Here's how the iPhone 18 Pro's Apple Reference Image tech works

Adding a digital signature, backed by Apple's own cloud service, is supposed to give you confidence that the finished photo is legitimate. How, though, can you be sure that the signature is legitimate?

Apple points out that someone could, theoretically, replace or change a camera's image before it's marked as authentic. Reference Image mode is designed to protect against this by adding its first digital signature inside the camera sensor itself.

The sensor has its own private cryptographic key, which is generated when the phone is manufactured and kept inside it, to create a signature tied to the image data it captures. It's a digital tamper seal. No other phone has that key, and if someone else alters the data, it'll no longer pass the signature check. Apple certifies the corresponding public key during manufacturing so that its cloud service can verify the sensor's signature.

Reference mode is opt-in for the iPhone 18 Pro or Pro Max's main camera, so it won't be enabled by default. To switch it on, you'll need to tap Settings > Camera > Reference Image, then tap Add Reference Mode, before following the on-screen instructions. To use it, open your camera, then swipe to select Reference Mode. When you take a photo with it switched on, the camera sensor converts the light it captures into digital image data and signs it using its own unique cryptographic key. The mode also stops the sensor's firmware from being able to modify the captured data (again unlikely, but covering another potential area of attack).

During manufacturing, Apple records which camera sensor belongs to which phone. The sensor and the phone's security processor each have their own digital key, which they use to sign parts of the capture record for each photo. Apple's cloud service then checks those signatures and confirms that the sensor and security processor belong together. This is designed, in theory, as a safeguard to stop someone from removing a genuine sensor and using it elsewhere to pass off fake photos.

The evidence is stored using a popular RAW format called digital negative, or DNG. It's linked to the end photo that your camera produces. Before development, you can retain it indefinitely, or share it for someone else to develop later. You'll see both in the Photos app to compare and contrast. After development, the negative moves to your deleted photos folder and gets automatically deleted after 30 days unless you recover it.