> ## Content Index
> Fetch the complete content index at: https://varops.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Microsoft Paint's on-device AI generator stamps its images with an identifier issued by a Microsoft server
- URL: https://varops.com/microsoft-paints-on-device-ai-generator-stamps-its-images-with-an-identifier-issued-by-a-microsoft-server/
- Published: 2026-08-25T11:11:35.000Z
- Updated: 2026-08-25T11:11:35.000Z
- Description: Microsoft documented the cloud dependency, the prompt egress and the identifier collection on the page a user would actually read. The compute really is local. What no page mentions: the value stamped into the pixels is a per-generation identifier issued by the server that read your prompt.
- Author: Nix Nullty
- Tags: Overhyped

*Today's piece* will *disappoint anyone hoping for a villain. Microsoft documented the cloud dependency, documented the prompt egress, documented the identifier collection, and put it all on the page a normal person would actually read.* [*Nix*](https://varops.com/columnist/nix/) *went looking for the lie and did not find one. What Nix found instead is more useful and considerably more annoying: a vendor review that asks every correct question about what leaves your building,* butasks *no* questions *at all about what is baked into the files that stay in it. — Muximus*

---

Microsoft did this one properly, and your AI vendor review would still have missed it. Both of those things are true, and the second one is the story.

Here is what happened. The reverse engineer Xusheng Li went through Microsoft Paint's AI image features with Binary Ninja and [published the results on 21 August](https://xusheng.dev/posts/reversing/mspaint%5Finvisible%5Fwatermark/main/?ref=varops.com). On the on-device path, the model runs on your machine, precisely as advertised. The identifier stamped into the pixels of the finished image is issued by a Microsoft server during prompt moderation.

Not a leak. Not a lie. Just an answer to a question nobody on the buying side thought to ask.

## Credit where it's due

The Overhyped instinct is to open on the gap. That instinct is wrong here, and the reason it is wrong is most of the point.

Microsoft's [Copilot+ Paint support page](https://support.microsoft.com/en-us/windows/ai/ai-apps/use-copilot-pc-features-in-paint?ref=varops.com) says the features "make use of the Neural Processing Unit (NPU) to generate images locally on your computer," and then says, plainly, that to use them "you need to sign in with your Microsoft account and be connected to the internet to access cloud services that ensure safe use of AI." Under a heading called Privacy - an actual heading, not a link to a 40-page policy - it describes the architecture as a "unique hybrid approach of running the necessary safety systems on cloud using Azure online services to help ensure the safe and ethical use of AI, while the image generation happens on the device."

Then it volunteers the part most vendors bury: "The Azure online services perform content filtering to prevent the generation of harmful, offensive, or inappropriate content. Microsoft collects attributes such as device and user identifiers, along with the user prompts, to facilitate abuse prevention and monitoring."

And: "Microsoft does not store your input images or generated images."

Read that as a set. The prompt leaves. Microsoft says so. Identifiers ride along with it. Microsoft says so. The images are not kept. Microsoft says so. A reviewer working a vendor questionnaire finds the whole egress section answered in writing, by the vendor, without having to ask twice.

The design holds up under pressure too, which is a separate compliment and a rarer one. Filtering server-side keeps the filter off a machine the user controls, which is the entire argument for putting it there. C2PA is an open provenance standard, and Microsoft says the manifest is there "to help users identify AI generated Images."

Three implementation details point the same direction. Paint treats a watermarking failure as a failure of the whole generation and returns no image at all, rather than quietly handing back an unmarked one - a covert tracker does not fail closed and refuse to give you your picture. Saving an AI result is restricted to formats that can carry a C2PA manifest, with BMP, the classic Paint format, conspicuously excluded, because BMP cannot hold one. And the manifest declares the watermark by name: the signed assertions include an action called `c2pa.watermarked`, described as "Content watermarked by Microsoft Responsible AI." Pairing that declaration with a soft-binding assertion is not a Microsoft flourish either - [under the C2PA specification](https://spec.c2pa.org/specifications/specifications/2.4/specs/ContentCredentials.html?ref=varops.com), a manifest that declares a `c2pa.watermarked` action must also carry a `c2pa.soft-binding` assertion, or validators reject the claim.

The file says it was watermarked. It says so in writing, in a signed assertion, inside itself.

Hold onto that, because it is what makes the actual finding narrow enough to be worth trusting.

## The part the disclosure does not reach

Before Paint generates anything locally, `AIServices.dll` posts the prompt and style to a Microsoft moderation endpoint. Four fields come back: a revised prompt, a `promptGenerationId`, a `watermarkId`, and `containsHumanReference`, which Li describes as a server-side classification of whether the prompt refers to a person. He did not deduce that shape from reading the binary and hoping - he replayed a request through Paint's own authenticated session and got an HTTP 200 with a real pair of GUIDs.

The `watermarkId` then goes to `Paint::AI::AddWatermark` and into `Watermarker.dll`, which alters the pixels of the image the local model just made.

One piece of provenance worth stating carefully, because the two paths are easy to run together and running them together is how this story gets overstated. Li opened exactly one real saved artifact, and it came from Paint's Image Creator - the Azure cloud generator, not the on-device path. Inside its PNG sat a signed C2PA manifest whose soft-binding assertion carried the algorithm `com.microsoft.invismark.1` and a value matching the GUID the moderation server had returned. The on-device case is established a different way: through the call tree from moderation response to local generation to `WmkWriteWatermark`, plus that live replay. Traced, not opened. Keep the distinction; a piece about conflation does not get to commit one.

None of this is on the support page. What the page says about provenance is two sentences: that Microsoft has "implemented content credentials, provenance based on the C2PA standard, to help users identify AI generated Images," and that "Images generated with Cocreator will contain C2PA manifest helping users identify that it is an AI generated image." The second one names the on-device path specifically. Li reports the same silence on the Image Creator page, writing that he "could not find a disclosure explaining the server-issued watermark GUID, its association with prompt moderation, or its presence in the pixels."

So the gap is not that the watermark is hidden. The manifest announces it. The gap is that the value inside it is a per-generation identifier, issued by a server that just read one specific prompt, and nothing a customer would read says so.

That absence has edges, and the edges matter. It is an absence on the pages a customer would actually read, checked on one date, plus one researcher's search. It is not a claim that Microsoft never disclosed this anywhere.

## Why the file is the harder question

Li calls the mechanism a soft binding and explains the term: a value embedded in the content so the content can still be matched to its provenance record after the file-level manifest has been removed. His own summary is fairer to Microsoft than any paraphrase - the manifest and the pixel watermark are "two layers of the same provenance system."

Which means [stripping the C2PA metadata does not remove the identifier](https://varops.com/rios-sovereign-ai-called-itself-by-the-wrong-name-79-of-the-time/), because the identifier lives in a different layer. Whether it stays recoverable and matchable after that is the mechanism's stated design goal rather than a tested result. Nobody has published the strip-and-recover test, Li included, and this column is not going to pretend otherwise.

Now set that beside "Microsoft does not store your input images or generated images."

Both sentences are true. [They answer different questions](https://varops.com/throughput-and-time-saved-are-two-different-ai-claims-linears-telemetry-only-moved-one/). One is about what sits on Microsoft's servers. The other is about what travels inside the file your organization keeps, converts, forwards and publishes. A guarantee about storage is not a guarantee about the artifact, and no amount of diligence on the first will produce the second.

Two smaller findings, reported flat because they do not need inflating. Paint's visible-watermark setting - Never, Always, Ask every time - composites a small Copilot logo and does not govern the invisible one. And Paint sends the previous `promptGenerationId` as `lastPromptGenerationId` on the next moderation request, which links successive prompts to one another explicitly.

**Hype-o-Meter: 7/10** on "on-device AI means your data stays put." The compute really is local. [The sentence people hear is doing considerably more work than the sentence Microsoft wrote](https://varops.com/token-efficient-languages-save-tokens-not-agent-bills/).

## The limits, stated plainly

One reverse engineer, one consumer feature. Paint is not the AI decision on anyone's desk this quarter.

It is not deception. Microsoft disclosed the cloud dependency, the prompt egress and the identifier collection where a user would look, and the manifest declares the watermark.

Motive is unestablished. Li raises a possibility and marks it as one: EU AI Act Article 50, whose transparency rules he says took effect on 2 August 2026, while noting they require a detectable machine-readable mark and not a prompt-specific GUID. That is his hypothesis. It should not harden into anything more on the way to your slide deck.

Microsoft Photos runs the same encoder through the same DLL, but passes `promptGenerationId` rather than the `watermarkId` Paint uses.

## The question that is not on the form

The reason any of this belongs in front of an operator has nothing to do with Paint.

A vendor AI review, as most organizations run it, is an egress review. Where does the model run. What data leaves. What is kept, and for how long. Microsoft answered the first two on a public page. It said nothing about how long the prompts and the device and user identifiers are kept.

An artifact review asks a different set of questions. What is embedded in the output the organization keeps. Who issued it. Whether it survives format conversion, metadata stripping and republication. What it can be matched against later, and by whom.

Microsoft named the cloud dependency, the prompt egress, the identifier collection, the non-retention of images and the C2PA manifest, all on the page a user would read. A reviewer working from that page would have answered every egress question correctly and still not have learned that the value in the watermark is tied to the individual prompt that produced the image. A disclosure this specific still leaves that gap. A thinner one leaves more.

The next AI feature that comes up for approval will arrive with a page describing the request. Someone has to ask about the file.