Looking through all of that...my guess was off. Where I was incorrect was in thinking that the comparison would be made at the server. Instead the documentation says that it is the client software which compares the hashes.
Of course Apple installs and controls this software, so they'd be able to (obviously) change this without notice. They can also do updates, completely changing how the system functions. The way it works seems to me as follows:
According to the protocol, each image is not directly uploaded to the server (i-cloud) but is first encrypted at the client (user) end with a hash function using their neuralhash algorithm which creates a similar hash for similar images. So two pictures of the same swan with different sizes and encodings should result in the same or similar neuralhash. The server never sees the image nor has the ability to easily decrypt user images. Only the client (user) can decrypt them. The client also handles the scanning of the hashes, comparing them to hashes of illegal images, then reports an approximate number, a total. In the technical documents it uses the phrase 'Cardinality of the intersection'. It is purposely approximate. A user with only 1 illegal image will likely not be noticed. This is necessary for some technical reasons that have to do with stopping malicious servers and malicious clients.
If I follow this correctly the client scans the neural hash and compares it to hashes sent from the server. These are hashes of (but not originals of) illegal images. The client never gets any illegal images from the server, and the server never gets to see the client images only their hashes. Then on a weekly basis the server reports anyone who has enough illegal images to reach a certain threshold number for reporting, however there is a small amount of uncertainty about how many images. This uncertainty is created at the client end purposely by the addition of synthetic positives.
