Your Paint-generated image leaves with a number inside it

The prompt leaves, even when the image doesn't

On a Copilot+ PC, Paint can whip up an image without touching the cloud. The generation model runs on the NPU, the AI-dedicated chip that defines this whole category of machines. The workshop sits right there on your desk.

The purchase order, though, still goes through headquarters. Before generation starts, Paint sends the prompt to a Microsoft moderation server. And that server doesn't just hand back filtered text: it hands back a number, which Paint then writes into the pixels of the image produced on your machine.

That's what Xusheng Li, a developer at Vector 35, laid out in a reverse-engineering writeup published August 20. The Register picked it up this Tuesday.

Sixteen bytes, and 193,376 pixels that move

Li took apart Watermarker.dll, a 1.67 MB library shipped with Paint 11.2605.71.0. It exposes a watermarking function that rejects any payload other than exactly sixteen bytes, throwing two distinct error codes depending on whether it's too short or too long.

Sixteen bytes happens to be the size of a GUID, a universally unique identifier. The calling function's signature says as much without hedging: it demands a winrt::guid.

That GUID gets padded to eighteen bytes, 144 bits, with a prefix and a checksum, then scattered across the image. The encoder requires every bit to be planted at least three times, like an address copied onto three sides of a package in case one label peels off in transit. On a 512-by-512 test image, Li measured 193,376 modified pixels out of 262,144.

This invisible watermark is a separate mechanism from the small Copilot logo Paint offers to stamp in the bottom-right corner: two separate code paths, and the toggle that controls the second has zero effect on the first.

The server's answer fits in four fields

Li didn't stop at the code. He replayed an actual request to the moderation endpoint, reusing Paint's authenticated session, with the prompt "a cobalt blue circle above a tiny orange square."

The server answered with four things: revisedPrompt, the text as possibly rewritten; promptGenerationId, a generation identifier; watermarkId, the GUID that ends up in the pixels; and containsHumanReference, a boolean flagging whether the prompt references a person. With a second prompt describing a portrait, that last field flipped to true.

Two details matter here. Paint sends back the previous promptGenerationId on the next request, explicitly linking generations that belong to the same series. And if writing the watermark fails, Paint turns the whole generation into an error rather than serve an unmarked image.

Watermarking, then, is a condition of delivery, not a finishing touch. Photos is more forgiving about it: it logs the failure and hands over the image anyway.

The same number, signed into the metadata

There's still the visible side of the setup, the part Microsoft actually documents. Generated images carry a C2PA manifest, the provenance standard Microsoft co-founded.

Li opened a PNG saved from Paint. The manifest contains an assertion named c2pa.soft-binding, using the com.microsoft.invismark.1 algorithm, and as its value, the exact same GUID that's written into the pixels. All of it cryptographically signed, carrying the line "Content watermarked by Microsoft Responsible AI."

A soft binding exists precisely to survive metadata stripping. The manifest is the catalog card, the watermark is the number engraved on the back of the painting: lose the card, and you can still find the painting. Consistent with that, BMP, Paint's legacy format, has vanished from the list of possible save formats for a generated image. It simply has no way to carry a manifest.

What Microsoft says, for its part

Microsoft's help page on Image Creator is public, and more revealing than you'd expect. It states that a Microsoft account is required. The application documentation on Microsoft Learn specifies that this requirement holds even for features that run locally.

The privacy section reads: "Microsoft collects attributes such as device and user identifiers, along with the user prompts, to facilitate abuse prevention and monitoring." Device and account identifiers, collected right alongside the prompts.

The next line reads: "Microsoft does not store your generated images."

The dry cleaner doesn't keep the garment. It keeps the ticket. Except here, the ticket number is sewn into the lining of the garment the customer takes home.

What this number allows, and what nobody has shown

Precision matters here, because this is exactly the point where a story like this falls apart. Li never demonstrates that Microsoft keeps a table linking that GUID to an account. He doesn't claim it either. What he does write is that he found no documentation explaining why this identifier exists, where it originates in prompt moderation, or why it ends up in the pixels.

Nobody, at this point, can say that Microsoft can trace an image back to its author.

Still, this number is no throwaway session token, and that's exactly what makes the question worth asking. It's issued per generation, with every prompt producing its own pair of identifiers. It travels over an authenticated request, on a service that requires an account.

Add to that the deliberate chaining of successive generations, and a cryptographic signature. An identifier you sign is an identifier built to last.

Every technical link needed to trace a generation back to someone exists on the server side. The one link nobody outside Microsoft can verify is retention. The Register frames the same point conditionally, and recalls an older case: the tracking dots laser printer makers built into every page, which only alarmed privacy advocates once someone actually found them.

The requirement asked for less than this

Article 50 of the AI Act took effect on August 2. We flagged that deadline here: it requires generated content to carry a mark that's detectable and machine-readable. It does not require a unique identifier per generation.

On August 13, we wrote about the pitfalls of Claude's watermark, the same subject seen from the obligation's side: a mark that travels with the user's text while the obligation itself stays with the provider. This is the same mark, seen from the side of what it actually carries.

The regulation sets a goal without mandating a method, leaving each signatory free to pick its own implementation. Microsoft chose one that goes well beyond the required minimum, The Register notes. What the minimum would have cost is a different question.

Asked for comment by The Register, Microsoft had not responded by publication time. The help page, meanwhile, still holds both lines in the same paragraph: prompts are collected along with identifiers, and generated images aren't retained. That's true. The company doesn't need to keep the image. The image keeps the number.