MS Paint and Photos inivisibly watermark even locally generated output with GUID

This research began with curiosity about Microsoft Paint. The author recently explored less-explored Windows features like UCPD, WHESCVC, and the AI features added to Paint. While expecting remote image generation via an API, the author discovered that Microsoft ships local models as part of Copilot. The Paint app is located in a specific Windows Apps path, and there are four model files with the .onnxe extension.

Microsoft did not change the algorithm, only the key, as evidenced by the use of the same decoder for all files.

Within the DLL files, the author found a Watermarker.dll responsible for adding both visible and invisible watermarks. The visible watermark is a Copilot logo at the bottom right of generated images. The invisible watermark is added by the WmkWriteWatermark function, triggered after local Stable Diffusion image generation. The function takes a 16-byte payload, which is a GUID received from a network request.

Microsoft receives and moderates the prompt, then issues a unique GUID that is embedded into the locally generated image.

Additionally, Paint attaches Content Credentials to the saved file using the ProvenanceHelper.dll library. This process involves sending the prompt, style, and previous promptGenerationId to a moderation endpoint, which responds with two GUIDs: watermarkId and containsHumanReference. The watermarkId becomes part of the generated image, while the containsHumanReference field classifies whether the prompt refers to a human.