(Photo illustration: The LA Globe)

AI images made inside Microsoft Paint carry a 16-byte identifier hidden in their pixels. The identifier is issued by a Microsoft server before the image is generated, according to a reverse-engineering writeup published on August 20, 2026 by the researcher Xusheng Li, who disassembled a file called Watermarker.dll inside the app. Whether the hidden mark survives cropping, resizing or conversion to another file format is not addressed in the post.

The stake is narrow and concrete. A picture a person makes on their own computer, in Los Angeles or anywhere else, leaves that computer as a prompt first and comes back marked with a value tied to that request. Nothing breaks and nobody is billed. It is a provenance system, and the writeup says its central detail is not explained on the support page a Paint user would read.

What is actually in the file

The watermarking function, WmkWriteWatermark, accepts a payload of exactly 16 bytes, per the disassembly. Shorter and longer payloads return two different error codes. Its wrapper builds an 18-byte message: a marker byte, the 16-byte identifier, then the sum of those bytes modulo 256.

That message is spread through the image as 144 individual bits, with each bit written at least three times, the post says. The encoder refuses images smaller than 192 by 192 pixels. Li ran the function directly against a synthetic 512-by-512 test image; of its 262,144 pixels, 193,376 changed once the watermark was written.

Where the number comes from

Before the local model runs, Paint sends the prompt and style to a Microsoft moderation endpoint over HTTPS, the writeup reports. The response carries a revised prompt, a promptGenerationId, a watermarkId, and a flag for whether the prompt refers to a human. The watermarkId is the value written into the pixels. Paint sends the previous promptGenerationId along with its next moderation request, which links successive prompts explicitly.

Li queried the endpoint using Paint's own authenticated session with a prompt for a blue circle above an orange square, and the server returned a fresh pair of identifiers. A second prompt returned a different pair. On the evidence in the post, the value is per generation, not per user, per install or per session. Whether those values are also logged against an account or a device is not something a disassembly can show; Microsoft's Image Creator support page, as quoted in the writeup, says the company collects user and device identifiers along with prompts for abuse prevention.

The same value, signed into the metadata

One image saved as PNG from Paint's Image Creator carried an 18,979-byte caBX chunk immediately after the header, holding a signed C2PA manifest. Inside it, a soft-binding assertion names the algorithm com.microsoft.invismark.1 and records the same identifier found in the pixels, per the post. The manifest's action line reads "Content watermarked by Microsoft Responsible AI."

Microsoft's support page, quoted in the writeup, says generated images "will contain C2PA manifest helping users identify that it is an AI generated image." The post says it found no disclosure explaining the server-issued watermark identifier, its association with prompt moderation, or its presence in the pixels.

Photos does it too, and fails differently

The same Watermarker.dll ships in the Microsoft Photos app, behind its Image Creator and Restyle Image features, the writeup says. If the encoder returns an error, Photos logs it and appears to return the image anyway. Paint treats a watermarking failure as a failure of the entire generation. Saving an AI result from Paint is limited to PNG, JPEG, GIF and Paint's own .paint format, all of which can carry a C2PA manifest. BMP is not offered.

What is not established

This account rests on one researcher's disassembly and his own requests to the moderation endpoint. The desk read the writeup line by line; it has not generated and inspected its own files, and the post carries no response from Microsoft. The post notes that Article 50 of the European Union's AI Act, whose transparency rules took effect on August 2, 2026, requires AI content to carry a detectable machine-readable mark, but not a prompt-specific identifier.

Source: xusheng.dev, retrieved August 24, 2026.