Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hash collision in Apple NeuralHash model

github.com

Post reply on HN
Print view View original

211–220 of 725 posts

Re: Hash collision in Apple NeuralHash model

#211

Post by helen___keller »

reacharavindh wrote: post #132

I admit that I have not done enough research to have a strong opinion on this, but why is Apple taking this on themselves? As far as I can see, this outrage is because of "scanning on iPhone" that is wildly out of user's control. Why can't Apple be like others and say we scan the shit out of what you upload to iCloud(and it is in our Terms and Conditions to use iCloud)? Almost all tech people know that iCloud (or its…

My understanding is that iCloud reports orders of magnitudes less CSAM than other cloud services at a similar scale. My guess is that apple wanted a way to report the CSAM they are currently storing without having to decrypt/inspect every person's personal data (which necessarily opens vectors for e.g. rogue employees doing bad things with people's personal data)

Hence why this approach was stated as a privacy win by Apple. They catch the CSAM and they don't have to look at your photos stored online.

Re: Hash collision in Apple NeuralHash model

#212

Post by Croftengea »

vesinisa wrote: post #13

Now this offers Apple a very delicate opportunity to back out of the whole scanning controversy due to technological vulnerabilities.

This! Apple almost never admit their mistakes ("You're holding it wrong"), so the technical argument would allow leaving this feature in an indefinite and perhaps opt-in beta.

Re: Hash collision in Apple NeuralHash model

#214

Post by zug_zug »

manmal wrote: post #203
vnchr wrote: post #177

Earlier quoted context omitted.

I would think a Message with the attached photo from a burner phone/account would be enough.

Currently, the image would have to be imported into the photos library, and iCloud upload must be enabled.

This conversely means that all illegal content can be freely texted and this system won't even catch the distribution of CP unless those pictures are imported into the photos library and icloud updates enabled.

There's a pretty good chance that it was inevitably going to get expanded to handle pictures arriving at the phone through other means.

Re: Hash collision in Apple NeuralHash model

#215

Post by sandworm101 »

Grustaf wrote: post #200
nbzso wrote: post #106

Earlier quoted context omitted.

Don't feel bad at all. I dumped macOS entirely from production workflow. I cannot work on computer knowing that something is "scanning" me and I am glad that my "paranoid" feeling stopped me to upgrade all office macs. Billionaires at (Apple) don't give a flying f*ck about users privacy. It is all vertical integration in the name of world domination. How removed from reality they are. This is week after Pegasus/NSO a…

How likely is it that you will have enough colliding images in your photo library to even trigger a review? I'm guessing you need at least 5 images, perhaps much more, to trigger it. In any case, 1 image is definitely not enough.

For a normal random person, a grey man. In the real world, a single collision could be enough for the police to acquire further access to people they are already looking at. If the police want access to your phone for other reasons (drugs, taxes, illegal speech) they can use that one collision to get a warrant which will give them greater access.

It is akin to cops wanting to search a car. They don't need a warrant. They only need to follow the car until it breaks any number of traffic laws. Then the resulting traffic stops lets them talk to the driver, who seems evasive, which gives them probable cause, which gets them a warrant to perform a full search. The accidental collision, week evidence of an offending image on the phone, opens the door to whatever other investigation they want to do.

Re: Hash collision in Apple NeuralHash model

#216

Post by Grustaf »

hughrr wrote: post #7

That’s end game. Now you can use it for targeted attacks against innocent people. This needs to be shut down and disposed of immediately. There is no other outcome which is socially acceptable for Apple. I feel vindicated now. There are a lot of people saying that I’m insane as I’ve dumped the entire iOS ecosystem in the last week. But Craig was busy steamrolling out the marketing still only a couple of days back abo…

Working against you?

This technology doesn't make it even an ounce easier for Apple, or some evil three letter agency, to spy on you. If they want to see if you're a Trump supporter, anti-vaxxer or whatever, they already have access to all your photos and emails, on device. They even have OCR and classification of your photos. An intern could add a spying function in an afternoon.

if OCR(photo[i]).containsString("MAGA") { reportUser() }

Re: Hash collision in Apple NeuralHash model

#217

Post by mukesh610 »

varispeed wrote: post #175
magpi3 wrote: post #159

Can someone ELI5? I understand that a person can now generate an image with the same hash as an illegal image (such as child porn), but I don't understand how they can get it on someone's phone and I don't understand why someone would get in trouble for an image, when finally examined, that is clearly not child pornography.

> that is clearly not For one, you can't know if that's true as the image could have been manipulated to appear as such. For example you wouldn't know if a kind of steganography has been used to hide image in an image and that neuralhash picked on a hidden image. > but I don't understand how they can get it on someone's phone There is many vectors. For example you can leave phone unattended and someone can snap a pic…

> For example you wouldn't know if a kind of steganography has been used to hide image in an image and that neuralhash picked on a hidden image.

How would NeuralHash pick a "hidden image"? It only uses the pixels of the image to get the hash. Any hidden image in the metadata would not even be picked up and no amount of steganography can fool NeuralHash.

> There is many vectors. For example you can leave phone unattended and someone can snap a picture of an image or since a collision may look innocent to you, you would overlook it in an email etc...

As iterated elsewhere in this thread, random gibberish pixels colliding with CSAM would definitely not be useful in incriminating anyone. The manual process would catch that. Also, if the manual process is overloaded, I'm pretty sure basic object recognition can filter out most of the colliding gibberish .

Re: Hash collision in Apple NeuralHash model

#218

Post by endisneigh »

Koffiepoeder wrote: post #163
magpi3 wrote: post #155

Earlier quoted context omitted.

But how would the attacker get the generated image on a person's phone?

E.g. send them a whatsapp message that looks innocent

They can see the image - why would they import a random image into their library from someone they don’t know?

Re: Hash collision in Apple NeuralHash model

#219

Post by Grustaf »

sandworm101 wrote: post #215
Grustaf wrote: post #200

Earlier quoted context omitted.

How likely is it that you will have enough colliding images in your photo library to even trigger a review? I'm guessing you need at least 5 images, perhaps much more, to trigger it. In any case, 1 image is definitely not enough.

For a normal random person, a grey man. In the real world, a single collision could be enough for the police to acquire further access to people they are already looking at. If the police want access to your phone for other reasons (drugs, taxes, illegal speech) they can use that one collision to get a warrant which will give them greater access. It is akin to cops wanting to search a car. They don't need a warrant.…

I'm not sure what you mean. If we are talking about Apple's new feature, they will not even be alerted until you have enough matches.

And the police probably won't be using any neural hashes if they have access to your device, so I'm not sure what you are talking about.

Re: Hash collision in Apple NeuralHash model

#220

Post by zug_zug »

shadowgovt wrote: post #99

Does this algorithm work for the reverse goal (i.e. can content that would trip the CSAM hash be perturbed enough to avoid it without compromising quality of the underlying image)? To my mind, that's far more disquieting than the risk of someone staging and elaborate attack on an enemy's device.

Why is this downvoted? This checks out -- A problem with local scanning is that the source code will always be available and thus the user can learn exactly which perturbations trick the system.
Post reply on HN