4 ms·

This is false. 1. An image is only scanned if it's in your Photo Gallery and about to be uploaded to Apple's servers. 2. The image would need also to match an

This is false. 1. An image is only scanned if it's in your Photo Gallery and about to be uploaded to Apple's servers. 2. The image would need also to match an unspecified second hash algorithm which runs on Apple servers. If it doesn't match this hash as well, it's not considered a match and won't be a candidate for human review. 3. Twenty nine more dual-hash collisions would also need to be imported into their iCloud photo gallery. Human review can only occur if a total of thirty images have matched both hash algorithms. This requirement is cryptographically enforced. 4. Apple human reviewers would only ever see these hash matched images. Which means they'd only ever see some manipulated memes/cat pictures, never any of your personal photos.

tsimionescu 5y ago
Your argument works just as well if for any x, NeuralHash(x)=1. The fact is that a 'first line of defense' that is trivial to fool is useless. The fact that there are other lines of defense doesn't mean that the one they would make me run on my own hardware has nay merit whatsoever.
- MauranKilom 5y ago
  > Your argument works just as well if for any x, NeuralHash(x)=1. That's good, because they weren't arguing that NeuralHash is infallible, but that its fallibility does not lead to the consequences outlined by the GP. > The fact is that a 'first line of defense' that is trivial to fool is useless. Useless to you, but not to apple. It reduces the set of pictures to process from "everything" to "those identified by the algorithm as designed, plus artificial false positives". It's impossible for the second set to be larger than the first, so it's by definition not useless. This is why it's strange how people are focusing so hard on the weaknesses of NeuralHash when what we should care about is how well the system as a whole works.
DeathArrow 5y ago
>The image would need also to match an unspecified second hash algorithm which runs on Apple servers. Security by obscurity in 2021?
- simondotau 5y ago
  It’s not security by obscurity, it’s a privately held and operated secret.
jdlshore 5y ago
And 5. The “bad” hashes are secret, so it’s not possible to create a false positive that would trigger Apple’s human review.
- charcircuit 5y ago
  They aren't all secret. Finding a site with pictures in that database is a single google search away.
  - maratc 5y ago
    The pictures aren't secret. The hashes are. We don't know what hash algorithm is employed on Apple's server side, so we can't feed that algorithm with these non-secret images and get the hashes.
    - charcircuit 5y ago
      The hash algorithm shouldn't matter if you have something you know it will detect
      - simondotau 5y ago
        Sure, but then you have CSAM and Apple’s system is working as intended.
        skinkestek 5y ago
        no, that is the entire point: it is trivially simple to make an innocent picture match in neuralhash.
        nullc 5y ago
        You're talking across each other. Apple claims without evidence that there is a second secret hash which is run serverside. Perhaps it's just Microsoft PhotoDNA (which isn't secret anymore), perhaps it's just another copy of neuralhash (which might share the same collisions)-- it isn't currently known to the public. It is, however, known to anyone inside the project at apple and anyone involved in the abuse image databases at a minimum. I'm of the opinion that any security properties of this supposed second hash should be disregarded in public analysis of the system-- for all we know it's just a "return true". Other people make a reasonable argument that this additional function makes some of the attacks people describe harder. In practice it probably does, but security analysis should concern itself with the worst cases admitted by the known system.

tsimionescu 5y ago

Your argument works just as well if for any x, NeuralHash(x)=1. The fact is that a 'first line of defense' that is trivial to fool is useless. The fact that there are other lines of defense doesn't mean that the one they would make me run on my own hardware has nay merit whatsoever.

MauranKilom 5y ago
> Your argument works just as well if for any x, NeuralHash(x)=1. That's good, because they weren't arguing that NeuralHash is infallible, but that its fallibility does not lead to the consequences outlined by the GP. > The fact is that a 'first line of defense' that is trivial to fool is useless. Useless to you, but not to apple. It reduces the set of pictures to process from "everything" to "those identified by the algorithm as designed, plus artificial false positives". It's impossible for the second set to be larger than the first, so it's by definition not useless. This is why it's strange how people are focusing so hard on the weaknesses of NeuralHash when what we should care about is how well the system as a whole works.

DeathArrow 5y ago

>The image would need also to match an unspecified second hash algorithm which runs on Apple servers. Security by obscurity in 2021?

simondotau 5y ago
It’s not security by obscurity, it’s a privately held and operated secret.

jdlshore 5y ago

And 5. The “bad” hashes are secret, so it’s not possible to create a false positive that would trigger Apple’s human review.

charcircuit 5y ago
They aren't all secret. Finding a site with pictures in that database is a single google search away.
- maratc 5y ago
  The pictures aren't secret. The hashes are. We don't know what hash algorithm is employed on Apple's server side, so we can't feed that algorithm with these non-secret images and get the hashes.
  - charcircuit 5y ago
    The hash algorithm shouldn't matter if you have something you know it will detect
    - simondotau 5y ago
      Sure, but then you have CSAM and Apple’s system is working as intended.
      - skinkestek 5y ago
        no, that is the entire point: it is trivially simple to make an innocent picture match in neuralhash.
        nullc 5y ago
        You're talking across each other. Apple claims without evidence that there is a second secret hash which is run serverside. Perhaps it's just Microsoft PhotoDNA (which isn't secret anymore), perhaps it's just another copy of neuralhash (which might share the same collisions)-- it isn't currently known to the public. It is, however, known to anyone inside the project at apple and anyone involved in the abuse image databases at a minimum. I'm of the opinion that any security properties of this supposed second hash should be disregarded in public analysis of the system-- for all we know it's just a "return true". Other people make a reasonable argument that this additional function makes some of the attacks people describe harder. In practice it probably does, but security analysis should concern itself with the worst cases admitted by the known system.