What cannot be removed, and why
Every result here falls in one of three classes. Nothing is ever reported simply as "clean", because that word covers all three and hides the difference.
Removed
Proven
Absent from the output, and proven by re-reading our own result with the same parser that found it.
Reduced
Measured
Measurably weakened and reported as a number. The number is the claim — not the word "clean".
Not verifiable
Named, never claimed
Nobody outside the owner of a private detector can tell you the answer, so we do not guess.
The three we will not claim
Watermarks whose detector is private. Several major schemes keep the detector with their owner. Our deeper levels are known to damage marks of that family, and no honest party can tell you whether a specific image still trips a specific private detector. We do not guess.
Fingerprint databases. Platforms keep hashes of images they have seen. None of it is in your file, so there is nothing in your file to change.
Provenance bindings. Removing a signed manifest is easy and we do it. The current standard also pairs that manifest with an imperceptible mark and a perceptual fingerprint held by the issuer, so the record can be recovered without it.
The sensor's own noise signature identifies the individual camera body rather than the model. Our deepest level attenuates it and reports the number. It cannot be removed.
Source: the paper establishing sensor pattern noise as a camera identifier.
Two formats we read but do not rewrite: JPEG XL and ICO. They are identified and reported, and nothing in them is changed. Naming them costs us a claim; not naming them would hand somebody a file they believed was cleaned. The formats that are rewritten are JPEG, PNG, WebP, GIF, BMP, SVG, PSD, HEIC, HEIF, AVIF, TIFF and the raw files built on TIFF.
A PSD's layer names are overwritten in place, and the pass is allowed to refuse. A Photoshop document is a chain of nested lengths, and a wrong figure gives back a file that will not open. So the names are overwritten character for character, keeping every byte count identical — and if the layer section does not parse exactly, nothing is touched and the page says so. A refusal is reported to you; it is never quietly counted as a clean.
A raw file keeps its length after cleaning, and that is deliberate. Every offset inside a raw file points at another offset, so the identifying values are overwritten where they lie rather than cut out. The tags survive pointing at nothing. If you expected the file to get smaller, that is why it did not.
One more thing, and it is not obvious. A cleaned file that looks obviously cleaned is its own signal. If the output carried a distinctive trace of this tool, it would announce that its owner ran an anti-forensics tool — which in some situations is worse than the metadata it replaced. So the output uses ordinary settings and carries no marker of ours, and batch archives are stripped of their own identifiers too.