Any computational method that relies on a function that converts m bits (an image) to n bits (a fingerprint) where m > n will always be vulnerable to such an attack. The smaller n is compared to m, the easier it is to counterfeit something with that signature. It is not new knowledge. The only way to be certain, unfortunately, is for a human to look at it. When the allegation is as serious as CSAM, I would rather be…
> Any computational method that relies on a function that converts m bits (an image) to n bits (a fingerprint) where m > n will always be vulnerable to such an attack. The "vulnerable" depends on your definition: SHA-2 and SHA-3 are both still quite safe against preimage attacks, and even second preimage attacks require significant work to pull off for SHA-2, and I am unaware of any meaningful second preimage attack…
They essentially take an image and scale it to a small thumbnail. The values of all those reduced pixels are the hash of the original image. When a new image is scanned it's just doing a similarity check against the database of those hashes of known "bad" images. A hit triggers checking against an image hash performed with a separate algorithm. Hits against multiple hashes triggers a "bad image alarm" and ruins a person's life.
Changing a few input bits in an image doesn't usually change the perceptual hash because they're meant to be resistant to small amounts of localized noise. It is possible to add noise that will change a perceptual hash. It's also possible to manipulate an image so transforms (scaling etc) get wildly different results.
This leads to two exploits. The first is an attacker manipulates a "good" image such that when hashed it matches perceptual hashes of a "bad" image. The attacker then sends a bunch of these to a target triggering the "bad image alarm" and essentially SWATs the target. The second is to manipulate bad images in a recoverable way to get them pasted bad image scanners.