> a catalog Can two collisions really be called a catalog?
It's a WIP catalog where everyone who stumbles over one can put it in.
It could in the future be used to e.g. improves this algorithms.
A catalog of naturally occurring images whose Apple NeuralHash is identical
141–150 of 304 posts
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#142My take on this is that the system is by and large useless. It won't catch anything but the dumbest of dumb criminals, because those who care about CSAM can surely figure out a better way to share images, or find a way to obfuscate their images enough to bypass the system (the lower the false positive rate, the easier it must be to trick the system). So what's left when all the criminals this is supposed to catch hav…
Perceptual hashes are only used to reduce the search space for human review. Apple doesn’t have images in the CSAM database to do a comparison, but if it’s just a picture of a door their going to reject it. Also, because human review is an expense Apple’s incentives are to minimize the number of times it happens, thus the requirement for multiple collisions.
> Apple’s incentives are to minimize the number of times it happens, thus the requirement for multiple collisions.
How can we be sure they won’t cut costs by increasing worker load? I could see them giving each reviewer less time to review individual pictures before passing it on to law enforcement.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#143Apple has yet to make a valid reason for implementing client side CSAM scanning. According to Apple only images that will be uploaded to iCloud will be scanned. If this is the case there is zero reason to scan locally and you can just scan the uploaded image once it is on the server. Apple has not implemented E2E nor has it released a statement indicating this will be implemented in the future.
There is an interesting constitutional quirk which arises from the scanning being done client side, specifically for US citizens. If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. Whereas if the CSAM scanning was performed exclusiv…
What kind of non-CSAM crime could be detected with just a couple of hashes? Wouldn’t Apple need to reduce the similarity score in order to even get something close?
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#144Earlier quoted context omitted.
> allows the producers and distributors of CSAM material to ensure that nearly all of the next generation of CSAM will suffer from hash collisions with perfectly innocent images That’s a really interesting attack vector I hadn’t seen mentioned previously. Most people are talking about the potential for adversarial images to be sent to users. If they were instead injected into the database itself (either by poisoning…
Because they're not CSAM? People don't seem to grasp what kind of images end up in the CSAM databases. They are most definitely not "leaked celebrity nude selfie" level stuff. Think of the most vile sexual thing you could do to a child and then times that by two and halve the child's age in your mind. That's the shit that gets in there. It's not something even 4chan weebaboos share. It's stuff that makes Liveleak reg…
How is the human reviewer expected to make that judgement call? They’re not allowed to see the original to compare with for obvious reasons.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#145Technically speaking, this does not prove that an adversarial attack is possible on the CSAM system of apple, Given that apple has another not released neural hash system on their servers which is potentially larger and works better than the one on device.
The more interesting technical question for me is: do collisions transfer across models? or how to find collisions that transfer across models?
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#146Earlier quoted context omitted.
One reason for client side could be to save on datacenter compute resources. That would seem like a perfectly valid reason, if that’s their reasoning.
If it’s going to really save a significant amount of data center resources, then it’s also probably going to reduce the battery lifespan of all these devices significantly. That may probably be good for Apple’s bottom line temporarily, but it will hurt in the long run. I’d imagine it’d be a lot easier to optimize the data center compute resources than optimizing the scanning on individual devices and not trashing bat…
> I’d imagine it’d be a lot easier to optimize the data center compute resources than optimizing the scanning on individual devices and not trashing battery lifespan.
No amount of data center optimization will beat running computations on hundreds of millions of devices other people have to pay for.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#147Earlier quoted context omitted.
> If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. There's no reason not to assume this isn't already happening, being closed source and proprietary. The question to ask is, what are we going to do about it?
If you take that line of argument, you must also accept that you have no reason not to assume that binary distributions of Android and Windows haven't been doing similar things for the past decade.
I agree with you in that I don't think the problem is the closed-source aspect. Closed source software can still be audited (with difficulty). The problem is that the source material for the hashes can't be audited, even when we know exactly how the system works.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#148Apple has yet to make a valid reason for implementing client side CSAM scanning. According to Apple only images that will be uploaded to iCloud will be scanned. If this is the case there is zero reason to scan locally and you can just scan the uploaded image once it is on the server. Apple has not implemented E2E nor has it released a statement indicating this will be implemented in the future.
There is an interesting constitutional quirk which arises from the scanning being done client side, specifically for US citizens. If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. Whereas if the CSAM scanning was performed exclusiv…
I think you're implying that scanning of private personal property by a corporation without a warrant protects users from searches of their content in the cloud that is authorized by a warrant or national security letter. I don't understand the mechanism if there isn't end to end encryption, and I don't understand the mechanism if there is end to end encryption.
Scanning makes phones a greater threat, and also erodes the expectation of privacy that is a legal barrier to surveillance.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#149Earlier quoted context omitted.
Why would anyone go to the effort of technical concealment[1] of CSAM when they could just resist the urge to import child porn in their phone's photo library in the first place? I've managed to resist the urge to import regular porn into my photo library, and being caught with regular porn is (at most) embarrassing. It's not potentially life-destroying. It's inconceivable that anyone could desire possession of NCMEC…
I agree with you in that I do not understand why anybody doing something illegal would upload related data to a cloud storage. But if nobody would import CSAM into their icloud library why do all the pictures need to be scanned in the first place? I would imagine anybody doing major illegal stuff being informed about important measures in order to not be caught.
I agree, why Apple is doing this is an interesting and pertinent question. I don't think it's actually because they think this will put a big dent into CSAM. So the question is: what is motivating Apple?
Perhaps it's a prerequisite for deploying end-to-end encryption of iCloud Photo Library and/or iCloud Backups. The latter in particular has remained decryptable by Apple supposedly due to pressure from the FBI. Perhaps CSAM is what the FBI are using to justify their pressure.
Perhaps it's because Apple's team of lobbyists are seeing ahead to future anti-privacy, anti-encryption legislation being justified under the guise of CSAM. If Apple can show that the CSAM problem is already "solved" then such justifications disintegrate.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#150Why not combine this with a second different hash? E: Better yet, only run the second hash if you have a collision, which should be very rare.
Apple does, and I created a proof of concept for how it might work to guard against adversarially perturbed images here: https://blog.roboflow.com/apples-csam-neuralhash-collision/