This is a proof of concept on generating collisions on a perceptual hash similar to the one Apple recently decided to use to scan your devices for CSAM. (https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...)

Perceptual hashes are not cryptographically secure, so no matter how much crypto you add on top of them, they are one weak point of attack of the whole system.

To create a collision you search for an input image which minimize the distance between the hash and the target hash. Because neural network are continuous you can use a gradient method.

I don't have the architecture nor the weights of the actual neural hash they use so this is only a POC in the general case.

What does this mean : An attacker can easily produce natural images that have a specified perceptual Hash. An attacker can generate a meme image which looks normal but has a hash which is inside the CSAM database. (he can easily get one of these bad hash values by computing the neural hash of a known offensive image) Then he send you a mail, then you save the image to your cloud because you find it funny (or because your phone automatically back-up your mail to your cloud) , and a collision is registered and you get arrested (when the manual review fails, for example if the attacker has steganographically hidden offensive content in those images).

I don't have the architecture nor the weights of the actual neural hash they use so this is only a POC in the general case.

Then why is this titled "Generating Collisions on NeuralHash" and why are you making claims about the how easy it is to fool NeuralHash based on it?

In the manual review failure case, you're saying that the reviewer would decrypt the steganographical encryption, discover the hidden offensive content, and thereby decide that it's a true positive?

And related to that, I wonder how steganographically hidden offensive content would affect a perceptual hash. Would it help or would it hurt the similarity measure if an attacker were trying to generate a benign-looking collision in the manner described.

My guess is that adding steganographically hidden content is almost free for the attacker as perceptual hash is resistant to small variation.

There is a free parameter called gap in my code which help make sure that you can modify the image a little bit and still get the same hash.

So probably the attacker can use the least significant bit of each pixel as a hidden channel. Take 8 pictures and you can hide any grey image ((or hide them in the same one if the original image is of high resolution (perceptual hash is almost like acting on thumbnails) ).

The human eye won't be able to see anything special in the picture, but a forensic software will definitely notice that something's off in the least significant bits of your pictures and light some red flag. Then once the reviewer figure the steganographical scheme, he will decode the hidden picture, and after having a ha-ah moment he will be convinced 100% that this is offensive content and that it should be reported.