• DOI:10.48550/arXiv.2207.14258
• Corpus ID: 251135308

Exploiting and Defending Against the Approximate Linearity of Apple's NeuralHash

@article{Bhatia2022ExploitingAD,
  title={Exploiting and Defending Against the Approximate Linearity of Apple's NeuralHash},
  author={Jagdeep Bhatia and Kevin Meng},
  journal={ArXiv},
  year={2022},
  volume={abs/2207.14258}
}

• Jagdeep Bhatia, Kevin Meng
• Published 28 July 2022
• Computer Science
• ArXiv

Perceptual hashes map images with identical semantic content to the same n -bit hash value, while mapping semantically-different images to different hashes. These algorithms carry important ap-plications in cybersecurity such as copyright in-fringement detection, content fingerprinting, and surveillance. Apple’s N EURAL H ASH is one such system that aims to detect the presence of illegal content on users’ devices without compromising consumer privacy. We make the surprising discovery that N EURAL H ASH is approximately linear , which inspires the development of novel black-box attacks that can (i) evade detection of “illegal” images, (ii) generate near-collisions, and (iii) leak information about hashed images, all without access to model parameters. These vulnerabilities pose serious threats to N EURAL H ASH ’s security goals; to address them, we propose a simple fix using classical cryptographic standards.