Paint and Photos quietly tag locally generated images with a server-issued GUID

Out of curiosity, researcher Xusheng Li set out to understand how image generation works in Microsoft Paint, and found more than he had bargained for. It turned out that Windows ships with local AI models (the .onnxe files are just ordinary ONNX encrypted with a simple XOR), but “local” here doesn't mean “entirely on-device.”

An invisible mark instead of a visible logo

Paint has a setting that adds a visible watermark — a little Copilot logo in the corner. But what caught the author's eye was a suspiciously large Watermarker.dll library (1.67 MB). Inside was a standalone function, WmkWriteWatermark, which, after an image is generated locally, makes subtle changes to the pixels: in a 512×512 test image, roughly 193,000 of 262,000 pixels changed. This is a content-adaptive watermark in the vein of SVD, and the separate visible-mark setting has no control over it.

The identifier comes from the server

The most interesting part is the origin of those 16 embedded bytes. It's a winrt::guid, and it comes from the network. Before running the local model, Paint sends the prompt and style to an Azure server for moderation. The response contains not only the “edited” prompt but also a pair of GUIDs: promptGenerationId and watermarkId. It's the latter that gets baked into the pixels. What's more, the app attaches the previous request's identifier to the next one, letting the server chain generations together.

The same GUID also turns up in the image's signed C2PA manifest — in the c2pa.soft-binding field, with the algorithm com.microsoft.invismark.1. In other words, the file-level manifest and the pixel-level watermark are two layers of a single provenance system: even if you strip the metadata, the image can still be matched to a record via the hidden mark.

Why it's built this way

The cloud-based Image Creator (running on the Azure OpenAI ImageGen engine) can mark the image itself. But Cocreator on a Copilot+ PC generates the image on the local NPU — so the mark has to be embedded on the device, after inference. Tellingly, if WmkWriteWatermark fails, Paint turns the entire generation into an error and won't hand the image over to the user (Photos, in the same situation, behaves more gently and simply writes to a log). The list of save formats is tailored to C2PA as well: PNG, JPEG, GIF and a proprietary .paint are available, while the classic BMP, which can't store a manifest, has vanished.

Microsoft does disclose that it applies remote content filtering and adds C2PA Content Credentials. But, the author notes, the company nowhere explains that this identifier is tied to prompt moderation and physically present in the pixels — and that is already a matter of privacy and the right to know. In theory you could curb this behavior by modifying the app, but that grants no new capability: anyone can already run Stable Diffusion without any marks at all.

Source: Hacker News