3 ms·
> First, as an additional safeguard, the visual derivatives themselves are matched to the known CSAM database by a second, independent perceptual hash. This ind
by shuckles 5y ago
> First, as an additional safeguard, the visual derivatives themselves are matched to the known CSAM database by a second, independent perceptual hash. This independent hash is chosen to reject the unlikely possibility that the match threshold was exceeded due to non-CSAM images that were adversarially perturbed to cause false NeuralHash matches against the on-device encrypted CSAM database.
https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf https://www.apple.com/child-safety/pdf/Security_Threat_Model...
- ec109685 5y agoAnd that hash function is kept private, so you can’t just iterate to find a match of both hashes.
- shuckles 5y agoCorrect, gradient descent attacks like this depend on being able to differentiate your hash function.
- blintz 5y agoHonestly missed this. Is that security-through-obscurity? If the model and weights for the second hash function became public, then we could still construct a collision on both functions, right?
- shuckles 5y agoIt’s not security through obscurity. The implementation is not necessarily a secret; it’s the model configuration which can only be differentiated if known. Since part of the threat is adversarial embeddings, it’s perfectly fine to assume you can keep a private model confidential that adversaries can’t differentiate.