The Adversarial Collisions that Broke Apple’s CSAM System (and Why They Matter Beyond Apple)
This post is a technical follow-up to “64 Bits Decide What You Can Upload to the Internet”. If you haven’t read that yet, I recommend starting there. Here, we assume you understand what a perceptual hash is and why PhotoDNA, PDQ, and NeuralHash are close cousins. On August 5, 2021, Apple announced NeuralHash. By August 18—just thirteen days later—a pseudonymous researcher named Asuhariet Ygvar published a complete reverse-engineering of the model, extracted from iOS binaries, on GitHub. Within days, two independent researchers—Brad Dwyer and others—published collisions: visually distinct images producing the exact same hash. The system that Apple had promised to deliver with a false positive rate of “one in a trillion accounts per year” was shown to be attackable using consumer-grade hardware. ...