Microsoft Paint, Photos Embed Non-Disableable Blind Watermarks in AI Images, Upload Prompts to Servers

Microsoft has added invisible blind watermarks to AI-generated images in its Paint and Photos applications. The watermark uses identifiers sourced from Microsoft servers and operates independently of the Copilot watermark, which users can enable or disable at will, meaning the mechanism cannot be fully turned off by users.

On AI PCs, even when images are generated using local Stable Diffusion models, the process is not entirely offline. Before generation, the Paint application sends the prompt and style to Microsoft servers for review. The servers return a modified prompt, a prompt generation ID, and a watermark ID, after which the image is generated locally via the NPU unit.

Following generation, Paint invokes a blind watermark control to write the 16-byte watermark parameters returned by the server into the image pixels. The watermark is invisible to the naked eye, but Microsoft can identify whether an image was generated by Paint through its detection mechanisms. In testing, a 512x512 pixel image saw more than 190,000 pixels undergo subtle changes after the watermark was applied.

If the blind watermark write fails, Paint treats the entire AI image generation task as a failure rather than returning an unwatermarked image. The Photos application, by contrast, logs the error and continues to return the generated result. In addition, Paint appends C2PA content credentials that record the AI generation information and blind watermark details, creating two layers of provenance: even if the C2PA metadata is deleted, the watermark embedded in the pixels remains detectable.