how long until they start scanning a device's framebuffer in realtime?
why stop at CSAM? Pirated material like movies next?
Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
111–120 of 363 posts
Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
#112Earlier quoted context omitted.
The parent was proposing to “just send known CSAM”. But OK, say someone sends you a sunset that fools the hasher. Then what? Of course one match won’t do anything, so you’d need to download however many matching sunsets. Then what? The Apple reviewer would see they’re sunsets and you’d challenge the flag saying they’re sunsets. And if somehow NCMEC got involved, they’d see they’re just sunsets. And if law enforcement…
> But OK, say someone sends you a sunset that fools the hasher. Then what? Of course one match won’t do anything, so you’d need to download however many matching sunsets. Then what? A real attack would be to take legal porn images and make them collide with illegal images, so when a human goes to review the scaled down derivative images, those images very well look like they could be CSAM. Since there are many of the…
This where the "fog of war" kicks in. What with doors being busted down, police departments making press releases, etc. I can easily imagine that the victim could be prosecuted, convicted and sent away because no-one understood the subtlety that their legal porn was not in fact CSAM.
Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
#113This is just getting wilder and wilder by the day, how spectacularly this move has backfired. As others have commented, at this point all you need is someone willing to sell you the CSAM hashes on the darknet, and this system is transparently broken. Until that day, just send known CSAM to any person you'd like to get in trouble (make sure they have icloud sync enabled), be it your neighbour or a political figure, an…
Why wait? Just send them the pictures on Facebook Messenger or Gmail or Dropbox today.
I can't tell if you are being sarcastic. In case you are not, isn't the act of sending those pictures completely illegal?
Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
#114Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
#115Earlier quoted context omitted.
Why wait? Just send them the pictures on Facebook Messenger or Gmail or Dropbox today.
I can't tell if you are being sarcastic. In case you are not, isn't the act of sending those pictures completely illegal?
People here are proposing intentionally creating image assets which collide with perceptual hashes of known CSAM (ignoring whether that is legal or ethical) and sharing those assets to effectively SWAT unaware targets.
Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
#116Really naive question. What's to stop apple from using two distinct and separate visual hashing algorithms? Wouldn't the collision likelihood decrease drastically in that scenario? Again, really naive but it seems like if you have two distinct multi-dimensional hashes it would be much harder to solve the gradient descent problem.
It's common for two unrelated images come up as false positives when comparing hashes across different unrelated perceptual hashing methods.
Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
#117I don't see how this is fixable on their end. Several people have suggested simply layering several different perceptual hash systems, with the assumption that it's difficult to find a colliding image in all of them. This is pretty suspect - there's a reason we hold a decades-long competition to select secure hash functions. Basically, a function can't generally achieve cryptographic properties (like collision-resist…
> First, as an additional safeguard, the visual derivatives themselves are matched to the known CSAM database by a second, independent perceptual hash. This independent hash is chosen to reject the unlikely possibility that the match threshold was exceeded due to non-CSAM images that were adversarially perturbed to cause false NeuralHash matches against the on-device encrypted CSAM database. https://www.apple.com/chi…
And that hash function is kept private, so you can’t just iterate to find a match of both hashes.
Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
#118Really naive question. What's to stop apple from using two distinct and separate visual hashing algorithms? Wouldn't the collision likelihood decrease drastically in that scenario? Again, really naive but it seems like if you have two distinct multi-dimensional hashes it would be much harder to solve the gradient descent problem.
They do:
https://news.ycombinator.com/item?id=28230029
They also keep the second hash function private.
Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
#119Earlier quoted context omitted.
The "send known CSAM" attack has existed for a while but never made sense. However, this technology enables a new class of attacks: "send legal porn, collided to match CSAM perceptual hashes". With the previous status quo: 1. The attacker faces charges of possessing and distributing child pornography 2. The victim may be investigated and charged with child pornography if LEO is somehow alerted (which requires work, a…
It seems like I'm not going to sleep tonight. Sure, there is hyperbole in OP's comment (CSAM ransomware and automated law enforcement aren't a thing yet), but we're a few steps from that reality. Even worse, how long will it take until other cloud storage services such as Dropbox, Amazon S3, Google Drive et al implement the same features? Or worse, required by law to do so? This sounds like the start of an exodus fro…
Cloud services generally already do this, for example, here is Google's report:
https://transparencyreport.google.com/child-sexual-abuse-mat...
Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash
#120Earlier quoted context omitted.
> First, as an additional safeguard, the visual derivatives themselves are matched to the known CSAM database by a second, independent perceptual hash. This independent hash is chosen to reject the unlikely possibility that the match threshold was exceeded due to non-CSAM images that were adversarially perturbed to cause false NeuralHash matches against the on-device encrypted CSAM database. https://www.apple.com/chi…
And that hash function is kept private, so you can’t just iterate to find a match of both hashes.
Correct, gradient descent attacks like this depend on being able to differentiate your hash function.