A catalog of naturally occurring images whose Apple NeuralHash is identical

Post by Someone » Wed, Aug 25, 2021, 3:26 PM UTC

saithound wrote: post #83

SiempreViernes wrote: post #77

Earlier quoted context omitted.

Yeah, of course the collision rate in an adversarial dataset is likely to be much higher. But I really wonder why you think this is an important objection, do you think a lot of people want to go to the "get flagged for child porn" casino?

The existence of a preimage attack makes Apple's system completely useless for its nominal purpose. The NeuralHash collider allows the producers and distributors of CSAM material to ensure that nearly all of the next generation of CSAM will suffer from hash collisions with perfectly innocent images. If these new images never make it to the NCMEC database, then new CSAM content will be completely NeuralHash-proof. How…

Post by foxfluff » Wed, Aug 25, 2021, 3:31 PM UTC

tyingq wrote: post #191

foxfluff wrote: post #183

Earlier quoted context omitted.

"After running the hashes against 100 million non-CSAM images, Apple found three false positives" So closer to 1/10M. The reporting threshold is made artificially higher by requiring more than one positive. But anyway, that's beside the point. A perceptual hash is not uniformly distributed; it's not a random number. Likewise for photos taken in a specific setting; they do not approach the randomness of a set of rando…

"After running the hashes against 100 million non-CSAM images" They don't say what kind/distribution of non-CSAM images. Landscapes? Parent pix of kids in the bathtub? Cat memes? Porn of young adults? Photos from real estate listings? I suspect some pools of image types would have a much higher hit rate. Edit: And, well "hot dog / not hot dog" is impressive on a set of random landscapes too.

Post by colejohnson66 » Wed, Aug 25, 2021, 3:32 PM UTC

jrockway wrote: post #185

simondotau wrote: post #70

Earlier quoted context omitted.

There is an interesting constitutional quirk which arises from the scanning being done client side, specifically for US citizens. If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. Whereas if the CSAM scanning was performed exclusiv…

Apple could also encrypt every upload to iCloud, and not have any scanning on the client, and still be able to say to the government "sure, you can have the files; we can't read them and neither can you". Apple wants to reduce your privacy from the government above and beyond what the law requires. The questions is: why?

Post by Tagbert » Wed, Aug 25, 2021, 3:34 PM UTC

jdavis703 wrote: post #142

Retric wrote: post #124

Earlier quoted context omitted.

Perceptual hashes are only used to reduce the search space for human review. Apple doesn’t have images in the CSAM database to do a comparison, but if it’s just a picture of a door their going to reject it. Also, because human review is an expense Apple’s incentives are to minimize the number of times it happens, thus the requirement for multiple collisions.

> Apple’s incentives are to minimize the number of times it happens, thus the requirement for multiple collisions. How can we be sure they won’t cut costs by increasing worker load? I could see them giving each reviewer less time to review individual pictures before passing it on to law enforcement.

Post by mayoff » Wed, Aug 25, 2021, 3:40 PM UTC

foxfluff wrote: post #123

My take on this is that the system is by and large useless. It won't catch anything but the dumbest of dumb criminals, because those who care about CSAM can surely figure out a better way to share images, or find a way to obfuscate their images enough to bypass the system (the lower the false positive rate, the easier it must be to trick the system). So what's left when all the criminals this is supposed to catch hav…