Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

github.com

Post reply on HN
Print view View original

301–310 of 363 posts

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#301

Post by GistNoesis »

anishathalye wrote: post #2

The README ( https://github.com/anishathalye/neural-hash-collider#how-it-... ) explains in a bit more detail how these adversarial attacks work. This code pretty much implements a standard adversarial attack against NeuralHash. One slightly interesting part was replacing the thresholding with a differentiable approximation. I figured I'd share this here in case anyone is interested in seeing what the code to generate…

Well done ! Here is my version that uses Scipy lbfgs-b optimizers : https://gist.github.com/unrealwill/d64d653a7626b825ef332aa3b...

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#302

Post by xucheng »

In addition to the attacks, such as converting legit image to be detected as CSAM (false positive) or circumventing detection of the real CSAM image (false negative), which have been widely discussed in HN, I think this can also be used to mount a DOS attack or to censor any images.

It works like this. First, found your target images, which are either widely available like internet memes for DOS attack or images you want to censor. Then, compute their Neuralhash. Next, use the hash collision tool to turn real CSAM images to have the same NeuralHash as the target images. Finally, report these adversarial CSAM images to the government. The result is that the attackers would successfully add the targeted NeuralHash into the CSAM database. And people who store these legit image will then be flagged.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#303

Post by chongli »

romeovs wrote: post #292

A lot has been said about using this as an attack vector by possibly poisoning a victims iPhone with an image that matches a CSAM hash. But could this not also be used to circumvent the CSAM scanning by converting images that are in the CSAM database to visually similar images that won't match the hash anymore? That would effectively defeat the CSAM scanning Apple and others are trying to put into place completely an…

Or am I missing something here?

Wouldn't it be easier for offenders to avoid Apple products? That requires no special computer expertise and involves no risk on their part.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#304

Post by zo1 »

asxd wrote: post #291
ThinBold wrote: post #156

Despite that Apple scanning our images is a horrible privacy practice, I don't get why 𝚜̶𝚘̶ ̶𝚖̶𝚊̶𝚗̶𝚢̶ some people think this is an ineffective idea. Surely you can easily fabricate innocent images whose NeuralHash matches the database. But in what way are you going to send them to victims and convince them to save them to their photo library? The moment you send it via WhatsApp FB will stop you because (they th…

I really appreciate this comment, as anytime a new security issue creates a fuss, I feel like I'm the only one wondering what the real attack vector is. I'm genuinely glad people are so thoroughly investigating this new Apple policy, but at the same time I feel like I'm the only one dumb enough not to understand what I should be actually concerned about.

It's all theater. We need to stop talking about it and get trusted security researchers picked at random to be deployed to Apple for an audit. They sign an NDA, they work in a clean room with no way to exfiltrate data, they get full access to all the algorithms, source code, trained networks, all test data, access to Apples infra to test as they please, etc. And then they need to be the definitive authority on this matter to give us info and suggestions. Not Apple, not PR departments, not the EU parliament, not the US gov. And most certainly not us.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#305

Post by Erwin »

jobigoud wrote: post #296

Can someone explain what is the profile of criminals they expect to catch with this system? People that are tech savy enough to go on the darknet and find CSAM content but simultaneously stupid enough to upload these images to iCloud? And they think there are enough of these people to create this very complicated system and risk a PR disaster?

Here in Denmark a 15-year old girl and boy was filmed while having sex, and the video spread around among teenagers, apparently mostly through Facebook Messenger.

In 2018, the police indicted 1000 of them (tracking them down with Facebook's help). Legal results were a child-porn law judgement for 334 of them, and simpler penalties for 400.

The child-porn judgement was mostly suspended sentences, but it precludes working with children (as a teacher or even sports trainer if children under 15yo are involved) for between 10 and 20 years.

If there was a system that would have caught it sooner, prior to sharing, the spread would be minimized. The police took 3 years to form a plan to indict the 1000+ people.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#306

Post by rebuilder »

Alupis wrote: post #35

So, what does Apple get out of all this, except negative attention, erosion of their image, possible privacy lawsuits, etc? I just don't understand what Apple's motivation would have been here. Surely this fallout could have been anticipated?

Cynical speculation:

Apple have decided their position of not being able to provide access to law enforcement is becoming a liability. They're probably under intense pressure from several governments on that front.

This is a way to intentionally let their hand be forced into scanning for arbitrary hashes on devices at the behest of governments, taking pressure off Apple and easing their relations with governments. They take a PR hit now, but it's not too bad since it's ostensibly about fighting child abuse, and Apple's heart is clearly in the right place. When later, inevitably, the hashes start to include other material, Apple can say their hands are tied on the matter - they can no longer use the "can't do it" defense and are forced to comply. This is much simpler than having to fight about it all the time.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#307

Post by Fnoord »

vermilingua wrote: post #37

The integrity of this entire system now relies on the security of the CSAM hash database, which has just dramatically increased in value to potential attackers. All it would take now, is for one CSAM hash to be known to the public, then uploading collided iPhone wallpapers to wallpaper download sites. That many false positives will overload whatever administrative capacity there is to review reports in a matter of da…

To assume CP is reviewed manually is simply wrong. You don't want to put such weight on an individual. You want to automate it as much as possible, with as little false positives (and false negatives) as possible.

For example, in case of a wallpaper, let's say its the Windows XP wallpaper. There's no human skin color in it at all, so you can easily be reasonably sure it isn't CP. You would not need an advanced ML for such.

And they can have multiple checksums, just like a tarball or package or whatever can have an CRC32, MD5, and SHA512. Just because one of these matches, doesn't mean the other don't. Only problem is keeping these DBs of hashes secret. But that could very well be a reason the scanning isn't done locally.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#308

Post by vermilingua »

comex wrote: post #237
vermilingua wrote: post #217

Earlier quoted context omitted.

But surely if they're doing this in anticipation of E2EE user data, that procedure becomes moot? So either they have no intention to actually protect user data, or the system is trivially broken; either way a pretty damning look for Apple.

No, because the second hash is only performed after the first hash has already matched, and so, using the threshold secret sharing crypto, the server has learned the escrowed encryption key for the image. (Well, for its “visual derivative”, at any rate.)

So, Apple retains the ability to decrypt E2EE data? That’s… worse?

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#309

Post by sennight »

ThinBold wrote: post #234
copperx wrote: post #222

Earlier quoted context omitted.

Almost nobody is arguing the effectiveness of the idea. That would be missing the point entirely.

The first comment algorithm choses to show me contains substring "and this system is transparently broken". Isn't that a remark on the effectiveness of the idea or I misread? (In case you have problem with me saying "so many", that I can fix.)

> I don't get why 𝚜̶𝚘̶ ̶𝚖̶𝚊̶𝚗̶𝚢̶ some people think this is an ineffective idea.

Because such architectural flaws become absolute train wrecks when scaled. Remember the Clipper Chip? This is like that: cryptographers pointing out fundamental flaws that may seem like minor issues to most of the users who were going to be compelled to use it - but at scale those flaws result in the direct opposite of the stated objectives.

It feels weird having to explain scalability on HN... everyone here should know that if your little scheme is struggling pre-rollout then trying to power through will only magnify your troubles. So it is hard to account for that blind spot that defenders of this thing seem to have.

Re: Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

#310

Post by vermilingua »

Fnoord wrote: post #307
vermilingua wrote: post #37

The integrity of this entire system now relies on the security of the CSAM hash database, which has just dramatically increased in value to potential attackers. All it would take now, is for one CSAM hash to be known to the public, then uploading collided iPhone wallpapers to wallpaper download sites. That many false positives will overload whatever administrative capacity there is to review reports in a matter of da…

To assume CP is reviewed manually is simply wrong. You don't want to put such weight on an individual. You want to automate it as much as possible, with as little false positives (and false negatives) as possible. For example, in case of a wallpaper, let's say its the Windows XP wallpaper. There's no human skin color in it at all, so you can easily be reasonably sure it isn't CP. You would not need an advanced ML for…

To assume it’s never reviewed manually is absolutely terrifying.
Post reply on HN