Loading story…
Apple introduced Reference Image, an opt-in provenance feature for the iPhone 18 Pro and iPhone 18 Pro Max that is intended to prove an image originated in an iPhone camera and was not subsequently altered. In Reference mode, the main sensor cryptographically signs pixel data immediately after capture, before software processing; the phone retains a secure digital negative locally and uses Private Cloud Compute to render an unprocessed version for private validation. Apple says it retains hashes rather than reference photographs, does not publicly identify photographers or correlate images from the same sensor, and can revoke compromised photos or sensors if fraud is detected.
The feature is designed to help recipients compare a reference image with an edited image and detect manipulation or AI-generated content, but its initial scope is limited to specified iPhone models, regions, and Apple-device viewing. Critics note that Apple has not published the sensor-attestation and cryptographic design for independent review, retains central authority to invalidate provenance data under defined security conditions, and does not use 3D depth information to prevent “photo of a photo” attacks. Apple argues its hardware-based approach offers stronger protection against data injection, OS compromise, hardware tampering, and cryptographic attacks than software-only alternatives.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Apple introduced the opt-in Reference Image feature for iPhone 18 Pro and iPhone 18 Pro Max, designed to provide verifiable evidence that Main-camera photos were captured by the device and were not subsequently altered or AI-generated. The system signs sensor pixel data at capture, retains a secure digital negative, and can use Private Cloud Compute to render an image for validation; Apple also outlined initial device, regional, and viewing limitations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple introduced **Apple Reference Image**, an opt-in photo-authenticity capability for the iPhone 18 Pro and iPhone 18 Pro Max. In Reference mode, the phones’ new Main camera sensor signs image data at the pixel level during capture; Private Cloud Compute then develops that data into an unalterable reference image intended to serve as a digital negative. The Photos app displays the reference image beside the corresponding photograph, enabling users to compare it against later edits, and APIs for iOS, iPadOS, and macOS 27 will let third-party applications display the reference asset. The feature arrives with Apple’s iPhone 18 Pro lineup, which runs iOS 27 and is scheduled to be available beginning September 18, 2026. Apple plans to add **SynthID** support later in 2026 to help identify AI-generated or AI-edited images. Reference Image will not be available at launch in China, while capture will be unavailable at launch in the EU; EU users can nevertheless develop and view existing reference images on Apple operating systems version 27.
Sep 10, 2026Google has introduced C2PA Content Credentials in the Pixel 10 camera and Google Photos to provide verifiable provenance for digital images. This system uses cryptographic signatures, hardware-backed security, and on-device trusted timestamps to ensure authenticity and privacy. The move aims to increase transparency and trust in digital media, especially in the context of AI-generated or altered content.
Jun 29, 2026
Apple has released the post-quantum cryptography components of its `corecrypto` library as open source, publishing implementations of the NIST-standardized **ML-KEM** and **ML-DSA** algorithms alongside mathematical proofs, documentation, and verification tooling for independent review. The company said `corecrypto` underpins encryption, hashing, random number generation, and digital signatures across more than 2.5 billion active devices, and that post-quantum protections introduced in 2024 are already used in **iMessage**, VPN services, and TLS networking, including the **PQ3** messaging protocol Apple previously described as a large-scale quantum-secure design. Apple said it validated the code through a hybrid assurance model combining conventional testing, simulation, independent review, and formal verification, using a workflow that linked portable C implementations to **Cryptol** and **Isabelle** proofs with support from Galois. According to Apple, that process uncovered a subtle early **ML-DSA** flaw that could rarely produce incorrect output and likely would have escaped standard testing; the issue was fixed before deployment. The release is intended to make Apple’s analysis reproducible and give outside experts a chance to scrutinize security-critical cryptographic code as organizations prepare for future quantum threats.
Jun 29, 2026