Xusheng Li, a software developer at Vector 35, published a reverse-engineering analysis on August 20 concluding that Windows' built-in Paint and Photos apps encode a 16-byte GUID from Microsoft's servers into the pixels of any AI-generated image, forming a watermark invisible to the naked eye. The finding only spread through developer circles after The Register followed up with a report on August 25.
According to Li's breakdown, the process begins the moment a prompt leaves the device. When a user types a description into Paint's Cocreator, the app first sends the prompt to a Microsoft Azure Front Door endpoint for moderation. The server returns three things: a revised prompt, a promptGenerationId, and a value called watermarkId. That watermarkId is the GUID later written into the pixels.
How the Watermark Gets Embedded
The component responsible for the encoding is called Watermarker.dll, a 1.67 MB file paired with a 302.4 MB encrypted model file, mager.onnxe. The 16-byte GUID gets a 0x4c marker prefixed to it and a checksum appended, bringing the total to 18 bytes, which expand into 144 bits. Each bit needs at least an 8×8 pixel block to carry it, so the smallest image that can be watermarked is 192×192.
The cost isn't trivial. Li measured a 512×512 image and found that 193,000 of its 262,000 pixels had been altered — about 74%. The technique is a content-adaptive, block-based SVD-like algorithm; the changes are invisible to the eye, but they do rewrite the majority of the image.
The same GUID is also written into the C2PA Content Credentials metadata as a soft binding, tagged with the algorithm identifier com.microsoft.invismark.1 and signed by Microsoft. There's one copy in the pixels and one in the metadata, each backing up the other — strip the C2PA metadata and the pixel watermark still survives.
The supported formats are PNG, JPEG, GIF, and Paint's own .paint format. BMP is excluded — Li's assessment is that BMP can't hold a complete C2PA manifest.
Paint and Photos Handle Failure Differently
Paint and Photos handle a failed watermark attempt very differently, and the gap is revealing:
- Paint: if the watermark can't be applied, the whole generation is treated as a failure and the image is never returned to the user.
- Photos: it logs an error, then hands over the unwatermarked image anyway.
Photos' Image Creator and Restyle Image features rely on the same Watermarker.dll. Paint's "no watermark, no image" behavior suggests that, in Microsoft's product logic, the watermark is a mandatory part of the generation pipeline rather than an optional add-on applied afterward.
Li also noticed a detail: Paint sends the previous promptGenerationId back as lastPromptGenerationId with the next moderation request. That means consecutive generations are explicitly chained together on the server side.
The Part That Still Needs the Cloud
The mechanism is most easily misunderstood on Copilot+ PCs. These machines have a local NPU, and image generation genuinely runs on-device — Microsoft has consistently marketed "local generation" as a selling point. But both the prompt moderation and the provenance signing happen in the cloud: the GUID has to be issued by the server, and the C2PA signature has to come from Microsoft. The picture is drawn locally; the pass that proves it is issued online.
The privacy implication isn't complicated: as long as Microsoft matches each prompt to the account that sent it, tracing the watermark on a leaked image could, in theory, identify who generated it and which specific generation it was. Li's criticism isn't aimed at the watermarking technology itself but at the adequacy of the disclosure — Microsoft has publicly discussed its AI safety measures but hasn't made clear that the GUID inside the C2PA manifest is bound to the user's prompt. The Register reached out to Microsoft for comment and had received no response by the time of publication.
Where Provenance Ends and Tracking Begins
The EU's transparency requirements for AI-generated content boil down to letting people know something was AI-generated. Standards like C2PA were designed for exactly that — labeling the source and the method of generation. Microsoft's approach goes a step further than labeling: it issues a unique number for every single generation.
The technical implementation of the two things is nearly identical, but their purposes are far apart. Do the rough math: distinguishing a binary "AI-generated / not AI-generated" flag only takes one bit. A 16-byte GUID has 2^128 possible values, and all that extra width can only be used to encode something far more granular. The bit width alone reveals the design intent — this isn't a content label, it's an ID card for a generation event.
For the average Windows user, the short-term impact is limited — most people aren't using Paint-generated images for anything that requires anonymity. But for anyone who treats Paint as a casual go-to tool, one thing is now settled: local generation doesn't mean no trace is left. Every image leaves carrying a number that only Microsoft can explain.
Sources: Xusheng Li's published reverse-engineering report, The Register, CocoLoop; verified against the GUID byte length, the watermark bit count, the pixel-modification figure for the 512×512 image, and the C2PA algorithm identifier.