False positives—images that look nothing alike but have very similar or even the same perceptual hashes—are also possible. This leaves an opening for mischief, and worse. It is unfortunately too easy to arrange for, say, a candidate for elective office, to receive a photo that looks innocuous, store it, and only later learn that the photo triggered a law enforcement alert because its perceptual hash was the same as that of known CSAM. Damage would be high and may not go away (recall Pizzagate).

Would such an “attack” be feasible? Yes. Shortly after a researcher published the code used in Apple’s NeuralHash, an Intel researcher produced a hash “collision”: two images that look nothing alike but have the same perceptual hashes. Such capabilities are present for researchers—and others, especially those with an incentive to cause problems. As computer scientists Carmela Troncoso and Bart Preneel observed, “In the arms race to develop such detection technologies, the bad guys will win: scientists have repeatedly shown that it is easy to evade detection and frame innocent citizens."

Other proposed techniques to recognize CSAE, including previously unknown examples, include machine learning. But as my co-authors and I discussed in “Bugs in our Pockets,” false positives and false negatives are a problem here too.

This is grounded in information theory. Without a perfect CONTEXT AWARE classifier (i.e. not one that will report you for sending your family doctor a photo of your child’s medical condition) with perfect integrity protection it’s impossible to solve. All other solutions means it either can be evaded or that it can be abused to spy on innocent people. No circumvention of this basic fact is possible.