{"slug": "apple-reference-image-but-open-source-and-using-steganography", "title": "Apple Reference Image, but open source and using steganography", "summary": "Apple introduced Apple Reference Image, a system in which a camera sensor cryptographically signs every pixel at capture time and Private Cloud Compute develops the signature into a \"digital negative\" stored alongside the photo. The announcement follows an open-source Proof of Capture camera built at the Recurse Center by Alex Hornstein and a collaborator, which hides a signed perceptual hash in image pixels via a frequency-domain watermark (DWT + DCT) and signs with a self-soldered ATECC608 cryptographic chip, buildable for under $100. The author criticizes Apple for not adopting the existing C2PA standard already used by Nikon, Sony, Leica and Adobe, and notes the root of trust stays inside Apple's Private Cloud Compute, while acknowledging that neither system stops a screen attack in which a photo of an AI image still yields a signed capture.", "body_md": "Apple Reference Image, but open source and using steganography\n\nApple introduced yesterday Apple Reference Image: a way to cryptographically prove a photo was actually taken by a camera, instead of AI generated.\nDuring my time at the Recurse Center this summer, Alex Hornstein and I (two camera lovers) built a camera with proof of capture.\n\nProve what’s real at capture time\n\nBack in 2019 I was deploying ML fact-checking tools, and even in the Will-Smith-eating-spaghetti era it was obvious that generators outrun detectors. Detection is a losing race: every improvement in the detector is training signal for the next generator.\nOur approach flips the problem: instead of trying to detect what's fake after the fact, prove what's real at the moment of capture.\n\nThe complexity of this is not at the technical level but in how to handle photo edits (should a cropped photo keep its signature?) and metadata: the moment you share an image, the EXIF gets stripped for privacy reasons, and any signature stored there is gone.\n\nSteganography and perceptual hashes\n\nFor our camera we used steganography: an invisible watermark hidden in the image pixels themselves, containing a signed perceptual hash (a hash of what the photo looks like, not its exact bytes).\nBecause nothing lives in the metadata, the signature survives compression and resizing. Our first version hid an exact SHA-256 hash in the last bit of each pixel, and any JPEG recompression destroyed it; the current one signs a pHash and spreads it across the whole image as a frequency-domain watermark (DWT + DCT), which survives WhatsApp-grade compression and still detects content edits.\n\nThe ATECC608 chip\n\nThe signing is handled by an ATECC608 cryptographic chip (self-soldered!) that holds a public key for verifying and a private one for signing.\nOnce minted, the private key never leaves the chip: not even the owner can read it. And if you tamper with it, the chip locks itself.\n\nWhat Apple is doing\n\nApple does something similar: the sensor signs every pixel at capture time. But instead of embedding the signature into the image, Private Cloud Compute develops it into a \"digital negative\" that lives next to your photo. Their verification flow is neither public nor clear yet.\n\nSomething I don't like is that they're not using the existing open standard, C2PA, already used by Nikon, Sony, Leica and Adobe. And even though they're opening APIs so platforms can verify natively, the root of trust stays inside Apple's Private Cloud Compute. Apple... (sigh)\n\nTo be fair...\n\nNeither Proof of Capture, Apple Reference Image nor C2PA fully solve the problem. For example, a screen attack still works: photograph a screen displaying an AI image and you get a signed photo of a fake. But it's always nice seeing big actors interested in addressing this problem.\nThe project is open source. You can build your own for under $100.\nClosing with a printed photo from our Proof of Capture camera. Visit the Recurse Center to see this piece of art. If you look closely enough you may see the hidden signature.", "url": "https://wpnews.pro/news/apple-reference-image-but-open-source-and-using-steganography", "canonical_source": "https://merybenavente.me/blog/proof-of-capture", "published_at": "2026-09-10 19:44:15+00:00", "updated_at": "2026-09-10 20:13:53.014278+00:00", "lang": "en", "topics": ["ai-safety", "computer-vision", "ai-policy", "ai-products"], "entities": ["Apple", "Apple Reference Image", "Private Cloud Compute", "C2PA", "Alex Hornstein", "Recurse Center", "ATECC608", "Nikon"], "alternates": {"html": "https://wpnews.pro/news/apple-reference-image-but-open-source-and-using-steganography", "markdown": "https://wpnews.pro/news/apple-reference-image-but-open-source-and-using-steganography.md", "text": "https://wpnews.pro/news/apple-reference-image-but-open-source-and-using-steganography.txt", "jsonld": "https://wpnews.pro/news/apple-reference-image-but-open-source-and-using-steganography.jsonld"}}