The finding, first detailed by software engineer Xusheng Li and subsequently examined by CyberInsider and Germany’s Dr. Web, changes the practical meaning of “local” generation in Paint. Microsoft’s own support documentation already says Cocreator uses local NPU inference while relying on Azure online services for safety checks, and that it collects prompts plus device and user identifiers for abuse prevention and monitoring. What the documentation does not spell out is that the moderation response apparently supplies a per-generation identifier which the client then writes into the image itself.
For Windows users and IT administrators, the important point is narrower than the most alarming interpretation: the available evidence does not show that the GUID itself contains a user ID, device ID, Microsoft account address, or persistent Windows identifier. It is a unique value associated with an individual generation request. But because Microsoft controls the service that issues it—and says it collects prompts and device and user attributes in the same safety workflow—the identifier could function as a lookup key in Microsoft’s own records if those records are retained and correlated.
Paint’s local AI workflow still requires Microsoft’s cloud
Microsoft describes Paint Cocreator as a hybrid service. The artwork is generated locally on a Copilot+ PC’s neural processing unit, but users must sign in with a Microsoft account and maintain an internet connection so Microsoft can apply its cloud-based safety systems. Microsoft says Azure performs the content filtering and that it does not store the user’s input or generated images.
Li’s analysis fills in technical detail behind that public description. According to the researcher, Paint sends a request containing the prompt and style to a Microsoft Azure endpoint before it starts the local model. The response includes a moderated or rewritten prompt, a prompt-generation ID, and a separate watermarkId represented as a 16-byte GUID.
That sequence matters for anyone who assumed that running Cocreator on an NPU meant prompts never left the PC. It does not. The local model avoids uploading the image-generation workload, but the requested subject matter still reaches Microsoft’s safety infrastructure. Microsoft’s published privacy language already confirms the prompt transmission and collection of user and device attributes; Li’s work indicates the same online exchange also seeds a durable provenance marker in the output.
Paint’s cloud-only Image Creator is a separate path. It uses Microsoft’s DALL-E-backed service and has always required authentication and cloud processing. The newly documented issue concerns the local Cocreator workflow, where the marketing distinction between on-device inference and fully offline operation can easily be misunderstood.
The visible Copilot watermark is not the hidden identifier
Paint has offered a visible Copilot logo watermark option for AI-generated artwork. Users can choose to show it, hide it, or be asked per image. That setting is meaningful for presentation, but it apparently does not govern the lower-level pixel watermark Li found.
The reverse-engineering report traces the hidden-marking work to Watermarker.dll. In Paint, the visible watermark setting affects a component called AddPerceptibleWatermark; the hidden write follows a different path, identified as WmkWriteWatermark. In other words, selecting “Don’t show” for the Copilot logo removes the obvious corner badge but does not, according to the analysis, stop Paint from encoding the server-issued GUID inside the generated image.
Li reports that the library converts the identifier into an 18-byte, 144-bit payload and distributes it through blocks of the picture, repeating each bit several times. In a synthetic 512×512 test image, the watermark operation changed 193,376 of 262,144 pixels. That figure should not be read as proof that three quarters of an ordinary photo will visibly degrade—the changes are designed to be imperceptible—but it demonstrates that the watermark is distributed across the image rather than placed in a small, easily cropped corner.
This is a familiar design goal for invisible provenance marks. A mark that survives some ordinary edits can still be detected after the easy step of stripping file metadata. It also means that deleting EXIF data, re-saving an image, or removing a visible logo should not be assumed to remove every provenance signal.
C2PA metadata and the pixel watermark use the same value
Microsoft openly says that AI images made with Paint include C2PA Content Credentials. C2PA is an industry provenance standard that stores signed assertions about an asset’s origin and edits. Unlike pixels, those file-level credentials can be removed by export tools, social networks, screenshots, or a metadata scrubber.
Li found a more consequential relationship: in a captured Paint-generated PNG, the C2PA manifest named Microsoft’s com.microsoft.invismark.1 algorithm and contained the same GUID passed to the pixel-watermarking code. The metadata layer and invisible pixel layer are therefore not merely two unrelated ways to label an AI image. They appear to be two parts of one provenance system.
C2PA calls this kind of connection a soft binding. A signed manifest can point to an invisible watermark in the media data, allowing a verifier to associate a surviving pixel-level signal with provenance information even if the original metadata was removed. The C2PA specification recognizes invisible watermarks as a soft-binding mechanism, while also cautioning that they are not a substitute for cryptographic integrity protection.
The design has a clear operational benefit: a C2PA manifest by itself is fragile when images move through services that rewrite or strip files. The hidden mark gives Microsoft a second signal. Yet the same resilience creates a disclosure problem. Microsoft tells Paint users that AI-generated images receive C2PA manifests, but its support pages do not explain that the manifest’s provenance value may also be encoded invisibly in the image pixels or that the value originates from an online moderation exchange.
What Microsoft’s published privacy statement does—and does not—answer
Microsoft’s Paint support page is unusually direct on several points. It says Cocreator sends necessary safety work to Azure, uses content filtering, collects prompts and device and user identifiers for abuse prevention and monitoring, and does not store input or generated images. Those statements undercut any claim that the entire Cocreator process is private simply because inference runs on the NPU.
They do not answer several questions raised by the watermarking analysis:
- Microsoft does not publicly state how long it retains the request data, moderation results, device and user attributes, or GUIDs associated with Paint generations.
- Microsoft does not explain whether a
watermarkIdcan be resolved only for abuse investigations, used for content-provenance detection, or associated with other account activity. - Microsoft does not say whether an image’s invisible GUID remains recoverable after resizing, recompression, cropping, screenshots, or image-to-image editing.
- Microsoft does not explain whether enterprise policy, consumer privacy controls, or a Paint setting can disable hidden provenance marking while retaining Cocreator.
Those omissions should keep the story grounded. A per-generation GUID is not automatically a tracking beacon, and nothing in Li’s published evidence establishes a public decoding service or proves an outsider can identify the person who made an image. The apparent correlation would require access to Microsoft’s server-side issuance records. But that is precisely why calling the image generation “local” without explaining the cloud moderation and server-issued watermark is incomplete.
Photos appears to use the same watermarking component
The analysis also found Watermarker.dll in Microsoft Photos. Li reported that the app’s local Image Creator and Restyle Image paths pass GUID-like values to the same library. A notable implementation difference is that Paint appears to fail the generation if watermark writing fails, while Photos may log the watermarking error and still return the result.
The Paint evidence is stronger because Li captured the live request-response workflow and examined a saved image’s C2PA data. The Photos conclusion rests more heavily on static analysis of the app binaries. It is reasonable to treat Photos as a likely extension of the same design, rather than as equivalently demonstrated behavior until Microsoft documents it or further runtime testing confirms it.
For managed Windows environments, administrators already have a supported control with clearer consequences: Microsoft’s WindowsAI Policy CSP includes DisableCocreator, which can turn off Paint’s Cocreator feature on supported Windows 11 Pro, Enterprise, Education, and IoT Enterprise systems. Organizations with rules against sending creative prompts to external services should use that policy rather than relying on the presence of an NPU or on removal of visible watermarks.
Microsoft’s provenance system may help establish that an image came from an AI workflow after its metadata has been stripped. But the record now shows that Paint’s “local” generation also depends on a Microsoft-issued identifier embedded in the final pixels. Anyone using Cocreator for sensitive concepts, internal product work, client mockups, or regulated material should treat the prompt as cloud-submitted data and the resulting image as carrying a persistent provenance signal unless Microsoft provides a documented opt-out.