Microsoft's commitment to AI content transparency goes beyond minimum EU requirements: a new reverse engineering study by Xusheng Li of Vector 35 has revealed that the Paint and Photos applications for Windows embed an invisible Global Unique Identifier (GUID) directly into the pixels of every locally created image. This mechanism, which Microsoft had only hinted at in official documentation without technical details, links each output to the specific prompt that generated it.

Add AlexTech.ai asPreferred Source on Google

Remote GUID in local pixels

The most significant finding is that, although image generation happens entirely locally on NPU-equipped PCs (Copilot+), the prompt is still sent to a remote server for moderation. The server then returns the filtered prompt along with a GUID that is subsequently embedded in the final image. This means that even without an internet connection for generation, there is a point of contact with Microsoft servers necessary for content identification.

How the invisible watermark works

The analysis highlighted the presence of a dedicated library, Watermarker.dll, which manages an invisible watermark distinct from the visible one (the Copilot logo). The 16-byte GUID is transformed into an 18-byte payload including a checksum, then expanded into 144 bits. The algorithm uses quantization techniques on image blocks, requiring minimum dimensions of 192x192 pixels to ensure enough capacity to place each bit at least three times. In a test on a synthetic 512x512 pixel image, the process modified over 70% of the total pixels.

Privacy implications and the AI Act

This implementation fits into the context of the European Code of Practice on transparency for AI-generated content, which requires machine-readable marking. Microsoft chose to go beyond requirements by linking the identifier to the user and prompt. Although the invisible watermark cannot be disabled via standard settings (which only control the visible logo), its presence raises questions about local usage traceability. As highlighted in previous analyses on AI Act watermarking, the robustness of these techniques remains a debated topic among experts, but Microsoft's approach represents one of the most advanced cases integrating remote identification with local generation.