Glonce

Proof of Capture: an open source counterpart to Apple Reference Image, using steganography

securityThe Glonce editorsHacker News🔥64Glonce rating64Impact50Novelty60Relevance85Surprise65Players20Credibility78

Apple announced Apple Reference Image the day before this post: a way to cryptographically prove that a photo was actually taken by a camera rather than generated by AI. During a summer at the Recurse Center, the author and Alex Hornstein, two self-described camera enthusiasts, built their own take on the same idea and called it Proof of Capture: an open source camera that proves a photo is real using steganography instead of a closed corporate pipeline.

The author traces the motivation back to 2019, when they were deploying machine learning fact-checking tools and had already concluded, even in what they call the 'Will Smith eating spaghetti' era of AI video, that generators outrun detectors: catching fakes after the fact is a losing race, because every improvement in a detector becomes training signal for the next generator. Proof of Capture flips that problem around, aiming to prove what is real at the moment of capture instead of hunting for fakes afterward. The hard part, the author writes, is not the cryptography but handling edits, such as whether a cropped photo should keep its signature, and handling metadata, since sharing a photo typically strips its EXIF data, taking any signature stored there with it.

Their fix is steganography: an invisible watermark hidden in the image's own pixels, carrying a signed perceptual hash, a hash of what the photo looks like rather than its exact bytes. Because the signature does not live in metadata, it survives compression and resizing. The first version hid an exact SHA-256 hash in the last bit of each pixel, and a single JPEG recompression destroyed it. The current version instead signs a perceptual hash and spreads it across the whole image as a frequency-domain watermark, using DWT and DCT, which the author says survives WhatsApp-grade compression and still detects edits to the content.

Signing itself runs on a self-soldered ATECC608 cryptographic chip, which holds a public key for verification and a private key for signing. Once that private key is minted, it never leaves the chip; not even the owner can read it back out, and the chip locks itself if someone tries to tamper with it.

The author draws a direct line to what Apple is doing: Apple's sensor also signs every pixel at capture time, but instead of embedding that signature in the image, Apple's Private Cloud Compute turns it into a separate 'digital negative' stored alongside the photo, and Apple's verification flow is not yet public or clearly explained. The objection raised is that Apple is not using C2PA, the open standard already adopted by Nikon, Sony, Leica and Adobe, and that even though Apple is opening APIs so other platforms can verify images natively, the root of trust still sits inside Apple's own Private Cloud Compute rather than in an open system.

The author is careful to flag the limits of all of this: neither Proof of Capture, Apple Reference Image, nor C2PA fully solves the underlying problem. A screen attack still works, meaning a photo of a screen that is itself displaying an AI-generated image comes out signed as real. Proof of Capture is released as an open source project that the author says can be built for under $100, and the post closes by describing a printed photo from the camera on display at the Recurse Center, carrying a hidden signature visible up close.

Key facts

  • The author and Alex Hornstein built Proof of Capture, an open source camera, during a summer at the Recurse Center, and say it can be built for under $100.
  • The camera hides a signed perceptual hash as an invisible steganographic watermark spread across the whole image using DWT and DCT, which survives WhatsApp-grade compression and still detects edits; an earlier version that hid an exact SHA-256 hash in each pixel's last bit was destroyed by a single JPEG recompression.
  • Signing runs on a self-soldered ATECC608 chip: once the private key is minted it never leaves the chip, not even the owner can read it, and the chip locks itself if tampered with.
  • This account was published one day after Apple announced Apple Reference Image, which also signs every pixel at capture but stores the signature as a separate 'digital negative' via Private Cloud Compute instead of embedding it, and does not use the open C2PA standard already used by Nikon, Sony, Leica and Adobe.
  • The author concedes that neither Proof of Capture, Apple Reference Image, nor C2PA stops a screen attack: photographing a screen that is displaying an AI-generated image still produces a signed photo of a fake.

Why it matters

Post-hoc AI detection keeps losing to generators, because every detector improvement becomes training data for the next generation of fakes. Proof of Capture is a concrete demonstration of the alternative: sign what is real at the moment of capture instead of trying to catch fakes afterward. The write-up lands one day after Apple announced its own version of that idea, Apple Reference Image, which makes the two approaches directly comparable: a closed, sensor-plus-cloud pipeline from Apple against an open, steganography-based one built by two people for under $100.

Who it affects

Photographers, journalists and fact-checkers who need to prove an image is genuine; camera makers and platforms already committed to the open C2PA standard, including Nikon, Sony, Leica and Adobe; and anyone who ends up relying on Apple's newly introduced Reference Image, whose Private Cloud Compute verification flow is not yet public or clearly explained.

How to use it

Proof of Capture is released as an open source project, and the author says a working camera can be built for under $100, though no cost breakdown or component list is given beyond that figure. There is no pricing tier or commercial offering here: this is a hobby build from a summer at the Recurse Center, meant to be replicated by other builders rather than bought.

How solid is it

This is a single hobbyist proof of concept, not a shipped or independently tested product. The steganography technique has already gone through one visible failure and fix: the first version's exact SHA-256 hash hidden in each pixel's last bit broke under ordinary JPEG recompression, and the current perceptual-hash-plus-DWT/DCT approach is what the author says survives WhatsApp-grade compression, a real-world bar rather than a lab one. The signing hardware is a commercially available ATECC608 chip, soldered by hand rather than mass-produced. The author is upfront about an open design question, whether a cropped photo should keep its signature, that the post does not resolve. Apple's side is no more checkable from the outside: the author states plainly that Apple's own verification flow is not yet public or clearly explained.

Risks and caveats

The clearest limitation the author names is a screen attack: photograph a screen that is itself showing an AI-generated image, and the camera signs a real photo of a fake. Sharing a photo normally strips its EXIF metadata, part of why the signature had to move into the pixels themselves instead of staying in metadata that gets discarded. On the Apple side, the stated objection is twofold: Apple is not using the existing open C2PA standard already adopted by Nikon, Sony, Leica and Adobe, and even though Apple is opening APIs for platforms to verify images natively, the root of trust still sits inside Apple's own Private Cloud Compute rather than an open system. The author states directly that none of Proof of Capture, Apple Reference Image or C2PA fully solves the underlying problem of proving an image is real.

“Detection is a losing race: every improvement in the detector is training signal for the next generator.”

— the post's author