Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A catalog of naturally occurring images whose Apple NeuralHash is identical

github.com

Post reply on HN
Print view View original

61–70 of 304 posts

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#61

Post by koolhaas »

grlass wrote: post #55
koolhaas wrote: post #46

Earlier quoted context omitted.

Presumably, it’s done this way so they can say computers other than your personal device do not scan photos and “look” at decrypted and potentially innocent photos. And technically the original image is never decrypted in iCloud by Apple - if 30 images are flagged they are then able to decrypt the CSAM scan meta data which contains resized thumbnails, for confirmation. In summary, I’m guessing they tried to invent a…

calling resized thumbnails metadata is a bit of a stretch imo. Surely that's just the data, but resized?

Yes I agree, bit of a stretch. Based on their whitepaper, it's a smaller version of the original image, I guess just large enough to support the human verification step.

But I'm unsure that the thumbnail is included with every CSAM "voucher" -- it's likely only included when you pass the 30 image limit. Need to read that section more clearly.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#62

Post by david_draco »

tsimionescu wrote: post #5
toxik wrote: post #3

Sigh, for the last time, it doesn't actually matter if the NeuralHash is identical. You need multiple images matching, and then the images are compared by another system on Apple's end, which you don't know anything about. The system is specifically designed so that colliding images does not pose a threat to the user. NeuralHash and the CSAM scanning is grotesque, but please, criticize it for what it is, not some bul…

Then let's get rid of the NeuralHash entirely, if it doesn't matter, right? If it's a critical part of the system, then it should be inspected thoroughly. If Apple claims a minuscule chance of a hash collision, and the reality is that collisions are relatively common, that significantly changes the requirements for the backend system, which Apple keeps secret. We have every right to believe, bbased oon ppublic info,…

> collisions are relatively common

Are they?

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#63

Post by saithound »

koolhaas wrote: post #61
grlass wrote: post #55

Earlier quoted context omitted.

calling resized thumbnails metadata is a bit of a stretch imo. Surely that's just the data, but resized?

Yes I agree, bit of a stretch. Based on their whitepaper, it's a smaller version of the original image, I guess just large enough to support the human verification step. But I'm unsure that the thumbnail is included with every CSAM "voucher" -- it's likely only included when you pass the 30 image limit. Need to read that section more clearly.

A thumbnail is included with every safety voucher. However, it is encrypted with a key that resides on your hardware and is unknown to Apple. So Apple doesn't have enough information to decrypt your thumbnails at will.

A secret sharing scheme is used to drip-feed Apple the key: each time a positive match occurs, Apple learns a bit more about your key. Once the threshold is reached, Apple will have learned enough to recover your encryption key, and will be able to use it to decrypt all your matching thumbnails at once.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#64

Post by madeofpalk »

mns wrote: post #49
nobrains wrote: post #31

Please help me understand. Isn't this the reason why the process involved a final manual review? If so, isn't the point of having identical hashes moot? Or is the point that having more identical hashes means reviewing more personal pictures manually, leading to a privacy issue?

I don't think I would trust a huge corporation with this. Plus, leaving the review to some internal classified process where some poor faceless guy needs to reach an unrealistically high quota of reviewed images per day to get his bonus, might be a bit of a risk.

it's not just internal policy - the safety vouchers will not decrypt (technically impossible) unless there are ~30 matches. It is a policy encoded in cryptography.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#65

Post by koolhaas »

roody15 wrote: post #60
koolhaas wrote: post #46

Earlier quoted context omitted.

Presumably, it’s done this way so they can say computers other than your personal device do not scan photos and “look” at decrypted and potentially innocent photos. And technically the original image is never decrypted in iCloud by Apple - if 30 images are flagged they are then able to decrypt the CSAM scan meta data which contains resized thumbnails, for confirmation. In summary, I’m guessing they tried to invent a…

Apple frequently decrypts icloud data including photos based on a valid warrant. This new local scanning method does not stop apple from complying and decrypting images like they have for years. https://www.apple.com/legal/privacy/law-enforcement-guidelin... (Note: I have worked with law enforcement in the past specifically on a case involving Apple and two iCloud accounts. You submit a PDF of the valid warrant to Ap…

Of course, but it's a kind of last resort thing to support a valid legal process they cannot (and probably don't want to) skirt around. They also publish data on warrant requests.

To me it's pretty clear they are doing the absolute minimum possible to keep congress from regulating them into a corner, where they lose decision making control around their own privacy standards. The system they came up with is their answer for doing it in the most privacy conscious way (e.g. not decrypting user data in icloud) while balancing a lot of other threat model details, like what if CSAM-hash-providing organizations provide img hashes for a burning American flag, and lots of other scenarios outlined in the white paper.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#66

Post by madeofpalk »

ben-schaaf wrote: post #39
ithkuil wrote: post #24

Earlier quoted context omitted.

Let's not forget what the alternative is: this is about images that are uploaded on icloud anyway. The alternative is to upload the image in clear (or with ane encryption key that apple controls), and let apple run the CSAM filter on their servers. Apple now has the ability to encrypt the images before sending them to icloud, with a private key you own. Except that some percentage of images that match the CSAM finger…

They already have the decryption keys for iCloud. Undoubtedly they've already been running a similar CSAM filter server-side for ages. The only thing doing this stuff client side has done is reduce privacy and erode trust.

> Undoubtedly they've already been running a similar CSAM filter server-side for ages

Apparently they have not - They say facebook reported something like 20m images in a year, and Apple reported 250.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#67

Post by koolhaas »

saithound wrote: post #63
koolhaas wrote: post #61

Earlier quoted context omitted.

Yes I agree, bit of a stretch. Based on their whitepaper, it's a smaller version of the original image, I guess just large enough to support the human verification step. But I'm unsure that the thumbnail is included with every CSAM "voucher" -- it's likely only included when you pass the 30 image limit. Need to read that section more clearly.

A thumbnail is included with every safety voucher. However, it is encrypted with a key that resides on your hardware and is unknown to Apple. So Apple doesn't have enough information to decrypt your thumbnails at will. A secret sharing scheme is used to drip-feed Apple the key: each time a positive match occurs, Apple learns a bit more about your key. Once the threshold is reached, Apple will have learned enough to r…

Fascinating, thanks for clarifying.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#68

Post by FabHK »

koolhaas wrote: post #61
grlass wrote: post #55

Earlier quoted context omitted.

calling resized thumbnails metadata is a bit of a stretch imo. Surely that's just the data, but resized?

Yes I agree, bit of a stretch. Based on their whitepaper, it's a smaller version of the original image, I guess just large enough to support the human verification step. But I'm unsure that the thumbnail is included with every CSAM "voucher" -- it's likely only included when you pass the 30 image limit. Need to read that section more clearly.

> Based on their whitepaper, it's a smaller version of the original image,

I seem to recall that the white paper speaks of a "visual derivative" without specifying it further.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#69

Post by AnonC »

mrweasel wrote: post #40
roody15 wrote: post #33

Apple has yet to make a valid reason for implementing client side CSAM scanning. According to Apple only images that will be uploaded to iCloud will be scanned. If this is the case there is zero reason to scan locally and you can just scan the uploaded image once it is on the server. Apple has not implemented E2E nor has it released a statement indicating this will be implemented in the future.

One reason for client side could be to save on datacenter compute resources. That would seem like a perfectly valid reason, if that’s their reasoning.

If it’s going to really save a significant amount of data center resources, then it’s also probably going to reduce the battery lifespan of all these devices significantly. That may probably be good for Apple’s bottom line temporarily, but it will hurt in the long run. I’d imagine it’d be a lot easier to optimize the data center compute resources than optimizing the scanning on individual devices and not trashing battery lifespan.

Re: A catalog of naturally occurring images whose Apple NeuralHash is identical

#70

Post by simondotau »

roody15 wrote: post #33

Apple has yet to make a valid reason for implementing client side CSAM scanning. According to Apple only images that will be uploaded to iCloud will be scanned. If this is the case there is zero reason to scan locally and you can just scan the uploaded image once it is on the server. Apple has not implemented E2E nor has it released a statement indicating this will be implemented in the future.

There is an interesting constitutional quirk which arises from the scanning being done client side, specifically for US citizens. If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment.

Whereas if the CSAM scanning was performed exclusively in the cloud, protection under the 4th Amendment does not exist as it would likely fall under the third party doctrine.

Now I'm not saying the US Government would let mere unconstitutionality get in the way of any surveillance program. But Apple would. You don't think Apple wouldn't be itching for another opportunity to flex in public? Especially now, with their reputation on the line? Apple would love nothing more than to have more opportunities like they got with the San Bernardino iPhone.

Post reply on HN