# Exploiting and Defending Against the Approximate Linearity of Apple's NeuralHash

arXiv: https://arxiv.org/abs/2207.14258 · HTML: https://mlsanity.com/paper/2207.14258/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 18 references that are in the map.
- First posted on arXiv 28 Jul 2022.

## Builds on (most cited first, 5 of 5)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications](https://mlsanity.com/paper/1704.04861/) (2017)
- [Adversarial Examples Are Not Bugs, They Are Features](https://mlsanity.com/paper/1905.02175/) (2019)
- [Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash](https://mlsanity.com/paper/2111.06628/) (2021)
- [Bugs in our Pockets: The Risks of Client-Side Scanning](https://mlsanity.com/paper/2110.07450/) (2021)

## Built on by (most cited first, 1 of 1)

- [Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attacks](https://mlsanity.com/paper/2406.00918/) (2024)

## Abstract (arXiv)

Perceptual hashes map images with identical semantic content to the same n-bit hash value, while mapping semantically-different images to different hashes. These algorithms carry important applications in cybersecurity such as copyright infringement detection, content fingerprinting, and surveillance. Apple's NeuralHash is one such system that aims to detect the presence of illegal content on users' devices without compromising consumer privacy. We make the surprising discovery that NeuralHash is approximately linear, which inspires the development of novel black-box attacks that can (i) evade detection of "illegal" images, (ii) generate near-collisions, and (iii) leak information about hashed images, all without access to model parameters. These vulnerabilities pose serious threats to NeuralHash's security goals; to address them, we propose a simple fix using classical cryptographic standards.