NeuralHash

The core of NeuralHash is a convolutional neural network (CNN) that runs entirely on the user's device. It processes an image and extracts a compact, high-level feature vector representing its perceptual content. This embedding is designed to be robust to common image transformations like resizing, cropping, and compression, ensuring that visually identical images produce nearly identical vectors, while visually distinct images map to very different ones. The model is specifically trained to focus on semantic content, not pixel-level noise.

The continuous feature vector is converted into a discrete binary hash. The matching process uses a private set intersection (PSI) protocol. The user's device downloads an encrypted, unreadable database of known CSAM hashes. Matching occurs locally by comparing the generated hash against this encrypted database. The system is designed so that:

• The server never sees the user's photos.
• The user's device cannot decrypt the full database of illegal hashes.
• A match is only revealed if a threshold of identical bits is exceeded, preventing reverse-engineering of the database.

To prevent false positives and protect the database's secrecy, NeuralHash employs a threshold secret sharing scheme. A match on the device generates a cryptographic 'safety voucher'. This voucher is uploaded to Apple's servers, but it is encrypted in such a way that it can only be decrypted if the device's match exceeds a high-confidence threshold. Apple cannot decrypt a voucher from a single low-probability match. This ensures that only high-certainty matches are ever reviewed by a human, adding a critical layer of privacy and accuracy.

The system is engineered to resist adversarial attacks. The hashing algorithm is designed for collision resistance, meaning it is computationally infeasible to create a benign image that intentionally hashes to a known CSAM hash. Furthermore, the neural network is trained to be robust against adversarial perturbations—subtle, maliciously crafted noise added to an image to fool a classifier. The system's architecture ensures that the hash is a one-way function, making it impossible to reconstruct the original image from the hash alone.

NeuralHash does not operate in isolation. It is designed as part of a dual-hashing strategy alongside Microsoft's PhotoDNA. While NeuralHash provides a robust, neural network-based perceptual hash, PhotoDNA provides a complementary, frequency-domain-based hash. An image must match against both independent hashing algorithms to be flagged for review. This multi-algorithm approach dramatically reduces the probability of false positives and creates a more resilient detection system that is harder for malicious actors to evade.

To continuously improve the neural network's accuracy without compromising user privacy, Apple applies differential privacy to the telemetry collected during the hash generation process. When the system analyzes an image, it can send a small amount of randomized, aggregated data about the distribution of hash values. This noise injection provides a mathematical guarantee that the data cannot be used to reconstruct any individual user's image library, while still allowing engineers to monitor and correct systemic drift in the model's embedding space over time.

A cryptographic scheme where a secret is divided into multiple shares, and a minimum number—the threshold—is required to reconstruct it. In Apple's design, the decryption key for the safety voucher is split using this method. The server can only decrypt the voucher and reveal the matched images for human review when the number of matching hashes exceeds a predetermined threshold (e.g., 30). This prevents the system from being used for broad surveillance by ensuring individual, isolated matches are cryptographically inaccessible.

The architectural principle of performing computation locally on the user's hardware rather than in the cloud. NeuralHash exemplifies this by running the neural network inference and hash generation entirely on the device. This means:

• Raw images never leave the device during the scanning process
• The server only ever receives encrypted safety vouchers
• User privacy is preserved by default, with server-side access gated behind cryptographic thresholds This approach contrasts sharply with cloud-based scanning systems that require uploading content for analysis.

The resilience of a machine learning model against inputs intentionally designed to cause misclassification. For NeuralHash, this means resistance to adversarial attacks that attempt to:

• Generate a collision (a benign image that hashes to a known CSAM hash)
• Evade detection (a CSAM image modified to produce a benign hash)
• Extract the model's internal representations Apple employs techniques like gradient masking and ensemble defenses, but the public release of a hash collision by researchers in 2021 demonstrated the ongoing cat-and-mouse nature of this field.

A mathematical framework that quantifies the privacy leakage from an algorithm's output. While NeuralHash itself does not use differential privacy, the broader CSAM detection system is designed with similar privacy-preserving principles. The combination of on-device hashing, PSI, and threshold secret sharing creates a system where the server learns nothing about a user's photo library unless a high-confidence, multi-match threshold is crossed—a design philosophy closely aligned with differential privacy's goal of minimizing information disclosure.