What exactly does “on-device” mean if your prompt still takes a trip to Microsoft’s servers before your image is allowed to exist?
That’s the question sitting underneath a small piece of reverse engineering making the rounds this week. Microsoft Paint and Microsoft Photos embed invisible GUID watermarks into AI-manipulated images. Not just cloud-generated ones. Locally generated output too. And according to the teardown, the GUID isn’t cooked up on your machine. Your prompt gets sent to a remote moderation server, which sends back an identifier, which then gets stitched invisibly into the file you thought your laptop made all by itself.
You can’t turn it off.
Two separate things got quietly merged
Provenance marking and content moderation are different problems with different politics, and this setup collapses them into one pipeline.
Provenance is defensible. Marking AI-touched images so downstream systems can identify them is a reasonable response to a real problem, and Microsoft has been building toward it in public for a while now: invisible watermarks for DALL-E images on Azure OpenAI, watermarking work in Microsoft 365 pitched as transparency for AI-generated or AI-altered content. Nobody sane is arguing that images should be untraceable by default.
Moderation is a different animal. If a remote server has to see your prompt and issue an identifier before the local model’s output gets finalized, then the local model is not actually the authority on what you’re allowed to make. Your GPU does the math, but permission comes from somewhere else. That’s a checkpoint dressed up as a feature.
And the identifier itself is where things get interesting. A GUID issued by a server is, structurally, a row in a table. Whether Microsoft keeps that table, what’s in it, how long it lives, and who can query it are questions the marketing language around transparency does not answer. I’m not claiming there’s a log tying your prompt to your file. I’m saying the architecture makes that log trivially easy to keep, and nothing in the public framing tells you whether it exists.
Why the “local” claim matters more than the watermark
Copilot+ PCs were sold on a specific promise. Neural processing hardware in your machine, inference happening on your desk, less dependence on somebody’s data center. That pitch is the entire reason a chunk of buyers paid the premium.
If a network round trip is required for basic image generation in Paint, the promise has an asterisk on it that nobody put in the ad copy. Practical consequences that follow from that:
- Offline behavior becomes uncertain. If the moderation server is the source of the GUID, what happens on a plane, in a dead zone, or behind a corporate firewall that blocks the endpoint?
- Anything you generate carries a marker you did not choose and cannot remove through the app.
- Enterprise and regulated environments now have an outbound data question about a bundled OS accessory, not a plugin someone installed.
- “Local model” stops being a meaningful privacy claim and becomes a statement about where the FLOPs happen.
The part that bugs me most
Not the watermark. The silence. Invisible marking that users can’t disable, driven by a server call users weren’t told about, shipped inside two of the most boring, most trusted, most preinstalled apps on Windows. Paint is the software you open to crop a screenshot. It has a level of assumed harmlessness that no AI product earns on its own.
When a company wants credit for transparency, the transparency should extend to the mechanism. “We mark AI-altered images so they can be identified” is a fine sentence. “We send your prompt to our servers to get the marker” is the sentence that should have been next to it, in the same font.
How much noise is this actually making
Almost none, which is its own data point. The Hacker News submission that surfaced this was sitting at three points and a single comment. A design decision that touches every Windows user who ever tries the AI button in Paint, and it barely registered.
That gap between impact and attention is where defaults get set. Nobody votes on this stuff. It arrives in an update, it works, the marker is invisible by design, and six months later it’s just how images work.
What I’d want before calling this acceptable
A clear statement of whether prompts and GUIDs are retained, and for how long. Documented offline behavior. An honest label on Copilot+ marketing about which operations require network access. And a real answer on whether the moderation check is a filter, a log, or both.
Until those exist, treat “runs locally” as a performance claim rather than a privacy one. Your machine is doing the work. It isn’t the one making the call.
🕒 Published: