Windows Paint Invisible Watermark: A Server GUID

Windows Paint embeds a 16-byte GUID in AI images

Paint's Watermarker.dll writes an invisible watermark whose payload is exactly 16 bytes, and Xusheng Li found that the payload is a GUID. A GUID is a 16-byte identifier meant to be unique. Written into the pixels, that payload is the AI watermark you cannot see in the picture.

File size is what made Li look for the invisible watermark. Watermarker.dll is 1.67 MB, which is large for a library that only has to add the small Copilot logo Paint can place at the bottom right of an image. That logo is the visible watermark, and its separate setting does not control the invisible one.

How Paint writes the invisible watermark, as described by the researcher

Item	Detail
Payload	The GUID, exactly 16 bytes; any other length returns an error
Message	A marker byte, the 16 GUID bytes and a checksum byte, 18 bytes in all
Bits	The 18 bytes become 144 single bits
Minimum image size	192 pixels wide and 192 pixels high
Redundancy	Each bit is placed at least three times, or the call fails
Method	Small quantized changes over selected image blocks, which Li calls a content-adaptive, SVD-style watermark

Li adds that he is not an expert in image watermarking. He also called the watermark function directly on a synthetic 512-by-512 image, and 193,376 of its 262,144 pixels changed. In that test the small changes reached most of the image, not just one corner.

The GUID comes from Microsoft's prompt moderation server

Li found that Paint does not make up the GUID on the PC; it gets the GUID from a Microsoft moderation endpoint before the local image model runs. Paint sends the prompt and the chosen style to that endpoint. The reply carries four fields: a revised version of the text, a generation ID, a watermark ID and a flag for whether the text refers to a person.

Li sent a real prompt through Paint's own signed-in session and received a GUID in the watermark ID field. That is the value Paint later writes into the pixels. He found no sign that the person flag controls the watermarking itself.

Paint also sends the previous prompt generation ID with its next moderation request. Li says this lets successive requests be linked explicitly.

Local Cocreator must embed the watermark itself

In Li's account, Paint has two ways to make an AI image, and only the local one has to write the mark into the pixels itself. Image Creator runs in Microsoft's cloud on Azure OpenAI ImageGen. Li says generation, watermarking and signing can all happen there, so Paint can receive a finished image that already carries the mark.

Cocreator runs on a Copilot+ PC, a Windows PC with an NPU (a chip built for AI work), where the NPU generates the image on the device. Li reasons that a local generator cannot rely on a cloud service to mark its output, so Paint has to write the server-issued GUID into the pixels itself.

Li says "local" here does not mean offline. As he reports it, Microsoft states that Azure online services still perform the safety checks and that Cocreator needs a Microsoft account and an internet connection. He adds that the finished local image goes through online signing too.

The two apps differ when watermarking fails. Paint turns the failure into a failed generation and returns no image. Photos, which calls the same routine behind its local Image Creator and Restyle Image features, logs that the mark will not be applied and appears to return the picture anyway.

The C2PA soft binding repeats the GUID hidden in the pixels

Li reports that a signed C2PA manifest in a saved PNG records the same GUID that Paint hides in the pixels. C2PA Content Credentials are a signed record, attached to a file, of where it came from. In a real image saved from Paint's Image Creator, Li found the manifest in an 18,979-byte block right after the PNG header.

Inside the manifest, a c2pa.soft-binding assertion names the algorithm com.microsoft.invismark.1 and records the same GUID that the server issued and that sits in the pixels. A soft binding is a value tied to the content itself, so the content can still be matched to its provenance record after someone strips the manifest from the file. Li adds that Microsoft signed that assertion.

Li also looked at the save formats. After an AI result is applied to the canvas, they are PNG, JPEG, GIF and Paint's own .paint format, and BMP is absent. In his reading, that lines up with the formats C2PA supports.

Microsoft discloses its C2PA use, but not the GUID's source

Microsoft discloses that Paint uses content filtering and C2PA, and the researcher found no disclosure of the GUID or where it comes from. As Li quotes it, the support page for Image Creator says Microsoft applies content filtering and that generated images carry a C2PA manifest that identifies them as AI-made. He also reports that the page says Image Creator uses Azure online services and that Microsoft collects user and device identifiers together with prompts, to prevent abuse.

What he did not find is a statement that the manifest holds a GUID tied to the invisible pixel watermark, or that Paint's local path gets that GUID from remote prompt moderation. He says those details carry obvious privacy and right-to-know implications. His post is one long web page, so a reader who wants to check these points can save it as Markdown first.

Li also notes that Article 50 of the EU AI Act, in force since August 2, 2026, requires AI content to carry a detectable, machine-readable mark, but not a GUID tied to a prompt. He says the rule might be related to this watermarking, but he does not claim it explains why Microsoft added the GUID.

Every point about the GUID is one researcher's finding. Microsoft's own page is described here only as Li quotes and reads it. To save Li's post as a file, try the tool that converts a page URL into Markdown.