Microsoft Paint and Photos Invisible Watermarking Analysis

Microsoft Paint and Photos embed a server-issued GUID into the pixels of AI-generated images to ensure provenance, even when the image generation process occurs locally on the device. This mechanism links the final image to a specific prompt and user account via a remote moderation server, effectively bypassing the "local" nature of the generation process for tracking purposes.

Remote Moderation and GUID Issuance

Contrary to the user's perception of local generation, the process is not entirely offline. Before a local Stable Diffusion model runs on a Copilot+ PC, the application sends the user's prompt and style to a Microsoft moderation server (/v1/paint-cocreator/moderate-prompt).

The server returns a JSON response containing:

  • A revised prompt for the local model to use.
  • A promptGenerationId (GUID).
  • A watermarkId (GUID).

This watermarkId is the key identifier that is subsequently embedded into the image pixels and metadata.

The Invisible Watermarking Mechanism

Microsoft uses a dedicated library, Watermarker.dll, to embed the GUID. The process is a content-adaptive, block-domain watermark (likely SVD-style) that makes small, quantized changes to RGB pixels across selected image blocks.

Technical Implementation

  • Payload Construction: The 16-byte GUID is wrapped into an 18-byte message consisting of a prefix (0x4c), the GUID, and a byte-sum checksum.
  • Embedding Process: The encoder rounds image dimensions to 8-pixel boundaries and uses 144 counters to ensure each bit of the payload is placed at least three times for redundancy.
  • Pixel Modification: The system modifies a significant number of pixels (e.g., 193,376 out of 262,144 in a 512x512 image) to embed the identifier invisibly.
  • Failure Handling: In Microsoft Paint, if the WmkWriteWatermark function fails, the entire image generation is treated as an error and the image is not returned to the user.

C2PA Metadata and Soft Binding

Beyond pixel-level watermarking, Microsoft attaches C2PA (Coalition for Content Provenance and Authenticity) Content Credentials to the saved file. This creates a dual-layer provenance system:

  1. File-Level Manifest: A signed C2PA manifest is embedded in the file (e.g., in a caBX chunk for PNGs). This manifest explicitly lists the watermarkId in a c2pa.soft-binding field.
  2. Pixel-Level Watermark: The watermarkId is embedded directly into the pixels via Watermarker.dll.

This "soft binding" allows the image to be matched to its provenance record even if the file-level metadata is stripped. To preserve this metadata, Paint restricts AI-generated image saves to C2PA-compatible formats: PNG, JPEG, GIF, and .paint. Classic formats like BMP are disabled for AI outputs because they cannot embed the manifest.

Comparison: Cloud vs. Local Paths

Microsoft employs two distinct generation paths depending on the hardware and feature used:

Path Process Watermarking Location
Cloud (Image Creator) Prompt $\rightarrow$ Cloud Generation $\rightarrow$ Cloud Watermarking $\rightarrow$ Finished Image returned to Paint Server-side
Local (Cocreator) Prompt $\rightarrow$ Remote Moderation $\rightarrow$ Local NPU Generation $\rightarrow$ Local Watermarker.dll $\rightarrow$ Online Signing Client-side

Community Insights and Privacy Implications

Technical analysis and community discussion highlight several critical privacy and transparency concerns:

"The GUID is the giveaway that it's not about protecting artists, it's about being able to prove provenance later. nobody embeds a unique id in a local file for the user's benefit."

Key points raised by the community include:

  • False Sense of Control: The visible watermark toggle in Paint settings only controls the Copilot logo; it does not disable the invisible GUID watermark.
  • Account Linking: Because the GUID is issued by a server after authenticating the user's session and deducting AI credits, the watermark can be linked back to a specific Microsoft account and prompt.
  • Comparison to Printer Tracking: Users have compared this to "yellow dots" (printer tracking dots), where hardware produces identifying marks that the user cannot disable.
  • Regulatory Drivers: Some observers note that this likely aligns with transparency requirements in the EU AI Act (Article 50), which requires AI-generated content to be machine-readable.

Conclusion

While Microsoft discloses the use of C2PA metadata and remote content filtering, it does not explicitly inform users that a unique, server-issued GUID is embedded into the pixels of locally generated images. This mechanism ensures that "local generation" remains tethered to Microsoft's cloud infrastructure for both moderation and identification.

Sources

Related