Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A catalog of naturally occurring images whose Apple NeuralHash is identical

github.com

Post reply on HN
Print view View original

181–190 of 304 posts

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#181

Post by Someone »

ajb wrote: post #97
scotty79 wrote: post #71

Why are exact collisions interesting? They are not intended to be compared exactly. This algorithm doesn't even give exact matches for the same image on different hardware. https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX Note: Neural hash generated here might be a few bits off from one generated on an iOS device. This is expected since different iOS devices generate slightly different hashes anyway. The reason…

If you can get exact collisions, this can be gamed. For example, suppose there are two rival gangsters. One wants to set the police on his rival. He knows that a certain (innocuous) image is on his rival's phone. So he pays someone to generate a fake child-porn image with the same neuralhash, and ensure that it gets into the child porn DB. Then, apple reports the rival to the police, and they come and investigate him…

If your enemy can get an image on your phone and in the “child porn DB”, I think they can easily get you in trouble without Apple’s help.

they can either just send the police an anonymous message or set up a child porn web site and have it ‘accidentally’ leak its password database, and make sure your email address is in it.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#182

Post by user-the-name »

roody15 wrote: post #33

Apple has yet to make a valid reason for implementing client side CSAM scanning. According to Apple only images that will be uploaded to iCloud will be scanned. If this is the case there is zero reason to scan locally and you can just scan the uploaded image once it is on the server. Apple has not implemented E2E nor has it released a statement indicating this will be implemented in the future.

Apple basically never announces things before they are ready to be released, so them not announcing this means very little. They may be working on it, and their usual secrecy is biting them in the ass very hard.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#183

Post by foxfluff »

volta83 wrote: post #174
foxfluff wrote: post #123

My take on this is that the system is by and large useless. It won't catch anything but the dumbest of dumb criminals, because those who care about CSAM can surely figure out a better way to share images, or find a way to obfuscate their images enough to bypass the system (the lower the false positive rate, the easier it must be to trick the system). So what's left when all the criminals this is supposed to catch hav…

The false positive rate reported in the blogpost for imagenet was 1 in a trillion, and the author concludes that this algorithm is better than they expected.

"After running the hashes against 100 million non-CSAM images, Apple found three false positives"

So closer to 1/10M. The reporting threshold is made artificially higher by requiring more than one positive.

But anyway, that's beside the point.

A perceptual hash is not uniformly distributed; it's not a random number. Likewise for photos taken in a specific setting; they do not approach the randomness of a set of random images.

So someone snapping a photos in a setting that has features similar to a set of photos in the CSAM database may risk a massively higher false positive rate. It's no longer a million sided dice, it could be a thousand sided dice when your outputs happen to be clustered around similar values due to similar setting.

But I can't say I care about false positives. To me the system is bad either way.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#184

Post by fraa-orolo »

jdavis703 wrote: post #142
Retric wrote: post #124

Earlier quoted context omitted.

Perceptual hashes are only used to reduce the search space for human review. Apple doesn’t have images in the CSAM database to do a comparison, but if it’s just a picture of a door their going to reject it. Also, because human review is an expense Apple’s incentives are to minimize the number of times it happens, thus the requirement for multiple collisions.

> Apple’s incentives are to minimize the number of times it happens, thus the requirement for multiple collisions. How can we be sure they won’t cut costs by increasing worker load? I could see them giving each reviewer less time to review individual pictures before passing it on to law enforcement.

We can't and they probably will, everyone else seems to already be doing so. There's that Swiss federal police report that only about 10% of NCMEC reports are actually relevant (https://fedpol.report/en/fedpol-in-figures/fight-against-pae...)

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#185

Post by jrockway »

simondotau wrote: post #70
roody15 wrote: post #33

Apple has yet to make a valid reason for implementing client side CSAM scanning. According to Apple only images that will be uploaded to iCloud will be scanned. If this is the case there is zero reason to scan locally and you can just scan the uploaded image once it is on the server. Apple has not implemented E2E nor has it released a statement indicating this will be implemented in the future.

There is an interesting constitutional quirk which arises from the scanning being done client side, specifically for US citizens. If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. Whereas if the CSAM scanning was performed exclusiv…

Apple could also encrypt every upload to iCloud, and not have any scanning on the client, and still be able to say to the government "sure, you can have the files; we can't read them and neither can you". Apple wants to reduce your privacy from the government above and beyond what the law requires. The questions is: why?

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#186

Post by Grustaf »

dathinab wrote: post #153
Grustaf wrote: post #98

Earlier quoted context omitted.

Since the risk of that is 1 in a trillion, a lot of people are quite happy to take that risk.

It's not 1 in a trillion, it's MUCH higher. We are not speaking about a situation where not a "arbitrary" picture is miss-classifieds. We are speaking about a situation where a innocent picture involving a naked or not fully clothed child is deemed similar to a non innocent picture of a naked or not fully clothed child. Now you might argue that there should not be a picture a a naked or not fully clothed child of any…

> Now you might argue that there should not be a picture a a naked or not fully clothed child of any form ever on any phone

No I'm definitely not arguing that. I'm not American, where I live you'll sometimes see nude bathers in the city centre, and most definitely nude children on the beach.

1 in a trillion is derived from a dataset of 100 million photos, presumably a representable proportion of these were "similar images" like bathing kids.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#187

Post by user-the-name »

School-Cotton wrote: post #175
scotty79 wrote: post #71

Why are exact collisions interesting? They are not intended to be compared exactly. This algorithm doesn't even give exact matches for the same image on different hardware. https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX Note: Neural hash generated here might be a few bits off from one generated on an iOS device. This is expected since different iOS devices generate slightly different hashes anyway. The reason…

That explanation doesn’t make sense to me. Standard (IEEE) floating-point math is deterministic; it shouldn’t depend on the hardware.

The processors that implement hardware-accelerated neural nets are not necessarily using standard IEEE floating-point math.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#188

Post by UncleMeat »

iamtheworstdev wrote: post #126
monkeynotes wrote: post #109

Earlier quoted context omitted.

I think before a criminal investigation, or any investigation at all is pursued, a human verifying the images would dismiss the false positive. I would think surreptitiously placing actual child porn on a rival's phone/computer would be much, much more effective. Cybercriminals could likely do all this remotely. Phish for apple account login, upload images. Done.

you think the US government would respect the law before initiation of actions to take down a criminal? they rarely do that when dealing with people that dont have criminal backgrounds

Okay. Then why are you worried about this new system, given that the US govt can just throw you in prison at a whim?

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#189

Post by foxfluff »

user-the-name wrote: post #179
foxfluff wrote: post #123

My take on this is that the system is by and large useless. It won't catch anything but the dumbest of dumb criminals, because those who care about CSAM can surely figure out a better way to share images, or find a way to obfuscate their images enough to bypass the system (the lower the false positive rate, the easier it must be to trick the system). So what's left when all the criminals this is supposed to catch hav…

> It won't catch anything but the dumbest of dumb criminals This includes the vast majority of pedophiles.

Where did you find the statistics about pedophiles' intelligence?

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#190

Post by Grustaf »

teekert wrote: post #155
dathinab wrote: post #153

Earlier quoted context omitted.

It's not 1 in a trillion, it's MUCH higher. We are not speaking about a situation where not a "arbitrary" picture is miss-classifieds. We are speaking about a situation where a innocent picture involving a naked or not fully clothed child is deemed similar to a non innocent picture of a naked or not fully clothed child. Now you might argue that there should not be a picture a a naked or not fully clothed child of any…

Where I live some kids even play naked on normal beaches or near lakes or in their backyard, whatever. Up to 2 years old it's very normal. Within families kids and parents see each other naked up until puberty of the kids and the kids don't feel comfortable anymore. If you go to a sauna, everybody is naked. Or what if a kid gets her/his hands on a phone and takes some pics (doesn't even require unlocking the phone) b…

Up to 2 years? Hold my beer, in Scandinavia 5 year olds routinely run naked on public beaches. You're not even very shocked if you see nude grownups bathing.
Post reply on HN