Apple to Sign Photos at the Sensor With Reference Image Starting on iPhone 18

The system begins at the sensor. When light reaches the camera sensor and is converted into digital signals, the sensor captures raw pixels and signs them with an internal private key. Hardware mechanisms prevent sensor firmware from modifying the data before signing. Apple also links the sensor to the phone's Secure Enclave through a device hardware manifest, so verification can check both the pixel signature and whether the sensor and Secure Enclave belong to the same iPhone. If a sensor is compromised, Apple can revoke the authentication associated with photos from that sensor, the report said.

To establish when a photo was taken, the iPhone periodically obtains signed time credentials from Apple's cryptographic timestamp service, about every 15 minutes, and requests another credential after capture. This places the capture between two verified time points. The feature can work without a network connection at the time of capture, with the later credential added after connectivity returns, according to the report.

The raw pixels, metadata, sensor and Secure Enclave signatures, device hardware manifest and trusted time information are packaged as a Secure Digital Negative in DNG format on the iPhone. The file is then processed in what Apple describes as a trusted environment: Private Cloud Compute. PCC first verifies that the pixels, signatures, certificates, device identity and time information form a complete and consistent evidence chain. If verification passes, PCC processes the RAW data into a final JPEG and downloads it to the user's device. Deployed PCC software versions are recorded in a cryptographically protected transparency log, and corresponding binaries are published to external security researchers. Before uploading a negative, the iPhone checks that the target server is running a version recorded in the log.

After a final signature from Apple's signing service, the result is a Reference Image whose origin can be independently verified. PCC also runs a neural network to check whether the image has the physical characteristics expected from Apple camera sensor raw output and produces a confidence score. These scores, along with a photo's unique identifier and sensor ID, are sent to Apple's revocation service to monitor sensor trust. If a sensor repeatedly produces abnormal image data, Apple can identify a potential security risk and revoke photo authentication linked to that sensor.

Apple does not expose the sensor's internal identity credential in the final image. According to the report, external verifiers can see only Apple's signature indicating that the photo was captured by a trusted camera. This limits the ability to use multiple Reference Images to determine whether they came from the same device and to track a photographer, a concern for journalists or people in conflict zones.

The feature has clear limits. A user can photograph an AI-generated image displayed on a computer screen. Even if the resulting photo passes every check, the proof shows only that the camera captured the screen. It does not show that the event depicted actually happened. Apple's documentation defines the guarantee as a trusted iPhone camera sensor capturing optical data within a verified time range, with that data undergoing verifiable processing.

Apple is not the first to attach verifiable provenance to photos. Leica's Content Credentials uses dedicated secure hardware in the camera to attach a cryptographically signed credential to photo files under the C2PA standard, recording origin and later modifications, but the credential is created when the JPEG file is generated, after image processing. Google's SynthID embeds invisible digital watermarks in AI-generated content, including images, but ordinary users generally do not use verification tools to check them. Apple's approach, as described by ifanr, starts at the sensor and relies on control over camera hardware, the operating system and cloud services.