Microsoft Paint and the Windows Photos app embed a server‑issued GUID as an invisible watermark in images generated locally by their AI features, according to a reverse‑engineering analysis of the applications. The researcher discovered that while Paint and Photos can run local diffusion models, they still forward the user’s prompt to a remote server for moderation. That server returns a globally unique identifier (GUID) together with the moderated prompt, and the apps then incorporate that 16‑byte value into the pixel data of the resulting image. The invisible mark is added by a function called WmkWriteWatermark in Watermarker.dll, which expects exactly a 16‑byte payload. The function builds an 18‑byte message consisting of a fixed byte (0x4c), the GUID, and a checksum equal to the sum of the GUID’s bytes modulo 256. This message is expanded into bits and written into the image using a content‑adaptive block‑domain technique that modifies selected pixel blocks in a quantized manner, requiring each bit to be placed at least three times. If the watermarking step fails, Paint treats the entire generation as an error rather than returning an unwatermarked image. The invisible watermark operates separately from the visible watermark option, which merely overlays a small Copilot logo; toggling the visible setting does not affect the hidden GUID insertion. On Copilot+ PCs, where image generation is performed locally on the NPU, the prompt moderation step still occurs remotely, meaning the GUID watermark is present even when no data leaves the device for the actual image synthesis. Microsoft’s own documentation notes that Paint adds C2PA metadata to AI‑generated outputs and limits saving to formats that preserve that metadata—PNG, JPEG, GIF, and the proprietary .paint format. The analysis also showed that the local AI models shipped with Windows are encrypted ONNX files (with extensions .onnxe) that are decrypted at runtime using a key stored in segapi.dll; after decryption, the models pass standard ONNX validity checks. In summary, the apps combine local model execution with remote prompt safety checks, using the returned GUID as an imperceptible identifier embedded directly into the image pixels.
