Your 'Local' AI Is a Lie — Microsoft Paint Is a Spy

Microsoft Paint has been reverse-engineered. The result is damning: every "local" AI image generation in Paint and Photos sends your prompt to a remote moderation server, gets back a GUID, and embeds that GUID as an invisible watermark into your image's pixels. The visible-watermark toggle in the settings does not control this. There is no disclosure that this invisible watermark exists.

Xusheng Li published the full analysis this week, and it's the kind of work that should make every "local AI" marketing claim legally risky starting tomorrow.

What They Found

Li decompiled Paint's Watermarker.dll and traced the full pipeline. Here's the flow:

graph TD
  A[User types prompt in Paint] --> B[Paint sends prompt to Microsoft moderation API]
  B --> C{POST /v1/paint-cocreator/moderate-prompt}
  C --> D[Server returns: moderated prompt + watermarkId GUID]
  D --> E[Paint runs Stable Diffusion locally on NPU]
  E --> F[Paint calls WmkWriteWatermark to embed GUID into pixels]
  F --> G[AddWatermark calls Watermarker.dll]
  G --> H[SVD-style invisible watermark applied]
  D --> I[C2PA Content Credentials manifest signed server-side]
  I --> J[Manifest embedded in file metadata]
  H --> K[Final image with invisible watermark + C2PA]

On a Copilot+ PC with an NPU, the image generation itself runs locally — that part is true. But the moderation is always remote. The server returns two things: a moderated (censored) version of your prompt, and a watermarkId GUID. This GUID is:

• Embedded into the image pixels via an SVD-style invisible watermark at the pixel level
• Stored in C2PA metadata as a signed "soft binding" that links the file manifest to the pixel watermark
• Sent back to the server on subsequent requests, linking all your generations together

The technical implementation is sophisticated. The watermark function WmkWriteWatermark constructs an 18-byte message: 0x4c || GUID[0..15] || checksum, then applies block-domain SVD-style modifications. The researcher tested it on a synthetic 512×512 BGRA image — 193,376 of 262,144 pixels changed after watermarking. That's 74% of pixels altered.

On a Paint image with ~260K pixels, Microsoft changed three in four just to invisibly tag it. That's not a subtle artifact. That's a broadcast.

The "Local" Deception

This is the pattern now. "Local AI" in marketing means the generation step is local. Everything else — prompt moderation, content filtering, identifier assignment, provenance signing — goes through the cloud.

Microsoft does disclose that Paint uses remote content filtering and adds C2PA Content Credentials. But here's what they don't tell you:

• That the C2PA manifest contains a GUID tied to an invisible pixel-level watermark
• That the invisible watermark is applied even when the "visible watermark" setting is off
• That every prompt is linked to a unique server-issued identifier
• That successive prompts are explicitly linked to each other

The C2PA manifest itself contains a c2pa.watermarked assertion that reads "Content watermarked by Microsoft Responsible AI" and names Microsoft InvisMark as the method. This is encrypted in a signed chunk that requires the C2PA software binding to decode. Not exactly transparent.

Paint contains four ONNX models — seg.onnx, inseg_enc.onnx, inseg_dec.onnx, and mager.onnx — which are encrypted with XOR keys stored in segapi.dll. On Copilot+ PCs, they run on the NPU. On non-Copilot+ machines, the generation itself runs server-side. In both cases, the prompt goes to Microsoft's cloud first.

What This Means

Three implications worth thinking about:

1. "Local" has been semantically gutted.
When you hear "local AI" from a vendor, ask: local inference, or local everything? The industry has quietly redefined "local" to mean "the heavy compute is on-device" while preserving the ability to phone home with everything else. A truly local system needs zero round-trips to a server to generate an image. This system needs two: one for moderation, one for C2PA signing.

2. This is traceability as a feature, surveillance as a side effect.
The EU AI Act's transparency rules took effect August 2, 2026. Microsoft can argue this is compliance — detectable, machine-readable marks on AI-generated content. That's fair. But the GUID design means Microsoft can track every locally-generated AI image back to the prompt that created it, the session that requested it, and potentially the user who typed it. The architecture supports retroactive identification.

The difference between "provenance" and "surveillance" is often just who holds the key.

3. The soft binding creates a novel attack surface.
C2PA soft bindings are designed to survive format re-encoding — the GUID in the pixels persists even if you strip the file metadata. That means Microsoft can identify AI-generated images even after they've been downloaded, screenshotted, re-saved, and uploaded elsewhere. It also means the watermark is a vector: if someone reverse-engineers the detection, they can plant fake watermarks to frame innocent images as AI-generated.

Head to Head: What's Disclosed vs. What's Real

Bottom Line

This research isn't just about Microsoft Paint. It's a case study in how "local AI" functions in practice — as a cloud-mediated experience with local acceleration, not a genuinely offline capability. The invisible watermarking is clever engineering paired with questionable transparency. If you're building local AI features, ask yourself: does your "local" label survive a Binary Ninja decompile?

For users: if you generate AI images on a Copilot+ PC, assume every single one carries a unique server-issued identifier embedded in the pixels. You can't see it, you can't turn it off, and it survives format conversion. That's not a bug. It's by design.