Reverse engineering finds Paint and Photos embed server-issued GUIDs in locally generated AI images
- Microsoft Paint and Photos send AI prompts to a remote moderation server, which returns a moderated prompt and a GUID that the apps embed as an invisible pixel watermark even when image generation runs locally.
- The invisible watermark uses a separate
WmkWriteWatermarkpath in Watermarker.dll, while Paint's visible Copilot-logo watermark has a user setting with Never, Always, and Ask every time options. - Paint includes encrypted local
.onnxemodels, including a 302.4 MBmagermodel; the researcher decrypted them by extracting keys fromsegapi.dlland verified them as ONNX models. - On Copilot+ PCs, image generation is local but prompt moderation remains remote, so the server-issued GUID path still applies according to the article.
- Microsoft discloses C2PA metadata for AI-generated Paint images and limits saves to C2PA-preserving PNG, JPEG, GIF, and
.paintformats.
Hacker News opinions
My concern is not merely that images get labeled as AI-made. Paint and Photos appear to insert a silent, non-disableable GUID into pixels and metadata, and Microsoft could link it to the prompt and originating device or user. That feels like printer tracking dots with far more data behind them.
I do not expect every generative model to watermark output, especially models built for adversarial or disinformation use.
I do not think camera signatures prove a photo is real. They only show that a particular private key signed it, and keys can be stolen, extracted, or used by a compromised camera to sign arbitrary images.
A camera-signature system could create false confidence. A forged image signed with a leaked camera key might be believed in court, even though the signature says nothing about how the pixels were produced.
I understand the need to preserve provenance, but a watermark can say an image was AI-generated without leaking who made it. Binding a GUID to a Microsoft account is user tracking.
The AI label is a distraction if the identifier can let Microsoft connect an image to an account after receiving a subpoena. The post only establishes this for AI-assisted images, though, not every image a user creates.
The article does not actually show that the GUID identifies a user. There is a large difference between marking an image as AI-created and identifying its creator.
I had Paint flag a normal screenshot as AI-made when I only wanted to resize it, so I installed Paint.net instead. That makes me wary of how broadly these labels can trigger.