How Paint Hides a GUID in AI-Generated Images

Open Microsoft Paint on a Copilot+ PC, a Windows computer with dedicated artificial-intelligence hardware, draw a loose shape, type a prompt, and watch Cocreator turn the sketch into polished artwork. The result may look completely ordinary, especially when the visible Copilot logo is disabled. Yet reverse engineering of recent Paint and Photos builds found a second signal: a watermark, meaning a hidden mark added to media for identification, carrying a server-issued GUID.

A GUID, or globally unique identifier, is a 128-bit number commonly written as a long group of hexadecimal characters. Here it is not the prompt and it is not displayed to the person using Paint. It identifies a generation event and is embedded into the image so software can look for it later. That detail makes the phrase “generated locally” much more interesting than it first sounds.

The analyzed Paint package also contained protected .onnxe model files that could be validated as ONNX graphs after reversing the wrapper. ONNX, or Open Neural Network Exchange, is a portable format for machine-learning models. The files support the conclusion that Cocreator is not only a window around a cloud-based image service.

Two watermarks, different jobs

Paint has two separate ideas of a watermark. The visible version is a small Copilot logo composited onto the bottom-right corner of an image. Its Never, Always, and Ask every time settings control whether people see that logo.

The hidden path is different. A Windows DLL, or dynamic-link library, packages reusable code that an application can call. Paint’s Watermarker.dll receives image buffers containing pixels—the tiny color samples that make up a raster image—and writes a modified copy. It does not add a logo or another visible layer. It changes the pixel values themselves.

Because those code paths are separate, turning off the visible watermark does not turn off the invisible one. The setting controls a disclosure aimed at human viewers; the hidden mark serves software that knows how to detect it.

Why does an image generated locally still need internet access?

Local image generation and remote safety checks are different jobs. Microsoft says Paint’s Cocreator uses a Neural Processing Unit (NPU), a processor designed for machine-learning calculations, to generate images on the computer. Before that local inference—the model’s act of turning input into an output—the application sends the text prompt, meaning the description of the desired image, and the chosen style to an online moderation service.

Moderation here means an automated safety review. Reverse engineering found that the response contains a revised prompt plus two identifiers:

{
 "revisedPrompt": "...",
 "promptGenerationId": "<GUID>",
 "watermarkId": "<GUID>"
}

The revised prompt goes toward the local Stable Diffusion model, a family of generative models that creates images from text and visual guidance. Paint keeps the identifiers for later steps. In the local Cocreator path, watermarkId is passed into the watermarking routine after the NPU produces the image.

The full arrangement looks like this:

prompt + sketch
 -> remote moderation
 -> revised prompt + server-issued identifiers
 -> local Stable Diffusion inference on the NPU
 -> pixel watermark using the GUID
 -> online C2PA provenance signing

Photos follows a similar pattern in the analyzed build. Its local Image Creator and Restyle Image paths use the same watermarking component, although the observed wrapper passes a GUID associated with the prompt generation. Microsoft’s Photos documentation also describes on-device models alongside an internet and account requirement for cloud safety services.

How 16 bytes become an invisible mark

At the boundary of WmkWriteWatermark, the payload—the small data buffer passed into the function—must be exactly 16 bytes. That matches the binary size of a GUID. A wrapper then expands it into an 18-byte message:

0x4c || GUID[16 bytes] || 1-byte checksum

The checksum is a quick consistency value made by adding the 16 GUID bytes and keeping the remainder after division by 256. Eighteen bytes contain 144 bits, so the encoder tracks 144 separate values. It attempts to place every bit at least three times across suitable regions of the image.

The routine aligns usable dimensions to eight-pixel boundaries, selects image blocks based on their content, and makes small changes in carefully chosen numerical values. Its matrix operations resemble a block-domain watermark based on singular-value-style decomposition, a mathematical way of separating important patterns from less important ones.

The implementation requires images at least 192 by 192 pixels. In one synthetic 512-by-512 test, more than 193,000 pixels changed after watermarking. That number sounds dramatic until the scale of each change is considered. “Invisible” does not mean that no pixels move. It means the changes remain below casual visual detection.

The same identifier appears in C2PA metadata

The pixels are only one layer. Paint also adds metadata, information stored alongside the image file rather than drawn into the picture. The relevant standard is C2PA, the Coalition for Content Provenance and Authenticity. C2PA Content Credentials are signed records that describe where an asset came from and what happened to it.

For the local generation path, the marked image is sent through an online signing step. An inspected PNG contained a caBX chunk, a named section inside the PNG file, holding a signed C2PA manifest. The manifest recorded the same GUID used by the pixel watermark under a c2pa.soft-binding value and identified Microsoft’s invisible-marking algorithm.

A soft binding is a link intended to help match an altered image with its provenance record even when the exact file bytes change or the visible metadata is removed. PNG can carry the manifest in a caBX chunk, JPEG uses APP11 marker segments, and GIF has its own application-extension form. BMP is more limited because it does not provide a standard place for arbitrary embedded data, which helps explain why Paint restricts AI-generated saves to formats such as PNG, JPEG, GIF, and .paint.

What the design means for privacy

Local does not mean offline, and it does not mean that no server-side record exists. Microsoft’s Paint documentation says an account and internet connection are required for cloud safety services. It also describes collecting prompts together with device and user identifiers for abuse prevention and monitoring, while separately stating that input and generated images are not stored.

The GUID itself does not reveal the prompt to someone who opens the image. Its meaning lives in the service that issued it. Because Paint sends the previous promptGenerationId with a later moderation request, successive generations can also be linked explicitly on the service side.

The two apps do not handle every failure identically. The observed Paint path treats a failed watermark operation as a failed generation, while Photos logs the error and appears able to continue with the image. That difference suggests that Paint treats the hidden mark as a required part of its output contract, whereas Photos has a more permissive fallback.

Neither signal is magic. File metadata can be stripped, and heavy editing or recompression can damage a pixel watermark. These mechanisms are not a universal truth detector. Their narrower purpose is to help a known pipeline identify, match, and describe content it produced.

That is the surprising lesson hidden inside an ordinary canvas app. The model can run on your computer while moderation, identifier issuance, and provenance signing remain online. The final image carries a small piece of that cloud transaction inside its pixels, with a signed explanation beside them: local inference, remote policy, and layered provenance working together.