TechTalks

Yes, I can. This is just one possible strategy: there are many others, where different things are done, and where things are done in a different order.

You use the collider [1] and one of the many scaling attacks ([2] [3] [4], just the ones linked in this thread) to create an image that matches the hash of a reasonably fresh CSAM image currently circulating on the Internet, and resizes to some legal sexual or violent image. Note that knowing such a hash and having such an image are both perfectly legal. Moreover, since the resizing (the creation of the visual derivative) is done on the client, you can tailor your scaling attack to the specific resampling algorithm.

Eventually, someone will make a CyberTipline report about the actual CSAM image whose hash you used, and the image (being a genuine CSAM image) will make its way into the NCMEC hash database. You will even be able to tell precisely when this happens, since you have the client-side half of the PST database, and you can execute the NeuralHash algorithm.

You can start circulating the meme before or after this step. Repeat until you have circulated enough photos to make sure that many people in the targeted group have exceeded the threshold.

Note that the memes will trigger automated CSAM matches, and pass the Apple employee's visual inspection: due to the safety voucher system, Apple will not inspect the full-size images at all, and they will have no way of telling that the NeuralHash is a false positive.

[1]…

Yet ChatGPT totally - apparently - gets 1 + 1. In fact it aces the addition table way beyond what a child or even your average adult can handle. It's only when you get to numbers in the billions that it's weaknesses become apparent. One thing it starts messing up is carry-over operations, from what I can see. Btw. the treshold used to be significanly lower, yet that doesn't convince me in the least that it's made progress in its understanding of addition. It's still just as much in the fog. And it cannot introspect and tell me what it's doing so I can point out where it's going wrong.

But I think you are right in what you are saying. Basically it not 'seeing' math as a child does, is just another way to say that it doesn't undestand math. It doesn't have a intuitive understanding of numbers. It also can't really experiment. What would experimenting mean in this context? Just more training cycles. This being math, one could have it run random sums and give it the correct answer each time. That's one way to experiment, but that wouldn't solve the issue. At some point it would reach its capacity of absorbing statistical corelations to deal with numbers large enough. It would need more neurons to progress beyond that stage.

Btw. I found this relevant article: https://bdtechtalks.com/2022/06/27/large-language-models-logical-reasoning/

HiddenLayer's latest research uncovers a universal prompt injection bypass impacting GPT-4, Claude, Gemini, and more, exposing major LLM security gaps. (https://news.ycombinator.com/item?id=43793280)

1. Machine learning adversarial attacks are a ticking time bomb - TechTalks (https://bdtechtalks.com/2020/12/16/machine-learning-adversarial-attacks-against-machine-learning-time-bomb/)

2. How ChatGPT actually works (https://www.assemblyai.com/blog/how-chatgpt-actually-works/)

3. PrivacyRaven Has Left the Nest | Trail of Bits Blog (https://blog.trailofbits.com/2020/10/08/privacyraven-has-left-the-nest/)

4. Prompt injection: What's the worst that can happen? (https://simonwillison.net/2023/Apr/14/worst-that-can-happen/)

5. The big cybersecurity themes at Black Hat 2024 - and why they matter (https://www.reversinglabs.com/blog/the-big-cybersecurity-themes-at-black-hat-2024-and-why-they-matter)

It's entirely possible to alter an image such that its raw form looks different from its scaled form [0]. A government or just well resourced group can take a legitimate CSAM image and modify it such that when scaled for use in the perceptual algorithm(s) it changes to be some politically sensitive image. Upon review it'll look like CSAM so off it goes to reporting agencies.

Because the perceptual hash algorithms are presented as black boxes the image they perceive isn't audited or reviewed. There's zero recognition of this weakness by Apple or NCMEC (and their equivalents). For the system to even begin to be trustworthy all content would need to be reviewed raw and scaled-as-fed-into-the-algorithm.

[0] https://bdtechtalks.com/2020/08/03/machine-learning-adversarial-image-scaling/

Get used to it. The infrastructure involved is just too expensive to run at home.

The same applies to quantum computers. Models like GPT-3 are way too big for a consumer machine to handle and require something like a DXG-station [0][1] with 4x 80 GiB A100 GPUs to run properly.

So even if the model were available for download, you wouldn't be able to even run it without hardware costing north of $125,000.

It's less about restricting knowledge and more about the insane amount of resources required. It's not as bad as getting access to FMRI or particle accelerators, but it's getting there ;)

[0] https://bdtechtalks.com/2020/09/21/gpt-3-economy-business-model/

[1] https://www.nvidia.com/content/dam/en-zz/Solutions/Data-Center/dgx-station/nvidia-dgx-station-a100-datasheet.pdf

Right. I’m naive in assigning more capability to these models than they posess.

I found a quote from Geoff Hinton where he talked about this last year.

From [1]: “I can take an image and a tiny bit of noise and CNNs will recognize it as something completely different and I can hardly see that it’s changed. That seems really bizarre and I take that as evidence that CNNs are actually using very different information from us to recognize images,” Hinton said in his keynote speech at the AAAI Conference.

“It’s not that it’s wrong, they’re just doing it in a very different way, and their very different way has some differences in how it generalizes,” Hinton says.

[1] https://bdtechtalks.com/2020/03/02/geoffrey-hinton-convnets-cnn-limits/