53 comments

[ 0.19 ms ] story [ 2.8 ms ] thread
Here's a toy for embedding small text into images steganographically: https://github.com/fitzn/atrium
Here's a toy for embedding text inside random HN comments.

https://gitlab.com/here_forawhile/edasm

Example:

After wholly implemented our logging layer with dagger, I posit that the real regression was not the aws itself but the rigorously prototyped around authentication. We consequently extraordinarily profiled the config, henceforth simplified every edge case, and the optimization were unmistakably exemplary. alternatively, the aforementioned monitoring is comparable advantageous to an incremental security environment. I endorse this path if your security team has rigorously instrumented a massive rust codebase before.

Both DeepSeek-V4.1-Flash and GLM-5.3-Flash failed to decode your embedded example text. I failed, too, but I only spent a minute trying to figure out your repo before giving up and telling AI to do it. Anyway, maybe you want to improve your docs?
That's makes sense because I am the only key holder in existence to decode! It should decode with other 'keys' but It won't be the correct message.

The text decodes to 'hello world'.

Also, this engine won't compile on non arm64 chips without virtualization layers.

why require arm64?
There were significant performance improvements to write the engine in assembly.

The project started as a pure python version, but it's pretty slow.

> For example, a screen attack still works: photograph a screen displaying an AI image and you get a signed photo of a fake. But it's always nice seeing big actors interested in addressing this problem.

Yeah, very nice. So this whole idea basically doesn't work - but we get a new stealth way to embed metadata in an image that can be used for tracking...

(And a new narrative why cameras need to have TPMs and locked-down firmware as well)

Couldn't the camera encode information from the depth sensor and prevent this.
I will make miniature dioramas and photograph them.
Miniature dioramas wouldn't be size appropriate. Apple could detect faces/cars/other common objects of ~known size and verify -- or even just dump depth map for anyone to check.
It seems to be what Apple is doing, this feature is only available on the 18 Pro's (which have depth sensor on the back), but not Duo.
Photos of photos has always been a problem.

In days of old, a Polaroid photo was considered "proof of capture".

I've got a Polaroid daylab 35 plus sitting in storage somewhere (https://www.instantoptions.com/wp/faqs/daylab/). You can project a slide through it onto Polaroid film, expose it, and have the image there.

I was also able to find a company that did slide printing. It was possible to send them a digital image and they'd send you back a slide with that image... which I then used to make a Polaroid of that image.

I had a classic 600 Polaroid photo of a UFO landing.

That signature contains time and optionally gps coords, and taking photo of a screen is not simple. So overall does solve some problem

ps:most important: cam/lens settings also in the digital sig, what for a screen is different

I expect in the near future all digital cameras to digitally sign the images they take. Even before AI slop, it was useful to avoid manual alterations. AI makes it all too easy, so it makes sense.

However, this will certify only the original image. I think the missing part of this is additional layers of certification which allow some image editing (e.g., rotating, contrast, etc.) yet clearly document that the image was modified and link to the original image ID. Kind of like a signed git log.

There will always be a way around it. There are even open-source alternative/hacked firmwares for professional DSLR cameras where tampering with the signing may be possible.

And this still doesn't help any other kind of image e.g. screenshots, photo of a screen etc. that can make the camera signatures largely pointless depending on the context.

if such a method gains traction then so will the effort to bypass it. either by stealing private keys or just projecting light onto its sensor.
Even if it's flawed, adding any friction at all to the effort of deception is a positive step.
Not if it means essentially outlawing open computing.
People may be interested in the work of the Coalition for Content Provenance and Authenticity (C2PA) https://c2pa.org/
https://www.da.vidbuchanan.co.uk/blog/android-c2pa.html

is a post about Google Pixel C2PA cameras experiencing contact with reality

Hi, I'm the author of the above. I also got a Sony A7 IV camera a few days ago. I already have a root shell on it. Although that wasn't even required to break Sony's C2PA implementation...

I'll write more about this in the future.

Soon my phone can cryptographically prove the beauty filter lied at capture time.
> However, this will certify only the original image. I think the missing part of this is additional layers of certification which allow some image editing (e.g., rotating, contrast, etc.) yet clearly document that the image was modified and link to the original image ID. Kind of like a signed git log.

That’s not necessarily missing. For photography competitions, what matters is that people send original photos; for press photos, you don’t need a digital link between what’s published and the original, either. What matters is that papers, when questioned, can produce the original of a photo they published. Then, humans can determine whether editing changed the story.

I don't understand why few people are pointing out the obvious vulnerability here that you can control the wires going into the photosensor controller and pretend that the photosensor is capturing whatever image you want. I imagine it's not exactly trivial to do this, but a grad student with an FPGA could probably figure it out.
Simpler than that, you can just talk to the cryptography IC yourself and ask it to sign stuff. No need for an FPGA, just an arduino. Given the datasheet I imagine any LLM from the last year should be able to oneshot it.
if

I imagine on apple silicon this is buried deep in silicon / ISP IP block, and isn't a discrete IC.

>a screen attack still works: photograph a screen displaying an AI image and you get a signed photo of a fake

you don't need to do that just photograph a screen.

This seems close to worthless in "identifying real photos vs AI" for someone actually wanting to do something bad with an AI image, although probably very useful at identifying which phone took a photo when ("the root of trust stays inside Apple's Private Cloud Compute") seen as it's not an entirely local solution a bad actor government could use their powers to completely abuse this.

if geolocation data can be captured in the same signature, that would be a good enough approximation for most relevant cases I think.
GNSS signals can be relatively easily faked because the original signals are very weak so overpowering them doesn't require much broadcast power.
Jamming them is easy, replaying them so as to trick unacquainted receivers is easy, but "faking" a network of signals so as to precisely control present a specific location is not easy or feasible.

"Overpowering" (as to jam) inherently means detectable, these signals are arriving below the noise floor anyway. And if you aren't overpowering, the original signals will leak through. Also, depending on the sophistication of the receiver, your ability to present an implausibly different location may not exist at all (AGPS.)

It seems feasible for state actors, at least: https://en.wikipedia.org/wiki/GNSS_spoofing#Ocurrences
Yes, a motivated actor can move a naive receiver somewhere different than where it thinks it is by some small amount - ideally outside of the CEP of whatever weapons system is targeting, but that's much different than precisely controlling the location to be somewhere else arbitrarily.
its conflicting desiderata: a videographer doesn't want to constantly power a device to maintain provable continuity, but screen attacks necessitate such a scheme

a continuous stream of video from factory to customer to observation should prevent screen attacks, if there is a trustworthy framework for processing and checking the absence of screen slide-ins etc.

In the future, people willingly surveil themselves 24/7 with cryptographic proof, because fake images and video will be so good that it will be the only way to prove what one didn't do. Total Information Awareness achieved :D
In the future? People willingly buy Amazon spy devices now.
> we sign a perceptual hash (pHash) of the image rather than an exact pixel checksum

Perceptual hashes are non-cryptographic. There are certainly collision attacks, but what about preimages? A preimage would completely break this scheme.

This paper demonstrates second-preimage attacks against PhotoDNA and PDQ: https://eprint.iacr.org/2021/1531.pdf

Yep, that breaks this scheme, making it useless. But it's far from the only thing making it useless, and the github page even explicitly lists those:

- "Small content edits slip under the threshold. [...] A localised edit covering ~15%x20% of the frame [...] passes as authentic" - this is the worst part. 15%x20% is huge, for example enough to change the face of the person or the book/text on the image.

- "Cropping is not survivable, at any amount" - given the purported reason for perceptual hashing is surviving light editing, it's pretty disappointing that one of the most common light editing operation is not supported.

Oh, and the whole "cryptographic chip" angle is absolutely bogus from the security perspective. OK, attacker can't extract the private key from chip. But they can simply connect the chip to a different device and have it sign anything! Given that the attacker in this model is device owner, this is absolutely trivial.

Considering child comment, I agree it's not great. That being said, would a bit-hash have worked? How many users are capable of sending bit-perfect images to someone else? I don't expect more than 5% of people to know...
Yes, it is a hard problem, but that doesn't mean that we should accept non-solutions.
Signing things by default has repeatedly been found to have serious unintended consequences. Do you really want your leaked/stolen photos to be undeniably linked to you?

https://blog.cryptographyengineering.com/2020/11/16/ok-googl...

It reminds me of the era when the Stasi kept archives of typewriter samples and typefaces so they could trace the authors of anonymous letters deemed subversive.
Samples, or sampling of each typewriter's idiosyncracies?

This post https://foxfire.blog/explorations/the-typewriter-that-became... claims "specific machine":

> The forensic science behind this was genuinely elegant. No two typewriters print identically. The mechanical tolerances of individual typebars—those metal arms that swing up to strike the ribbon—create unique signatures. Forensic document examiners look at three primary characteristics: alignment (whether a letter strikes slightly above or below the baseline), impression (whether one side of a letter prints darker than the other due to uneven wear), and damage (a chipped serif, a broken bowl on a lowercase “g”, a filled-in counter on an “e”). Taken together, these micro-imperfections form a pattern as distinctive as a human fingerprint—or so the authorities claimed.

> The East German Stasi took this principle to its industrial extreme. They maintained an exhaustive registry of type samples, a vast database of typewriter fingerprints. When a dissident pamphlet surfaced, the Stasi could compare its letterforms against their archive and, in theory, trace the text back to the specific machine that produced it. The countermeasure was ingenious in its simplicity: dissidents sought out pre-communist typewriter models—early Mignon or Ideal D machines manufactured before the registry existed. A typewriter without a file was a typewriter without a name. It could speak and not be traced.

Since they had control of commerce, I suppose it was possible to intercept every typewriter and "fingerprint" it before it is sold, or even tweak the typewriter to produce something unique (e.g. chipping a typebar so it prints a particular letter distinctly). Hah, needing to register your name/address to buy a typewriter feels spooky too. And if it gets stolen, you'd have to tell the authorities that it's no longer in your possession.

Maybe cryptographers think this way, but I'm struggling to think of a case where a normal person had genuine photos leaked and then just baldly denied everything. Deniability isn't an option most people use or want to use in practice.

On the other hand, images faked by AI is a real problem.

> a case where a normal person had genuine photos leaked and then just baldly denied everything

"Genuine" is doing a lot of work in that sentence. A big part of the threat model for image provenance/signing/similarity diffing is identifying when images aren't genuine--if they're from elsewhere than they're claimed to be from, or have been modified.

I very much hope that apple is using lidar data to determine if it's a flat surface being screened
And then? What if the flat surface is a wall showing cracks and it's the photo that should have been signed?

Maybe it should include depth info in the image instead.

lidar = depth sensor
Sure (I already worked with lidars before they were in phones ;-)), I had just understood that the proposal was to just not sign the images coming from a flat surface like a screen, which of course can have unintended effects.
A pHash isn't built for this. The 15%x20% threshold that passes as authentic is enough to swap a face.
One of the few advantages of "not owning your device".

Glad that at least we have that now.