{
  "id": 3055753,
  "title": "MS Paint and Photos inivisibly watermark even locally generated output with GUID",
  "url": "https://urgent.news/2026/08/24/ms-paint-and-photos-inivisibly-watermark-even-locally-generated",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-24T15:28:04.000Z",
  "source": {
    "name": "Hacker News",
    "slug": "hacker-news",
    "url": "https://xusheng.dev/posts/reversing/mspaint_invisible_watermark/main/"
  },
  "original_language": "en",
  "account": "This article reveals the presence of invisible watermarks in images generated by Microsoft's Paint application. The research began with an exploration of various Windows features, including AI capabilities incorporated into the Paint app. Initially, it was assumed that the image generation process involved a remote API call. However, after setting up Binary Ninja MCP with Codex and analyzing the code, it became clear that Microsoft had implemented local models as part of Copilot.\n\nThe Paint application is located in a specific Windows Apps path, and there are four ONNX model files with the .onnxe extension. The format of one of these files (seg.onnxe) is known, but the other three initially appeared different. It turned out that Microsoft had not changed the algorithm, only the key. The decryption of these files revealed a Watermarker.dll responsible for adding both visible and invisible watermarks.\n\nThe visible watermark consists of a small Copilot logo at the bottom right of the generated image. The invisible watermark, however, is more intriguing. It is added by a function called AddPerceptibleWatermark, and a different WmkWriteWatermark function is responsible for embedding the watermark after a local Stable Diffusion image generation. The payload for this process is a 16-byte GUID, which is not directly embedded by the WmkWriteWatermark function. Instead, it constructs an 18-byte (144-bit) message, using a content-adaptive block-domain, SVD-style watermark technique.\n\nThe GUID for the invisible watermark comes from a network request sent to a moderation endpoint. Microsoft receives and moderates the prompt, then issues a unique GUID that is embedded into the locally generated image. This process occurs before the image is generated locally, meaning that \"generated locally\" does not mean that the entire operation is local. The watermarkId from the server's response is what becomes part of the generated image, while the PromptGenerationId is sent with subsequent moderation requests to link them explicitly.\n\nAdditionally, Paint attaches Content Credentials (C2PA) to the saved files, which includes the watermarkId along with the PromptGenerationId. This information is stored alongside the image, allowing it to be associated with the moderation request.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Hacker News Best",
        "title": "MS Paint and Photos inivisibly watermark even locally generated output with GUID",
        "url": "https://urgent.news/2026/08/24/ms-paint-and-photos-inivisibly-watermark-even-locally-generated-3099566",
        "published": "2026-08-24T15:28:04.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}