Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attacks

TL;DR

This paper evaluates the security of popular perceptual hashing algorithms against adversarial attacks, finding they are more robust than previously thought due to inherent variability, and proposes a method to further improve their security.

Contribution

The study provides a comprehensive security assessment of three widely used PHAs and introduces a novel defense mechanism involving hash perturbations.

Findings

PHAs show significant robustness against hash-evasion and hash-inversion attacks.

Inherent randomness in PHAs contributes to their robustness.

Proposed perturbation-based defense enhances PHA security.

Abstract

Perceptual hashing algorithms (PHAs) are widely used for identifying illegal online content and are thus integral to various sensitive applications. However, due to their hasty deployment in real-world scenarios, their adversarial security has not been thoroughly evaluated. This paper assesses the security of three widely utilized PHAs - PhotoDNA, PDQ, and NeuralHash - against hash-evasion and hash-inversion attacks. Contrary to existing literature, our findings indicate that these PHAs demonstrate significant robustness against such attacks. We provide an explanation for these differing results, highlighting that the inherent robustness is partially due to the random hash variations characteristic of PHAs. Additionally, we propose a defense method that enhances security by intentionally introducing perturbations into the hashes.