Apple signs iPhone 18 Pro sensor data for verifiable Reference Images

Apple has detailed Reference Image, an opt-in capture mode debuting on the main camera sensor of iPhone 18 Pro and iPhone 18 Pro Max. In Reference mode the sensor boots into a specialised capture state and cryptographically signs the captured pixel data and sensor metadata before ordinary iPhone image processing can alter them.

The device also binds secure timing information to the capture. Apple uses cryptographic timestamp tokens to establish lower and upper bounds around when the photograph was taken, then stores the pixels, signatures, timestamps and device information in a secure digital negative. The ordinary photo can still go through the normal computational-photography pipeline alongside it.

When the user chooses to develop the reference, the signed digital negative is sent to Private Cloud Compute. PCC verifies the sensor and Secure Enclave signatures, checks that the sensor belongs to the device described by the manufacturing manifest, validates the available timestamps and then performs steps such as demosaicing, tone mapping and compression using an attested software build.

The resulting JPEG receives a composite signature combining RSA-3072 and ML-DSA-87. Apple also maintains a revocation path for individual photos and sensors, allowing clients to reject a reference image later if the underlying sensor is determined to have been compromised. Apple presents the hybrid signature and revocation design as protection for the long lifetime of published photographs.

Reference Image capture requires an iPhone 18 Pro or Pro Max. Apple provides APIs on iOS 27, iPadOS 27 and macOS 27 so third-party applications can view reference images, but regional restrictions apply at launch. Capture is unavailable in the European Union at launch, although EU users can develop and view existing reference images. In China, Apple says Reference Image will not be available at launch because of regulatory requirements.

The feature is therefore useful first as a provenance format and verification path for supported captures, rather than a universal camera standard. Adoption will depend on third-party viewers, newsroom or evidence workflows and whether Apple later expands capture availability in restricted regions.

The system is designed to establish that a displayed reference corresponds to data captured by a genuine iPhone sensor during a bounded period and processed through the documented reference pipeline. That guarantee does not establish why a scene occurred, whether it was staged, what happened outside the frame or whether a caption attached to the photograph is accurate.

Several parts of the trust model also remain Apple-operated, including manufacturing certificates, PCC, signing and revocation services. Apple publishes substantial technical detail and makes PCC builds inspectable, but independent cryptographic and operational review will be important before high-stakes users treat the system as sufficient evidence on its own.