Microsoft Paint Secretly Watermarks Even Local AI Images

Every image Windows' Paint or Photos apps generate with AI carries an invisible watermark tied to a Microsoft-issued ID, and that holds even when the image itself never leaves your PC. A reverse-engineering write-up published today traces exactly how that ID gets there: the prompt still makes a round trip to a Microsoft server before anything gets drawn, and the tracking mark comes back with it.

• Paint's Cocreator feature can render AI images locally on a Copilot+ PC's NPU, but the prompt is still sent to a Microsoft Azure endpoint for moderation before the image gets generated.
• That server hands back a 16-byte GUID, and Paint's Watermarker.dll rewrites roughly three-quarters of the image's pixels to hide that ID invisibly across the picture.
• The same GUID also gets written into the image's C2PA Content Credentials metadata, under an entry Microsoft's own code calls com.microsoft.invismark.1, linking the visible metadata to the invisible pixel mark.
• Microsoft's support pages disclose that Paint filters prompts and adds C2PA manifests, but don't mention InvisMark by name or say the watermark ID can be traced back to a specific prompt.

What exactly did the researcher find?

Security researcher Xusheng Li spent time pulling apart Paint's and Photos' AI features piece by piece: decrypting the encrypted .onnxe model files bundled with the app, tracing calls through PaintAIManager.dll and AIServices.dll, and finally dissecting a 1.67 MB library called Watermarker.dll that had no obvious reason to be that large. What Li found is a pipeline most users would never think to question: type a prompt into Paint's Cocreator, and before a single pixel gets drawn, that prompt travels to a Microsoft moderation endpoint. The server checks it, revises it if needed, flags whether it contains a reference to a real person, and returns a fresh identifier alongside its verdict. Only then does the on-device NPU render the picture.

RelatedCopilot Explained Its Own Guardrails, Then Leaked Them

Why does a "local" render still phone home?

The word doing the misleading work here is "local." Copilot+ PCs market their neural processing units as a privacy and speed win: the actual image synthesis runs on your own silicon, not in Microsoft's cloud. That part is true. What isn't obvious is that Paint treats content moderation as a separate step from generation, and moderation is not local. Li's traffic capture shows the request carries the prompt text, a style parameter, and a promptGenerationId that chains one request to the next, letting Microsoft's server link successive edits to the same session even before any image exists. The response carries the revised prompt, a new promptGenerationId, a containsHumanReference flag, and the watermark ID itself. Photos' cloud-based Image Creator skips the ambiguity entirely, since it generates in Azure anyway, but Cocreator's local rendering creates the false impression that the whole interaction stayed on the machine.

How does the ID actually get hidden in the picture?

Once the GUID comes back, Watermarker.dll builds an 18-byte payload: a fixed marker byte, the 16-byte GUID, and a checksum. Li describes the embedding technique as content-adaptive and block-domain, using SVD-style math across small pixel blocks, and requiring at least three successful placements of each bit before it counts as embedded. On a 512-by-512 test image, that process altered 193,376 of the picture's 262,144 pixels, meaning nearly three out of every four pixels shifted by an amount too small to see but large enough to encode the ID redundantly across the whole frame. That redundancy is the point: it's built to survive normal edits, not to sit in one corner where a crop could remove it. The same GUID then shows up a second time, openly, inside the file's C2PA manifest as a "soft binding" entry naming Microsoft's own InvisMark scheme, which is presumably also why Paint only lets you save AI-generated images as PNG, JPEG, GIF, or its native format. All four support embedded C2PA metadata. BMP, which doesn't, isn't offered.

What does Microsoft actually tell users, and what does it leave out?

Microsoft's own support pages aren't silent on this. They state that Paint applies "content filtering to prevent the generation of images" that are harmful or inappropriate, and that generated images "will contain C2PA manifest helping users identify that it is an AI generated image." Both of those statements are accurate as far as they go. Neither one mentions that the manifest names an internal system called InvisMark, or that the identifier baked into the manifest is the same one hidden invisibly in the pixels, tied to the specific prompt that produced the image. A user who reads the support page walks away knowing their image is labeled as AI-made. They don't walk away knowing it's individually fingerprinted.

RelatedThe $15K/Month Job Offer That Shipped Malware in .git/hooks

Who should actually care about this?

Anyone using Cocreator or Photos' AI tools on a Copilot+ PC is affected, whether they know it or not, since there's no setting to turn the watermark off and no on-screen notice separate from the visible Content Credentials badge. The practical risk isn't that Microsoft is doing something illegal. Content provenance is a real and generally welcome idea, and C2PA exists precisely so images can be traced to their origin. The risk is the gap between what people assume "runs locally" means and what's actually happening: a prompt, plus a session-linking identifier, still leaves the device and gets tied permanently into the resulting file, even for a picture that never touches the internet again. Li also raises a question Microsoft hasn't answered: it's possible to reach the image-generation step through a direct API call that skips the moderation round trip entirely, and it's unclear whether that's an intentional escape hatch, an overlooked bug, or a hole in what's supposed to be a mandatory safety and provenance boundary.

Our take

Nothing here amounts to Microsoft lying to its users. The support pages do disclose content filtering and C2PA metadata, and provenance watermarking on AI images is a defensible, even useful, default in a world full of synthetic media. What this research actually exposes is a marketing gap rather than a legal one: "runs on your NPU" and "never leaves your device" are being used as if they mean the same thing, and Li's traffic captures show they don't. The more interesting fallout is downstream. Publishing the exact embedding mechanics of a watermarking scheme is usually the beginning of that scheme's arms race with people who want it gone, and Microsoft now has to decide whether InvisMark's design holds up once its internals are public knowledge rather than a black box.

Original analysis by GenZTech, based on reverse-engineering research published by Xusheng Li.