HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
anishathalye
neural-hash-collider
Python2021–2021
anishathalye / neural-hash-collider

neural-hash-collider

Preimage attack against NeuralHash 💣

8Distinct people
9Mentions
0Explicit recommenders
676GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Preimage attack against NeuralHash 💣

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by week9 dated mentions

Observed mentions: 2021-08-19 01:22:17 UTC to 2021-09-23 09:02:15 UTC. Weeks start Monday, UTC.

02462021-08-16 00:00:00 UTC to 2021-08-23 00:00:00 UTC (exclusive): 7 mentions; 1 submissions, 6 commentsAug 162021-08-23 00:00:00 UTC to 2021-08-30 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-08-30 00:00:00 UTC to 2021-09-06 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsAug 302021-09-06 00:00:00 UTC to 2021-09-13 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-09-13 00:00:00 UTC to 2021-09-20 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-09-20 00:00:00 UTC to 2021-09-27 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsSep 20

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Aug 162021-08-16 00:00:00 UTC2021-08-23 00:00:00 UTC716
Aug 232021-08-23 00:00:00 UTC2021-08-30 00:00:00 UTC000
Aug 302021-08-30 00:00:00 UTC2021-09-06 00:00:00 UTC101
Sep 62021-09-06 00:00:00 UTC2021-09-13 00:00:00 UTC000
Sep 132021-09-13 00:00:00 UTC2021-09-20 00:00:00 UTC000
Sep 202021-09-20 00:00:00 UTC2021-09-27 00:00:00 UTC101

What Hacker News says

9 sources
Reminder that it's perceptual hashes, not cryptographic hashes. So it's enough that images have enough visual resemblance, according to the model. Natural collisions have been observed and generating collisions for planting on someone elses device is trivial. Apple also only recieves a DB of hashes and so have no way to verify that they're only scanning for CSAM and not other "undesirable" content. https://github.com/roboflow-ai/neuralhash-collisions https://github.com/anishathalye/neural-hash-collider
In Google Drive of historical footage locked and flagged as terrorist activity
"Apple said that there is a one in one trillion chance of a false positive" https://techcrunch.com/2021/08/05/apple-icloud-photos-scanni... Versus: https://blog.roboflow.com/nerualhash-collision/ Along with: https://github.com/anishathalye/neural-hash-collider Demonstrates blatant incompetence on the part of Apple's design. At this point, trust is broken. That's the end of credibility regarding any other claim made about the security or base function of the system. As for a simple example of one of many potential attack vectors (search HN for "neuralhash" and read the comments for countless examples), here is a basic attack: As Apple's hash algorithm is entirely broken and useless, a malicious actor can easily craft a NSFW, but otherwise legal image, that has a hash matching one in the CSAM database, that is visually ambiguous in that con
Read the rest
text (for example, a close-up). Targeted attacks could be launched on unsuspecting victims as simply as sending them an image. If their app is configured to auto-save to iCloud - as some are by default, and as many are configurable to be - the image will then get automatically flagged as a match, and may well potentially pass a human review - because the image may indeed look just like CP - and an innocent person, who may not even be aware of the presence of the image in their iCloud library at this point, may get visited by the police. That in itself is bad enough. However it gets worse - do bear in mind that "the police" is not an equivalent concept across nations, yet iPhones are ubiquitously used across the world. In certain countries, a "visit from the police" over such automatically-flagged content could well result in presumption of guilt to the point of immediately administered punishment and a destroyed innocent life. In China for example, conviction rates are routinely 99.99% - being accused of a crime there is equivalent to being convicted, and that's just one major country containing well over 100 million iphone users. Apple is demonstrating not only gross incompetence in this design of this "system", but vagrant disregard for human rights, along with utterly destroying their own long-cultivated pro-privacy stance. It's a disaster for them and their customers in every possible way it could be.
In Hash collision in Apple NeuralHash model
Yes, I can. This is just one possible strategy: there are many others, where different things are done, and where things are done in a different order. You use the collider [1] and one of the many scaling attacks ([2] [3] [4], just the ones linked in this thread) to create an image that matches the hash of a reasonably fresh CSAM image currently circulating on the Internet, and resizes to some legal sexual or violent image. Note that knowing such a hash and having such an image are both perfectly legal. Moreover, since the resizing (the creation of the visual derivative) is done on the client, you can tailor your scaling attack to the specific resampling algorithm. Eventually, someone will make a CyberTipline report about the actual CSAM image whose hash you used, and the image (being a genuine CSAM image) will make its way into the NCMEC
Read the rest
hash database. You will even be able to tell precisely when this happens, since you have the client-side half of the PST database, and you can execute the NeuralHash algorithm. You can start circulating the meme before or after this step. Repeat until you have circulated enough photos to make sure that many people in the targeted group have exceeded the threshold. Note that the memes will trigger automated CSAM matches, and pass the Apple employee's visual inspection: due to the safety voucher system, Apple will not inspect the full-size images at all, and they will have no way of telling that the NeuralHash is a false positive. [1] https://github.com/anishathalye/neural-hash-collider [2] https://embracethered.com/blog/posts/2020/husky-ai-image-res... [3] https://bdtechtalks.com/2020/08/03/machine-learning-adversar... [4] https://graphicdesign.stackexchange.com/questions/106260/ima...
In ImageNet contains naturally occurring Apple NeuralHash collisions
This post is still getting linked from other places, so I think it's helpful to point out that it's almost certainly fake. (Hence its [flagged] status) The images shown do appear to be adversarially generated inputs against some NN-based image hash or classifier, but there is no evidence to suggest that this is at all related to Apple's NeuralHash, or that the colliding hashes are from a real CSAM database (the target hashes are not public). OP claimed they would "release 5 pieces of proof in the next 5 days" [1], and guess what, 11 days later they still haven't. Look at OP's post and comment history, it's quite clear that they are a troll. In the mean time, it has been actually proven that hash collisions against NeuralHash are trivially possible, see [2] [1] https://news.ycombinator.com/item?id=28107393 [2] https://github.com/anishathal
Read the rest
In Tell HN: Dont upload these images to iCloud as Apple will assume its Child Porn
The README (https://github.com/anishathalye/neural-hash-collider#how-it-...) explains in a bit more detail how these adversarial attacks work. This code pretty much implements a standard adversarial attack against NeuralHash. One slightly interesting part was replacing the thresholding with a differentiable approximation. I figured I'd share this here in case anyone is interested in seeing what the code to generate adversarial examples looks like; I don't think anyone in the big thread on the topic (https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX/issue...) has shared attack code for NeuralHash in particular yet.
In Show HN: Neural-hash-collider – Find target hash collisions for NeuralHash

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.