// HACKER NEWS — CYBERSECURITY
MS Paint and Photos inivisibly watermark even locally generated output with GUID
This research started with my curiosity about Paint. I recently had some success looking into less-explored Windows features like UCPD, WHESCVC, and I have long known that Microsoft
added a bunch of AI features into the Paint app.
I do not know if anyone actually uses Paint + AI to generate images, but I wanted to see how exactly the image generation works.
Before I started, I expected that it simply called a remote API to do the image generation. However, after I set up Binary Ninja MCP with Codex and started the analysis, I soon realized that Microsoft actually shipped local models in Windows as part of Copilot.
The Paint App is sitting in the following path (yes, they are all Windows Apps now):
And there are four apparent model files with the .onnxe extension:
The format of seg.onnxe was previously known, i.e., when it is XORed with the string Microsoft_2023, it becomes a normal ONNX file. However, the format of the other three .onnxe files initially looked different.
It turned out that Microsoft had not changed the algorithm, only the key. segapi.dll contains a small key registry:
After decryption, onnx.checker.check_model() works on all of them:
While walking through these files, I found a Watermarker.dll:
This is not super surprising to me, because while I interacted with the Paint app, I already discovered that it has a setting to embed a visible watermark to the image that it produces:
The visible watermark is just a small Copilot logo at the bottom right of the image, which is totally normal.