Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

github.com

Post reply on HN
Print view View original

151–160 of 363 posts

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#151

Post by sigmar »

fay59 wrote: post #123
dannyw wrote: post #30

Earlier quoted context omitted.

The "send known CSAM" attack has existed for a while but never made sense. However, this technology enables a new class of attacks: "send legal porn, collided to match CSAM perceptual hashes". With the previous status quo: 1. The attacker faces charges of possessing and distributing child pornography 2. The victim may be investigated and charged with child pornography if LEO is somehow alerted (which requires work, a…

Before they make it to human review, photos in decrypted vouchers have to pass the CSAM match against a second classifier that Apple keeps to itself. Presumably, if it doesn’t match the same asset, it won’t be passed along. This is explained towards the end of the threat model document that Apple posted to its website. https://www.apple.com/child-safety/pdf/Security_Threat_Model...

What happens if someone leaks or guesses the weights on that "secret" classifier? The whole system is so ridiculous even before considering the amount of shenanigans the FBI could pull by putting in non-CSAM hashes.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#152

Post by ec109685 »

ryanmarsh wrote: post #7

Ok so now all we have to do is get a phone, load it with adversarial images that have hashes from the CSAM database and we wait and see what happens. Basically a honeypot. Get some top civil rights attorneys involved. Take the case to the Supreme Court. Get precedence set right. Lawfare

The adversarial images have to match both the NeuralHash output of CSAM, plus another private perceptual hash that points to the same image that only Apple has access to, plus a human reviewer needs to agree it is CSAM, and this has to happen for 30 images.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#153

Post by zepto »

shuckles wrote: post #115
SCLeo wrote: post #113

Earlier quoted context omitted.

I can't tell if you are being sarcastic. In case you are not, isn't the act of sending those pictures completely illegal?

People here are proposing intentionally creating image assets which collide with perceptual hashes of known CSAM (ignoring whether that is legal or ethical) and sharing those assets to effectively SWAT unaware targets.

They still seem to be under the impression that a neuralhash collision would be enough to do this, which it isn’t.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#154

Post by zepto »

dannyw wrote: post #39
robertoandred wrote: post #36

Earlier quoted context omitted.

Why would anyone save CSAM to their photo library?

A hash collision allows you to create material that matches CSAM signatures, without being CSAM. This opens up a new class of attacks. Specifically, many criminal actors don't touch CSAM because it's wrong. But some of these criminal actors will happily abuse legal systems, e.g. SWATTing.

> A hash collision allows you to create material that matches CSAM signatures, without being CSAM.

This is not correct. Hash collisions won’t match the visual derivative.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#155

Post by zepto »

systemvoltage wrote: post #42
robertoandred wrote: post #36

Earlier quoted context omitted.

Why would anyone save CSAM to their photo library?

I posted another comment that was misunderstood as well. Folks, no one is proposing to download actual CSAM images to your photo lib. You could be duped thinking you downloaded an image of a beautiful sunset which was carefully manipulated to match the hash of an actual CSAM image.

Yes but that would be harmless because the visual derivative wouldn’t match.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#156

Post by ThinBold »

Despite that Apple scanning our images is a horrible privacy practice, I don't get why 𝚜̶𝚘̶ ̶𝚖̶𝚊̶𝚗̶𝚢̶ some people think this is an ineffective idea.

Surely you can easily fabricate innocent images whose NeuralHash matches the database. But in what way are you going to send them to victims and convince them to save them to their photo library? The moment you send it via WhatsApp FB will stop you because (they think) it is a problematic image. And Even if the image did land, it has to look like some cats and dogs or the receiver will just ignore. (Even worse, the receiver may report you.) And even if your image does look like cats and dogs, it has to pass another automatic test at the server side that uses another obfuscated, constantly-updating algorithm. After that, even more tests if Apple really wants to.

That means your image needs to collide ≥ three times, one open, one obfuscated, and one Turing.

Gmail scans your attachments and most people are cool with it. I highly doubt that Apple has any reason to withdraw this.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#157

Post by belltaco »

robertoandred wrote: post #91
arsome wrote: post #71

Earlier quoted context omitted.

The client has to be able to check for them in some way - just run that algorithm against every image you can scrape from Tor/Freenet and I suspect you'll have results rather quickly. Or you can probably just wait a minute and pay an... enterprising individual to sell you such a list on a darknet market though, or perhaps even find one posted on the clearnet soon enough.

No, the client doesn’t have access to the CSAM hashes. And matches are verified on the server, not on the client.

The poster meant the algorithm to compute the hash has to be on the local device. And it's already been found.

https://old.reddit.com/r/MachineLearning/comments/p6hsoh/p_a...

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#158

Post by zepto »

iaw wrote: post #82

Really naive question. What's to stop apple from using two distinct and separate visual hashing algorithms? Wouldn't the collision likelihood decrease drastically in that scenario? Again, really naive but it seems like if you have two distinct multi-dimensional hashes it would be much harder to solve the gradient descent problem.

They do. The system isn’t vulnerable to these collisions attacks. The people saying they are are just not aware of how the system works.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#159

Post by niij »

Alupis wrote: post #35

So, what does Apple get out of all this, except negative attention, erosion of their image, possible privacy lawsuits, etc? I just don't understand what Apple's motivation would have been here. Surely this fallout could have been anticipated?

Government coercion.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#160

Post by arsome »

belltaco wrote: post #157
robertoandred wrote: post #91

Earlier quoted context omitted.

No, the client doesn’t have access to the CSAM hashes. And matches are verified on the server, not on the client.

The poster meant the algorithm to compute the hash has to be on the local device. And it's already been found. https://old.reddit.com/r/MachineLearning/comments/p6hsoh/p_a...

Indeed, if they're proposing to only decrypt select images the client needs to know pass/fail at some point. Whether that's before or after sending the hashes to Apple's server really doesn't matter as bulk checks will likely be a part of API anyways. We'll have to wait for further reverse engineering to get full details here though.
Post reply on HN