4 ms·

So, these adversarial collisions are the images that I need to send to my enemies so that they go to prison when they upload those images to iCloud? It seems tr

by dsign 5y ago

So, these adversarial collisions are the images that I need to send to my enemies so that they go to prison when they upload those images to iCloud? It seems trivially easy to exploit.

xucheng 5y ago
You can technically hide an adversarial collision inside a complete legit normal image. It won’t be seen by human eyes but it will trigger a detection. In addition, you can do the complete opposite by perturbing a CSAM to output complete different hash to circumvent the detection. All of these vulnerabilities are well known for perceptual hash.
- SV_BubbleTime 5y ago
  So right there seems to be an issue to me. It seems like if you were trading in CSAM, you would run CLEANER -all on anything and everything. Because you know someone has already written that as proof of concept here.
nsizx 5y ago
The images are sent for manual verification before you're turned in, so no.
sneak 5y ago
You can also just send your enemies CSAM, it is more effective at imprisoning them.
- eknkc 5y ago
  They probably would not hold onto them and also now you have a paper trail of sending CSAM to people. But if you were to alter some innocent looking photos and send them to someone, they might store those.
  - zepto 5y ago
    Yes, but that won’t work since innocent looking photos won’t match the visual derivative.
- TechBro8615 5y ago
  That sounds like a good reason not to create a virtual SWATing vector then.
UncleMeat 5y ago
No. Because, as documented in the published material, hits are also reviewed by humans.
- heavyset_go 5y ago
  Downscaled derivative images are what are checked, and if the reviewer even suspects that the downscaled image contains sexual content of a minor, they're required to report it. At that point, it is the authorities who decide whether or not to continue to investigate and determine if the user possesses CSAM. That investigation alone can ruin lives.
  - user-the-name 5y ago
    The "downscaled" image 360x360. It's pretty easy to compare two images at that size to determine if they are the same. You're not going to end up investigated unless you actually have actual picture of child pornography. Also, not just one, the process doesn't even start until you have a fairly large number.
    - Xamayon 5y ago
      It's highly unlikely that the apple reviewer will have access to the actual image in the database, instead they will assess whether the blurry,b/w,etc modified thumbnail could possibly be illegal. Given the level of secrecy surrounding the contents of the DB, even the normal NCMEC reviewers may not have access to those for comparison. There are plenty of CG images, small legal models, or even images of erotic toys which could be used as the base image which would look very suspicious as a low quality thumbnail.
      - user-the-name 5y ago
        There will be someone along the line who will check that the image is, in fact, the actual listed image. Otherwise, there is no legal case to be made.
jhanschoo 5y ago
I wonder what scenarios are facilitated by sending adversarial collisions over simply sending over CSAM.

by dsign 5y ago

So, these adversarial collisions are the images that I need to send to my enemies so that they go to prison when they upload those images to iCloud? It seems trivially easy to exploit.

xucheng 5y ago

You can technically hide an adversarial collision inside a complete legit normal image. It won’t be seen by human eyes but it will trigger a detection. In addition, you can do the complete opposite by perturbing a CSAM to output complete different hash to circumvent the detection. All of these vulnerabilities are well known for perceptual hash.

SV_BubbleTime 5y ago
So right there seems to be an issue to me. It seems like if you were trading in CSAM, you would run CLEANER -all on anything and everything. Because you know someone has already written that as proof of concept here.

nsizx 5y ago

The images are sent for manual verification before you're turned in, so no.

sneak 5y ago

You can also just send your enemies CSAM, it is more effective at imprisoning them.

eknkc 5y ago
They probably would not hold onto them and also now you have a paper trail of sending CSAM to people. But if you were to alter some innocent looking photos and send them to someone, they might store those.
- zepto 5y ago
  Yes, but that won’t work since innocent looking photos won’t match the visual derivative.
TechBro8615 5y ago
That sounds like a good reason not to create a virtual SWATing vector then.

UncleMeat 5y ago

No. Because, as documented in the published material, hits are also reviewed by humans.

heavyset_go 5y ago
Downscaled derivative images are what are checked, and if the reviewer even suspects that the downscaled image contains sexual content of a minor, they're required to report it. At that point, it is the authorities who decide whether or not to continue to investigate and determine if the user possesses CSAM. That investigation alone can ruin lives.
- user-the-name 5y ago
  The "downscaled" image 360x360. It's pretty easy to compare two images at that size to determine if they are the same. You're not going to end up investigated unless you actually have actual picture of child pornography. Also, not just one, the process doesn't even start until you have a fairly large number.
  - Xamayon 5y ago
    It's highly unlikely that the apple reviewer will have access to the actual image in the database, instead they will assess whether the blurry,b/w,etc modified thumbnail could possibly be illegal. Given the level of secrecy surrounding the contents of the DB, even the normal NCMEC reviewers may not have access to those for comparison. There are plenty of CG images, small legal models, or even images of erotic toys which could be used as the base image which would look very suspicious as a low quality thumbnail.
    - user-the-name 5y ago
      There will be someone along the line who will check that the image is, in fact, the actual listed image. Otherwise, there is no legal case to be made.

jhanschoo 5y ago

I wonder what scenarios are facilitated by sending adversarial collisions over simply sending over CSAM.