Apple introduced yesterday Apple Reference Image: a measurement to cryptographically beryllium a photograph was really taken by a camera, alternatively of AI generated. During my clip astatine the Recurse Center this summer, Alex Hornstein and I (two camera lovers) built a camera pinch proof of capture.
The camera: a Raspberry Pi Zero, a show board, an ATECC608 crypto chip, a shutter button, and a 3D-printed enclosure.Prove what’s existent astatine seizure time
Back successful 2019 I was deploying ML fact-checking tools, and moreover successful the Will-Smith-eating-spaghetti era it was evident that generators outrun detectors. Detection is simply a losing race: each betterment successful the detector is training awesome for the adjacent generator. Our attack flips the problem: alternatively of trying to observe what's clone aft the fact, prove what's existent astatine the infinitesimal of capture.
The complexity of this is not astatine the method level but successful really to grip photo edits (should a cropped photograph support its signature?) and metadata: the infinitesimal you stock an image, the EXIF gets stripped for privateness reasons, and immoderate signature stored location is gone.
Steganography and perceptual hashes
For our camera we utilized steganography: an invisible watermark hidden successful the image pixels themselves, containing a signed perceptual hash (a hash of what the photograph looks like, not its nonstop bytes). Because thing lives successful the metadata, the signature survives compression and resizing. Our first type hid an nonstop SHA-256 hash successful the past spot of each pixel, and immoderate JPEG recompression destroyed it; the existent 1 signs a pHash and spreads it crossed the full image arsenic a frequency-domain watermark (DWT + DCT), which survives WhatsApp-grade compression and still detects contented edits.
Simplified illustration: LSB replacement is shown for clarity, the existent embedding spreads the signature crossed a DWT + DCT watermark.The ATECC608 chip
The signing is handled by an ATECC608 cryptographic spot (self-soldered!) that holds a nationalist cardinal for verifying and a backstage 1 for signing. Once minted, the backstage cardinal ne'er leaves the chip: not moreover the proprietor tin publication it. And if you tamper pinch it, the spot locks itself.
What Apple is doing
Apple does thing similar: the sensor signs each pixel astatine seizure time. But alternatively of embedding the signature into the image, Private Cloud Compute develops it into a "digital negative" that lives adjacent to your photo. Their verification travel is neither nationalist nor clear yet.
Apple Reference Image: comparison the authenticated seizure against the photograph to spot if it was altered. [source]Something I don't for illustration is that they're not utilizing the existing unfastened standard, C2PA, already utilized by Nikon, Sony, Leica and Adobe. And moreover though they're opening APIs truthful platforms tin verify natively, the guidelines of spot stays wrong Apple's Private Cloud Compute. Apple... (sigh)
To beryllium fair...
Neither Proof of Capture, Apple Reference Image nor C2PA afloat lick the problem. For example, a screen attack still works: photograph a surface displaying an AI image and you get a signed photograph of a fake. But it's ever bully seeing large actors willing successful addressing this problem. The task is open source. You tin build your ain for under $100. Closing pinch a printed photograph from our Proof of Capture camera. Visit the Recurse Center to spot this portion of art. If you look intimately capable you whitethorn spot the hidden signature.
"Trust me, this photograph is 100% authentic. Signed."
English (US) · 
Indonesian (ID) · 
