A reverse-engineering writeup published at xusheng.dev takes apart what Windows Paint and Photos do to an image on the way out. According to that analysis, both applications embed an invisible watermark carrying a globally unique identifier tied to the machine, and they do it to output generated locally, not only to the cloud round trips. The bytes never left the building. Something got written into them anyway.
A GUID here is a long unique string bound to the installation, which in practice means bound to the box under the desk. Anyone holding the decoder can pull it back out of a file that has been emailed, posted to a client portal, or dropped into a shared drive, and can match two otherwise unrelated files as products of the same machine. The capability is narrow, durable, and invisible to every tool in a normal review process.
Procurement has spent three years sorting AI features by where the computation happens, and local has been the answer that ends the conversation. That sort was always about egress: does my data go to a server, does it land in a training set, whose subpoena reaches it. The watermark runs the other direction: nothing leaves, and something arrives inside the artifact, then travels onward with every copy.
In 2005 the Electronic Frontier Foundation published decoding work on color laser printers, showing a grid of near-invisible yellow dots on every page that encoded the printer's serial number and a timestamp. I was reading the trade coverage as that broke, and the durable lesson sat in the disclosure path rather than in the mechanism. Xerox and its peers had told law enforcement. They had not told the people buying the printers, who learned it from researchers with a blue LED and a microscope. Twenty-one years later the marking has moved from documents somebody chose to print to images a default application produces by the thousand, and the disclosure path is unchanged: a stranger with a disassembler.
Microsoft helped found the Coalition for Content Provenance and Authenticity in 2021 alongside Adobe, Arm, the BBC, Intel and Truepic. C2PA's whole proposition is legible provenance: a signed manifest that travels with a file, states what made the image and what was done to it, and can be read by anyone who receives it. The same company ships a provenance marker in Paint that can be read by one party. Both systems answer where an image came from. They differ on who is allowed to ask.
For most operators this is a nuisance with no consequence. For a few it is a live exposure. Agencies producing work for competing clients on shared hardware, anyone circulating blinded or anonymized material, contractors generating assets on a client-issued laptop, teams doing competitive research they would rather not have attributed: in all of those, a file that identifies its machine of origin is a fact somebody else can use. None of those teams knew they were making that disclosure, which is the part that matters for how the risk gets classified.
Image hygiene in most production pipelines means stripping the EXIF block, which handles metadata and nothing beneath it. A payload living in pixel values survives that untouched. Whether it survives a resize, a recompression, a screenshot, or a pass through a different encoder is unknown outside Redmond, because the robustness envelope of an undocumented watermark is undocumented too. A control nobody can test is a control nobody has.
Two decisions sit on the table this week for anyone who owns an image pipeline, and neither of them is technical. The first is whether artifacts get re-encoded through non-vendor tooling before publication, at a small quality cost, on the standing assumption that vendor applications mark their output. The second is a line item in the vendor questionnaire that almost nobody currently includes: what does this feature write into my output that the documentation does not describe. That question generalizes well past images. Local transcription, local summarization, and on-device assistants all emit artifacts, and every one of them ships inside a binary written by someone with their own reasons.
This lands in a week when the rest of the local inference conversation is about how much capability fits on a 24GB card, with a 22GB coding quant claiming frontier-medium parity on the strength of one contributor's harness. The premise underneath that enthusiasm is that a model on hardware you own is a system under your control. The premise holds for open weights pulled from a public repository. It holds considerably less well for local features shipped inside a commercial application, where the vendor's interests arrive with the binary and the absence of network traffic is a statement about bandwidth rather than about intent.
Microsoft holds a seat on the C2PA steering committee. Whoever occupies it has a small and unambiguous job this quarter: put the identifier in the Paint documentation, or take it out of the encoder. A provenance standard that coexists with an undisclosed machine identifier from the same vendor is a marketing asset with a specification attached. Until one of those two things happens, every image leaving a Windows desktop carries a signature, and the signature was not written for the person who made it.