Reverse engineer Xusheng Li found that Paint and Photos alter output pixels with a GUID untouched by the visible-watermark setting.
By Ryan Merket · Published
Primary source: Xusheng Li
Why it matters #
Microsoft's on-device image generation still depends on remote moderation and embeds a server-issued identifier in the output, binding local AI to cloud provenance controls.
Microsoft Paint and Microsoft Photos embed server-issued identifiers into the pixels of AI images generated on a user's device, according to reverse engineering published on August 24th by security researcher Xusheng Li. The invisible watermark remains active when a user disables Paint's separate, visible Copilot logo.
Li is a core developer of the Binary Ninja reverse-engineering platform and leads development of its debugger at Vector 35. He began examining Paint to determine whether its AI tools relied entirely on remote services. His analysis of Paint version 11.2605.71.0 instead found encrypted ONNX models shipped with the Windows app, including a 302.4 MB image-generation model, alongside the DLL responsible for watermarking output.
The server supplies the watermark
Li traced Paint's local Cocreator workflow from prompt submission through image generation. Before the on-device model runs, Paint sends the prompt and selected style to a Microsoft moderation endpoint. The response includes a revised prompt, a prompt-generation ID and a separate watermarkId
, each formatted as a GUID.
Paint then supplies the revised prompt to its local Stable Diffusion pipeline. After the device's neural processing unit generates the image and output safety checks run, Watermarker.dll
writes the 16-byte watermarkId
into the image pixels. Paint treats a watermarking failure as a failure of the entire generation rather than returning an unmarked image, Li found.
The encoding function constructs a 144-bit message from the GUID, a prefix and a checksum. It distributes that message through small changes to selected image blocks, requiring each bit to be placed at least three times. The changes are designed to be imperceptible rather than displayed as metadata or a logo.
Paint's visible-watermark menu follows a different code path. Users can choose whether Paint adds a Copilot logo to the corner of an image, but that preference does not control the pixel-level watermark uncovered by Li.
The distinction matters because Microsoft describes Cocreator as an on-device feature for Copilot+ PCs. Microsoft's documentation says the NPU generates images locally while Azure services perform safety checks. Microsoft also requires a signed-in account and internet connection, and says it collects prompts plus device and user identifiers for abuse prevention and monitoring.
Li's work fills in the mechanism between those disclosed steps: the moderation service issues the value that Paint subsequently preserves inside the locally generated output. Paint also sends the previous prompt-generation ID with the next moderation request, explicitly linking successive requests at the protocol level.
The same ID appears in Content Credentials
Paint separately attaches a signed C2PA manifest to generated images. Li inspected a PNG produced by Paint and found the same watermarkId
in a c2pa.soft-binding
assertion naming the algorithm com.microsoft.invismark.1
. The manifest described the image as watermarked by Microsoft Responsible AI.
The C2PA specification defines this type of invisible watermark as a soft binding. It allows an image to be matched with provenance information even after embedded file metadata has been removed or the image has been re-encoded. Microsoft has also published InvisMark research code for durable AI-image provenance, although Li's analysis does not establish that Paint's compiled implementation is identical to that repository.
Microsoft already discloses that AI features in Paint add C2PA manifests. Its support materials also disclose cloud filtering and collection of prompts and user and device attributes. They do not describe the pixel-level encoding or explain that a value returned during remote moderation is embedded into locally generated output.
A GUID alone does not prove that an image identifies a particular person. Li's stronger finding is the end-to-end reuse of a unique, server-assigned value: Microsoft returns it during prompt moderation, Paint writes it into the pixels, and the signed provenance manifest records the same identifier.
Photos uses the same watermarking library
Li found another copy of Watermarker.dll
in Microsoft Photos version 2026.11060.2004.0. His analysis indicates that the app's local Image Creator and Restyle Image operations pass a server-issued prompt-generation GUID into the same watermarking function after on-device inference.
Photos handles failures differently. Its code appears to log the watermarking error and continue returning the image, while Paint blocks the result when the invisible watermark cannot be applied.
Microsoft's Photos documentation confirms that the relevant models come with a Copilot+ PC or are downloaded from the Microsoft Store. It also says users must remain signed in and online for cloud safety services, prompts undergo abuse monitoring, and generated or edited images receive C2PA Content Credentials.
The reverse engineering narrows Microsoft's definition of local AI. The costly image inference can run on the user's hardware, while prompt review, identifier issuance and provenance signing remain cloud-controlled. The resulting file carries that relationship in two places: a removable C2PA manifest and a second identifier embedded directly into its pixels.