Will Apple’s ‘Reference Image’ Feature Help Defend Against AI Manipulation?

Last week, Apple announced the iPhone 18 Pro. Among the device’s new photography features is “Apple Reference Image,” and it represents the Silicon Valley behemoth’s entry into content provenance. "Now you can prove the authenticity of an image taken on iPhone. Secure, pixel-level signing of photo data happens at the time of capture, making it easy to verify exactly what the camera sensor saw," the company promises. A technical whitepaper expands on how the company will do this.

For those of us who have spent more than a decade arguing that cameras should include such features, this is welcome news. Starting fifteen years ago, in reaction to a profusion of claims that real footage from contexts like Syria was falsified and a growing sense that the trustworthiness of critical images across society was under threat, myself and colleagues at WITNESS and our counterparts at the Guardian Project began building our own tools for trustworthy image and video capture (now ProofMode). At the time, we argued for the necessity of a Proof Mode or Eyewitness Mode on every camera to show what was real in the face of denial.

We talked to many of the major tech players (including Apple circa 2016-7) but we were too early. Now generative AI has made the problem of confirming what is real and what is not dramatically more urgent.

Over the past years we've had the maturation of the Coalition for Content Provenance and Authenticity (C2PA) standard for showing the recipe of reality and AI in what we see and hear, and pioneering work from Google implementing C2PA (and complementary tools like SynthID that watermark AI content) in the Pixel camera and Photos Edit Suite.

Apple has now introduced its own approach. Apple’s Reference Image is a serious piece of engineering, and a genuine response to the epistemic crisis of AI and ambient uncertainty. It addresses some serious challenges we've all had in this area, while it also presents some unanswered questions and indicates some crucial next steps.

So what to make of it? My lens on the subject is informed by my experience collaborating on independent capture apps used in specialist contexts in human rights and journalism, co-authoring a report that evaluated these types of trusted capture tools for images and videos against fourteen key dilemmas, and subsequently working on the guiding principles and ‘harms modeling’ for the C2PA standards now in use by Google, OpenAI, TikTok and others. I was also briefed by Apple in advance of the launch, and some of my analysis draws on that conversation.

A new “digital negative”

In a nutshell, what does Apple Reference Image do? Basically, the camera sensor itself signs each image it produces. Each camera sensor generates its own cryptographic key when it is first initialized on the factory line, and never releases the private half. Apple only certifies the public key. When you shoot in the new Reference mode, which is an opt-in choice, you reboot the camera into a strict state where the sensor doesn’t alter pixels at all: no de-mosaicing, no tone mapping, no compression. The raw sensor data, together with a lower bound on the capture time, is signed by the sensor before it leaves the hardware. The phone's security chip then adds its own signature on the metadata that exists alongside the pixels, and an upper bound timestamp is added shortly afterwards. That device-specific signed bundle sits on your phone as a secure “digital negative.” The concept is a deliberate echo of film and the old film-lab idea that, in case of doubt as to an image’s authenticity, you looked at the negative.

Later, and only if you choose to, you can “develop” that negative, so to speak. The phone sends it to Apple’s Private Cloud Compute servers, which check the signature, ensure that the sensor and device are genuinely paired, apply the minimum processing needed to make it viewable — the de-mosaicing, tone mapping and compression the camera skipped before — and then sign the result with Apple’s own signature, built to stay secure for decades. The same Apple signature appears on all Reference Images. You end up with two images: your normal photo, which you can edit or process however you like, and the Reference Image, which shows what the sensor actually captured. You can toggle between versions on the device (and Apple promises with third party viewers in the future). If you’ve erased, added or changed something in the main photo, whatever you’ve removed or edited, for whatever reason, is still there in the Reference Image. Once developed, the negative itself is moved to deleted photos and purged after 30 days unless you rescue it.

Where Apple deserves credit

Apple deserves credit on some key elements which have been longstanding concerns for those of us working in this area: A capture approach that is the most reliable yet seen for ensuring a photo shows reality, an approach that does not link image trust to identity, and a robust capacity to respond to a failure in the authentication approach. At all three of these: ‘semantic authenticity,’ ‘resilience to compromise’ and ‘privacy preservation’ are articulated as core requirements for Apple in their whitepaper.

1. Strong, generally non-probabilistic defense of the photons that crossed the sensor, grounded in the sensor.

The verification is cryptographic, not a probability, and it's at the sensor level, not the software level. The camera signs the pixels as it captures them, the phone's security chip countersigns that along with the zoom and exposure (which come from software not the sensor), and a factory record proves both parts came from the same handset. Notably, Reference Image doesn't rely on gathering inaccurate and potentially privacy-compromising data such as location for verification. It works offline with a rolling timestamp that bounds a time in which it was shot, and is collected as soon as available. Then the image either checks out or it doesn’t, in the same binary way that C2PA manifests either validate or don't.

Apple runs additional fraud analysis on the raw sensor data as a second line of defense, scoring whether it has the physical characteristics expected of their sensors. This check is an AI model whose workings Apple keeps private. This is a defensible position, since in the world of manipulation detection, as in fraud more broadly, making this public would open it to attack. If a series of photos from one camera drift far enough from what Apple's sensors should physically produce, all images from that sensor can be revoked. Both the single image assessment and the running score are probabilistic layers, a confidence score, sitting alongside an otherwise binary claim.

Their technical whitepaper does not specify if their fraud analysis also includes looking for the common attack of screen recapture images (when a photo is taken of an existing image or screen). This has been a part of fraud defense in the capture app ecosystem for a while.

Strong sensor level work is a real win here and an addition to the ‘defending-reality’ ecosystem (more on that below).

2. Strong privacy and a clear design goal around avoiding identity as the root of trust.

The Reference Image doesn’t publicly identify the user, their phone, or their sensor. Every Image is signed with the same Apple signature, rather than anything specific to you, your device or your camera when it emerges from the Private Cloud Compute. I appreciate how Apple’s technical paper makes this an explicit design goal. It has been a longstanding concern of activists working with vulnerable defenders and civilian journalists that it should not be necessary to give up anonymity in order to prove an image is authentic. Identity disclosure should not be a prerequisite for trust.

Apple commits to a core design requirement that given two Reference Images taken with the same iPhone, nothing in them lets you work out that the same device took both. This addresses a kind of risk my former WITNESS colleague Jacobo Castellanos pointed to (manifesting in slightly different ways) in a recent report on C2PA implementation risks where usage of the same device or of a dedicated software traces back to a vulnerable individual. However, Apple can still make that link, because it needs to in order to revoke a compromised sensor (on the risks of that, read on). Third parties can’t, and Apple told me it doesn’t connect sensors to individuals.

One caveat — there is the option outlined in the whitepaper to share the negative directly in ‘undeveloped’ state. While presented as an option for professional photographers, this also raises a vulnerability since this negative hasn’t been through the process that strips out device-specific material. It carries certificates unique to that sensor and that phone, with the consequence that anyone holding two negatives can tell they came from the same device, with no help from Apple. With a Reference Image, that information sits only in Apple’s own records.

This privacy approach extends to the viewer of images. One concern, cited by Jacobo Castellanos, in provenance approaches such as C2PA is “viewer surveillance via the validation infrastructure” where viewers of sensitive material may implicate themselves by looking up verification data via an external server query, creating “a behavioral record… which content was verified, by whom, from where, and when.” Apple has taken steps to minimize the risks of looking at a Reference Image by using on-device lists to confirm an image is still a trustworthy record rather than by using a look-up online.

3. Revocation when it goes wrong

Apple can revoke an individual Reference Image, or every image from a specific sensor, if something goes wrong. Just recently, there was an incident showing a hack on the Google Pixel approach to verification that the tech giant couldn't fix. Building confidence in knowing what is real and what is synthetic is going to be an uphill education battle if the tools for trust keep getting broken without recourse. Apple has a clear recourse built into their approach; the question is who controls and governs this option, to which I return below.

Questions and concerns

1. Apple holds a switch.

Apple can retroactively revoke a single image, or every image a given sensor ever produced. If it does, photographs already published and already in other people’s hands stop showing as verified. That capability exists for good reasons, and something like it is necessary if a sensor is ever compromised (as with the case noted above with Google implementation of C2PA on their Pixel phones).

However, it also means the durability of evidence collected by iPhone users depends on the company’s ability to resist pressure to withdraw an image or a set of images, and to provide redress for mistakes. There are big questions around revocation — Do we want that power with Apple? Could they be compelled to do this? And who knows when this happens, and can they challenge it? The manufacturing and revocation records that make revocation possible seem to imply that Apple’s “we don’t link sensors to individuals” assurance could be more a policy commitment than a technical impossibility if the rubber hits the road. For a journalist protecting a source or a human rights documenter working under an authoritarian government whose images are being challenged, that distinction of policy versus technical does matter. From experience of how data and transparency matter in such contexts with what amounts to a form of content moderation, we need to be able to see the numbers, decision-making and appeals process, and we need public transparency reporting for decisions.

2. Anonymity but with some loopholes

As I note above, Apple has a powerful design goal that I have argued in favor of for over a decade: you should not have to give up anonymity to prove an image is real. And to a third party, a Reference Image (but not a shared negative) is genuinely anonymous. There is no photographer credential attached, and no way to tell that two images came from the same phone.

But this anonymity is not absolute: a Reference Image creator’s identity is not known to consumers and viewers, but Apple has options. Apple’s own paper describes a revocation service holding a record of every developed image against the sensor that made it, and the device manifest binds that sensor to a particular handset. What stands between a sensor and a named person is Apple’s business records and Apple’s choice not to connect the two, not mathematics. For most people that distinction is academic and probably irrelevant. Not so if you’re documenting a security force repressing a protest, and worry that they may come looking for you or might have an interest in discrediting your work. Two potential risks appear to exist here. Apple doesn’t see the photos you develop from negatives in the Private Cloud Compute, but developing a Reference Image does create a record tying it back to a sensor, so if Apple later was handed a public Reference Image it could confirm the device it came from. More dramatically revoking a specific sensor-device discredits everything that phone ever shot in Reference Image mode all at once. In both cases, Apple would use the same identifier that lets your phone check whether an image has been revoked to find the sensor.

3. Apple has to be in it for the long haul if all roads go through it.

The negative provided by Apple Reference Image is raw sensor data and isn’t viewable on its own, so every image you actually intend to use has to be ‘developed’ through Apple’s servers. Private Cloud Compute is seriously engineered privacy infrastructure and I don’t doubt the confidentiality guarantees. Apple has also looked ahead to the upcoming post-quantum cryptography cliff. They’re using a signature that is designed for a world where current signatures are broken by quantum computing, on the premise that the evidence of authenticity must last beyond the next 5-10 years.

But it’s still a huge dependency at the most fundamental level, and it’s unclear what happens to undeveloped negatives or even validated Reference Images if the service is discontinued or is blocked in a country. This may matter more than it first looks, because the negative is deleted by default once developed. What is left is the Apple-signed image, not the sensor-signed original. Evidence should not have a possible expiry date set by a product roadmap, even from a company as dominant as Apple and with a team that seems committed to the need.

Apple points to the capacity of experts to verify the actions of the Private Cloud Compute; the stage that turns a negative into an Apple-signed Reference Image. We will need good answers on how the system is suitable and usable in key situations like evidence — if this becomes the norm, how does the black box become coherently transparent and legible? This was one of the core dilemmas in previous research I co-authored at the human rights organization WITNESS.

4. Do people use these modes?

Sharing Reference Images is per-image and opt-in. Capture the proof when you want to, disclose it only when you decide to. This differs from the always-on version of ‘AI or real’ based on C2PA on the Google Pixel.

Apple doesn’t explain in the technical paper why capture has to be opt-in, but being optional is good from a user-control and privacy perspective, since there are real trade-offs in an always-on service, particularly the risks of retaining many ‘negatives’ that contain device-identifiable data.

However, experience with Guardian Project and WITNESS' ProofMode as well as other crisis documentation tools has found that if people, such as civilian witnesses in a crisis, have to specifically switch into a new mode to take a critical photo, they often miss that step. This is not an unsolvable problem, but Apple will have some educating to do.

5. Selective and unevenly distributed ‘this is real’ tools bring their own challenges.

Reference Image launches on the main cameras of two premium phones as an opt-in mode you have to remember to use. Meanwhile, we're in a strange moment of transition. Long term, I worry about real images being dismissed as fakes, but I also worry about real photographs being dismissed because they aren't credentialed as real. This applies as a concern to both images with Content Credentials and C2PA metadata, and going forward also to Apple Reference Images.

It is good that Apple intends to open this feature up to 3rd party apps for verification and capture in the future, but in the near term, most of the world’s cameras won’t have this technology, and many of the people doing the most important documentation, witnessing and journalism are shooting on cheap Android phones. Apple’s user education over the coming year needs to lead, perhaps perversely, with what a photo with a Reference Image marker means, but also what the absence of one does not. Otherwise we may see the cultivation of a perverse ratchet effect of expectations of photographic proof that the majority of image-takers in the world cannot meet.

6. ‘Real or AI’ is a journey, not a one-off, and is evolving in a bigger world than Apple — where is the C2PA collaboration?

The final question is the most significant one. Apple’s answer to the fact that real photos get edited is elegant: keep the untouched negative, and let people compare. When you toggle between the two you see exactly what changed (Google's Pixel phone does something similar via C2PA, though with a less robust confirmation of the original if the exploits noted above are not fixed).

That works well for the case where someone hands you both files. It’s strong for a professional photographer or first-hand documenter who gets to hold onto their original, and challenge a fake that circulates. It’s valuable for some specific business cases - for example, an insurance claim. It’s weaker as an ecosystem answer. It needs a human to look and judge. It says nothing technically transparent about which changes were made and how.

And perhaps more importantly, we live in a world where edits and evolutions of real images in the moment, and over time, via material and non-material use of AI and by multiple entities, across diverse platforms, and with a range of intentions, is the norm. This listing of the recipe of our complex digital creation, manipulation and consumption is a gap that C2PA and Content Credentials fills: a signed, machine-readable record of what each tool and entity did along the way. C2PA often talks about three legs of a stool — metadata to show the origins and the edits combined with watermarking and fingerprinting/hashes to reconnect the metadata if lost.

But C2PA has struggled with the challenges of showing ground-truth reality from when photons hit sensors. This is where Apple comes in. What I’d like to see is Apple’s sensor signature, which is the strongest capture attestation anyone has built, feeding into an open and portable edit history. We need a system in which this information can be handed off interoperably into other tools and other ‘real-AI’ recipes and concoctions, C2PA being one strong option now used by many others. Apple has already joined one ecosystem bet by announcing plans to incorporate Google's SynthID for watermarking AI images and edits later this year (a critical step to industry-wide adoption). Let's see what other collaborations are possible to defend reality. Putting watermarking, robust metadata recipes readable by all, and a best-in-field privacy-protecting sensor-based attestation together would be a powerful combination.

Some thoughtful places where Apple could take this forward include:

• Collaborate and interoperate with C2PA so negatives and Reference Images can be easily developed, verified and then imported into C2PA-compliant apps, so that edits after capture documented in a form many others’ tools can read, and a powerful sensor record can be part of a recipe we can all read showing the mix of reality and AI in what we see.
• Make verification of a developed Reference Image (and additionally, confirmation if it has been revoked) possible outside the Apple ecosystem, as soon as possible — as they've indicated is the intention.
• Third-party capture APIs asap would let developers building for high risk human rights and journalism work reach the same hardware guarantees.
• Revocation governance matters: publish what’s retained, for how long, who can compel it, and whether targeted revocations are disclosed.
• Be loud, in the rollout, that a photo without a Reference Image is not a suspicious photo (people won't all have iPhones and not everyone remembers or chooses to use these modes)

Human rights activists and citizen journalists first called out the need for a robust method to conclusively prove that a photo showed what it said it did. We saw how easy it was to dismiss reality even before AI forced every single one of us to doubt the evidence of our eyes.

We now have an option to do this on one of the most powerful cameras, with some of the best privacy-preserving technology, and from one of the leading hardware companies in the world. But this technology cannot be an Apple-only island. We need to be able to use this ground-truth proof in a broader world of reality-determination, and whimsical, communicative and malicious AI edits that spread across messaging, social and search. Accessibility, interoperability, transparent governance and a recognition of the realities of a world where absence of technical proof can and will be leveraged against the most vulnerable accounts are critical next steps to build on this key advance.