Microsoft Paint embeds server-issued IDs in locally generated AI images

Microsoft Paint and Microsoft Photos embed server-issued identifiers into the pixels of AI images generated on-device, according to reverse engineering published on August 24 by security researcher Xusheng Li. The invisible watermark, which uses a 16-byte GUID from Microsoft's moderation endpoint, remains active even when users disable Paint's visible Copilot logo. Li, a core developer at Vector 35, found that Paint version 11.2605.71.0 ships encrypted ONNX models and a Watermarker.dll that writes the watermark, and the same ID appears in C2PA Content Credentials.

Microsoft Paint embeds server-issued IDs in locally generated AI images Reverse engineer Xusheng Li found that Paint and Photos alter output pixels with a GUID untouched by the visible-watermark setting. By Ryan Merket /author/ryan-merket · Published Primary source: Xusheng Li https://xusheng.dev/posts/reversing/mspaint invisible watermark/main/ Why it matters Microsoft's on-device image generation still depends on remote moderation and embeds a server-issued identifier in the output, binding local AI to cloud provenance controls. Microsoft Paint https://support.microsoft.com/en-us/windows/ai/ai-apps/use-copilot-pc-features-in-paint and Microsoft Photos embed server-issued identifiers into the pixels of AI images generated on a user's device, according to reverse engineering published on August 24th https://xusheng.dev/posts/reversing/mspaint invisible watermark/main/ by security researcher Xusheng Li. The invisible watermark /models/fal/invisible-watermark remains active when a user disables Paint's separate, visible Copilot logo. Li https://xusheng.dev/ is a core developer of the Binary Ninja reverse-engineering platform and leads development of its debugger at Vector 35. He began examining Paint to determine whether its AI tools relied entirely on remote services. His analysis of Paint version 11.2605.71.0 instead found encrypted ONNX models shipped with the Windows app, including a 302.4 MB image-generation model, alongside the DLL responsible for watermarking output. The server supplies the watermark Li traced Paint's local Cocreator workflow from prompt submission through image generation. Before the on-device model runs, Paint sends the prompt and selected style to a Microsoft moderation endpoint. The response includes a revised prompt, a prompt-generation ID and a separate watermarkId , each formatted as a GUID. Paint then supplies the revised prompt to its local Stable Diffusion pipeline. After the device's neural processing unit generates the image and output safety checks run, Watermarker.dll writes the 16-byte watermarkId into the image pixels. Paint treats a watermarking failure as a failure of the entire generation rather than returning an unmarked image, Li found. The encoding function constructs a 144-bit message from the GUID, a prefix and a checksum. It distributes that message through small changes to selected image blocks, requiring each bit to be placed at least three times. The changes are designed to be imperceptible rather than displayed as metadata or a logo. Paint's visible-watermark menu follows a different code path. Users can choose whether Paint adds a Copilot logo to the corner of an image, but that preference does not control the pixel-level watermark uncovered by Li. The distinction matters because Microsoft describes Cocreator as an on-device feature for Copilot+ PCs. Microsoft's documentation https://support.microsoft.com/en-us/windows/ai/ai-apps/use-copilot-pc-features-in-paint says the NPU generates images locally while Azure services perform safety checks. Microsoft also requires a signed-in account and internet connection, and says it collects prompts plus device and user identifiers for abuse prevention and monitoring. Li's work fills in the mechanism between those disclosed steps: the moderation service issues the value that Paint subsequently preserves inside the locally generated output. Paint also sends the previous prompt-generation ID with the next moderation request, explicitly linking successive requests at the protocol level. The same ID appears in Content Credentials Paint separately attaches a signed C2PA manifest to generated images. Li inspected a PNG produced by Paint and found the same watermarkId in a c2pa.soft-binding assertion naming the algorithm com.microsoft.invismark.1 . The manifest described the image as watermarked by Microsoft Responsible AI. The C2PA specification https://spec.c2pa.org/specifications/specifications/2.4/guidance/Guidance.html defines this type of invisible watermark as a soft binding. It allows an image to be matched with provenance information even after embedded file metadata has been removed or the image has been re-encoded. Microsoft has also published InvisMark research code https://github.com/microsoft/InvisMark for durable AI-image provenance, although Li's analysis does not establish that Paint's compiled implementation is identical to that repository. Microsoft already discloses that AI features in Paint add C2PA manifests https://support.microsoft.com/en-us/windows/ai/ai-apps/use-image-creator-in-paint-to-generate-ai-art . Its support materials also disclose cloud filtering and collection of prompts and user and device attributes. They do not describe the pixel-level encoding or explain that a value returned during remote moderation is embedded into locally generated output. A GUID alone does not prove that an image identifies a particular person. Li's stronger finding is the end-to-end reuse of a unique, server-assigned value: Microsoft returns it during prompt moderation, Paint writes it into the pixels, and the signed provenance manifest records the same identifier. Photos uses the same watermarking library Li found another copy of Watermarker.dll in Microsoft Photos version 2026.11060.2004.0. His analysis indicates that the app's local Image Creator and Restyle Image operations pass a server-issued prompt-generation GUID into the same watermarking function after on-device inference. Photos handles failures differently. Its code appears to log the watermarking error and continue returning the image, while Paint blocks the result when the invisible watermark cannot be applied. Microsoft's Photos documentation https://support.microsoft.com/en-us/windows/ai/ai-apps/microsoft-photos-restyle-image-and-image-creator-responsible-ai-faq confirms that the relevant models come with a Copilot+ PC or are downloaded from the Microsoft Store. It also says users must remain signed in and online for cloud safety services, prompts undergo abuse monitoring, and generated or edited images receive C2PA Content Credentials. The reverse engineering narrows Microsoft's definition of local AI. The costly image inference can run on the user's hardware, while prompt review, identifier issuance and provenance signing remain cloud-controlled. The resulting file carries that relationship in two places: a removable C2PA manifest and a second identifier embedded directly into its pixels.