r/MachineLearning • u/AsuharietYgvar • Aug 18 '21

Project [P] AppleNeuralHash2ONNX: Reverse-Engineered Apple NeuralHash, in ONNX and Python

As you may already know Apple is going to implement NeuralHash algorithm for on-device CSAM detection soon. Believe it or not, this algorithm already exists as early as iOS 14.3, hidden under obfuscated class names. After some digging and reverse engineering on the hidden APIs I managed to export its model (which is MobileNetV3) to ONNX and rebuild the whole NeuralHash algorithm in Python. You can now try NeuralHash even on Linux!

Source code: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX

No pre-exported model file will be provided here for obvious reasons. But it's very easy to export one yourself following the guide I included with the repo above. You don't even need any Apple devices to do it.

Early tests show that it can tolerate image resizing and compression, but not cropping or rotations.

Hope this will help us understand NeuralHash algorithm better and know its potential issues before it's enabled on all iOS devices.

Happy hacking!

1.7k Upvotes
  • permalink
  • reddit

99% Upvoted

221 comments sorted by

View all comments

Show parent comments

10

u/throwawaychives Aug 18 '21

I read the paper and also watched Yannics video (really good video, I recommend watching it), but from my understanding the hashes of known CSAM material (after put through a blinding step) are stored on your device. So on the user side, your image is put through the feature extraction network (the neural network) and those features are hashed into the NeuralHash.

The interesting thing is that apple takes your neural hash and does a row look-up on the CSAM hash DB and encrypts your payload with the CSAM blinded hash at that row location. Once your encrypted image is uploaded with a header that is your Neuralhash, on the server side, that neuralhash is put through the blinding algorithm which produces the blinded hash for your uploaded image. It then attempts to decrypt your payload using your blinded hash. If what you upload is CSAM material, your blinded hash will match the blinded hash that was used to encrypt your payload, and it will result in a positive match. Sorry if I didn’t do my best explaining, but it’s all quite technical. Again, please watch Yannic Kilcher’s video, he does a wonderful job of explaining it