# Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash

arXiv: https://arxiv.org/abs/2111.06628 · HTML: https://mlsanity.com/paper/2111.06628/

## Key facts

- Cited by 25 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 67 references that are in the map.
- First posted on arXiv 12 Nov 2021.

## Builds on (most cited first, 24 of 24)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [ImageNet Large Scale Visual Recognition Challenge](https://mlsanity.com/paper/1409.0575/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Analyzing and Improving the Image Quality of StyleGAN](https://mlsanity.com/paper/1912.04958/) (2019)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Searching for MobileNetV3](https://mlsanity.com/paper/1905.02244/) (2019)
- [Training Generative Adversarial Networks with Limited Data](https://mlsanity.com/paper/2006.06676/) (2020)
- [StarGAN v2: Diverse Image Synthesis for Multiple Domains](https://mlsanity.com/paper/1912.01865/) (2019)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [One pixel attack for fooling deep neural networks](https://mlsanity.com/paper/1710.08864/) (2017)
- [Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack](https://mlsanity.com/paper/1907.02044/) (2019)
- [GreedyFool: Distortion-Aware Sparse Adversarial Attack](https://mlsanity.com/paper/2010.13773/) (2020)
- [Targeted Attack for Deep Hashing based Retrieval](https://mlsanity.com/paper/2004.07955/) (2020)
- [Deep Semantic Ranking Based Hashing for Multi-Label Image Retrieval](https://mlsanity.com/paper/1501.06272/) (2015)
- [Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm](https://mlsanity.com/paper/2106.06027/) (2021)
- [Prototype-supervised Adversarial Network for Targeted Attack of Deep Hashing](https://mlsanity.com/paper/2105.07553/) (2021)
- [Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning](https://mlsanity.com/paper/2106.09820/) (2021)
- [Bugs in our Pockets: The Risks of Client-Side Scanning](https://mlsanity.com/paper/2110.07450/) (2021)
- [Adversarial collision attacks on image hashing functions](https://mlsanity.com/paper/2011.09473/) (2020)

## Built on by (most cited first, 25 of 25)

- [Poisoning Web-Scale Training Datasets is Practical](https://mlsanity.com/paper/2302.10149/) (2023)
- [Exploiting Cultural Biases via Homoglyphs in Text-to-Image Synthesis](https://mlsanity.com/paper/2209.08891/) (2022)
- [Does CLIP Know My Face?](https://mlsanity.com/paper/2209.07341/) (2022)
- [Be Careful What You Smooth For: Label Smoothing Can Be a Privacy Shield but Also a Catalyst for Model Inversion Attacks](https://mlsanity.com/paper/2310.06549/) (2023)
- [On the Difficulty of Constructing a Robust and Publicly-Detectable Watermark](https://mlsanity.com/paper/2502.04901/) (2025)
- [Balancing Transparency and Risk: The Security and Privacy Risks of Open-Source Machine Learning Models](https://mlsanity.com/paper/2308.09490/) (2023)
- [Exploring the Adversarial Capabilities of Large Language Models](https://mlsanity.com/paper/2402.09132/) (2024)
- [Minimizing Risk Through Minimizing Model-Data Interaction: A Protocol For Relying on Proxy Tasks When Designing Child Sexual Abuse Imagery Detection Models](https://mlsanity.com/paper/2505.06621/) (2025)
- [ARIA: Adversarially Robust Image Attribution for Content Provenance](https://mlsanity.com/paper/2202.12860/) (2022)
- [Needle In A Haystack, Fast: Benchmarking Image Perceptual Similarity Metrics At Scale](https://mlsanity.com/paper/2206.00282/) (2022)
- [Exploiting and Defending Against the Approximate Linearity of Apple's NeuralHash](https://mlsanity.com/paper/2207.14258/) (2022)
- [Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attacks](https://mlsanity.com/paper/2406.00918/) (2024)
- [Provenance Detection for AI-Generated Images: Combining Perceptual Hashing, Homomorphic Encryption, and AI Detection Models](https://mlsanity.com/paper/2503.11195/) (2025)
- [QualitEye: Public and Privacy-preserving Gaze Data Quality Verification](https://mlsanity.com/paper/2506.05908/) (2025)
- [MetaSeal: Defending Against Image Attribution Forgery Through Content-Dependent Cryptographic Watermarks](https://mlsanity.com/paper/2509.10766/) (2025)
- [Combining AI and AM - Improving Approximate Matching through Transformer Networks](https://mlsanity.com/paper/2208.11367/) (2022)
- [Re-purposing Perceptual Hashing based Client Side Scanning for Physical Surveillance](https://mlsanity.com/paper/2212.04107/) (2022)
- [On the Robustness of Malware Detectors to Adversarial Samples](https://mlsanity.com/paper/2408.02310/) (2024)
- [Fractal Signatures: Securing AI-Generated Pollock-Style Art via Intrinsic Watermarking and Blockchain](https://mlsanity.com/paper/2410.20519/) (2024)
- [Clean Image May be Dangerous: Data Poisoning Attacks Against Deep Hashing](https://mlsanity.com/paper/2503.21236/) (2025)
- [Property-Preserving Hashing for ℓ1-Distance Predicates: Applications to Countering Adversarial Input Attacks](https://mlsanity.com/paper/2504.16355/) (2025)
- [Model Inversion meets Cryptographic Fuzzy Extractors](https://mlsanity.com/paper/2510.25687/) (2025)
- [DeepSignature: Digitally Signed, Content-Encoding Watermarks for Robust and Transparent Image Authentication](https://mlsanity.com/paper/2604.23016/) (2026)
- [Classifying by Proxy: Explainable and Reproducible Ensemble of Proxy Tasks for Child Sexual Abuse Imagery Classification](https://mlsanity.com/paper/2606.15993/) (2026)
- [Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retraining](https://mlsanity.com/paper/2608.03101/) (2026)

## Abstract (arXiv)

Apple recently revealed its deep perceptual hashing system NeuralHash to detect child sexual abuse material (CSAM) on user devices before files are uploaded to its iCloud service. Public criticism quickly arose regarding the protection of user privacy and the system's reliability. In this paper, we present the first comprehensive empirical analysis of deep perceptual hashing based on NeuralHash. Specifically, we show that current deep perceptual hashing may not be robust. An adversary can manipulate the hash values by applying slight changes in images, either induced by gradient-based approaches or simply by performing standard image transformations, forcing or preventing hash collisions. Such attacks permit malicious actors easily to exploit the detection system: from hiding abusive material to framing innocent users, everything is possible. Moreover, using the hash values, inferences can still be made about the data stored on user devices. In our view, based on our results, deep perceptual hashing in its current form is generally not ready for robust client-side scanning and should not be used from a privacy perspective.