捕获证明：Apple 参考图像，但采用开源方案并使用隐写术。

捕获证明：Apple 参考图像，但采用开源方案并使用隐写术。
Proof of Capture: Apple Reference Image, but open source and using steganography

原始链接: https://merybenavente.me/blog/proof-of-capture

随着人工智能生成图像的发展速度超过了检测工具，焦点正转向“拍摄证明”（Proof of Capture），即在源头验证真实性。受此挑战启发，作者与亚历克斯·霍恩斯坦（Alex Hornstein）利用树莓派（Raspberry Pi）和 ATECC608 加密芯片制造了一款开源相机。与容易被剔除的传统元数据不同，他们的方法使用隐写术将经过签名的感知哈希值直接嵌入图像像素中。这种水印在压缩和调整大小后依然存在，使得照片即使在分享后仍可验证。此项进展与苹果公司新推出的“参考图像”（Reference Image）工具同期出现，该工具通过创建“数字底片”来验证相机拍摄的内容。然而，作者对苹果的专有方案表示担忧，认为它绕过了行业标准的 C2PA 框架，并将信任根集中化。虽然这两种方法都非万灵药——“屏幕攻击”（拍摄显示屏上的虚假图像）仍是一个漏洞，但这些举措是恢复数字来源可追溯性的关键一步。作者的项目是开源的，允许任何人以不到 100 美元的成本制作自己的验证相机。

抱歉。

Apple introduced yesterday Apple Reference Image: a way to cryptographically prove a photo was actually taken by a camera, instead of AI generated. During my time at the Recurse Center this summer, Alex Hornstein and I (two camera lovers) built a camera with proof of capture.

Hand holding the display PCB over the 3D-printed camera enclosure with a Raspberry Pi Zero inside — The camera: a Raspberry Pi Zero, a display board, an ATECC608 crypto chip, a shutter button, and a 3D-printed enclosure.

Prove what’s real at capture time

Back in 2019 I was deploying ML fact-checking tools, and even in the Will-Smith-eating-spaghetti era it was obvious that generators outrun detectors. Detection is a losing race: every improvement in the detector is training signal for the next generator. Our approach flips the problem: instead of trying to detect what's fake after the fact, prove what's real at the moment of capture.

The complexity of this is not at the technical level but in how to handle photo edits (should a cropped photo keep its signature?) and metadata: the moment you share an image, the EXIF gets stripped for privacy reasons, and any signature stored there is gone.

Steganography and perceptual hashes

For our camera we used steganography: an invisible watermark hidden in the image pixels themselves, containing a signed perceptual hash (a hash of what the photo looks like, not its exact bytes). Because nothing lives in the metadata, the signature survives compression and resizing. Our first version hid an exact SHA-256 hash in the last bit of each pixel, and any JPEG recompression destroyed it; the current one signs a pHash and spreads it across the whole image as a frequency-domain watermark (DWT + DCT), which survives WhatsApp-grade compression and still detects content edits.

Diagram: a photo’s pixel color channels feed a crypto chip, which produces a signature string embedded into the least significant bits of the image — Simplified illustration: LSB replacement is shown for clarity, the actual embedding spreads the signature across a DWT + DCT watermark.

The ATECC608 chip

The signing is handled by an ATECC608 cryptographic chip (self-soldered!) that holds a public key for verifying and a private one for signing. Once minted, the private key never leaves the chip: not even the owner can read it. And if you tamper with it, the chip locks itself.

The ATECC608 secure element.

What Apple is doing

Apple does something similar: the sensor signs every pixel at capture time. But instead of embedding the signature into the image, Private Cloud Compute develops it into a "digital negative" that lives next to your photo. Their verification flow is neither public nor clear yet.

Three iPhone screens showing Apple’s Reference Image flow: the photo, the authenticated reference image, and the comparison view — Apple Reference Image: compare the authenticated capture against the photo to see if it was altered. [source]

Something I don't like is that they're not using the existing open standard, C2PA, already used by Nikon, Sony, Leica and Adobe. And even though they're opening APIs so platforms can verify natively, the root of trust stays inside Apple's Private Cloud Compute. Apple... (sigh)

To be fair...

Neither Proof of Capture, Apple Reference Image nor C2PA fully solve the problem. For example, a screen attack still works: photograph a screen displaying an AI image and you get a signed photo of a fake. But it's always nice seeing big actors interested in addressing this problem. The project is open source. You can build your own for under $100. Closing with a printed photo from our Proof of Capture camera. Visit the Recurse Center to see this piece of art. If you look closely enough you may see the hidden signature.