Apple Unveils Reference Image, a Verified Photography System

Apple has introduced a system called Reference Image, designed to verify that photographs are authentic. It can confirm that an image is exactly as an iPhone captured it (newer models only), without tying the shot to any particular device or photographer. At the same time, it can establish that several images came from the same iPhone.

Anonymity instead of an author's signature

The difference from competing industry solutions lies in how authenticity is vouched for. Typically a photographer or institution signs an image using their own credentials. Apple notes that this puts some people in a hard spot — those working in conflict zones, for instance: proving a picture is genuine should not require giving up anonymity.

So Reference Image uses no explicit public credential for the photographer, and not even an implicit link between different photos taken by the same sensor. The final reference image is instead signed by Apple's signing service, after validation by Private Cloud Compute (PCC). That signature is backed by the company's strongest technical guarantees.

Confidentiality of the image, even from Apple

The implementation also protects the image itself, including from Apple. Capturing a reference image should never expose the actual pixels to the company or anyone else. This rests on the privacy properties of PCC: the nodes are architected so that not even Apple can access the image data — just as Apple cannot see the data processed for Apple Intelligence in PCC.

The revocation service must keep a private record of photo GUIDs and their associated sensors to make revocation possible, but it never has access to the image data, and the record is closed to public access. Final revocation checks run against on-device lists, so a device never reveals to anyone which photo it is checking for validity.

Source: Schneier on Security