Server-issued GUID in the pixels: Paint's local AI generation still phones Microsoft first

Microsoft Paint’s AI images carry an invisible identifier that Microsoft’s own servers hand out. Xusheng Li, a Vector 35 developer who works on Binary Ninja, took apart the watermarking code and found a 16-byte GUID that arrives from a moderation endpoint before the picture exists, then gets quantized into the pixels.

The identifier is per request. Paint stamps the specific ID that Microsoft’s server minted for one prompt, and the same value appears in the file’s signed C2PA metadata. Strip the metadata and the pixels keep the number. Transparency rules under Article 50 of the EU AI Act became enforceable on Aug. 2, 2026, and they do require a machine-readable mark on AI output. They don’t require a mark that’s unique to each request.

What an invisible watermark actually is

Paint has two watermarks and they work nothing alike. The visible one is a small Copilot logo in the bottom right corner, and Paint gives you three choices for it: never, always, or ask every time. That setting doesn’t touch the invisible one. An invisible watermark works by nudging pixel values just enough to carry data through normal viewing, the same broad idea as steganography. Li called the Windows encoder directly with a synthetic 512-by-512 test image and watched 193,376 of its 262,144 pixels change.

The other layer is metadata. C2PA defines a signed block that travels with a file and records how it was made. When Li saved a real image out of Paint’s Image Creator and dumped the PNG chunks, an 18,979-byte caBX chunk sat immediately after IHDR, holding a signed manifest. That manifest names the algorithm com.microsoft.invismark.1 and records an action of c2pa.watermarked, described as “Content watermarked by Microsoft Responsible AI”.

Both layers point at one value. The manifest’s soft binding assertion carries the exact same GUID that’s sitting in the pixels:

"c2pa.soft-binding": {
  "alg": "com.microsoft.invismark.1",
  "blocks": [
    { "scope": "the entire image",
      "value": "83424621-03cb-40e3-9808-a9fae837156d" }
  ]
}

A soft binding, in C2PA’s own framing, is an identifier derived from or embedded into content so the content can still be matched to its provenance record after the file-level manifest has been removed. The C2PA explainer lists invisible watermarking as one way to build one. Microsoft cryptographically signed that assertion.

Why local generation still phones home

Cocreator on a Copilot+ PC runs Stable Diffusion on the device’s NPU. It still needs a Microsoft account and an internet connection, because before any inference happens AIServices.dll posts the prompt and style to a Microsoft moderation endpoint sitting behind Azure Front Door. The reply carries four fields: revisedPrompt, promptGenerationId, watermarkId and containsHumanReference. Li reused Paint’s own authenticated session to send the prompt “a cobalt blue circle above a tiny orange square” through that endpoint and got back a watermarkId of 83424621-03cb-40e3-9808-a9fae837156d, which is the value that later turned up in his saved PNG.

Li puts the consequence plainly in his writeup: “In other words, ‘generated locally’ does not mean that the complete operation is local. Microsoft receives and moderates the prompt, then issues the unique GUID that Paint embeds into the locally generated image.” Paint also sends the previous promptGenerationId back as lastPromptGenerationId on the next request, which chains successive generations together on the server side.

Then the encoder does its work. The wrapper builds an 18-byte message, a 0x4c tag byte followed by the 16 GUID bytes and a checksum, expands that to 144 bits, rounds the usable dimensions down to 8-pixel boundaries and quantizes selected blocks so every bit lands at least three times. Below 192 by 192 pixels there isn’t room and the call fails. Paint escalates that failure into a failed generation and refuses to hand back an unmarked image. Windows Photos, running a Watermarker.dll of the same name, logs the error and returns the picture anyway.

Paint’s save dialog gives the design away. Straight out of the Image Creator pane the only offered format is PNG. Once a result lands on the canvas the options widen to PNG, JPEG, GIF and Paint’s own .paint, while BMP, the classic Paint format, is gone. Every remaining option can carry a C2PA manifest. BMP can’t.

What the GUID can and can’t prove

The GUID identifies a generation request. Nothing in the pixels says who you are or which account you used, and it becomes user-linkable only if Microsoft keeps the server-side mapping from GUID to account, device or IP address. Li is careful about that line. Answering questions on Hacker News, he wrote that he believes “your MS account is linked to the prompt and the GUID”, pointing out that each generation debits the AI credits attached to his account, then added: “Though I am not sure about their storage and retention, e.g., do they actually store the data, and if they do, for how long”.

Microsoft’s own Image Creator support page is what would close that loop. Li notes it says the feature uses Azure online services and that Microsoft collects user and device identifiers together with prompts for abuse prevention and monitoring. What the page doesn’t explain, in Li’s words, is “the server-issued watermark GUID, its association with prompt moderation, or its presence in the pixels”. Thomas Claburn, reporting the research for The Register on Aug. 25, wrote that “Microsoft did not immediately respond to a request for comment”. No Microsoft statement has surfaced since. Microsoft’s security communications have had a busy year, a record 570-flaw Patch Tuesday in July included, and none of it has addressed the watermark GUID.

Durability is the open question, and the honest answer is that nobody has published a test against this build. Li documents the encoder without measuring how well it holds up. Two things are known. Converting the file to BMP throws away the C2PA manifest and leaves the modified pixels untouched, a distinction several commenters drew on Hacker News. And the encoder is built for redundancy, placing all 144 bits at least three times across the image, which is what a mark meant to survive a re-encode would need.

The manifest name invites one more caveat. Microsoft’s Responsible AI team published an InvisMark paper at WACV 2025 reporting 256-bit payloads at PSNR around 51 and over 97% bit accuracy across image manipulations. Treat that as the vendor’s design target rather than a measurement of what ships in Paint. The paper describes a neural encoder, while what Li found in Watermarker.dll looks like a content-adaptive block-domain quantizer built around matrix decomposition. A crop aggressive enough to drop most of the redundant bit placements would break extraction, though nobody has shown where that line falls.

The EU rule behind the timing

Article 50 is why any of this marking exists. Its transparency duties became enforceable on Aug. 2, 2026, and they require providers of systems that generate synthetic image, audio, video or text to mark the output in a machine-readable format that is detectable as artificially generated. The accompanying Code of Practice on Transparency of AI-Generated Content is more prescriptive about method: providers should deploy at least two machine-readable techniques, per Paul, Weiss’s reading of the final text, “such as digitally signed, tamper-evident metadata plus imperceptible watermarking”, because “no single technique currently ensures compliance with Article 50(2)”.

That explains both layers. A signed C2PA manifest plus an invisible pixel mark is exactly the two-technique combination the Code describes, and it explains why an AI result in Paint can’t be saved as a BMP. What the rule asks for is content that a machine can identify as AI-generated. It stops there. Li makes the same point in his conclusion, and one Hacker News commenter argued that Microsoft’s level of provenance tracking goes past what the EU actually mandates. Europe has spent the past year arguing about machine-readable consent signals, including a stalled plan to replace cookie banners with one, and the marking rules apply that instinct to synthetic media.

The clock also hasn’t finished running. Under the Digital Omnibus, generative systems already on the market before Aug. 2 have until Dec. 2, 2026 for the Article 50(2) marking and detection duties, and until Feb. 2, 2027 for watermark-detection interoperability. Roughly 190 organizations had signed the Code as of July 31, by Paul, Weiss’s count.

What this means for you

If you generate an image in Paint or Photos and post it anywhere, you’re publishing a number that Microsoft’s servers issued for that one prompt. The number is a per-request ID. It carries no name and no account ID by itself. Microsoft can probably resolve it back to you anyway, because its own documentation says it logs user and device identifiers with prompts, and because the generation debits your AI credits. Whether it keeps that mapping, and for how long, is unanswered.

Two practical things follow. Converting the file to BMP or screenshotting it drops the manifest while leaving the pixel changes in place, which gives you the worst of both: no readable credential, still a trackable mark. And if you want AI images with no server round trip at all, run a local model yourself. Li makes that point himself, noting that patching Paint to skip moderation and watermarking buys you nothing you couldn’t already get by running Stable Diffusion directly. Where the model runs tells you almost nothing about where the data goes.

The limitation worth watching is measurement. Until somebody publishes a robustness test against Watermarker.dll, and until Microsoft says what it retains and for how long, the working assumption has to be that the mark is present and you can’t see it. Article 50(2)‘s watermark-detection interoperability deadline lands Feb. 2, 2027. That’s the date detection tooling for marks like this one is supposed to become something outsiders can actually run.