Thread

Apple Reference Image: A New Approach for Verified Photography

539 points · 352 comments · imwally

tristanj · 1789527436 · focus · HN ↗
Apple doesn't address the modified photo replay situation, where you take a picture of an already edited image.
Photoshop / AI-gen an image -> display on a high-resolution monitor -> photograph the monitor with iPhone 18 Pro -> valid Apple Reference image.
To get valid reference photos, you can go to the actual physical location, put the iPhone/monitor in a cardboard box to block external light, then photograph the monitor. Paint the inside of the box using Vantablack (stopping reflections) and cover the LiDAR projector with tape.
I can't wait to see Apple Verified™ photos of UFOs flying over the Golden Gate Bridge.
1. amanj41 · 1789528149 · focus · HN ↗
  Sony's analogous solution (<a href="https://authenticity.sony.net/camera/en-us/" rel="nofollow">https://authenticity.sony.net/camera/en-us/) claims 3d depth information is built in, I'm sure Apple could do the same given at least some iPhone models have LiDAR on the back
  1. tristanj · 1789528682 · focus · HN ↗
    This would work for close up shots taken on iPhone, but not landscape shots. The infrared dots the iPhone LiDAR projects are too weak to appear over long distances.
    Also the dots can be trivially blocked by putting your finger over the sensor, sometimes improving photo quality. I do this frequently when I want to take a photo through a window. The absence of the dot matrix tells the iPhone to focus on the background far away instead of the windowpane.
    dd8601fn · 1789533925 · focus · HN ↗
    > I do this frequently when I want to take a photo through a window.
    I feel really dumb for not having thought of this.
    amanj41 · 1789576761 · focus · HN ↗
    I see, yeah good point. Perhaps the lack of reliable depth data also be baked into some signed metadata property. Wouldn't tell you definitively if something were fake, but could be a context clue if a particular photo were dubious I suppose.
    Cthulhu_ · 1789584489 · focus · HN ↗
    What they could do instead is record a video while taking a photo, the subtle movements (at least if handheld) might have enough information to get an approximation of depth (parallax).
2. osy · 1789528263 · focus · HN ↗
  It also doesn't prevent you from staging an image or anything that's existed since photography was invented. But that's not the problem they're trying to solve.
  > Today, powerful, widely available AI tools allow users to easily generate or alter photorealistic images to a degree that was difficult to imagine just a few years ago.
  Photoshop has existed for decades and so has fake images. This is a low friction way to attest "this image came from an iPhone sensor and Apple approved it". It will still take the usual image forensics to determine if the scene it depicts is legitimate.
  1. BugsJustFindMe · 1789529268 · focus · HN ↗
    > "But that's not the problem they're trying to solve."
    It is the problem that they say they're trying to solve, though. They specifically say "where the essential role of a photograph is to prove that something actually happened".
    It fails the reasonable person test to say that the "something" in that phrase refers to the act of taking the photo itself.
    Likewise in "distinguish between photographs that depict real events and...".
    spiderice · 1789531322 · focus · HN ↗
    This is so stupid. This makes it like, a thousand times harder to fake a photo than it would otherwise be. You pedants imagining a way to fake it doesn't change that.
    BugsJustFindMe · 1789531994 · focus · HN ↗
    > This makes it like, a thousand times harder to fake a photo than it would otherwise be.
    The problem with this thinking is twofold:
    1) Whether it actually meaningfully increases the difficulty of a forgery remains to be seen. Despite their initial language about discerning real events, we see no details here about what scene information is used.
    2) It increases the potential value of a forgery because now your forgery is attested by Apple.
    So it either makes it easier to defraud people or more worthwhile to put in the effort to defraud people or both. None of those outcomes are great.
    porkshoe · 1789535412 · focus · HN ↗
    You worry that a technology that you have never used nor evaluated might not work in practice...
    Therefore because of your worry (which is based on remarkably little information), it's a bad technology?
    Come the fuck on. That's beyond luddite bullshit.
    otterley · 1789536180 · focus · HN ↗
    > because of your worry (which is based on remarkably little information)
    You must be new around here. ;-)
    BugsJustFindMe · 1789537932 · focus · HN ↗
    Is this you? <a href="https://news.ycombinator.com/item?id=49685271">https://news.ycombinator.com/item?id=49685271
    phoghed · 1789561087 · focus · HN ↗
    Being right twice isn’t a crime
    porkshoe · 1789576079 · focus · HN ↗
    yes. <a href="https://imgflip.com/i/b1ay01" rel="nofollow">https://imgflip.com/i/b1ay01
    latexr · 1789553189 · focus · HN ↗
    > Whether it actually meaningfully increases the difficulty of a forgery remains to be seen.
    Then maybe let’s save those criticisms until this is in the hands of knowledgeable people who can actually test? I mean, I’m no fan of the direction Apple has gone under Tim Cook, but all else being equal I’m inclined to give them the benefit of the doubt that they may have thought this through over the time it took to build more than a random person speculating on HN who just read a blog post for the first time.
    > (…) we see no details here about what scene information is used.
    And you assume that everything in a post is the sum total of how it works?
    > It increases the potential value of a forgery
    By that token, should we also not be adding forgery deterrents to ID cards and bills? After all, if you can fake the preventive measures, “it increases the potential value of a forgery”.
    brookst · 1789531392 · focus · HN ↗
    So, in your view, photography has been fatally flawed since the late 1800’s, and mere mitigation of AI image gen are insufficient if they don’t also solve actors impersonating real people?
    BugsJustFindMe · 1789531691 · focus · HN ↗
    [dead]
    reader9274 · 1789533004 · focus · HN ↗
    Yes, it is proving something actually happened, that is your monitor screen showing something you photographed.
    BugsJustFindMe · 1789533474 · focus · HN ↗
    [dead]
    bawolff · 1789539776 · focus · HN ↗
    No security control is perfect. The point is to increase costs to the point its unfeasible.
    After all, if money is no object, you could just bribe every single apple employee involved in the project.
  2. Gigachad · 1789542266 · focus · HN ↗
    This has been possible since the beginning of photography and yet I can’t think of a single scenario where people have been tricked by a staged photo. Yet every day hundreds of millions of people are being fooled by AI generated photos.
    zimpenfish · 1789644330 · focus · HN ↗
    > I can’t think of a single scenario where people have been tricked by a staged photo
    Let me introduce you to Sir Arthur Conan Doyle and the Cottingley Fairies[0].
    "Doyle was enthusiastic about the photographs, and interpreted them as clear and visible evidence of supernatural phenomena. [...] the photographs were faked, using cardboard cutouts of fairies copied from a popular children's book of the time"
    [0] <a href="https://en.wikipedia.org/wiki/Cottingley_Fairies" rel="nofollow">https://en.wikipedia.org/wiki/Cottingley_Fairies
  3. pndy · 1789548106 · focus · HN ↗
    > This is a low friction way to attest "this image came from an iPhone sensor and Apple approved it".
    Which surely will be useful in ID verification on the Internet; Android devices most likely will follow with same or similar solution
3. pveierland · 1789528538 · focus · HN ↗
  Claim 7 in this patent application describes how depth sensors are used as part of an image authentication process, which would make such a workaround more difficult:
  <a href="https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/20260268025" rel="nofollow">https://image-ppubs.uspto.gov/dirsearch-public/print/downloa...
  The Apple Reference Image feature is here launched on iPhone 18 Pro and iPhone 18 Pro Max that both have built-in LiDAR sensors that could be used for this process.
  1. BugsJustFindMe · 1789528800 · focus · HN ↗
    iPhone lidar only works up to like 16 feet in the easiest lighting conditions (indoors) and may be functionally ineffective outdoors.
    gruez · 1789529358 · focus · HN ↗
    So you need a big enough screen to cover the entire field of view at 16 ft? Sounds expensive
    BugsJustFindMe · 1789529818 · focus · HN ↗
    Well, first, that's only expensive if you're poor. The world is absolutely full of people who can easily piss away your entire annual income throwing a house party.
    But I really mean that if the lidar barely works outdoors anyway then actually you don't need to be 16 feet away at all.
    Anyway, one may presume that they've thought about this.
    brookst · 1789531241 · focus · HN ↗
    Thought about it and also are bright enough not to fall for the “if a single person dies wearing a seat belt, we should abandon seat belts because they do no good at all” fallacy.
    It’s almost certainly possible to fool v1 of this system, for some images, in some contexts. It would be shocking if the first implementation was completely perfect. But maybe it’s better than nothing?
    BugsJustFindMe · 1789531447 · focus · HN ↗
    > But maybe it’s better than nothing?
    I think this will depend on how it gets used. I can imagine numerous outcomes where it's in fact worse than nothing (significantly more effective blackmail, for instance).
    brookst · 1789616904 · focus · HN ↗
    I guess? The bailey version of that argument is that we should do away with the concept of truth altogether, because some truths are harmful.
    akersten · 1789532777 · focus · HN ↗
    > maybe it’s better than nothing?
    While that is not quite my bar of confidence when implementing wide-reaching technologies that have numerous unexplored knock-on effects, I guess the calculus must have been different on Infinite Loop recently.
    dd8601fn · 1789533705 · focus · HN ↗
    I like that seatbelt argument example.
    I’ve seen that type of argument a million times, and I’ll certainly reuse that.
    MisterKent · 1789534383 · focus · HN ↗
    The problem is that if defeating it is trivial, then it _authenticates_ fake images.
    The problem is that it makes it easier to fool people and provide "cryptographic" evidence of validity, backed by big tech.
    It's purpose is to stop bad actors from passing of fake as real just as much as it is to prevent real images being dismissed as fake.
    alwillis · 1789536497 · focus · HN ↗
    > It’s almost certainly possible to fool v1 of this system, for some images, in some contexts. It would be shocking if the first implementation was completely perfect.
    Knowing Apple, they've been working on and testing Apple Reference Image for years.
    It being perfect isn't the issue; it's that random people on the internet who are just learning about this assume Apple's engineers haven't already thought about everything (and more) mentioned in this thread.
    archagon · 1789542173 · focus · HN ↗
    If they thought about it, then why isn't this very obvious failure point even mentioned in the technical breakdown?
    ben_w · 1789542189 · focus · HN ↗
    > It being perfect isn't the issue; it's that random people on the internet who are just learning about this assume Apple's engineers haven't already thought about everything (and more) mentioned in this thread.
    Given how many bugs there are in macOS and how long they have remained there, I (who have been writing iOS apps from the release of the first retina iPod touch until AI got good) functionally agree with such people; at best, I think Apple's engineers haven't actually solved everything (and more) mentioned in this thread, even if every one of these things may have come up in discussions and even reached an official backlog or task list or similar.
    mitxela · 1789553017 · focus · HN ↗
    It's bad to begin with that Apple should be the arbiters of reality.
    croon · 1789725304 · focus · HN ↗
    If fake images get certified as real, that's a net negative compared to now where the verification boils down to chain of trust.
    somethinsfishy · 1789534968 · focus · HN ↗
    Put some sugar on it. Please.
    BugsJustFindMe · 1789535078 · focus · HN ↗
    Def Leppard, is that you?
    nomel · 1789530487 · focus · HN ↗
    Or, probably just some optics, like a slanted $9 IR mirror [1] in front of it, to direct the lidar to the sky/absorption box. Then you can point at the high res HDR TV that's probably already in your living room.
    [1] <a href="https://commonlands.com/products/ir-cut-filters-csp650?srsltid=AU7gw4X-pCzrQspQzH18g1_O281WPxL3N-zhy48Usxf-IMb8Ctbs45Bk" rel="nofollow">https://commonlands.com/products/ir-cut-filters-csp650?srslt...
    pveierland · 1789529375 · focus · HN ↗
    Still, that means that either the fake target scene and your screen presenting it would need to be outside of LiDAR sensor bounds, or you'd need to find a way to make the depth sensor data conform with your fake scene, both increasing the difficulty of producing a forgery.
    BugsJustFindMe · 1789533685 · focus · HN ↗
    <a href="https://news.ycombinator.com/item?id=49721878">https://news.ycombinator.com/item?id=49721878
    > increasing the difficulty of producing a forgery
    The problem with this thinking is twofold:
    1) Whether it actually meaningfully increases the difficulty of a forgery remains to be seen. Despite their initial language about discerning real events, we see no details here about what scene information is used.
    2) It increases the potential value of a forgery because now your forgery is attested by Apple.
    So it either makes it easier to defraud people or more worthwhile to put in the effort to defraud people or both. None of those outcomes are great.
    moffkalast · 1789574468 · focus · HN ↗
    A sufficiently light absorbing material is indistinguishable from infinity to a lidar. Or simply add a mirror that redirects it sideways, those can't be detected either.
  2. tristanj · 1789529371 · focus · HN ↗
    Apple's current implementation doesn't integrate LiDAR. And LiDAR wouldn't be enough here, it's trivial to block the projector and hide the dot pattern. No dot pattern = iPhone thinks the object is far away, which is what happens in landscape photos.
    A better fix is to take photos with all three iPhone cameras simultaneously, ideally as a 2-3s video, and use the parallax/multiple perspectives to extract depth information. The video files (Possibly audio too) could also be included with the verified image as additional verification.
    They can also prevent photos if iPhone detects the LiDAR sensor is covered, similar to how Meta does it with their camera glasses.
    pveierland · 1789529702 · focus · HN ↗
    I don't think it's an either or - additional data signals that need to correlate to authenticate will increase confidence. You can use multiple other signals to evaluate whether something is truly a landscape photo, and in that case not require a LiDAR capture, but if you are inside and at close range then you could assume that it should be part of scoring the authentication.
    Similarly, LiDAR alone will help disqualify cases where someone is just taking a picture of e.g. a landscape target of the Golden Gate, but that it shown on a screen 1 meter away.
    halestock · 1789530047 · focus · HN ↗
    This approach makes me wonder if the future is actually going to move towards visual cryptography.
    alwillis · 1789537027 · focus · HN ↗
    Um… that's already a thing [1]:
    TL;DR: What is C2PA in 60 seconds What: An open technical standard for embedding cryptographically signed provenance data inside digital media files. Who: Created by a coalition founded by Adobe, Arm, BBC, Intel, Microsoft, and Truepic in February 2021. How: A C2PA Manifest (also called a Content Credential) travels inside the file and records who made it, when, and what tools were used. Why: Deepfake incidents surged from 500,000 to 8 million cases between 2023 and 2025. Provenance gives media a verifiable chain of custody.
    [1]: <a href="https://c2paviewer.com/articles/what-is-c2pa" rel="nofollow">https://c2paviewer.com/articles/what-is-c2pa
    halestock · 1789575013 · focus · HN ↗
    Hm, that's more like digitally signing an image. I'm thinking about something like e.g. encoding/encrypting depth information from multiple images to create a composite that can't be duplicated without the source images.
    sandcat_ · 1789532665 · focus · HN ↗
    Right but I’d argue that realistically this feature is going to be most useful when taking photos of things reasonably close by, people especially, rather than landscape photography.
    dylan604 · 1789535418 · focus · HN ↗
    > it's trivial to block the projector and hide the dot pattern. No dot pattern = iPhone thinks the object is far away, which is what happens in landscape photos.
    I've never looked at the LiDAR hardware, but where is the emitter in relation to the receiver. Why would the LiDAR not reflect off of whatever you're blocking it with and return a very short flight meaning it was very close?
    jojobas · 1789537149 · focus · HN ↗
    Paint the stopper vantablack then.
    testdelacc1 · 1789539833 · focus · HN ↗
    I knew keeping a pot of vantablack in my jacket pocket would come in handy.
    mitxela · 1789552949 · focus · HN ↗
    I think the plan is to block the emitter, not the emitter and the receiver together
    Findecanor · 1789549829 · focus · HN ↗
    > all three iPhone cameras simultaneously, ideally as a 2-3s video, and use the parallax/multiple perspectives to extract depth information.
    I think optics could be used to make each camera see a different image.
    A video could show shake, which could be verified against readings from the phone's accelerometer -- but you could just hold it still and claim that it was on a tripod.
    avianlyric · 1789583386 · focus · HN ↗
    > A better fix is to take photos with all three iPhone cameras simultaneously, ideally as a 2-3s video, and use the parallax/multiple perspectives to extract depth information.
    I think iPhones already do this (although without taking multiple seconds of video). iOS is capable of generating pretty accurate depth data even on devices with no LiDAR unit.
    astafrig · 1789654714 · focus · HN ↗
    Using the cameras to estimate depth information is not really a better solution than using the LiDAR sensor because the cameras are so close together that the effective range for parallax depth estimation and the effective range of the LiDAR sensor are very similar.
  3. geokon · 1789529416 · focus · HN ↗
    furthermore, couldnt you do parallax from the multiple cameras as well as flicker the flash?
    seems pretty easy to make it sufficiently difficult to trick the system
4. dinobones · 1789529701 · focus · HN ↗
  Is this really that big of a flaw in this implementation? I don't think it's worth the additional complexity to address it. (Encoding depth information in some way, trying to detect "flat" surfaces, whatever).
  Discerning a camera taken image of an image is typically very very easy. The collors/exposure/etc will all be obviously wrong in ways to a human, even without doing any analysis.
  1. BugsJustFindMe · 1789531208 · focus · HN ↗
    You mean that it is sometimes very easy. But it is also sometimes impossible. You seem to be thinking only of poor quality photos of poor quality prints, but there's no basis for assuming those characteristics.
5. nvme0n1p1 · 1789531151 · focus · HN ↗
  Yeah, such systems have been tried (and been hacked) for decades now.
  <a href="https://www.elcomsoft.com/news/428.html" rel="nofollow">https://www.elcomsoft.com/news/428.html
  <a href="https://blog.elcomsoft.com/2011/04/nikon-image-authentication-system-compromised/" rel="nofollow">https://blog.elcomsoft.com/2011/04/nikon-image-authenticatio...
  You don't even have to travel to the location, you can just spoof GPS. And of course that will only be needed until some eastern european kid gets bored one weekend and the signing keys magically appear on pastebin.
  It's funny to see Apple fall into this same trap.
  1. Rohansi · 1789533890 · focus · HN ↗
    To be fair Apple of all companies have the best shot at pulling it off. They've been perfecting their hardware security for years for other reasons and this is just another way to take advantage of that work. But yes, if someone breaks it then the trust is gone and it casts doubt on all of the photos that were ever captured using the broken system.
6. [deleted] · 1789531188 · focus · HN ↗
  [deleted]
7. srik · 1789531567 · focus · HN ↗
  It's less about proving a photo's truth than about attesting it.
  1. scorpiosdayoff · 1789535403 · focus · HN ↗
    [dead]
8. walrus01 · 1789532303 · focus · HN ↗
  > Paint the inside of the box using Vantablack
  But you're only allowed to do that if your name if Anish Kapoor
  1. zimpenfish · 1789645454 · focus · HN ↗
    Also I think if you're rich enough to be able to coat the inside of a cardboard box with Vantablack, you've probably much easier ways to get misinformation out to the public than photographing a monitor in a cardboard box...
9. ricksunny · 1789533892 · focus · HN ↗
  >I can't wait to see Apple Verified™ photos of UFOs flying over the Golden Gate Bridge.
  There’s no such thing as a Golden Gate Bridge.
  Prove it.
10. baxtr · 1789535111 · focus · HN ↗
  This sounds like it could be done, but the costs for doing so are comparably high.
  I think the idea is to control the easy, cheap mass production of AI gen picture and not 100% coverage.
  That’s a tradeoff I can live with.
  1. dgellow · 1789548782 · focus · HN ↗
    > but the costs for doing so are comparably high
    You will find pre made kits to do that exact thing in a few weeks/months on alibaba and similar
11. Glyptodon · 1789537358 · focus · HN ↗
  I suspect they have ways to ID at least some things like this somehow in ways that will lead to key revocation.
12. mw888 · 1789539246 · focus · HN ↗
  > I can't wait to see Apple Verified™ photos of UFOs flying over the Golden Gate Bridge.
  While I'm on board with you about the inabsolute security of this (relative to what's typically expected of cryptographic systems), the fact that their 'verified' state requires a live certification and can be revoked means that the sensor responsible for obviously faked images will see those images and that device no longer certified.
  It all relies a lot on trust in Apple, and integration with Apple, and relatively unmotivated attackers.
13. nalekberov · 1789540730 · focus · HN ↗
  Exactly, a wave of “verified” fake images are coming.
14. Gupie · 1789542361 · focus · HN ↗
  Won't the focus length of the camera be wrong?
15. est · 1789548888 · focus · HN ↗
  > take a picture of an already edited image
  I think the "reference image" means a photo is taking by a real iPhone 18 device at a certain time, what the content actually means is another matter.
  The "digital negative" in DNG format can be used to analyze the authenticity of the content.
16. peri-cl · 1789549966 · focus · HN ↗
  It's even easier than that. You just wait for someone else to figure out, some photography professional with fancy equipment and a hacker-y mindset, and you pay them to sign your photos for you.
  Once a defeat device (a camera pointed at a screen) is functional, whoever has it, can simply automate a "receive API request, display image on screen, photograph it, return signed image" pipeline. A cheap internet service. I'd WAG a hundred thousand signatures per day per phone, limited by the sensor speed.
  Since there's no way for anyone, Apple included, to correlate photo signatures with the device that signed them, it's also true there's no way to stop one device from signing millions in bulk. ("...an outside observer cannot determine whether any pair of reference images were taken by the same device..."; "...avoid even implicit public association between different photos taken by the same sensor...")
  It's the same economic asymmetry as DRM vs. movie piracy (as soon as one group defeats a technical challenge, millions instantly benefit, at zero marginal cost). Apple has no chance of winning.
  1. [deleted] · 1789557533 · focus · HN ↗
    [deleted]
17. eutropia · 1789567450 · focus · HN ↗
  I think the timestamp attestation of the digital negative puts a real hamper on this, because it puts a bounded time window on the photo as part of the cryptographic chain of evidence.
  So if you're the proud owner of "literally the only photo of a ridiculously unusual event in a highly public area" which is bounded to either a plausible 15-30 minute window or a sketchy March2026->Now window, people can do something like "hey, gee, did anyone else see that UFO over the golden gate bridge at 3pm?"
  plus, you know, the confidence score from their secret neural network, which has an unknown scoring function.
18. rlt · 1789580464 · focus · HN ↗
  "As part of developing the secure digital negative, PCC computes a confidence score that assesses whether the image has the physical characteristics expected of raw output from our camera sensors. Before the developed reference image is signed, PCC sends the photo GUID, sensor ID, and this confidence score to a companion service, which records them and updates the running score associated with that sensor."
  I wouldn't be surprised if it's also possible to detect the differences between a photo of a real scene and a photo of a monitor or printout displaying a photo of a real scene, given they have the raw sensor output.
  Not sure if they're doing anything like that.
19. furyofantares · 1789585548 · focus · HN ↗
  It doesn't need to be bulletproof to be very valuable.
  However much effort is required to fake it - it's proof that the image is either legit or that much effort went in. There's TONS of cases where it's plausible for someone to have put in the effort to fake a photo with AI (nearly zero effort required) but not remotely plausible that they set up some elaborate high quality photo of a fake.
  It's also much more damning if you get caught faking it. Think of the examples where police have been caught posting altered images on social media. The lame excuse that some intern didn't realize it would do more than just upscale the image won't fly if some elaborate setup was required.
20. HALtheWise · 1789676405 · focus · HN ↗
  We're talking about a 48MP camera here, so finding a sufficiently "high-resolution monitor" to pull this off is probably more difficult than you expect. Especially because without at least a few times as many pixels as the camera, it's likely that there will be detectable moire patterns in the image. My guess is that a physical print is more fruitful, but it's still a pretty tricky task to get high enough dynamic range and such to truly fool the sensor.
  This sort of concern is presumably why Apple says "Using a neural network with hidden weights, PCC computes a confidence score for the photograph." I'm assuming that things like moire-patterns from pointing the camera at a screen would be caught by that check.
  It's of course physically possible to fool the sensor, but at some point it becomes cheaper to just build a UFO and fly it over the actual Golden Gate Bridge.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.