4 ms·

It doesn't send the photos to their servers. Read the white paper before you make snarky responses. Most of what you're saying is covered there.

prophesi 5y ago
They send a low res visual derivative. Which is worse than sending the actual photo in regards to false positives.
- dkonofalski 5y ago
  It doesn't send the derivative until it passes both hash checks. The blind hash includes multiple checks to make sure that the attacks presented through the methods presented in the Github article don't get through. There are currently multiple methods of creating collisions and one method of hiding a different thumbnail through resizing and no methods of combining any of those attacks. Apple has already shown that their verification method already uses multiple methods to generate the blind hash so, thus far, there's no way for this to send a low res visual without making it past both hash checks.
  - prophesi 5y ago
    That's just incorrect. From the whitepaper: > Once Apple’s iCloud Photos servers decrypt a set of positive match vouchers for an account that exceeded the match threshold, the visual derivatives of the positively matching images are referred for review by Apple. First, as an additional safeguard, the visual derivatives themselves are matched to the known CSAM database by a second, independent perceptual hash. This independent hash is chosen to reject the unlikely possibility that the match threshold was exceeded due to non-CSAM images that were adversarially perturbed to cause false NeuralHash matches against the on-device encrypted CSAM database. If the CSAM finding is confirmed by this independent hash, the visual derivatives are provided to Apple human reviewers for final confirmation. So to recap, this second blind hash you're talking about is run _after_ the server has already received and decrypted the visual derivatives (what else would it be hashing?). Perceptual hashing is highly susceptible to collisions. I'm not sure what you're talking about with "hiding a different thumbnail through resizing". All you need is nude-looking colors in your photo to let the derivative look like credible CSAM. No resizing tricks necessary.
mono-bob 5y ago
The fact that they send a visual derivative of the image, such as a low-resolution version, makes the human review process tricky. Because there is, understandably, no actual CSAM image to compare the visual derivative with, images that look similar enough (contain nudity or a child in a swimsuit) may get past the human review process.
- dkonofalski 5y ago
  The visual derivative of the image only gets sent if the image matches both hashes (including a multi-stage blind hash). It's almost certain that an image that makes it to that point would be CSAM.

prophesi 5y ago

They send a low res visual derivative. Which is worse than sending the actual photo in regards to false positives.

dkonofalski 5y ago
It doesn't send the derivative until it passes both hash checks. The blind hash includes multiple checks to make sure that the attacks presented through the methods presented in the Github article don't get through. There are currently multiple methods of creating collisions and one method of hiding a different thumbnail through resizing and no methods of combining any of those attacks. Apple has already shown that their verification method already uses multiple methods to generate the blind hash so, thus far, there's no way for this to send a low res visual without making it past both hash checks.
- prophesi 5y ago
  That's just incorrect. From the whitepaper: > Once Apple’s iCloud Photos servers decrypt a set of positive match vouchers for an account that exceeded the match threshold, the visual derivatives of the positively matching images are referred for review by Apple. First, as an additional safeguard, the visual derivatives themselves are matched to the known CSAM database by a second, independent perceptual hash. This independent hash is chosen to reject the unlikely possibility that the match threshold was exceeded due to non-CSAM images that were adversarially perturbed to cause false NeuralHash matches against the on-device encrypted CSAM database. If the CSAM finding is confirmed by this independent hash, the visual derivatives are provided to Apple human reviewers for final confirmation. So to recap, this second blind hash you're talking about is run _after_ the server has already received and decrypted the visual derivatives (what else would it be hashing?). Perceptual hashing is highly susceptible to collisions. I'm not sure what you're talking about with "hiding a different thumbnail through resizing". All you need is nude-looking colors in your photo to let the derivative look like credible CSAM. No resizing tricks necessary.

mono-bob 5y ago

The fact that they send a visual derivative of the image, such as a low-resolution version, makes the human review process tricky. Because there is, understandably, no actual CSAM image to compare the visual derivative with, images that look similar enough (contain nudity or a child in a swimsuit) may get past the human review process.

dkonofalski 5y ago
The visual derivative of the image only gets sent if the image matches both hashes (including a multi-stage blind hash). It's almost certain that an image that makes it to that point would be CSAM.