MS Paint and Photos inivisibly watermark even locally generated output with GUID

Microsoft Paint and Photos are secretly embedding a server-issued GUID into the pixels of AI-generated images, even those produced locally, linking them to user accounts and prompts via remote moderation. This discovery has ignited a fierce debate on Hacker News about digital privacy, Microsoft's pervasive tracking, and the ethics of invisible provenance, drawing strong parallels to past controversies like printer tracking dots. The community is questioning the transparency and necessity of such deep, user-identifiable watermarking.

329

Score

138

Comments

Highest Rank

on Front Page

First Seen

Aug 24, 4:00 PM

Last Seen

Aug 24, 10:00 PM

Rank Over Time

The Lowdown

A recent reverse-engineering investigation has uncovered that Microsoft Paint and Photos invisibly watermark AI-generated images, even those produced using local models. This sophisticated system embeds a server-issued Globally Unique Identifier (GUID) directly into the image pixels and associated metadata, raising significant privacy concerns for users.

Microsoft Paint and Photos use local AI models but send user prompts to a remote Microsoft server for moderation. This server returns a unique watermarkId (a GUID) and a promptGenerationId.
The watermarkId is then invisibly embedded into the pixels of the locally generated image using a complex SVD-style watermarking algorithm; Paint halts image generation if this watermarking fails.
This GUID is also included in C2PA Content Credentials metadata attached to the file, asserting its origin from "Microsoft Responsible AI Provenance" and specifically referencing the embedded watermark as a "soft binding."
The system ensures that "local" AI generation still necessitates an internet connection for prompt moderation and to retrieve this unique tracking GUID.
Paint restricts saving AI-generated images to C2PA-compatible formats (PNG, JPEG, GIF, .paint), deliberately preventing formats like BMP that would strip file-level metadata, underscoring a design choice for persistent provenance.
The Photos app implements a similar invisible watermarking process, though it logs errors and proceeds even if watermarking fails, unlike Paint.
Microsoft's public disclosures mention C2PA metadata and remote content filtering but do not explicitly detail the server-issued, prompt-specific GUID embedded in pixels, particularly for local generation.
The author notes that this level of tracking extends beyond the EU AI Act's transparency requirements, which mandate general AI identification but not a prompt-specific, user-traceable GUID.

This intricate process reveals Microsoft's layered strategy for AI image provenance, integrating local processing with remote oversight and granular, pixel-level identification. The opaqueness surrounding the invisible, user-traceable GUID embedded in pixels challenges user expectations of privacy and truly "local" AI operations.

The Gossip

Pervasive Privacy Panics

A dominant theme is the deep concern over Microsoft embedding a unique, server-issued GUID directly into locally-generated AI images. Commenters draw parallels to printer tracking dots and other surveillance techniques, arguing that this practice facilitates user de-anonymization and erodes digital privacy. Many feel this exemplifies Microsoft's increasing "enshitification" and push towards pervasive tracking, making Windows less desirable.

Watermark Whys and Wherefores

Users debate the true purpose of the GUID watermark. While some acknowledge the need to identify AI-generated content, especially given regulations like the EU AI Act, many contend that a unique, prompt-specific GUID goes far beyond mere AI detection and points to a user-tracking agenda. Questions are raised about the resistance of such watermarks to removal and how they might be circumvented, particularly given the local implementation of the watermarking algorithm.

Microsoft's Muddled Methods

Commenters express frustration with Microsoft's approach to integrating AI features, citing instances of incorrect AI detection (e.g., mislabeling screenshots as AI-generated) and poorly implemented features. This leads to calls for users to abandon Windows for Linux or open-source alternatives, and suggestions for technical workarounds to bypass or remove the watermarks, such as modifying DLLs, using other software, or stripping metadata via format conversions.

Authenticity Arguments

The discussion extends to the broader implications of digital image provenance. Some argue that tools to verify authenticity are crucial in an age of AI-generated content, advocating for systems like C2PA. However, a strong counter-argument emphasizes that such systems, especially when tied to specific users or devices, can be easily abused, lead to false trust, or be used for surveillance rather than genuine content verification, drawing skepticism about their ultimate utility and potential for manipulation.