NeuralHash

File:Barbara.tif NeuralHash is a byproduct of Apple Inc, which reported as early as August 2021 their Child Sexual Abuse Material (CSAM) system using a perceptual hash. A technical summary document, which nicely explains the system with copious diagrams and example photographs, offers that "Instead of scanning images [on corporate] iCloud [servers], the system performs on-device matching using a database of known CSAM image hashes provided by [the National Center for Missing and Exploited Children] (NCMEC) and other child-safety organizations. Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices."

History

The technical summary document was released in early August 2021 to a shocked infosec world. Greg Nojeim of the Center for Democracy and Technology said that "Apple is replacing its industry-standard end-to-end encrypted messaging system with an infrastructure for surveillance and censorship."

NeuralHash was to roll out in iOS 15, macOS Monterey, and Apple Watches.

Already in the same month of its introduction a researcher who goes by username "Asuhariet Ygvar" posted code on GitHub for a "reconstructed Python version of NeuralHash" named AppleNeuralHash2ONNX (ANH2O) which Ygvar "claimed to have reverse-engineered from previous versions of iOS." Ygvar recognized the "nhcalc" contribution, to Compute NeuralHash for a given image, of username "Khaos Tian" who happens to work in Menlo Park.

Later the same week Cory Cornelius, a researcher at Intel Labs, published results that ANH2O produced a grave image collision error in that two distinct images may produce the same hash result. As it turns out, perceptual hashes are known to be more collision-prone. In fact, Matthew Green from Johns Hopkins University warned that "the system could be used to frame innocent people by sending them seemingly innocuous images designed to trigger matches for child pornography. Researchers have been able to do this pretty easily." Green said he believes Apple has "sent a very clear signal" that in its view, "it is safe to build systems that scan users' phones for prohibited content."

Ross Anderson, a professor at Cambridge University, said "It is an absolutely appalling idea, because it is going to lead to distributed bulk surveillance of our phones and laptops."

Edward Snowden said: "No matter how well-intentioned, Apple is rolling out mass surveillance to the entire world with this. Make no mistake: if they can scan for kiddie porn today, they can scan for anything tomorrow. They turned a trillion dollars of devices into iNarcs--without asking."

On 13 August 2021 a Wall Street Journal reporter interviewed Apple software chief Craig Federighi for more than 10 minutes to give him an opportunity to defend the technology. Federighi was at pains to point out that companies like Google, FaceBook and Microsoft use similar technology to process their users' electronic files on their servers. What Apple sought to do was to process them right on their users' client devices.

One result was that the Electronic Frontier Foundation (EFF) launched a petition calling on Apple to bury the system, under the headline “Tell Apple: Don’t Scan Our Phones.”

In an essay entitled "The Problem With Perceptual Hashes", a professional working in the field named Oliver Kuederle produces a startling collision generated by a piece of commercial neural net software, of the NeuralHash type. A photographic portrait of a real woman (Adobe Stock #221271979) reduces through the test algorithm to the same hash as the photograph of a piece of abstract art (from the "deposit photos" database). Both sample images are in commercial databases. Kuederle is concerned with collisions like this. "These cases will be manually reviewed. That is, according to Apple, an Apple employee will then look at your (flagged) pictures... Perceptual hashes are messy. When such algorithms are used to detect criminal activities, especially at Apple scale, many innocent people can potentially face serious problems... Needless to say, I’m quite worried about this."

One wag generated an image whose NeuralHash was written in the image itself. The NeuralHash c78fc26ec100f8508d4e60a3 had two cartoon images of a courtroom scene: the first in which the defense attorney indicates "INNOCENT!" while the second in which the prosecutor says "GUILTY!".

A cybersecurity fellow at the German Marshall Fund of the United States wrote that "It would be trivial for the German government to request that Apple configure the CSAM detection system to flag hate symbols such as swastikas in order to prevent any flagged images or videos from being exported from the device. Every country could develop specific laws related to illicit materials that are impossible to enforce without technology companies like Apple building on-device detection systems."

On 3 September 2021 Apple announced it had shelved its plans to implement NeuralHash amidst concerns the system could be abused by authoritarian states. It only took two weeks for the EFF petition to reach 25,000 signatures.

On 15 October 2021 Forbes reported that 15 experts had written a joint paper entitled "Bugs in our Pockets: The Risks of Client-Side Scanning" to debunk the rosy picture painted by Apple. The authors included stars like Ronald Rivest and Bruce Schneier, who wrote that:

“ Instead of having targeted capabilities such as to wiretap communications with a warrant and to perform forensics on seized devices, the agencies’ direction of travel is the bulk scanning of everyone’s private data, all the time, without warrant or suspicion. That crosses a red line. ”

The Rivest et al paper was covered on the same day by The Guardian who observed that Apple referred them to a press release that said "Based on feedback from customers, advocacy groups, researchers and others, we have decided to take additional time over the coming months to collect input and make improvements before releasing these critically important child safety features."

On 16 December 2021 a Swiss researcher notice that Apple had removed most of the material about CSAM from its website.