Apple explains how iPhone 18 Pro’s Reference Image mode verifies photos

Apple has explained the security system behind Apple Reference Image, an opt-in camera mode on iPhone 18 Pro and iPhone 18 Pro Max. It is designed to preserve evidence of the pixels the camera sensor captured, even as synthetic and edited images become harder to distinguish from originals.

Reference Image can help verify a photo’s capture history. It cannot prove that the scene itself was real or that the subject in front of the camera was genuine.

The camera signs the pixels immediately

In a technical post from Apple’s Security Research team, Apple says the iPhone 18 Pro’s main camera sensor boots into a specialized Reference Image mode. The sensor cryptographically signs the pixel data immediately after capture and prevents firmware from changing it first.

The sensor metadata is signed too. The Secure Enclave Processor adds its own signature to device-generated information, such as the focal length and the boundaries used for digital zoom. Together, those records form a protected digital negative containing the pixels, sensor details, and secure timestamp bounds.

Apple’s timestamp system is designed to show when the image could have been captured. The device receives a cryptographic timestamp token through an Apple Push Notification service heartbeat, then asks for another token after taking the photo. Apple says the heartbeat averages about every 15 minutes, though network conditions can change that interval.

Private Cloud Compute develops the reference image

The signed digital negative is sent to Private Cloud Compute for steps such as demosaicing, tone mapping, and compression. Apple says the service can be verified through device attestation and an append-only log, while the system is designed to keep the image data private.

Apple says the final signature combines RSA-3072 with ML-DSA-87, a post-quantum signature algorithm. That technical combination matters less to most people than the result: the finished Reference Image is tied to signed sensor data instead of being an ordinary image file that can be silently changed after capture.

In Photos, the reference version appears alongside the regular photo. Apple’s iPhone 18 Pro announcement says developers can also work with the format through APIs on iOS 27, iPadOS 27, and macOS 27.

What Reference Image can and cannot prove

The mode can help answer whether the pixels came from a compatible iPhone sensor and whether the signed capture data has been altered. It can also expose edits that break the provenance record.

It does not establish that the scene was truthful. If you photograph an AI-generated image on another screen, Reference Image can show that your iPhone sensor captured those pixels. It cannot tell you whether the face, document, or event shown on that screen was authentic.

That distinction is important. The feature is closer to a signed digital negative than a truth detector. For ordinary photos, our guide on how to get photo metadata on an iPhone explains what information a photo can carry and how to inspect it.

How to turn it on

Reference Image is opt-in and works through the iPhone 18 Pro main camera. Apple Support lists these steps:

1. Open Settings and tap Camera.
2. Tap Reference Image, then Add Reference Mode.
3. Open Camera and swipe to Reference.
4. Take the photo.

The mode is not available in every region. Apple says capture is unavailable in the European Union and China at launch, although people in the EU can still develop and view reference images on supported Apple devices. Check Apple’s current Reference Image instructions if the setting does not appear.

For more camera and hardware context, see our iPhone 18 Pro guide. Reference Image is a useful provenance feature, but its strongest claim is narrow: it helps show what the sensor captured, not whether the world looked exactly as the image suggests.