Microsoft Paint and Photos apps add invisible watermark to AI-generated content — developer reverse engineers GUID embedding

Developer Xusheng Li has uncovered some previously unknown functionality deep within Microsoft’s Paint and Photos apps. The findings concern GUID watermarks. While these programs clearly add Copilot logo watermarks to images where LLM image generation has played a part in the process, Li also uncovered an invisible watermark and the process behind embedding it. To be clear, both these watermarks are merely to identify/verify imagery where AI has had a role in the creation, so GUID should not be confused with the recent controversies over Microsoft’s GDID traceable device-specific telemetry.

Li says that simple curiosity spurred him to investigate the AI features of the Paint app in Windows 11. The image generation functionality being capable of calling a remote API was expected. However, the dev got more curious when four apparent model files were found in the app path for local processing. Specifically, one of the local files was an ONNX-like model, the other 3 were encrypted ONNX-like files…

With all four files unencrypted and open to probing, investigations led to watermarker.dll being uncovered. Initially, Li thought it was just for visible watermarking tooling, leaving a Copilot logo on the bottom right of the image. It calls the AddPerceptibleWatermark function to do this. However, with curiosity stoked by the DLL file’s larger-than-expected size, the dev decided to ask AI to analyze the file. The AI found there was also a function to embed an invisible watermark.

The invisible watermarking function is called WmkWriteWatermark. Microsoft’s embedding process basically insists on this invisible watermark in its Stable Diffusion image generation output. If WmkWriteWatermark fails for any reason, the generation process will result in an error.

Coalition for Content Provenance and Authenticity (C2PA) credentials

Li provides some further technical insight into the hidden watermark. Most strikingly, he asserts that the watermarking information mixes a server-issued GUID into the pixels. That isn’t the end of the identifying data bundling. “Paint does more than alter the pixels,” notes the dev. “It also attaches C2PA Content Credentials to the saved file. The code responsible for this lives in ProvenanceHelper.dll, backed by provenancesdk.dll.”

In conclusion, even on devices where local image generation occurs, the prompt is still sent to Microsoft servers for moderation, says Li. Moreover, the dev indicates this watermarking is mandatory, and if the process fails, Paint will abort the entire image generation process. In Photos, there is the same GUID mechanism in place when AI is used, but it will still return the image and just log an error if the watermarking process has issues.

It is thought that all this hidden processing “might be related to Article 50 of the EU AI Act, whose transparency rules took effect on August 2, 2026, and require AI-generated content to carry a detectable, machine-readable mark—but not a prompt-specific GUID.”