[ec109685]

Not resembles. The adversarial image has to match a private perceptual hash function of the same CSAM image that the NeuralHash function matched before a human reviewer ever looks at it.

[onepunchedman]

Do you have any material on this private function?

[ec109685]

Not beyond the documents Apple has shared. Presumably it will be kept that way given it prevents an adversarial attack against it.