www.it-connect.fr
Microsoft Paint and Photos Embed a Unique Microsoft ID in Your AI-Generated Images
Researcher Xusheng Li reverse-engineered two Windows apps: Paint and Photos. Thanks to this analysis, he identified an invisible watermark applied to locally generated AI images. The catch: it is a GUID that is not generated locally, but issued by a Microsoft server.
A server-issued identifier, then encoded into pixels
Xusheng Li, a developer at Vector 35, closely analyzed Paint, the classic Windows app that hardly needs an introduction. That said, I am taking this opportunity to point out that Microsoft has evolved Paint and added new features, including some powered by AI.
First, his analysis showed that the app ships with four local models in .onnxe format, encrypted with a simple XOR whose key is stored in segapi.dll. This DLL comes with another library called Watermarker.dll, which is designed to add the visible watermark on images (the small Copilot logo that users can choose to enable or refuse through the app settings).
In reality, this watermarking library is far too large to handle only the small Copilot logo that users can choose to display or not on their creations... There are actually two watermarks. The first one is visible and optional. The second one is invisible, and it cannot be disabled.
This invisible watermark is in fact an invisible marker, and it carries 16 bytes of data. That corresponds to a GUID, in other words a unique identifier associated with the generated image. By tracing the calls made by the app, the researcher was able to determine that this GUID was not generated locally, but retrieved from Microsoft servers. Indeed, even before launching the model installed on the machine, Paint sends the prompt entered by the user to a Microsoft moderation service.
The server returns the possibly rewritten text, along with two unique identifiers. One of them ends up encoded into the image pixels, like a marker.
Some findings noted by the researcher:
- The modification is massive, since on a 512 x 512 test image, nearly 193,000 pixels out of 262,000 were altered.
- The image must be at least 192 pixels wide for encoding to be possible.
- Each bit of information is written at least three times in the image, making it more resistant to edits.
And if you modify the same image several times using AI, Microsoft knows it. In fact, Paint sends the identifier from the previous generation back to the server in the next request, which makes it possible to link creations together.
The same number also appears in the image metadata
What is interesting is that the GUID hidden directly in the image pixels is also visible in the file’s metadata. That is what the researcher’s test on a PNG file revealed. He explains that he found a C2PA manifest signed by Microsoft there. What is C2PA? It is the content provenance standard backed notably by Adobe and Microsoft, also known as Content Credentials. The Redmond company must implement it to comply with the AI Act (in force since August 2, 2026).
So, in short: the file metadata and the image watermark form two layers of the same AI content provenance system. This also means that if you erase the metadata, that is not enough: the number remains embedded in the image.
This approach also explains a quirky detail in Paint’s interface. Once an AI result has been generated, Paint no longer offers more than four formats for exporting and saving an image: PNG, JPEG, GIF, and its own proprietary format. BMP, the app’s historic format, disappears from the list simply because it cannot carry this type of metadata.
The researcher also analyzed the Photos app, which integrates AI features on the same principle. Apparently, the two apps do not behave the same way. Paint considers a watermarking failure to be a complete generation failure and then returns no image at all. Photos, according to the analyzed code, seems to return the result anyway.
Local does not mean offline
The researcher’s investigation shows that even if processing is performed locally, the decision-making still happens on Microsoft servers. As a result, this creates a false sense of privacy and of being able to work offline with these tools.
On a PC Copilot+ equipped with a NPU, Stable Diffusion inference does run on the machine, a capability that Microsoft is also promoting for developers with the local Stable Diffusion XL API announced at Ignite 2025. But prompt moderation remains remote, on Microsoft servers, just like that famous signature embedded in the image. In other words, a Microsoft account and an Internet connection are still required even if the main processing is done locally.
That raises a question: does Microsoft document this watermark and GUID story anywhere? Well, Microsoft does document content filtering through prompt analysis and the addition of Content Credentials. What the researcher cannot find documented anywhere is the fact that this manifest carries an identifier linked to the prompt, and above all, that this identifier is retrieved from a remote service.
In practice, if you use Paint with a Microsoft account and make AI-based edits, Microsoft can easily link you to an image. The GUIDs are generated and stored by Microsoft, and they are also embedded in the image itself.
Find the researcher’s full report on this page.
