What happened
A hidden Microsoft Paint AI watermark is quietly showing up in images that users assumed were generated fully offline. A researcher reverse-engineering Windows binaries with Binary Ninja MCP discovered that Microsoft Paint and Photos embed an invisible, traceable watermark into AI-generated images — even when the image itself is created entirely by a local, on-device model.
The investigation started as a curiosity project into Paint's lesser-known AI features. Digging through the app's installation folder (now shipped as a full Windows App package), the researcher found four encrypted `.onnxe` model files: a segmentation model, two inpainting-segmentation models, and a 302MB "mager" model. All four decrypt into standard ONNX models once XORed with keys hidden inside `segapi.dll` — one of which is a 4096-byte alphanumeric string, not the simpler "Microsoft_2023" key used in earlier versions.
While analyzing a file called `Watermarker.dll`, the researcher found two separate watermarking systems. The first is the visible Copilot logo users can toggle on or off in Paint's settings. The second — and the one nobody asked for — is an invisible watermark embedded through a function tied to `CPBDoc::Save`. Even on PCs where image generation runs 100% locally (as it does on Copilot+ PCs), the prompt is still sent to a Microsoft server for moderation. That server returns a GUID alongside the approved prompt, and that GUID gets silently baked into the final image file as an invisible watermark — regardless of whether the visible watermark toggle is on or off.
Why it matters
This isn't just an academic reverse-engineering footnote. It reveals a mismatch between what users are told and what actually happens. Paint's marketing pitch is that AI generation can run locally on Copilot+ hardware — implying privacy and independence from the cloud. In reality, the prompt-moderation round-trip still phones home, and the returned identifier becomes a permanent, invisible fingerprint in the output file.
Microsoft does disclose that Paint attaches C2PA metadata (the industry standard for content provenance, backed by Adobe, Microsoft, and others) to AI-generated images. That much is expected and even welcomed by many in the AI-content-authenticity community. What's less obvious is that AI images can only be saved in formats that support C2PA — PNG, JPEG, GIF, and the native `.paint` format — and that a second, separate invisible watermark tied to a server-issued GUID rides along independently of the visible toggle and independently of the C2PA disclosure the user sees.
For entrepreneurs, marketers, and creators who build workflows around AI-generated visuals, this matters because it changes the privacy assumptions baked into "local-only" AI tools. If an image can be traced back to a specific generation session via an embedded GUID, that has implications for anonymity, brand experimentation, and even competitive research where you'd rather not leave a paper trail.
How to use it today
If you're already using Paint's Cocreator or Image Creator features, there are a few practical steps worth taking. First, understand that toggling off the visible watermark in Paint's settings does nothing to the invisible one — they are controlled by entirely separate code paths. Second, check the file format: since the invisible watermark and C2PA metadata only attach to PNG, JPEG, GIF, and `.paint` files, converting or re-encoding the image into another format (or flattening it through a screenshot) will typically strip both.
Third, if your workflow depends on genuinely local, unlogged image generation — for confidential product mockups, early-stage branding concepts, or client work under NDA — it's worth using tools that don't route your prompt through a remote moderation server at all. For quick, no-account, browser-based generation without the extra plumbing, many creators are turning to lightweight alternatives like the [free AI tools at mykreatool.com](https://mykreatool.com), which skip the OS-level integration entirely and let you generate and download images directly.
Finally, if provenance and traceability actually help your business — say, you want to prove an image came from your own account for licensing or dispute purposes — the C2PA metadata is a feature, not a bug, and worth leaving intact.
Who benefits
Content authenticity advocates and platforms fighting deepfakes benefit most directly. A traceable GUID embedded in every AI-generated image, even offline ones, gives Microsoft (and potentially downstream platforms that read C2PA data) a way to verify origin and flag manipulated content. News organizations, stock image marketplaces, and social platforms building AI-detection pipelines gain a more reliable signal than visible logos alone, which are trivially cropped out.
Enterprise IT and compliance teams also benefit: an audit trail baked into image metadata can help track how AI tools are used across an organization, which matters for companies now writing internal policies around generative AI use.
Risks
The core risk is the gap between disclosure and reality. Users who saw the visible-watermark toggle and switched it off reasonably assumed their images carried no identifying marks — that assumption is false. A hidden identifier tied to a server-issued GUID that persists after the visible watermark is disabled is a transparency problem, not just a technical curiosity.
There's also a privacy dimension. Because prompt moderation happens server-side even during "local" generation, Microsoft has visibility into what was requested, and the returned GUID links that request to the specific output file. For anyone generating images tied to sensitive business plans, unreleased products, or personal content, that's a meaningful gap between the marketed "runs locally" experience and what's actually happening under the hood.
Finally, because the watermark rides on C2PA-compatible formats specifically, users who aren't aware of the format restriction may inadvertently keep the hidden marker by saving in PNG or JPEG out of habit, without realizing the metadata comes along for the ride.
Conclusion
The discovery of Microsoft Paint's invisible AI watermark is a useful reminder that "local" doesn't always mean "private," and that visible privacy controls don't necessarily cover everything happening behind the scenes. For creators and businesses relying on AI-generated visuals, it's worth knowing exactly what metadata and identifiers travel with your files — and choosing tools deliberately when traceability is, or isn't, something you want.
Comments 0