We removed a watermark from a PDF. Here is what it left behind.

The question nobody asks after removing a watermark

Search interest in removing watermarks is enormous and mostly mundane — draft stamps on your own documents, template markings, tool branding on output you paid for. This article is not about whether you can remove a watermark. You can; dozens of tools will do it. It is about the question that matters to everyone downstream: when a document arrives without the watermark it should have, or with a history it does not admit to, what does the file itself still say?

We could not find a published experiment that answers this concretely for PDFs, so we ran one: create a watermarked document, remove the watermark by the methods people actually use, and put every version through forensic inspection. What follows is the full setup and the actual findings, so the result is checkable rather than asserted.

Why we care is not hidden: we build the inspection tooling, and a determination published by Australia’s financial ombudsman this June — the companion piece to this article — turned on exactly this class of artifact. The complainant’s documents carried the generating tool’s own marks; the ombudsman spotted them and declined to rely on the documents. The obvious next question was: what happens when the marks are removed?

The experiment: one document, three removals

The test document mimics the AFCA case’s shape: a one-page call-transcript PDF carrying a tool watermark in three places — a diagonal “TRANSCRIBED BY AI MINUTES” overlay, a “Notes created … by AI Minutes” attribution line, and per-utterance confidence percentages in the body.

We then removed the watermark three ways, in increasing order of care:

• Edit-and-save (the common path): open the PDF, redact the watermark text, save. Desktop editors typically save this way — appending the change as a new revision while the original bytes remain in the file’s history chain.
• Clean rewrite (the careful path): rebuild the document into a fresh file containing only the final content. No prior revisions exist, because the file is genuinely new.
• Re-render (the launderer’s path): rasterise the page to an image and wrap it in a new PDF. Everything textual about the original — including its text layer — is gone.

What the inspection actually found

The edit-and-save result is the finding that matters, because it is the path most removals take. Quoting the inspection evidence on our test file: the report recorded that the “PDF was saved across multiple revisions (incremental updates)”, with “objects redefined across revisions” — supported by the file’s own %%EOF revision markers and cross-reference chain — alongside provenance noting the document “carries post-creation modification” with its producing software and dates. A reviewer reading that report knows, from the file alone, that this document is not in its original state. Paired with a watermark that should be there and is not, that is precisely the discrepancy worth escalating.

Two honest notes on the same result. First, the trail says edited, not why: incremental saves are also how ordinary, legitimate edits land, so the inspection surfaces the history as evidence for a reviewer rather than branding the file fraudulent — a design choice, because a modification record is a fact and fraud is a judgement. Second, on our synthetic file the overall risk band stayed low: a one-page fabricated transcript gives the content and arithmetic checks little to work with, so the structural history was the evidence, and the evidence is what a reviewer quotes.

The clean rewrite is the boundary, and we are stating it rather than burying it: a fresh file has no revision history, and nothing inside the file proves a watermark ever existed. What remains in that case sits outside the file — the mismatch between the document’s claimed origin and its actual producing software, the absence of marks its claimed source always applies, cross-checks against the counterparty’s copy — checks that need context a single file cannot supply.

The re-render is almost self-defeating: stripping a PDF to an image discards the text layer that makes a document machine-readable, and an all-image “statement” or “transcript” is itself the anomaly. Inspection treats it as a scan and says so.

What a watermark actually proves — and what its absence asks

The deeper lesson generalises well beyond our one-page test file. A watermark is a label, not a lock. It marks the copies made by honest tools and honest workflows; the one document it cannot mark is the one someone chose to clean. This is the same asymmetry provenance systems face everywhere: presence of a mark is meaningful evidence of origin, absence of a mark proves almost nothing on its own.

That asymmetry is why the practical question flips for anyone receiving documents. Do not ask “does this carry a watermark?” — ask “is this document’s history consistent with what it claims to be?” A bank statement claiming to come from a bank’s system but produced by a desktop editor; a “scan” with no capture metadata; a transcript whose file was revised after its stated creation date — each is the removal question in a form a file can actually answer.

The AFCA case shows the human version of this working: three artifacts the tool left in, spotted by an attentive ombudsman. The gap this experiment measures is what happens when the next submitter is less considerate — and the answer is that the common removal path still tells on itself structurally, while the careful path moves the contest to context, where single-file forensics honestly ends.

Run the experiment yourself

Nothing here requires our word for it. Take a PDF of your own, note a visible watermark or stamp, remove it with whatever editor you normally use, and inspect the result — with our tool or any forensic reader that shows revision structure and modification metadata. If your editor saved incrementally, you will find the trail exactly as we did.

For the receiving side, the workflow is one upload: the inspection reads structure, provenance, arithmetic and content together, and returns its findings as named evidence you can quote in a review note — which, as the AFCA determination shows, is the form a refusal ultimately has to stand on.