Reverse engineering finds Paint and Photos invisibly watermark local AI images with a server GUID

Invisible watermark in on-device output

A reverse engineering analysis of Microsoft's Paint app, published at xusheng.dev and picked up on the front page of Hacker News, reports that images produced by Paint's AI tools carry an invisible watermark even when the image itself is generated entirely on the machine. Embedded in that watermark is a 16-byte GUID issued by a remote Microsoft server as part of prompt moderation.

Generation is local, moderation is not

The author, who has previously probed obscure Windows components such as UCPD and WHESCVC, expected Paint's AI features to simply call a cloud API. According to the write-up, the opposite is true: the Paint app directory under WindowsApps holds four encrypted model files with an .onnxe extension, including segmentation and encoder/decoder components and a roughly 302 MB image generator. The files are XOR-obfuscated, with the keys stored in segapi.dll, namely a previously known "Microsoft_2023" string for one file and a 4,096-byte alphanumeric key for the rest. After decryption they load as ordinary ONNX models.

The write-up's summary indicates the Photos app ships local AI models too. On Copilot+ PCs the actual generation runs locally, with the call tree showing a Stable Diffusion pipeline producing output on the NPU, but the prompt is still sent to a remote server for moderation. The server returns the moderated prompt together with a GUID, and that GUID becomes the watermark payload.

How the watermark is written

The mechanism lives in a 1.67 MB DLL named Watermarker.dll. Its size was the author's first clue that it did more than stamp a small logo onto the corner of an image, an unusually heavy footprint for such trivial compositing.

The visible watermark, a Copilot logo composited at the bottom right, is handled by a separate function, AddPerceptibleWatermark, governed by a Never, Ask every time or Always setting. It is unrelated to the invisible path.

The invisible watermark is written by WmkWriteWatermark, which the analysis traced to run after local generation and after output safety checks inside Paint's image generation flow. The function insists on exactly a 16-byte payload, returning distinct error codes for inputs that are too short or too long, then builds an 18-byte message consisting of a 0x4c marker byte, the 16 GUID bytes and a checksum byte formed from the sum of the GUID bytes modulo 256. Those 18 bytes expand into 144 individual bits.

The encoder rounds usable image dimensions down to 8-pixel boundaries, requires images of at least 192 by 192 pixels, and embeds each of the 144 bits at least three times through small quantized changes over selected image blocks, using matrix decomposition and constants that suggest a content-adaptive, SVD-style scheme. In a synthetic 512-by-512 test image, 193,376 of 262,144 pixels changed after watermarking.

Two behavioural details stand out. First, if the watermark write fails, Paint turns the entire generation into an error rather than returning the image without it, so the watermark is effectively mandatory. Second, the user-facing visible-watermark setting has no control over it.

Disclosure and provenance

The write-up notes that Microsoft does disclose adding C2PA provenance metadata to AI-generated images in Paint, and that saves are limited to formats which preserve C2PA: PNG, JPEG, GIF and .paint. The GUID watermark is a different layer entirely. It lives in the pixels rather than in sidecar metadata, which means it would survive the metadata stripping that defeats C2PA tags on their own. The analysis walks the payload backward to the moderation server's response; what the GUID corresponds to on Microsoft's side is not established in the published material.

Why it matters

The finding sits at the intersection of provenance and privacy. Watermarking AI-generated images is a defensible, widely discussed goal, and C2PA is the transparent way to pursue it. But a persistent, per-image identifier issued by a remote server, attached to a feature marketed as running locally, with no user-facing setting and a hard failure when the watermark cannot be written, means every locally generated image remains traceable to a server-side moderation event. Users who assumed on-device generation meant no server involvement learn that their prompts still leave the machine, and that the resulting image quietly records the exchange. For anyone building or auditing local-first AI features, it is also a reminder that claims of local processing need to be verified at the binary level rather than taken from marketing copy.