Apple Reference Image explained through Anti-Doping

Down to the sealed sample, the anonymised lab, and the medal taken back years later

An athlete crosses the line and a stranger introduces themselves. From that moment until the sample is sealed in a bottle, the stranger does not look away. Not once, not discreetly, not while the athlete gets changed. The technical term for this person is chaperone, and the entire credibility of anti-doping rests on a single property: there is no gap between the moment the sample exists and the moment it is sealed.

On 15 September 2026, Apple’s security engineering team published the design document for the same idea applied to photographs.

Most coverage reached for the word cryptography and then went vague. The cryptography here is mostly ordinary; the choreography is the interesting part. What Apple has built is a chain of custody, and we already have a mature, scandal-tested one in public life. It runs at every Olympics, and reading Apple’s design against it explains almost everything, including the two places where it should worry you.

The chaperone

The weakness in every provenance system is the gap. Hand an athlete a bottle, send them off to fill it and bring it back, and the seal proves nothing because everything worth knowing happened while nobody was watching.

You might assume that gap is where the existing standard sits, and that would be unfair to it. C2PA, the Content Credentials system, has been signing photographs inside the camera since the Leica M11-P arrived in 2023, using a tamper-resistant chip holding a key installed at the factory, with the credential written into the file before it ever reaches the memory card. Sony followed with its signing key provisioned during manufacturing, and other makers have since joined. Nobody is bolting provenance on afterwards.

The argument is about how much of the chain the seal covers. A camera doing C2PA in hardware signs what comes out of its image processor, which leaves the ribbon between the sensor and that processor, and the processor’s own firmware, inside the trust boundary and unattested. Apple names both openings: spoofed pixel data injected “onto the data transport from the sensor”, and an operating system compromise that can “completely alter the image before signing”. In doping terms, everyone seals the sample at the point of collection. The question is how many hands it passes through first, and whether you were allowed to watch them.

The obvious fix is to sign the raw sensor output instead, and Apple rejects that too, for the reason that turns out to be the hinge of the design. Raw sensor values need demosaicing, lens shading correction and tone mapping before a human can look at them. Sign the raw data and you have authenticated something nobody can see; sign the finished image and you have authenticated something a compromised operating system could have rewritten. In Apple’s words, “neither signing raw sensor values, nor delaying signing until the photograph is processed, meets our bar for semantic authenticity.”

The answer is to split the problem: create a secure digital negative, then develop it.

Creating the negative starts with the sensor booting into a dedicated reference mode, which “instructs the sensor to cryptographically sign pixel data immediately after capture, and prevents the sensor firmware from modifying the data.” The sensor can sign because it has an identity of its own. On first initialisation in the factory, it generates an ECDSA P-256 key pair, hands over only the public half, and never releases the private one. A factory certificate authority signs that public key into the device’s hardware manifest.

Then comes the detail I find genuinely elegant. In reference mode the sensor accepts exactly one input from the operating system: a SHA-256 digest, computed over the most recent secure timestamp, the device manifest and the secure boot manifest. That digest gets embedded at a fixed location in the frame’s metadata, and then, as Apple puts it, “the digitized frame and the embedded metadata digest are signed together, inside the sensor, with the sensor’s private key.” The operating system is reduced to passing a single hash through a slot. It cannot touch the pixels, and it cannot separate the pixels from the context they were captured in.

The Secure Enclave signs the rest: the values that cannot come from the sensor because they describe the camera around it, such as exposure, digital zoom and lens parameters. Its key is certified by Apple’s Basic Attestation Authority. A third certificate authority signs the device manifest, binding the sensor key and the enclave key together as belonging to the same iPhone, which is how the system later resists someone desoldering a sensor and wiring it into different hardware.

The doping control room does the same job with paper. The athlete and the officer both confirm that the code numbers on the bottles, the lids and the box all match, and both sign the form. Two parties attest to the same object at the same moment, so neither can later claim the other swapped it.

Two bounds on time

Knowing when a photograph was taken often matters as much as knowing what it shows, and here Apple has built something genuinely unusual. Not because cryptographic timestamps are new, though. They are among the oldest furniture in this room: RFC 3161, the very token format Apple uses, was published in August 2001, and trusted-capture systems have been signing provenance data for years. What is new is the shape of the claim.

Apple’s complaint about earlier work is narrower than it first sounds. Prior systems, it says, took a timestamp “provided by the general device operating system”, which is to say from a clock the phone’s owner can set to whatever they like. Apple instead gives you an interval, anchored outside the device at both ends and bound into the signature the sensor itself produces, and guarantees the capture happened inside it.

The lower bound arrives before the photograph does. Apple Push Notification Service already runs a heartbeat to keep its connection alive, and it now carries an RFC 3161 timestamp token from Apple’s timestamp service, signed with ECDSA P-256 over SHA-256. The device keeps the most recent one, refreshed on average every fifteen minutes depending on the network. That token is baked into the digest the sensor signs, so the photograph provably came after it.

The upper bound arrives afterwards. Once the frame and its signatures exist, the device hashes the Secure Enclave’s signature and sends the commitment to the timestamp service, which returns a token establishing that the photograph already existed at that moment. Offline, no upper bound is available yet, and a background process keeps retrying until it gets one, producing the tightest interval the circumstances allow.

This is the doping control form’s collection time, written by someone other than the athlete, and it is strictly better than what came before it. There is even a fallback that reads like a shrug: if the lower bound fails verification, Apple substitutes 31 March 2026, on the grounds that the feature did not exist before then and no photograph can predate it.

The lab only sees a number

Here is the detail that convinced me the comparison is structural rather than decorative.

When a doping sample reaches the laboratory, the paperwork has been stripped. The lab copy shows the bottle code, the sport and the athlete’s gender. No name. The people running the analysis are deliberately prevented from knowing whose career they are holding.

Apple set itself a stronger version of the same requirement, and stated it formally: “an outside observer cannot determine whether any pair of reference images were taken by the same device.” Not merely that your name is absent, but that nobody can tell two of your photographs apart from two strangers’ photographs. The final signature comes from Apple’s signing service rather than from a credential belonging to you, so there is no photographer identity to leak.

The plumbing follows the same rule. Timestamp requests travel over Oblivious HTTP, so the timestamp service never learns the device’s IP address. Calls to the signing and revocation services happen from inside Private Cloud Compute rather than from your phone. Revocation checks at viewing time run against a list already on the device, so your phone never tells anyone which photograph it is looking at.

This is not fastidiousness for its own sake. Sam Gregory of the human rights organisation WITNESS has pointed out that provenance metadata can expose whoever captured an image, and that photojournalists have been targeted once identified. A system that proves your photograph is real by announcing who took it is not obviously progress for the people who need it most.

Developing the negative

What leaves the sensor is not yet a photograph. Apple calls it a secure digital negative, stored on the phone in DNG format, containing the pixels, both signatures, the timestamp bounds, the metadata and the device manifests. It can sit there indefinitely, and it can be shared in that undeveloped state, which matters for professional workflows where the raw file goes to a picture desk.

When you ask for a reference image, the negative goes to Private Cloud Compute, and PCC’s first job is not image processing at all. It recomputes the digest embedded in the frame and verifies the sensor’s signature over both, chaining the certificate back to the sensor CA. It verifies the Secure Enclave signature and chains that to the Basic Attestation Authority. It verifies the signature on the device manifest and chains it to the factory CA. Then it confirms that the sensor and the enclave named in those chains belong to the same device. Only then does anything get developed.

The development itself is demosaicing, tone mapping and related corrections, then compression to JPEG. The result is hashed, which both creates the value to be signed and supplies the bits for the photo’s identifier.

Anti-doping solved the equivalent problem by refusing to let samples be analysed just anywhere. Testing happens in accredited laboratories, the accreditation list is public and the analytical standard is published, so a result can be challenged on procedure rather than on faith.

Apple’s version is stricter than I expected. “Every production build of PCC is recorded in an append-only, cryptographically tamper-proof transparency log, the binaries are available for public inspection, and a device will only send data to a node that can attest to running a build from that log.” You do not have to trust that Apple developed your negative honestly. You can read the code that did it and confirm the machine was running that code.

The finished image is signed with a composite post-quantum signature combining RSA-3072 and ML-DSA-87. The reasoning Apple gives is the right one and worth quoting, because it explains why a photograph is a harder problem than a web session: “an image asserted to be authentic in 2026 should be securely verifiable in perpetuity.” A TLS certificate needs to survive ninety days. Evidence needs to survive the lifetime of the argument it is evidence in.

Once development succeeds, the negative is moved to your deleted photos and purged after thirty days unless you rescue it.

The hidden weights

Somewhere in this chain of mathematics sits an opinion.

Before signing, PCC runs one more check, and Apple describes it plainly: “Using a neural network with hidden weights, PCC computes a confidence score for the photograph.” The score assesses whether the image has the physical characteristics expected of raw output from Apple’s sensors. PCC then sends the photo identifier, the hash, the score and the sensor ID to a companion service, which records them and updates a running confidence score associated with that sensor. A sensor whose running score falls far enough can be revoked, after which PCC stops signing anything it produces.

Read that again with a sports lens on because anti-doping runs the closest thing to this that exists, and unlike Apple’s version it has a name. The Athlete Biological Passport does not test for a banned substance. It tracks an athlete’s own biological markers over time and flags patterns that do not look like a human body behaving normally. It is longitudinal, statistical, and it judges you against a model of what is physically plausible rather than against a threshold you either crossed or did not.

Apple has built a biological passport for camera sensors.

The difference is what surrounds it. WADA published the Operating Guidelines and the Technical Documents in 2009. The statistical model is described in the literature. A flagged profile goes to an Athlete Passport Management Unit and then to a panel of named human experts, and the athlete can contest their findings. Apple’s model has hidden weights and an unpublished threshold. Nothing in the published design describes a review panel, or any route by which the owner of a revoked sensor could argue that the machine got it wrong.

The reason is a good one: a published model for detecting fake sensor output is a specification for manufacturing convincing fake sensor output. The trade is real. It is still worth saying plainly that the one discretionary step in an otherwise auditable pipeline is the one step nobody outside Apple can inspect.

Stripping the medal

The property that makes anti-doping unusual among certification systems is that its verdicts are not final. The International Olympic Committee stores samples for years and retests them when the science improves. Its London 2012 programme, run by the International Testing Agency and concluded in December 2022, re-examined 2,727 samples and sanctioned 73 anti-doping violations, most of them caught by a steroid test that had not existed in 2012. It withdrew 31 medals a decade after they were handed out.

Apple built the same power. The company created “a revocation system that can revoke individual photos, as well as all photos from a specific sensor,” devices fetch updated revocation lists on a regular cadence, and the viewing client checks the list every time a reference image is displayed.

A hallmark stays on the spoon. This is the first widely deployed system in which the authenticity of an object already in your possession is a live status rather than a settled fact, withdrawable after the thing has been published, quoted and believed.

It also makes verification eventually consistent. Between a revocation being issued and your phone fetching the updated list, a withdrawn photograph still checks out.

What the test cannot say

A clean doping test does not prove an athlete is clean. It proves that nothing detectable by the methods of the day was found in one sample on one afternoon. Everyone involved knows this, which is exactly why the ten-year retesting window exists.

Reference Image carries the same shape of limitation. It covers photographs, not video and not audio. It proves that these pixels came off this sensor within that time interval and were developed by inspectable code. It says nothing whatsoever about whether the scene in front of the lens was true.

In October 1840, Hippolyte Bayard photographed himself posed as his own drowned corpse, to protest the credit going to Daguerre. He had not drowned. That photograph would pass Reference Image easily because the camera was not lying. Only the man in front of it was.

Hany Farid, who has spent a career on image forensics, gave IEEE Spectrum the fair summary: “when a company like Apple gets in the game, it’s getting serious,” and also, “I don’t think they solve the problem. It’s not like we can all pack it up and go home now.”

One more limit, and a strange one. Reference Image capture is not available in China at launch for regulatory reasons, and not in the European Union at launch either, although Europeans can view reference images captured elsewhere. Whether your photograph can be proven authentic currently depends on which side of a regulatory negotiation you live on.

The missing tribunal

Metaphors earn their keep where they break, so here is the break.

An athlete who returns a positive result has a B sample, analysed separately, which they may attend. They have a hearing. They have the Court of Arbitration for Sport. Decisions are published, annual numbers are reported, and the apparatus exists because everyone understood from the start that a system able to end careers has to answer for its mistakes.

Reference Image has the chaperone, the sealed bottle, the anonymised laboratory, the biological passport and the retroactive disqualification. It has no tribunal. No B sample, no hearing, no published count of revocations, no appeal. Apple’s revocation service “must maintain a private record of photo GUIDs and associated sensors,” and it “does not allow for public access to this record.”

The asymmetry is sharpest when you notice that Apple already knows the remedy and applied it one level up. Every build of the software that develops your photograph goes into a public, append-only log that anyone can audit. The software is auditable. The verdicts are not.

Apple’s reason is real rather than an excuse. A public ledger recording which sensor produced which photograph is a surveillance database, and the people it would endanger first are the photojournalists the feature exists to protect. Privacy, public auditability and unforgeability: this system can have two. Gregory’s proposal is the sensible middle, borrowed from content moderation: publish the numbers, the process and a route of appeal, even if you cannot publish the list.

And there is one difference no design choice can fix. The World Anti-Doping Agency does not sell running shoes. Apple certifies photographs taken on a device Apple designs and sells, using a service Apple operates, scored by a model Apple keeps secret, with a revocation power Apple holds alone. Gregory’s verdict on the closed implementation is the one to keep: it is “a control choice, not a technical necessity.”

Who never entered

Most cameras on earth will never have this, and much of the documentation that actually matters is shot on cheap Android phones by people with more pressing concerns than sensor attestation.

Anti-doping tests the athletes who showed up and won. The trouble with building the same machinery for photographs is what it quietly does to everything outside it. Once a signed photograph is normal, an unsigned one stops being merely unverified and starts looking like an answer to a question nobody asked it.