A reverse-engineering report about Microsoft Paint drew 558 points and 174 comments on Hacker News by the brief's August 24 snapshot. The number is a useful signal: developers are less surprised that AI images carry provenance than that a supposedly local generation can depend on a unique value issued by a remote server.
The finding comes from security researcher Xusheng Li, who traced Paint's image-generation path through several Windows DLLs. His analysis says Paint sends the user's prompt to a Microsoft moderation endpoint, receives a 16-byte GUID called watermarkId, runs the image model on the PC, and then writes that identifier invisibly into the resulting pixels. Microsoft already tells users that cloud services inspect prompts and that Paint adds C2PA Content Credentials. Its public documentation does not describe this server-issued pixel identifier.
That distinction matters for anyone evaluating an on-device AI feature. Local inference can keep the expensive model execution and source image on the PC while the surrounding workflow still exposes the prompt, account context, and a per-generation identifier to the vendor. Li's work does not show that the GUID contains a user identity, nor does it demonstrate a public service that can resolve a marked image back to a person. It does show a deliberate link between remote moderation, the generated pixels, and the signed provenance record.
The GUID arrives before the pixels exist
Li examined Paint version 11.2605.71.0 and found encrypted ONNX model files, including a 302.4MB model named mager.onnxe. His Cocreator call-chain analysis indicates that Paint posts the prompt, style, and previous prompt-generation ID to a Microsoft endpoint before local generation begins. The response parser expects a revised prompt, a new promptGenerationId, a watermarkId, and a flag indicating whether the prompt refers to a human.
The researcher then reused Paint's authenticated session to submit a test prompt. The server returned separate GUIDs for promptGenerationId and watermarkId. Paint passed the latter into Watermarker.dll, whose WmkWriteWatermark function accepts a payload of exactly 16 bytes. According to Li's static and live tests, Paint refuses to return a Cocreator result when that watermarking step fails.
Inside the encoder, the GUID becomes part of an 18-byte message: a prefix byte, the 16 GUID bytes, and a checksum. That produces 144 bits. Li found that the code rounds image dimensions to eight-pixel boundaries and requires at least three placements for every bit. On a synthetic 512-by-512 image, his test found changes in 193,376 of 262,144 pixels. The alterations were visually hidden; the count describes changed pixel values, not visible damage. He characterized the implementation as resembling a content-adaptive, block-domain watermark, while noting that he is not an image-watermarking specialist.
Local generation still needs Microsoft's cloud
Microsoft's own Paint support page says Cocreator and related features use the neural processing unit in a Copilot+ PC to generate images locally. The same page says users must sign in with a Microsoft account and stay connected to the internet because Azure services handle safety checks. Microsoft says it collects user and device identifiers along with prompts for abuse prevention and monitoring, while stating that it does not store input or generated images.
Li's tracing fills in part of that hybrid design. The cloud moderation response supplies both a revised prompt and the watermark GUID. The local Stable Diffusion path produces the pixels, then Paint embeds the GUID and makes another online request for provenance signing. The previous promptGenerationId is also sent with the next moderation call, which lets the service explicitly link successive requests. The analysis does not establish how long Microsoft retains those values or what internal records remain associated with them.
Paint also has a cloud path called Image Creator. Microsoft's documentation for Image Creator says that feature uses an authenticated cloud service and that AI-generated results carry a C2PA manifest. Li found that a cloud-generated image can arrive at Paint already watermarked and signed. Cocreator needs a local writer because its image pixels originate on the PC. The two routes reach a similar provenance result through different plumbing.
Microsoft Photos appears to use the same Watermarker.dll for local Image Creator and Restyle Image operations, according to Li's analysis. Its error handling differs: the Photos code appears to continue returning an image when watermarking fails, whereas Paint turns the failure into a failed generation. That behavior came from reverse engineering rather than a published Microsoft contract, so an app update could change it without notice.
One identifier lives in two layers
The pixel watermark is only half of the mechanism. Li saved an image from Paint and inspected its PNG chunks. He found an 18,979-byte caBX chunk containing a signed C2PA manifest. Its soft-binding assertion named the algorithm com.microsoft.invismark.1 and carried the same GUID that the moderation server had returned for the invisible watermark.
A shortened version of the structure he reported looks like this:
{
"c2pa.soft-binding": {
"alg": "com.microsoft.invismark.1",
"blocks": [{ "value": "83424621-03cb-40e3-9808-a9fae837156d" }]
}
}
The C2PA specification defines a soft binding as a fingerprint or invisible watermark that can match content to a provenance record even after the underlying file bits change. If someone strips the embedded manifest but a copy remains in a separate provenance store, a supporting system can use the soft binding to find a match. That is why placing the same value in the pixels and the signed manifest is more useful than adding metadata alone.
This also helps explain Paint's export choices. Li found that an AI result saved directly from Image Creator is offered as PNG, while results applied to the canvas can be saved as PNG, JPEG, GIF, or Paint's .paint format. BMP is absent from that route. The C2PA format guidance says classic formats such as BMP cannot embed arbitrary manifest data and need an external manifest instead. The restriction preserves the file-level provenance layer, although the pixel watermark is a separate signal.
A generation ID is not proof of personal tracking
The observed value is a 16-byte identifier for a generation event. Li demonstrated that Microsoft issues a different watermark value during prompt moderation and that Paint embeds it in the output. He did not show a decoder for com.microsoft.invismark.1, a public lookup endpoint, or a database row tying a recovered value to a named account. Claims that every Paint image can already be traced to an individual would go beyond the evidence.
The privacy question is narrower and still worth asking. Microsoft says the cloud receives prompts plus user and device identifiers for monitoring. The reverse engineering indicates that the same transaction also yields a per-generation watermark value, and the completed local image is submitted for online provenance signing. Users can choose whether Paint adds a visible Copilot logo, but Li found that this setting controls a separate function and does not disable the invisible mark. A team handling confidential prompts therefore cannot treat local NPU execution as an offline workflow.
There is a policy backdrop, though the code does not prove Microsoft's motive. The European Commission says the EU AI Act's Article 50 transparency duties became applicable on August 2, 2026. Its guidance describes machine-readable, detectable marking for generated or manipulated output. C2PA plus an invisible watermark fits that general technical direction. Article 50 does not, by itself, explain why Microsoft chose a prompt-associated GUID or how long related service data should be retained.
Microsoft could settle the open questions with documentation: whether the watermark can be resolved outside its systems, which services retain the GUID mapping, how retention works, and whether administrators can audit the data flow. Independent reproduction on current Paint and Photos builds would also show whether Li's observed paths are stable across hardware and regions. Until then, the grounded conclusion is limited but useful. Paint can execute image inference locally while the prompt, watermark identifier, and provenance signing still pass through Microsoft's cloud.