The AI aspect of this is a red herring. The real problem is that they're secretly adding in a unique identifier into every image you create. If somebody does not like your meme, they can just send a copyright subpoena to Microsoft to instantly get your full name, address, email, phone number, and any other data associated with your Microsoft account. Just like age verification, this is another weapon in the war against internet anonymity.
No - there is a huge difference between "this AI created this image" and "this user did it" - the first we need more of, and the second is a big privacy concern. The article does not say anything about identifying a user.
A guid isn’t a user id, if it is in this case, it’s an abuse of how guid is used, at least colloquially. I haven’t read enough to understand if it is user / machine id, I.e. only globally unique in the sense it’s a globally unique entity identifier.
This a variant of the provenance scheme: C2PA its implemented by all major Camera maker, and Google it seems, Apple support it with 3rd party apps on iPhone, but they have something called "Apple Reference Image" brewing.
Personally I think there is a good argument for being able to distinguish AI generated image and video...
> I think there is a good argument for being able to distinguish AI generated image and video...
Neat but that's not what's being built here. What's being built is "we can trace back this content to who made it" which is bad. Doesn't matter if today that it's limited to AI generated content. Won't be tomorrow. Your devices should not act against your best interests. No cop in my pocket please.
It does kind of say: The GUID is coming from the moderation endpoint, which is hit when you generate a local or cloud AI image based on your prompt. If there is no prompt, there is no endpoint, and likely no GUID.
Obviously Paint could have been watermarking prior to AI though, but this specific AI watermarking appears to be only that.
Do not tell Microsoft where you sleep. IANAL but they are not a government or financial institution and do not have a right to that information.
Make sure you register mailing addresses with your credit card institutions in addition to your residential addresses, and make your mailing address your billing address so that you aren't forced to tell a thousand businesses like Microsoft where you sleep.
Windows 11 effectively forces users to register with a Microsoft account. Once that's established, all it takes is for an unaware user to fill out an e-commerce form and save an address for auto-fill.
Any of a number of virtual mailbox services which can receive mail for you, e.g. anytimemailbox.com but there are several. You can either pick up in person, or they offer services like mail forwarding, opening and scanning, etc.
Besides privacy against leaking your sleeping-address to businesses, they're also convenient for avoiding package theft if that's a problem in your area, and receiving/forwarding mail if you travel a lot for extended periods of time.
I'd recommend against PO boxes because (1) they get rejected by some services (2) UPS and FedEx won't deliver to them.
Because these businesses have to register as CMRAs and you have to sign a notarized form for them to legally receive mail for you, some services will still detect it and not let you use the address, but my experience for the most part has been that most US financial institutions let you enter a "residential/legal address" (no CMRAs allowed) and a "mailing address" (CMRAs allowed) separately, and the mailing address usually becomes your billing address.
> This is broadly impractical for the average citizen.
No it's not. Sign up for a virtual mailbox for $15-$25/month.
> A scalable solution would be to make this sort of thing illegal.
I'm posting this in the genuine interest of people being able to maintain anonymity from data leaks, privacy leaks, and in general not needing to tell businesses more personal information than is necessary to render services. This is in a country that has no protection of personal safety whatsoever, and any business data leak could mean life or death to average citizens who are being threatened by criminals, stalkers, and more.
It seems every time I post something of this flavor the same handful of you come out of the woods and want to make privacy illegal, and I'm not sure who you are trying to support.
Ahhh okay if that's what they meant, then yes, I 100% agree and apologize in advance.
I fully agree that businesses should not be asking for addresses. Non-financial businesses don't need to KYC in the first place, and financial institutions can KYC without needing to know where you sleep.
I got triggered because people seem to always want to come out of the woods and say "addresses should be public record" or things of that sort and I vehemently disagree in the interest of privacy, in a country where a stalker can just look you up, terrorize you, and the police will do nothing about it.
AI-generated text warning (I submitted - but did not author - the piece), but it seems MS Paint and MS Photos add both a visible (can be turned off) and invisible (cannot be disabled and happens silently in the background with no user notice) watermarks to photos that have been AI-manipulated, even when using a local model to perform the action. It's not clear if this applies to even things like using AI-enhanced background delete/remove, but the invisible watermark is embedded in both the image pixels and the image metadata, both containing a GUID that can be linked to the exact prompt that was used and the originating device/user (on Microsoft's end).
Obvious next step is to explore if you can replace watermarker.dll with a (signed) no-op shim or MITM the API call to at least use your own (nil?) GUID that isn't linked to your device/account.
In case it's not obvious, my bigger concern isn't "this image can be identified to have been generated with/by AI" so much as it is "digital yellow printer dots have been forced upon us, except they can identify and retrieve the exact user/device/time/place/document/etc", completely destroying any and all illusions of privacy left.
I'd like to know more about the GUID part and how easy is it so deanonymize yeah.
But if it's only on ai generation and not on all images it seems easy enough to work around that part? Still better than printers doing it no matter what you're printing.
I get the privacy concerns, and we are right to expect Microsoft to say that this is what their tool may be doing. However, I fear that one day we will look back and wonder why we didn't do more to sign and preserve human authenticity. Having a stamp saying "AI manipulated" should be a part of digital lineage tooling.
Well if that's any reassurance, you can generate a meme picture using AI, then paste it into Paint to add some funny text. That way you can get the best of both worlds.
I had this trigger the other day incorrectly and went and installed Paint.net. I pasted in a screenshot I took and just wanted to resize it. I got a banner saying it was made with AI and would be updated to reflect that.
I guess it shouldn't be surprising if an application called "paint.net" can determined if AI was used when connected to the internet. (I have used Paint.net more than a decade ago).
ah, right, i vaguely recall that now. But why/how would it know AI was used, outside of a local LLM, weird it would say that AI was used (unless it's referring to the software itself).
MS Paint wanted to add the "this is AI" tag on a picture they just resized. OP didn't like that, so they went and downloaded Paint.Net to avoid having to deal with (MS) Paint shenanigans.
A few months back, MS incorrectly tried to stamp a Copilot "watermark" (just an auto-added note) to any and all Azure DevOps commits, regardless of whether an LLM was actually involved. They removed it after a lot of github issues were submitted to the source of the issue which was a VS Code Copilot extension.
MS has been very sloppy in their implementations. I would recommend against using Paint or any other LLM enabled app they use as a result. Things may be getting incorrectly stamped.
This reminds me that in the USSR they had typewriters that added an identifier somehow that could be traced back to that particular typewriter (and who it was sold to)
the GUID is the giveaway that it's not about protecting artists, it's about being able to prove provenance later. nobody embeds a unique id in a local file for the user's benefit.
Interesting. I really didn't think watermarks would end up going anywhere, but maybe with enough adoption we can have easy ai generated content flagging after all?
I mean, workarounds wouldn't be hard, just annoying, anyway. Like an extra step or two (take a screenshot, change the image format, wipe the metadata; or print, take photo with camera, clean up in something like gimp, same other steps).
This muddle of an article makes it totally unclear to me if this GUID is attached by the AI generation call or every image I edit in MS Paint. I'm going to assume the former unless they release a clarification.
Edit: Actually trivial to test, just save an image of all black and see if it suddenly has other values on save.
Thanks Microsoft, for adding my signature so I won't have to claim authorship when it ends up in a museum in 200 years, and the NSA archives are declassified for art historians filing a FOIA in 2226, who find out, "yep, it was from his PC."
If C2PA and similar signature systems ever become a meaningful authenticity signal, they will create huge incentives for someone (potentially a state actor) to hack at least one camera in order to sign images of arbitrary provenance with its private keys. This will in turn inevitably lead to the same game of cat-and-mouse we have seen play out with video DRM schemes, where keys are regularly extracted from exploitable devices and used to decrypt as much content as possible before the device gets blacklisted entirely (harming all legitimate owners in the process).
I've done this btw. I went for the Pixel Camera app since they were the ones bragging the hardest about their "security". Writeup + PoC should be dropping some time tomorrow. Despite 90+ days from initial report, it remains unpatched.
I don't think that that's a good idea, because it implies trust when there actually isn't any.
Being signed with something just means that whoever has that key could've done that. That might be the owner of a specific camera, but it might also be the camera manufacturer, anyone else in the supply chain, or anyone who dumped the key.
Imagine fake evidence signed with the same key as your camera uses being used in court against you. And the court believes it because it has this signature attached and those computers are very secure and all.
Exactly that will happen. Not widespread, of course, but it will.
The hard part is deciding how much post processing is acceptable with these images. Feels like a lot of phone cameras optimize images and curious how much of it is considered “AI”
I was thinking any photo created with a camera should be signed. Why we don't have that in 2026 is beyond me.
But what you're talking about is the generative aspect of these photos likely expanding over time. We're seeing that today with the ultra zoom features on some cameras regenerating objects (and especially text). Without the user doing anything the phone will generatively fill in detail, most worryingly text and people. Then there's the Samsung moon issue - taking a photo of a pixelated printout of the moon caused Samsung phones to generate a new image of the moon.
When I was in photography class in college, I created backplates in photoshop for still life portraits of small trinkets I was photographing. The photos were taken on black and white film and developed in the campus dark room. Led to some impressive photos. In our class's critiques, I explained how it was done. A lot of peers went from impressed to meh'd. The point: the black and white film laundered the new-age manipulation, and a digitally signed photo from a modern camera remains vulnerable to the same premise.
No. You'd only ever be able to show that key material belonging to $specific_camera was used to sign/mark the image.
Was the camera manufacturer breached? Did somebody on the factory floor steal some keys during the provisioning step? Or did somebody build their own photo-sensor simulator and plug _that_ in to the camera's motherboard to feed it a "real" image? Before going _that_ far, just point the unmodified camera at a sufficiently high resolution display...
Presumably the OP is proposing something like a TPM attached to the image sensor that signs the sensor output or something like that. You can’t sign it because you can’t get the key out. The key could be per-camera and be a published list.
I suppose a dedicated fraudster could still stage an appropriate scene. An appropriately lit matte image might even suffice.
Keys could be stored in something like TPM on Camera, and could sign the image. The key could then be verified from the camera itself to prove the authenticity of the image.
If we as a society deemed it necessary, the camera manufacturer could also provide a list of keys for devices they have manufactured. And an image/key could be provided, and the manufacturer could verify the authenticity that way.
The TPM signing could be tied into the sensor hardware itself, making it difficult, but not impossible, to sign arbitrary images with the TPM.
"I think it would be nice if all pens added a unique isotopic tracer signature to their ink. You could tell exactly who wrote everything."
"I think it would be nice if all typewriters had their unique fine-detail type artifacts registered with the government. You could tell exactly who authored a given document."
I think it would be nice if you took these ideas back to Stalinist Russia where they belong.
I'm honestly surprised they don't upload the entire image to apply the watermark server-side, to the point that I'd like someone else to repeat this investigation and confirm it's not happening.
Shipping the watermark generator on user's machine would make it very easy for someone motivated to find how it works and write a "watermark remover".
The AI aspect of this is a red herring. The real problem is that they're secretly adding in a unique identifier into every image you create. If somebody does not like your meme, they can just send a copyright subpoena to Microsoft to instantly get your full name, address, email, phone number, and any other data associated with your Microsoft account. Just like age verification, this is another weapon in the war against internet anonymity.
No - there is a huge difference between "this AI created this image" and "this user did it" - the first we need more of, and the second is a big privacy concern. The article does not say anything about identifying a user.
a GUID isn't an indicator, it's a fingerprint.
so unless you want to draw a distinction between 'user' and 'machine' , yeah it is for identifying users.
to believe otherwise, especially with Microsoft involved, would be incredibly naive to their history.
Article literally says it adds a guid, not a binary field indicating that the image is ai generated.
A guid isn’t a user id, if it is in this case, it’s an abuse of how guid is used, at least colloquially. I haven’t read enough to understand if it is user / machine id, I.e. only globally unique in the sense it’s a globally unique entity identifier.
This a variant of the provenance scheme: C2PA its implemented by all major Camera maker, and Google it seems, Apple support it with 3rd party apps on iPhone, but they have something called "Apple Reference Image" brewing.
Personally I think there is a good argument for being able to distinguish AI generated image and video...
> I think there is a good argument for being able to distinguish AI generated image and video...
Neat but that's not what's being built here. What's being built is "we can trace back this content to who made it" which is bad. Doesn't matter if today that it's limited to AI generated content. Won't be tomorrow. Your devices should not act against your best interests. No cop in my pocket please.
Well yeah they know my John Doe info
Does it trigger on non AI images? The post doesn't say so at least.
It does kind of say: The GUID is coming from the moderation endpoint, which is hit when you generate a local or cloud AI image based on your prompt. If there is no prompt, there is no endpoint, and likely no GUID.
Obviously Paint could have been watermarking prior to AI though, but this specific AI watermarking appears to be only that.
This really needs to be hit with the GDPR hammer. Microsoft have not obtained consent for this.
> This really needs to be hit with the GDPR hammer. Microsoft have not obtained consent for this.
At best they'd just disable it for EU... assuming they didn't successfully argue "it was in the ToS ..."
> address
Do not tell Microsoft where you sleep. IANAL but they are not a government or financial institution and do not have a right to that information.
Make sure you register mailing addresses with your credit card institutions in addition to your residential addresses, and make your mailing address your billing address so that you aren't forced to tell a thousand businesses like Microsoft where you sleep.
Windows 11 effectively forces users to register with a Microsoft account. Once that's established, all it takes is for an unaware user to fill out an e-commerce form and save an address for auto-fill.
> Make sure you register mailing addresses with your credit card institutions
Sorry for a dumb question but what would one use as a mailing address? Rent a PO box, or use a mail forwarding service, something like that?
Any of a number of virtual mailbox services which can receive mail for you, e.g. anytimemailbox.com but there are several. You can either pick up in person, or they offer services like mail forwarding, opening and scanning, etc.
Besides privacy against leaking your sleeping-address to businesses, they're also convenient for avoiding package theft if that's a problem in your area, and receiving/forwarding mail if you travel a lot for extended periods of time.
I'd recommend against PO boxes because (1) they get rejected by some services (2) UPS and FedEx won't deliver to them.
Because these businesses have to register as CMRAs and you have to sign a notarized form for them to legally receive mail for you, some services will still detect it and not let you use the address, but my experience for the most part has been that most US financial institutions let you enter a "residential/legal address" (no CMRAs allowed) and a "mailing address" (CMRAs allowed) separately, and the mailing address usually becomes your billing address.
This is broadly impractical for the average citizen. A scalable solution would be to make this sort of thing illegal.
> This is broadly impractical for the average citizen.
No it's not. Sign up for a virtual mailbox for $15-$25/month.
> A scalable solution would be to make this sort of thing illegal.
I'm posting this in the genuine interest of people being able to maintain anonymity from data leaks, privacy leaks, and in general not needing to tell businesses more personal information than is necessary to render services. This is in a country that has no protection of personal safety whatsoever, and any business data leak could mean life or death to average citizens who are being threatened by criminals, stalkers, and more.
It seems every time I post something of this flavor the same handful of you come out of the woods and want to make privacy illegal, and I'm not sure who you are trying to support.
I think they meant make what Microsoft is doing illegal?
or make it illegal to ask for address, etc. definitely a little more effective than mailboxes
Ahhh okay if that's what they meant, then yes, I 100% agree and apologize in advance.
I fully agree that businesses should not be asking for addresses. Non-financial businesses don't need to KYC in the first place, and financial institutions can KYC without needing to know where you sleep.
I got triggered because people seem to always want to come out of the woods and say "addresses should be public record" or things of that sort and I vehemently disagree in the interest of privacy, in a country where a stalker can just look you up, terrorize you, and the police will do nothing about it.
AI-generated text warning (I submitted - but did not author - the piece), but it seems MS Paint and MS Photos add both a visible (can be turned off) and invisible (cannot be disabled and happens silently in the background with no user notice) watermarks to photos that have been AI-manipulated, even when using a local model to perform the action. It's not clear if this applies to even things like using AI-enhanced background delete/remove, but the invisible watermark is embedded in both the image pixels and the image metadata, both containing a GUID that can be linked to the exact prompt that was used and the originating device/user (on Microsoft's end).
Obvious next step is to explore if you can replace watermarker.dll with a (signed) no-op shim or MITM the API call to at least use your own (nil?) GUID that isn't linked to your device/account.
In case it's not obvious, my bigger concern isn't "this image can be identified to have been generated with/by AI" so much as it is "digital yellow printer dots have been forced upon us, except they can identify and retrieve the exact user/device/time/place/document/etc", completely destroying any and all illusions of privacy left.
I'd like to know more about the GUID part and how easy is it so deanonymize yeah.
But if it's only on ai generation and not on all images it seems easy enough to work around that part? Still better than printers doing it no matter what you're printing.
> AI-generated text warning
This seems incorrect to me. Are you basing that on the use of bullet points?
I don’t understand the warning.
They're saying that the blogpost is at least partially AI-generated.
I have some better options. Stop using computers, or if you use a computer, use Linux.
Everything is spying on us now. Literally everything. I recently downgraded my MacBook M1 to Sonoma to avoid all this AI privacy invading BS.
I get the privacy concerns, and we are right to expect Microsoft to say that this is what their tool may be doing. However, I fear that one day we will look back and wonder why we didn't do more to sign and preserve human authenticity. Having a stamp saying "AI manipulated" should be a part of digital lineage tooling.
You can watermark AI without leaking who did it. That's just using AI to add yet another layer of user tracking.
Well if that's any reassurance, you can generate a meme picture using AI, then paste it into Paint to add some funny text. That way you can get the best of both worlds.
I had this trigger the other day incorrectly and went and installed Paint.net. I pasted in a screenshot I took and just wanted to resize it. I got a banner saying it was made with AI and would be updated to reflect that.
I guess it shouldn't be surprising if an application called "paint.net" can determined if AI was used when connected to the internet. (I have used Paint.net more than a decade ago).
Paint.net is named after the dot net framework and is not referring to a URL or the internet as I understand it.
Paint.net actually just recently got ownership of paint.net, it only took 22 years: https://www.xda-developers.com/after-22-years-paintnet-downl...
ah, right, i vaguely recall that now. But why/how would it know AI was used, outside of a local LLM, weird it would say that AI was used (unless it's referring to the software itself).
MS Paint wanted to add the "this is AI" tag on a picture they just resized. OP didn't like that, so they went and downloaded Paint.Net to avoid having to deal with (MS) Paint shenanigans.
They aren’t saying that, paint.net is an open source application, Paint is the descendant of MSPaint.
Keep an eye on this.
A few months back, MS incorrectly tried to stamp a Copilot "watermark" (just an auto-added note) to any and all Azure DevOps commits, regardless of whether an LLM was actually involved. They removed it after a lot of github issues were submitted to the source of the issue which was a VS Code Copilot extension.
MS has been very sloppy in their implementations. I would recommend against using Paint or any other LLM enabled app they use as a result. Things may be getting incorrectly stamped.
Googling you can see the source code for watermarking here https://github.com/microsoft/InvisMark
This reminds me that in the USSR they had typewriters that added an identifier somehow that could be traced back to that particular typewriter (and who it was sold to)
Not only USSR.
the GUID is the giveaway that it's not about protecting artists, it's about being able to prove provenance later. nobody embeds a unique id in a local file for the user's benefit.
How resistant is it to dithering? Can you just add +-1 randomly to each pixel r,g and b values and throw it off?
Interesting. I really didn't think watermarks would end up going anywhere, but maybe with enough adoption we can have easy ai generated content flagging after all?
Not every generative AI model will watermark. Especially not adversarial and disinformation models.
So as usual, exactly the things you want it to work on it won’t.
I mean, workarounds wouldn't be hard, just annoying, anyway. Like an extra step or two (take a screenshot, change the image format, wipe the metadata; or print, take photo with camera, clean up in something like gimp, same other steps).
awesome breakdown of the process you took. reverse-engineering is crazy now with AI. IP is dead
this also reminds me of what got me hooked on CS in the first place: a simple java steganography app in cmsc150
This muddle of an article makes it totally unclear to me if this GUID is attached by the AI generation call or every image I edit in MS Paint. I'm going to assume the former unless they release a clarification.
Edit: Actually trivial to test, just save an image of all black and see if it suddenly has other values on save.
Thanks Microsoft, for adding my signature so I won't have to claim authorship when it ends up in a museum in 200 years, and the NSA archives are declassified for art historians filing a FOIA in 2226, who find out, "yep, it was from his PC."
I think it would be nice if all cameras digitally signed pictures. You could prove the photo was real.
If C2PA and similar signature systems ever become a meaningful authenticity signal, they will create huge incentives for someone (potentially a state actor) to hack at least one camera in order to sign images of arbitrary provenance with its private keys. This will in turn inevitably lead to the same game of cat-and-mouse we have seen play out with video DRM schemes, where keys are regularly extracted from exploitable devices and used to decrypt as much content as possible before the device gets blacklisted entirely (harming all legitimate owners in the process).
I've done this btw. I went for the Pixel Camera app since they were the ones bragging the hardest about their "security". Writeup + PoC should be dropping some time tomorrow. Despite 90+ days from initial report, it remains unpatched.
Some proof: https://verify.contentauthenticity.org/?source=https://retr0...
I could also paste a privkey + cert chain in here but el goog's lawyers might not like that.
I don't think that that's a good idea, because it implies trust when there actually isn't any.
Being signed with something just means that whoever has that key could've done that. That might be the owner of a specific camera, but it might also be the camera manufacturer, anyone else in the supply chain, or anyone who dumped the key.
Imagine fake evidence signed with the same key as your camera uses being used in court against you. And the court believes it because it has this signature attached and those computers are very secure and all.
Exactly that will happen. Not widespread, of course, but it will.
Imagine today where a photo is submitted as evidence and the court believes it even without signatures.
Precisely. Now take that, but glue a "the machine has cryptographically proven that this is legit" to that.
Yes, it's a disaster waiting to happen.
The hard part is deciding how much post processing is acceptable with these images. Feels like a lot of phone cameras optimize images and curious how much of it is considered “AI”
I was thinking any photo created with a camera should be signed. Why we don't have that in 2026 is beyond me.
But what you're talking about is the generative aspect of these photos likely expanding over time. We're seeing that today with the ultra zoom features on some cameras regenerating objects (and especially text). Without the user doing anything the phone will generatively fill in detail, most worryingly text and people. Then there's the Samsung moon issue - taking a photo of a pixelated printout of the moon caused Samsung phones to generate a new image of the moon.
Signing doesn't really achieve anything when an attacker can manipulate the device into signing arbitrary pixels.
Nobody knows how to make a camera that can distinguish honest vs deceptive photons.
When I was in photography class in college, I created backplates in photoshop for still life portraits of small trinkets I was photographing. The photos were taken on black and white film and developed in the campus dark room. Led to some impressive photos. In our class's critiques, I explained how it was done. A lot of peers went from impressed to meh'd. The point: the black and white film laundered the new-age manipulation, and a digitally signed photo from a modern camera remains vulnerable to the same premise.
> You could prove the photo was real.
No. You'd only ever be able to show that key material belonging to $specific_camera was used to sign/mark the image.
Was the camera manufacturer breached? Did somebody on the factory floor steal some keys during the provisioning step? Or did somebody build their own photo-sensor simulator and plug _that_ in to the camera's motherboard to feed it a "real" image? Before going _that_ far, just point the unmodified camera at a sufficiently high resolution display...
do you believe this should be mandated by regulation, or voluntarily offered by manufacturers as a value-add feature? ("all" implies the former.)
What would prevent someone from applying the same algorithm on a computer to sign arbitrary images?
Presumably the OP is proposing something like a TPM attached to the image sensor that signs the sensor output or something like that. You can’t sign it because you can’t get the key out. The key could be per-camera and be a published list.
I suppose a dedicated fraudster could still stage an appropriate scene. An appropriately lit matte image might even suffice.
Please note: A well-funded organization, like a government, can derive the keys from the TPM hardware using an electron microscope.
Keys could be stored in something like TPM on Camera, and could sign the image. The key could then be verified from the camera itself to prove the authenticity of the image.
If we as a society deemed it necessary, the camera manufacturer could also provide a list of keys for devices they have manufactured. And an image/key could be provided, and the manufacturer could verify the authenticity that way.
The TPM signing could be tied into the sensor hardware itself, making it difficult, but not impossible, to sign arbitrary images with the TPM.
If I steal your camera while you're on vacation, do I then gain proof of ownership of your photos?
If I need to reset TPM, how do I reclaim photos I took previously?
Finally a legitimate use for NFTs. /s
Asymetric keys
Or, you know, using the totally-real-picture camera to take a photo of an AI-generated scene?
"I think it would be nice if all pens added a unique isotopic tracer signature to their ink. You could tell exactly who wrote everything."
"I think it would be nice if all typewriters had their unique fine-detail type artifacts registered with the government. You could tell exactly who authored a given document."
I think it would be nice if you took these ideas back to Stalinist Russia where they belong.
I'm honestly surprised they don't upload the entire image to apply the watermark server-side, to the point that I'd like someone else to repeat this investigation and confirm it's not happening.
Shipping the watermark generator on user's machine would make it very easy for someone motivated to find how it works and write a "watermark remover".
It is already fairly trivial to write a universal watermark remover, an LLM can do it for you.
Without access to the code, I imagine it'd be extremely difficult even with unlimited API calls to the watermarker.