Abstract:
According to a reverse analysis report released by security researcher Xusheng Li, Microsoft will add invisible blind watermarks to AI-generated pictures in Paint and Photo/Album applications. The identifier used by the blind watermark comes from Microsoft servers, and this mechanism is completely independent from the Microsoft Copilot watermark that users can turn on/off by themselves, so users cannot completely turn off the blind watermark.
Local generation of images on AI PC still requires a connection to Microsoft servers:
Research found that although the creation function of the Paint application can use AI PC A local Stable Diffusion model generates images, but the entire process is not completely offline. Before starting the generation, the Paint application will send the prompt words and selected style filled in by the user to the Microsoft server for review. The server will then return the modified prompt words, prompt word generation ID and watermark ID, and then the picture will be generated locally on the computer through the NPU unit.
After the image is generated, the Paint application will call the blind watermark control to write the 16-byte blind watermark related parameters returned by the server into the image pixels. The blind watermark itself is invisible to the naked eye, but Microsoft can identify whether the image was generated by the Paint application through certain detection mechanisms.
GUID identifiers are written directly to image pixels:
Reverse analysis shows that the blind watermark mechanism will 16 The byte GUID was expanded to 144-bit data and then embedded by making slight modifications to multiple blocks of the image. The researchers used a 512x512 pixel image for testing. After Microsoft added a blind watermark, more than 190,000 pixels changed slightly.
What is more noteworthy is that in the drawing application, if the blind watermark mechanism fails to be written, the AI image generation task will be directly regarded as a failure, instead of returning an image without a watermark. It can be seen that Microsoft regards this process as a necessary link in AI generation, and no image will be generated unless the blind watermark mark is completed.
Screenshots/cropping, etc. do not affect Microsoft recognition:
In addition to modifying the pixels, the Paint application will also add the industry-wide C2PA content certificate to the image. After checking the actual generated PNG file, the researchers found that the C2PA list not only clearly marked the image as generated by AI, but also recorded Microsoft InvisMark blind watermark information.
The watermark value saved there is exactly the same as the blind watermark ID previously returned by the server and actually written to the image pixels, which means that Microsoft is actually using two layers of proof of origin: C2PA metadata + invisible watermark hidden in the image pixels. Therefore, even if users delete C2PA metadata through certain tools, Microsoft can still identify the watermark through pixels. For example, simple screenshots, cropping, etc. cannot completely destroy the blind watermark.
In addition, the AI image generation and style conversion functions in Microsoft's Photos/Album application also use the blind watermark mechanism. Some differences are: if the Paint application fails to write the watermark, it will directly terminate the image generation, while the Album application will record the error and continue to return the generated results.
Comments