Microsoft's AI Watermark Carries an Identifier Tied to Your Prompt

Generate an image in Paint on a Copilot+ PC and the model runs on your own machine. The inference is local. Before it starts, though, your prompt goes to a Microsoft server, and the server sends back a 16-byte identifier that gets written into the pixels of the picture you are about to make.^[1]

That is the finding of a reverse-engineering writeup published on 20 August by Xusheng Li, who says it is the first research to document the invisible-watermarking behaviour of Paint and Photos. The Register covered it five days later under the headline that AI watermarks are "linked to user IDs."^[4]

The privacy framing is fair. It is also not the most useful thing here.

What does Microsoft Paint actually embed in an AI image?

Two marks, in two layers. A signed C2PA manifest sits in the file as metadata, and a separate invisible watermark sits in the pixels themselves. Both carry the same identifier, so removing the metadata does not remove the mark.

The pixel layer holds an 18-byte message built from a prefix, the identifier, and a checksum, placed at least three times per bit.^[1]

The two layers are formally joined. The signed manifest names the pixel watermark as a C2PA soft binding, under the algorithm identifier com.microsoft.invismark.1, and records the same value the pixels carry. A soft binding exists precisely so content can be matched back to its provenance record after the file-level metadata is gone.^[1]

Three details are worth holding onto, because they are what the rest of this rests on.

• The identifier comes from the moderation server, so an ostensibly local feature depends on a remote call.
• The request carries the previous generation's id as lastPromptGenerationId, which makes successive prompts linkable into a session.
• The watermark is not best-effort. If writing it fails, Paint turns the whole generation into an error rather than hand back an unmarked image.^[1]

That last one is a product decision, and it tells you how load-bearing Microsoft considers this to be.

What does the EU AI Act actually require?

Less than that. The obligation, which has applied since 2 August 2026, is a single sentence about the output, and it is worth reading in full rather than in summary.

The European Commission's own guidance restates it the same way, so this is not one host's paraphrase.^[2][3] The law goes on to ask that the technical solutions be effective, interoperable and reliable as far as is technically feasible. It does not ask for anything else.

Read the two side by side and the gap is easy to see.

Nothing in Article 50 calls for a unique identifier. Nothing calls for that identifier to be issued by a server, or tied to the prompt that produced the image, or linkable to the prompt before it.

What is the difference between detectability and identifiability?

Detectability is a property of an artifact. It answers "was this made by a machine," and anyone holding the file can check it without knowing anything about who made it. Identifiability is a property of a person. It answers "which account, which prompt, which session," and it requires a record somewhere that maps the mark back to them.

Article 50 asks for the first. What shipped delivers the second.

That is the whole story, and it is worth being precise about what it is and is not. There is no evidence that Microsoft has used these identifiers to identify anyone, and this post is not claiming otherwise. The claim is about capability and disclosure.

A mechanism that can link a picture to an account and a session exists, it was built to satisfy a rule that did not ask for it, and the public documentation describes the C2PA metadata without describing the pixel-level identifier or the server that issues it.

There is also a visible-watermark setting in these apps, and it does not control this one.^[1] Turning it off changes what you can see in the picture, not what is written into it.

Li puts the disclosure point more precisely than a headline can.

Calling the feature "Content Credentials" is accurate, but it does not make this prompt-associated identifier obvious to a Windows user.

Does this affect images you draw yourself?

No, and this is where a lot of the discussion went wrong. The Hacker News thread that carried this to a wide audience, at 693 points and 286 comments as of this morning, is titled around locally generated output, and many readers took that to mean everything made on the machine.

Only AI-generated output is marked. If you draw in Paint, or edit a photo you took, nothing is embedded. The scope is Cocreator and Image Creator in Paint, and Image Creator and Restyle in Photos.^[1]

Worth noting that the law drew the same line first. Article 50(2) exempts systems performing "an assistive function for standard editing" that do not substantially alter the input.^[2] On scope, the implementation and the regulation agree. It is on the contents of the mark that they part company.

What should builders take from this?

That a compliance feature is still an architecture decision, and the defaults you choose will outlive the rule that prompted them.

Microsoft was handed a real obligation with a genuine deadline and shipped a technically serious answer to it. Every provider covered by Article 50 is making the same set of choices right now, mostly without announcement, mostly on a schedule. The useful question is not whether a given vendor is behaving well. It is what any given mark proves, and about whom.

We have argued before that you should not assume a boundary exists because a vendor implies one, and that applies to provenance as much as to sandboxes. "Content Credentials" sounds like a statement about content. In this implementation it is also a statement about a session.

There is a harder version of this for us specifically. In August we argued that disclosure beats banning AI-generated code, and we would still argue it, because the evidence on transparency is good and the evidence on prohibition is not.

But advocating a mechanism means owning what it becomes in practice. This is one of its implementations, and pretending it is somebody else's problem would be the cheap move.

So the useful response is not outrage at one vendor. It is that provenance standards currently specify what a mark must contain and say almost nothing about what it may not. Article 50 got the requirement right and the constraint missing, and that omission is where a detection rule turned into an identification system without anyone having to argue for it.