  Over the past few years, AI methods of generating images have been increasing
in capabilities, with recent breakthroughs enabling high-resolution,
photorealistic "deepfakes" (artificially generated images with the purpose of
misinformation or harm). The rise of deepfakes has potential for social
disruption. Recent work has proposed using ZK-SNARKs (zero-knowledge succinct
non-interactive argument of knowledge) and attested cameras to verify that
images were taken by a camera. ZK-SNARKs allow verification of image
transformations non-interactively (i.e., post-hoc) with only standard
cryptographic hardness assumptions. Unfortunately, this work does not preserve
input privacy, is impractically slow (working only on 128$\times$128 images),
and/or requires custom cryptographic arguments.
  To address these issues, we present zk-img, a library for attesting to image
transformations while hiding the pre-transformed image. zk-img allows
application developers to specify high level image transformations. Then,
zk-img will transparently compile these specifications to ZK-SNARKs. To hide
the input or output images, zk-img will compute the hash of the images inside
the ZK-SNARK. We further propose methods of chaining image transformations
securely and privately, which allows for arbitrarily many transformations. By
combining these optimizations, zk-img is the first system to be able to
transform HD images on commodity hardware, securely and privately.
