Hacker News Reader

Comment by rootusrootus | Hacker News Reader

I know you were being a bit hyperbolic, but that is actually an interesting point. I wonder how long it will be before web browsers start real-time fingerprinting images that are downloaded and checking against the database. It seems like an inevitable progression.

View on HN

Depending on the fingerprinting method that could be easy to overcome, servers can send unique images in response to every query, eg crop differently, add icons, or add subtle colour casts. Overcoming hashing checks could be done by varying packing bits or metadata.

there are perceptual hash algorithms overcoming exactly these issues

https://en.m.wikipedia.org/wiki/Perceptual_hashing

I wonder how resistant those are to distortion. The examples on the Insight page are pretty impressive, but fairly naive approaches. I feel like, if you knew the algorithm, you could probably manipulate your image data in a way to make it appear almost the same but come up with a very different hash. Similar to adversial images in computer vision.

https://spectrum.ieee.org/cars-that-think/transportation/sen...

Or put it in an encrypted 7z archive. Or any number of workarounds where you're not sending image data so the filter can't detect you.

sure, but I dont think apple expects you to be able to filter this

As a platform you cant really filter this, unless you blanket ban all archive files. For tumblr this might be viable, but for a file hoster it wouldnt be

Tumlbr at least used to let you add arbitrary HTML to your blog, I remember putting base64 encoded gifs on mine that the browser would render. Unless they removed that (which IMO, would pretty dramatically change the general feel of the site) there's a real limit to what they can block.

Perceptual hashing is certainly resistant to some distortions, primarily affine transforms.

Unfortunately there's not any easy or sufficiently strong defense against someone gradient descent-ing your algorithm.

There is an entire youtube cottage hobby of putting full pirated movies with distortion. The distortion goes beyond simple things like color casts, so I'm guessing they are trying to escape some sort of perceptual hashing. Often the movies don't take the full frame and there are lens flare like overlays put on the images. The audio is also distorted.

I do not very well understand the algorithms used for this purpose, but I imagined that they are somewhat resistant to easy circumvention -- otherwise what use are they in trying to filter CP? The folks who are trafficking in such things would probably be very interested in workarounds if they are easy to accomplish.

Detecting porn is actually not that hard because you can look for skin color. With a bit of machine learning it’s totally doable and there are firewall solutions that can block porn content in real time.

I had friends at a startup that was doing this 10 years ago and they were doing a marvelous job. Don’t know what happened to it, blocking porn isn’t something that people really want to pay for imo.

But it’s totally doable and it doesn’t involve hashing / fingerprinting.

Detecting porn and child porn are very different. Also, detecting porn with no false positives and no false negatives is also much harder.

An image classifier of yesteryear had some problems with sand dunes: https://gizmodo.com/british-cops-want-to-use-ai-to-spot-porn...

blocking porn isn’t something that people really want to pay for imo.

Sell it to libraries, or any other place that has publicly-available computers.

(My local library has a regular wifi network, and a second one that doesn't filter NSFW content.)

Are you suggesting that a censored network is "regular"-- at a library?

Just like 98% of all front doors are easily opened with brute force. Just because you can circumvent something, or doesn’t make it unusefull.

For sure most of what people think of as security is presentation.

But the context here is hashing all images in order to catch illicit images, particularly child pornography.

Presumably people who distribute such images take a rather more practical approach to security.

So implementing a universal change to the internet needs to work against those using bank-vault level security rather than easily-picked, easily-booted down, easily bypassed "domestic front door" level of security.

If you implement something that will work in 99% of cases in the net then you'll let through billions of images from those who take a combatative approach to law enforcement. The result being no effect against the criminals you want to catch.

(Your local version of GCHQ will be able to reduce their database size though.)

There are algorithms developed by Microsoft and others which are specifically designed to normalize images as best they can before processing in order to reduce false negatives due to alterations like cropping, color shifting, watermarking, etc.

They then use perceptual hashing techniques to identify similar images. It's a game of cat and mouse but ultimately I think with ML, the mouse is going to lose.

Edge will be the first, of course. But it will be "opt in" at first hidden beneath a wealth of misdirection.

Reply on news.ycombinator.com