Sadly I don't have a 5DmkIII but I've managed to figure it out with a bit of detective work.
The answer is that it's stored in an XMP header as the
I started by hunting down a Canon 5DmkIII group on Flickr and found this thread. Click on one of those photos then go to the metadata page and you'll see one of the values listed is Rating (in this case with a value of 3). I'm certain that value hasn't come from post-processing because the metadata also shows it was processed in Lightroom 4. I use a 5DmkII and Lightroom 4, and rate all my photos before uploading to Flickr, and yet my photos don't have a Rating value on their metadata page.
Unfortunately all the photos I checked in that group have download disabled, so I headed over to dpreview.com's gallery of 5DmkIII test shots where I found this test image:
If you click that to go through to dpreview.com you'll see one of the tags on the photo is
pre-production. Seeing that, and knowing dpreview.com's usual approach, it's pretty certain this image is straight out of camera.
So, I got the URL of the original image and posted it into Jeffrey's Exif Viewer. And there it is, right in the XMP section:
<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?>
<rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/">
Also note there's no Software value in the metadata anywhere: a further indication that this is straight from camera.
Finally, just to be absolutely sure, I took a straight-from-camera JPEG from my 5DmkII and ran that past Jeffrey's Exif Viewer. Sure enough, no rating value.