Apple details how the iPhone 18 Pro can cryptographically prove a photo hasn't been faked by AI

[Skye Jacobs]

First look: Apple added a new camera feature to the iPhone 18 Pro and iPhone 18 Pro Max designed to help establish whether a photograph is authentic. Called Apple Reference Image, the opt-in mode creates a cryptographically protected version of a photo when it is captured. Apple says the system is designed to show that an image was captured by an iPhone camera sensor and has not been altered or generated by AI.

When Reference Image is enabled, the camera sensor restarts in a dedicated operating mode. It then signs the pixel data immediately after capture, before the image goes through the usual software-based processing steps.

Apple said that's a key difference from other image-authentication methods. Many systems attach provenance data after an image has passed through the software pipeline. Apple argues that this can leave room for tampering before the photo is signed.

The company describes the resulting file as a "secure digital negative." It is stored on the phone and contains pixel data, sensor metadata, and cryptographic timestamps. The original reference file is not intended to be edited in the same way as a standard photo.

The iPhone's Secure Enclave Processor also signs some capture information from outside the sensor, such as exposure settings, digital zoom, and lens data. Apple said this information is kept separate from the sensor data and cannot change the underlying pixels.

A reference image still needs to be rendered into a usable photograph. When a user decides to develop one, the device sends the original negative to Apple's Private Cloud Compute system.

Private Cloud Compute checks the sensor and Secure Enclave signatures, verifies that the device components are associated with the same iPhone, and confirms that the software handling the image has been approved. It then processes the photo and produces a JPEG.

Apple said the final image receives a composite signature that combines RSA-3072 with ML-DSA-87, a post-quantum cryptographic algorithm. The company said this approach is intended to keep images verifiable over long periods as cryptographic threats evolve.

The system also records a range for the capture time rather than relying on a single timestamp generated by the phone's operating system. The device periodically receives cryptographic time records that provide a lower bound before the photo is taken and an upper bound after capture.

Apple said it can add the upper timestamp later if the iPhone is offline when the image is taken.

Apple said the system is designed to protect the photographer's identity. Reference Images do not include a public credential that identifies who took the picture, and Apple said the technology is intended to prevent others from publicly linking multiple photos to the same camera sensor.

The company also built in a mechanism for revoking images if it detects fraud. Private Cloud Compute assigns each Reference Image a confidence score based on whether it has the expected characteristics of Apple's camera hardware.

If Apple finds a security issue, it can invalidate a single image or revoke images associated with an entire sensor. Apple said the revocation process does not require the company to view the photo's content.

Apple Reference Image is optional and does not replace the standard camera system on the iPhone 18 Pro lineup. The models also include a 48-megapixel Fusion main camera with a variable aperture, a 48-megapixel ultra wide camera, and a 48-megapixeltelephoto camera that supports 12-megapixel 8x optical zoom.

Apple Reference Image is available only through the main camera sensor on the iPhone 18 Pro models.

For Apple, the feature aims to provide a technical record of an image's origin at a time when edited and AI-generated photographs are becoming increasingly difficult to distinguish from authentic camera images.

Permalink to story:

Apple details how the iPhone 18 Pro can cryptographically prove a photo hasn't been faked by AI

 

[mbrowne5061]

I quite like this feature. The only thing I am questioning is why this is necessary:

"A reference image still needs to be rendered into a usable photograph. When a user decides to develop one, the device sends the original negative to Apple's Private Cloud Compute system. Private Cloud Compute checks the sensor and Secure Enclave signatures, verifies that the device components are associated with the same iPhone, and confirms that the software handling the image has been approved. It then processes the photo and produces a JPEG."

I can understand why you may need a central service to validate a signature, at least until there can be decentralize FOSS standard, but why go so far as to not even render a JPEG until signature has been validated? I feel like you could strike a balance where an image processing pipeline had an invisible watermark that only appears when the signature becomes invalid. Then from the time of capture, through DAM/photoshop, to JPEG, if the signature at any point is "broken", a permanent watermark appears across the whole image. Hopefully something like this is what Apple is working towards (probable), and hopefully it'll be an open standard that anyone from Adobe, to GIMP, to Microsoft, to Google, to Irfanview can implement (doubtful, given Apple's track record with developing new standards).

 

[Dreadcthulhu]

The downside of this is that it provides a system to tie specific images to specific devices, which has all sorts of negative privacy implications.

 

[Megalomaniac]

The downside of this is that it provides a system to tie specific images to specific devices, which has all sorts of negative privacy implications.

One hand giveth - the other taketh.

 

[Plutoisaplanet]

The downside of this is that it provides a system to tie specific images to specific devices, which has all sorts of negative privacy implications.

See here:

Apple said the system is designed to protect the photographer's identity. Reference Images do not include a public credential that identifies who took the picture, and Apple said the technology is intended to prevent others from publicly linking multiple photos to the same camera sensor.

It sounds like what you say is technically true, but only Apple is able to do it. That means law enforcement would need to execute a warrant in order to make that determination.

 

[Taroo]

It sounds like what you say is technically true, but only Apple is able to do it. That means law enforcement would need to execute a warrant in order to make that determination.

Unless they play the Flock's way, haha.
But I think Apple won't do that.

 

[Plutoisaplanet]

Unless they play the Flock's way, haha.
But I think Apple won't do that.

Not a relevant comparison. This is user data, not law enforcement’s data. It would be more akin to approaching Google and asking “who sent this email?” Like Apple, they also won’t answer law enforcement without a warrant.

Regardless, Flock doesn’t share user data with law enforcement agencies by default. The customer has to choose who to share it with. For example if a shopping center gets Flock cameras, they generally don’t share with law enforcement by default. Law enforcement would have to approach the business to make a request. If they refuse, law enforcement would need a warrant.

Flock is controversial simply because it’s far easier for law enforcement to use compared to other CCTV’s. Unlike CCTV’s though, Flock focuses exclusively on license plates and vehicle attributes (public roadways).

 

[Taroo]

Not a relevant comparison. [...]

Yes it is.

Flock has responsibilities in several issues reported here on TechSpot, such as access to the database without needing a warrant, and reinstalling cameras after some cities decided to remove them.

The data and possibilities Apple will have via their new system could possibly allow to identify a phone/person behind some photos, revoke their certificate, or revalidate one that has been revoked.
In the wrong hands, in the field of journalism, it could be dangerous.
So I write it again : if they play the Flock's way, that'll be bad.
Feel free to disagree.

But privacy concerns around technology in the hands of the big tech are always relevant.
Especially when something should be impossible (remember Snowden ?).