Images created with the AI tools in Microsoft Paint carry more than a visible Copilot logo. Reverse engineer Xusheng Li found that Paint and Photos embed an invisible watermark in AI-generated images, and that the identifier in that watermark is issued by a Microsoft server even when the image itself is generated locally.
Li started out curious about how Paint’s image generation worked. Using Binary Ninja with an AI assistant, he found that Microsoft ships local models with Paint as encrypted .onnxe files, and that the encryption is a simple XOR with keys stored in a DLL. While going through the files, he noticed a 1.67 MB Watermarker.dll, which he considered unusually large for a feature that only adds a small visible logo.
How the Watermark Works
Paint adds the visible watermark through a separate function. The DLL’s WmkWriteWatermark function does something else: after a local Stable Diffusion generation, it takes a 16-byte payload, wraps it in an 18-byte message with a prefix byte and a checksum, and spreads each of its 144 bits across the image at least three times through small quantized changes to pixel blocks. Li described it as a content-adaptive, block-domain watermark. In a test on a synthetic 512-by-512 image, 193,376 of 262,144 pixels changed, with no visible difference.
If the watermark step fails, Paint treats the whole generation as an error rather than returning an unmarked image. Photos, which has its own copy of Watermarker.dll for its Image Creator and Restyle features, logs the error and appears to return the image anyway.
The ID Comes From Microsoft
Tracing the payload back, Li found it was a GUID returned by Microsoft’s prompt moderation service. Before Paint runs a local model, it sends the prompt and style to a Microsoft endpoint, which returns a revised prompt, a promptGenerationId and a watermarkId. Paint embeds the watermarkId in the pixels and also sends the previous generation ID with each new request, so successive requests can be linked.
The same GUID shows up in the signed C2PA Content Credentials attached to saved files. In a PNG Li saved from Paint, the manifest’s soft-binding value matched the watermark ID and was labeled “Content watermarked by Microsoft Responsible AI.” A soft binding lets an image be matched to its provenance record even if the file-level metadata is stripped. Paint also limits saving AI results to formats that can carry C2PA data, which is why BMP, Paint’s classic format, is missing from the options.
What Microsoft Discloses
Microsoft’s Image Creator support page says the company applies content filtering, that images “will contain C2PA manifest helping users identify that it is an AI generated image,” and that it collects user and device identifiers with prompts for abuse prevention. What it does not explain, Li wrote, is that the manifest records a per-generation identifier that is also hidden in the pixels, or that local generation on Copilot+ PCs still depends on an ID issued during remote moderation.
For developers and IT teams, the takeaway is that “generated locally” does not mean offline or untracked. The prompt still goes to Microsoft, and the output carries an identifier that can tie the image back to that request. That design supports AI provenance standards such as C2PA, and organizations with strict data policies should factor it in when deciding whether to allow these features.
WebProNews is an iEntry Publication