Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash • Hacker News Board

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#361

Post by nullc » Fri, Aug 20, 2021, 10:39 PM UTC

throwaway384950 wrote: post #78

robertoandred wrote: post #70

Earlier quoted context omitted.

Does anyone save porn to their personal photo libraries? Especially porn as suspicious as the image you posted?

Going by what some people on Reddit say, it seems to be the case. https://old.reddit.com/r/datahoarder/search?q=porn&restrict_... Probably not the weird image I posted, which looks obviously suspicious. But maybe someone will make a program to find "cleaner" hash collisions that don't look suspicious.

https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX/issue...

I posted some examples that look like totally normal images, they're no harder to produce, you just need to noise-shape the gradient descent so that the introduced noise has a spectrum similar to the image. E.g. just feeding back a gaussian highpassed version of the error signal is sufficient.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#362

Post by nullc » Fri, Aug 20, 2021, 10:42 PM UTC

ec109685 wrote: post #147

throwaway384950 wrote: post #67

Some people seem to be confused why a hash collision of a cat and a dog matters. Here's a potential attack: share (legal) NSFW pictures that are engineered to have a hash collision with CSAM to get someone else in trouble. The pictures are flagged as CSAM, and they also look suspicious to a human reviewer (maybe not enough context in the image to identify the subject's age). To show that this can be done with real NS…

Keep in mind that you have to also collide with another perceptual hash function that only Apple has to trigger a match.

> Keep in mind that you have to also collide with another perceptual hash function that only Apple has to trigger a match.

If it's another neural network I wouldn't be shocked if the adversarial preimages worked across both-- it's not uncommon for blackbox generalization to work for adversarial examples. It would be very likely if someone (maybe the attacker) made their own version of neuralhash and then generated examples that passed both theirs and apple's public one.

Privacy wise, if there were two perceptual hash functions Apple should have used the more restrictive one on the devices too -- because even if they decide to not report you, your privacy is still invaded if they inspect at your images at all.

The neuralhash function is extremely easy to attack. We should not have any confidence in the competence of its authors, so we shouldn't expect their undisclosed mechanism to provide a great deal of protection.

A secret second hash also will not be secret against a state attacker who will have access to this function by virtue of being trusted to create the databases for Apple.

There is, however, a very simple technique they could use that would provide almost perfect protection: They could stop invading the privacy of their users and refrain from scanning their private content!

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#363

Post by undecisive » Thu, Aug 26, 2021, 3:33 PM UTC

ThinBold wrote: post #334

undecisive wrote: post #315

Earlier quoted context omitted.

It's a good question, and unfortunately you're probably right. It boils down to this: If you can prevent [some organisation] from potentially destroying civilisation, how much effort would be too much effort, and how much uncertainty is too much uncertainty? For most, there's a trade off. If someone believes that the technology is sufficient for any country to implement a brutal civil rights destruction campaign, and…

save hundreds of lives, would you? Sure, why not. But let me ask some questions, because at this point I am not sure if people want Apple's system to be robust or jammable. If our fear is that Apple will tune the system to detect pictures of two men kissing, wouldn't an easily jammable system works in our favor because we can DDoS it or threaten to do so anytime we want?

It's a tricky one, certainly.

There is probably a graph somewhere showing how much effort to fix is too much effort, vs how much bad will in the community this project is inducing, vs how much value this project has.

So no, Apple's system being jammable is a great "booby prize" right up to the point where Apple fix the algorithms, or the chinese government start reporting these false positives as bugs and saying that Apple must fix the bugs before their devices can be sold in China.

And so, one has to assume that if the algorithms can be fixed, they will be fixed. If we can DDoS Apple's human checking capability while it's still young, we might be able to prevent more resource being sunk into it - though I agree, that's unlikely. If we can do all that AND make it clear that this is going to cause nothing but bad will, and if we can get enough governments to regulate against it, then there may be hope.

So your question was, why do people think this software isn't going to work, and the answer is we really hope it isn't going to work and really hope that enough people get onboard with the efforts to subvert it and really hope that the message sinks in to Apple that this was a doomed project that they should abandon for good.

But with enough money and time, there is no problem that can't be overcome. So even if it is a currently jammable child protection system, in the future is will almost definitely become a robust human rights violation system. In the space between those two points there is hope. Slim hope, but hope nonetheless.