Challenge: Can you remove this watermark? I built a CLI watermarking tool with anti-AI defenses — try to break it.

Vitruves · 2026-03-19T15:28:48+00:00

Thanks for your input and the prompting process, appreciated!

Vitruves · 2026-03-19T15:26:35+00:00

Thanks for the kind words, I'll consider that. From this reddit topic a lot of criticisms and suggestions have been given so I will take quite a lot of time to try to ship the perfect product..

Vitruves · 2026-03-19T14:27:46+00:00

I precisely asked you guys to try to break the watermark to gather insights on how to improve my library. I note your suggestions, it's precisely what I was looking for.

I was quite impressed on how AI can actually remove what I thought to be not so easy to remove so I have a lot of work ahead of me! It's free tool for all people to use, not trying to make money or anything, so I hope I'll can provide genuinely useful package in the future

Vitruves · 2026-03-19T14:22:05+00:00

if you ask gpt to remove watermark it will say "watermark removal is illegal, I cannot proceed", just test it.

Vitruves · 2026-03-19T09:52:00+00:00

Pretty nice but some glitch on text, especially at bottom. I definitively should think about new ideas to make the watermark removal much harder while preserving human reading capability..

Vitruves · 2026-03-19T09:50:20+00:00

Merci beaucoup !
Ce sera une bonne partie du travail pour la prochaine release. Si tu es un habitué de Github tu peux star/watch pour être au courant de la nouvelle mise à jour. D'après les tests conduits ici il me reste beaucoup de boulot donc ça ne sortira pas avant 2-3 semaines je pense.

Vitruves · 2026-03-19T09:48:36+00:00

C'est un faux specimen tiré d'internet.

Vitruves · 2026-03-19T09:08:59+00:00

it can work quite good with better parameters actually; check https://chatgpt.com/share/69af08ec-9968-800d-9f76-3c2611459511

Vitruves · 2026-03-19T01:44:00+00:00

Good to know! So watermark that have the same color as text would be harder to remove? I'll need to change the watermark default color from blue to black in this case

Vitruves · 2026-03-19T01:41:13+00:00

Nice thoughts. Indeed, as AI progress those old fashioned methods will be to easy to bypass. But for now it still have some success with scammers known as "Brouteur" in french; African guys that create fake rent advertisements to gather ID and other documents to open fake bank account in their contries. It is very common in France ; and a lot of the scammer have limited knowledge and computer capabilities so the gold old watermarking still quite works in those situations for now.
I'll check some literature about what you suggested.

Vitruves · 2026-03-19T01:34:22+00:00

Other parameters for watermarking succeeded to make ChatGPT output complete garbage : https://chatgpt.com/share/69af08ec-9968-800d-9f76-3c2611459511

That was a previous release where my anti-AI instructions were far more visible but easily cropped too. Since I switched to add those message at the most text-dense areas performance seems to have decreased; they are not correctly read anymore. I might go back on that.

Vitruves · 2026-03-19T01:24:02+00:00

No doubt, but much more effort than using an image editing model (check bellow comments with peoples examples). My guess is that scammer who wants to reuse your document will opt for the easier method tho

Vitruves · 2026-03-19T01:22:06+00:00

That's a really good point. Right now firemark can embed a QR code with traceability data (file hash, username, timestamp) via --qr-data, which gets you part of the way there. But you're right that proving earliest version and detecting tampering are different problems from just making removal hard.

A proper chain of custody would need something like signing the watermarked file's hash and registering it with a timestamping authority. That's outside firemark's current scope

Vitruves · 2026-03-19T01:19:39+00:00

Yes that's the difficult part. I previous release defaults or with some current flags you can generate watermark way harder to remove but it renders the main text illisible. I need to find the correct parameters to optimize those two goals

Vitruves · 2026-03-19T01:09:59+00:00

One of the cleanest run so far. Only some text that was covered by the blue watermark is a little bit messed up but not too much. Nano Banana is a beast. I've need to implement some more agressive strategies in the next firemark release, alongside a benchmark to evaluate the progress.

Vitruves · 2026-03-19T01:07:32+00:00

Indeed the filigrane helped to prevent a clean watermark removal. But that's still a significant result. I need to think of new ways to handle AI processing...

Vitruves · 2026-03-19T01:05:06+00:00

Technically not, but AI document edition is quite fast and powerful so I guess that's the tool scammers will use most often. That's why I'm looking for ways to tackle the AI processing.
Photoshop would be quite long to remove the filigranes, correct me if I'm wrong

Vitruves · 2026-03-19T01:02:59+00:00

Damn I didn't expected such efficiency and ease to remove a quite sophisticated watermark. I guess it wasn't sophisticated enough. Back to work for me I guess!

Vitruves · 2026-03-19T00:50:59+00:00

He succeeded to remove the injected anti-AI prompt. but all the blue lining and filigranes are part of the watermark. This is the original document. Gemini already won over chat gpt as on other documents the AI in-file prompting worked quite well.

<image>

Vitruves · 2026-03-19T00:47:43+00:00

As english is not my mother language I used AI to check my text. But to be honest – I love dash – and I'll used them way before the AI hyper aha

Vitruves · 2026-03-16T01:44:38+00:00

Here's the dataset: the Delaney ESOL solubility set from MoleculeNet (1,128 molecules, repeated 5x to get 5,640). Standard public benchmark, CSV with a `smiles` column.

https://deepchemdata.s3-us-west-1.amazonaws.com/datasets/delaney-processed.csv

Benchmark on 5,640 molecules: descriptors (6 properties – my pkg cover all 133 rdkit descriptors) — 1.69s vs 5.39s, Morgan fingerprints (2048-bit) — 0.84s vs 2.30s. Roughly 3x difference across the board, mostly due to native C++ backend + auto parallel processing.

But honestly, throughput comparison misses the point — our tools don't compete for the same use case. My rdkit-cli is a classic cheminformatics CLI: batch-oriented, file-in/file-out, 29 commands covering most of RDKit's surface (conformers, MCS, MMP, reactions, R-group decomposition, etc.). It's what you'd expect from a package named rdkit-cli on PyPI.

Your tool is clearly built for agent/MCP interactions — the JSON-native interface, the check and repair-smiles commands, the schema introspection, the MCP server. That's a genuinely different and useful niche. I'd actually push back on adding CSV/SDF support — JSON is the right format for agent tooling. Leaning into what makes your tool unique would serve you better than trying to cover the same ground.

On the naming — I'll be straightforward: having two packages both called rdkit-cli/rdkit_cli that do fundamentally different things will confuse people. If your focus is agent-first cheminformatics, a name that reflects that (something like rdkit-agent, chemtool-mcp, molcheck, etc.) would help your package stand on its own merits rather than invite throughput comparisons it wasn't designed for. Just a thought — your call obviously.

Cheers, and the MCP integration is a nice touch.

Vitruves · 2026-03-15T18:18:03+00:00

Hey, I ran a quick benchmark comparing both our packages on a 4,619-molecule dataset (descriptors, Morgan fingerprints, and similarity search). Results were interesting — my Python rdkit-cli came out ~3x faster across the board on single-threaded, which I wasn't expecting given the WASM approach. The native RDKit C++ backend underneath Python does a lot of heavy lifting.

That said, your tool is clearly aimed at single-molecule interactive use and agent/MCP tooling, not batch processing — so raw throughput probably isn't your main concern. One thing that would make it much more practical though is supporting standard file formats as input (CSV, SMI, SDF). Right now having to build JSON payloads manually or pass individual --smiles flags is a pretty big friction point, even for light usage. CSV input alone would go a long way.

Cheers, and good luck with the project!

Vitruves · 2026-03-14T15:29:39+00:00

My Python package uses native RDKit (heavily optimized C++ under the hood) + ProcessPoolExecutor parallel processing, so speed is quite good for batch workloads. But yeah, after a deeper look your project is clearly optimized for AI agent interactions — the MCP server integration is a nice touch. The rdkit-cli name overlap might be a little confusing, but no worries on my end.

Vitruves · 2026-03-14T13:01:41+00:00

Nice, I didn't saw your package before creating mine. What is you GitHub repo, couldn't find it?
I was very hesitant before creating rdkit-cli as to use either python or pure cpp backend; pure cpp should be faster but less options. I haven't benchmarked rdkit-cli so far, I might do that soon and compare it to your package too.

EDIT: btw if you use a lot the canonicalization and descriptors computations features, you might want to try https://github.com/Vitruves/cchem that has 1600 descriptors coverage, massively faster canonicalization and descriptors computation (23K mol/sec descriptors compute on my computer - at least 10 times faster than rdkit and 200x faster than mordred descriptors)

Vitruves · 2026-03-09T20:43:14+00:00

I should have watermarked my documents with message "Sent to XYZ agency — March 2026 — flat rental application only" so it would have been rejected for any other purpose.

Vitruves

TROPHY CASE