MS Paint and Photos inivisibly watermark even locally generated output with GUID

Original Article ↗ Hacker News Discussion ↗

Microsoft’s Paint and Photos apps on Windows have been found to embed invisible watermarks in AI-generated or AI-edited images, encoding a server-issued GUID that links back to the prompt and potentially the user’s account or device. Commenters see this as part of a broader shift toward traceable digital content—akin to printer tracking dots and proposed camera signing—driven in part by EU rules that require AI watermarking. While some argue provenance markers help fight deepfakes, many are alarmed by the lack of clear consent, the ease of extending such tracking to all media, and the implications for anonymity and privacy.

Scope of the Watermarking Behavior

  • Watermarking occurs for images generated or edited using MS Paint/Photos AI tools (Copilot/Cocreator, local or cloud), not for purely hand-drawn content.
  • The apps call a remote “prompt moderation” API even when generation runs locally; the server returns a GUID that:
    • Is embedded as an invisible pixel-level watermark.
    • Is also stored in C2PA “content credentials” metadata.
  • Visible “AI” labels can be disabled in the UI, but the invisible GUID watermark cannot.

Privacy, Surveillance, and User Identification

  • Many see this as a serious privacy overreach:
    • The GUID can be linked to prompts and to the user’s Microsoft account/device.
    • It parallels yellow tracking dots in printers and historical typewriter identification.
  • Concern extends beyond “AI vs human” marking to “who created this, when, on which device,” enabling subpoenas or state surveillance.
  • Some fear expansion to all edited images and other file types, or OS-level pervasive watermarking.

Legal and Policy Angle

  • Several commenters note EU and other laws now require AI-generated content to be marked.
  • Others counter that the law does not require a user-identifiable GUID, only an “AI-generated” indicator.
  • Debate over whether this could violate GDPR due to lack of explicit, informed consent and potential personal identifiability.

Technical Aspects & Possible Workarounds

  • Proposed evasion tactics:
    • Re-encode via BMP or other simple formats to strip metadata.
    • Add low-level noise, dithering, or run denoising/diffusion to destroy pixel watermarks.
    • Replace watermarker.dll with a no-op or intercept the API call.
  • Some argue robust watermarking can survive common transforms; others note that once the algorithm is known, targeted removal or overwriting with random data is straightforward.
  • Misclassification issues reported (e.g., plain screenshots flagged as AI).

Authenticity, Provenance, and Camera-Signing Debate

  • A faction supports strong provenance (C2PA, camera signing) to combat deepfakes and preserve “human authenticity.”
  • Others stress limits:
    • Device signatures can be compromised, forged, or used as courtroom “security theater.”
    • TPM/camera-signing designs are vulnerable to hardware attacks, analog re-recording, or staged scenes.
  • General theme: cryptographic provenance proves “signed by some key,” not that the scene is truthful.

Broader Reactions and Software Choices

  • Significant loss of trust in Microsoft; many say they will avoid MS Paint/Photos or Windows entirely and move to Linux / open-source tools.
  • Worry that widespread acceptance of such watermarking will normalize invasive tracking and may become legally mandated for all image editors.