MS Paint and Photos inivisibly watermark even locally generated output with GUID

I admit it’s a while since I’ve used windows, but it’s such a shock to hear that MS Paint isn’t just a point and click pixel coloring app anymore. It seems like they could have left it as a pure “paint” app and added the fancy stuff to some new image editor or something.

I guess they’ve optimized their workforce to just keep making changes so they get promoted rather than just creating really good software.

The AI aspect of this is a red herring. The real problem is that they're secretly adding in a unique identifier into every image you create. If somebody does not like your meme, they can just send a copyright subpoena to Microsoft to instantly get your full name, address, email, phone number, and any other data associated with your Microsoft account. Just like age verification, this is another weapon in the war against internet anonymity.

AI-generated text warning (I submitted - but did not author - the piece), but it seems MS Paint and MS Photos add both a visible (can be turned off) and invisible (cannot be disabled and happens silently in the background with no user notice) watermarks to photos that have been AI-manipulated, even when using a local model to perform the action. It's not clear if this applies to even things like using AI-enhanced background delete/remove, but the invisible watermark is embedded in both the image pixels and the image metadata, both containing a GUID that can be linked to the exact prompt that was used and the originating device/user (on Microsoft's end).

Obvious next step is to explore if you can replace watermarker.dll with a (signed) no-op shim or MITM the API call to at least use your own (nil?) GUID that isn't linked to your device/account.

In case it's not obvious, my bigger concern isn't "this image can be identified to have been generated with/by AI" so much as it is "digital yellow printer dots have been forced upon us, except they can identify and retrieve the exact user/device/time/place/document/etc", completely destroying any and all illusions of privacy left.

Keep an eye on this.

A few months back, MS incorrectly tried to stamp a Copilot "watermark" (just an auto-added note) to any and all Azure DevOps commits, regardless of whether an LLM was actually involved. They removed it after a lot of github issues were submitted to the source of the issue which was a VS Code Copilot extension.

MS has been very sloppy in their implementations. I would recommend against using Paint or any other LLM enabled app they use as a result. Things may be getting incorrectly stamped.

I had this trigger the other day incorrectly and went and installed Paint.net. I pasted in a screenshot I took and just wanted to resize it. I got a banner saying it was made with AI and would be updated to reflect that.

I get the privacy concerns, and we are right to expect Microsoft to say that this is what their tool may be doing. However, I fear that one day we will look back and wonder why we didn't do more to sign and preserve human authenticity. Having a stamp saying "AI manipulated" should be a part of digital lineage tooling.

Googling you can see the source code for watermarking here https://github.com/microsoft/InvisMark

It is quite likely that Snipping Tool is also doing this. Every camera also leaves device specific signature because of its inherent silicon sensor defects.

If you want to stay anonymous, don't share images you can't verify at the byte level. Apply filtering to decrease the low bit noise that could hide cryptographic signatures. Don't trust complex container formats.

See e.g. PPM format: https://www.cs.swarthmore.edu/~soni/cs35/f13/Labs/extras/01/...

These days entire scenes can be tweaked by AI to add unimportant but identifying marks, at a level far above signal processing tricks, like moving objects in the scene. Verify from multiple sources.

This is gonna sound a bit harsh, but from the outside it genuinely looks like Microsoft is actively looking for new ways to degrade and humiliate their users. (And having no trouble finding them!)

Interesting find. Overall it makes sense from a deepfake-fighting perspective and EU requirements. But what's concerning is that users aren't really told about this, as far as I can tell. Would be cool if someone checked if it can be bypassed, like swapping the DLL or intercepting the API call. But yeah, it's another step toward every digital trace becoming personally identifiable...

As a linux fan I just love all these changes Microsoft have been introducing

This reminds me that in the USSR they had typewriters that added an identifier somehow that could be traced back to that particular typewriter (and who it was sold to)

Misleading title: the watermark applies to AI generated/edited images. That includes local models.

Whether it applies to non-AI generated images is a question for the reverse engineers (or ironically, a suitable AI). My bet is on "no".

Of course, the pre-AI versions of paint and notepad can still be installed with a bit of trickery, and it's worth it just for the UX.

Kind of sad how all these technical blogs just reek of Claude text these days. Hard read when it’s obviously padded by an LLM…

the GUID is the giveaway that it's not about protecting artists, it's about being able to prove provenance later. nobody embeds a unique id in a local file for the user's benefit.

These days i cant recommend Windows to anybody. Even gamers should move to linux.

Some say "i do nothing illegal" "have nothing to hide". You dont do anything illegal in your point of view. AI tracking you might think otherwise.

A sudden knock on your door might happen because of an ambigious search/propmt.

This is not ok.

How resistant is it to dithering? Can you just add +-1 randomly to each pixel r,g and b values and throw it off?

awesome breakdown of the process you took. reverse-engineering is crazy now with AI. IP is dead

this also reminds me of what got me hooked on CS in the first place: a simple java steganography app in cmsc150

Thanks Microsoft, for adding my signature so I won't have to claim authorship when it ends up in a museum in 200 years, and the NSA archives are declassified for art historians filing a FOIA in 2226, who find out, "yep, it was from his PC."

Until proven otherwise via open-source audits and reproducible binaries, you should assume that all commercial photo editing software is embedding watermarks in any way they can get away with. This includes the professional software that you pay quite expensive licenses for. You should also assume that even if they're not today, they will eventually be coerced into doing so, in the same way that printers embed tracking dots.

Interesting. I really didn't think watermarks would end up going anywhere, but maybe with enough adoption we can have easy ai generated content flagging after all?

This muddle of an article makes it totally unclear to me if this GUID is attached by the AI generation call or every image I edit in MS Paint. I'm going to assume the former unless they release a clarification.

Edit: Actually trivial to test, just save an image of all black and see if it suddenly has other values on save.

With every new thing Microsoft goes trying so hard to come out as the good person, but they just cannot help themselves but to inject their evil. It had to be changed with Nadla coming, but their enshitification is just keeps getting worse and worse. What on Earth is this.

Ya know, this would probably be pointless but if I were a programmer (I'm not -and refuse to be a vibe coder) I'd probably just grab appropriate libraries and make my own replacements for this shit. GLTK+ (?) is an obvious choice to use for recreating mspaint, and to replace notepad -I was told making a simple editor was an excercise they have you do when you learn programming to begin with?

I already replaced the 'solitaire' games suite with pysol running on WSL2 and it's a vast improvement!

tldr -if MS is going to screw us, why don't we mitigate it by using replacements?

Solved by not using closed source SW, period.

Solution: Don't AI generate images! I think this is a good way to discourage people from making slop.

I think it would be nice if all cameras digitally signed pictures. You could prove the photo was real.

I'm honestly surprised they don't upload the entire image to apply the watermark server-side, to the point that I'd like someone else to repeat this investigation and confirm it's not happening.

Shipping the watermark generator on user's machine would make it very easy for someone motivated to find how it works and write a "watermark remover".

Yet another reason to switch to Linux.

My honest reaction: https://files.catbox.moe/4ylzsq.png

This is a standard mark for AI generated images using a format agreed upon by most of the GenAI world to help people not get tricked by fake images. It’s exactly according to spec, is widely announced, and is widely used.

It’s shocking how immediately off the rails this topic went with the conspiracy crowd.

[dead]

[dead]

[flagged]