MS Paint and Photos inivisibly watermark even locally generated output with GUID

This article reveals the presence of invisible watermarks in images generated by Microsoft's Paint application. The research began with an exploration of various Windows features, including AI capabilities incorporated into the Paint app. Initially, it was assumed that the image generation process involved a remote API call. However, after setting up Binary Ninja MCP with Codex and analyzing the code, it became clear that Microsoft had implemented local models as part of Copilot.

The Paint application is located in a specific Windows Apps path, and there are four ONNX model files with the .onnxe extension. The format of one of these files (seg.onnxe) is known, but the other three initially appeared different. It turned out that Microsoft had not changed the algorithm, only the key. The decryption of these files revealed a Watermarker.dll responsible for adding both visible and invisible watermarks.

The visible watermark consists of a small Copilot logo at the bottom right of the generated image. The invisible watermark, however, is more intriguing. It is added by a function called AddPerceptibleWatermark, and a different WmkWriteWatermark function is responsible for embedding the watermark after a local Stable Diffusion image generation.

The payload for this process is a 16-byte GUID, which is not directly embedded by the WmkWriteWatermark function. Instead, it constructs an 18-byte (144-bit) message, using a content-adaptive block-domain, SVD-style watermark technique.

The GUID for the invisible watermark comes from a network request sent to a moderation endpoint. Microsoft receives and moderates the prompt, then issues a unique GUID that is embedded into the locally generated image. This process occurs before the image is generated locally, meaning that "generated locally" does not mean that the entire operation is local.

The watermarkId from the server's response is what becomes part of the generated image, while the PromptGenerationId is sent with subsequent moderation requests to link them explicitly.

Additionally, Paint attaches Content Credentials (C2PA) to the saved files, which includes the watermarkId along with the PromptGenerationId. This information is stored alongside the image, allowing it to be associated with the moderation request.