NeuralHash is BROKEN - How to evade Apple's detection & craft hash collisions (w/ Open Source Code)
deep learning machine learning arxiv explained neural networks ai artificial intelligence paper what is deep learning deep learning tutorial introduction to deep learning neuralhash neural hash neural hash collision neuralhash collision neuralhash broken break neuralhash evade neuralhash apple detection icloud neuralhash adversarial examples neuralhash adversarial example apple hash collision how to neuralhash
#apple #icloud #neuralhash

Send your Apple fanboy friends to prison with this one simple trick ;) We break Apple's NeuralHash algorithm used to detect CSAM for iCloud photos. I show how it's possible to craft arbitrary hash collisions from any source / target image pair using an adversarial example attack. This can be used for many purposes, such as evading detection, or forging false positives, triggering manual reviews.

OUTLINE:
0:00 - Intro
1:30 - Forced Hash Collisions via Adversarial Attacks
2:30 - My Successful Attack
5:40 - Results
7:15 - Discussion

DISCLAIMER: This is for demonstration and educational purposes only. This is not an endorsement of illegal activity or circumvention of law.

Code: https://github.com/yk/neural_hash_collision
Extract Model: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX
My Video on NeuralHash: https://youtu.be/z15JLtAuwVI

ADDENDUM:
The application of framing people is a bit more intricate than I point out here. Apple has commented that there would be a second perceptual hashing scheme server-side, i.e. the model would not be released, which makes forging false positives harder. Nevertheless, evading the system remains fairly trivial.

Links:
TabNine Code Completion (Referral): http://bit.ly/tabnine-yannick
YouTube: https://www.youtube.com/c/yannickilcher
Twitter: https://twitter.com/ykilcher
Discord: https://discord.gg/4H8xxDF
BitChute: https://www.bitchute.com/channel/yannic-kilcher
Minds: https://www.minds.com/ykilcher
Parler: https://parler.com/profile/YannicKilcher
LinkedIn: https://www.linkedin.com/in/yannic-kilcher-488534136/
BiliBili: https://space.bilibili.com/1824646584

If you want to support me, the best thing to do is to share out the content :)

If you want to support me financially (completely optional and voluntary, but a lot of people have asked for this):
SubscribeStar: https://www.subscribestar.com/yannickilcher
Patreon: https://www.patreon.com/yannickilcher
Bitcoin (BTC): bc1q49lsw3q325tr58ygf8sudx2dqfguclvngvy2cq
Ethereum (ETH): 0x7ad3513E3B8f66799f507Aa7874b1B0eBC7F85e2
Litecoin (LTC): LQW2TRyKYetVC8WjFkhpPhtpbDM4Vw7r9m
Monero (XMR): 4ACL8AGrEo5hAir8A9CeVrW8pEauWvnp1WnSDZxW7tziCDLhZAGsgzhRQABDnFy8yuM9fWJDviJPHKRjV4FWt19CJZN9D4n
 So I've made multiple videos about this already. ML news reported, Apple is releasing their new system to detect child abuse material, which includes running code on the device of the actual users before they upload images to iCloud. I've also made a video about the technical summary that Apple released where they detail how they're going to preserve user privacy in the face of all of this. And the system is pretty smart. But in that video, I already pointed out while the cryptographic and security part of the system is smart and fulfills all the privacy requirements of what Apple claims, the neural network part is the weak part right here. But also in that video, I outlined two weak points of the system. The first weak point is who controls the database, who does the manual checking and so on. This is politics, I guess the second part is the neural network part. At the beginning of this whole pipeline, there is a neural network that is trained to recognize when two images are the same. So the neural network is supposed to be robust to some transformations. For example, if you resize the image, if you re encode the image, and so on, the bits of the image will change. However, the neural network should still recognize that that is the same image. And you can definitely train neural networks to do that. However, criticism has come up. And I've mentioned this as well, that neural networks being neural networks, they can be tampered with with so called adversarial attacks. Now it didn't even take a week before code was released to find the model that Apple is using on device, it was actually on my computer the whole time, and convert that to a format that we can work with in neural network frameworks. Also, we already have the first reports of a forced collision, that means two images that look essentially nothing alike, yet the network thinks that is the same image. So this can be potentially used to frame someone i.e. send them images that are seemingly innocuous, yet the images are perturbed in just the right way to make Apple think they're the same as one of the images in their database. On the other hand, using the same techniques called adversarial attacks, we can also evade this system, meaning that we can change this neural hash of any image pretty much as we please. So I thought, hey, why not give it a try. So this is partially based on code that's already available, and I'll link to that. I'll make my code available that has references to that code that I'm basing my work on. So I'm going to show you how to force a collision. If you understand how to force a collision, it's pretty easy to also understand how you can evade a collision. So that exercise is left to the reader. Forcing a collision is actually the more difficult part. So that's what I'm going to show you today. And this is doable by anyone with introductory skills to deep learning programming. Alright, so first, we're going to need some sort of a image that we want to perturb. Let's take this image right here of nice doggy. Hey, she by new. And let's assume that we are in possession of an image that we know is in the database of bad material. Pretend for a second that this image of the Titanic is that image that is in the database. Alright, so I've already used the code available online to convert the model into the O and X format, which is an interchangeable format for the different frameworks of deep learning. And then I further converted it to a TensorFlow format, which is one of the major frameworks for deep learning. Now with a little bit of plumbing, I can then further shove this into a library called the adversarial robustness toolbox, which is used to do research on adversarial examples. So our plan is going to be essentially we have the source image. And if we just run that through the neural pipeline, it will give us some neural hash at the end, that neural hash is computed from the network's output, which is some vector in high dimensional space, if we run the target image through the same neural network, we'll get a different vector. And because of that, we'll get a different neural hash. Now what we can do with an adversarial attack is we can compute the minimal perturbation necessary to the source image. And that's really going to be a tiny perturbation, you can't see it with the naked eye. But this tiny perturbation, if we do it in the right way, causes the output to change all the way to align with the output vector of the target image. And if we align the two vectors closely enough, then they will output the same neural hash, they will fall into the same bucket of the LSH algorithm. And they will give the same output. I've explained in the last video already what LSH is and how that works. So if you want to find more about that, check it out. So when I recorded this, I was a bit over eager in what I could do, though, I'm pretty sure with some engineering, this can be smoothed out. But you see the image on the left is the one we started with. And our target image is this image of the Titanic. And the image on the bottom is the collision image. So it's noticeably different. So first of all, the resizing, that's just the fact of the algorithm that doesn't matter, actually. But you can clearly see there are some artifacts in the image. However, you would still notice it as being very similar to the original image, yet it is in the same bucket. So it has the same neural hash as the Titanic image, which, you know, that's pretty astonishing. All right, so as you can see, the code for this is relatively minimal. And we don't have to run this for long until we actually find a collision. And the image that we craft looks like this. Remember, this has the same neural hash as the Titanic image. So on Apple's side, at least before the manual review, this shows up as being flagged to be the same as this Titanic image, it should be plainly obvious, you know, how you can frame people if you see these things. Now, if you get this crafted image, you don't think twice that this could be some kind of a malintended essentially a virus. And as soon as you upload it to iCloud in Apple's headquarters, a red light flashes next to your name. Now hold on, you might say, in order to pull off this attack, you do actually need this Titanic ish image, right? Therefore, you must already be in pretty shady waters, because the possession of this image, presumably is illegal already. And I'm here to tell you not necessarily see since we now have another image that you know, is not an illegal image, it's not the same image to a human. But nevertheless, that image is in fact, in this bucket, we now are in possession of a completely legal image from the illegal bucket. So in the future, we can simply use that image as the target image. So technically, only one person at the very beginning has to have access to some kind of illegal material, and they can simply pass on the non robust features that we all adjust to. And subsequently, nobody is doing anything illegal, yet we're able to essentially DDoS Apple with this, there you go, we've just beaten the most valuable company on the planet with ironically, a laptop that they manufactured in less than a few minutes. Now, what does it matter, you ask? Well, I think this is pretty worrisome. So there is a system that's implemented on all of these devices, it essentially normalizes companies running code on your devices. And given that they have exclusive control over these databases, and given that we see everyday governments going to these companies right now, it's in different countries, but surely can happen everywhere on the world. I don't think this is necessarily a good thing, given the trade off we're doing here, this is so easy to evade. And this is so easy to abuse. At the end, it seems like there must be better methods of achieving our goals here. Alright, that was it. Check out code, subscribe, check out next ML news. Bye bye.
 So I've made multiple videos about this already. ML news reported, Apple is releasing their new
 system to detect child abuse material, which includes running code on the device of the
 actual users before they upload images to iCloud. I've also made a video about the technical summary
 that Apple released where they detail how they're going to preserve user privacy in the face of all
 of this. And the system is pretty smart. But in that video, I already pointed out while the
 cryptographic and security part of the system is smart and fulfills all the privacy requirements
 of what Apple claims, the neural network part is the weak part right here. But also in that video,
 I outlined two weak points of the system. The first weak point is who controls the database,
 who does the manual checking and so on. This is politics, I guess the second part is the neural
 network part. At the beginning of this whole pipeline, there is a neural network that is
 trained to recognize when two images are the same. So the neural network is supposed to be robust to
 some transformations. For example, if you resize the image, if you re encode the image, and so on,
 the bits of the image will change. However, the neural network should still recognize that
 that is the same image. And you can definitely train neural networks to do that. However,
 criticism has come up. And I've mentioned this as well, that neural networks being neural networks,
 they can be tampered with with so called adversarial attacks. Now it didn't even take a week before
 code was released to find the model that Apple is using on device, it was actually on my computer
 the whole time, and convert that to a format that we can work with in neural network frameworks.
 Also, we already have the first reports of a forced collision, that means two images that look
 essentially nothing alike, yet the network thinks that is the same image. So this can be potentially
 used to frame someone i.e. send them images that are seemingly innocuous, yet the images are
 perturbed in just the right way to make Apple think they're the same as one of the images in
 their database. On the other hand, using the same techniques called adversarial attacks, we can also
 evade this system, meaning that we can change this neural hash of any image pretty much as we please.
 So I thought, hey, why not give it a try. So this is partially based on code that's already available,
 and I'll link to that. I'll make my code available that has references to that code that I'm basing
 my work on. So I'm going to show you how to force a collision. If you understand how to force a
 collision, it's pretty easy to also understand how you can evade a collision. So that exercise is
 left to the reader. Forcing a collision is actually the more difficult part. So that's what I'm going
 to show you today. And this is doable by anyone with introductory skills to deep learning
 programming. Alright, so first, we're going to need some sort of a image that we want to perturb.
 Let's take this image right here of nice doggy. Hey, she by new. And let's assume that we are in
 possession of an image that we know is in the database of bad material. Pretend for a second
 that this image of the Titanic is that image that is in the database. Alright, so I've already used
 the code available online to convert the model into the O and X format, which is an interchangeable
 format for the different frameworks of deep learning. And then I further converted it to
 a TensorFlow format, which is one of the major frameworks for deep learning. Now with a little
 bit of plumbing, I can then further shove this into a library called the adversarial robustness
 toolbox, which is used to do research on adversarial examples. So our plan is going to be essentially
 we have the source image. And if we just run that through the neural pipeline, it will give us some
 neural hash at the end, that neural hash is computed from the network's output, which is
 some vector in high dimensional space, if we run the target image through the same neural network,
 we'll get a different vector. And because of that, we'll get a different neural hash. Now what we
 can do with an adversarial attack is we can compute the minimal perturbation necessary to the source
 image. And that's really going to be a tiny perturbation, you can't see it with the naked eye.
 But this tiny perturbation, if we do it in the right way, causes the output to change all the
 way to align with the output vector of the target image. And if we align the two vectors closely
 enough, then they will output the same neural hash, they will fall into the same bucket of the
 LSH algorithm. And they will give the same output. I've explained in the last video already what LSH
 is and how that works. So if you want to find more about that, check it out. So when I recorded this,
 I was a bit over eager in what I could do, though, I'm pretty sure with some engineering, this can be
 smoothed out. But you see the image on the left is the one we started with. And our target image is
 this image of the Titanic. And the image on the bottom is the collision image. So it's noticeably
 different. So first of all, the resizing, that's just the fact of the algorithm that doesn't matter,
 actually. But you can clearly see there are some artifacts in the image. However, you would still
 notice it as being very similar to the original image, yet it is in the same bucket. So it has the
 same neural hash as the Titanic image, which, you know, that's pretty astonishing. All right,
 so as you can see, the code for this is relatively minimal. And we don't have to run this for long
 until we actually find a collision. And the image that we craft looks like this. Remember, this has
 the same neural hash as the Titanic image. So on Apple's side, at least before the manual review,
 this shows up as being flagged to be the same as this Titanic image, it should be plainly obvious,
 you know, how you can frame people if you see these things. Now, if you get this crafted image,
 you don't think twice that this could be some kind of a malintended essentially a virus. And as soon
 as you upload it to iCloud in Apple's headquarters, a red light flashes next to your name. Now hold on,
 you might say, in order to pull off this attack, you do actually need this Titanic ish image,
 right? Therefore, you must already be in pretty shady waters, because the possession of this image,
 presumably is illegal already. And I'm here to tell you not necessarily see since we now have
 another image that you know, is not an illegal image, it's not the same image to a human. But
 nevertheless, that image is in fact, in this bucket, we now are in possession of a completely
 legal image from the illegal bucket. So in the future, we can simply use that image as the target
 image. So technically, only one person at the very beginning has to have access to some kind of
 illegal material, and they can simply pass on the non robust features that we all adjust to. And
 subsequently, nobody is doing anything illegal, yet we're able to essentially DDoS Apple with this,
 there you go, we've just beaten the most valuable company on the planet with ironically, a laptop
 that they manufactured in less than a few minutes. Now, what does it matter, you ask? Well,
 I think this is pretty worrisome. So there is a system that's implemented on all of these devices,
 it essentially normalizes companies running code on your devices. And given that they have exclusive
 control over these databases, and given that we see everyday governments going to these companies
 right now, it's in different countries, but surely can happen everywhere on the world. I don't think
 this is necessarily a good thing, given the trade off we're doing here, this is so easy to evade.
 And this is so easy to abuse. At the end, it seems like there must be better methods of achieving
 our goals here. Alright, that was it. Check out code, subscribe, check out next ML news. Bye bye.