It's a shorter version of "Generating Collisions on a Neural Perceptual Hash like Apple's NeuralHash" optimized for click-baitingness ;), but the spirit of the

It's a shorter version of "Generating Collisions on a Neural Perceptual Hash like Apple's NeuralHash" optimized for click-baitingness ;), but the spirit of the attack is there. It's a pretty standard attack based on the fact they use a neural network, therefore the function is continuous(ly differentiable) and vulnerable to (gradient-)optimisation based attack. Neural networks are famous for being susceptible to adversarial attacks. I don't own an IPhone, so that's as far as I can go. (If you have one, jailbreak it, locate and copy the weights). Unless they have additional security on their version of the NeuralHash they don't speak about in their technical documentation, they have the same weakness that this standard generic neural network perceptual hash has. The neural-network is considered public as it's run on device without homomorphic-encryption. They also can't change it very often because every-time they would need to recompute the hashes of the database of sensitive material they don't own (every-time leaking more information on the raw sensitive material).