Do Son 
According to a reverse-engineering report published by security researcher Xusheng Li, Microsoft embeds an invisible blind watermark into AI-generated images produced through both the Paint app and the Photos app. The research found that the identifier used within this watermark originates from Microsoft’s own servers. Moreover, this mechanism operates entirely independently of the Microsoft Copilot watermark that users can manually toggle on or off. As a result, users have no way to fully disable the blind watermark.
Local AI Image Generation on an AI PC Still Requires a Server Connection
The research found that although Paint’s Image Creator feature can generate images using a locally hosted Stable Diffusion model on an AI PC, the overall process is not fully offline. Before generation even begins, Paint transmits the user’s prompt text and selected style to a Microsoft server for review. The server then returns a modified prompt, a prompt generation ID, and a watermark ID. Only after receiving this response does the image get generated locally on the device’s NPU.
Once generation is complete, Paint invokes a blind-watermark component that writes the 16-byte watermark parameters returned by the server directly into the image’s pixel data. The watermark itself is invisible to the naked eye. However, Microsoft can use certain detection mechanisms to determine whether an image was generated by the Paint app.
A GUID Identifier Written Directly Into Pixel Data
Reverse-engineering analysis revealed that the watermarking mechanism expands a 16-byte GUID into 144 bits of data. This data is then embedded by making subtle modifications across multiple regions of the image. Researchers tested this against a 512×512 pixel image. They found that more than 190,000 pixels underwent subtle changes once Microsoft’s blind watermark was applied.
More notably, within the Paint app, if the blind-watermark writing process fails for any reason, the entire AI image generation task is treated as an outright failure. Rather than returning the image without a watermark attached, it does not generate the image. This makes clear that Microsoft regards this step as a mandatory part of the AI generation pipeline. No image is produced unless the blind-watermark process completes successfully.
Screenshots and Cropping Don’t Defeat Microsoft’s Detection
Beyond modifying pixel data, Paint also attaches the industry-standard C2PA content credential to generated images. Upon examining an actual generated PNG file, researchers found that its C2PA manifest not only explicitly labels the image as AI-generated, but also records the Microsoft InvisMark blind-watermark information.
The watermark value stored within that manifest exactly matches the watermark ID the server originally returned and physically wrote into the image’s pixels. This means Microsoft effectively employs two independent layers of provenance verification: C2PA metadata plus an invisible watermark hidden within the pixel data itself. As a result, even if a user removes the C2PA metadata using some tool, Microsoft can still identify the watermark through pixel analysis. Therefore, simple actions like taking a screenshot or cropping the image cannot fully destroy the blind watermark.
Additionally, the AI image generation and style transfer features within Microsoft’s Photos app rely on the same blind-watermarking mechanism. One notable difference exists, however. While Paint terminates image generation entirely if watermark writing fails, the Photos app instead logs the error and still returns the generated result.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
