Think about the little laundry tag sewn into the inside seam of a shirt. You don’t see it when you’re wearing the shirt. You didn’t ask for it. But it’s there, and it tells anyone who looks closely where the garment came from and how it was made. Now imagine that tag showing up in a photo you edited on your own laptop, with your own processor, in an app that has shipped with Windows since the early 90s.
That’s roughly what’s being reported about Microsoft Paint and Microsoft Photos. When you use their AI features to generate or alter an image, the resulting file carries an invisible watermark containing a GUID, a long unique identifier. It’s not a visible logo in the corner. It’s baked into the file itself, and according to what’s been described publicly, you can’t turn it off.
What a GUID actually is
If you’ve never encountered the term, a GUID is a globally unique identifier. It’s a long string of letters and numbers designed so that no two are ever the same. Software uses them constantly as internal labels for things: this user, this session, this document, this image.
The important quality is uniqueness. A watermark that says “made with AI” is a category label. A watermark that contains a GUID is a serial number. Those are very different things. One tells you what kind of file you’re holding. The other points to one specific event that produced one specific file.
The part that surprised people
Reverse engineering work shared publicly suggests something more involved than a local tagging step. Even though these Copilot+ PC features do the image generation on the device, the reported behavior is that the prompt gets sent to a remote moderation server, and that server sends back the GUID that then gets embedded in the image.
Treat that as a technical claim from independent analysis rather than an official description of how the pipeline works. But if it holds up, it reframes what “local” means in a way a lot of people would find counterintuitive. The heavy compute stays on your machine. The identifier does not originate there.
For non-technical readers, this is the single most useful idea to take away from the whole story: “runs locally” and “doesn’t talk to the internet” are not the same promise. A feature can do its actual thinking on your hardware while still checking in with a server for permission, logging, or labeling. Marketing language rarely draws that line clearly, so it’s a good habit to assume the two are separate questions and ask about each one.
Why Microsoft is doing this at all
None of this comes out of nowhere. Invisible watermarking has been on Microsoft’s roadmap across several products, including images generated with DALL·E through the Azure OpenAI service, and a broader transparency push extending into Microsoft 365 content that has been generated or altered with AI.
The reasoning is easy to follow and mostly sympathetic. As synthetic images get easier to produce and harder to eyeball, provenance becomes valuable. If a newsroom, a court, a school, or a platform can check whether an image was machine-made, that’s a real defense against a real problem. Visible labels get cropped off. Metadata gets stripped by every upload pipeline on earth. So the industry has gravitated toward marks embedded in the image data itself.
Where the tension sits
The friction isn’t the watermark existing. It’s the combination of three details:
- It’s invisible, so most people won’t know it’s there.
- It’s unique per output, not a generic “AI-made” flag.
- It reportedly can’t be disabled, including for work you did on your own machine.
A unique identifier is only as private as the records kept alongside it. On its own, a GUID in a file tells an outsider nothing. Paired with server-side logs of when that GUID was issued and to whom, it becomes something else entirely. That’s not an accusation about what anyone is doing with the data. It’s just the shape of the system, and the shape is what determines what becomes possible later.
There’s also a consent gap that has nothing to do with technology. Paint is the app people open to crop a screenshot. Nobody approaches it expecting a provenance system. When transparency features arrive quietly inside utilities people have used for thirty years, the transparency ends up pointing outward at the file rather than inward at the user.
What to do with this
Practically speaking, most people don’t need to change anything. If you’re making memes or touching up vacation photos, an embedded identifier is unlikely to affect your life.
If you handle sensitive material, treat AI-edited images the way you’d treat any file with unknown metadata. Know that the mark is designed to survive normal handling, so casual re-saving is not a reliable way to remove it. And if a tool’s privacy behavior matters for your work, look for a plain statement of what leaves the device and when, not just where the model runs.
The wider lesson is about vocabulary. As AI features get folded into ordinary software, the words describing them are getting slipperier. “On-device,” “local,” and “private” are drifting apart. Learning to ask which one a product actually means is quickly becoming a basic literacy skill.
đź•’ Published: