3 ms·
The crypto here is for the private set intersection, not the hash. So your device has a list of perceptual (non-cryptographic) hashes of its images. Apple has
by cvwright 5y ago
The crypto here is for the private set intersection, not the hash.
So your device has a list of perceptual (non-cryptographic) hashes of its images. Apple has a list of the hashes of known bad images.
The protocol lets them learn which of your hashes are in the “bad” set, without you learning any of the other “bad” hashes, and without Apple learning any of the hashes of your other photos.
- bastawhiz 5y agoWell therein lies the problem: perceptual hashes don't produce an exact result. You need to compare something like the hamming distance (as the article mentions) of each hash to decide if it's a match. Is it possible to perform private set intersection where the comparison is inexact? I.e., if you have two cryptographic hashes, private set intersection is well understood. Can you do the same if the hashes are close, but not exactly equal? If the answer is yes, that could mean you would be able to derive the perceptual hashes of the CSAM, since you're able to find values close to the original and test how far you can drift from it before there's no longer a match.
- aix1 5y agoWould love to learn more about actual algorithms that could be used to do something like this (private set intersection with approximate matching) if they exist.
- cvwright 5y agoFrom what I’ve read, part of the magic here is that Apple’s perceptual hash is an exact hash. Meaning, you don’t have to do the Hamming distance thing. Admittedly, I haven’t had a chance to read the original source material yet. It’s possible that the person I heard this from was wrong.