Proving a photo came from a real camera, even after JPEG, blur, or redaction

For years, every cryptographic receipt that promises "this photo came from a real camera" has shared a fatal flaw: the moment anyone recompressed, blurred, or redacted the image, the receipt broke. Those are the exact transforms every camera and every editor performs, so the receipts kept failing at the moment they were supposed to matter.

A new research tool, ZK-JPEG, threads the needle. It attaches a mathematical proof that the photo came from a committed, signed source and was only edited inside an allowed family of transforms, and that proof still verifies after the image has been through JPEG's lossy compression. The paper, ZK-JPEG: Zero-Knowledge Image Editing and Compression, was approved on September 17, 2026 in the IACR Cryptology ePrint Archive and is a minor revision of work accepted at the peer-reviewed SCN 2026 conference.

The team, Samuel Dittmer, Steve Lu, and Kimberlee Model of Stealth Software Inc., with Joseph Near of the University of Vermont, built the system on top of a tool called PicoZK. PicoZK converts ordinary Python image-editing code into a ZK circuit, the kind of cryptographic computation that lets a verifier check a statement without learning the underlying data. The proof that emerges, the paper claims, attests that an image was correctly compressed from a secret, committed input while surviving JPEG's lossy compression. Equally important, it certifies that a large family of image transformations, including blur, redaction, and other edits, can be folded into the JPEG pipeline with minimal extra cost.

That allowed-edit family is the part that changes the calculus. Today's camera-attestation schemes, of which the C2PA standard is the most widely deployed, attach a signed manifest to the original image file. The moment a newsroom recompresses for web delivery, blurs a face to protect a source, or redacts a license plate, that manifest no longer matches the pixels, and the signature stops being valid. The result is a receipts system that fails on the very photos that need provenance most: a journalist's blurred source, a redacted court filing, a wire-service photo re-encoded for every social platform.

ZK-JPEG is built for that failure mode. The proof commits to a specific signed source image, then certifies that the visible output was produced by applying some sequence of allowed transforms and then compressing through a JPEG-compatible pipeline. A reader with the proof in hand can verify, without seeing the original, that the photo was not generated from scratch by a model and that no disallowed edit was applied. The allowed-transform family is part of the design rather than an afterthought, which is the property that makes the receipt survive the things editors actually do.

Discussion of the paper surfaced on Hacker News, where it drew modest engagement in its first days, more a discovery signal than a community verdict. There are no independent benchmarks yet. The paper does not report proof time, compression overhead, maximum image size, or memory cost, and any claim about real-world deployability has to wait for replication.

A real camera in the hands of someone staging an event still produces a fully attested photo of a fabricated moment, and a photo can be authentic to its sensor while still misrepresenting its context. ZK-JPEG rules out one class of fakes, the kind that start from a model and try to pass as a snapshot. Whether the scene depicted actually happened is a separate question, and one this tool does not address.

The team's next milestone is the SCN 2026 presentation. The path from a peer-reviewed paper to a tool a newsroom can actually run depends on whether the allowed-transform family can be widened, or specified per use case, without making the proof too expensive to attach to ordinary web imagery.