MS Paint and Photos embed a tracking GUID in AI images you generate
A researcher decoded it: 144 bits of a server-issued ID, tied to your prompt, baked into ~74% of pixels and openly declared in the C2PA manifest.
Copy markdown
What's actually baked into the file
Researcher Xusheng Li decoded a 16-byte GUID wrapped in an 18-byte payload (a 0x4c prefix plus a checksum), spread as 144 bits across the image with each bit repeated at least three times. In one 512x512 test, ~193,376 of 262,144 pixels were altered. It's a content-adaptive, SVD-style block watermark, not a metadata tag you can just strip.
How it can point back to you
The GUID isn't random. Your prompt is sent to Microsoft for moderation, and the server returns the ID that gets encoded into the pixels; chained requests link via a lastPromptGenerationId field. So Microsoft can tie a shared image back to the prompt that made it, the way color laser printers once hid tracking dots.
On-device generation gets marked too
It's not only the cloud path. Paint Cocreator runs the diffusion on your Copilot+ PC's NPU, yet the prompt still goes up for the GUID; Paint Image Creator and Photos' Image Creator and Restyle all embed it as well. Local compute doesn't mean an unmarked output.
It's declared, if you know where to look
The watermark is announced in the C2PA/Content Credentials manifest under algorithm id com.microsoft.invismark.1. Microsoft, a C2PA founder, documented that it watermarks but not that the manifest carries a prompt-linked GUID. Removal is hard by design: you'd have to beat every redundant bit placement without wrecking the picture.