9 ms·

As apple states at the time, any action would require more than one match. For any hash value of a given size, it is trivially easy to calculate the probability

As apple states at the time, any action would require more than one match. For any hash value of a given size, it is trivially easy to calculate the probability of collisions and to adjust required thresholds for any arbitrary rate of false positives. If the FP rate is 1/1000, requiring three „hits“ makes it 1/1,000,000,000, or essentially zero.

giantrobot 5y ago
That assumes that only "bad" images exist in CSAM corpus. There's no guarantee of that and it's not something that can be audited in a meaningful way. In the US the only place CSAM images can legally exist is NCMEC. Even someone wanting to generate a detection system can't access the corpus directly and has to rely on some convoluted system of hashes.
Someone 5y ago
The false positive rate has to be a lot lower for this to work. If it is 1/1000, it is only 1/1,000,000,000 if they have only 3 of images from a customer. They typically have thousands, though. A 1:1000 false positive rate would mean several ones in many iCloud photo databases. On the plus side, in case of multiple hits, they would have a human look at the images. The whole thing was intended as a way to make that human check economically viable. Instead of having people look at every picture uploaded to iCloud, they would filter out almost all of them, and only let humans look at the few remaining (where, I guess, ‘few’ still could be a lot, given their number of users)
- IfOnlyYouKnew 5y ago
  They wouldn't have a human look at it. They don't have the images, only the hashes–that's the point. And it's somewhat irrelevant how the probability of collisions is specifically calulated (1/1000 already assumed 1:n comparisons), as long as we agree it's easy to calculate for a given user. The algorithm does know about the sizes of the respective image libraries, for example, and could adjust the threshold with precision.
  - Someone 5y ago
    They don’t have the images, but they do have “visual derivatives”. https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...: “The device creates a cryptographic safety voucher that encodes the match result. It also encrypts the image’s NeuralHash and a visual derivative. This voucher is uploaded to iCloud Photos along with the image. […] Once more than a threshold number of matches has occurred, Apple has enough shares that the server can combine the shares it has retrieved, and reconstruct the decryption key for the ciphertexts it has collected, thereby revealing the NeuralHash and visual derivative for the known CSAM matches.” https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf https://www.apple.com/child-safety/pdf/Security_Threat_Model... is even clearer: “The decrypted vouchers allow Apple servers to access a visual derivative – such as a low-resolution version – of each matching image. These visual derivatives are then examined by human reviewers”

giantrobot 5y ago

That assumes that only "bad" images exist in CSAM corpus. There's no guarantee of that and it's not something that can be audited in a meaningful way. In the US the only place CSAM images can legally exist is NCMEC. Even someone wanting to generate a detection system can't access the corpus directly and has to rely on some convoluted system of hashes.

Someone 5y ago

The false positive rate has to be a lot lower for this to work. If it is 1/1000, it is only 1/1,000,000,000 if they have only 3 of images from a customer. They typically have thousands, though. A 1:1000 false positive rate would mean several ones in many iCloud photo databases. On the plus side, in case of multiple hits, they would have a human look at the images. The whole thing was intended as a way to make that human check economically viable. Instead of having people look at every picture uploaded to iCloud, they would filter out almost all of them, and only let humans look at the few remaining (where, I guess, ‘few’ still could be a lot, given their number of users)

IfOnlyYouKnew 5y ago
They wouldn't have a human look at it. They don't have the images, only the hashes–that's the point. And it's somewhat irrelevant how the probability of collisions is specifically calulated (1/1000 already assumed 1:n comparisons), as long as we agree it's easy to calculate for a given user. The algorithm does know about the sizes of the respective image libraries, for example, and could adjust the threshold with precision.
- Someone 5y ago
  They don’t have the images, but they do have “visual derivatives”. https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...: “The device creates a cryptographic safety voucher that encodes the match result. It also encrypts the image’s NeuralHash and a visual derivative. This voucher is uploaded to iCloud Photos along with the image. […] Once more than a threshold number of matches has occurred, Apple has enough shares that the server can combine the shares it has retrieved, and reconstruct the decryption key for the ciphertexts it has collected, thereby revealing the NeuralHash and visual derivative for the known CSAM matches.” https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf https://www.apple.com/child-safety/pdf/Security_Threat_Model... is even clearer: “The decrypted vouchers allow Apple servers to access a visual derivative – such as a low-resolution version – of each matching image. These visual derivatives are then examined by human reviewers”