Microsoft appears to be doing more than placing a visible Copilot logo on images created or modified with AI inside Windows 11. Developer Xusheng Li has reverse engineered parts of Microsoft Paint and Photos and found that the apps also embed an invisible watermark into AI-generated imagery, alongside machine-readable provenance information.
The discovery suggests Microsoft is building several layers of identification into AI-generated content, potentially making it easier for software and platforms to determine whether an image was created with generative AI.
The mechanism is separate from recent discussions around Microsoft device-specific telemetry. In this case, the GUID is being used as part of the AI content watermarking process.
The Investigation Started With Paint's AI Models
Li reportedly began investigating Paint's AI features out of curiosity.
The fact that Paint could call remote APIs for image generation was not especially surprising.
What caught his attention was the discovery of four apparent model files stored locally inside the application directory.
One appeared to resemble an ONNX model, while the other three looked like encrypted ONNX-style files.
After decrypting and examining those files, Li continued tracing how the image-generation pipeline worked.
That eventually led him to a component called:
watermarker.dll
At first, the obvious assumption was that this library simply handled the visible Copilot watermark that Microsoft places in the bottom-right corner of AI-generated images.
That visible watermark uses a function called:
AddPerceptibleWatermark
But the DLL contained more functionality than expected.
Paint Also Embeds an Invisible Watermark
Further analysis revealed another function:
WmkWriteWatermark
This is responsible for embedding an invisible watermark into the generated image.
Unlike the Copilot logo, users cannot simply see this watermark by looking at the picture.
Instead, identifying information is embedded into the image data itself.
According to Li's analysis, Microsoft mixes a server-issued GUID into the image pixels.
That gives generated imagery a machine-detectable marker even if the visible Copilot branding is later cropped or removed.
The exact way such a watermark survives editing, resizing or recompression will be important in determining how useful it is in practice.
But the broader intention appears clear: Microsoft wants AI-generated content to carry identification beyond a simple visible logo.
The Watermark Is Mandatory in Paint
One particularly interesting finding is that Paint appears to treat invisible watermarking as a mandatory part of the AI-generation process.
If WmkWriteWatermark fails, the image-generation workflow reportedly fails as well.
In other words, Paint does not simply generate the image and add provenance information when convenient.
The watermark is treated as a required step.
If Microsoft cannot successfully embed it, Paint aborts the generation process and returns an error.
That tells us something about how seriously Microsoft is treating content provenance.
From the application's perspective, an AI-generated image without the required identification is apparently considered incomplete.
Photos Uses the Same GUID Mechanism
Microsoft Photos reportedly uses a similar GUID-based watermarking mechanism when AI tools are involved.
There is one important difference, however.
If watermarking fails inside Photos, the application does not necessarily discard the result.
Instead, it can still return the image while logging an error.
That suggests Microsoft has implemented slightly different enforcement policies depending on the application.
Paint appears stricter.
Photos appears more tolerant of watermarking failure.
The reason for that difference is not yet clear.
Microsoft Is Also Adding C2PA Content Credentials
The invisible pixel watermark is only one part of the identification system.
Li also discovered that Paint adds C2PA Content Credentials to saved AI-generated files.
C2PA stands for the Coalition for Content Provenance and Authenticity, an industry initiative designed to provide verifiable information about how digital content was created and modified.
The relevant functionality reportedly lives inside:
ProvenanceHelper.dll
and is supported by:
provenancesdk.dll
This means Paint can attach provenance metadata describing the image's creation history in addition to modifying its pixels.
The two mechanisms complement each other.
C2PA credentials provide structured metadata that compatible software can inspect.
The invisible watermark provides another signal embedded directly into the image.
Together, they give Microsoft more than one way to identify AI-generated content.
Why Use Both Visible and Invisible Watermarks?
A visible watermark is easy for humans to understand.
If someone sees the Copilot logo in the corner, they immediately know AI was involved.
The problem is that visible marks are also easy to remove.
A user can crop the image.
They may cover the logo.
An editing application could erase it.
Invisible watermarking attempts to solve that problem by placing the signal inside the image itself.
C2PA adds another layer by recording provenance information in a standardised format.
The result is effectively three levels of identification:
That layered approach makes it more difficult for AI-generated images to lose every indication of their origin.
Even Local Generation Still Contacts Microsoft
Another notable part of Li's findings concerns so-called local image generation.
Even when the image-generation model runs on the device, the text prompt is reportedly still sent to Microsoft's servers for moderation.
That means "local generation" does not necessarily mean the entire process stays offline.
The model may generate the image locally, but Microsoft can still evaluate the prompt remotely before the process continues.
This distinction is important for users concerned about privacy.
Running an AI model locally reduces some cloud dependence, but it does not automatically mean that no information leaves the computer.
In this case, prompt moderation apparently still relies on Microsoft's infrastructure.
The GUID Appears to Come From Microsoft's Server
The server-issued GUID is particularly interesting because it suggests there is a connection between the generated image and server-side activity.
However, the research described here does not establish exactly what Microsoft stores alongside that GUID or how long such information is retained.
A GUID by itself is simply an identifier.
It does not automatically mean that Microsoft can identify the person who generated the image or reconstruct the original prompt.
More information would be required before drawing those conclusions.
The important finding is narrower: the identifier is issued by Microsoft's server and incorporated into the watermarking process.
That gives each generated item a machine-readable identifier that could potentially help verify its AI-generated origin.
This May Be Connected to the EU AI Act
The timing of the feature has also attracted attention.
Article 50 of the European Union AI Act introduced transparency requirements covering certain AI-generated and manipulated content, with relevant rules taking effect on 2 August 2026.
Those rules encourage or require AI-generated content to carry detectable, machine-readable identification in certain contexts.
Microsoft's watermarking and C2PA implementation would fit broadly with that transparency objective.
However, the reported requirement does not specifically demand a prompt-specific or server-issued GUID.
So while the regulatory timing may help explain why Microsoft is strengthening AI-content provenance, the exact design appears to go beyond simply satisfying a minimum machine-readable marking requirement.
Content Provenance Is Becoming a Bigger Industry Priority
Microsoft is not alone in trying to make AI-generated content identifiable.
As generative AI becomes capable of producing increasingly realistic images, video and audio, distinguishing synthetic material from authentic media becomes much harder.
Visible labels alone are unlikely to solve the problem.
Metadata can be removed.
Watermarks can sometimes be damaged.
Images can be screenshotted or heavily edited.
This is why the industry is increasingly relying on several complementary approaches rather than expecting one perfect solution.
C2PA has become particularly important because it attempts to record a verifiable history of how content was created and modified.
Instead of asking only:
"Is this image fake?"
the system tries to answer:
"Where did this image come from, and what happened to it along the way?"
That is a more useful question for journalists, platforms, researchers and consumers.
Watermarking Still Has Limitations
Invisible watermarking is useful, but it should not be treated as foolproof.
Images can be resized, compressed, filtered, recomposed or passed through additional generative tools.
Any watermarking system needs to remain detectable after ordinary editing while avoiding obvious degradation of image quality.
There is also the question of interoperability.
A watermark is much more valuable when many different tools can recognise it.
C2PA helps here because it is an industry standard rather than a Microsoft-only format.
A proprietary pixel watermark, on the other hand, may require Microsoft or compatible software to detect and interpret it.
The long-term value of the GUID system will therefore depend partly on how broadly Microsoft exposes verification capabilities.
The Discovery Shows How Much Happens Behind the Generate Button
From the user's perspective, AI image generation inside Paint looks simple.
Enter a prompt.
Wait a few moments.
Receive an image.
Behind that button, however, there may be several additional processes taking place:
The prompt is sent for moderation.
A model generates the image.
A visible Copilot mark may be added.
A server-issued GUID is embedded invisibly.
C2PA credentials are attached to the saved file.
Only after those steps succeed does Paint return the final result.
That hidden pipeline shows how AI applications increasingly combine generation, safety, provenance and regulatory compliance into a single workflow.
Final Thoughts
Xusheng Li's reverse engineering of Microsoft Paint and Photos reveals that the company's AI-content identification system goes much deeper than the visible Copilot logo.
AI-generated images can also receive an invisible GUID-based watermark embedded into the pixels, while Paint attaches C2PA Content Credentials to preserve additional provenance information.
In Paint, the watermark appears mandatory enough that image generation fails entirely if the process cannot be completed.
Photos uses similar technology but can still return the image if watermarking fails.
The findings also show that prompts may still be sent to Microsoft for moderation even when generation itself happens locally.
As AI-generated images become increasingly difficult to distinguish from ordinary photography and artwork, systems like this are likely to become much more common.
The bigger challenge will be ensuring those markers remain reliable after images are edited, shared, compressed and moved between platforms.
For Microsoft, the direction is already clear: AI-generated content should not simply look different — it should carry a detectable record that AI was involved, even when the human-visible watermark disappears.
Comments 0