Microsoft Paint and Photos embed server-issued GUIDs in local AI images
Reverse engineering reveals that "local" AI generation on Copilot+ PCs still requires an internet connection to link user prompts to invisible pixel watermarks and C2PA provenance manifests.
New research indicates that Microsoft Paint and Photos embed a server-issued unique identifier, or GUID, into the pixels of AI images generated locally on Copilot+ PCs. While the image generation process relies on local Stable Diffusion models running on the device’s neural processing unit, the applications transmit user prompts to Microsoft servers for moderation. The server returns a specific GUID, which is then embedded as an invisible watermark using a content-adaptive block-domain method.
The analysis, published on 24 August 2026, highlights that the term "local" generation does not imply an offline process. The local generation path, known as Cocreator, requires an active internet connection for prompt moderation and provenance signing. This creates a two-layer provenance system where the pixel-level watermark is cryptographically linked to a C2PA Content Credentials manifest attached to the saved file.
In a test case involving a 512-by-512 image, the watermark encoder altered 193,376 of the 262,144 pixels through small quantised changes. The 16-byte watermark payload is confirmed to be a GUID issued by Microsoft’s remote moderation endpoint rather than a value generated locally. This identifier allows the server to associate the signing request with the watermark already present in the submitted pixels, ensuring the content can be matched with its provenance record even if the file-level manifest is removed.
Microsoft’s Image Creator support page discloses the use of remote content filtering and C2PA metadata but does not explicitly detail the server-issued GUID or its direct association with prompt moderation. The research notes that this lack of explicit disclosure raises privacy questions regarding the undisclosed link between a user’s specific prompt and the embedded identifier.
The study also identified differences in failure behaviour between the two applications. If the watermark encoder fails in Microsoft Photos, the image is still returned to the user. In contrast, Paint treats a watermarking failure as a failure of the entire generation, meaning the image is not returned. This distinction suggests that Paint is designed to ensure every locally generated image carries the provenance marker.
The findings arrive as the EU AI Act Article 50 transparency rules take effect, requiring AI-generated content to carry a detectable, machine-readable mark. While Microsoft has previously added visible Copilot logo watermarks to Paint, this invisible pixel-level system represents a more granular approach to tracking the origin of AI-generated content.
