Apple unveils system to cryptographically verify iPhone photos without revealing device identity

Apple announced a system called Reference Image designed to cryptographically verify that photos were taken by a new-model iPhone without associating the image with a specific device or photographer. The system is limited to images captured on recent iPhone models.

The verification process signs each photo using Apple’s signing service after validation by a privacy-preserving component referred to as PCC. Apple states the signature is backed by its strongest technical guarantees, and that PCC’s architecture prevents even Apple from accessing the image pixels.

Apple says the system can verify that multiple images came from the same iPhone, but is engineered so an outside observer cannot determine whether any pair of reference images were taken by the same device. If a device is later found to be compromised, images from that device can be revoked and flagged retroactively without revealing which images came from the same sensor.

Revocation checks are performed on-device using private lists, meaning a device never reveals which photo it is inspecting to determine its validity. The revocation service maintains a private record of photo identifiers and associated sensors for revocation purposes, but does not expose image data or allow public access to this record.

The system is positioned as an alternative to industry practices where a photographer or institution vouches for an image using their own credentials, a requirement Apple argues can endanger photographers in conflict zones or other high-risk contexts.