The most basic version could work like this on a CPU level:
The supervisor program could run off a non maskable interrupt:
- Am I running macOS? If not, continue
- Setup a non maskable periodical memory scanning interrupt
Mind you that the entire hardware stack is controlled by Apple, so they can embed the ML model on the integrated SSD and the running operating system wouldn't be able to modify it without special privileges.
- Scanning interrupt triggers
- Is there any idle core available? If yes, continue
- Scan the memory, en-queue pointers to any detected JPEG signature or copy it to a location
- Load the ML model from a known location if it is not already loaded
- Use integrated Neural Engine to perform neural hash analysis.
- If any hash match found, store it in a buffer
- Is there any hash in a buffer? If not, return
- Is there enough hashes to meet the threshold? If yes, continue
Here given that again Apple has control over entire hardware stack, they can easily initiate a network connection and send the hashes for review. This will only be few bytes or kB.
The entire process can run separately from the running operating system and be extremely difficult to detect and AI is hardware accelerated so user wouldn't notice any slow down.
There are reports that this NeuralHash Apple has already hidden in iOS 14.