Apple Faces Intense Scrutiny Over Flawed CSAM Photo Scanning Algorithm
Security researchers successfully reverse-engineer Apple's NeuralHash algorithm and quickly discover a hash collision, raising serious concerns about the accuracy and potential abuse of the upcoming CSAM detection system.
Apple faces significant backlash over its upcoming NeuralHash technology, a system designed to detect known child sexual abuse material on user devices before it uploads to iCloud. The algorithm works by matching unique photo hashes provided by child protection organizations, flagging an account for manual review only if it detects 30 or more matching images. Apple claims this on-device approach is more privacy-friendly than traditional server-side scanning because it does not require breaking end-to-end encryption, and the company insists the false positive rate is about one in one trillion accounts.
Despite Apple's assurances, privacy advocates and security experts warn that highly resourced actors or authoritarian governments could potentially abuse the system to implicate innocent people or expand the scanning to detect other objectionable materials. The controversy escalates when a security researcher reverse-engineers the NeuralHash algorithm into a publicly available Python script. This reconstructed code reveals that the technology already exists in obfuscated form within iOS 14.3, allowing the broader security community to examine the algorithm before its official rollout.
Critics quickly put the published code to the test and soon report the first hash collision, a scenario where two entirely different images produce the exact same hash. This discovery directly challenges Apple's mathematical claims regarding the system's reliability and underscores the very real risk of false positives. Meanwhile, internal Apple memos show that the National Center for Missing and Exploited Children dismisses these growing security concerns as merely the "screeching voices of the minority."