TL;DR: Reverse engineering by Xusheng Li shows Microsoft Paint and Photos embed a server-issued GUID watermark into the pixels of AI-generated images, including files produced entirely locally on the user’s machine. The invisible mark survives in output files and can be decoded from the image data itself — and, as The Register reported, the identifiers are linked to user IDs.
Microsoft shipped an invisible watermarking system inside two of the oldest apps in Windows, and almost nobody noticed. According to The Register’s coverage from August 25, 2026, the identifiers embedded by Microsoft Paint and Microsoft Photos are linked to user IDs. The discovery came not from an official disclosure, but from reverse engineering published by security researcher Xusheng Li.
The finding matters because the watermark is applied to images generated locally. No cloud round-trip is required for the mark to appear in the saved file. That detail alone raises questions about what else runs silently under the hood of everyday Windows applications.
What Did Reverse Engineering Reveal About MS Paint’s Invisible Watermark?
Reverse engineering published by Xusheng Li revealed that Microsoft Paint and Microsoft Photos quietly embed an invisible watermark into images generated with their built-in AI features. The watermark is not stored in file metadata, where a curious user might expect to find it. Instead, it is woven directly into the pixel data of the output image itself.
The mark takes the form of a GUID — a globally unique identifier issued by a Microsoft server. Because it lives in the pixels rather than the metadata, it survives operations that would strip EXIF tags or other side-channel information. Anyone who knows the encoding scheme can decode the identifier straight from the image data.
Li’s analysis, later picked up by The Register and by El Ecosistema Startup, shows the mechanism is deliberate and structured. This is not an artifact or a compression quirk. It is a designed tracking channel. And it operates by default, without a prominent opt-in that users would readily notice.
The core problem is transparency. A user who generates an image offline reasonably expects the output to be free of hidden identifiers. Microsoft’s implementation breaks that assumption. The watermark travels with the file wherever it goes.
How Does Microsoft Embed the Watermark in Image Pixels?
The watermark is embedded through steganographic modification of the image’s pixel data — subtle alterations to pixel values that are imperceptible to the human eye but machine-readable. Li’s reverse engineering work documents how Paint and Photos perform this embedding as part of the image generation and saving pipeline.
Because the changes live in the pixels themselves, the watermark is durable in a way metadata-based marks are not. Stripping EXIF data, renaming files, or re-saving through many common workflows does not necessarily remove it. The identifier can be recovered by decoding the pixel-level modifications directly from the final output file.
This approach mirrors techniques used elsewhere in AI content labeling, such as Google’s SynthID-style systems, where provenance signals are baked into the image content rather than attached alongside it. The difference here is the specific payload. Microsoft’s mark carries a server-issued GUID tied to the generation event — and, per The Register’s reporting, linked to user IDs.
So the embedding method answers one question and raises another. It explains how the mark persists. It does not explain why a locally generated image needs a server-issued identity at all.
Where Does the GUID Come From and Why Does It Point to a Server?
The GUID embedded in the watermark is issued by a Microsoft server, according to Li’s analysis. That means the generation workflow — even when the image itself is produced locally on the user’s hardware — involves a server-side step whose purpose is to hand out a unique identifier for that specific image.
This is the detail that turns a labeling feature into a privacy question. A purely local watermark could contain a generic marker saying “this image was AI-generated.” Instead, the embedded value is a unique, server-assigned GUID. Uniqueness implies distinguishability: each generated image carries its own identity, traceable back to the moment and context of its creation.
The Register’s reporting connects these identifiers to user IDs. If a GUID is associated with the account that triggered the generation, then every watermarked image becomes a potential fingerprint linking a file to a person. Share the image anywhere, and the mark travels with it.
Microsoft has not fully detailed the server-side mechanics publicly, which is precisely why reverse engineering was needed to surface the behavior. The server dependency also means the watermarking system has a network component even when the AI model runs offline. Users who believed local generation meant local-only processing got something different.
Does the Watermark Appear on Locally Generated Images Without Cloud AI?
Yes — and this is the central surprise of Li’s findings. Images generated entirely locally, without sending prompts to a cloud AI service, still receive the server-issued GUID watermark in their output files. The local generation path does not bypass the marking system.
That behavior undercuts the common assumption that on-device AI generation is inherently more private than cloud-based generation. The compute happens on your machine. The pixels are produced by a local model. Yet a unique identifier, issued via a server interaction, still ends up encoded in the saved image.
For users who deliberately choose local generation — to avoid telemetry, to keep prompts private, or to work fully offline in spirit — this is a meaningful gap between expectation and reality. The image content never leaves the machine, but an identity marker tied to the generation event is stamped into it anyway.
The practical takeaway is blunt. “Locally generated” does not mean “unmarked.” Anyone assessing the privacy properties of Windows AI features needs to look past the processing location and examine what gets written into the output file. In Paint and Photos, the answer is: a hidden GUID.
Can the Watermark Link an Image Back to a Specific Microsoft Account?
Potentially, yes. The Register’s report on Li’s research states that the watermarks in Paint and Photos are linked to user IDs. The GUID embedded in the pixels is not a random anonymous value — it is an identifier whose issuance is associated with the account context in which the image was generated.
Whether Microsoft itself maintains the mapping between GUIDs and accounts internally is not something the reverse engineering could fully establish from the client side. But the linkage reported by The Register means the architecture supports associating a watermarked image with the user who created it. The capability is what matters for a privacy assessment.
Consider the implications for shared images. A file posted to a forum, sent through messaging apps, or distributed as part of a creative portfolio carries an invisible identifier. If that identifier resolves to a user ID, the image becomes traceable to its originator long after it leaves their machine.
There are defensible uses for provenance tracking, such as combating deepfakes or enforcing AI-content disclosure rules. The controversy is not that watermarking exists. It is that the watermark is invisible, applied by default, server-linked, and present even in local workflows — without clear, upfront disclosure to the user. Transparency, not the technique, is the sticking point.
What Are the Privacy Implications of Server-Issued Watermarks?
The core privacy problem is linkage. According to Xusheng Li’s reverse engineering write-up, the watermark embedded by Paint and Photos is a server-issued GUID — a globally unique identifier that Microsoft’s infrastructure assigns to a generation event. The Register’s coverage of the findings emphasizes that these watermarks “are linked to user IDs,” which means a seemingly anonymous image file can quietly carry a durable reference back to an account-level event on Microsoft’s servers.
Why does that matter for a locally generated file? Users who choose local generation often do so precisely because they expect no server round-trip, no telemetry, and no identity trail. The watermark breaks that expectation. The pixel-level fingerprint is invisible, survives normal viewing, and cannot be inspected with standard image tools.
Consider the practical scenarios. An image shared on a forum, a screenshot reposted to social media, or a file leaked from a corporate environment could all be traced back to the GUID issued at creation time. If Microsoft retains a mapping between GUIDs and accounts — something the researcher could not rule out — every generated image becomes a potential identifier. That is a quiet shift. It moves AI-generated images from “anonymous artifacts” to “attributable artifacts” without any visible signal to the user.
There is also a consent dimension. The watermarking happens silently, with no prominent disclosure in the app interface at generation time. Privacy advocates quoted in The Register’s reporting flagged exactly this gap between user expectation and actual behavior.
Can Users Disable or Remove the Watermark in Paint or Photos?
No documented setting disables it. Neither Xusheng Li’s analysis nor The Register’s coverage identifies any toggle in Paint, Photos, or broader Windows privacy settings that turns the invisible GUID watermark off. For users who generate AI images through these apps, the watermark appears to be a default behavior rather than an opt-in feature.
Removal is a different question. Because the watermark lives in the pixel data rather than in EXIF metadata, deleting metadata does not touch it. However, pixel-level watermarks are generally fragile against transformations. Based on how the embedding works, operations that resample or re-encode the image — resizing, cropping, format conversion, or aggressive compression — can degrade or destroy the embedded signal.
The researcher’s own decoding tooling demonstrates the other side of this coin: if the watermark can be located and read from the pixels, it can also be targeted. Still, ordinary users have no supported path to strip it. That asymmetry is notable.
For now, the practical guidance is straightforward:
- Avoid AI generation features in Paint and Photos if you need unmarked output
- Use third-party local generators that document their watermarking behavior
- Strip metadata routinely — but understand this does not remove pixel watermarks
- Re-encode or resize images if anonymity is critical, accepting quality loss
- Check Microsoft’s documentation for any newly added opt-out settings
- Monitor future Windows updates, as disclosure requirements may force changes
How Does This Compare to Other AI Content Watermarking Schemes?
Microsoft’s approach is unusual in two respects: it is invisible at the pixel level, and it references a server-issued identifier rather than a generic “this is AI-generated” flag. Most industry watermarking schemes announced to date — such as Google’s SynthID for Imagen-generated images — focus on provenance labeling, marking content as synthetic without tying it to a specific user session.
The mainstream alternative is the C2PA standard, which Adobe, Microsoft, and other vendors support. C2PA stores cryptographically signed provenance metadata alongside the file. That approach is transparent and inspectable, but it is also trivially removable: delete the metadata and the provenance disappears. Pixel embedding is the opposite trade-off — harder to remove, but invisible and harder to audit.
| Scheme | Carrier | Tied to user identity? | Visibility |
|---|---|---|---|
| Paint/Photos GUID | Pixel data | Yes — server-issued GUID | Invisible |
| SynthID | Pixel data | No — content-level mark | Invisible |
| C2PA | Signed metadata | No — provenance chain | Inspectable |
The GUID linkage is what sets Microsoft’s implementation apart. A SynthID mark answers “was this AI-generated?” A GUID watermark potentially answers “which generation event produced this?” That second question is far more privacy-sensitive, and it is exactly the distinction The Register highlighted when reporting that the watermarks are linked to user IDs.
What Tools Did the Researcher Use to Decode the Watermark?
Xusheng Li’s investigation, published as a detailed reverse engineering post at xusheng.dev, combined static analysis of the Windows app binaries with runtime inspection of the generation pipeline. The goal was to locate where, in the flow between the local AI model and the saved image file, the watermark gets injected — and to extract the algorithm responsible.
The methodology, as described in the write-up, followed the classic reverse engineering path for Windows Store apps: unpacking the app packages, identifying the relevant DLLs and native components, and tracing how generated image buffers are processed before being written to disk. By comparing image data before and after the watermarking stage, the researcher isolated the embedding routine and recovered the structure of the hidden GUID.
Crucially, the analysis established that the GUID is not generated locally. It is issued by Microsoft’s servers and passed into the local pipeline, which then writes it into the output pixels even when the image generation itself runs entirely on-device. That single finding reframes the whole story: a “local” generation feature carries a server-side fingerprint.
The work also produced practical decoding capability. Once the embedding scheme was understood, the hidden identifier could be extracted from ordinary saved files — which is how the linkage to user IDs was confirmed and reported by The Register on August 25, 2026.
Should Windows Users Be Concerned About Hidden Image Fingerprints?
A measured answer: concerned enough to pay attention, not alarmed. The watermark only affects images produced through the AI generation features in Paint and Photos. Ordinary editing, cropping, and saving of existing photos in these apps does not, based on the available analysis, add a GUID. The scope is narrower than headlines might suggest.
Within that scope, however, the concern is legitimate. Users who deliberately chose local generation received a hidden, identity-linked fingerprint in their output — with no visible disclosure and no documented opt-out. Whether Microsoft retains a GUID-to-account mapping server-side is the pivotal unknown. The company’s public framing of AI watermarking is content provenance; the implementation revealed by this research is closer to user tracking.
The reasonable posture for Windows users:
- Treat AI-generated output from Paint and Photos as potentially attributable
- Assume the GUID persists in the original file until demonstrated otherwise
- Watch for an official Microsoft statement or settings change
- Prefer tools with documented, transparent watermarking for sensitive work
- Support provenance standards like C2PA that keep marks inspectable
Transparency is the real ask here. A visible label, a settings toggle, or published documentation would resolve most of the discomfort. Their absence is what turns a defensible anti-abuse measure into a privacy story.
Frequently Asked Questions
Which Microsoft apps embed the invisible GUID watermark?
Based on Xusheng Li’s reverse engineering analysis, both Microsoft Paint and Microsoft Photos embed the watermark when users invoke their AI image generation features. The Register’s August 25, 2026 coverage confirmed the finding applies to locally generated output in both apps. Standard non-AI editing functions are not affected.
Does the watermark survive editing or re-saving the image?
The GUID is embedded in pixel data, not metadata, so simple re-saving or metadata stripping does not remove it. However, like other pixel-domain watermarks, it can be degraded by resizing, cropping, or heavy recompression. The researcher’s decoding work showed the mark is recoverable from ordinary saved files in its intact form.
Is the watermark tied to my Microsoft account identity?
The embedded value is a server-issued GUID assigned to the generation event, and The Register reported that these watermarks “are linked to user IDs.” Whether Microsoft maintains a persistent server-side mapping from each GUID to a specific account was not confirmed by the research. The identifier’s server origin is what makes the linkage plausible.
Can I opt out of the watermark in Windows settings?
No. Neither the researcher’s analysis nor subsequent reporting identified any toggle in Paint, Photos, or Windows privacy settings that disables the watermark. It appears to be a default behavior of the AI generation features. Users who need unmarked output must avoid those features or use alternative tools.
Summary
Microsoft’s invisible watermarking in Paint and Photos raises real questions about consent and transparency in consumer AI tools. The key takeaways:
- Paint and Photos embed a server-issued GUID into the pixels of locally generated AI images, as documented by Xusheng Li’s reverse engineering
- The watermarks are linked to user IDs, per The Register’s reporting of August 25, 2026
- No supported opt-out or removal method exists; the mark lives in pixel data, not metadata
- The approach differs from SynthID and C2PA by referencing a generation event rather than just marking content as synthetic
- Users needing anonymous output should avoid AI generation in these apps or re-encode images
Read the full technical write-up at xusheng.dev and share this article if you found the analysis useful — disclosure like this only works when users know it happened.