Thread

ZK-JPEG: Zero-Knowledge Image Editing and Compression

107 points · 33 comments · gslin

Loading the complete thread in the background. This saved snapshot is available now. Refresh

Retr0id · 1789850356 · focus · HN ↗
Interesting work.
> our tool can verify a large family of image transformations
Is this family large enough to transform real image A into arbitrary fake image B?
1. gblargg · 1789852690 · focus · HN ↗
  Viewers could provide a way to see the original before transforms, and perhaps apply each one at a time to see how the end result is arrived at.
  1. Retr0id · 1789854890 · focus · HN ↗
    If you're preserving the original, then you don't need the ZKP
2. bawolff · 1789856915 · focus · HN ↗
  Presumably in a real application there would be a list of acceptable operations.
  Like first you have to show you can do everything necessary in the system which is what this paper does. Step 2 is coming up with a policy of what restrictions to place on allowed transformations
huflungdung · 1789852278 · focus · HN ↗
[dead]
jamienk · 1789852762 · focus · HN ↗
Hasn't this crossed over into being a philosophical question? You want to attest to reality or provenance. But then you start making lists of "acceptable" changes: file format; compression; color-correction; size; taking "medium" into account... It then slowly slides into "average human perceptibility"; "irrelevant details"; keeping the "spirit" of the image intact; judging the intention or motive of the user or of the viewer; aligning the image with "values"; appropriate/legal use... etc. Not sure what the end-game is?
We are trying to make images in the AI era be as reliable as they were pre-AI? But they were not reliable pre-AI, it was just more difficult to intentionally doctor them.
1. another-dave · 1789857769 · focus · HN ↗
  I think for photojournalism it should be original raw image, as captured in camera — zero edits for colour correction/cropping/filesize etc — platforms can link a digital sig from a postprocessed version but you keep the provenance proof tied to a published original.
  1. Gigachad · 1789872794 · focus · HN ↗
    That's pretty much how the Apple one works. The raw sensor data is signed. But you have to process it because raw sensor data is unviewable.
    Provide the raw original, and the exact processing steps used to get the presentable one.
  2. 112233 · 1789904040 · focus · HN ↗
    ok, point camera at a screen. let's counter that by also taking 360° image with secondary camera. Ok build some props, let's add gps into it. fake gps. let's add inertial tracking and self-destruct on tamper. Ok, but we really need a fake image, here is our badge, give us signing keys for special use case...
    You cannot replace honesty with tech.
  3. goodmythical · 1789916769 · focus · HN ↗
    Are they allowed flash? What about studio lighting? What about commentary? Paid actors?
    "Hey, do me a favor, wear this hoodie and go hand this plastic baggie with white powder in it to that guy over there, it's for an art project, he's going to act like he doesn't know you, and then you just run in the opposite direction to where you'll be payed"
    Or "here's three photos of XYZ taken on three seperate days at his new favorite coffee shop, notably across from this elementary school. Read on for our take on why he likes this shop so much!"
    Or even something as simple as positioning the camera just so that one national head appears shorter than another. Or, in an interview, adjusting lights on the 'hero' to make them look good and highlight the shadows on the 'villain' to make them look ominous.
    Use a mirror set up to make it look to the 'villain' that they are making eye contact but are instead looking weirdly askance.
    Limitations are the origin of creativity. Force publishing RAW would just force journalists to be more creative in their framing.
    Also, no edits for filesize? Lossless RAWs are huge! Especially from professional cameras. You could end up loading a gig of data for a single article with 10 images, or even more for larger frames. The few who care enough to see the 'real' image (that is still tainted by photographer intent regardless of file size and editting) are motivated enough to click the lossy jpg for the raw. Those who do not care aren't going to sit waiting on the order of minutes to see the first image.
    jamienk · 1789925564 · focus · HN ↗
    Or what about: the photographer tries to hide so that they don't contaminate the real-life that they are watching, but then the person sort of hears a small sound from the photographer's direction -- they don't actually SEE the photographer, but they get interrupted.
    Or: the CCTV is well hidden, but the people who installed it left behind some mud that got on someone's shoes and that made them late...
    another-dave · 1790082908 · focus · HN ↗
    > Are they allowed flash? What about studio lighting? What about commentary? Paid actors? > > "Hey, do me a favor, wear this hoodie and go hand this plastic baggie with white powder in it to that guy over there, it's for an art project, he's going to act like he doesn't know you, and then you just run in the opposite direction to where you'll be payed"
    what exactly is the 'threat model' that you're trying to protect against here? If you already don't trust John Doe as a credible source, of course then there's a million ways he can frame a scene to tell an unreliable story. That's always been the case.
    But to me, what we're looking for now in the age of diffusion models is for someone to be able to say "here is the provenance of this image, it came from John Doe's camera" and that can survive being shared round the internet, provably.
    > You could end up loading a gig of data for a single article with 10 images, or even more for larger frames.
    I'm not suggesting that the _only_ thing that gets used is a raw image. I'm saying that if you go to the Wall Street Journal, then underneath the photo, beside the credit, they put a link out to some page that hosts the RAW file, the metadata of the camera used and a signature.
    If you find the photo unbelievable and think it's bogus, you're able to regenerate the signature from the parts and see that it's valid. (and obviously if they link off to something that's massively different - that isn't just compression, white balance, etc - people hold them to account)
2. iririririr · 1789864843 · focus · HN ↗
  no no no you need to buy a new phone!
  /s
3. afavour · 1789873662 · focus · HN ↗
  I feel like we were already in a weird gray area. Cellphone cameras use all kinds of programmatic tricks to make their output better than the exact information the lens captures. I think people just didn’t realize how much their phones were doing. Is that “fake”?
  1. goodmythical · 1789915741 · focus · HN ↗
    Any capturing device is only every going to offer a symbol of the light that traversed it's aperture.
    Even a camera obscura with a strip of film inside contains some adjustment to the "actual" image. If I expose the film for longer/shorter or during differing weather conditions, or near a train, etc, the developed film is going to have an appearance that may tinge the viewers perception of the subject. A short exposure, slightly off tilt, during a partially cloudy day, and a 'proper' exposure, rightly aligned, during full sun at noon, both of the same subject, both taken as soon as the photographer could to meet the deadline, both published on the front page of a newpaper, will give readers wildly different tastes for the subject.
    Even two different b/w films will have different brightness/contrast etc, and the color films vary even more, with some punching various red/blue/green levels.
    That's all without necessary deliberate intervention of the photographer. Once you get in to artistic license, you've got an even wider range. Taken from a low angle to add gravitas, taken from a high angle to minimize chin and highlight chest, with special lights to deepen shadows, with/without normal/stage makeup to add anything from regality to poverty. Taken in one's very nicest clothing, with family that is never around, while everyone has a congenial expression. (Aww, look at this lovely family)(look at the grand barren desert monument off in the wild dunes that is clearly not littered with tourists and a short walk from downtown cairo) This is easily noticeable if you've seen both a wedding and it's final professional photos. The lights didn't look like that. Where'd the audience around their first dance go? Holy shit, she looked good, but not that good.
    Many have often taken photography as if it offers a genuine view of a thing at a time. We even sometimes call historical representations "snapshots". But it's never been the case.
    Not sure I'd really call any photo a fake per se, they're all just representations. I suppose the fakeness comes from outside the image: the framing. If one edits a picture of a park and says "come to Always Sunny Perfect Awesomeville Where it Never Rains and is Always Full of Butterflies", then one has lied as it definitely rains there and there's certainly not always butterflies. One producing a deepfake is doing the same: capturing something they'd like captured. If it is represented as a photograph, then, sure, there's a lie; there was no photograph. But both the image with the clothes on (with lighting, editting, and makeup) and without are the same "here's what I thought it should look like" rather than "here's an exact transcript of the actual arrangement of this particular band of the electromagnetic spectrum that would have met my eye at the time"
    jamienk · 1789925357 · focus · HN ↗
    This is so good. I think this is what Hegel meant by the "absolute" - not some final God's-eye view that he's often caricatured for, but the fact that every objective "substance" is and will always be wrought by "subject", by a POV, a mediation, a representation.
  2. imagetic · 1789922885 · focus · HN ↗
    Yes.
  3. tough · 1790789506 · focus · HN ↗
    today's phone cameras abuse AI too or had some blunders around that like fake moons etc
mvid · 1789853168 · focus · HN ↗
Tie this into the Apple/Android/Sony/Leica signed photos, and you get provenance from capture to publish
AmazingEveryDay · 1789861707 · focus · HN ↗
I'm trying to think of recent real-world examples where the reality of the photo was of major importance. Photographs just don't seem to have the same significance, even as potential verification of their realness becomes more achievable.
1. Gigachad · 1789873376 · focus · HN ↗
  An everyday scenario is Real estate photography and Facebook marketplace where people are having a field day AI faking photos.
  Having a tick showing the photo is verified real would add a lot of trust to online platforms.
  1. tosapple · 1789876955 · focus · HN ↗
    [dead]
2. avianlyric · 1789884923 · focus · HN ↗
  There’s been a few, but it’s becoming so common people have stopped noticing, but here’s a few recent ones:
  <a href="https://www.bbc.co.uk/news/live/ce9yydgmzdvt" rel="nofollow">https://www.bbc.co.uk/news/live/ce9yydgmzdvt
  <a href="https://www.france24.com/en/middle-east/20260417-press-association-israeli-army-use-ai-doctored-image-slain-journalist" rel="nofollow">https://www.france24.com/en/middle-east/20260417-press-assoc...
  There’s now even a wiki article on the usage of AI generated images in American politics, mostly dealing with the obvious slop that Trump has produced, rather than insidious edits of real images
  <a href="https://en.wikipedia.org/wiki/AI-generated_content_in_American_politics" rel="nofollow">https://en.wikipedia.org/wiki/AI-generated_content_in_Americ...
3. rerdavies · 1789895954 · focus · HN ↗
  [delayed]
  1. fwip · 1789909315 · focus · HN ↗
    [delayed]
  2. AmazingEveryDay · 1790028659 · focus · HN ↗
    True I can see there being issues in legal system yes. The Kyle Rittenhouse trial was a good covid-time diversion and I remember much consternation and fuss about the zooming/enhancement of some of the video evidence.
killingtime74 · 1789874734 · focus · HN ↗
Can't I just use a physical camera to take a picture of a screen? (Engineer's fantasy ended by a wrench moment)
pixelsort · 1789881218 · focus · HN ↗
If this ever became widespread, people would game the "verified real" checkmark using the analog gap.
1. Print AI photo 2. Point fancy expensive camera at printed photo 3. Take a "real" photo
Then you'd see more sensors and even more expensive cameras. Then you'd see miniatured virtual-production volumes.
So, this is not a solution. It's just an arms race disguised as one.
1. augunrik · 1789883047 · focus · HN ↗
  Can you photograph a photo so it’s not really noticeable?
  1. dexen · 1789905897 · focus · HN ↗
    Yes to arbitrarily good degree with hobby grade tooling. The previous gen photo tech (b&w negative film, colour negative film) used device called enlarger† which is pretty much taking a photo of a photo.
    † <a href="https://en.wikipedia.org/wiki/Enlarger" rel="nofollow">https://en.wikipedia.org/wiki/Enlarger
  2. nolok · 1789919137 · focus · HN ↗
    I've been able to get some truly great digital copy of old analog printed photo using Google snapseed and a sub 1k€ smartphone and that was almost a decade ago, so I'm pretty sure anyone dedicated can.
2. ImHereToVote · 1789884291 · focus · HN ↗
  This would make deepfakes more expensive because you would have to tightly control the chroma and illuminance of the display.
  1. tacomagick · 1789908674 · focus · HN ↗
    Something a calibration tool surely can do I assume.
    ImHereToVote · 1790001480 · focus · HN ↗
    Fakes were always possible. Just labor intensive or costly.
WorseIsBetter · 1789898381 · focus · HN ↗
[dead]
j2kun · 1789913971 · focus · HN ↗
Zero-knowledge seems completely unnecessary. Surely the original image does not have any material content in it that is not made public by publishing a JPEG-compressed version.
Could this be simpler and more efficient without ZK?
1. progbits · 1789915527 · focus · HN ↗
  It would be interesting if it could be made to work with arbitrary transform, such as redaction.
  Imagine a photo with some blacked out rectangles, and a ZK proof that confirms it comes from an attested "real" photo + adding those rectangles, but no other modification.
2. sisuo30390 · 1789917511 · focus · HN ↗
  [dead]
3. nullc · 1789949315 · focus · HN ↗
  Generally being succinct goes hand and hand with being zero knowledge.
  The proof must be MUCH smaller than the whole computation or even the inputs (otherwise, just provide the uncompressed image!).
  And the proof has to resist forgery.
  So going for succinctness and at least computational soundness gets you to zero knowledge 'for free'.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.