{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/learning-to-break-deep-perceptual-hashing-the","title":"Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash","arxiv_id":"2111.06628","date":"2021-11-12","proceeding":null,"authors":["Lukas Struppek","Dominik Hintersdorf","Daniel Neider","Kristian Kersting"],"abstract":"Apple recently revealed its deep perceptual hashing system NeuralHash to detect child sexual abuse material (CSAM) on user devices before files are uploaded to its iCloud service. Public criticism quickly arose regarding the protection of user privacy and the system's reliability. In this paper, we present the first comprehensive empirical analysis of deep perceptual hashing based on NeuralHash. Specifically, we show that current deep perceptual hashing may not be robust. An adversary can manipulate the hash values by applying slight changes in images, either induced by gradient-based approaches or simply by performing standard image transformations, forcing or preventing hash collisions. Such attacks permit malicious actors easily to exploit the detection system: from hiding abusive material to framing innocent users, everything is possible. Moreover, using the hash values, inferences can still be made about the data stored on user devices. In our view, based on our results, deep perceptual hashing in its current form is generally not ready for robust client-side scanning and should not be used from a privacy perspective.","url_abs":"https://arxiv.org/abs/2111.06628v5","url_pdf":"https://arxiv.org/pdf/2111.06628v5.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"learning-to-break-deep-perceptual-hashing-the","repo_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[{"method_slug":null,"method_name":null}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2111.06628","atlas_url":"https://app.syntology.ai/?focus=2111.06628","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2111.06628"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":7,"ran_violates":1,"unverified":3},"by_repo_kind":{"official":{"samples":11,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"e1eaa826568138bd","entry":"balance_classes","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"adv4_information_extraction.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/adv4_information_extraction.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e1eaa826568138bd"}},{"code_sha256_prefix":"bcc42256373b217f","entry":"get_transforms","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"adv3_robustness_check.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/adv3_robustness_check.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"bcc42256373b217f"}},{"code_sha256_prefix":"08fc0e1afccc13f5","entry":"get_translation_tuples","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"adv3_robustness_check.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/adv3_robustness_check.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"08fc0e1afccc13f5"}},{"code_sha256_prefix":"a4e251357a69a2a6","entry":"hinge_loss","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"losses/hinge_loss.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/losses/hinge_loss.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a4e251357a69a2a6"}},{"code_sha256_prefix":"752453953f3f810e","entry":"load_hash_matrix","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"utils/hashing.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/utils/hashing.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"752453953f3f810e"}},{"code_sha256_prefix":"74e2bf38733ce1eb","entry":"mse_loss","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"losses/mse_loss.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/losses/mse_loss.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"74e2bf38733ce1eb"}},{"code_sha256_prefix":"f3bc4f33a06ea41f","entry":"ssim_loss","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"losses/quality_losses.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/losses/quality_losses.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f3bc4f33a06ea41f"}},{"code_sha256_prefix":"7c508037b40522af","entry":"str2bool","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"adv4_information_extraction.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/adv4_information_extraction.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7c508037b40522af"}},{"code_sha256_prefix":"7686cd6d1115d544","entry":"compute_hash","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"utils/hashing.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/utils/hashing.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7686cd6d1115d544"}},{"code_sha256_prefix":"02b8a2e5f0aa5da2","entry":"get_dataset","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"adv3_robustness_check.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/adv3_robustness_check.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"02b8a2e5f0aa5da2"}},{"code_sha256_prefix":"4a923d4924e00574","entry":"get_hashes_of_dataset","repo":"ml-research/Learning-to-Break-Deep-Perceptual-Hashing","repo_kind":"official","path":"utils/hashing.py","file_url":"https://github.com/ml-research/Learning-to-Break-Deep-Perceptual-Hashing/blob/HEAD/utils/hashing.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4a923d4924e00574"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}