CSAM in the database is confidential, so the human reviewer just needs to be plausibly confident that they have CSAM in front of them. However, it’s not clear to me that you can pull off all three simultaneously. Furthermore, the attack doesn’t specify how they would adversarially generate an image derivative for a secret perceptual hash that they can’t run gradient descent on.

If someone wanted to plant CSAM and had control of an iCloud account, it seems far easier to send some emails with those images since iCloud Mail is actively scanned and nobody checks their iCloud Mail account, especially not the sent folder.

CSAM in the database is confidential.

The question is whether the visual derivatives are checked against derivatives from the database or just against abstract criteria. That seems to be an unknown.

> However, it’s not clear to me that you can pull off all three simultaneously

Agreed. People here seem to keep assuming that you can, but so far nobody has demonstrated that it is possible.