Apple Just Solved Fake Photos? (Reference Image)

0:00 Apple shipped a camera sensor that signs every pixel it sees. That's Apple's own sentence, word for word, from the press release on September 9th. The foldable iPhone duo took the headlines. This sat

0:11 further down the page. It's called Apple reference image, and I think it's the most interesting thing in the iPhone 18 Pro. I went looking for one answer. Does this finally let you catch the fake

0:21 photos in your feed? Not the way you're hoping. Not close, actually. What you get instead is serious engineering aimed a few degrees away from the problem you think it solves. So, let's take it apart

0:32 properly. First, how the signing works, then the four places it breaks. One of those four is so simple, you'll be annoyed. Start with what a photo even is on a phone. The sensor reads out raw

0:42 values, then the image pipeline turns those values into the picture you look at. By pipeline, I just mean the chain of software steps between the sensor and the file you keep. Then sharpening, tone

0:53 mapping, a dozen more passes. Every stage of that is software. And software is exactly where you'd insert a fake. So, Apple moved the proof earlier than the software, earlier than the pipeline,

1:04 down to the readout itself. In the 18 Pro's main camera, there's a new sensor, and Apple's claim is that it can sign every pixel it sees. Here's the whole flow in five steps. Step one, you switch

1:16 the camera app into a new reference mode. It's off by default, and you have to choose it. Step two, you take the shot. The camera captures signed sensor data and provenance data, which just

1:26 means a record of where the picture came from goes into the photos metadata. Step three is the part that surprised me, because it doesn't happen at capture. It happens later, when you actually need

1:36 the proof. You tap a reference badge on the photo. That sends four things to Apple's private cloud compute. The raw image, the sensor signatures, the capture time frame, and the unique

1:46 hardware identifiers of that specific sensor. Step four, the servers work out whether that camera really did capture that image, give the photo a unique ID, and develop the signed sensor data into

1:57 what Apple calls an unalterable reference image. And develop is the right word, by the way. A raw sensor read isn't a picture yet. It's a grid where each cell has only seen one color.

2:07 So, turning that into full color pixels means working out the other two from its neighbors. That guess is called demosaic, and it's the develop step Apple is running on a server. Step five,

2:18 the reference comes back and sits in photos next to your edited shot. Apple's own comparison is a digital negative. You put the two side by side, and the difference between them is the evidence.

2:29 So, say you shoot one frame on the 48-megapixel fusion main camera wide open at F/1.48 in reference mode. You edit the export and take a sign out of the background. Then you tap the badge,

2:40 and private cloud compute hands you back the reference. In photos, the sign is still standing in the negative and missing from the edit. That gap is the entire argument. Why route any of it

2:50 through a server, though? Apple hasn't said. What we know is what the phone sends, and that verifying your own photo needs a round trip to Apple to happen at all. But sharing does work inside the

3:00 family. Reading the iOS 27 beta, 9to5Mac found an authenticated photo can be checked locally by another Apple device without telling Apple you looked. But most of the coverage skipped one thing.

3:12 There was already a standard for this, and Apple didn't use it. It's called C2PA, content credentials in the marketing. And by 9to5Mac's count, over 500 companies are in it, including most

3:23 of the camera industry. Google put it in silicon. On Pixel 10 and Pixel 11, every photo out of the stock camera app is signed by default. No mode, no badge, no decision. The signing key is generated

3:35 and stored inside the Titan M2 security chip. So, the private key never leaves tamper-resistant hardware. And Tensor G5 runs the crypto inside the normal capture pipeline, so it costs you

3:46 no perceptible delay. Google's camera app is certified at C2PA assurance level two, the highest level the conformance program currently defines. And there's one line in Google's

3:56 security post I keep thinking about. One key, one certificate, one image. Every single photo gets its own. Pixel also keeps a trusted clock in a secure environment isolated from Android, so a

4:08 photo taken with no signal still carries a timestamp that holds up after the certificate expires. So, say you pull out a Pixel and take one photo. There's no mode to remember. The capture signs

4:19 it with one key and one certificate signed that image and nothing else. And the isolated clock stamps the time even with no signal. The signed record then travels inside the file itself. So, any

4:29 validator can read it without asking Google. So, put the two designs next to each other and the cryptography isn't where they part company. The defaults are Google signs everything and asks you

4:39 nothing. Apple signs what you remember to switch on. On a Pro phone, where the regulators allow it, China doesn't get it at launch. In the EU, you can't capture a reference

4:49 image at launch, though you can still develop and view one, which leaves the question I couldn't shake. If a signature only exists when somebody remembered to turn it on, what does the

4:58 absence of one actually prove? So, onto where it breaks. Break one is the oldest trick in copy protection and it works embarrassingly well here. You put an AI generated image

5:09 on a decent monitor, point the iPhone at the screen, and shoot it in reference mode. The sensor really did see those pixels. The signature checks out. The photograph is real. The scene is not.

5:20 This is the analog hole and C2PA's own security document names the same family of failure. Optical illusions for cameras, where the device correctly records what came through the lens and

5:30 the conclusion is still false. Provenance proves where pixels came from. It has never once proved that a scene was true. Break two is the internet itself.

5:40 Instagram, Facebook, and X re-encode whatever you upload and the signed metadata doesn't survive the trip. LinkedIn and TikTok keep it and show a label, but almost everywhere else it's

5:50 gone the moment you post. The specification is blunt about this in writing. C2PA does not offer any protection against the complete removal of C2PA manifest from assets. Apple's

6:01 version sits somewhere stranger. As of today, Apple has published no file format, no export path, and no verifier that runs anywhere except in Apple device. The only way to inspect a

6:12 reference image is to open it in photos or in an app using the new iOS, iPadOS, and macOS 27 APIs. That leaves the rest of the world with a picture and your word. Break three

6:24 already happened to somebody else and it's the one that should worry you most. Nikon put C2PA into the Z 6 3 in a firmware update. A contributor on Nikon Rumors found that multiple exposure mode

6:35 would merge a signed frame with an unsigned one and then sign the result. They use it to make the camera certify an AI-generated image of a pug flying a jet. Nikon suspended the feature on the

6:46 5th of September 2025 and revoked every certificate it had issued on the 21st. Now the part that matters. In April this year, a team at UMBC published a security analysis of the C2PA

6:58 specifications. They found that checking whether a certificate was revoked, meaning canceled after the fact because it turned out to be bad, is optional in the spec. And when you do check, only

7:08 one method is permitted because revocation lists are expressly forbidden. So months after Nikon pulled those certificates, Adobe's inspection tool still reported one of the

7:18 signatures as valid. A second validator called the same file invalid. Not one of them mentioned the revocation. A signature nobody revalidates is a sticker. Break four is the one I think

7:28 is actually new and it comes from stacking two good ideas. There are now two layers of proof on a picture and they don't talk to each other. Two layers. Provenance lives in the metadata

7:39 and watermarks to in the pixels. Apple is adding Synth ID, which is Google's Pixel watermark, to Apple intelligence images later this year. Google says Synth ID has already marked over 100

7:50 billion images and videos. In March, researchers at Case Western and UCLA showed exactly what happens when those two layers disagree. They generated 500 AI images,

8:01 watermarked everyone, then signed them with a manifest that declared human editing only. The specification permits that omission. Both checks pass. The meta data says a person made it. The

8:11 pixels say a model did. Each verifier is correct inside its own world, and together they certify a lie. Their fix needs no new cryptography at all. Just read both layers in the same pass and

8:23 flag the contradiction. In their test, that caught every contradictory case. Nobody ships it yet. So, here's where I land. For the open internet, Google's approach wins, and it isn't close. On by

8:34 default beats opt in every single time, because a system that asks you to predict in advance which photograph will be disputed, protects almost nothing. That's not how disputed photographs

8:44 happen. But, for one specific person, Apple built the better artifact. If you're a photojournalist with a contested frame, or you're handing a picture to a court, a per-pixel sensor

8:54 signature plus a developed negative beats a metadata manifest, and that isn't close either. It also does something the metadata layer structurally can't. C2PA validates

9:04 signatures. It doesn't look at pixels. The reference image is pixels. If a model repainted the sky, the negative still has the old sky in it. I'd take that at twice the price if I shot news

9:14 for a living. I just wouldn't tell anyone it fixes the feed. Neither company is the villain here. The villain is an idea, that shipping strong cryptography is the same

9:23 thing as solving a trust problem. A signature is a fact about a file, and belief is something that happens in a person. Those are different machines. A portrait photographer called Glyn Dewis

9:33 wrote a line this week I haven't managed to improve on. A camera can faithfully photograph a misleading situation. They named the trap underneath all of this, too. The people who opt in may gain a

9:43 useful way to support their work, whilst everybody else could find themselves under suspicion for no good reason. The brief that started this video wondered whether platforms might begin favoring

9:53 signed originals in the ranking. They might. No platform has announced anything like it, so treat that as a hope and not a plan. What's real is the pressure, because since the 2nd of

10:03 August, the EU's AI Act has required AI output to be marked in a machine-readable format. The plumbing is going in either way, which leaves the question worth arguing about. What does

10:14 an unsigned photo become once signing is normal? Because that's the setting we're choosing by default. For every camera that can't do this, every source is in the description, dated.