That the server may know the hash is IMHO much less a problem (it shouldn't be reversible anyway) than the legitimization of on-device scanning.
Of course that's a lot less secure and leaks more privacy info, but the objections seem more about the morality of having a device you own doing the scanning, not so much about any privacy concerns.
Lots to look at there but the key bit is:
>If the user image hash matches the entry in the known CSAM hash list, then the NeuralHash of the user image exactly transforms to the blinded hash if it went through the series of transformations done at database setup time. Based on this property, the server will be able to use the cryptographic header (derived from the NeuralHash) and using the server-side secret, can compute the derived encryption key and successfully decrypt the associated payload data
So my understanding is that the server won't even know the hash of the image unless the client-side operations determine that it matches one of the hashes in the CSAM database, which is stored on the client.
Are you seeing it differently?
Let's say tomorrow China tells Apple to do client-side scanning, and let's say Apple decides to comply.
Scenario A (Apple already did on-device scanning):
Apple flips a few bits. iOS no longer cares whether images where uploaded on not. The code change can easily be hidden assuming no reverse engineering. There's little measurable difference unless the user has a matching image in which case the user is already done for [EDIT: in retrospect, the device should be running a scan on the local images every blacklist fetch. I still think that scanning more images is much less of a difference than the other scenario, where the device has to do stuff it just did not do before]
Scenario B (Hash Comparison is server-side):
The code change can be hidden of course. But otherwise there are significant changes:
The device needs to calculate hashes to every image upon creation which it did not before. The device needs to fetch the blacklist every X days which it did not before. The device needs to run the local scan every blacklist fetch which can be slow if many images.
All these things are far more likely to be noticeable and far more likely to generate network traffic.
>Pushing a perceptual hash of every photo to Apple would actually decrease your privacy as now Apple can find any known photo in your library - not just CSAM but on any topic - memes, political protests, porn, whatever.
The Hash shouldn't be reversible, so the only way for Apple to do that is to have an existing dataset. Which is possible, but preferable to the no E2E situation and (IMHO) the on-device scanning situation.
This seems far better than having every photo scanned server side and have those photos sit there unencrypted.