Message Boards Message Boards

GROUPS:

Analyzing Apple's NeuralHash surveillance system

Posted 2 months ago
1112 Views
|
4 Replies
|
9 Total Likes
|

An analysis of Apple's CSAM Detection NeuralHash Network

4 Replies

Is there a way we could get access to the ONNX files and the original weight files? Also you might be interested in: https://blog.wolfram.com/2021/01/07/deploy-a-neural-network-to-your-ios-device-using-the-wolfram-language/

Posted 2 months ago

Apple stores the weight files on all up-to-date Apple computers in the "/System/Library/Frameworks/Vision.framework/Resources/" folder. These weights are also present on similar folder which is accessible on jailbroken Apple iOS devices. Finally, these files can be extracted from iOS disk images (discussed here: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX ).

ONNX files can be created using the shell commands in the correspondingly named section of the notebook.

I cannot upload .onnx or .zip files to this forum for some reason.

Nice exploration!

One thing that might be worth trying is to check how the degradation by rotation is influenced by the pretty sharp transition to the black background.

You can pad the original image (or find one with more background)

img = Import[
   "https://i.natgeofe.com/n/6490d605-b11a-4919-963e-f1e6f3c0d4b6/sumatran-tiger-thumbnail-\
nationalgeographic_1456276.jpg?w=200"];
img = ImagePad[img, 50, RGBColor[{252, 251, 249}/255]];

tiger padded

and than create a fixed size rotated crop:

Table[ImageRotate[img, d Degree, 200], {d, {0, 45, 90, -45}}]

tiger list

Posted 2 months ago

Hashing error is slightly better when the background color is preserved during rotation, but still consistently drops to 75-80% bit match. They probably hash rotated images to avoid this shortcoming however.

Considering two unrelated cat pictures can match with 68% bit similarity, Apple will likely have to deal with many false positives regardless. 1 in 1 Trillion error seems like utterly wrong based on their approach: neural networks are not intelligent enough to accomplish that kind of accuracy, and current NN approaches have a known sensitivity to rotation and arbitrary perspective transformations (which was one of the original sparks for the creation of alternatives like capsule nets).

Reply to this discussion
Community posts can be styled and formatted using the Markdown syntax.
Reply Preview
Attachments
Remove
or Discard

Group Abstract Group Abstract