iOS 27 Hints at 'Apple Reference Image' Photo Authentication

Apple is working on "Apple Reference Image," a photo provenance system that will verify if an image was captured with an iPhone. References to the feature were found in a privacy disclosure included in iOS 27 beta 5, but it is not live yet.

According to the text, there will be a "Reference" mode option in the Camera app that users can select. Using this mode will embed provenance data in the image's metadata.

Images captured with an opt-in Reference mode can be authenticated to confirm they were taken with an iPhone. Authenticating is done by tapping the Reference badge on the image, which sends the raw image, sensor signatures, capture time frame, and the unique hardware identifiers of the sensor to Apple's Private Cloud Compute (PCC) servers. PCC uses the information to determine whether the camera captured the photo, gives it a unique ID, and then returns an authenticated version to the user's device.

When authenticating a photo, Apple receives sensor data, a hash, and the assessment results, but not the raw photo. Apple can refuse to authenticate images from a sensor that might be compromised, and it can retroactively revoke a sensor's past authentications.

Authenticated photos can be viewed on an iPhone, iPad, or Mac, and the Reference badge can also be clicked on a Mac. Images have to be captured in Apple's specific Reference mode to be authenticated, which suggests it's a feature aimed at pro photographers, journalists, and others who need to verify images. There may also be a video component, since Apple's disclosure mentions "photos or videos" and "uncropped footage."

Reference mode offers hardware-backed evidence that an image was captured with a physical camera sensor, which is useful at a time when AI can generate realistic-looking images. AI images are often watermarked or labeled through metadata to make sure they can be identified as fake, including images from Image Playground.

Camera manufacturers like Leica, Sony, and Nikon use C2PA Content Credentials for authentication, and Google also adopted it for the Pixel 10 lineup. Apple's authentication system sounds like it serves a similar purpose.