Reverse engineering reveals that Microsoft Paint and Photos embed a server-issued GUID as an invisible watermark in locally generated AI images. While these apps ship local AI models, they send prompts to a remote server for moderation. The server returns a GUID alongside the moderated prompt, which is then embedded into the generated image.

This invisible watermark operates independently of the visible Copilot logo setting. On Copilot+ PCs, image generation occurs locally, but prompt moderation remains remote. Microsoft discloses that Paint adds C2PA metadata to AI-generated images, with saves limited to C2PA-preserving formats like PNG, JPEG, GIF, and .paint.

Research began by analyzing model files such as seg.onnxe, inseg_enc.onnxe, inseg_dec.onnxe, and mager.onnxe found in the Windows Apps directory. These encrypted ONNX files were decrypted using keys from segapi.dll. Analysis of Watermarker.dll uncovered functions handling both perceptible and invisible watermarks, confirming the hidden GUID insertion mechanism within the pixel data.