ZK-JPEG proves an edited photo is authentic without revealing the original image

A group of researchers from Stealth Software Technologies and the University of Vermont published ZK-JPEG, a zero-knowledge (ZK) proof scheme for image compression and editing. The paper is available on the Cryptology ePrint Archive (eprint.iacr.org/2026/2039), was accepted with minor revision for publication at SCN 2026 (Security and Cryptography for Networks), and is signed by authors Samuel Dittmer, Steve Lu, Kimberlee Model, and Joseph Near.

The problem: the digital signature doesn't survive compression

The starting point of the work is a practical media authentication problem. Cameras can digitally sign a photo at the moment of capture, a scheme the authors call "camera attestation," which serves to prove that a file came from a physical sensor and was not generated by AI. The problem is that any legitimate and desirable transformation of the image, such as JPEG compression itself (which alters bytes to reduce file size), applying blur, or redacting a region to protect someone's identity, invalidates the original signature. Previous work already used ZK to prove the editing history of a published image, but, according to the authors, these approaches don't survive lossy encoding like JPEG.

In other words: there was a gap between "proving that the image is authentic" and "allowing it to be edited and compressed like any normal photo." ZK-JPEG addresses exactly that gap.

What ZK-JPEG actually proves

The system is a cryptographic tool for JPEG compression that proves an image was correctly compressed from a secret, committed input, without revealing that input. This means it is possible to publish the compressed version of a photo and attach a verifiable proof that it is, in fact, a valid compression of an original that the prover holds but does not expose.

Beyond compression itself, the paper claims the tool can verify a wide family of image transformations (the authors cite blur and redaction as examples throughout the abstract) by integrating them into the JPEG compression process itself, at minimal additional cost. In other words, the same circuit that proves compression can also prove that a specific edit, such as blurring a face, was correctly applied to the committed original content.

Under the hood: PicoZK and the LPZK proof system

The engineering part relevant to those working with applied cryptography is the circuit construction. The authors use a tool called PicoZK to convert Python image-editing code directly into a zero-knowledge circuit, compatible with the line-point zero knowledge (LPZK) proof system. In practice, this means the compression and editing pipeline didn't need to be rewritten by hand in a circuit language: the original Python flow becomes the circuit that LPZK can verify.

The authors themselves describe the system as "fast, flexible," and instantiable "from off-the-shelf ZK tools," which suggests a deliberate choice not to reinvent the proof system from scratch, but to compose existing cryptography pieces around the specific image problem. The paper's abstract doesn't provide benchmark numbers for proving time or circuit size, so this performance claim is left to the full text of the paper, which is worth reading for anyone assessing production viability.

Why this matters for those building media verification

For those working in content moderation, image provenance verification, or any trust layer on top of generated or captured media, ZK-JPEG solves a real friction point: until now, proving authenticity and allowing legitimate editing were goals in tension. A verification system that requires the raw image, without compression or any editing, is impractical, because every camera, every social network, and every publishing pipeline recompresses and resizes files.

This angle also matters to those building responsible generative AI pipelines. One of the paper's explicit motivations is the proliferation of easier-to-use deepfake tools, and the proposed response is not to detect the fake image after the fact, but to prove the provenance chain of the genuine image from capture to publication, even as it passes through compression and editing along the way. This is a different model from what trust & safety teams typically implement today (AI-detection classifiers), and closer to what content provenance initiatives are trying to standardize: signing at the source and preserving the proof throughout the entire transformation chain.

For architects evaluating this type of solution, the practical point is that the ZK proof happens over the JPEG compression algorithm itself, which avoids the need to maintain two file formats (a "proof" one and a "distribution" one). The final image remains an ordinary JPEG, accompanied by a cryptographic proof that any party can verify, without needing to trust the prover or have access to the original file.

What remains open

The paper is an academic contribution published at a cryptography conference (SCN 2026), not a product or library announced for general use. There is no indication in the published material of public availability of the PicoZK code, nor concrete numbers on the computational cost of generating or verifying proofs for real-size images, data that would be decisive for assessing whether the approach is viable at the scale of a smartphone camera or a social network platform. It also isn't clear from the abstract how the scheme would integrate with real camera manufacturers, who would need to adopt source-level signing for the rest of the chain to work. For those following the field, the natural next step is to read the full PDF on the ePrint Archive and compare LPZK's performance numbers with other ZK constructions applied to media that have been published in recent years.