Hacker News Reader

Comment by anishathalye | Hacker News Reader

A bit of context: Microsoft developed PhotoDNA to identify illegal images like CSAM -- NCMEC maintains a database of PhotoDNA signatures, and many companies use this service to identify and remove these images.

Microsoft claims:

> A PhotoDNA hash is not reversible, and therefore cannot be used to recreate an image.

This project shows that this isn't quite true: machine learning can do a pretty good job of reproducing a thumbnail-quality images from a PhotoDNA signature.

There has been some discussion in the past on HN about PhotoDNA: https://news.ycombinator.com/item?id=28378254. It has been claimed that PhotoDNA is reversible, but there was no public demonstration as far as I know.

View on HN

Interesting work. It seems like these lossy photo hashes are more obfuscation and resolution reduction than anything secure.

In the photo of the child, facial features aren't reconstructable. Is it possible that PhotoDNA hashes might be sufficiently potato to not infringe on privacy or meaningfully (if not legally) count as explicit/illicit content?

Are secure lossy photo hashes possible? I feel like it'd require indistinguishability obfuscation (iO), where distinguishing a hash from zillions of random noise preimages would be guaranteed intractable. But I'm not sure if you could guarantee all the preimages matching the hash aren't all still recognizable.

Maybe you could set up some kind of adversarial system using your work as the adversary? (e.g. Set of transformed input images --[hashing neural net]-->hashes, then hashes--[Ribosome]-->preimage, then penalize hashing neural net (and reward Ribosome) based on distance of input image and preimage, along with rewarding the hashing net for distance from its hashes of other images + closeness of its hashes of similar transformed images.)

The reversible restriction is important because otherwise distributing PhotoDNA signatures of CSAM is distributing CSAM.

That seems a little bit extreme unless you mean lossless reversibility, which for a process like this will never be available, as per information theory. Obviously the best thing you get by this process is a smudge of colors which will never pass the "I know it when I see it" test.

Couldn't you then pipe the lossy thumbnail into something like nvidia's ML tool that creates "real" images from sketches?

Of course you can. The problem is you almost certainly won't end up with the original image unless the ML tool has been trained with this original image (and even then it might not necessarily appear as an output). There's so many different images it could create from a smudge that there's no reason why the original one should be preferred.

Maybe, but is blurry CSAM still CSAM? If not, then they could just distribute the blurry thumbnails instead of this hash.

It's not if it can't be distinguished of the same blur of something completely different.

Reply on news.ycombinator.com