MS Paint and Photos inivisibly watermark even locally generated output with GUID
xusheng.dev
August 24, 2026
14 min read
68/100
Summary
Microsoft Paint embeds an invisible, server-issued GUID watermark in images generated locally through its Cocreator feature on Copilot+ PCs. Before local NPU-based Stable Diffusion inference begins, Paint sends the prompt and style to a Microsoft Azure moderation endpoint. The response includes a revised prompt, a promptGenerationId, a watermarkId, and a human-reference classification. Paint encodes the 16-byte watermarkId into image pixels through Watermarker.dll; generation fails if that watermarking step fails. The watermark encoder requires images at least 192 by 192 pixels and converts the GUID into a 144-bit payload with a prefix and checksum. Paint also sends the generated image and promptGenerationId to an online signing service, which returns a signed C2PA Content Credentials manifest. Testing found that the manifest’s Microsoft InvisMark soft-binding value matched the GUID embedded in the image pixels. Paint limits AI-generated image saves to C2PA-preserving PNG, JPEG, GIF, and .paint formats. Microsoft Photos includes the same Watermarker.dll for locally generated Image Creator and Restyle Image results, although its code appears to return an image even when watermarking fails. Microsoft discloses remote content filtering and C2PA manifests, but the research found no Microsoft disclosure describing the prompt-moderation-issued GUID or its embedding in pixels.
Key Takeaways
- Paint sends Cocreator prompts to a Microsoft Azure moderation service even when image inference runs locally on a Copilot+ PC.
- Paint embeds the moderation service’s 16-byte watermarkId as an invisible pixel watermark and records the same identifier in signed C2PA metadata.
- Paint treats invisible-watermark encoding failures as image-generation failures, while Photos appears to continue without a watermark if its encoder fails.
- AI-generated images in Paint can be saved only in PNG, JPEG, GIF, and .paint formats, which can preserve C2PA provenance data.
What the discussion said
Commenters treated the headline as partly misleading but the underlying issue as serious: the reported marker appears aimed at AI-generated or AI-edited images, including work done with local models, rather than every ordinary Paint save. That distinction mattered, yet it did little to calm the dominant concern that a persistent GUID could turn provenance tooling into a lookup key for the person behind a prompt, image, or account. Several readers argued that labeling synthetic media is valuable for preserving digital lineage and preventing AI manipulation from passing as untouched human work. Their objection was not to an AI-origin signal itself, but to binding it to an identity-bearing identifier without clear disclosure or an opt-out. Skeptics also doubted Microsoft’s implementation discipline. Reports of AI labels appearing on ordinary screenshots, alongside a prior incident where Copilot attribution was applied too broadly, made false positives feel plausible rather than theoretical. The thread repeatedly demanded basic technical clarity: whether non-AI edits trigger marking, whether the GUID lives in pixels as well as metadata, and how robust it is to simple transformations. Some saw useful AI image features such as background removal as worth having, but argued that a basic editor should not silently turn those conveniences into traceable AI provenance records.
Where opinion split
The central dispute is whether AI watermarking is necessary provenance infrastructure or covert identity surveillance. Supporters argue that durable disclosure of AI manipulation is essential to preserve trustworthy digital history; critics answer that provenance can be signed without embedding a GUID that may let a provider connect an image back to its creator and prompt activity.
Community Sentiment
Positives
- Labeling AI-altered images could give digital media a durable provenance trail, making it harder to pass synthetic or manipulated work off as untouched human evidence.
- AI-assisted background removal wins practical support because it saves real editing time and can produce cleaner results than Paint’s crude traditional eraser.
- The watermark reportedly targets AI-generated or AI-edited output rather than every image, which would limit the scope of provenance tracking if confirmed.
Concerns
- A hidden GUID attached to locally AI-edited images looks less like transparent provenance and more like a provider-controlled route from a shared picture back to a user account.
- Watermarking AI output without notice or a disable switch strips users of informed consent, especially when the marker may survive in both pixels and metadata.
- Reports of ordinary screenshots receiving an AI label, plus Microsoft’s earlier overbroad Copilot attribution, make erroneous synthetic-media accusations a credible risk.
- The thread lacks crucial technical answers about which edits trigger the marker, what the GUID reveals, and whether routine image transformations can remove or preserve it.
