Microsoft Paint and Photos embed server-issued GUIDs as invisible watermarks

A reverse-engineering study published on xusheng.dev shows that Microsoft Paint and Photos add an invisible watermark to AI-generated images even when the image is produced locally on the device. The mark carries a GUID issued by a Microsoft server.

The Watermarker.dll inside Paint

The researcher found a 1.67 MB Watermarker.dll in the Paint package. It contains two distinct mechanisms: AddPerceptibleWatermark, which composites the visible Copilot logo and is controlled by a setting offering Never, Always or Ask every time, and WmkWriteWatermark, which runs after a local Stable Diffusion generation. If the second one fails, Paint turns the whole generation into an error instead of returning an unmarked image.

The function accepts a payload of exactly 16 bytes and builds an 18-byte, 144-bit message from it: 0x4c, the 16 GUID bytes, and a checksum byte holding the sum of those bytes modulo 256. The encoder rounds usable dimensions down to multiples of eight, keeps 144 bit counters and requires every bit to be placed at least three times, returning an error when capacity is insufficient. In a test on a synthetic 512×512 image, 193,376 of the 262,144 pixels changed.

The GUID comes from remote prompt moderation

Analysis showed that before running the local model, Paint sends the prompt and style to a moderation endpoint hosted on Azure Front Door (the /v1/paint-cocreator/moderate-prompt path) and receives a revised prompt, a promptGenerationId, a watermarkId and a containsHumanReference flag. The researcher sent his own prompt through the endpoint and got an HTTP 200 response with watermarkId 83424621-03cb-40e3-9808-a9fae837156d. That same GUID ends up in the pixels of the finished image.

C2PA metadata and file formats

Paint also attaches signed C2PA Content Credentials to the file. In a saved PNG, a caBX chunk held an 18,979-byte manifest whose c2pa.soft-binding assertion names the algorithm com.microsoft.invismark.1 and records the same GUID, while the action is described as "Content watermarked by Microsoft Responsible AI". Saving AI results is therefore limited to C2PA-capable formats — PNG, JPEG, GIF and Paint's own .paint file; the classic BMP is absent.

What Microsoft discloses

Microsoft's documentation acknowledges content filtering and the presence of a C2PA manifest, but does not explain that the manifest carries the GUID of the invisible pixel watermark or that the GUID comes from prompt moderation. Photos contains the same Watermarker.dll behind its Image Creator and Restyle Image features; the difference is that when watermarking fails, Photos still returns the generated image while Paint does not. The research notes a possible link to Article 50 of the EU AI Act, whose transparency rules took effect on 2 August 2026, though the law does not require a prompt-specific identifier.