MS Paint and Photos inivisibly watermark even locally generated output with GUID
TL;DR
Reverse engineering shows that Windows Paint and Photos stamp every AI image they generate with an invisible pixel watermark. That includes images made by a local model on the device. The watermark carries a unique ID that Microsoft's servers issue for each generation when they moderate the prompt. Turning off the visible Copilot watermark does not remove it. Microsoft's disclosures never mention the ID.
The article
- Paint ships local AI models as encrypted .onnxe files, XORed with "Microsoft_2023" or a 4,096-byte key. It also ships a 1.67 MB Watermarker.dll. That is a big DLL for drawing a logo. The size prompted the author to look for a hidden watermark.
- Before Paint runs the local Stable Diffusion model, it POSTs the prompt to an Azure moderation endpoint. The server sends back a revised prompt, a promptGenerationId and a watermark ID. Each request also carries the previous generation's ID, so Microsoft can chain a user's prompts together.
- WmkWriteWatermark embeds the 16-byte watermark ID into the pixels with a block-based, SVD-style scheme. The scheme writes each of 144 bits at least three times. In a 512x512 test it changed 193,376 of 262,144 pixels. If watermarking fails, Paint discards the whole generation.
- The saved file also gets a signed C2PA manifest. Its soft-binding value is the same watermark ID, labeled com.microsoft.invismark.1. Paint saves AI results only in formats that keep C2PA metadata: PNG, JPEG, GIF and .paint. BMP is not offered.
- Photos uses the same Watermarker.dll for its Image Creator and Restyle features. Unlike Paint, it logs a watermarking failure and returns the image anyway.
- Microsoft discloses remote content filtering and C2PA Content Credentials. It does not say that the manifest names a watermark ID issued during prompt moderation. The EU AI Act asks only that AI output be machine-detectable. It does not require a per-generation ID.
Why it matters
Read the original for the call graphs, the moderation endpoint's real JSON responses and the C2PA manifest dump. It also asks whether the cloud endpoint could return images before watermarking, and how such images might be classified.
The discussion
A large, angry thread. Most commenters accept a plain "made by AI" mark but object to an ID that Microsoft can tie back to an account. The printer tracking-dot comparison comes up again and again. The biggest side threads argue over camera-signed photos, how Paint and Notepad got AI features, and what the EU and US states require.
A unique ID is a fingerprint, not a label
The top reaction calls the AI part beside the point, since the ID lets anyone with a subpoena trace an image to a Microsoft account. Commenters compared it to the yellow dots of color laser printers, which probably helped the FBI identify NSA leaker Reality Winner. A few pushed back that the ID is not a user ID, but the author replied that each generation spends his account's AI credits. Several found the moderation call worse than the mark, since a model running on their own NPU still reports every prompt to Microsoft.
The AI aspect of this is a red herring. The real problem is that they're secretly adding in a unique identifier into every image you create.
when I do an image generation, it deducts my AI credits (yes, MS gives you like 60 free AI credits), so MS surely knows where the prompt is coming from.
Signing real photos instead
One commenter proposed the reverse, having cameras sign their photos so real images can be proven real. Replies took it apart: keys can be extracted from hardware, the chip can be fed arbitrary data, and a signed camera can photograph a screen. Routine crops and conversions break the signature, and a court would believe signed fakes. Retr0id said he had already forged C2PA signatures with Google's Pixel Camera app, still unpatched after 90 days, and published the writeup during the thread.
I've done this btw. I went for the Pixel Camera app since they were the ones bragging the hardest about their "security".
Being signed with something just means that whoever has that key could've done that.
Paint and Notepad are not simple tools anymore
A long thread mourned Paint and Notepad as lightweight apps that now carry Copilot, autosave and rich text. Notepad keeping old pastes around drew particular complaints, and one commenter recalled a streamer whose saved links surfaced on air. Others like dark mode, tabs and background removal, and say most of it can be switched off. The usual "just switch to Linux" advice met pushback from people who run corporate fleets, where Microsoft's cloud stack and engineering software leave little choice.
It seems like they could have left it as a pure “paint” app and added the fancy stuff to some new image editor or something.
The cost of switching one laptop to linux is quite low. The cost of taking an enterprise using Microsoft everywhere to linux is something else entirely.
What the law requires
Some called for GDPR enforcement, since Microsoft never asked for consent. Others answered that the EU, California, Colorado and Texas now require AI content to be watermarked, California since August 1. The reply was that the EU rule asks for a mark showing an image is AI-generated, not a per-generation ID. One commenter linked Microsoft's InvisMark watermarking code on GitHub.
As the article explained, the EU does not mandate a prompt-specific GUID, only the ability to identify the content as AI-generated. The highly privacy-invasive level of provenance tracking which Microsoft has added goes beyond the EU’s new mandates.
Scanning the comments, I see some curiosity and outrage but little recognition that this is legally required in places like California and Colorado and Texas and probably some more places.
Stripping the mark, and trusting it too much
Converting to BMP drops the C2PA metadata but leaves the altered pixels, so people traded ways to scrub them, like faint noise or a denoiser. Others warned that schemes like SynthID survive that. A skeptic replied that this code runs locally, so its method is known and anyone can overwrite the mark with noise. Two worries followed: trusting detectors makes unmarked deepfakes look real, and the same watermarking could later tag any image or app window.
There is no robust-without-qualifiers watermarking. There is only robustness against common operations but as soon as someone is actually trying to remove the watermark they can at the very least use exactly the same technique to embed random noise instead to overwrite your watermark.
Imagine the populace getting used to a AI image detector flagging things as fake using this fairly easily defeated GUID marker system.
Consensus
Marking an image as AI-generated is acceptable, and some think it is needed. Embedding an ID that ties the image to a prompt and an account goes further, and Microsoft did not tell users. Many concluded the practical fix is to avoid Microsoft's AI tools or Windows itself.
Dissent
A minority said the title overstates things, since only output from the built-in generators gets marked and hand-drawn images do not. Others pointed out that the law now requires such marks and called the slippery-slope arguments overblown.