12 ms·

MS Paint and Photos inivisibly watermark even locally generated output with GUID

861 points by ComputerGuru 23d ago

andai 23d ago
This is gonna sound a bit harsh, but from the outside it genuinely looks like Microsoft is actively looking for new ways to degrade and humiliate their users. (And having no trouble finding them!)
kylepomykala 23d ago
[flagged]
- pmkary 23d ago
  [flagged]
ComputerGuru 23d ago
AI-generated text warning (I submitted - but did not author - the piece), but it seems MS Paint and MS Photos add both a visible (can be turned off) and invisible (cannot be disabled and happens silently in the background with no user notice) watermarks to photos that have been AI-manipulated, even when using a local model to perform the action. It's not clear if this applies to even things like using AI-enhanced background delete/remove, but the invisible watermark is embedded in both the image pixels and the image metadata, both containing a GUID that can be linked to the exact prompt that was used and the originating device/user (on Microsoft's end). Obvious next step is to explore if you can replace watermarker.dll with a (signed) no-op shim or MITM the API call to at least use your own (nil?) GUID that isn't linked to your device/account. In case it's not obvious, my bigger concern isn't "this image can be identified to have been generated with/by AI" so much as it is "digital yellow printer dots have been forced upon us, except they can identify and retrieve the exact user/device/time/place/document/etc", completely destroying any and all illusions of privacy left.
- NuclearPM 23d ago
  I don’t understand the warning.
  - phainopepla2 23d ago
    They're saying that the blogpost is at least partially AI-generated.
- like_any_other 23d ago
  [dead]
- nemomarx 23d ago
  I'd like to know more about the GUID part and how easy is it so deanonymize yeah. But if it's only on ai generation and not on all images it seems easy enough to work around that part? Still better than printers doing it no matter what you're printing.
  - jijji 23d ago
    The article says that once converted to BMP all the metadata gets removed....so on linux: convert file.jpg file.bmp; convert file.bmp file.jpg
    - jkaplowitz 23d ago
      It says that about the C2PA content credentials metadata, but not about the modified image pixels.
      - kbelder 23d ago
        Conversion from jpg to bmp to jpg is a lossy process, so it may obscure the watermarked pixels.
        setopt 23d ago
nemomarx 23d ago
Interesting. I really didn't think watermarks would end up going anywhere, but maybe with enough adoption we can have easy ai generated content flagging after all?
- dotancohen 23d ago
  Not every generative AI model will watermark. Especially not adversarial and disinformation models.
  - AaronAPU 23d ago
    So as usual, exactly the things you want it to work on it won’t.
    - jambalaya8 23d ago
      I mean, workarounds wouldn't be hard, just annoying, anyway. Like an extra step or two (take a screenshot, change the image format, wipe the metadata; or print, take photo with camera, clean up in something like gimp, same other steps).
  - deltoidmaximus 23d ago
    It actually might make the new horrible world even worse. Imagine the populace getting used to a AI image detector flagging things as fake using this fairly easily defeated GUID marker system. Most people are just making memes or cat videos and don't even try to remove this so eventually the populace starts to believe these things actually work. Now some one slightly more sophisticated starts creating deepfakes of a woman and uploading them or fabricating video of an political event without this marker. The subject protests it's fake and AI generated but a loud majority of ignorants feed it into Microsoft AI detector and call you a liar and say it's confirmed real. Most people don't know any better and eat it up because a computer said so.
    - Terr_ 23d ago
      > the populace starts to believe US Social Security Numbers are a useful analogy: The designers knew they weren't something anyone could securely depend on, and told people not to do it... but companies did it anyway, for their own convenience and cheap security-theater. Ultimately a lot of individual victims suffered for it. It would have almost been better if one big incident blew the "knowing an SSN means something" myth apart early on.
sixothree 23d ago
I think it would be nice if all cameras digitally signed pictures. You could prove the photo was real.
- 615341652341 23d ago
  The hard part is deciding how much post processing is acceptable with these images. Feels like a lot of phone cameras optimize images and curious how much of it is considered “AI”
  - sixothree 23d ago
    I was thinking any photo created with a camera should be signed. Why we don't have that in 2026 is beyond me. But what you're talking about is the generative aspect of these photos likely expanding over time. We're seeing that today with the ultra zoom features on some cameras regenerating objects (and especially text). Without the user doing anything the phone will generatively fill in detail, most worryingly text and people. Then there's the Samsung moon issue - taking a photo of a pixelated printout of the moon caused Samsung phones to generate a new image of the moon.
    - Retr0id 23d ago
      Signing doesn't really achieve anything when an attacker can manipulate the device into signing arbitrary pixels. Nobody knows how to make a camera that can distinguish honest vs deceptive photons.
- WalterGR 23d ago
  What would prevent someone from applying the same algorithm on a computer to sign arbitrary images?
  - dotancohen 23d ago
    Asymetric keys
  - arjie 23d ago
deleted 23d ago
[deleted]
JoeBOFH 23d ago
I had this trigger the other day incorrectly and went and installed Paint.net. I pasted in a screenshot I took and just wanted to resize it. I got a banner saying it was made with AI and would be updated to reflect that.
- initramfs 23d ago
  I guess it shouldn't be surprising if an application called "paint.net" can determined if AI was used when connected to the internet. (I have used Paint.net more than a decade ago).
  - JoeBOFH 23d ago
    I was stating that MS Paint mis categorized a Print Screen screenshot as AI generated when pasted. Which pushed me to install PaintdotNet onto my laptop instead.
    - TeMPOraL 23d ago
      > mis categorized a Print Screen screenshot as AI generated Maybe. Question is, was that a false positive, or merely a bad user-facing message? Assuming you didn't have any AI-generated images caught in the screenshot (e.g. some advert - plenty of those even in Microsoft apps like Weather, nowadays), what if - and I'm speculating here; I don't know if anyone actually does it yet, but it's so obvious they eventually will - - what if parts of your screenshot already had an invisible watermark on it, like the ones for tagging AI images? You can imagine an app rendering its window to texture, and embedding a watermark on those pixels before sending it over to the system compositor, and the reasons have nothing to do with AI. Watermarks are DRM tech. "AI generated" is just a specific kind of metadata that can be put in one, and a huge red herring for discussions. It's only a matter of time before we'll need to have software for detecting and removing real-time watermarks from display output at OS level. (Unless, of course, platforms decide to add app window live watermarking as a "feature", and given the story with remote attestation, I think it's more than likely.)
  - aqfamnzc 23d ago
Delphiza 23d ago
I get the privacy concerns, and we are right to expect Microsoft to say that this is what their tool may be doing. However, I fear that one day we will look back and wonder why we didn't do more to sign and preserve human authenticity. Having a stamp saying "AI manipulated" should be a part of digital lineage tooling.
- torginus 23d ago
  Well if that's any reassurance, you can generate a meme picture using AI, then paste it into Paint to add some funny text. That way you can get the best of both worlds.
- jacquesm 23d ago
  You can watermark AI without leaking who did it. That's just using AI to add yet another layer of user tracking.
- account42 22d ago
  If an adversary knows how the watermark is embedded they can replace it with noise so its not like you can rely on these watermarks anyway.
  - inigyou 22d ago
    Yeah you can do that, and it's a crime
initramfs 23d ago
Thanks Microsoft, for adding my signature so I won't have to claim authorship when it ends up in a museum in 200 years, and the NSA archives are declassified for art historians filing a FOIA in 2226, who find out, "yep, it was from his PC."
- Scaled 23d ago
  Ms paint slop being hung in a museum? Now that's a dystopian future!
  - initramfs 23d ago
    No, I wasn't suggesting that. I was saying that if there was digital art (human made) aesthetically significant that a curator would want to display it in a museum, Microsoft's GUID supplied to a data collection agency would make it possible to retrieve if ever/whenever that data were declassified (assuming it isn't purged) It's possible a very bad curator with a terrible taste in art might select slop to display, but I was refering to "fine art" or at least finer art that is digital.
    - initramfs 23d ago
      According to It's FOSS, :It's FOSS 3h • Microsoft quietly embeds a hidden tracking identifier in every AI-generated image you create using Paint or Photos on Windows. A researcher discovered that these apps embed a server-issued GUID (a globally unique identifier) as an invisible watermark in locally generated AI images. The watermark is tied to the prompts you type. And since those prompts are associated with your Microsoft account, Microsoft could "theoretically" trace any watermarked image back to the user who created it. This is recycling an idea from the 80s. Back then, laser printer manufacturers added tiny yellow dot patterns to every printed page. With this, they could identify the printer. Now Microsoft has brought the same idea to AI image generation, and added it to two of the most widely used default Windows apps. Microsoft had disclosed its AI safety measures in official documentation, but the practical implication, that your output image file carries an invisible fingerprint linked to your identity, was never clearly mentioned, of course. The researcher found this by reading Microsoft's own published documentation and analyzing the watermarking mechanics. AI watermarking is a requirement by law in the EU. But "this image was generated by AI" is different than "this image was generated by AI by Mr. Winston Smith". For anyone who values privacy, this is something to worry about. If you generate an image locally, on your own device, why should it carry a tag that can identify you to the company whose software you used? But then, anyone who values their privacy won't be using Microsoft Windows anyway." Since the cat is out of the bag, I wouldn't be surprised if Microsoft generates an invisible watermark for ALL files and not just AI generated ones. The real story is that since AI watermarks are possible, there is no technical barrier to them adding personal EXIF metadata to a file where it can't be seen, removed, or decrypted, whether it is media, a document or other file.
weberer 23d ago
The AI aspect of this is a red herring. The real problem is that they're secretly adding in a unique identifier into every image you create. If somebody does not like your meme, they can just send a copyright subpoena to Microsoft to instantly get your full name, address, email, phone number, and any other data associated with your Microsoft account. Just like age verification, this is another weapon in the war against internet anonymity.
- nemomarx 23d ago
  Does it trigger on non AI images? The post doesn't say so at least.
  - Someone1234 23d ago
    It does kind of say: The GUID is coming from the moderation endpoint, which is hit when you generate a local or cloud AI image based on your prompt. If there is no prompt, there is no endpoint, and likely no GUID. Obviously Paint could have been watermarking prior to AI though, but this specific AI watermarking appears to be only that.
    - londons_explore 23d ago
      The fact that local ai image generation uses an online moderation API is a bit worrying too.... Why not just mod the app to not call this API?
      - nvme0n1p1 23d ago
        Since the watermarker runs locally, you could also do the reverse: generate some porn with a different open model, then run that code to tag it as "Content watermarked by Microsoft Responsible AI"
      - autoexec 23d ago
        Probably both so they can change what they censor without waiting for you to run windows update and also so they can collect your information (IP, timestamp, etc) to associate with whatever you did
VCFundedGenYer 23d ago
Keep an eye on this. A few months back, MS incorrectly tried to stamp a Copilot "watermark" (just an auto-added note) to any and all Azure DevOps commits, regardless of whether an LLM was actually involved. They removed it after a lot of github issues were submitted to the source of the issue which was a VS Code Copilot extension. MS has been very sloppy in their implementations. I would recommend against using Paint or any other LLM enabled app they use as a result. Things may be getting incorrectly stamped.
- Gud 22d ago
  I would avoid junk from Microsoft entirely.
sehw 23d ago
[dead]
gigel82 23d ago
I'm honestly surprised they don't upload the entire image to apply the watermark server-side, to the point that I'd like someone else to repeat this investigation and confirm it's not happening. Shipping the watermark generator on user's machine would make it very easy for someone motivated to find how it works and write a "watermark remover".
- deadbabe 23d ago
  It is already fairly trivial to write a universal watermark remover, an LLM can do it for you.
  - gigel82 23d ago
    Without access to the code, I imagine it'd be extremely difficult even with unlimited API calls to the watermarker.
dagaci 23d ago
Googling you can see the source code for watermarking here https://github.com/microsoft/InvisMark https://github.com/microsoft/InvisMark
jasonmp85 23d ago
[dead]
naniel 23d ago
awesome breakdown of the process you took. reverse-engineering is crazy now with AI. IP is dead this also reminds me of what got me hooked on CS in the first place: a simple java steganography app in cmsc150
petjuh 23d ago
How resistant is it to dithering? Can you just add +-1 randomly to each pixel r,g and b values and throw it off?
- red_admiral 23d ago
  Probably not, if it's this kind of thing: https://en.wikipedia.org/wiki/Perceptual_hashing https://en.wikipedia.org/wiki/Perceptual_hashing
  - account42 22d ago
    Randomizing bit 0 might not be enough but if you know the algorithm used (and you do in this case because it is applied locally) then you can always replace the embedded data with random noise.
petjuh 23d ago
This reminds me that in the USSR they had typewriters that added an identifier somehow that could be traced back to that particular typewriter (and who it was sold to)
- srean 23d ago
  Not only USSR. I wonder whether Arthur Conan Doyle had the idea before the police started using typewriter typeface wear and tear for forensics.
- kvuj 23d ago
  You have no idea how deep this rabbit hole goes. Search for EFF printers secret tracking. Virtually all commercial printers embed an invisible identifier on every page printed.
  - esafak 23d ago
    It was about money anti-counterfeiting. https://en.wikipedia.org/wiki/Printer_tracking_dots https://en.wikipedia.org/wiki/Printer_tracking_dots
    - SV_BubbleTime 23d ago
      There is always a legit reason. It’s just never the only reason.
    - inigyou 22d ago
      Are they still doing the EURion constellation, too? You can embed that in anything.
  - imhoguy 23d ago
    Now I need to see if agentic reverse engineering of printer firmware can actually remove that "feature" for good.
  - kube-system 23d ago
    Virtually all color laser printers and copiers.
phendrenad2 23d ago
This muddle of an article makes it totally unclear to me if this GUID is attached by the AI generation call or every image I edit in MS Paint. I'm going to assume the former unless they release a clarification. Edit: Actually trivial to test, just save an image of all black and see if it suddenly has other values on save.
- david_shaw 23d ago
  > Edit: Actually trivial to test, just save an image of all black and see if it suddenly has other values on save. Did it?
- red_admiral 23d ago
  Assuming the watermark works like the upcoming AI watermark for text, then it uses the content's entropy to embed the information. An all-black image doesn't have much entropy, so it's unlikely you'd find anything.
  - phendrenad2 23d ago
    I guess that makes sense. So import an image of the mandelbrot set you generated and save it, and see if any pixels change.
luciana1u 23d ago
[flagged]
red_admiral 23d ago
Misleading title: the watermark applies to AI generated/edited images. That includes local models. Whether it applies to non-AI generated images is a question for the reverse engineers (or ironically, a suitable AI). My bet is on "no". Of course, the pre-AI versions of paint and notepad can still be installed with a bit of trickery, and it's worth it just for the UX.
- SV_BubbleTime 23d ago
  Don’t care. There is no reason to assign a GGUID except to identify the person, not that the photo is generated. This is nothing more than surveillance.
  - phendrenad2 23d ago
    Don't care that you don't care. This distinction does matter to a lot of people, because to many people there's a huge difference.
saejox 23d ago
These days i cant recommend Windows to anybody. Even gamers should move to linux. Some say "i do nothing illegal" "have nothing to hide". You dont do anything illegal in your point of view. AI tracking you might think otherwise. A sudden knock on your door might happen because of an ambigious search/propmt.
- tapland 23d ago
  There's a huge number of gamers moving to things like CachyOS. Some are stuck because of Valorant, LoL or Battlefield DRM, but it's a big move lately.
  - avadodin 23d ago
    I'd never play one of those games but the excuse for the kernel modules spying on you is usually anti-cheat not DRM as they are online games. There are droves of people petitioning Valve to add kernel anti–cheat to CS2.
    - account42 22d ago
      It's both and the main reason why anti-cheat is needed is the central matchmaking model, which is itself a form of DRM. If people were still hosting smaller community-moderated servers there would not be a need for invasive anti-cheat but people could also pay on cracked servers without paying.
- 1970-01-01 23d ago
  Others say "I need it to work on a random Thursday, not wait for fsck after ever reboot" https://github.com/IceWhaleTech/CasaOS/issues/1104 https://github.com/IceWhaleTech/CasaOS/issues/1104
  - toilet 23d ago
    I have the same issue on Windows 11. It's been bugging me to press a button or "check my drive" on every startup for at least half a year, no matter how often I let it run the check...
clear0250 23d ago
Solution: Don't AI generate images! I think this is a good way to discourage people from making slop.
cupantae 23d ago
As a linux fan I just love all these changes Microsoft have been introducing
- account42 22d ago
  As another Linux fan, I don't. What Microsoft does to their users changes the overton window of what's acceptable in tech. Before you know it there will be a politician demanding that all software systems that don't implement such tracking will be outlawed and there will be no one left to speak up to you because they are all already used to the tracking so why should you get a pass.
  - cucumber3732842 22d ago
    Exactly. North Star linux was doing this 20yr ago. And now Microsoft thinks it's ok to do it.
kibwen 23d ago
Until proven otherwise via open-source audits and reproducible binaries, you should assume that all commercial photo editing software is embedding watermarks in any way they can get away with. This includes the professional software that you pay quite expensive licenses for. You should also assume that even if they're not today, they will eventually be coerced into doing so, in the same way that printers embed tracking dots.
- account42 22d ago
  You should however not accept this state of affairs even if you exclusively use open source software because the next step is that it become illegal to have photo editing software that doesn't include the tracking information needed to protect the children, fight terrorists or whatever the boogeyman of the day is.
  - inigyou 22d ago
    It's already illegal to not watermark an AI image.
    - picofarad 22d ago
      Oh I didn't know I was going to break the law today just using automatic1111 stable diffusion. I'll call my lawyer.
      - inigyou 22d ago
        You do that.
pmkary 23d ago
With every new thing Microsoft goes trying so hard to come out as the good person, but they just cannot help themselves but to inject their evil. It had to be changed with Nadla coming, but their enshitification is just keeps getting worse and worse. What on Earth is this.
megous 23d ago
Solved by not using closed source SW, period.
andai 23d ago
My honest reaction: https://files.catbox.moe/4ylzsq.png https://files.catbox.moe/4ylzsq.png
deleted 23d ago
[deleted]
alightsoul 23d ago
Yet another reason to switch to Linux.
imnotr0b0t 23d ago
Interesting find. Overall it makes sense from a deepfake-fighting perspective and EU requirements. But what's concerning is that users aren't really told about this, as far as I can tell. Would be cool if someone checked if it can be bypassed, like swapping the DLL or intercepting the API call. But yeah, it's another step toward every digital trace becoming personally identifiable...
two_handfuls 23d ago
This is not ok.
claiir 23d ago
Kind of sad how all these technical blogs just reek of Claude text these days. Hard read when it’s obviously padded by an LLM…
deleted 23d ago
[deleted]
clickety_clack 23d ago
I admit it’s a while since I’ve used windows, but it’s such a shock to hear that MS Paint isn’t just a point and click pixel coloring app anymore. It seems like they could have left it as a pure “paint” app and added the fancy stuff to some new image editor or something. I guess they’ve optimized their workforce to just keep making changes so they get promoted rather than just creating really good software.
- darig 23d ago
  [dead]
- SideQuark 23d ago
  If you read the article instead of the headline…….. it’s adding a fairly standard mark to AI generated images to let’s others know, in the same manner a giant swath of the GebAI industry has agreed to.
  - trickypr 23d ago
    I think their point is that paint shouldn’t have any GenAI features (or any new features other than compatibility)
    - SideQuark 23d ago
      [flagged]
      - qu4z-2 23d ago
        I don't so much mind about Paint, but modern Notepad is completely unusable. We had "Notepad but with Rich Text formatting" -- it was called WordPad and no-one used it so they eventually deleted it.
        brudgers 23d ago
        People used Wordpad and thus other people had trouble opening RTF files.
rnd0 23d ago
Ya know, this would probably be pointless but if I were a programmer (I'm not -and refuse to be a vibe coder) I'd probably just grab appropriate libraries and make my own replacements for this shit. GLTK+ (?) is an obvious choice to use for recreating mspaint, and to replace notepad -I was told making a simple editor was an excercise they have you do when you learn programming to begin with? I already replaced the 'solitaire' games suite with pysol running on WSL2 and it's a vast improvement! tldr -if MS is going to screw us, why don't we mitigate it by using replacements?
- inigyou 22d ago
  I would've thought the obvious API to recreate mspaint was Win32
- cyteeditor 22d ago
  [flagged]
SideQuark 23d ago
[flagged]
angry_octet 23d ago
It is quite likely that Snipping Tool is also doing this. Every camera also leaves device specific signature because of its inherent silicon sensor defects. If you want to stay anonymous, don't share images you can't verify at the byte level. Apply filtering to decrease the low bit noise that could hide cryptographic signatures. Don't trust complex container formats. See e.g. PPM format: https://www.cs.swarthmore.edu/~soni/cs35/f13/Labs/extras/01/ppm_info.html https://www.cs.swarthmore.edu/~soni/cs35/f13/Labs/extras/01/... These days entire scenes can be tweaked by AI to add unimportant but identifying marks, at a level far above signal processing tricks, like moving objects in the scene. Verify from multiple sources.
- threecheese 23d ago
  If Anthropic can manipulate text to add a watermark, what’s preventing providers from doing the same to generated images? Modifying the container format can’t protect you from a signature in the image’s visual representation, unless you apply noise to that (and know it’s enough noise/the right kind of noise to counteract whatever unknown technique they’ve applied).
  - angry_octet 22d ago
    Anthropic's watermarking technique is possible, and worryingly could effect low frequency choices (eg as I said, with object placement or style). However, this has to be a generation time decision, you can't really do that with a small edit. In fact small edits tend to be detectable spectrally.
ranger_danger 23d ago
Misleading title IMO... here they are using "locally generated output" to specifically mean only AI-generated images, not your "500hrs in MS Paint" hand-made masterpiece.
LeBit 23d ago
Do we really need more examples of why local LLMs are an absolute necessity?
tgsovlerkhgsel 23d ago
> In other words, “generated locally” does not mean that the complete operation is local. That sounds like a privacy violation that the DPAs should look into. Edit: Apparently it's disclosed somewhere. Still, that defeats the entire point of local generation...
mococa 23d ago
Could microslop be more evil?
- __MatrixMan__ 23d ago
  They're pretty bad, but yes I think so.
userbinator 23d ago
after a local Stable Diffusion image generation The request is JSON and contains at least these fields:..."prompt": "..." Local SD (especially the earlier versions) is already uncensored, so they're effectively crippling it with additional spyware that phones home to tell Microsoft what you're doing and asking whether they approve of it. IMHO the invisible watermark isn't the worst part, but rather the fact that MS is logging every interaction you have with the model, which doesn't ever need to leave your machine.
- TonyStr 23d ago
  What happens if you try to use this feature without being connected to the internet? Will it refuse to run the local AI model?
seriocomic 23d ago
"inivisibly"? for 9 hours this was invisible...
aucisson_masque 23d ago
> On Copilot+ PCs, image generation is local but prompt moderation remains remote Anyone disturbed about that ? It's your computer, running locally, but Microsoft can tell you 'no'. It's like you want to open a folder and it asks permission to Microsoft.
- zdragnar 23d ago
  I would be surprised that anyone is surprised by this. They've been making local accounts harder and harder now to the point of being impossible. Anyone not deep in tech will accept the "think of the children" defense without much worry, and anyone who is deep in tech already knows that if you really want an OS that doesn't spy on you, you need to go to a *nix of some flavor.
- fchicken 23d ago
  I'm disturbed by everything. Prompt moderation, GUID insertion, watermark insertion; track anything and everything, probably done in the name of "protect the children".
- inigyou 22d ago
  That's nothing new. Ever tried to develop a driver? Or replace a system file? Or install an app on iOS not from the store? That war was lost two decades ago with the iPhone
emsign 23d ago
> The two apps send the prompt to a remote server for moderation Why? What needs tobe moderated locally?
fchicken 23d ago
Fucking spyware. Soon it'll literally be "you need a license to use this technology" if we're not there in some form or another already.
- inigyou 22d ago
  It literally already is? What happens if you pirate windows but don't do it properly?
fchicken 23d ago
It'll literally be like printers "cannot print this black/white document, low on cyan". "Cannot run local AI model, no network connection". The more you think about it, the more it really is the same: https://en.wikipedia.org/wiki/Printer_tracking_dots?useskin=vector https://en.wikipedia.org/wiki/Printer_tracking_dots?useskin=...
- account42 22d ago
  Except once printed its at least hard to remove the dots. Image based watermarks are trivial to destroy if you know they are there.
  - fchicken 22d ago
    tbh so is circumventing those dots. It doesn't make it any better
    - JacobKfromIRC 22d ago
      How do you circumvent printer dots? I don't see how that could be trivial.
globular-toast 23d ago
Use free software. Proprietary software is used by its owners to control you. This is nothing new, just another example to add to the countless ones we already have.
Schlagbohrer 23d ago
"Apparently, the recent Claude Code text-watermark announcement also played a role in prompting me to think about this possibility." Extremely odd way to write. Are the writer's own thoughts invisible to him or her?
- jojobas 23d ago
  You might think you have control over what causes you to think this or that, but that's only an illusion.
4d4m 23d ago
Gross. Unnecessary. Anti consumer.
p0w3n3d 23d ago
It's for our safety, so when Kathy in the primary school steals Beatrice's picture in paint, miss Wallingford will tell who was the original author
burnoutdv 23d ago
Okay, there are watermarks on AI stuff, interesting, not good but everyone else already talked about. My question..how does it work? Is it robust? I remember that young me hid data in pixels of png with simple stegonagraphy and it was a fun little project..but brittle. How exactly does the fingerprinting survive jpeg compression? Is it repeate over and over the images or is it just one area? If that one is pure black by chance the jpeg algorhitmen would erase it all no?
- nmg 23d ago
  I'm pretty sure the robustness of watermarking has been a solved problem for at least 30 years, I remember visiting the mit media lab in the mid 90s and they were explaining how they could watermark digital audio by imperceptibly adjusting the acoustics as if the walls of the room the audio has been recorded in were changing distance relative to the microphone according to a wave function
  - account42 22d ago
    There is no robust-without-qualifiers watermarking. There is only robustness against common operations but as soon as someone is actually trying to remove the watermark they can at the very least use exactly the same technique to embed random noise instead to overwrite your watermark.
shevy-java 22d ago
Great detective work. With regards to Microsoft being ... uhm ... "transparent": > The same page says that generated images: > “will contain C2PA manifest helping users identify that it is an AI generated image.” > [...] That is a meaningful disclosure of remote filtering and C2PA metadata. > C2PA manifest contains a GUID identifying the invisible pixel watermark > Calling the feature “Content Credentials” is accurate, but it does not > make this prompt-associated identifier obvious to a Windows user. I don't think this is accurate, because without that detective work, most people would have no idea that Microsoft tags and tracks the images here. This reminds me of printers printing identifiers to ID individuals. What this to me means is that I can no longer use any such Microsoft services, because there is no trust for me here. Microsoft sniffs on me, if I were to use these software products. AI is a big spy-op too. Microsoft could easily admit "we watermark all your images, whether you like it or not", but corporate speak forbids this and they don't really admit to it. They do not use the word watermark officially, but their .dll names reveal it. That means they resort to deceit and propaganda. It really is time to strengthen the whole open source ecosystem. I no longer want my taxpayer's money to go into traitorous US companies that abuse EU citizens here. (Note: the same would apply to EU companies, but the USA dominates the software sector, unfortunately. This also has to change permanently.)
blablabla123 22d ago
Actually Microsoft is doing this since the 90s with Word documents. Did they ever pause this practice?
fithisux 22d ago
Don't use them if it does not fit your requirements. The last ten years I am more that happy with Lazpaint or Libreoffice Draw. The last year I have added Imglass to the mix.
grugdev42 22d ago
Use this instead!!! https://jspaint.app/ https://jspaint.app/
lesspassiveobse 22d ago
RedStar OS (North Korea linux) already did this 10 years ago. Nice to see the west catching up.
mg794613 22d ago
My goodness, this has nothing to do with AI problems. I don't understand that people still buy an OS from a company that actively hates it's customers. The amount of things they pull should not even be succesful on a OS you get paid FOR to use.
- alex_duf 22d ago
  Not that I love Microsoft, but they would get a lot of heat if they let anybody generate harmful content as well. They can't win on that topic. Now I would not want to appear to defend the mess they've created out of windows, that's not the point.
  - deleted 22d ago
    [deleted]
  - someguyornotidk 22d ago
    They have only themselves to blame for this. They've spent decades developing technology to spy on and micro-regulate what their captive customers can do with their property. Now that they have this technology, it's only logical that they be held responsible for misuse. The only (and inevitable) solution at this point is for big tech to get micro-regulated like the banking industry. The same mindless greed that drove them to take control away from their customers will be responsible for the same control to be taken away from them.
    - xmcqdpt2 22d ago
      Be careful what you wish for. I'm sure Microsoft and Google would love the kind of regulation we apply to big banks. It has become a moat that makes it impossible for other (snaller/foreign) financial institutions to compete because they don't have massive specialized regulatory departments. The more complex the rules become, the more difficult it will be for alternative providers to exist, unless they have explicit carve outs. So far, with age verification and user id laws, there doesn't seem to be much appetite from politicians to create exceptions for open source and smaller projects. By comparison, in the US the regional banks have special exemptions for many of the really onerous regs, which is why they are still a bunch of them.
hn9rsvy2gx 22d ago
[dead]
luciana1u 22d ago
[flagged]
ozereray1 22d ago
Injecting hidden GUIDs into local files without explicit user consent is a massive privacy overreach. It makes you wonder what other local tools are silently tagging user generated content.
- stingraycharles 22d ago
  Haven’t printers done the same thing for decades?
  - jamesnorden 22d ago
    Oh that makes it totally ok then...
    - stingraycharles 22d ago
      Not saying that, but at least that there must have been ample legal precedent that this is probably allowed.
      - ozereray1 22d ago
        [flagged]
    - kmacdough 22d ago
      No it's not ok, and most people are horrified when they learn. It's just a reality check that we've lived in a surveillance state for quite a while and it's time we take a stand. And a reminder that the government has done a good job of suppressing these realities from public awareness.
      - hulitu 18d ago
        > and it's time we take a stand I'm afraid it is too late.
  - MisterTea 22d ago
deleted 22d ago
[deleted]
deleted 22d ago
[deleted]
hojinkoh 22d ago
Microsoft is in a pretty good position to do something that can be valuable to certain institutions. Imaging every pdf file, every image, every office documents, and every video has a hidden record of the associated Microsoft accounts of all computers it has ever passed through. This should sell well, and realistically nobody can stop them. Why haven't Microsoft done this much earlier?
Kvarnek 22d ago
The visible watermark toggle giving users a false sense of control while the invisible GUID persists regardless is the worst part. People who turn off the watermark think they opted out.
codedokode 22d ago
Commercial companies with closed-source software, cloud software will always betray you.
deleted 22d ago
[deleted]
xushengdev 22d ago
Xusheng here! I have not gone through all comments, but wish to clarify a few things: 1. The watermark only applied to AI-generated contents through the in-app AI (copilot/cocreator, etc). If you draw something by hand it is not watermarked 2. Privacy implications: I believe your MS account is linked to the prompt and the GUID. And the GUID is embedded into the image as both an insivible watermark and a file-level C2PA metadata. I did not write about this very deeply in my blogpost, but when I do an image generation, it deducts my AI credits (yes, MS gives you like 60 free AI credits), so MS surely knows where the prompt is coming from. Though I am not sure about their storage and retention, e.g., do they actually store the data, and if they do, for how long, etc
assistant1 22d ago
[dead]
not_a_bot_4sho 22d ago
Scanning the comments, I see some curiosity and outrage but little recognition that this is legally required in places like California and Colorado and Texas and probably some more places. And federally, the C2PA strongly encourages digital providence albeit without legal consequences... yet. All AI content coming from companies that service the US market are watermarking things.
cyteeditor 22d ago
[flagged]
m3047 22d ago
People worried about other people tracking them while using local stable diffusion models built on fraudulently obtained training content, to produce images which cannot be owned. Thug on thug violence.
krick 22d ago
Obviously it's bad and we can all say "fuck Microsoft" once more, but "we" probably don't use Windows anyway, right? I have no idea, really, but if you willingly use closed-source spyware that is notorious (for AT LEAST 15 years) for all kinds of invasive telemetry it forces upon you, you probably wouldn't find this new piece of information concerning anyway. And ironically, I think that this one is kinda fair. I mean, you specifically asked your software to generate whatever pseudo-random bytes it wishes to loosely based on some text prompt. It did that. Now, apparently, these pseudo-random bytes turn out to be personally identifiable. So what? I suppose they didn't claim their PRNG to be cryptography-grade. They could even make it seem like an accident, should they be bothered to. Make it way less obvious. Now if it would insert watermarks on save (like printers do), that would be really outrageous. But when you trust software to produce "whatever", you probably shouldn't be really mad about it doing anything more than you asked to.

861 points by ComputerGuru 23d ago

andai 23d ago

This is gonna sound a bit harsh, but from the outside it genuinely looks like Microsoft is actively looking for new ways to degrade and humiliate their users. (And having no trouble finding them!)

kylepomykala 23d ago

[flagged]

pmkary 23d ago
[flagged]

ComputerGuru 23d ago

AI-generated text warning (I submitted - but did not author - the piece), but it seems MS Paint and MS Photos add both a visible (can be turned off) and invisible (cannot be disabled and happens silently in the background with no user notice) watermarks to photos that have been AI-manipulated, even when using a local model to perform the action. It's not clear if this applies to even things like using AI-enhanced background delete/remove, but the invisible watermark is embedded in both the image pixels and the image metadata, both containing a GUID that can be linked to the exact prompt that was used and the originating device/user (on Microsoft's end). Obvious next step is to explore if you can replace watermarker.dll with a (signed) no-op shim or MITM the API call to at least use your own (nil?) GUID that isn't linked to your device/account. In case it's not obvious, my bigger concern isn't "this image can be identified to have been generated with/by AI" so much as it is "digital yellow printer dots have been forced upon us, except they can identify and retrieve the exact user/device/time/place/document/etc", completely destroying any and all illusions of privacy left.

NuclearPM 23d ago
I don’t understand the warning.
- phainopepla2 23d ago
  They're saying that the blogpost is at least partially AI-generated.
like_any_other 23d ago
[dead]
nemomarx 23d ago
I'd like to know more about the GUID part and how easy is it so deanonymize yeah. But if it's only on ai generation and not on all images it seems easy enough to work around that part? Still better than printers doing it no matter what you're printing.
- jijji 23d ago
  The article says that once converted to BMP all the metadata gets removed....so on linux: convert file.jpg file.bmp; convert file.bmp file.jpg
  - jkaplowitz 23d ago
    It says that about the C2PA content credentials metadata, but not about the modified image pixels.
    - kbelder 23d ago
      Conversion from jpg to bmp to jpg is a lossy process, so it may obscure the watermarked pixels.
      - setopt 23d ago

nemomarx 23d ago

Interesting. I really didn't think watermarks would end up going anywhere, but maybe with enough adoption we can have easy ai generated content flagging after all?

dotancohen 23d ago
Not every generative AI model will watermark. Especially not adversarial and disinformation models.
- AaronAPU 23d ago
  So as usual, exactly the things you want it to work on it won’t.
  - jambalaya8 23d ago
    I mean, workarounds wouldn't be hard, just annoying, anyway. Like an extra step or two (take a screenshot, change the image format, wipe the metadata; or print, take photo with camera, clean up in something like gimp, same other steps).
- deltoidmaximus 23d ago
  It actually might make the new horrible world even worse. Imagine the populace getting used to a AI image detector flagging things as fake using this fairly easily defeated GUID marker system. Most people are just making memes or cat videos and don't even try to remove this so eventually the populace starts to believe these things actually work. Now some one slightly more sophisticated starts creating deepfakes of a woman and uploading them or fabricating video of an political event without this marker. The subject protests it's fake and AI generated but a loud majority of ignorants feed it into Microsoft AI detector and call you a liar and say it's confirmed real. Most people don't know any better and eat it up because a computer said so.
  - Terr_ 23d ago
    > the populace starts to believe US Social Security Numbers are a useful analogy: The designers knew they weren't something anyone could securely depend on, and told people not to do it... but companies did it anyway, for their own convenience and cheap security-theater. Ultimately a lot of individual victims suffered for it. It would have almost been better if one big incident blew the "knowing an SSN means something" myth apart early on.

sixothree 23d ago

I think it would be nice if all cameras digitally signed pictures. You could prove the photo was real.

615341652341 23d ago
The hard part is deciding how much post processing is acceptable with these images. Feels like a lot of phone cameras optimize images and curious how much of it is considered “AI”
- sixothree 23d ago
  I was thinking any photo created with a camera should be signed. Why we don't have that in 2026 is beyond me. But what you're talking about is the generative aspect of these photos likely expanding over time. We're seeing that today with the ultra zoom features on some cameras regenerating objects (and especially text). Without the user doing anything the phone will generatively fill in detail, most worryingly text and people. Then there's the Samsung moon issue - taking a photo of a pixelated printout of the moon caused Samsung phones to generate a new image of the moon.
  - Retr0id 23d ago
    Signing doesn't really achieve anything when an attacker can manipulate the device into signing arbitrary pixels. Nobody knows how to make a camera that can distinguish honest vs deceptive photons.
WalterGR 23d ago
What would prevent someone from applying the same algorithm on a computer to sign arbitrary images?
- dotancohen 23d ago
  Asymetric keys
- arjie 23d ago

deleted 23d ago

[deleted]

JoeBOFH 23d ago

I had this trigger the other day incorrectly and went and installed Paint.net. I pasted in a screenshot I took and just wanted to resize it. I got a banner saying it was made with AI and would be updated to reflect that.

initramfs 23d ago
I guess it shouldn't be surprising if an application called "paint.net" can determined if AI was used when connected to the internet. (I have used Paint.net more than a decade ago).
- JoeBOFH 23d ago
  I was stating that MS Paint mis categorized a Print Screen screenshot as AI generated when pasted. Which pushed me to install PaintdotNet onto my laptop instead.
  - TeMPOraL 23d ago
    > mis categorized a Print Screen screenshot as AI generated Maybe. Question is, was that a false positive, or merely a bad user-facing message? Assuming you didn't have any AI-generated images caught in the screenshot (e.g. some advert - plenty of those even in Microsoft apps like Weather, nowadays), what if - and I'm speculating here; I don't know if anyone actually does it yet, but it's so obvious they eventually will - - what if parts of your screenshot already had an invisible watermark on it, like the ones for tagging AI images? You can imagine an app rendering its window to texture, and embedding a watermark on those pixels before sending it over to the system compositor, and the reasons have nothing to do with AI. Watermarks are DRM tech. "AI generated" is just a specific kind of metadata that can be put in one, and a huge red herring for discussions. It's only a matter of time before we'll need to have software for detecting and removing real-time watermarks from display output at OS level. (Unless, of course, platforms decide to add app window live watermarking as a "feature", and given the story with remote attestation, I think it's more than likely.)
- aqfamnzc 23d ago

Delphiza 23d ago

I get the privacy concerns, and we are right to expect Microsoft to say that this is what their tool may be doing. However, I fear that one day we will look back and wonder why we didn't do more to sign and preserve human authenticity. Having a stamp saying "AI manipulated" should be a part of digital lineage tooling.

torginus 23d ago
Well if that's any reassurance, you can generate a meme picture using AI, then paste it into Paint to add some funny text. That way you can get the best of both worlds.
jacquesm 23d ago
You can watermark AI without leaking who did it. That's just using AI to add yet another layer of user tracking.
account42 22d ago
If an adversary knows how the watermark is embedded they can replace it with noise so its not like you can rely on these watermarks anyway.
- inigyou 22d ago
  Yeah you can do that, and it's a crime

initramfs 23d ago

Thanks Microsoft, for adding my signature so I won't have to claim authorship when it ends up in a museum in 200 years, and the NSA archives are declassified for art historians filing a FOIA in 2226, who find out, "yep, it was from his PC."

Scaled 23d ago
Ms paint slop being hung in a museum? Now that's a dystopian future!
- initramfs 23d ago
  No, I wasn't suggesting that. I was saying that if there was digital art (human made) aesthetically significant that a curator would want to display it in a museum, Microsoft's GUID supplied to a data collection agency would make it possible to retrieve if ever/whenever that data were declassified (assuming it isn't purged) It's possible a very bad curator with a terrible taste in art might select slop to display, but I was refering to "fine art" or at least finer art that is digital.
  - initramfs 23d ago
    According to It's FOSS, :It's FOSS 3h • Microsoft quietly embeds a hidden tracking identifier in every AI-generated image you create using Paint or Photos on Windows. A researcher discovered that these apps embed a server-issued GUID (a globally unique identifier) as an invisible watermark in locally generated AI images. The watermark is tied to the prompts you type. And since those prompts are associated with your Microsoft account, Microsoft could "theoretically" trace any watermarked image back to the user who created it. This is recycling an idea from the 80s. Back then, laser printer manufacturers added tiny yellow dot patterns to every printed page. With this, they could identify the printer. Now Microsoft has brought the same idea to AI image generation, and added it to two of the most widely used default Windows apps. Microsoft had disclosed its AI safety measures in official documentation, but the practical implication, that your output image file carries an invisible fingerprint linked to your identity, was never clearly mentioned, of course. The researcher found this by reading Microsoft's own published documentation and analyzing the watermarking mechanics. AI watermarking is a requirement by law in the EU. But "this image was generated by AI" is different than "this image was generated by AI by Mr. Winston Smith". For anyone who values privacy, this is something to worry about. If you generate an image locally, on your own device, why should it carry a tag that can identify you to the company whose software you used? But then, anyone who values their privacy won't be using Microsoft Windows anyway." Since the cat is out of the bag, I wouldn't be surprised if Microsoft generates an invisible watermark for ALL files and not just AI generated ones. The real story is that since AI watermarks are possible, there is no technical barrier to them adding personal EXIF metadata to a file where it can't be seen, removed, or decrypted, whether it is media, a document or other file.

weberer 23d ago

The AI aspect of this is a red herring. The real problem is that they're secretly adding in a unique identifier into every image you create. If somebody does not like your meme, they can just send a copyright subpoena to Microsoft to instantly get your full name, address, email, phone number, and any other data associated with your Microsoft account. Just like age verification, this is another weapon in the war against internet anonymity.

nemomarx 23d ago
Does it trigger on non AI images? The post doesn't say so at least.
- Someone1234 23d ago
  It does kind of say: The GUID is coming from the moderation endpoint, which is hit when you generate a local or cloud AI image based on your prompt. If there is no prompt, there is no endpoint, and likely no GUID. Obviously Paint could have been watermarking prior to AI though, but this specific AI watermarking appears to be only that.
  - londons_explore 23d ago
    The fact that local ai image generation uses an online moderation API is a bit worrying too.... Why not just mod the app to not call this API?
    - nvme0n1p1 23d ago
      Since the watermarker runs locally, you could also do the reverse: generate some porn with a different open model, then run that code to tag it as "Content watermarked by Microsoft Responsible AI"
    - autoexec 23d ago
      Probably both so they can change what they censor without waiting for you to run windows update and also so they can collect your information (IP, timestamp, etc) to associate with whatever you did

VCFundedGenYer 23d ago

Keep an eye on this. A few months back, MS incorrectly tried to stamp a Copilot "watermark" (just an auto-added note) to any and all Azure DevOps commits, regardless of whether an LLM was actually involved. They removed it after a lot of github issues were submitted to the source of the issue which was a VS Code Copilot extension. MS has been very sloppy in their implementations. I would recommend against using Paint or any other LLM enabled app they use as a result. Things may be getting incorrectly stamped.

Gud 22d ago
I would avoid junk from Microsoft entirely.

sehw 23d ago

[dead]

gigel82 23d ago

I'm honestly surprised they don't upload the entire image to apply the watermark server-side, to the point that I'd like someone else to repeat this investigation and confirm it's not happening. Shipping the watermark generator on user's machine would make it very easy for someone motivated to find how it works and write a "watermark remover".

deadbabe 23d ago
It is already fairly trivial to write a universal watermark remover, an LLM can do it for you.
- gigel82 23d ago
  Without access to the code, I imagine it'd be extremely difficult even with unlimited API calls to the watermarker.

dagaci 23d ago

Googling you can see the source code for watermarking here https://github.com/microsoft/InvisMark https://github.com/microsoft/InvisMark

jasonmp85 23d ago

[dead]

naniel 23d ago

awesome breakdown of the process you took. reverse-engineering is crazy now with AI. IP is dead this also reminds me of what got me hooked on CS in the first place: a simple java steganography app in cmsc150

petjuh 23d ago

How resistant is it to dithering? Can you just add +-1 randomly to each pixel r,g and b values and throw it off?

red_admiral 23d ago
Probably not, if it's this kind of thing: https://en.wikipedia.org/wiki/Perceptual_hashing https://en.wikipedia.org/wiki/Perceptual_hashing
- account42 22d ago
  Randomizing bit 0 might not be enough but if you know the algorithm used (and you do in this case because it is applied locally) then you can always replace the embedded data with random noise.

petjuh 23d ago

This reminds me that in the USSR they had typewriters that added an identifier somehow that could be traced back to that particular typewriter (and who it was sold to)

srean 23d ago
Not only USSR. I wonder whether Arthur Conan Doyle had the idea before the police started using typewriter typeface wear and tear for forensics.
kvuj 23d ago
You have no idea how deep this rabbit hole goes. Search for EFF printers secret tracking. Virtually all commercial printers embed an invisible identifier on every page printed.
- esafak 23d ago
  It was about money anti-counterfeiting. https://en.wikipedia.org/wiki/Printer_tracking_dots https://en.wikipedia.org/wiki/Printer_tracking_dots
  - SV_BubbleTime 23d ago
    There is always a legit reason. It’s just never the only reason.
  - inigyou 22d ago
    Are they still doing the EURion constellation, too? You can embed that in anything.
- imhoguy 23d ago
  Now I need to see if agentic reverse engineering of printer firmware can actually remove that "feature" for good.
- kube-system 23d ago
  Virtually all color laser printers and copiers.

phendrenad2 23d ago

This muddle of an article makes it totally unclear to me if this GUID is attached by the AI generation call or every image I edit in MS Paint. I'm going to assume the former unless they release a clarification. Edit: Actually trivial to test, just save an image of all black and see if it suddenly has other values on save.

david_shaw 23d ago
> Edit: Actually trivial to test, just save an image of all black and see if it suddenly has other values on save. Did it?
red_admiral 23d ago
Assuming the watermark works like the upcoming AI watermark for text, then it uses the content's entropy to embed the information. An all-black image doesn't have much entropy, so it's unlikely you'd find anything.
- phendrenad2 23d ago
  I guess that makes sense. So import an image of the mandelbrot set you generated and save it, and see if any pixels change.

luciana1u 23d ago

[flagged]

red_admiral 23d ago

Misleading title: the watermark applies to AI generated/edited images. That includes local models. Whether it applies to non-AI generated images is a question for the reverse engineers (or ironically, a suitable AI). My bet is on "no". Of course, the pre-AI versions of paint and notepad can still be installed with a bit of trickery, and it's worth it just for the UX.

SV_BubbleTime 23d ago
Don’t care. There is no reason to assign a GGUID except to identify the person, not that the photo is generated. This is nothing more than surveillance.
- phendrenad2 23d ago
  Don't care that you don't care. This distinction does matter to a lot of people, because to many people there's a huge difference.

saejox 23d ago

These days i cant recommend Windows to anybody. Even gamers should move to linux. Some say "i do nothing illegal" "have nothing to hide". You dont do anything illegal in your point of view. AI tracking you might think otherwise. A sudden knock on your door might happen because of an ambigious search/propmt.

tapland 23d ago
There's a huge number of gamers moving to things like CachyOS. Some are stuck because of Valorant, LoL or Battlefield DRM, but it's a big move lately.
- avadodin 23d ago
  I'd never play one of those games but the excuse for the kernel modules spying on you is usually anti-cheat not DRM as they are online games. There are droves of people petitioning Valve to add kernel anti–cheat to CS2.
  - account42 22d ago
    It's both and the main reason why anti-cheat is needed is the central matchmaking model, which is itself a form of DRM. If people were still hosting smaller community-moderated servers there would not be a need for invasive anti-cheat but people could also pay on cracked servers without paying.
1970-01-01 23d ago
Others say "I need it to work on a random Thursday, not wait for fsck after ever reboot" https://github.com/IceWhaleTech/CasaOS/issues/1104 https://github.com/IceWhaleTech/CasaOS/issues/1104
- toilet 23d ago
  I have the same issue on Windows 11. It's been bugging me to press a button or "check my drive" on every startup for at least half a year, no matter how often I let it run the check...

clear0250 23d ago

Solution: Don't AI generate images! I think this is a good way to discourage people from making slop.

cupantae 23d ago

As a linux fan I just love all these changes Microsoft have been introducing

account42 22d ago
As another Linux fan, I don't. What Microsoft does to their users changes the overton window of what's acceptable in tech. Before you know it there will be a politician demanding that all software systems that don't implement such tracking will be outlawed and there will be no one left to speak up to you because they are all already used to the tracking so why should you get a pass.
- cucumber3732842 22d ago
  Exactly. North Star linux was doing this 20yr ago. And now Microsoft thinks it's ok to do it.

kibwen 23d ago

Until proven otherwise via open-source audits and reproducible binaries, you should assume that all commercial photo editing software is embedding watermarks in any way they can get away with. This includes the professional software that you pay quite expensive licenses for. You should also assume that even if they're not today, they will eventually be coerced into doing so, in the same way that printers embed tracking dots.

account42 22d ago
You should however not accept this state of affairs even if you exclusively use open source software because the next step is that it become illegal to have photo editing software that doesn't include the tracking information needed to protect the children, fight terrorists or whatever the boogeyman of the day is.
- inigyou 22d ago
  It's already illegal to not watermark an AI image.
  - picofarad 22d ago
    Oh I didn't know I was going to break the law today just using automatic1111 stable diffusion. I'll call my lawyer.
    - inigyou 22d ago
      You do that.

pmkary 23d ago

With every new thing Microsoft goes trying so hard to come out as the good person, but they just cannot help themselves but to inject their evil. It had to be changed with Nadla coming, but their enshitification is just keeps getting worse and worse. What on Earth is this.

megous 23d ago

Solved by not using closed source SW, period.

andai 23d ago

My honest reaction: https://files.catbox.moe/4ylzsq.png https://files.catbox.moe/4ylzsq.png

deleted 23d ago

[deleted]

alightsoul 23d ago

Yet another reason to switch to Linux.

imnotr0b0t 23d ago

Interesting find. Overall it makes sense from a deepfake-fighting perspective and EU requirements. But what's concerning is that users aren't really told about this, as far as I can tell. Would be cool if someone checked if it can be bypassed, like swapping the DLL or intercepting the API call. But yeah, it's another step toward every digital trace becoming personally identifiable...

two_handfuls 23d ago

This is not ok.

claiir 23d ago

Kind of sad how all these technical blogs just reek of Claude text these days. Hard read when it’s obviously padded by an LLM…

deleted 23d ago

[deleted]

clickety_clack 23d ago

I admit it’s a while since I’ve used windows, but it’s such a shock to hear that MS Paint isn’t just a point and click pixel coloring app anymore. It seems like they could have left it as a pure “paint” app and added the fancy stuff to some new image editor or something. I guess they’ve optimized their workforce to just keep making changes so they get promoted rather than just creating really good software.

darig 23d ago
[dead]
SideQuark 23d ago
If you read the article instead of the headline…….. it’s adding a fairly standard mark to AI generated images to let’s others know, in the same manner a giant swath of the GebAI industry has agreed to.
- trickypr 23d ago
  I think their point is that paint shouldn’t have any GenAI features (or any new features other than compatibility)
  - SideQuark 23d ago
    [flagged]
    - qu4z-2 23d ago
      I don't so much mind about Paint, but modern Notepad is completely unusable. We had "Notepad but with Rich Text formatting" -- it was called WordPad and no-one used it so they eventually deleted it.
      - brudgers 23d ago
        People used Wordpad and thus other people had trouble opening RTF files.

rnd0 23d ago

Ya know, this would probably be pointless but if I were a programmer (I'm not -and refuse to be a vibe coder) I'd probably just grab appropriate libraries and make my own replacements for this shit. GLTK+ (?) is an obvious choice to use for recreating mspaint, and to replace notepad -I was told making a simple editor was an excercise they have you do when you learn programming to begin with? I already replaced the 'solitaire' games suite with pysol running on WSL2 and it's a vast improvement! tldr -if MS is going to screw us, why don't we mitigate it by using replacements?

inigyou 22d ago
I would've thought the obvious API to recreate mspaint was Win32
cyteeditor 22d ago
[flagged]

SideQuark 23d ago

[flagged]

angry_octet 23d ago

It is quite likely that Snipping Tool is also doing this. Every camera also leaves device specific signature because of its inherent silicon sensor defects. If you want to stay anonymous, don't share images you can't verify at the byte level. Apply filtering to decrease the low bit noise that could hide cryptographic signatures. Don't trust complex container formats. See e.g. PPM format: https://www.cs.swarthmore.edu/~soni/cs35/f13/Labs/extras/01/ppm_info.html https://www.cs.swarthmore.edu/~soni/cs35/f13/Labs/extras/01/... These days entire scenes can be tweaked by AI to add unimportant but identifying marks, at a level far above signal processing tricks, like moving objects in the scene. Verify from multiple sources.

threecheese 23d ago
If Anthropic can manipulate text to add a watermark, what’s preventing providers from doing the same to generated images? Modifying the container format can’t protect you from a signature in the image’s visual representation, unless you apply noise to that (and know it’s enough noise/the right kind of noise to counteract whatever unknown technique they’ve applied).
- angry_octet 22d ago
  Anthropic's watermarking technique is possible, and worryingly could effect low frequency choices (eg as I said, with object placement or style). However, this has to be a generation time decision, you can't really do that with a small edit. In fact small edits tend to be detectable spectrally.

ranger_danger 23d ago

Misleading title IMO... here they are using "locally generated output" to specifically mean only AI-generated images, not your "500hrs in MS Paint" hand-made masterpiece.

LeBit 23d ago

Do we really need more examples of why local LLMs are an absolute necessity?

tgsovlerkhgsel 23d ago

> In other words, “generated locally” does not mean that the complete operation is local. That sounds like a privacy violation that the DPAs should look into. Edit: Apparently it's disclosed somewhere. Still, that defeats the entire point of local generation...

mococa 23d ago

Could microslop be more evil?

__MatrixMan__ 23d ago
They're pretty bad, but yes I think so.

userbinator 23d ago

after a local Stable Diffusion image generation The request is JSON and contains at least these fields:..."prompt": "..." Local SD (especially the earlier versions) is already uncensored, so they're effectively crippling it with additional spyware that phones home to tell Microsoft what you're doing and asking whether they approve of it. IMHO the invisible watermark isn't the worst part, but rather the fact that MS is logging every interaction you have with the model, which doesn't ever need to leave your machine.

TonyStr 23d ago
What happens if you try to use this feature without being connected to the internet? Will it refuse to run the local AI model?

seriocomic 23d ago

"inivisibly"? for 9 hours this was invisible...

aucisson_masque 23d ago

> On Copilot+ PCs, image generation is local but prompt moderation remains remote Anyone disturbed about that ? It's your computer, running locally, but Microsoft can tell you 'no'. It's like you want to open a folder and it asks permission to Microsoft.

zdragnar 23d ago
I would be surprised that anyone is surprised by this. They've been making local accounts harder and harder now to the point of being impossible. Anyone not deep in tech will accept the "think of the children" defense without much worry, and anyone who is deep in tech already knows that if you really want an OS that doesn't spy on you, you need to go to a *nix of some flavor.
fchicken 23d ago
I'm disturbed by everything. Prompt moderation, GUID insertion, watermark insertion; track anything and everything, probably done in the name of "protect the children".
inigyou 22d ago
That's nothing new. Ever tried to develop a driver? Or replace a system file? Or install an app on iOS not from the store? That war was lost two decades ago with the iPhone

emsign 23d ago

> The two apps send the prompt to a remote server for moderation Why? What needs tobe moderated locally?

fchicken 23d ago

Fucking spyware. Soon it'll literally be "you need a license to use this technology" if we're not there in some form or another already.

inigyou 22d ago
It literally already is? What happens if you pirate windows but don't do it properly?

fchicken 23d ago

It'll literally be like printers "cannot print this black/white document, low on cyan". "Cannot run local AI model, no network connection". The more you think about it, the more it really is the same: https://en.wikipedia.org/wiki/Printer_tracking_dots?useskin=vector https://en.wikipedia.org/wiki/Printer_tracking_dots?useskin=...

account42 22d ago
Except once printed its at least hard to remove the dots. Image based watermarks are trivial to destroy if you know they are there.
- fchicken 22d ago
  tbh so is circumventing those dots. It doesn't make it any better
  - JacobKfromIRC 22d ago
    How do you circumvent printer dots? I don't see how that could be trivial.

globular-toast 23d ago

Use free software. Proprietary software is used by its owners to control you. This is nothing new, just another example to add to the countless ones we already have.

Schlagbohrer 23d ago

"Apparently, the recent Claude Code text-watermark announcement also played a role in prompting me to think about this possibility." Extremely odd way to write. Are the writer's own thoughts invisible to him or her?

jojobas 23d ago
You might think you have control over what causes you to think this or that, but that's only an illusion.

4d4m 23d ago

Gross. Unnecessary. Anti consumer.

p0w3n3d 23d ago

It's for our safety, so when Kathy in the primary school steals Beatrice's picture in paint, miss Wallingford will tell who was the original author

burnoutdv 23d ago

Okay, there are watermarks on AI stuff, interesting, not good but everyone else already talked about. My question..how does it work? Is it robust? I remember that young me hid data in pixels of png with simple stegonagraphy and it was a fun little project..but brittle. How exactly does the fingerprinting survive jpeg compression? Is it repeate over and over the images or is it just one area? If that one is pure black by chance the jpeg algorhitmen would erase it all no?

nmg 23d ago
I'm pretty sure the robustness of watermarking has been a solved problem for at least 30 years, I remember visiting the mit media lab in the mid 90s and they were explaining how they could watermark digital audio by imperceptibly adjusting the acoustics as if the walls of the room the audio has been recorded in were changing distance relative to the microphone according to a wave function
- account42 22d ago
  There is no robust-without-qualifiers watermarking. There is only robustness against common operations but as soon as someone is actually trying to remove the watermark they can at the very least use exactly the same technique to embed random noise instead to overwrite your watermark.

shevy-java 22d ago

Great detective work. With regards to Microsoft being ... uhm ... "transparent": > The same page says that generated images: > “will contain C2PA manifest helping users identify that it is an AI generated image.” > [...] That is a meaningful disclosure of remote filtering and C2PA metadata. > C2PA manifest contains a GUID identifying the invisible pixel watermark > Calling the feature “Content Credentials” is accurate, but it does not > make this prompt-associated identifier obvious to a Windows user. I don't think this is accurate, because without that detective work, most people would have no idea that Microsoft tags and tracks the images here. This reminds me of printers printing identifiers to ID individuals. What this to me means is that I can no longer use any such Microsoft services, because there is no trust for me here. Microsoft sniffs on me, if I were to use these software products. AI is a big spy-op too. Microsoft could easily admit "we watermark all your images, whether you like it or not", but corporate speak forbids this and they don't really admit to it. They do not use the word watermark officially, but their .dll names reveal it. That means they resort to deceit and propaganda. It really is time to strengthen the whole open source ecosystem. I no longer want my taxpayer's money to go into traitorous US companies that abuse EU citizens here. (Note: the same would apply to EU companies, but the USA dominates the software sector, unfortunately. This also has to change permanently.)

blablabla123 22d ago

Actually Microsoft is doing this since the 90s with Word documents. Did they ever pause this practice?

fithisux 22d ago

Don't use them if it does not fit your requirements. The last ten years I am more that happy with Lazpaint or Libreoffice Draw. The last year I have added Imglass to the mix.

grugdev42 22d ago

Use this instead!!! https://jspaint.app/ https://jspaint.app/

lesspassiveobse 22d ago

RedStar OS (North Korea linux) already did this 10 years ago. Nice to see the west catching up.

mg794613 22d ago

My goodness, this has nothing to do with AI problems. I don't understand that people still buy an OS from a company that actively hates it's customers. The amount of things they pull should not even be succesful on a OS you get paid FOR to use.

alex_duf 22d ago
Not that I love Microsoft, but they would get a lot of heat if they let anybody generate harmful content as well. They can't win on that topic. Now I would not want to appear to defend the mess they've created out of windows, that's not the point.
- deleted 22d ago
  [deleted]
- someguyornotidk 22d ago
  They have only themselves to blame for this. They've spent decades developing technology to spy on and micro-regulate what their captive customers can do with their property. Now that they have this technology, it's only logical that they be held responsible for misuse. The only (and inevitable) solution at this point is for big tech to get micro-regulated like the banking industry. The same mindless greed that drove them to take control away from their customers will be responsible for the same control to be taken away from them.
  - xmcqdpt2 22d ago
    Be careful what you wish for. I'm sure Microsoft and Google would love the kind of regulation we apply to big banks. It has become a moat that makes it impossible for other (snaller/foreign) financial institutions to compete because they don't have massive specialized regulatory departments. The more complex the rules become, the more difficult it will be for alternative providers to exist, unless they have explicit carve outs. So far, with age verification and user id laws, there doesn't seem to be much appetite from politicians to create exceptions for open source and smaller projects. By comparison, in the US the regional banks have special exemptions for many of the really onerous regs, which is why they are still a bunch of them.

hn9rsvy2gx 22d ago

[dead]

luciana1u 22d ago

[flagged]

ozereray1 22d ago

Injecting hidden GUIDs into local files without explicit user consent is a massive privacy overreach. It makes you wonder what other local tools are silently tagging user generated content.

stingraycharles 22d ago
Haven’t printers done the same thing for decades?
- jamesnorden 22d ago
  Oh that makes it totally ok then...
  - stingraycharles 22d ago
    Not saying that, but at least that there must have been ample legal precedent that this is probably allowed.
    - ozereray1 22d ago
      [flagged]
  - kmacdough 22d ago
    No it's not ok, and most people are horrified when they learn. It's just a reality check that we've lived in a surveillance state for quite a while and it's time we take a stand. And a reminder that the government has done a good job of suppressing these realities from public awareness.
    - hulitu 18d ago
      > and it's time we take a stand I'm afraid it is too late.
- MisterTea 22d ago

deleted 22d ago

[deleted]

deleted 22d ago

[deleted]

hojinkoh 22d ago

Microsoft is in a pretty good position to do something that can be valuable to certain institutions. Imaging every pdf file, every image, every office documents, and every video has a hidden record of the associated Microsoft accounts of all computers it has ever passed through. This should sell well, and realistically nobody can stop them. Why haven't Microsoft done this much earlier?

Kvarnek 22d ago

The visible watermark toggle giving users a false sense of control while the invisible GUID persists regardless is the worst part. People who turn off the watermark think they opted out.

codedokode 22d ago

Commercial companies with closed-source software, cloud software will always betray you.

deleted 22d ago

[deleted]

xushengdev 22d ago

Xusheng here! I have not gone through all comments, but wish to clarify a few things: 1. The watermark only applied to AI-generated contents through the in-app AI (copilot/cocreator, etc). If you draw something by hand it is not watermarked 2. Privacy implications: I believe your MS account is linked to the prompt and the GUID. And the GUID is embedded into the image as both an insivible watermark and a file-level C2PA metadata. I did not write about this very deeply in my blogpost, but when I do an image generation, it deducts my AI credits (yes, MS gives you like 60 free AI credits), so MS surely knows where the prompt is coming from. Though I am not sure about their storage and retention, e.g., do they actually store the data, and if they do, for how long, etc

assistant1 22d ago

[dead]

not_a_bot_4sho 22d ago

Scanning the comments, I see some curiosity and outrage but little recognition that this is legally required in places like California and Colorado and Texas and probably some more places. And federally, the C2PA strongly encourages digital providence albeit without legal consequences... yet. All AI content coming from companies that service the US market are watermarking things.

cyteeditor 22d ago

[flagged]

m3047 22d ago

People worried about other people tracking them while using local stable diffusion models built on fraudulently obtained training content, to produce images which cannot be owned. Thug on thug violence.

krick 22d ago

Obviously it's bad and we can all say "fuck Microsoft" once more, but "we" probably don't use Windows anyway, right? I have no idea, really, but if you willingly use closed-source spyware that is notorious (for AT LEAST 15 years) for all kinds of invasive telemetry it forces upon you, you probably wouldn't find this new piece of information concerning anyway. And ironically, I think that this one is kinda fair. I mean, you specifically asked your software to generate whatever pseudo-random bytes it wishes to loosely based on some text prompt. It did that. Now, apparently, these pseudo-random bytes turn out to be personally identifiable. So what? I suppose they didn't claim their PRNG to be cryptography-grade. They could even make it seem like an accident, should they be bothered to. Make it way less obvious. Now if it would insert watermarks on save (like printers do), that would be really outrageous. But when you trust software to produce "whatever", you probably shouldn't be really mad about it doing anything more than you asked to.