3 ms·
It didn’t seem to take long for the weights for Apple’s network to be discovered. And I suppose they must send the banned hashes to the client for checking too.
by dan-robertson 5y ago
It didn’t seem to take long for the weights for Apple’s network to be discovered. And I suppose they must send the banned hashes to the client for checking too. So I expect that list will be discovered and published soon too (unless they have some way to keep them secret?) I think one important question is: how reversible is Apple’s perceptual hash?
For example, my understanding of Microsoft’s PhotoDNA is that their perceptual hash has been reverse-engineered and that one could go backwards from a hash to a blurry image. But also it is very hard to get the list of PhotoDNA hashes for the NCMEC database. In other words, are Apple unintentionally releasing enough information to reconstruct a bunch of blurry CSAM?
- yeldarb 5y agoIt doesn't seem like it; check out the adversarially constructed images here. They don't look anything like the original despite perfectly matching the NeuralHash: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX/issues/1 https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX/issue...
- dan-robertson 5y agoRight obviously the hashing isn’t going to be injective and therefore there are lots of silly images that hash to a given value. The question is whether it is possible to efficiently find plausible images with a given hash. Think more like a “deep dream” than these adversarial attacks.
- fortenforge 5y agoThe hashes sent to the client are cryptographically blinded, making it impossible for the client to determine the original CSAM hashes.
- dan-robertson 5y agoThis is the information I was missing, thanks.
- kccqzy 5y ago> And I suppose they must send the banned hashes to the client for checking too. They absolutely do not. They use Private Set Intersection to achieve that.