Hacker News Reader

> First, as an additional safeguard, the visual derivatives themselves are matched to the known CSAM database by a second, independent perceptual hash. This independent hash is chosen to reject the unlikely possibility that the match threshold was exceeded due to non-CSAM images that were adversarially perturbed to cause false NeuralHash matches against the on-device encrypted CSAM database.

https://www.apple.com/child-safety/pdf/Security_Threat_Model...

View on HN

And that hash function is kept private, so you can’t just iterate to find a match of both hashes.

Correct, gradient descent attacks like this depend on being able to differentiate your hash function.

Honestly missed this.

Is that security-through-obscurity? If the model and weights for the second hash function became public, then we could still construct a collision on both functions, right?

It’s not security through obscurity. The implementation is not necessarily a secret; it’s the model configuration which can only be differentiated if known. Since part of the threat is adversarial embeddings, it’s perfectly fine to assume you can keep a private model confidential that adversaries can’t differentiate.

Reply on news.ycombinator.com