3 ms·

A bit of context: Microsoft developed PhotoDNA to identify illegal images like CSAM -- NCMEC maintains a database of PhotoDNA signatures, and many companies use

A bit of context: Microsoft developed PhotoDNA to identify illegal images like CSAM -- NCMEC maintains a database of PhotoDNA signatures, and many companies use this service to identify and remove these images. Microsoft claims: > A PhotoDNA hash is not reversible, and therefore cannot be used to recreate an image. This project shows that this isn't quite true: machine learning can do a pretty good job of reproducing a thumbnail-quality images from a PhotoDNA signature. There has been some discussion in the past on HN about PhotoDNA: https://news.ycombinator.com/item?id=28378254 https://news.ycombinator.com/item?id=28378254. It has been claimed that PhotoDNA is reversible, but there was no public demonstration as far as I know.

sterlind 5y ago
Interesting work. It seems like these lossy photo hashes are more obfuscation and resolution reduction than anything secure. In the photo of the child, facial features aren't reconstructable. Is it possible that PhotoDNA hashes might be sufficiently potato to not infringe on privacy or meaningfully (if not legally) count as explicit/illicit content? Are secure lossy photo hashes possible? I feel like it'd require indistinguishability obfuscation (iO), where distinguishing a hash from zillions of random noise preimages would be guaranteed intractable. But I'm not sure if you could guarantee all the preimages matching the hash aren't all still recognizable. Maybe you could set up some kind of adversarial system using your work as the adversary? (e.g. Set of transformed input images --[hashing neural net]-->hashes, then hashes--[Ribosome]-->preimage, then penalize hashing neural net (and reward Ribosome) based on distance of input image and preimage, along with rewarding the hashing net for distance from its hashes of other images + closeness of its hashes of similar transformed images.)
batch12 5y ago
The reversible restriction is important because otherwise distributing PhotoDNA signatures of CSAM is distributing CSAM.
- jhgb 5y ago
  That seems a little bit extreme unless you mean lossless reversibility, which for a process like this will never be available, as per information theory. Obviously the best thing you get by this process is a smudge of colors which will never pass the "I know it when I see it" test.
  - batch12 5y ago
    Maybe, but is blurry CSAM still CSAM? If not, then they could just distribute the blurry thumbnails instead of this hash.
    - jhgb 5y ago
      It's not if it can't be distinguished of the same blur of something completely different.
  - zionic 5y ago
    Couldn't you then pipe the lossy thumbnail into something like nvidia's ML tool that creates "real" images from sketches?
    - jhgb 5y ago
      Of course you can. The problem is you almost certainly won't end up with the original image unless the ML tool has been trained with this original image (and even then it might not necessarily appear as an output). There's so many different images it could create from a smudge that there's no reason why the original one should be preferred.

sterlind 5y ago

Interesting work. It seems like these lossy photo hashes are more obfuscation and resolution reduction than anything secure. In the photo of the child, facial features aren't reconstructable. Is it possible that PhotoDNA hashes might be sufficiently potato to not infringe on privacy or meaningfully (if not legally) count as explicit/illicit content? Are secure lossy photo hashes possible? I feel like it'd require indistinguishability obfuscation (iO), where distinguishing a hash from zillions of random noise preimages would be guaranteed intractable. But I'm not sure if you could guarantee all the preimages matching the hash aren't all still recognizable. Maybe you could set up some kind of adversarial system using your work as the adversary? (e.g. Set of transformed input images --[hashing neural net]-->hashes, then hashes--[Ribosome]-->preimage, then penalize hashing neural net (and reward Ribosome) based on distance of input image and preimage, along with rewarding the hashing net for distance from its hashes of other images + closeness of its hashes of similar transformed images.)

batch12 5y ago

The reversible restriction is important because otherwise distributing PhotoDNA signatures of CSAM is distributing CSAM.

jhgb 5y ago
That seems a little bit extreme unless you mean lossless reversibility, which for a process like this will never be available, as per information theory. Obviously the best thing you get by this process is a smudge of colors which will never pass the "I know it when I see it" test.
- batch12 5y ago
  Maybe, but is blurry CSAM still CSAM? If not, then they could just distribute the blurry thumbnails instead of this hash.
  - jhgb 5y ago
    It's not if it can't be distinguished of the same blur of something completely different.
- zionic 5y ago
  Couldn't you then pipe the lossy thumbnail into something like nvidia's ML tool that creates "real" images from sketches?
  - jhgb 5y ago
    Of course you can. The problem is you almost certainly won't end up with the original image unless the ML tool has been trained with this original image (and even then it might not necessarily appear as an output). There's so many different images it could create from a smudge that there's no reason why the original one should be preferred.