# Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attacks

arXiv: https://arxiv.org/abs/2406.00918 · HTML: https://mlsanity.com/paper/2406.00918/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 31 references that are in the map.
- First posted on arXiv 3 Jun 2024.

## Builds on (most cited first, 13 of 13)

- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Perceptual Losses for Real-Time Style Transfer and Super-Resolution](https://mlsanity.com/paper/1603.08155/) (2016)
- [Black-box Adversarial Attacks with Limited Queries and Information](https://mlsanity.com/paper/1804.08598/) (2018)
- [HopSkipJumpAttack: A Query-Efficient Decision-Based Attack](https://mlsanity.com/paper/1904.02144/) (2019)
- [Simple Black-box Adversarial Attacks](https://mlsanity.com/paper/1905.07121/) (2019)
- [Random Noise Defense Against Query-Based Black-Box Attacks](https://mlsanity.com/paper/2104.11470/) (2021)
- [Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash](https://mlsanity.com/paper/2111.06628/) (2021)
- [Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning](https://mlsanity.com/paper/2106.09820/) (2021)
- [Bugs in our Pockets: The Risks of Client-Side Scanning](https://mlsanity.com/paper/2110.07450/) (2021)
- [Hamming Distributions of Popular Perceptual Hashing Techniques](https://mlsanity.com/paper/2212.08035/) (2022)
- [Mitigating Black-Box Adversarial Attacks via Output Noise Perturbation](https://mlsanity.com/paper/2109.15160/) (2021)
- [Exploiting and Defending Against the Approximate Linearity of Apple's NeuralHash](https://mlsanity.com/paper/2207.14258/) (2022)
- [Information Forensics and Security: A quarter-century-long journey](https://mlsanity.com/paper/2309.12159/) (2023)

## Built on by (most cited first, 1 of 1)

- [Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retraining](https://mlsanity.com/paper/2608.03101/) (2026)

## Abstract (arXiv)

Perceptual hashing algorithms (PHAs) are widely used for identifying illegal online content and are thus integral to various sensitive applications. However, due to their hasty deployment in real-world scenarios, their adversarial security has not been thoroughly evaluated. This paper assesses the security of three widely utilized PHAs - PhotoDNA, PDQ, and NeuralHash - against hash-evasion and hash-inversion attacks. Contrary to existing literature, our findings indicate that these PHAs demonstrate significant robustness against such attacks. We provide an explanation for these differing results, highlighting that the inherent robustness is partially due to the random hash variations characteristic of PHAs. Additionally, we propose a defense method that enhances security by intentionally introducing perturbations into the hashes.