Apple Reference Image: I Attacked the Open-Source Rival

Yesterday Apple announced Reference Image — a sensor that signs every pixel at the moment of capture, an "unalterable digital negative" developed inside Private Cloud Compute, shipped with the iPhone 18 Pro. Today, an open-source counter-implementation landed on my feed: two camera hackers at the Recurse Center built Proof of Capture, a $70 Raspberry Pi camera that hides a cryptographic signature inside the pixels themselves. I cloned it, signed a photo, and spent the evening throwing 34 attacks at it. The results tell you exactly what capture-time provenance can do — and the one thing no sensor can fix.

What Apple Shipped Yesterday

The facts, from the MacRumors report: a new main-camera sensor on the iPhone 18 Pro signs sensor data at the pixel level during capture. In an opt-in "Reference" mode, that signed data goes to Private Cloud Compute, which develops it into a reference image — Apple's phrase is "like having a digital negative" — that lives next to your photo in the Photos app. Third-party apps get verification APIs in iOS, iPadOS, and macOS 27. SynthID support for identifying AI-generated and AI-edited images arrives in a software update later this year. Capture won't be available at launch in China, and EU availability is limited.

What it is not: C2PA. Nikon, Sony, Leica, and Adobe already shipped the open standard. Apple built a parallel pipeline whose root of trust is a private cloud. The Proof of Capture authors put it dryly: Apple's verification flow is "neither public nor clear yet."

The $70 Open Counter-Camera

María Benavente and Alex Hornstein's build: Raspberry Pi Zero 2 W ($18), Camera Module 3 ($35), an ATECC608 secure element ($6), an arcade button ($3), a microSD card ($8). The private key is minted inside the ATECC608 and never leaves it — the chip only answers signing requests, and bricks itself if tampered with. Under $100 all-in, fully open source.

The signature doesn't live in EXIF, because platforms strip metadata on upload. It's hidden in the pixels: the photo is normalized to 2048px width, a 64-bit perceptual hash is computed, the hash is signed with ECDSA P-256, and the 608-bit payload (32-bit magic + 64-bit pHash + 512-bit signature) is spread across the image as a DWT+DCT watermark. One payload bit per 4×4 block of the level-2 Haar wavelet LL subband of the luma channel, via quantization-index modulation — roughly 15 redundant votes per bit, resolved by confidence-weighted tally. Embedding cost: 40.5 dB PSNR, which I measured myself. Invisible, as claimed.

graph LR
  A[Capture on Pi] --> B[Normalize to 2048px]
  B --> C[64-bit pHash]
  C --> D[ECDSA P-256 sign in ATECC608]
  D --> E[Embed 608-bit payload
DWT + DCT watermark]
  E --> F[JPEG / reupload / metadata strip]
  F --> G[Extract + vote]
  G --> H{pHash distance < 10?}
  H -->|Yes| I[Authentic]
  H -->|No| J[Altered]

I Ran 34 Attacks on It. Here's the Scoreboard.

The watermark layer is a tank. I hit it with everything a messaging app or hostile platform would throw at a photo:

JPEG compression does not touch it until quality 10. A 70% downscale is free. My simulated phone screenshot — resize, Gaussian blur, sensor noise, brightness shift, q75 recompression — came back with the payload bit-perfect and a perceptual distance of zero. Verification takes 10–15 ms. Whatever else is true, the steganography engineering is legit.

The 64-Bit Blind Spot

Now the part that matters. The watermark surviving is not the goal — the hash is the proof, and the hash is only 64 bits describing the whole frame. So I blacked out increasingly large rectangles at the center and watched the distance:

• Black box over 5% × 40% of the frame → distance 2, authentic
• 15% × 40% → distance 4, authentic
• 20% × 40% → distance 6, authentic
• 40% × 40% — 16% of the entire image deleted → distance 6, authentic

A mirrored-patch splice — a classic manipulation — over 12% of the frame scored distance 2. Authentic. Their own README admits a 15%×20% edit slips under the threshold; my ladder shows the real boundary is worse. You can delete a person from a photo and the verifier says "same scene."

And the failure mode runs the other way too hard. Any rotation kills the proof — not just 90°, but a 1.5° tilt, the kind anyone applies to straighten a horizon. A 2% crop, too. Both report "no watermark found," which is indistinguishable from "never signed." An innocent edit and a cover-up produce the same output: nothing.

That's the structural problem: the robust layer and the honest layer are different layers. The watermark is nearly unkillable; the 64-bit pHash it protects is nearly blind. The system's failure asymmetry points the wrong way — heavy degradation reads as "forged signature," while real forgery reads as "authentic."

What This Predicts About Apple's Version

My simulated screenshot passing at distance zero is the receipts for the screen attack both teams already concede: photograph an AI image displayed on a screen with a capture-signed camera, and the sensor dutifully signs the fake. Apple's pixel-level sensor signing doesn't fix this either — it authenticates the camera, not the world in front of the lens. Neither system answers the question people actually have, which is "does this photo show something that happened?"

So why does the open version matter more? Because I could attack it. Apple's Reference Image is a marketing page and a blog post — my 34 attacks cannot touch it until it ships, and its verification flow is explicitly not public. Proof of Capture published a table of its own weaknesses before anyone asked. Every number in this post exists because the code was there to be run. That's the entire argument for open standards in this space, in one evening of work: you can only trust what you can attack.

Bottom Line

Capture-time provenance is real and the open implementation of it is genuinely impressive — the watermark survived everything short of quality-10 JPEG, and it costs $70 to build. But a 64-bit perceptual hash with threshold 10 is a scene-level vibe check, not a tamper detector: 16% of a frame can vanish and the verdict is "authentic," while a 1.5° rotation voids the proof entirely. Apple's Reference Image will inherit the same semantic gap with a private root of trust on top. When it ships, ask one question: can I attack it? If the answer is no, it's not evidence — it's branding.