MS Paint and Photos Secretly Watermark Locally Generated Content with GUIDs
Even locally created images are tagged with invisible identifiers.
1Research Initiation
The researcher had a curiosity for investigating lesser-known Windows features. AI additions to the Paint application caught his attention. Using Binary Ninja MCP, he began analyzing Paint's image generation mechanism. While expecting remote API calls, the discovery revealed local model integration instead.
2Discovery of Local Models
Analysis showed Microsoft integrated local models into Windows as part of Copilot. The Paint application's location and four distinct .onnxe model files were identified. File sizes ranged from 16.5 MB to 302.4 MB. The encryption key for seg.onnxe was previously known.
3Encryption Mechanism
Model files were found to be XOR-encrypted using the 'Microsoft_2023' key. Two different encryption key records were found in segapi.dll. The second key was a 4,096-byte alphanumeric string. After decryption, ONNX files were successfully validated.
4Watermarker.dll Discovery
During file examination, a component named Watermarker.dll was discovered. Paint's visible watermark feature was already known, adding a small Copilot logo at the image's bottom right. However, the DLL's size (1.67 MB) seemed excessive for simple functionality.
5Invisible Watermark Suspicion
The researcher suspected the DLL might also embed invisible watermarks. Claude Code's text watermark announcement influenced this thinking. The WmkWriteWatermark function was called after local Stable Diffusion image generation. Failed watermarking converted the entire generation into an error.
6Watermark Mechanism Analysis
WmkWriteWatermark accepts a 16-byte payload. The function checks payload length, returning errors if not exactly 16 bytes. Interestingly, different error codes are used for too-short versus too-long payloads. A fixed loop copies the payload regardless of the length parameter.
7GUID Implementation
The 16-byte payload was identified as a GUID. WmkWriteWatermark doesn't embed the GUID directly. It constructs an 18-byte (144-bit) message: 0x4c || GUID[0..15] || (sum of 16 GUID bytes modulo 256). Usable image dimensions are rounded down to multiples of eight.
8Watermark Embedding Algorithm
The algorithm requires at least three successful placements per bit. It makes small quantized changes over selected image blocks. The process involves 3x5 matrix operations and decomposition routines, using constants like 24.0, 0.25, 0.5, and 0.2. This suggests a content-adaptive, block-domain, SVD-style watermark.
9Watermark Impact
Tests showed that adding watermarks to 512x512 BGRA images changed 193,376 of 262,144 pixels. These changes are imperceptible to the human eye, with no visible impact on image quality. However, the technique enables tracking of user-generated content without their knowledge.
10Watermark Source
At the WmkWriteWatermark boundary, the payload is just a pointer and length. The requirement for exactly 16 bytes was a crucial clue. Questions emerged about the source of this watermark and how the GUID is generated and utilized, with details remaining unclear.
11Security and Privacy Concerns
This implementation demonstrates how locally created content can be tracked. Microsoft hasn't clarified how this data is used. Invisible watermarks raise new questions about user privacy and data security, particularly concerning AI-generated content and its potential misuse.
12Conclusions and Implications
Microsoft's watermarking mechanism in Paint and Photos reveals how deeply digital tracking can penetrate. Unaware users having their data collected sparks ethical and legal debates. These findings may necessitate new standards for software transparency and user control over embedded tracking technologies.