Microsoft Paint and Photos appear to embed an invisible, server-issued identifier into AI-generated images, including pictures created locally on Copilot+ PCs.
Reverse engineering shows that while image generation can happen on-device, prompts are still sent to Microsoft for moderation, which returns a unique GUID that is then hidden inside the image pixels.
The findings come from software engineer Xusheng Li, who analyzed recent versions of Paint, Photos, and several accompanying Windows DLLs and AI model files. The researcher traced Paint's image-generation workflow, inspected its Watermarker.dll component, and reproduced requests made to Microsoft's prompt-moderation service.
The analysis found that Paint ships local ONNX-based AI models used by features such as Cocreator. On supported Copilot+ PCs, these models can generate images using the device's NPU rather than sending the actual generation workload to Microsoft's servers.
Microsoft Paint is the long-running image editor bundled with Windows, while Photos is Microsoft's default image-management application. Both have gained generative AI features in recent releases as Microsoft expands AI capabilities across Windows and Copilot+ PCs.
However, local generation does not make the process fully offline.
Before Paint starts generating an image, it sends the user's prompt and selected style to a Microsoft Azure endpoint for moderation. The server responds with a revised prompt, a prompt-generation identifier, and a separate watermarkId.
That watermarkId is a 16-byte GUID unique to the generation request. Paint passes it to Watermarker.dll, which modifies the generated image's pixels in ways designed to be visually imperceptible.
According to Li’s reverse engineering work, the watermarking system distributes a 144-bit message across multiple image blocks and requires embedding each bit several times. Although the changes are not intended to be visible, testing on a synthetic 512×512 image showed that the watermarking process altered a substantial number of individual pixels.
This mechanism is separate from Paint's optional visible AI watermark, which places a Copilot logo on generated images. Turning the visible watermark off therefore does not disable the hidden one.
The same identifier also appears in Paint's C2PA Content Credentials metadata. In one captured example, the C2PA manifest identified Microsoft's com.microsoft.invismark.1 algorithm and contained the same GUID embedded in the pixels.
This creates two connected provenance layers: removable file metadata and an identifier encoded directly into the image itself. Paint also restricts direct AI-image exports to formats that preserve C2PA information, including PNG, JPEG, GIF, and Microsoft's .paint format.
The researcher found similar watermarking code in Microsoft Photos, where local Image Creator and Restyle Image operations also pass GUIDs into Watermarker.dll. One difference is that Photos appears able to continue if watermarking fails, whereas Paint treats such a failure as an unsuccessful generation.
Microsoft already documents that its AI image tools use online content filtering and attach C2PA credentials. What appears less clearly disclosed is that remote moderation also issues an identifier that is subsequently embedded invisibly into locally generated image pixels.
The finding is notable given recent cases in which Microsoft-held identifiers helped investigators correlate online activity to a specific Windows device. Unlike the persistent Windows GDID in that case, however, Paint's watermark GUID appears to be unique to a single generation rather than a persistent identifier for a device or user.
Leave a Reply