The problem is that a company is raping my privacy!! I don't care about the details of how good or bad is their spyware is!!
A catalog of naturally occurring images whose Apple NeuralHash is identical
91–100 of 304 posts
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#92Earlier quoted context omitted.
Presumably, it’s done this way so they can say computers other than your personal device do not scan photos and “look” at decrypted and potentially innocent photos. And technically the original image is never decrypted in iCloud by Apple - if 30 images are flagged they are then able to decrypt the CSAM scan meta data which contains resized thumbnails, for confirmation. In summary, I’m guessing they tried to invent a…
Interesting technical problem/solution. Another benefit is saving on millions of server computations when modern iOS devices have neural chips etc. I suppose folks who don’t like privacy implications can downgrade to an iPhone 4 and maybe it will not support the feature.
Or turn off iCloud syncing of photos.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#93Earlier quoted context omitted.
You (or at least Apple's customers) trust in and rely on Apple's proprietary software to do its job all the time. How is this different? I find this argument very weak.
afaik none of Apples other "proprietary software" is designed to pass my personal images to a human for visual inspection if it mistakenly outputs 2 high-enough numbers after a handful of convolution operations and matrix multiplications.
They pass a "visual derivative" to "a human", but only after some matrix multiplications etc. that result in extremely low probability false positives.
It could also happen that you lose your phone and "a human" finds it and randomly puts in the correct passcode on the first try and visually inspects your personal images. In fact, that seems vastly more likely [1].
[1] About 4% of smartphones are lost or stolen every year [https://www.mcafee.com/blogs/consumer/family-safety/almost-5... ], but make it just 1/1000, so 1e-3. Then a 6 digit passcode, 1e-6, so we're at 1e-9 per year, or 1000x as likely as being falsely flagged, assuming Apple's numbers (which can easily be achieved by calibrating the threshold).
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#94Earlier quoted context omitted.
Keep in mind that Apple's claimed false positive rate (one in a trillion chance of an account being flagged innocently), and the collision rate determined by Dwyer in the blog post linked from the repo [2], are both derived without making any adversarial assumptions. Given that NeuralHash collider and similar tools already exist, the practical false positive rate is now expected to be much much higher. Imagine that y…
This argument is utterly incoherent. Of course they don't include into the false positive rate images that are intentionally designed to generate positive hits, what would be the point of that? The only interesting metric is the false positive rate for normal images.
It's not an argument. It's an explanation of what the number means.
> The only interesting metric is the false positive rate for normal images.
Wrong. The only interesting metric is the false positive rate _in practice_: i.e. how likely are false positives to affect innocents. Indeed, Apple is presenting their "one in a trillion" number as reassurance, as if it was the probability that an account that doesn't distribute CSAM gets flagged by their system. But that probability depends strongly on adversarial questions, and cannot be calculated using optimistic assumptions about all images being "normal".
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#95Earlier quoted context omitted.
2 collisions out of a million images. I'm not sure how big the CSAM database is but if it's a tens of thousands and there are millions of photos uploaded a day then Apple could have a problem on their hands. This is all extrapolating from a study that doesn't use photos representative of what people actually upload. I would suspect when most photos being uploaded are of humans the actual collision rate will be much h…
This blogpost [1] by security researcher Sarah Jamie Lewis suggests that the false positive rate could be very high: [1] https://pseudorandom.resistant.tech/obfuscated_apples.html
In their own testing they got 3 false positives out of 100 million.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#96Why are exact collisions interesting? They are not intended to be compared exactly. This algorithm doesn't even give exact matches for the same image on different hardware. https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX Note: Neural hash generated here might be a few bits off from one generated on an iOS device. This is expected since different iOS devices generate slightly different hashes anyway. The reason…
The hash is 96 bits long. When hashing 1 billion pictures, that gives a collision probability of 6e-12. If it were uniformly distributed. There's no way people have hashed billions of images already. It just shows that it's pretty probably there will be collisions, and on visual inspection, it looks as if the collisions will happen on visually similar images. So if there's a naked baby pic in the CSAM database, quite…
The Tim cuk's law: "If it can happen, it will happen"
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#97Why are exact collisions interesting? They are not intended to be compared exactly. This algorithm doesn't even give exact matches for the same image on different hardware. https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX Note: Neural hash generated here might be a few bits off from one generated on an iOS device. This is expected since different iOS devices generate slightly different hashes anyway. The reason…
If you can get exact collisions, this can be gamed. For example, suppose there are two rival gangsters. One wants to set the police on his rival. He knows that a certain (innocuous) image is on his rival's phone. So he pays someone to generate a fake child-porn image with the same neuralhash, and ensure that it gets into the child porn DB. Then, apple reports the rival to the police, and they come and investigate him. OF course, they may notice that the image isn't the right one, but by that time they may have found other incriminating evidence.
Not sympathetic to a rival gangster? Ok lets find an innocent victim: not a rival criminal, but an innocent witness who our protag wants to intimidate. Gangster wants to intimidate the witness, but can't get at them, so cooks up a scheme to convince the witness that the police are in his pocket. Exactly as above, causing the police to investigate the witnesses phone.
Another one might be, a certain government wants to identify opposition groups using images associated with them . Apple is not keen to be associated with that, but the government can simply generate fake child-porn (remember, programmatically generated CP is just as illegal) for each image of interest.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#98I still think the biggest problem is that at some point a human is going to look at a false positive, this may be picture of my naked children and this human may not have the best intentions with my picture. That said, Nextcloud is my backend and I do not upload anything to iCloud (except for MS authenticator 2fa backups), so I'm safe right?
Since the risk of that is 1 in a trillion, a lot of people are quite happy to take that risk.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#99Why are exact collisions interesting? They are not intended to be compared exactly. This algorithm doesn't even give exact matches for the same image on different hardware. https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX Note: Neural hash generated here might be a few bits off from one generated on an iOS device. This is expected since different iOS devices generate slightly different hashes anyway. The reason…
Per ATP: Apple will compare hashes of local photos with a national registry of child pornography photos. Once a certain (unknown) threshold is reached, let's say 20 hits, some kind of escalation occurs, with some kind of manual (human) review steps.
Accidental Tech Podcast - A Storm of Asterisks https://atp.fm/443
I haven't listened to the follow up episode yet.
I still have zero opinion on this photo scanning kerfuffle. I just don't know enough. Of all the "hot takes" on this issue, ATP's has been the most comprehensive. So appreciated.
Re: A catalog of naturally occurring images whose Apple NeuralHash is identical
#100Why are exact collisions interesting? They are not intended to be compared exactly. This algorithm doesn't even give exact matches for the same image on different hardware. https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX Note: Neural hash generated here might be a few bits off from one generated on an iOS device. This is expected since different iOS devices generate slightly different hashes anyway. The reason…
> Why are exact collisions interesting?
1. What does “exact” mean to you in this context?
2. What else is more interesting about a hashing algorithm used to identify things, other than its collision rate?