Join for quick access. Enter your email below and we'll send confirmation plus sign you up to our newsletter.
By submitting your information, you confirm you are aged 16 or over,
have read our
Privacy Policy
and agree to the
Terms & Conditions. Geographical rules apply.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
You are now subscribed
Your newsletter sign-up was successful
Join the club
Get full access to premium articles, exclusive features and a growing list of member rewards.
An account already exists for this email address, please log in.
Microsoft Paint and Photos apps add invisible watermark to AI-generated content — developer reverse engineers GUID embedding
Developer Xusheng Li has uncovered some previously unknown functionality deep within Microsoft’s Paint and Photos apps. The findings concern GUID watermarks. While these programs clearly add Copilot logo watermarks to images where LLM image generation has played a part in the process, Li also uncovered an invisible watermark and the process behind embedding it. To be clear, both these watermarks are merely to identify/verify imagery where AI has had a role in the creation, so GUID should not be confused with the recent controversies over Microsoft’s GDID traceable device-specific telemetry.
Li says that simple curiosity spurred him to investigate the AI features of the Paint app in Windows 11. The image generation functionality being capable of calling a remote API was expected. However, the dev got more curious when four apparent model files were found in the app path for local processing. Specifically, one of the local files was an ONNX-like model, the other 3 were encrypted ONNX-like files…
With all four files unencrypted and open to probing, investigations led to watermarker.dll being uncovered. Initially, Li thought it was just for visible watermarking tooling, leaving a Copilot logo on the bottom right of the image. It calls the AddPerceptibleWatermark function to do this. However, with curiosity stoked by the DLL file’s larger-than-expected size, the dev decided to ask AI to analyze the file. The AI found there was also a function to embed an invisible watermark.
The invisible watermarking function is called WmkWriteWatermark. Microsoft’s embedding process basically insists on this invisible watermark in its Stable Diffusion image generation output. If WmkWriteWatermark fails for any reason, the generation process will result in an error.
Coalition for Content Provenance and Authenticity (C2PA) credentials
Li provides some further technical insight into the hidden watermark. Most strikingly, he asserts that the watermarking information mixes a server-issued GUID into the pixels. That isn’t the end of the identifying data bundling. “Paint does more than alter the pixels,” notes the dev. “It also attaches C2PA Content Credentials to the saved file. The code responsible for this lives in ProvenanceHelper.dll, backed by provenancesdk.dll.”
In conclusion, even on devices where local image generation occurs, the prompt is still sent to Microsoft servers for moderation, says Li. Moreover, the dev indicates this watermarking is mandatory, and if the process fails, Paint will abort the entire image generation process. In Photos, there is the same GUID mechanism in place when AI is used, but it will still return the image and just log an error if the watermarking process has issues.
It is thought that all this hidden processing “might be related to Article 50 of the EU AI Act, whose transparency rules took effect on August 2, 2026, and require AI-generated content to carry a detectable, machine-readable mark—but not a prompt-specific GUID.”
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Mark Tyson is a news editor at Tom's Hardware. He enjoys covering the full breadth of PC tech; from business and semiconductor design to products approaching the edge of reason.
Its a fine thing to make AI images easily identifiable as such. Most image generation apps do this and in a way that survives most post gen manipulation. Stable Diffusion has a cool article about how it works... it's a surprisingly complicated process.
That said, I'm not a fan of sending local data off box for unknown purposes.
A developer has uncovered some previously unknown GUID watermarking functionality deep within Microsoft’s Paint and Photos apps.
Microsoft Paint and Photos apps add invisible watermark to AI-generated content — developer reverse engineers GUID embedding : Read more
It's far from the first time images have had hidden modifications. Anyone remember warez sites using images with embedded zips https://github.com/90th/zipper?
I'm a bit mixed on this. Having some robust way to say "yes this image is ai generated" is genuinely good. Honestly it should probably be a legal requirement at this point as long as it doesn't contain unique user identifiable information. I don't even mind them sending off the prompts for moderation - fine whatever. I just wish they were more transparent about doing it.
In conclusion, even on devices where local image generation occurs, the prompt is still sent to Microsoft servers for moderation
Fine to insist on an AI content identifier, but sending the content of the prompt for local image generation to Microsoft is definitely crossing the line.
There should be a reasonable expectation of privacy here, and there is no defensible argument here for a process that absolutely does not require personal activity data to be sent to Microsoft.
It's exactly this kind of behavior that has people carefully scraping through every inch of their OS like it's a gifted Qatari luxury plane each install. You're selling a commercial product, not signing people up for Big Brother-style monitoring. If you want to monitor your users every move, be open about it, create a special version of the OS for that purpose, then pay them for their data by the hour. Otherwise, keep your nose from where it doesn't belong.
