Apple's ARI and One Developer's Answer to Proving a Photo Is Real

The author, who develops a camera app called TAPCam, wrote that he has not obtained an iPhone 18 Pro or the related API, so his description of how ARI works is based on public information and his own development experience and does not represent a complete implementation confirmed by Apple.

According to that account, ARI may sign data produced by the sensor at the moment of capture and then send the signed data to Apple's Private Cloud Compute for processing into a Reference Image. Apple has likened it to a "digital negative": kept alongside the final picture, it serves as evidence that the original data came from the device's sensor and was not altered from capture through processing to storage. The key mechanism is a digital signature, which binds data to a particular signer and lets a verifier check both who signed it and whether it changed afterwards. C2PA and similar standards address comparable problems through different mechanisms.

The essay separates authenticity into three questions: whether the file was modified, whether the capture and processing pipeline can be trusted, and whether the object in front of the lens was real. Digital signatures and secure hardware cover the first two. For the third, the author offers the example of a buyer checking a limited-edition badge. A seller could display a picture of the badge on a high-resolution screen or print it out and photograph that, and the source image itself could have been AI-generated. The photograph would genuinely have been taken through a certified pipeline, but the badge would still not exist.

His proposed addition is depth data combined with the image. A real badge has thickness, edges and three-dimensional structure, while a screen or a print is largely flat, so depth readings may expose them. Depth data has limits: a device may fail to capture it at a distance, a thin object may not register surface relief, and a fabricated physical object photographed by the camera would still pass. Depth raises the cost of faking rather than proving reality, he wrote, and Apple has not said whether ARI uses depth.

TAPCam takes a different route. It uses Apple's App Attest API, so a credential generated and protected by the Secure Enclave signs image and depth data. The credential cannot easily be exported, and a verification server checks the Secure Enclave signature; other processing happens in the user's browser to limit centralized collection of user data. The app does not rely on new hardware, runs on iOS 18.6 and later iPhones, and exposes features according to each device's actual depth capabilities. Its code and design are open source, the app is free with no in-app purchases, and the release version has been submitted for review.

On jailbroken or rooted devices, the author points to a weakness in solutions that depend on app-level interfaces: the credential is protected by the Secure Enclave, but the app must still call it through system interfaces, so an attacker on a rooted device might obtain valid signatures over data the attacker constructed. If ARI can establish a channel from sensor hardware directly to PCC, then rooting a device might not allow modification of data in that channel. He says he lacks sufficient low-level implementation information and treats this only as a possibility.

ARI depends on the new main camera in the iPhone 18 Pro series, the essay says. On whether the feature's unavailability in mainland China and the European Union is connected to cloud processing, the author writes that he is only speculating. He also notes that if only a digest were needed, a hash could theoretically be computed in secure hardware and signed without uploading the full image.

The developer wrote that he once tried to build an image community around such photographs, but most people he discussed it with, including friends and investors, saw no clear commercial value; the only funding came from a 75-dollar prize at a small hackathon. He said he was glad Apple is working on similar problems and a little sorry that TAPCam was not finished and approved sooner. His original reason, he wrote, was simple: decades from now, looking at a photograph of himself and friends eating hot pot and drinking beer, he wants to recognize the evening — where they sat, what was on the table, who held a cup, who was laughing. A photograph should preserve not just pixels but shared moments, which is why he believes image authenticity should be a basic capability rather than one reserved for those who can afford expensive devices and complex services.