Hacker News Reader

Comment by dkonofalski | Hacker News Reader

It doesn't send the photos to their servers. Read the white paper before you make snarky responses. Most of what you're saying is covered there.

View on HN

The fact that they send a visual derivative of the image, such as a low-resolution version, makes the human review process tricky. Because there is, understandably, no actual CSAM image to compare the visual derivative with, images that look similar enough (contain nudity or a child in a swimsuit) may get past the human review process.

The visual derivative of the image only gets sent if the image matches both hashes (including a multi-stage blind hash). It's almost certain that an image that makes it to that point would be CSAM.

They send a low res visual derivative. Which is worse than sending the actual photo in regards to false positives.

It doesn't send the derivative until it passes both hash checks. The blind hash includes multiple checks to make sure that the attacks presented through the methods presented in the Github article don't get through. There are currently multiple methods of creating collisions and one method of hiding a different thumbnail through resizing and no methods of combining any of those attacks. Apple has already shown that their verification method already uses multiple methods to generate the blind hash so, thus far, there's no way for this to send a low res visual without making it past both hash checks.

That's just incorrect. From the whitepaper:

> Once Apple’s iCloud Photos servers decrypt a set of positive match vouchers for an account that exceeded the match threshold, the visual derivatives of the positively matching images are referred for review by Apple. First, as an additional safeguard, the visual derivatives themselves are matched to the known CSAM database by a second, independent perceptual hash. This independent hash is chosen to reject the unlikely possibility that the match threshold was exceeded due to non-CSAM images that were adversarially perturbed to cause false NeuralHash matches against the on-device encrypted CSAM database. If the CSAM finding is confirmed by this independent hash, the visual derivatives are provided to Apple human reviewers for final confirmation.

So to recap, this second blind hash you're talking about is run _after_ the server has already received and decrypted the visual derivatives (what else would it be hashing?).

Perceptual hashing is highly susceptible to collisions. I'm not sure what you're talking about with "hiding a different thumbnail through resizing". All you need is nude-looking colors in your photo to let the derivative look like credible CSAM. No resizing tricks necessary.

Reply on news.ycombinator.com