Microsoft Paint's AI-generated images contain an invisible watermark embedding a GUID issued by Microsoft's servers. Software developer Xusheng Li confirmed with actual images that the same watermarkId is also recorded in the signed C2PA provenance data. In Microsoft Photos, a code path was found that passes a different promptGenerationId to the same watermarking library, though this has not yet been confirmed with a dynamic test on actual images.
Paint's scope includes the local image generation feature that runs on the NPU of Copilot+ PCs. However, even when image generation itself runs on the device, prompt moderation and signing of the provenance data happen online. Microsoft has disclosed that it collects device and user identifiers along with prompts, but it has not disclosed whether the two types of GUIDs are stored and matched against account information.
The watermarkId embedded in the image file is not itself a Microsoft account ID. It is also a separate GUID from the promptGenerationId used to chain requests and for signing. Although both are issued in the same moderation response, it has not been demonstrated that a third party can identify a user from an image, nor that Microsoft cross-references server records to identify the creator.
Local generation still passes through Microsoft's servers before and after
In the Cocreator feature of Paint version 11.2605.71.0 that Li examined, the prompt, style, and the previous promptGenerationId are sent to a moderation endpoint on Azure before an image is created. The server returns a revised prompt along with a new promptGenerationId and watermarkId. Because the previous ID is passed to the next request as lastPromptGenerationId, the sequence of generation requests is explicitly chained together.
In Li's tests, using Paint's own authenticated session, the server returned both GUIDs with an HTTP 200 response. After that, the local NPU generates the image from the revised prompt and the user's sketch, and Watermarker.dll writes the watermarkId into the pixels.
The correspondence between each stage is as follows.
| Stage | Information handled during Paint's local generation |
|---|---|
| Prompt moderation | Sends prompt, style, and previous promptGenerationId |
| Moderation response | Receives revisedPrompt, promptGenerationId, watermarkId, and other data |
| On-device image generation | NPU processes revisedPrompt and sketch |
| Invisible watermark | Embeds watermarkId into pixels |
| Online signing | Sends promptGenerationId, image, generation conditions, etc. |
| C2PA manifest | Signing path that records watermarkId in the soft binding |
So what "local" actually refers to is the inference stage that synthesizes the image. Microsoft's own official explanation likewise states that while the Copilot+ PC feature generates images on the NPU, it requires a Microsoft account and an internet connection, and the safety features run on Azure.
A 16-byte GUID links pixels to C2PA
What gets passed to the watermark is fundamentally a 16-byte GUID. Paint's implementation concatenates a leading 1-byte value, the GUID, and a 1-byte checksum, expanding it into 18 bytes, or 144 bits. Each bit is placed at least three times, and the process requires images with both width and height of at least 192 pixels.
When Li tested this with a synthesized 512×512-pixel image, 193,376 out of 262,144 total pixels changed between the before and after states. This is not a test of visual quality or robustness against processing, but it does show that, unlike a technique that places a small mark in a corner, the implementation spreads tiny changes across the entire image. In Paint, if the watermark write fails, the entire image generation process results in an error.
Furthermore, an actual PNG saved from Paint contained an 18,979-byte caBX chunk, and the C2PA manifest included the algorithm name com.microsoft.invismark.1 along with the same GUID. This means the watermarkId returned by the server, the watermark embedded in the pixels, and the c2pa.soft-binding.value all matched.
C2PA's soft binding is a mechanism for recovering provenance records using an identifier extracted from the image itself, even if the manifest embedded in the file is lost due to social media sharing or image editing. C2PA's official registry lists com.microsoft.invismark.1 as Microsoft Responsible AI InvisMark for images and video.
Detection rates after recompression, resizing, or screenshotting for Paint's implementation have not been made public. C2PA's official registry only shows the technology name InvisMark and the target media types; whether this particular Paint implementation survives various forms of processing needs to be measured separately.
The distance between the GUID embedded in an image and the user ID
In Paint's support documentation, Microsoft explicitly states that it collects device and user identifiers along with prompts for abuse prevention and monitoring purposes. Even for local generation, signing in to a Microsoft account is mandatory. The moderation server issues both promptGenerationId and watermarkId in response to the same request, and the subsequent signing request sends the former along with the watermarked image to Microsoft. This process could allow Microsoft to correlate both GUIDs with account-related information, but whether such a correspondence table is stored, or whether any matching operation is actually performed, has not been confirmed.
However, the value recorded in the image is a per-generation GUID, not an account name or device ID. Publicly available materials do not reveal whether Microsoft stores a correspondence table, how long it might be retained, or whether matching is actually performed. There is also no evidence that the same GUID is attached to separately generated images, so it cannot be said that a third party could bundle multiple images together as the work of the same user simply by looking at them.
Extracting the GUID from an image with its metadata stripped would also require a detector compatible with InvisMark. Li's investigation did not demonstrate a general-purpose decoder or Microsoft's own provenance lookup service. The plausible tracking path, if any, would be a matching process performed by Microsoft assuming it retains a correspondence record—not a mechanism by which anyone could identify an individual just by examining an image.
Photos passes a different GUID to the watermark
Microsoft Photos version 2026.11060.2004.0 also contains a Watermarker.dll of the same name, called from the local Stable Diffusion paths of Image Creator and Restyle Image. Whereas Paint embeds a dedicated watermarkId, Photos' code was found to convert promptGenerationId into a GUID and pass that to the watermark instead. Another difference from Paint is that when the watermarking process fails, Photos appears to log an error while still returning the image.
The evidence presented for Photos is primarily based on static analysis of the binary. It does not rise to the same level of dynamic confirmation as the actual server responses and C2PA analysis of saved images demonstrated for Paint. The fact that both apps use the same library, and whether the same storage and matching policy is applied on the server side, need to be considered as separate questions.
The visible Copilot logo follows a different path as well. Paint's settings for "Don't show," "Always show," and "Ask every time" control AddPerceptibleWatermark, but they have no effect on WmkWriteWatermark, which writes the GUID. In the version analyzed, no user-facing setting was found that disables the invisible watermark.
The EU's marking obligation and C2PA's privacy guidance
Article 50 of the EU AI Act, which applies from August 2, 2026, requires providers of generative AI systems to mark AI-generated or manipulated outputs in a machine-readable format so they can be detected. However, the EU's official explanation does not require a GUID unique to each prompt, nor does it require linking such an identifier to a specific user. Microsoft has also not stated that this implementation was introduced to comply with the EU rule.
C2PA's implementation guidance recommends that, when adding a soft binding, the mechanism should be optional for the user to choose. It also recommends explaining to creators both the benefit of being able to later recover provenance information and the privacy downside that can arise from being reconnected to a previous manifest. While this is not a legal obligation, it does specifically point to information that is missing from Paint's public documentation.
Microsoft has disclosed remote moderation, C2PA manifests, and the collection of device and user identifiers alongside prompts. What remains unexplained is that the watermarkId is embedded in both the pixels and the C2PA data, and that it is issued in the same moderation response as the separate promptGenerationId. Whether the two GUIDs are stored and matched together with account information remains unknown.
For users to make an informed judgment, they would need to know whether a correspondence table linking the GUID to account information is stored, how long it is retained and for what purpose, and whether the invisible watermark can be disabled. If Microsoft were to clarify these three points, it would become possible to properly evaluate the boundary between a feature that preserves provenance over the long term and an identifier that could potentially undermine anonymity.