Does this algorithm work for the reverse goal (i.e. can content that would trip the CSAM hash be perturbed enough to avoid it without compromising quality of the underlying image)?
To my mind, that's far more disquieting than the risk of someone staging and elaborate attack on an enemy's device.
Why is this downvoted? This checks out -- A problem with local scanning is that the source code will always be available and thus the user can learn exactly which perturbations trick the system.
To my mind, that's far more disquieting than the risk of someone staging and elaborate attack on an enemy's device.