An AI image detector is a classifier trained on yesterday's generators, while the next generator is trained, in part, to get past it. Detection also fails in both directions: it misses new fakes, and it flags real photos, which teaches people to doubt true evidence. Even when it works, it can only offer a probability, never a record anyone can check.
The question "does this look synthetic?" has no stable answer. A better question is "who vouches for these pixels, and why should anyone believe them?"
Provenance starts at capture. The device signs the image at the moment it is made, and anyone can later check the signature instead of guessing from the pixels. An image with a valid signature has a known origin. An image without one is simply unverified, which is not the same as fake.
The approach is only as strong as the key behind the signature. If the signing key lives in software, it can be pulled off a phone and used to sign anything, and a signed fake is worse than an unsigned image because it carries borrowed credibility. So the real design question is where the key lives and whether it can be copied.
Every chip carries tiny manufacturing variations that no other chip shares. UBIQS derives a device identity from that variation, so there is no stored key to extract and nothing to clone. The key exists only at the moment of signing.
At capture, the device signs a receipt that binds three things: a hash of the image data, the capture details such as time and settings, and the identity of the chip that did the signing. Anyone can check the receipt and learn which enrolled device produced the image and that the pixels have not changed since.
This closes the two gaps that sink most signing schemes. Malware that lifts a file off the phone gets no key it can reuse to sign a synthetic image somewhere else. And an image generated on a server has no enrolled chip behind it, so it cannot produce a valid receipt at all.
The closer to the sensor the signing happens, the fewer steps remain in which pixels could be swapped before they are signed. When an image is edited, the editing device signs a new receipt that points back to the original, so the history shows each hand that touched it.
Apple's iPhone 18 Pro feature is not a detector. Reference Image is a provenance feature: the camera signs sensor data at capture, and Apple's cloud develops it into a verifiable reference image. It is a real step, and the first at consumer scale. Its limits are about reach and trust anchor, not intent.
| Apple Reference Image | Silicon-identity provenance (UBIQS approach) | |
|---|---|---|
| What it answers | Did these pixels come from this iPhone's sensor, within a bounded time window? | Which enrolled device made this image, and has it changed since? |
| Where trust anchors | Apple's sensor, Secure Enclave and Private Cloud Compute | The silicon identity of the capturing device |
| Devices covered | iPhone 18 Pro and Pro Max | Any device with enrolled silicon, from any maker |
| Who verifies | Apple's pipeline | Anyone holding the receipt |
| Standards | No C2PA mentioned in the coverage reviewed; SynthID is supported separately | Designed to carry a receipt a verifier can check independently |
| Availability | Not in China; EU users can view but not initially capture | Depends on enrollment by device makers |
| Does not prove | Edits after capture, or images from other sources | Whether the scene itself is genuine |
Apple has shipping hardware, distribution and a trusted brand, which a new approach does not. What a single-vendor feature cannot give is a record that works across phones, cameras, dashcams and sensors from different makers, and that a stranger can check without going through one company's service.
A valid receipt proves which device signed the image and that the pixels are unchanged since. It does not prove the scene was real. A genuine camera pointed at a screen showing a fake will sign the fake, and a staged scene is still a staged scene. Provenance narrows the problem to the capture, and the capture still needs judgment.
It also does not prove that an unsigned image is fake. Most images in the world today carry no receipt, and a system that treats "unsigned" as "false" would punish every older photo. The honest result for those is "unverified."
Finally, coverage depends on adoption. A receipt only helps if devices sign, platforms preserve the receipt when images are shared, and viewers can see it. Each of those is a separate problem that no single chip can solve.
A system that answers all five is offering evidence. One that cannot is offering a badge.
Certificates, API keys, and tokens are data — and data gets copied. Why the only machine identity that holds is one derived from physics, not assigned.
Read →The portable, tamper-evident record that ties the physical node, the model, and the policy to a result — verifiable long after the job is gone.
Read →We're talking with teams building verifiable, component-level trust into infrastructure and devices.
