I noticed a bit of panic around here lately and as I have had to continuously fight against pedos for the past year, I have developed tools to help me detect and prevent this content.
As luck would have it, we recently published one of our anti-csam checker tool as a python library that anyone can use. So I thought I could use this to help lemmy admins feel a bit more safe.
The tool can either go through all your images via your object storage and delete all CSAM, or it canrun continuously and scan and delete all new images as well. Suggested option is to run it using --all once, and then run it as a daemon and leave it running.
Better options would be to be able to retrieve exact images uploaded via lemmy/pict-rs api but we’re not there quite yet.
Let me know if you have any issue or improvements.
EDIT: Just to clarify, you should run this on your desktop PC with a GPU, not on your lemmy server!
This is extremely cool.
Because of the federated nature of Lemmy many instances might be scanning the same images. I wonder if there might be some way to pool resources that if one instance has already scanned an image some hash of it can be used to identify it and the whole AI model doesn’t need to be rerun.
Still the issue of how do you trust the cache but maybe there’s some way for a trusted entity to maintain this list?
How about a federated system for sharing “known safe” image attestations? That way, the trust list is something managed locally by each participating instance.
Edit: thinking about it some more, a federated image classification system would allow some instances to be more strict than others.
I think building such a system of some kind that can allow smaller instances to rely from help from larger instances would be extremely awesome.
Like, lemmy has the potential to lead the fediverse is safety tools if we put the work in.
Consensus algorithms. But it means there will always be duplicate work.
No way around that unfortunately
Why? Use something like RAFT, elect the leader, have the leader run the AI tool, then exchange results, with each node running it’s own subset of image hashes.
That does mean you need a trust system, though.
As I’m saying, I don’t think you need to: manually subscribing to each trusted instance via ActivityPub should suffice. The pass/fail determination can be done when querying for known images.
Yeah that works. Who is the leader and how does it change? Does Lemmy.World take over because it’s largest?
Hash the image, then assign hash ranges to servers that are part of the ring. You’d use RAFT to get consensus about who is responsible for which ranges. I’m largely just envisioning the Scylla gossip replacement as the underlying communications protocol.
TBH, I wouldn’t be comfortable outsourcing the scanning like that if I were running an instance. It only takes a bit of resources to know that you have done your due diligence. Hopefully this can get optimized to get time to be faster.
Don’t have a GPU on my server. How is performance on the CPU ?
It will be atrocious. You can run it, but you’ll likely be waiting for weeks if not months.
the model under the hood is clip interrogator, and it looks like it is just the torch model.
it will run on cpu, but we can do better, an onnx version of the model will run a lot better on cpu.
sure, or a .cpp. But it will still not be anywhere near as good as a GPU. However it might be sufficient for something just checking new images
I’m not really convinced that a GPU backend is needed. Was there ever a comparison of the different CLIP model variants? Or a graph optimized / quantized ONNX version?
I think the proposed solution makes a lot of sense for the task at hand if it were integrated on the pic-rs end, but it would be worth investigating further improvements if it were on the lemmy server end.
I don’t host a server myself, but can this tool identify the users who posted the images and create a report with their IP addresses?
This could help identify who spreads that content and it can be used to notify authorities. No?
No but it will record the object storage We then need a way to connect that path to the pict-rs image ID, and once we do that, connect the pict-rs image ID to the comment or post which uploaded it. I don’t know how to do the last two steps however, so hopefully someone else will step up for this
Thank you for helping make the fediverse a better place.
Hi db0, if I could make an additional suggestion.
Add detection of additional content appended or attached to media files. Pict-rs does not reprocess all media types on upload and it’s not hard to attach an entire .zip file or other media within an image (https://wiki.linuxquestions.org/wiki/Embed_a_zip_file_into_an_image)
Currently I delete on PIL exceptions. I assume if someone uploaded a .zip to your image storage, you’d want it deleted
The fun part is that it’s still a valid JPEG file if you put more data in it. The file should be fully re-encoded to be sure.
In that case, PIL should be able to read it, so no worries
But I could take ‘flower.jpg’, which is an actual flower, and embed a second image, ‘csam.png’ inside it. Your scanner would scan ‘flower.jpg’, find it to be acceptable, then in turn register ‘csam.png’. Not saying that this isn’t a great start, but this is the reason that a lot of websites that allow uploads re-encode images.
As @Starbuck@lemmy.world stated. They’re still valid image files, they just have extra data.
Opened a relevant issue: https://github.com/LemmyNet/lemmy/issues/3920
Thank you for this! Awesome work!
By the way, this looks easy to put in a container. Have you considered doing that?
I don’t speak docker, but anyone can send a PR
I’ll try it out today. I’m about to start my workday, so it will have to be in a few hours. Fingers crossed I can have a PR in about 16 hours from now.
This is awesome. Thank you for making it.
Any thoughts about using this as a middleware between nginx and Lemmy for all image uploads?
Edit: I guess that wouldn’t work for external images - unless it also ran for all outgoing requests from pict-rs… I think the easiest way to integrate this with pict-rs would be through some upstream changes that would allow pict-rs itself to call this code on every image.
Exactly. If the pict-rs dev allowed us to run an executable on each image before accepting it, it would make things much easier
You might be able however integrate with my AI Horde endpoint for NSFW checking between nginx and Lemmy.
https://aihorde.net/api/v2/interrogate/asyncThis might allow you to detect NSFW images before they are hosted
Just send a payload like this
curl -X 'POST' \ 'https://aihorde.net/api/v2/interrogate/async' \ -H 'accept: application/json' \ -H 'apikey: 0000000000' \ -H 'Client-Agent: unknown:0:unknown' \ -H 'Content-Type: application/json' \ -d '{ "forms": [ { "name": "nsfw" } ], "source_image": "https://lemmy.dbzer0.com/pictrs/image/46c177f0-a7f8-43a3-a67b-7d2e4d696ced.jpeg?format=webp&thumbnail=256" }'Then retrieve the results asynchronously like this
{ "state": "done", "forms": [ { "form": "nsfw", "state": "done", "result": { "nsfw": false } } ] }or you could just run the nsfw model locally if you don’t have so many uploads.
if you know a way to pre-process uploads before nginx sends them to lemmy, it might be useful
Thanks for releasing this. After doing a
--dry_runcan the flagged files then be removed without re-analysing all images?Not currently supported. It’s on my to-do
Can this be used with Mastodon as well?
If it’s using object storage, yes
Amazing work.
Hey @db0@lemmy.dbzer0.com, just so you know, this tool is most likely very illegal to use in the USA. Something that your users should be aware of. I don’t really have the energy to go into it now, but I’ll post what I told my users in the programming.dev discord:
that is almost definitely against the law in the USA. From what I’ve read, you have to follow very specific procedures to report CSAM as well as retain the evidence (yes, you actually have to keep the pictures), until the NCMEC tells you you should destroy the data. I’ve begun the process to sign up programming.dev (yes you actually have to register with the government as an ICS/ESP) and receive a login for reports.
If you operate a website, and knowingly destroy the evidence without reporting it, you can be jailed. It’s quite strange, and it’s quite a burden on websites. Funnily enough, if you completely ignore your website, so much so that you don’t know that you’re hosting CSAM then you are completely protected and have no obligation to report (in the USA at least)
Also, that script is likely to get you even more into trouble because you are knowingly transmitting CSAM to ‘other systems’, like dbzer0’s aihorde cluster. that’s pretty dang bad…
here are some sources:
- https://www.law.cornell.edu/uscode/text/18/2258A
- https://crsreports.congress.gov/product/pdf/LSB/LSB10713
- https://www.missingkids.org/theissues/csam
- https://www.cloudflare.com/service-specific-terms-application-services/#csam-scanning-tool-terms
- https://developers.cloudflare.com/cache/reference/csam-scanning/#what-happens-when-a-match-is-detected
- https://developers.cloudflare.com/cache/reference/csam-scanning/#what-action-should-i-take-when-a-match-is-detected
Note that the script I posted is not transmitting the images to the AI Horde.
Also keep in mind this tool is fully automated and catches a lot of false positives (due to the nature of the scan, it couldn’t be otherwise). So one could argue it’s a generic filtering operation, not an explicit knowledge of CSAM hosting. But IANAL of course.
This is unlike cloudflare or other services which compare with known CSAM.
EDIT: That is to mean, if you use this tool to forward these images to the govt, they are going to come after you for spamming them with garbage
