MS Paint and Photos Embed Invisible GUID Watermarks in Local AI Images

TL;DR: Your Local AI Images Carry a Hidden Server-Issued ID

Microsoft Paint and Photos embed a unique, invisible watermark into AI-generated images—even when the image is generated locally on your device. This watermark is a 16-byte GUID issued by Microsoft's remote moderation server, not a random value generated on your PC.

• Remote moderation: Prompts are sent to Microsoft's servers for content filtering, even for local NPU-based generation.
• Invisible watermark: A GUID from the moderation response is embedded into image pixels using a custom algorithm in Watermarker.dll.
• Linked to C2PA metadata: The same GUID appears in the C2PA Content Credentials, creating a cryptographic soft-binding between the pixel watermark and provenance data.
• Not optional: The invisible watermark is applied regardless of the visible watermark setting and cannot be disabled by users.
• Privacy implications: The GUID could potentially be linked to your Microsoft account and prompt history, raising significant privacy concerns.

The Discovery: A Deep Dive into Microsoft's Local AI Pipeline

Researcher Xusheng recently published a detailed reverse-engineering analysis of Microsoft Paint and Photos, uncovering a sophisticated watermarking system that operates silently in the background. The research, which began as a curiosity about Paint's AI features, revealed that Microsoft ships local ONNX models for image generation on Copilot+ PCs.

These models—including a 302 MB Stable Diffusion variant—are encrypted with a custom key and run directly on the device's NPU. However, the complete operation is far from local. Before any image generation occurs, the app sends the user's prompt to Microsoft's cloud service for moderation.

How the Invisible Watermark Works

The moderation endpoint (apsaiservices-a0fqcjc6bzbhgdcd.b02.azurefd.net/v1/paint-cocreator/moderate-prompt) returns a JSON response containing a revisedPrompt, a promptGenerationId, and a watermarkId. This watermarkId is a GUID that becomes the payload for the invisible watermark.

The watermarking process is implemented in Watermarker.dll, a 1.67 MB library that seems disproportionately large for the simple task of adding a visible Copilot logo. The core function, WmkWriteWatermark, embeds a 144-bit message (0x4C prefix + 16-byte GUID + checksum) into the image pixels using a content-adaptive, SVD-style algorithm.

The encoder modifies pixel values in 3-by-5 matrix blocks, quantizing values to represent each bit of the message. The algorithm requires each bit to be placed at least three times across the image, ensuring robustness against cropping or compression. In a synthetic test, 193,376 of 262,144 pixels were altered—a significant but invisible change.

The C2PA Connection: Two Layers of the Same System

The invisible watermark is not the only provenance mechanism. Paint also attaches C2PA Content Credentials metadata to saved files. The C2PA manifest contains a signed c2pa.soft-binding assertion that explicitly names the algorithm com.microsoft.invismark.1 and records the same GUID used in the pixel watermark.

This creates a powerful forensic link. Even if a user strips the C2PA metadata from the file, the invisible pixel watermark remains, allowing Microsoft to potentially match the image back to its original moderation request and, by extension, the user's account and prompt.

The C2PA manifest also includes a visible action: c2pa.watermarked with the description "Content watermarked by Microsoft Responsible AI." This disclosure is accurate but does not explain the full extent of the tracking capability.

Why Local Generation Still Requires the Cloud

Microsoft's architecture reveals a deliberate division of labor. For cloud-based Image Creator, the entire pipeline—generation, watermarking, and provenance signing—happens on Microsoft's servers. For Cocreator on Copilot+ PCs, the image is generated locally, but the prompt must still go to the cloud for moderation.

This design explains why Paint needs a local watermark implementation at all. Since the image is generated on-device, the watermark must be applied locally. The research shows that if WmkWriteWatermark fails, Paint treats the entire generation as an error rather than returning an unmarked image—highlighting the importance Microsoft places on this feature.

Interestingly, the Photos app implements the same watermarking logic but with a critical difference: if the watermark fails, Photos logs an error and continues, returning the unmarked image. This inconsistency suggests a lack of unified policy across Microsoft's apps.

Privacy and Security Implications

The discovery has sparked immediate privacy concerns. As one Hacker News commenter noted, this system resembles the "yellow printer dots" used by laser printers—except it's digital and potentially linked to user identities.

The researcher emphasizes that the GUID is not just a random identifier. It's issued by Microsoft's servers alongside the moderation request, meaning Microsoft could theoretically correlate the watermark in any AI-generated image with the original prompt and user account. This capability exists even for images generated entirely on-device.

The transparency requirements of the EU AI Act (Article 50) mandate that AI-generated content carry machine-readable marks. Microsoft's C2PA metadata disclosure meets this requirement. However, the invisible pixel watermark and its link to user identity go beyond what the regulation explicitly requires, raising questions about whether users have a right to know about this additional tracking layer.

Format Restrictions and the BMP Gap

Microsoft's provenance system also explains a curious user-facing limitation. When saving AI-generated images from Paint, users are restricted to PNG, JPEG, GIF, and Paint's proprietary .paint format. The classic BMP format is conspicuously absent.

This restriction aligns with C2PA's technical requirements. PNG stores manifests in caBX chunks, JPEG uses APP11 segments, and GIF has its own application extension. BMP, however, cannot embed metadata without external manifests, making it incompatible with Microsoft's provenance requirements.

This is a subtle but significant design choice. Microsoft is effectively forcing users to save in formats that preserve the C2PA metadata, ensuring the provenance trail remains intact.

The Bigger Picture: AI Provenance and User Trust

The discovery comes at a time when AI content provenance is a major industry focus. Google's SynthID and Microsoft's own Bing Image Creator already use invisible watermarking. However, the direct link between the watermark and a server-issued GUID tied to prompt moderation is a new level of integration.

Microsoft's support documentation discloses that prompts are collected for abuse prevention and that C2PA metadata is added. What it does not disclose is that the C2PA manifest contains a GUID identifying the invisible pixel watermark—or that this GUID originates from the same moderation request that processes the user's prompt.

For privacy-conscious users, the implications are clear: every AI-generated image from Paint or Photos carries a unique identifier that could potentially be traced back to the user. While Microsoft states this is for safety and provenance, the lack of transparency about the full extent of this system is concerning.

The researcher also notes a potential security question: if the cloud image generation endpoint can be accessed directly without watermarking, it might be possible to obtain unwatermarked images. However, this would require bypassing Microsoft's API security and does not provide new capabilities beyond what open-source Stable Diffusion already offers.

Conclusion: A New Era of AI Content Tracking

This research represents the first documented analysis of Microsoft's invisible watermarking system in Paint and Photos. It reveals a sophisticated, multi-layered provenance system that operates silently, even for locally generated content.

While the visible watermark can be disabled and the C2PA metadata can be stripped, the invisible pixel watermark persists. It is a permanent, unremovable identifier that ties every AI-generated image to a specific moderation request—and potentially to a specific user.

As AI image generation becomes more common in consumer tools, the balance between provenance tracking and user privacy will become an increasingly critical conversation. Microsoft's implementation, while technically impressive, raises important questions about consent, transparency, and the right to generate content without persistent surveillance.