# Adversarial collision attacks on image hashing functions

arXiv: https://arxiv.org/abs/2011.09473 · HTML: https://mlsanity.com/paper/2011.09473/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Nov 2020.

## Built on by (most cited first, 5 of 5)

- [Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash](https://mlsanity.com/paper/2111.06628/) (2021)
- [Active Image Indexing](https://mlsanity.com/paper/2210.10620/) (2022)
- [Do You See What I See? Capabilities and Limits of Automated Multimedia Content Analysis](https://mlsanity.com/paper/2201.11105/) (2021)
- [ARIA: Adversarially Robust Image Attribution for Content Provenance](https://mlsanity.com/paper/2202.12860/) (2022)
- [Re-purposing Perceptual Hashing based Client Side Scanning for Physical Surveillance](https://mlsanity.com/paper/2212.04107/) (2022)

## Abstract (arXiv)

Hashing images with a perceptual algorithm is a common approach to solving duplicate image detection problems. However, perceptual image hashing algorithms are differentiable, and are thus vulnerable to gradient-based adversarial attacks. We demonstrate that not only is it possible to modify an image to produce an unrelated hash, but an exact image hash collision between a source and target image can be produced via minuscule adversarial perturbations. In a white box setting, these collisions can be replicated across nearly every image pair and hash type (including both deep and non-learned hashes). Furthermore, by attacking points other than the output of a hashing function, an attacker can avoid having to know the details of a particular algorithm, resulting in collisions that transfer across different hash sizes or model architectures. Using these techniques, an adversary can poison the image lookup table of a duplicate image detection service, resulting in undefined or unwanted behavior. Finally, we offer several potential mitigations to gradient-based image hash attacks.