Glonce

Microsoft Paint invisibly watermarks AI images with a server GUID

securityThe Glonce editorsHacker News🔥78Glonce rating78Impact50Novelty72Relevance82Surprise68Players75Credibility87
Microsoft Paint invisibly watermarks AI images with a server GUID

Researcher Xusheng Li reverse engineered how Microsoft Paint generates AI images and published the analysis on August 20, 2026. The investigation started out of curiosity about Paint's on-device AI features; using Binary Ninja MCP together with the Codex coding assistant to analyze the binaries, Li found that Paint, examined at Windows App package version 11.2605.71.0, ships four local model files in an XOR-obfuscated .onnxe format: seg.onnxe (23.1 MB), inseg_enc.onnxe (28.0 MB), inseg_dec.onnxe (16.5 MB) and mager.onnxe (302.4 MB, the largest). The older files decrypt with the key "Microsoft_2023"; a newer key used for the other three is a 4,096-byte alphanumeric string.

Paint already has a documented, user-facing setting, Never / Always / Ask every time, that adds a small visible Copilot-logo watermark to generated images. While examining the DLLs behind that feature, Li noticed a separate Watermarker.dll that, at 1.67 MB, looked too large for a simple logo overlay, a suspicion sharpened by the recent Claude Code text-watermark announcement. Tracing the code turned up a second function, WmkWriteWatermark, called every time Paint finishes a local Stable Diffusion generation. If that call fails, Paint turns the entire generation into an error rather than returning an unwatermarked image. The function demands an exact 16-byte payload, wraps it into an 18-byte, 144-bit message (a fixed prefix byte, the 16 bytes, and a checksum byte), and quantizes small changes across 8-pixel-aligned image blocks, requiring the image to be at least 192 by 192 pixels and each of the 144 bits to be placed at least three times. Called directly on a synthetic 512-by-512 test image, the routine altered 193,376 of the image's 262,144 pixels. Tracing the 16-byte payload back through its callers, Li found it typed as a winrt::guid: the invisible watermark is a GUID.

The GUID does not originate on the device. Before either app runs its local model, it sends the prompt and style to a Microsoft moderation endpoint at apsaiservices-a0fqcjc6bzbhgdcd.b02.azurefd.net/v1/paint-cocreator/moderate-prompt. Li sent two test prompts through that endpoint, reusing Paint's own authenticated session. For "a cobalt blue circle above a tiny orange square," the server returned HTTP 200 with a revised prompt, a promptGenerationId, a watermarkId (83424621-03cb-40e3-9808-a9fae837156d), and containsHumanReference: false; a prompt describing a person in a blue hat returned containsHumanReference: true and a different pair of IDs, indicating the field is a server-side classification of whether the prompt refers to a human. It is that server-issued watermarkId, not anything generated locally, that WmkWriteWatermark later stamps into the pixels once the on-device model has produced the image. In other words, an image Paint calls "locally generated" still depends on a round trip to Microsoft before it can be finished.

The same identifier turns up again elsewhere. Paint also signs saved images with C2PA Content Credentials through ProvenanceHelper.dll; the signing request sends a second server-issued ID, promptGenerationId, letting Microsoft's backend link the request to the same generation. Inspecting a PNG saved directly from Paint's Image Creator, Li found an 18,979-byte caBX chunk holding a signed manifest whose c2pa.soft-binding block names the algorithm com.microsoft.invismark.1 and carries a value equal to the very same watermarkId GUID embedded in the pixels, alongside a c2pa.watermarked action described as "Content watermarked by Microsoft Responsible AI." The pixel watermark and the signed file-level metadata are therefore two expressions of one per-generation, server-issued value, and Microsoft cryptographically signs the link. Because only PNG, JPEG, GIF, and Paint's own .paint format can carry a C2PA manifest, Paint restricts AI-generated saves to those formats; BMP, which cannot embed one, is not offered.

This traces back to two different generation paths. Image Creator runs entirely in Microsoft's cloud on Azure OpenAI ImageGen, so the server can hand Paint a file that is already watermarked and signed. Cocreator, on supported Copilot+ PCs, runs Stable Diffusion locally on the device's NPU but still requires a Microsoft account and an internet connection, because the prompt still has to go out for moderation and the returned watermark ID still has to be embedded locally before the image is usable; Li argues this is exactly why Watermarker.dll has to exist for a feature billed as local. Microsoft Photos, examined at package version 2026.11060.2004.0, ships the identical Watermarker.dll and calls the same WmkWriteWatermark from its own Image Creator and Restyle Image features, so the behavior is not unique to Paint. One difference: if the watermark call fails, Photos logs the error and appears to still return the image, while Paint blocks the generation outright.

Microsoft's own Image Creator support page discloses that it filters prompts and that generated images "will contain C2PA manifest helping users identify that it is an AI generated image," and that user and device identifiers are collected with prompts for abuse prevention. Li writes: "Microsoft discloses the existence of C2PA metadata, but I could not find a disclosure explaining the server-issued watermark GUID, its association with prompt moderation, or its presence in the pixels." Li raises, without asserting a causal link, that Article 50 of the EU AI Act, whose transparency rules took effect August 2, 2026, requires AI-generated content to carry a detectable, machine-readable mark, though not specifically a prompt-linked GUID. The write-up demonstrates only writing a GUID into an image, not reading one back out, so no extraction capability is shown. Li also leaves one question open: if the remote generation endpoint could be made to hand back a raw image before watermarking and provenance packaging run, whether that would count as intended behavior, a product bug, or a security vulnerability depends on a Microsoft trust boundary that Li says is not publicly documented. Modifying Paint or Photos to skip both moderation and the watermark looks possible, Li adds, but calls that no new risk, since anyone can already run Stable Diffusion directly without either mechanism.

Key facts

  • Reverse engineering by researcher Xusheng Li found that before Microsoft Paint or Photos generate an AI image locally, both apps send the prompt to a Microsoft moderation server first, even when the image itself is produced on-device via Stable Diffusion and an NPU.
  • The moderation server returns a per-request GUID (watermarkId) that Paint's Watermarker.dll embeds as an invisible pixel watermark, a step separate from the app's visible Copilot-logo watermark setting (Never / Always / Ask every time), which does not control it; a test on a 512-by-512 image altered 193,376 of its 262,144 pixels.
  • The identical watermarkId GUID also appears, cryptographically signed, in the saved image's C2PA metadata (algorithm com.microsoft.invismark.1), tying the invisible pixel watermark and the file-level provenance record to the same server-issued value.
  • Microsoft Photos, examined at package version 2026.11060.2004.0, contains the same Watermarker.dll and calls it from its own Image Creator and Restyle Image features; unlike Paint, which turns a failed watermark into a generation error, Photos logs the failure and appears to still return the image.
  • Xusheng Li says Microsoft's public disclosure covers prompt filtering and the presence of C2PA metadata but not that the metadata carries a prompt-linked GUID or that the GUID is separately embedded in the pixels, and separately notes, without claiming a causal link, that the EU AI Act's Article 50 transparency-mark requirement took effect August 2, 2026.

Why it matters

The finding exposes a gap between how Paint and Photos market local AI generation and what the code does. Cocreator on Copilot+ PCs is presented as running on-device, but the invisible watermark it stamps into every image only exists because the prompt was sent to Microsoft first and a server returned an identifier; without that round trip, WmkWriteWatermark has no payload to embed. The same identifier is then cryptographically notarized a second time in the image's C2PA metadata, so one server-issued GUID links a specific saved image back to a specific prompt-moderation event, invisibly and independent of the visible-watermark toggle. Xusheng Li notes that invisible watermarking itself is not new (Google's SynthID and Bing's own hidden watermark do it too), so the contribution here is documenting this specific server-linked mechanism inside Paint and Photos, work done by decompiling the shipped DLLs with Binary Ninja MCP and the Codex coding assistant, then checking the behavior against Microsoft's live moderation and provenance endpoints rather than treating it as a formal spec.

Who it affects

Windows users who generate images with Paint's Image Creator or Cocreator, or with Photos' Image Creator and Restyle Image, on a Copilot+ PC or otherwise; the watermark and metadata are added regardless of whether the visible watermark is turned off. It also matters to anyone auditing AI content provenance, since the C2PA c2pa.soft-binding value and the pixel watermark are shown to be the same GUID. Users in the EU fall under Article 50 of the EU AI Act, whose transparency-mark rule took effect August 2, 2026, though Xusheng Li stops short of saying Microsoft built this specific mechanism to satisfy it.

How to use it

Paint's visible-watermark setting (Never / Always / Ask every time) governs only the small Copilot logo; it has no effect on the invisible pixel watermark or the C2PA metadata, both of which are added unconditionally to AI-generated saves. Any AI output saved as PNG, JPEG, GIF, or Paint's .paint format carries the C2PA manifest, readable with standard C2PA tooling; BMP is not offered as a save format for AI results specifically because it cannot hold that manifest. Xusheng Li does not present a way to opt out: the write-up notes only that modifying Paint or Photos to skip both prompt moderation and the watermark looks technically possible, and treats that as no new risk, since running Stable Diffusion directly outside these apps already avoids both mechanisms.

How solid is it

This is first-hand binary analysis, not speculation: Xusheng Li decompiled the shipped DLLs (using Binary Ninja MCP with the Codex coding assistant), traced the exact call chain and byte-level payload format, then verified the design against live systems by sending real prompts through Paint's authenticated session and inspecting a real saved PNG's C2PA chunk. Specific details such as the 18,979-byte chunk size, the matching GUID appearing in both the pixel watermark and the c2pa.soft-binding value, and the exact error codes inside WmkWriteWatermark indicate direct inspection rather than secondhand description. Xusheng Li is also careful to flag uncertainty explicitly, writing "appears to" about Photos' failure behavior and "I found no evidence that" about whether containsHumanReference affects watermarking, and leaving open whether the gap in the cloud path is intended design, a bug, or a vulnerability. The piece is an independent write-up on a personal blog; the source gives no indication that Microsoft has confirmed, responded to, or been notified of the findings, and no CVE or vendor statement is mentioned.

Risks and caveats

The write-up demonstrates only writing a GUID into an image, not reading one back out, so no extraction or recovery capability is shown. The source does not say whether Microsoft has been notified of or has responded to the findings, gives no disclosure timeline, and names no watermarked user, image, or prompt beyond Xusheng Li's own two test prompts. It does not state how long Microsoft retains prompts, the two GUIDs, or the link between them, nor when watermarking was added to Paint or Photos, only the app versions examined (Paint 11.2605.71.0, Photos 2026.11060.2004.0). The EU AI Act connection is explicitly offered as speculation, "might be related," not an asserted cause, and the Act's own rule does not require a prompt-specific GUID. Whether the cloud-generation path could be exploited to obtain an unwatermarked, unsigned image, and whether doing so would be a bug or a vulnerability, is left as an open question the source says depends on a Microsoft trust boundary it cannot see from outside.

“Microsoft discloses the existence of C2PA metadata, but I could not find a disclosure explaining the server-issued watermark GUID, its association with prompt moderation, or its presence in the pixels.”

— Xusheng Li, researcher