The Image Was Generated Locally. Its Identifier Came From Microsoft.
Microsoft Paint can generate an image locally on a Copilot+ PC, but the operation does not stay local. The prompt goes to Microsoft’s cloud for moderation, the server returns a unique identifier, and Paint embeds that identifier invisibly into the generated pixels.
Reverse engineering by security researcher Xusheng Li connects three parts of the workflow that Microsoft documents separately: online safety checks, on-device image generation and C2PA Content Credentials. In the tested Paint path, the same server-issued GUID appears inside the pixels and in the signed provenance manifest attached to the saved image.
The finding does not prove that Microsoft uses the identifier to track a person or that it retains a permanent lookup table linking every image to an account. It does show that “generated locally” describes where inference happens, not the complete data and provenance path.
Local inference still depends on the cloud
Microsoft says Paint’s Cocreator and related Copilot+ PC features use the device’s neural processing unit to generate images locally. The same support page also says that a Microsoft account and an internet connection are required because Azure services perform safety checks.
Li traced that hybrid workflow through Paint’s binaries. Before the local Stable Diffusion model runs, Paint sends the prompt, selected style and a previous prompt-generation identifier to a Microsoft moderation endpoint. The response contains a revised prompt, a new prompt-generation identifier, a Boolean indicating whether the prompt refers to a human and a separate watermarkId.
That watermarkId is a 16-byte GUID. Paint passes it to Watermarker.dll after the neural processing unit produces the image. The encoder makes small changes across selected image blocks and requires every bit of its payload to be placed several times. If the watermark operation fails, Paint converts the entire generation into an error rather than returning an unmarked result.
The visible switch does not control the invisible mark
Paint also offers a setting for a visible AI watermark. Users can choose never, always or ask each time. Li found that this preference controls a separate perceptible logo applied during saving. It does not disable the pixel-level identifier written by Watermarker.dll.
The difference matters because the interface presents a choice about visible labelling while the less obvious provenance mechanism remains mandatory in the tested Paint path. A user who chooses not to add the visible mark has not opted out of the invisible one.
Microsoft Photos contains a parallel watermark component for local Image Creator and Restyle Image operations. The researcher found that Photos also embeds a server-originated GUID into locally generated output. Its failure handling appears less strict: Photos logs the watermarking error and may continue returning the image.
One identifier joins the pixels and the manifest
The strongest evidence comes from a saved Paint image. Li found a signed C2PA manifest containing a c2pa.soft-binding assertion. It named the algorithm com.microsoft.invismark.1 and stored the same GUID that the moderation service had returned as the watermark identifier.
C2PA uses a soft binding to reconnect content with provenance information even when file-level metadata is no longer present. In this implementation, the manifest records that Microsoft Responsible AI watermarked the content, while the corresponding identifier is also carried inside the image pixels. Removing the C2PA chunk does not necessarily remove the pixel signal.
The local generation path also sends the completed result through an online signing operation. According to the reverse engineering, that request includes the prompt-generation identifier, generation seed, creativity setting, AI feature version, moderation scores and an image for signing. Microsoft returns the signed provenance manifest that Paint inserts into the saved file.
This creates a coherent chain rather than two unrelated labels: remote moderation issues identifiers, the local application writes one identifier into the pixels, and an online service signs a manifest that names the same pixel watermark.
What Microsoft disclosed, and what the research adds
Microsoft is not hiding the entire cloud dependency. Its support documentation says Azure services perform content filtering for Paint’s AI features. It also says Microsoft collects prompts together with user and device identifiers for abuse prevention and monitoring. The company says it does not store users’ input or generated images.
The documentation also tells users that AI-generated Paint images contain a C2PA manifest. What it does not explain is that the manifest can carry a per-generation GUID identifying an invisible pixel watermark, or that the local workflow receives that watermark identifier from the same remote moderation exchange that handles the prompt.
That missing detail changes the privacy and governance question. C2PA metadata is designed to be inspectable. A pixel watermark is deliberately difficult for an ordinary user to see. Connecting the two with a server-issued value creates a stronger provenance signal, but it also deserves a clearer description of purpose, retention and who can resolve the identifier.
What the GUID does not prove
A unique value can support association, but capability is not evidence of use. The published analysis does not demonstrate that Microsoft retains a GUID-to-account mapping indefinitely, shares it with third parties or uses it for advertising. It also does not establish how reliably the watermark survives cropping, resizing, recompression or deliberate removal.
The demonstrated claim is narrower and still consequential: a Microsoft server supplies a unique value during prompt moderation, and that value is embedded into pixels produced by a local model. The same value appears in signed provenance data. Successive moderation requests can also be linked because Paint sends the preceding prompt-generation identifier with the next request.
This is best understood as a transparency and trust-boundary finding, not evidence of covert advertising surveillance. It belongs beside BlackTree’s earlier examination of Claude’s invisible watermarks: provenance controls can be valuable while still raising hard questions about notice, detectability and consent.
Why organisations should care
- Privacy teams should treat local AI labels as an architectural description, not a guarantee that prompts, identifiers and outputs never cross a cloud boundary.
- Enterprise administrators should include built-in Windows AI features in data-flow reviews, especially where prompts may contain confidential material.
- Digital-forensics teams should preserve both C2PA data and original pixel content. Stripping metadata may remove one provenance layer while leaving another.
- Policy owners should ask vendors whether per-generation identifiers can be resolved to users, how long mappings are retained and what access controls govern that resolution.
- Users should understand that Paint’s visible-watermark preference does not govern the invisible watermark documented in this research.
The operational lesson is simple: locality has layers. The model may execute on the user’s device while moderation, identifier issuance and provenance signing remain online. Products should disclose all three clearly, because the boundary that matters is not only where the image was rendered. It is where the prompt, identifiers and finished result travelled.
Sources
- Xusheng Li, “Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images”, published 20 August 2026 at 20:00. The source does not state a time zone.
- Microsoft Support, “Use Copilot+ PC features in Paint”. The page provides no publication date or time.
- Microsoft Support, “Use Image Creator in Paint to generate AI art”. The page provides no publication date or time.
- SANS Internet Storm Center, “Microsoft Paint Invisible Watermark”, published 26 August 2026. The page provides no publication time.
