Has anyone else noticed that Word 365 appears to be passing all inserted images to an outside server (something Bing-based, I as/u/me) to generate AI-based alt text?




This is not documented anywhere I can locate, and in the vast, confusing Options menus, there are just vague references to cloud services that can be disabled as a group.


I avoid everything after Office 2016 on many grounds, but (as now, when I noticed this behavior) contract clients often have it installed as the enterprise solution.


I find it disturbing that potentially sensitive, proprietary or even 'secret' images are being shot out of the local system and network, with no notice or user control; nothing I've found and no one I've asked seems aware of this behavior, and I'd bet 99% of users think their image is remaining local to their system. This is not the same as (theoretically) private cloud storage or user exchange; a third-party server is looking specifically at the content of a user file.


I'm only dealing with some industrial equipment of modest "secrecy"; a colleague at a major NGO was so disturbed he hung up on me to call their cybersecurity bureau.


Thoughts/comments?

What is your evidence of this?

Word writing "suggested" (and highly accurate, if bland) alt text captions far beyond the scope of a standalone app.


I don't know of any standalone desktop app or utility that can do image content analysis, not of this scope, and it's blink-of-an-eye fast as well. If the image is not being passed to an analysis system, MS has cracked the computing power problem for the next century.

To replicate it, in Word 365, insert a photo which is stored on your own hard drive and then right click it and choose View Alt Text. In my case the Alt text was already filled out and it said It does also have a mention of 'Powered by Office Services' down the bottom of that task pane.

If I look at the image properties before I inserted it, I can see title/subject metadata that says "Kids on a giant log at Echuca on the Murray River" so the Alt text 'could' have been inferred from that property locally but it clearly isn't a direct copy of that metadata. There could be other metadata that I haven't seen in Windows file properties dialog which could have provided a direct input. If images are 'on your hard drive' but also backed up onto Apple's, Microsoft's or Google's cloud data stores, do they get metadata added which can be harvested later or used in image searches?

So I would question what other metadata is stored with your images and what was the original source of that information. If you take a photo with an Android or Apple phone, does that get processed/saved online instantly to insert metadata that can later be harvested by the 'Office Services' engine? This would not surprise me at all.

What if you took photos in Airplane mode and transferred the image to the computer without connecting back to your phone's data? Would that stop metadata being added to the image and stop "Office Services" from being able to magic up some Alt text?

This is definitely worth investigating further for corporate environments with a cyber focus.

__________________
Andrew Lockton
Chrysalis Design, Melbourne Australia

I apologize for my scepticism. Yes, this is worrying.
I guess, for now, I may cut my Internet when posting images that could be sensitive and explore to see if that blocks this.

In my work as a criminal defense lawyer I seldom insert images from clients, but it is not never. It had not occurred to me that this security breach was present.

I cross-posted this in the Word Answers Forum as a discussion.
Redirecting

I can verify that if one takes the step of severing internet connection prior to insertion of the image, no Alt text is generated. If the connection is then restored, it is not added unless specifically requested. I wonder what else is going to Microsoft.

I've learned something new, and disturbing, today. I expect that Microsoft is trying to be helpful here but I would prefer to be asked before having anything go off my computer. Is this all "connected services?"

Perhaps I should not have been surprised.
There is an option available to turn this off, buried deep...
File > Account > Privacy Settings

Several of the images came directly from an older Canon 40D that has no connectivity at all (my field camera); the legacy images were mostly shot with employee smart phones, but I've never had my Android phones pop such analyzed information into the meta-data.


I think we can take it as proven that Word is reaching out for this information, and it's not something it can do blindly; it has to offer up the image for analysis.


Even in a world where privacy and security are punchlines, this disturbs me. A lot.

There is an option available to turn this off, buried deep...
File > Account > Privacy Settings
(I gave a screenshot with this earlier. The screenshot shows a box to turn them on because it was taken after I had turned them off.)

Take a look at Connected Services that Analyze Your Content.