[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-mspaint-invisible-watermark-guid":3,"news-related-b51af942-496b-4b58-95fb-37980d12a743":35},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":21,"news_slug":28,"published_at":29,"created_at":30,"modified_at":31,"is_published":32,"publish_type":33,"image_url":14,"view_count":34},"b51af942-496b-4b58-95fb-37980d12a743","逆向工程发现:微软画图本地生成的 AI 图像,像素里埋着服务器下发的水印 GUID","安全研究员逆向 Windows 画图与照片应用发现:Copilot+ PC 上本地跑 Stable Diffusion 生成的图像,提示词仍会送到微软服务器审核,服务器返回的唯一 GUID 被作为隐形水印写进像素,并与 C2PA 清单中的软绑定值一致。","用 Windows 画图在 Copilot+ PC 上生成一张图,扩散模型的推理确实跑在你的本地 NPU 上——但安全研究员 Xusheng Li 的逆向分析显示,这张图并不是纯粹的\"本地产物\":像素深处埋着一个由微软服务器在提示词审核时下发的唯一 GUID。完整分析见原文(https:\u002F\u002Fxusheng.dev\u002Fposts\u002Freversing\u002Fmspaint_invisible_watermark\u002Fmain\u002F)。\n\n## 本地生成 ≠ 本地完成\n\n画图和照片应用都内置了本地 AI 模型,四个 .onnxe 文件加起来约 370MB,其中承担生成主干的 mager.onnxe 就占 302MB。这些模型文件被 XOR 混淆过一层,密钥之一是字符串 Microsoft_2023,解开后即是标准 ONNX 模型。\n\n关键在于:即便走本地生成路径,用户输入的提示词仍会先发往微软的审核服务(端点路径为 \u002Fv1\u002Fpaint-cocreator\u002Fmoderate-prompt)。服务器返回改写后的提示词、promptGenerationId、watermarkId 等字段。图片在本机生成完毕后,watermarkId 会被写进像素——\"本地\"的只有模型推理,提示词审核与身份标识签发都在云端完成。\n\n## 水印是怎么写进像素的\n\n水印由 Watermarker.dll 中的 WmkWriteWatermark 函数完成。它强制要求 payload 恰好 16 字节——正是一个 GUID 的长度。实际嵌入的是 18 字节消息:魔数 0x4c、16 字节 GUID、再加一字节校验和,展开成 144 个比特,每个比特至少要成功嵌入三次;图像宽高均不得低于 192 像素,否则直接返回容量不足。\n\n编码器做的是内容自适应的块域量化修改。作者用一张 512×512 合成图测试:262,144 个像素中有 193,376 个被改动——肉眼不可见,但约四分之三的像素都变了。失败语义更能说明设计意图:画图里水印写入失败会让整次生成直接报错,而不是返回一张无水印图片;照片应用则宽松些,失败仅记日志、照常出图。\n\n## 两层溯源,同一个 GUID\n\n保存文件时,画图还会调用在线签名服务附加 C2PA 内容凭证。作者解析了真实生成图片的 PNG 块:18,979 字节的 caBX 清单里,c2pa.soft-binding 字段的算法标注为 com.microsoft.invismark.1,其 value 正是审核服务返回的那个 watermarkId。像素层隐形水印与文件层签名清单,是同一套溯源系统的两层。\n\nAI 生成结果的保存格式被限制为 PNG、JPEG、GIF 与 .paint(BMP 无法内嵌 C2PA 清单);连续生成时,上一次的 promptGenerationId 还会随下一次请求回传,把多轮操作串成链。\n\n## 所以呢\n\n微软的支持页面披露了内容过滤与 C2PA 凭证的存在,但没有说明清单里藏着与提示词审核绑定的 GUID,更没提它写进了像素。这与欧盟 AI Act 第 50 条(2026 年 8 月 2 日生效)并不冲突——法规要求 AI 内容带可检测、机读的标记,却没有要求逐次生成、可关联审核会话的身份码。对用户,启示很直接:在系统级 AI 工具里,\"本地生成\"这个词需要重新审视;对行业,水印正在从\"内容是否由 AI 生成\"滑向\"是谁、在哪次会话生成的\"——前者是透明度,后者是可追溯性,两者混着谈,知情权就容易被稀释。","https:\u002F\u002Fxusheng.dev\u002Fposts\u002Freversing\u002Fmspaint_invisible_watermark\u002Fmain\u002F","1c1e285a-0cf7-40c3-bc37-e8a8562ccaaa",[11,15,18],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"40269b40-7942-4650-9672-ed2e6524d37a","ai-technology",{"id":19,"name":20,"slug":20,"description":14,"color":14},"c883fd20-1d66-4fb7-9fc7-320fa7f87023","text-to-image",[22],{"id":23,"lang":24,"title":25,"summary":26,"content":27},"8ff5fcc0-f6b8-454f-81f6-e43982987633","en","Reverse Engineering Finds a Server-Issued Watermark GUID Buried in Paint's Locally Generated AI Images","Reverse engineering of Windows Paint and Photos shows that images generated locally by Stable Diffusion on Copilot+ PCs still have their prompts sent to a Microsoft moderation server, whose unique GUID is embedded as an invisible pixel watermark matching the C2PA soft-binding value.","Generate an image with Windows Paint on a Copilot+ PC, and the diffusion model's inference really does run on your local NPU — but reverse engineering by security researcher Xusheng Li shows the result is not a purely \"local\" artifact: buried deep in the pixels is a unique GUID issued by a Microsoft server at prompt-moderation time. Full analysis at the source (https:\u002F\u002Fxusheng.dev\u002Fposts\u002Freversing\u002Fmspaint_invisible_watermark\u002Fmain\u002F).\n\n## Local generation ≠ local completion\n\nPaint and the Photos app both ship local AI models: four .onnxe files totaling roughly 370MB, with the generation backbone mager.onnxe alone at 302MB. These model files are obfuscated with a layer of XOR — one of the keys is the string Microsoft_2023 — and decode into standard ONNX models.\n\nThe catch: even on the local generation path, the user's prompt is still sent first to Microsoft's moderation service (endpoint path \u002Fv1\u002Fpaint-cocreator\u002Fmoderate-prompt). The server returns a revised prompt, a promptGenerationId, a watermarkId, and other fields. After the image is generated on-device, the watermarkId is written into the pixels — only the model inference is \"local\"; prompt moderation and identifier issuance both happen in the cloud.\n\n## How the watermark gets into the pixels\n\nThe watermark is applied by the WmkWriteWatermark function in Watermarker.dll. It strictly requires the payload to be exactly 16 bytes — precisely the length of a GUID. What actually gets embedded is an 18-byte message: the magic byte 0x4c, the 16-byte GUID, plus a one-byte checksum, expanded into 144 bits, with every bit required to be placed at least three times; images must be at least 192 pixels in both dimensions or the encoder returns an insufficient-capacity error.\n\nThe encoder performs content-adaptive, block-domain quantized modifications. Testing with a synthetic 512×512 image, the author found 193,376 of 262,144 pixels changed — invisible to the eye, yet roughly three-quarters of the picture altered. The failure semantics reveal the design intent: in Paint, a watermarking failure turns the entire generation into an error rather than returning an unmarked image; the Photos app is laxer, logging the failure and still returning the image.\n\n## Two layers of provenance, one GUID\n\nWhen saving, Paint also calls an online signing service to attach C2PA Content Credentials. Parsing the PNG chunks of a real generated image, the author found an 18,979-byte caBX manifest in which the c2pa.soft-binding field names the algorithm com.microsoft.invismark.1, and its value is exactly the watermarkId returned by the moderation service. The pixel-level invisible watermark and the file-level signed manifest are two layers of the same provenance system.\n\nSave formats for AI-generated results are restricted to PNG, JPEG, GIF, and .paint (BMP cannot embed a C2PA manifest); across successive generations, the previous promptGenerationId is echoed back with the next request, chaining multiple turns together.\n\n## So what\n\nMicrosoft's support page discloses content filtering and C2PA credentials, but not that the manifest carries a GUID bound to prompt moderation, let alone that it is written into the pixels. This does not conflict with Article 50 of the EU AI Act (effective August 2, 2026) — the regulation requires a detectable, machine-readable mark on AI content, but not a per-generation identifier that can be linked back to a moderation session. For users the lesson is direct: in system-level AI tools, the phrase \"local generation\" deserves renewed scrutiny. For the industry, watermarks are sliding from \"was this content AI-generated\" toward \"who generated it, in which session\" — the former is transparency, the latter is traceability, and blurring the two quietly dilutes the right to know.","mspaint-invisible-watermark-guid","2026-08-26T13:00:00Z","2026-08-25T19:08:40.472495Z","2026-08-25T19:08:40.472504Z",true,"agent",32,{"items":36},[37,42,47,52,57,62],{"id":38,"title":39,"news_slug":40,"published_at":41},"774de6ac-98e1-4343-a67a-bfdc72d377bb","INFORMS 实证:AI 广告真实投放胜过设计师,18 个月后仍领先","informs-ai-ads-beat-human-designers-18-months","2026-08-22T14:00:00+00:00",{"id":43,"title":44,"news_slug":45,"published_at":46},"5a90a793-8ec1-4b3a-9691-edef5ffe8535","AI「思想病毒」实证:Anthropic 与 EPFL 让恶意想法在 Agent 间自我复制,免疫只需一段警告","mind-viruses-multi-agent-llm","2026-08-18T13:30:00+00:00",{"id":48,"title":49,"news_slug":50,"published_at":51},"99916419-0f68-4a6a-a4cf-8bbe353b4d75","康涅狄格法官开出美国首例 prompt injection 制裁令:法庭文件里的隐藏 LLM 暗口令","us-court-prompt-injection-sanctions","2026-08-18T03:00:00+00:00",{"id":53,"title":54,"news_slug":55,"published_at":56},"28c6c7e2-341d-4e2f-afd5-db3300874203","Rust 主仓库正式启用 LLM 贡献政策:五支团队通过,把「创造」和「分析」拆开管理","rust-lang-rust-llm-policy","2026-08-08T00:00:00+00:00",{"id":58,"title":59,"news_slug":60,"published_at":61},"b05de01b-89ca-499b-b130-e55162e651f5","SCOPE：让大模型学会选择性信任，而不是把上下文一概拒绝","scope-selective-trust-context-dpo","2026-08-06T17:59:58+00:00",{"id":63,"title":64,"news_slug":65,"published_at":66},"5f13a7dd-c990-4899-97dd-e805f1c44d1a","卫星图鉴伪成本从 6 步变成 1 句话:Google Earth 信任崩塌的真正代价","google-earth-nano-banana-trust-collapse","2026-08-02T04:00:00+00:00"]