By ByteBot
MS Paint will not generate an AI image without watermarking it first. If the invisible watermark step fails, Paint cancels the generation — you get nothing. A researcher reverse-engineered Watermarker.dll this week and confirmed that the embedded watermark contains an 18-byte payload with a server-issued GUID, invisibly distributed across roughly 74% of every image’s pixels. Windows Photos handles failure differently: it logs the error and returns the unwatermarked image anyway. MS Paint does not.
What Is Embedded in the Invisible Watermark
The payload structure is precise: one header byte (0x4c), 16 bytes for a GUID, and one checksum byte (the sum of the GUID bytes modulo 256). Researcher Xusheng Li documented the hard-coded validation inside WmkWriteWatermark — payloads shorter than 16 bytes return error -6; payloads longer than 16 bytes return error -5. Exactly 16 bytes, every time. The slot for the server GUID is not optional.
The encoder expands those 18 bytes into 144 individual bits and distributes them using SVD-style matrix decomposition, requiring at least three successful placements per bit position. On a 512×512 image, that means 193,376 of the image’s 262,144 pixels are modified — all to carry an identifier invisible to the human eye but detectable by Microsoft’s tools. Additionally, the GUID appears in the image’s C2PA Content Credentials manifest under c2pa.soft-binding.value. That manifest can be stripped; the pixel-level embedding cannot be easily removed.
The Invisible GUID Comes From Microsoft’s Servers — Not Your Device
This is where “local AI image generation” gets complicated. Cocreator on Copilot+ PCs runs Stable Diffusion inference locally on the NPU — that part is genuinely on-device. However, before any pixels are generated, your prompt goes to a Microsoft moderation endpoint: apsaiservices-a0fqcjc6bzbhgdcd.b02.azurefd.net. The server returns a revised prompt, a prompt generation ID, a human-reference classification flag, and — critically — a watermarkId. That watermarkId is the GUID embedded in your image.
No internet connection means no watermarkId. No watermarkId means no image in Paint. The watermark is not generated locally — it is issued by a Microsoft server and tied to the moderation session for that specific generation. If Microsoft retains the mapping between watermarkId, promptGenerationId, and the authenticated Microsoft account, every image becomes traceable back to the person who generated it and the session context. For context on how AI text outputs are tracked separately, see Claude’s text watermarks in API responses — a different mechanism, but the same industry-wide shift toward traceable AI output.
What Microsoft Discloses — and What It Does Not
Microsoft’s documentation covers C2PA Content Credentials, visible watermark options in Photos, and its responsible AI framing. What it does not explain is that the c2pa.soft-binding.value field is a server-issued GUID identifying an invisible pixel watermark, or that this GUID links back to a specific moderation session. As Xusheng Li’s reverse engineering documents: “Microsoft does not explain that the manifest contains a GUID identifying the invisible pixel watermark.”
Furthermore, this is not equivalent to Google’s SynthID. SynthID embeds a perceptual pattern that answers one question: was this image AI-generated? Microsoft’s approach embeds a specific identifier answering a different question: which session, on which account, with which prompt, generated this exact image. Class detection versus individual tracing. Both are invisible; the privacy implications are not equivalent.
EU AI Act Article 50 Is the Regulatory Driver
Article 50 of the EU AI Act went live on August 2, 2026 — 22 days ago. It requires AI-generated images, audio, and video to carry machine-readable markings, with penalties reaching €15 million or 3% of worldwide annual turnover. Microsoft’s dual-layer implementation — invisible pixel watermark plus C2PA manifest — is a direct response to that mandate and technically satisfies what regulators asked for.
The regulatory intent is legitimate: synthetic media that can be marked makes deepfakes easier to detect and misinformation easier to trace. However, compliance does not require a server-issued identifier that links every image to a moderation session. A locally-generated random GUID would satisfy the technical requirement without the individual tracing vector. Microsoft chose server-issued GUIDs. That is a product decision, not a regulatory requirement.
What Developers Need to Know
If you build applications on top of Windows AI image generation APIs or advise clients using Copilot+ PCs for creative workflows, the practical picture is clear. Every image generated through Paint’s Cocreator carries a server-issued GUID in 74% of its pixels and recorded in a signed C2PA manifest. Paint will not produce an image without it. Photos will produce an image without it only when the watermarking service fails. The BMP format is explicitly excluded from Paint’s AI image save options because the C2PA specification cannot embed manifests in BMP files — a format restriction driven entirely by the watermarking requirement.
For developers evaluating privacy posture or building image pipelines: you can strip the C2PA manifest, but the pixel-level GUID remains. The researcher’s analysis found no evidence of a user-accessible opt-out for the invisible watermark itself. For teams working inside the EU or processing images for EU users, understanding what is embedded — and what is linked server-side — is no longer optional.
