Starting from iPhone 18, Apple will add an "invisible" watermark to your photos.

About two hundred years ago, Frenchman Nicéphore Niépce placed a pewter plate coated with photosensitive material into a camera obscura and pointed it out the window. 

Light passed through the lens and landed on the metal plate. After a long exposure, the scenery outside the window left faint traces of light and shadow. This photograph *View from the Window at Le Gras* is generally recognized as the earliest surviving camera photograph. 

Nearly two hundred years have passed since then, and photography technology has undergone countless iterations. Its core principle has never changed: real-world objects reflect or emit light, which passes through the lens and leaves a trace on the photosensitive medium. 

The etymology of the word "photograph" is exactly "light drawing / light image" (photo-graph). This term itself implies that the moment captured in the frame once truly existed. 

Yet in the two centuries since the birth of photography, the mapping of photographs to "reality" has long been eroded. 

If you have watched the film *The Silent Friends*, the technique of manually retouching negatives shown in it was already popular in the late 19th century. With the advent of the digital age, the widespread use of Photoshop hardly needs further elaboration; and in today's era of surging generative AI, the taken-for-granted connection between a "seemingly realistic" photo and the real world has long ceased to exist. 

How can we prove that a photo truly comes from the real world? 

As the manufacturer of the most widely used camera devices in the world, Apple has offered its own answer — Apple Reference Image. 

Photo | Apple 

Engrave the "watermark" into the sensor

Marking the source of images is not a new concept. The most intuitive method is to leave visible labels on AI-generated images, a typical example of which is the watermark on Doubao's generated outputs that most people are familiar with. 

Visible watermarks have an obvious flaw: cropping, retouching, or even simply feeding the image to another AI can make the watermark disappear completely from the frame. 

In recent years, Google's SynthID technology has gained popularity in the fields of AI anti-counterfeiting and AI identification, and is adopted by companies including Google itself, Anthropic, and OpenAI. It is a full set of "invisible watermark" technologies covering multiple modalities such as text and images. Specifically for images, it embeds digital watermarks that are invisible to the naked eye into the picture. 

However, it still has limitations in recognition: for example, ordinary users do not know how to use the SynthID verification tool to check the authenticity of a photo or a piece of text, nor will they take the trouble to do so. 

Since it is getting increasingly difficult to judge whether an image is real or fake, instead of continuously marking AI-generated content as "fake", another line of thinking is: 

Leave proof of "authenticity" for photos that are truly taken by cameras. 

This is exactly the core idea of Apple Reference Image. 

Of course, adding a "watermark" to a real photo is not as simple as stamping a "Shot on iPhone" mark on the picture. 

After all, why should we trust that the photo before stamping is real? If a photo has been fully processed and the JPEG file is generated before the system attaches an unforgeable credential to it, this credential can only prove at most that the photo has not been modified after the stamping process. As for whether it was replaced or tampered with before stamping, the credential itself cannot answer that question. 

To make this proof truly credible, the starting point of trust must be pushed further back, all the way to the point where digital photography is closest to the real world — 

the sensor. 

When light passes through the lens and reaches the camera sensor, where it is converted into digital signals, the real world enters the mobile phone in the form of pixel data for the first time. 

Apple chooses to establish the starting point of trust right here. 

We call it a "watermark", but in fact it is a cryptographic signature provided by the sensor for the captured data. When the Reference Mode is enabled on iPhone 18 Pro and iPhone 18 Pro Max, the main camera sensor will enter a dedicated secure capture mode. 

The sensor captures the raw pixels and immediately signs these raw data with its internal private key. The hardware mechanism will also prevent the sensor firmware from modifying these data before the signature is generated. 

In this way, the signature protects not only what the sensor outputs, but also the relationship between the image data it outputs and the actual capture result. 

From a single photo to a full chain of trust

Apple is by no means the inventor of trusted photography technology. Traditional camera manufacturers have previously tried to attach verifiable source credentials to photos. Leica's Leica Content Credentials is a typical example. 

Photo | Leica 

After enabling the function, the camera uses the dedicated secure hardware inside the device to attach a cryptographically signed credential to the generated photo file. It adopts the C2PA standard, which can record the source of the photo and subsequent modifications. 

It is worth noting that the time point when this credential is generated is when the JPEG photo file is created. 

From the moment the sensor captures the raw pixels to the generation of the final file, the image has gone through a series of processing steps. 

If the data is replaced or tampered with before the signature is generated, even if the final file obtains a valid signature, it may not be faithful to the original frame captured by the sensor. 

This is also the problem that Apple tries to further solve with Reference Image: How to build a verifiable trust chain that runs from the original capture to the final output photo? 

First of all, the system must confirm that the sensor that generated the signature indeed belongs to this specific iPhone. 

During the production phase, the sensor will generate a unique private key. The private key stays inside the sensor, while the public key is used to verify the signature. 

The iPhone's Secure Enclave will also establish an independent signing identity. Apple records both as components of the same iPhone through the device hardware inventory. 

During verification, the system can not only check the sensor signature of the pixels, but also verify that the sensor and the Secure Enclave belong to the same factory-shipped device — only when the two match each other, the device identity verification step can be passed. 

Of course, we cannot fully guarantee that "entering from the sensor" is absolutely secure, and Apple does not assume that the sensor itself will never be breached. 

If an attacker successfully compromises a certain sensor and obtains its private key, it is possible to use this key to generate a valid signature for forged image data. 

Therefore, Reference Image also designs a revocation mechanism: once it is found that the security of a certain sensor is compromised, Apple can revoke the authentication of all photos associated with it, so that these photos are no longer regarded as having a trusted source. 

In other words, even if the starting point of the trust chain is breached, Apple still retains the ability to invalidate the authentication of related photos, preventing a leaked private key from becoming a permanent pass for forged photos. 

To be honest, this level of strictness has little practical significance, but Apple has taken device-level encryption verification for photos to such an extreme level. 

After the device identity is confirmed, we also need to know when the photo was taken. 

The EXIF data of ordinary photos records the shooting time, but it usually relies on the device clock. Users can manually modify the time, and a compromised operating system may also provide false time information. 

Photo | Discover Digital Photography 

Therefore, Reference Image also requires a time reference independent of the system clock. 

IPhones periodically obtain signed time credentials from Apple's cryptographic timestamp service, on average every 15 minutes globally; after the shooting is completed, another new time credential will be requested. 

Two trusted time points sandwich the shooting behavior in between. Apple cannot prove that the photo was taken at a specific second, but it can prove that it was generated between these two verified time points. 

In other words, Reference Image provides a "relatively vague but absolutely credible" timestamp. Even if there is no network during shooting, the second time credential can be supplemented after the network connection is restored. 

At this point, the raw pixels captured by the sensor, related metadata, signatures from the sensor and Secure Enclave, device hardware inventory, and trusted time information will be packaged into a Secure Digital Negative, which is stored in the iPhone in DNG format. 

But this digital negative is not the final photo we see. 

Converting RAW to JPEG requires a series of image processing steps. If the imaging process is tampered with, the trusted relationship established earlier may be destroyed at the last step. 

Therefore, this digital negative needs to be "developed" in a trusted environment. Apple assigns this step to Private Cloud Compute (PCC). 

When a user chooses to generate a Reference Image, PCC will first verify the raw pixels, signatures, certificates, device identity and time information to confirm that they form a complete and mutually consistent chain of evidence. After the verification is passed, PCC will process the RAW data to generate the final JPEG and download it locally to the user's device. 

This process is very "retro": it is just like you actually shot a roll of film (corresponding to Apple's Secure Digital Negative), and then sent the film to a photo lab (corresponding to Apple's PCC server) to complete the development. 

But why should we trust that Apple's cloud service is a "trusted environment"? 

Apple's solution is to make the cloud service itself a verifiable object, rather than relying solely on Apple's unilateral endorsement. 

The officially deployed software version of PCC will be recorded in a cryptographically protected transparent log