The mark is a row number

Xusheng Li took Microsoft Paint apart and found a 1.67 MB DLL doing more than it should need to. Paint has a visible watermark — a small Copilot logo in the corner — and that is what the DLL was ostensibly for. Underneath it was a second watermark, invisible, written into the pixels themselves. The encoder rejects any payload that is not exactly sixteen bytes. Sixteen bytes is a GUID. Paint does not generate that GUID. Microsoft's server does.

The sequence is the part worth slowing down on. Before the on-device model runs, Paint posts your prompt to an Azure moderation endpoint. The response comes back with a revised prompt, a `promptGenerationId`, and a `watermarkId`. The NPU then generates the image locally, and Paint stamps the server's watermarkId into the output. The same value reappears in the signed C2PA manifest as a soft binding — the field the standard defines precisely so content can be matched to its provenance record after the file-level metadata has been stripped off.

Arguments about AI watermarking almost always run on robustness: does the mark survive a crop, a re-encode, a screenshot. That is an engineering question and it has engineering answers. The question nobody asks is cardinality — how many distinct things the mark can say.

A mark that says "AI-generated" is a bit. A mark that says 83424621-03cb-40e3-9808-a9fae837156d is a row number.

A bit is self-contained. Anyone holding the image can read it and learn the one fact it encodes, and the fact is about the image. A row number is worthless on its own and valuable in proportion to the table behind it. Here the table is Microsoft's: the moderation service saw the prompt, the account it came from — Cocreator requires a signed-in Microsoft account and a live connection even though inference runs on your machine — the timestamp, and the identifier it then handed back to be pressed into the picture. Paint also sends the prior `promptGenerationId` as `lastPromptGenerationId` on the next request, which links successive generations into a session by design.

None of that is evidence Microsoft is looking anything up. It is a description of what was built, and what was built is a lookup key, held by the party that issued it, embedded in a way engineered to outlive the metadata a user knows how to remove.

The defaults say which mark Microsoft cares about. The visible logo has a setting — never, ask every time, always. The invisible one has none, and the setting for the visible one does not govern it. And when the encoder fails, Paint does not hand back an unmarked image; it converts the whole generation into an error. The save menu lost BMP, because BMP cannot carry a C2PA manifest. Microsoft would rather give you nothing than give you a clean file.

The provenance case for all of this is genuine. Synthetic images are about to be indistinguishable from photographs and something has to survive contact with the open internet to tell them apart. But that case is satisfied by a flag. It does not require the mark to be unique, it does not require the issuer to be online at generation time, and it does not require the issuer to keep the other half of the pair. Every one of those was a choice, and the version shipping in the default image editor on a billion machines made all three the same way.

If the watermark said "made by a machine," I would call it provenance and be glad of it. It says which machine, on whose account, at what moment — to anyone holding the table. That is a different product with the same name, and it shipped in Paint.