www.it-connect.fr
Microsoft Paint and Photos Embed a Unique Microsoft ID in AI-Generated Images
Researcher Xusheng Li dissected two Windows apps: Paint and Photos. Thanks to this analysis, he was able to identify an invisible watermark applied to locally generated AI images. The catch: it is a GUID that is not generated locally, but delivered by a Microsoft server.
A server-issued identifier, then encoded into pixels
Xusheng Li, a developer at Vector 35, took a close look at Paint, the long-standing Windows app that hardly needs an introduction. That said, I’m taking this opportunity to remind readers that Microsoft has evolved Paint over time, adding new features, including some powered by AI.
First of all, his analysis showed that the app ships with four local models in .onnxe format, encrypted with a simple XOR whose key is stored in segapi.dll. This DLL comes with another library called Watermarker.dll, which is used to add the visible watermark on images (the small Copilot logo that the user can enable or refuse through the app’s settings).
In reality, this watermarking library is far too large to handle only the small Copilot logo that users can choose to display or not on their creations... There are actually two watermarks. The first is visible and optional. The second is invisible, and it cannot be disabled.
This invisible watermark is in fact an invisible marker and it carries 16 bytes of data. It corresponds to a GUID, meaning a unique identifier associated with the generated image. By tracing the calls made by the application, the researcher was able to determine that this GUID was not generated locally, but retrieved from Microsoft servers. In fact, even before launching the model installed on the machine, Paint sends the prompt entered by the user to a Microsoft moderation service.
The server returns the possibly reformulated text, along with two unique identifiers. One of them ends up encoded into the image pixels, like a marker.
A few findings reported by the researcher:
- The modification is massive, since on a 512 x 512-pixel test image, nearly 193,000 pixels out of 262,000 were altered.
- The image must be at least 192 pixels wide for the encoding to work.
- Each bit of information is written at least three times in the image, making it more resistant to edits.
And if you modify the same image several times using AI, Microsoft knows it. Indeed, Paint sends the previous generation’s identifier back to the server in the next request, which makes it possible to link creations together.
The same number also appears in the image metadata
What is interesting is that the GUID hidden directly inside the image pixels is also visible in the image file metadata. This is revealed by the researcher’s test using a PNG file. He explains that he found a Microsoft-signed C2PA manifest there. What is C2PA? It is the content provenance standard backed notably by Adobe and Microsoft, also known as Content Credentials. Microsoft needs to do this to comply with the AI Act (effective since August 2, 2026).
So, in short: the file metadata and the image watermark form the two layers of a single AI-content provenance system. This also means that if you delete the metadata, that is not enough: the number remains embedded in the image.
This approach also explains a quirk in Paint’s interface. Once an AI result has been generated, Paint only offers four formats for exporting and saving an image: PNG, JPEG, GIF, and its own proprietary format. BMP, the app’s historical format, disappears from the list simply because it cannot carry this type of metadata.
The researcher also analyzed the Photos app, which integrates AI features using the same principle. Apparently, the two apps do not behave the same way. Paint considers a watermarking failure to be a full generation failure and then returns no image at all. Photos, according to the analyzed code, seems to return the result anyway.
Local does not mean offline
The researcher’s investigation shows that even if processing is done locally, the decision-making still happens on Microsoft’s servers. As a result, this creates a false sense of privacy and of being able to work offline with these tools.
On a Copilot+ PC equipped with an NPU, Stable Diffusion inference does run on the machine, a capability Microsoft is also promoting to developers with the local Stable Diffusion XL API announced at Ignite 2025. But prompt moderation still happens remotely, on Microsoft’s servers, just like the famous signature embedded in the image. In other words, a Microsoft account and an Internet connection remain required even if the main processing is done locally.
This raises a question: does Microsoft document this watermark and GUID mechanism anywhere? Yes, Microsoft does document content filtering through prompt analysis and the addition of Content Credentials. What the researcher cannot find documented anywhere is the fact that this manifest carries a prompt-linked identifier, and above all, that this identifier is retrieved from a remote service.
In practice, if you use Paint with a Microsoft account and make AI-based edits, Microsoft will have no trouble linking you to an image. The GUIDs are generated and stored by Microsoft, in addition to being embedded in the image.
Read the researcher’s full report on this page.
