4 ms·
I'd argue that the hash collisions (both natural and synthetic) that I've seen give me more confidence in the system, not less. On the natural hash collisions
by dhosek 5y ago
I'd argue that the hash collisions (both natural and synthetic) that I've seen give me more confidence in the system, not less.
On the natural hash collisions (of which there are two), we have objects of similar shape against a solid background. It seems that a natural hash collision of a CSAM image would be unlikely (or if it does occur, it would be something that perhaps is also an infringing image).
As for the synthetic hash collisions, there are visible artifacts in the picture that, if you compare with the original picture, make the overlay of the original picture on the synthetically generated hash collision obvious. Could people get tricked into downloading memes¹ with synthetically generated hash collisions? Sure, people are idiots. But I'm guessing the majority of folks will look at the picture and say, this is a sh*t picture in this meme and download something else.
1. And that, of course, assumes that meme hosters don't apply similar scanning techniques to what they serve up.
- nullc 5y ago> this is a sh*t picture in this meme and download something else. NO. Adversarial preimages can be created that look like perfectly normal images. Please stop repeating this falsehood. Here are some examples I generated (with a link to more): https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX/issues/1#issuecomment-903094036 https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX/issue...
- dhosek 5y agoI saw two examples. The dog/girl one has obvious artifacts in the picture of the girl. The directly linked image doesn't have artifacts, but putting them side by side, I can see what got matched up and they're still very approximately the same picture in that they're both pictures of women and the eyes are in the same part of the picture which gives support to your perspective. I do still wonder whether it would be possible to take, say, a (legal) nude and turn it into an innocent-looking image that still matches the hashes or not. I'm more inclined to believe it now than before, but theoretical possibilities don't usually map to realistic concerns.¹ 1. One example of this would be that theoretically, LaTeX's cross-reference mechanism can get caught in a cyclic state. This can only happen with page references and the most likely scenario is a reference to a roman-numeraled page number where if the page reference is output as ix the referenced location moves to page x and when the page reference is updated to x the referenced location moves to page ix (in practice, functioning examples required a shift between xcix and c, but either way, the probability of this happening in a real document is vanishingly small).