ImageNet contains naturally occurring Apple NeuralHash collisions
Keep in mind that Apple&#x27;s claimed false positive rate (one in a trillion chance of an account being flagged innocently), and the collision rate determined by Dwyer in the article, are both derived without any adversarial assumptions. Given that NeuralHash collider and similar tools already exist, the false positive rate is expected to be much much higher.<p>Imagine that you play a game of craps against an online casino. The casino throws a virtual six-sided die, secretly generated using Microsoft Excel&#x27;s random number generator. Your job is to predict the result. If you manage to predict the result 100 times in a row, you win and the casino will pay you $1000000000000 (one trillion dollars). If you ever fail to predict the result of a throw, the game is over, you lose and you pay the casino $1 (one dollar).<p>In an ordinary, non-adversarial context, the probability that you win the game is much less than one in one trillion, so this game is very safe for the casino. But this number is very misleading: it&#x27;s based on naive assumptions that are completely meaningless in an adversarial context. If your adversary has a decent knowledge of mathematics at the high school level, the serial correlation in Excel&#x27;s generator comes into play, and the relevant probability is no longer one in one trillion. The relevant number is 1&#x2F;216 instead! When faced with a class of adversarial math majors, a casino that offers this game will promptly go bankrupt. With Apple&#x27;s CSAM detection, you get to be that casino.