Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash

Abstract

Apple recently revealed its deep perceptual hashing system Neu-ralHash to detect child sexual abuse material (CSAM) on user devices before files are uploaded to its iCloud service. Public criticism quickly arose regarding the protection of user privacy and the system's reliability. In this paper, we present the first comprehensive empirical analysis of deep perceptual hashing based on NeuralHash. Specifically, we show that current deep perceptual hashing may not be robust. An adversary can manipulate the hash values by applying slight changes in images, either induced by gradient-based approaches or simply by performing standard image transformations, forcing or preventing hash collisions. Such attacks permit malicious actors easily to exploit the detection system: from hiding abusive material to framing innocent users, everything is possible. Moreover, using the hash values, inferences can still be made about the data stored on user devices. In our view, based on our results, deep perceptual hashing in its current form is generally not ready for robust client-side scanning and should not be used from a privacy perspective. 1 CCS CONCEPTS• Computing methodologies → Machine learning; • Security and privacy → Software and application security.

Needle In A Haystack, Fast: Benchmarking Image Perceptual Similarity Metrics At Scale

“…While this class of algorithms has recently come into attention due to Apple's intention to use a version of it -NeuralHash -to detect and report reprehensible images on user devices, with all the privacy, censorship and reliability issues it raises (Struppek et al, 2021), use of deep neural networks for similarity detection is all but new. In Bromley et al (1993), the authors trained networks to detect signature similarity with a precision sufficient to distinguish authentic ones from fake ones, by using a method they introduced -Siamese Networks.…”

Exploiting and Defending Against the Approximate Linearity of Apple's NeuralHash

“…Semantic Similarity: Two images x 1 , x 2 ∈ X are semantically similar if, given some metric function The pre-processed image is first embedded with a contrastively-trained MobileNet (Howard et al, 2017) convolutional neural network. The extracted features are then transformed with a randomized hashing matrix, whose outputs are passed through a step function to generate the final binary hash (Struppek et al, 2021;Apple, 2021).…”

“…Because NEURALHASH relies on a neural network whose weights have been extracted and made public (Ygvar, 2021), a variety of gradient-based attacks have also been proposed (Struppek et al, 2021). These white-box attacks rely on the susceptibility of neural networks to small adversarial perturbations (Goodfellow et al, 2014) More formally, consider taking two source images x 1 and x 2 and linearly interpolating them with respect to some parameter α.…”

“…Unfortunately, NEURALHASH has been controversial since its inception, due to concerns about efficacy and user privacy (Abelson et al, 2021). Recently, these concerns have been made concrete, with studies identifying problems with NEURALHASH's collision resistance, privacy guarantees, and false positive/negative rates under gradient-based adversarial attacks (Struppek et al, 2021;Ygvar, 2021;Roboflow, 2021;Dwyer, 2021).…”

“…White-box adversarial attacks on neural networks are well studied in literature; as a result, numerous gradient-based attacks have been proposed against NEURALHASH (Athalye, 2021; Struppek et al, 2021). We ask whether the same attacks can be achieved without access to model weights, as the ability to construct such attacks in a gradient-free setting would imply a deeper understanding of NEURALHASH's inner workings.…”