# Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retraining

arXiv: https://arxiv.org/abs/2608.03101 · HTML: https://mlsanity.com/paper/2608.03101/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 31 references that are in the map.
- First posted on arXiv 4 Aug 2026.

## Builds on (most cited first, 9 of 9)

- [Microsoft COCO: Common Objects in Context](https://mlsanity.com/paper/1405.0312/) (2014)
- [Certified Adversarial Robustness via Randomized Smoothing](https://mlsanity.com/paper/1902.02918/) (2019)
- [A Self-Supervised Descriptor for Image Copy Detection](https://mlsanity.com/paper/2202.10261/) (2022)
- [Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash](https://mlsanity.com/paper/2111.06628/) (2021)
- [Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning](https://mlsanity.com/paper/2106.09820/) (2021)
- [PDQ & TMK + PDQF -- A Test Drive of Facebook's Perceptual Hashing Algorithms](https://mlsanity.com/paper/1912.07745/) (2019)
- [ViT2Hash: Unsupervised Information-Preserving Hashing](https://mlsanity.com/paper/2201.05541/) (2022)
- [Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attacks](https://mlsanity.com/paper/2406.00918/) (2024)
- [Provenance Detection for AI-Generated Images: Combining Perceptual Hashing, Homomorphic Encryption, and AI Detection Models](https://mlsanity.com/paper/2503.11195/) (2025)

## Abstract (arXiv)

Near-duplicate image matching is crucial for trust and safety, provenance verification, copyright enforcement, and large-scale visual search. Modern platforms increasingly rely on deep perceptual hashes, which map visually similar images to nearby representations despite common image transformations. However, adversarial perturbations can cause near-duplicates to evade matching. We present DualShield, a plug-in defense that improves the robustness of existing deep perceptual hashes without retraining or modifying their underlying models. DualShield combines matching-time randomized smoothing, which aggregates decisions over perturbed reference-query pairs, with publication-time hardening, which adds an optimized imperceptible perturbation to each reference image before publication. Together, these mechanisms provide certified and empirical robustness. DualShield achieves a certified ℓ2 radius of approximately 0.3, guaranteeing that query perturbations within this radius cannot evade matching. We further evaluate it against adaptive white-box, black-box, and image-transformation attacks. Across eight deep perceptual hashes and three datasets, DualShield substantially reduces attack success rates while preserving low collision rates. These results show that deep perceptual hashes can be strengthened without costly retraining by improving the matching procedure and hardening reference images before publication.