mlsanityData to 14 Oct 2026

Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash

arXiv 2111.06628 ↗First posted 12 Nov 2021cs.LG cs.CR cs.CVcited by 25

Not on the map. Why?

Abstract (arXiv)

Apple recently revealed its deep perceptual hashing system NeuralHash to detect child sexual abuse material (CSAM) on user devices before files are uploaded to its iCloud service. Public criticism quickly arose regarding the protection of user privacy and the system's reliability. In this paper, we present the first comprehensive empirical analysis of deep perceptual hashing based on NeuralHash. Specifically, we show that current deep perceptual hashing may not be robust. An adversary can manipulate the hash values by applying slight changes in images, either induced by gradient-based approaches or simply by performing standard image transformations, forcing or preventing hash collisions. Such attacks permit malicious actors easily to exploit the detection system: from hiding abusive material to framing innocent users, everything is possible. Moreover, using the hash values, inferences can still be made about the data stored on user devices. In our view, based on our results, deep perceptual hashing in its current form is generally not ready for robust client-side scanning and should not be used from a privacy perspective.

Key facts. Cited by 25 papers in the map (data through 14 Oct 2026). Builds on 24 of its 67 references that are in the map. First posted on arXiv 12 Nov 2021.

Builds on

24 of 67 references.

References · 24

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  7. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 6,013
  8. 2013Intriguing properties of neural networkscited by 5,155
  9. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,588
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  11. 2019Searching for MobileNetV3cited by 1,994
  12. 2020Training Generative Adversarial Networks with Limited Datacited by 1,186
12 more
  1. 2019StarGAN v2: Diverse Image Synthesis for Multiple Domainscited by 1,098
  2. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  3. 2017One pixel attack for fooling deep neural networkscited by 582
  4. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  5. 2020GreedyFool: Distortion-Aware Sparse Adversarial Attackcited by 37
  6. 2020Targeted Attack for Deep Hashing based Retrievalcited by 35
  7. 2015Deep Semantic Ranking Based Hashing for Multi-Label Image Retrievalcited by 24
  8. 2021Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithmcited by 15
  9. 2021Prototype-supervised Adversarial Network for Targeted Attack of Deep Hashingcited by 8
  10. 2021Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanningcited by 7
  11. 2021Bugs in our Pockets: The Risks of Client-Side Scanningcited by 6
  12. 2020Adversarial collision attacks on image hashing functionscited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 7; 2023: 3; 2024: 4; 2025: 8; 2026: 3.

25 papers.

Sort:

By area:

  1. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  2. 2022Exploiting Cultural Biases via Homoglyphs in Text-to-Image Synthesiscited by 29
  3. 2022Does CLIP Know My Face?cited by 19
  4. 2023Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attackscited by 13
  5. 2025On the Difficulty of Constructing a Robust and Publicly-Detectable Watermarkcited by 9
  6. 2023Balancing Transparency and Risk: The Security and Privacy Risks of Open-Source Machine Learning Modelscited by 5
  7. 2024Exploring the Adversarial Capabilities of Large Language Modelscited by 4
  8. 2025Minimizing Risk Through Minimizing Model-Data Interaction: A Protocol For Relying on Proxy Tasks When Designing Child Sexual Abuse Imagery Detection Modelscited by 4
  9. 2022ARIA: Adversarially Robust Image Attribution for Content Provenancecited by 1
  10. 2022Needle In A Haystack, Fast: Benchmarking Image Perceptual Similarity Metrics At Scalecited by 1
  11. 2022Exploiting and Defending Against the Approximate Linearity of Apple's NeuralHashcited by 1
  12. 2024Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attackscited by 1
13 more
  1. 2025Provenance Detection for AI-Generated Images: Combining Perceptual Hashing, Homomorphic Encryption, and AI Detection Modelscited by 1
  2. 2025QualitEye: Public and Privacy-preserving Gaze Data Quality Verificationcited by 1
  3. 2025MetaSeal: Defending Against Image Attribution Forgery Through Content-Dependent Cryptographic Watermarkscited by 1
  4. 2022Combining AI and AM - Improving Approximate Matching through Transformer Networkscited by 0
  5. 2022Re-purposing Perceptual Hashing based Client Side Scanning for Physical Surveillancecited by 0
  6. 2024On the Robustness of Malware Detectors to Adversarial Samplescited by 0
  7. 2024Fractal Signatures: Securing AI-Generated Pollock-Style Art via Intrinsic Watermarking and Blockchaincited by 0
  8. 2025Clean Image May be Dangerous: Data Poisoning Attacks Against Deep Hashingcited by 0
  9. 2025Property-Preserving Hashing for ℓ1-Distance Predicates: Applications to Countering Adversarial Input Attackscited by 0
  10. 2025Model Inversion meets Cryptographic Fuzzy Extractorscited by 0
  11. 2026DeepSignature: Digitally Signed, Content-Encoding Watermarks for Robust and Transparent Image Authenticationcited by 0
  12. 2026Classifying by Proxy: Explainable and Reproducible Ensemble of Proxy Tasks for Child Sexual Abuse Imagery Classificationcited by 0
  13. 2026Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retrainingcited by 0