{"id":"17a6cf69-0b7a-470b-8406-931fb9b8c214","arxiv_id":"2412.06056","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A Pix2Pix GAN trained on 1000 celebrity photos can reconstruct recognizable faces from perceptual hash values of aHash, PDQ, NeuralHash, and PhotoDNA, including the first reported inversion attacks on PDQ and NeuralHash.","lead":"This paper shows that four perceptual hash functions, including the ones used by NCMEC's Take It Down service, can be partially reversed with a low-cost AI model, turning a hash back into a face-like image. The result matters because victims who report sensitive images upload only hashes under the promise they cannot be reconstructed, and a leaked hash could endanger them.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Quantitative evidence for privacy leakage is circular: Table 2's metric is hash-bit agreement with the very hash functions under attack, so it cannot establish that recognizable visual content is recovered; the practical claim that hashes should be treated like original images remains unquantified.","rationale":"The reader's weakest assumption identifies exactly the load-bearing weakness: the main quantitative metric is the attacked hash functions themselves, which cannot distinguish genuine visual recovery from hash-bit matching. I agree with that assessment. The paper is otherwise a plausible and useful contribution: it reproduces a known aHash attack, extends the methodology to PDQ, NeuralHash, and PhotoDNA, claims first inversion attacks on PDQ and NeuralHash, and is transparent about its limitations (low-budget training, only faces, no code release). The absence of independent metrics, baselines, and error bars means the strength of the central claim exceeds what the evidence supports, so a conditional verdict is appropriate. I do not recommend changing the reader's verdict: the qualitative examples and the prior literature make the vulnerability direction credible, but the paper should add an independent quantitative evaluation before the claim that hashes are as sensitive as original images is accepted at face value.","tokens_in":10323,"tokens_out":5004,"duration_ms":51090,"concrete_test":"Have the authors (or an independent party granted access to the shared models) evaluate the four trained generators on a held-out CelebA test set using visual metrics that do not involve the attacked hashes: LPIPS, SSIM, and ArcFace face-recognition cosine similarity between reconstruction and target. Compare these against a control condition that inverts hashes of the same length randomly sampled from the hash distribution, and against a dataset-mean-face baseline. If the attack's advantage over the random-hash control is small or not statistically significant, or if absolute LPIPS/ArcFace scores indicate unrecognizable outputs, then the privacy-leakage conclusion is unsupported and the paper should be revised to claim only that hash bits can be matched, not that original images can be approximated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that perceptual hash values should be treated almost as carefully as original images requires the inversion attack to actually leak visual content. The paper's only quantitative support is the perceptual similarity in Table 2, defined as 1 minus normalized Hamming distance between the hashes of target and reconstruction. Because the generator is conditioned on the attacked hash itself, high agreement on that same hash is not independent evidence of image recovery; the model can exploit structure in the conditioning code without reproducing the pre-image's visual content. The cross-hash rows in Table 2 illustrate the problem: when PDQ is used as the evaluation metric, mean similarities drop to roughly 54-61% across all attacked hashes, close to the 50% expected for random bit strings. If the reconstructions were visually faithful, independent perceptual hashes should agree much more strongly. The qualitative examples are suggestive, but no SSIM, LPIPS, face-embedding cosine, or human perceptual study is reported; the Limitations section explicitly defers such metrics to future work. The paper also evaluates only celebrity faces, so generalization to the non-face sensitive content that TID actually processes is asserted via related work rather than demonstrated. The practical threat to IBSA removal tools is therefore plausible but not yet quantitatively established by the paper's own evaluation.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies inversion attacks on perceptual hash functions used in image-based sexual abuse (IBSA) detection and removal tools. It trains Pix2Pix conditional GANs on (hash, image) pairs from a 1000-image CelebA subset and reconstructs approximations of original images from aHash, PDQ, NeuralHash, and PhotoDNA hashes, claiming the first known inversion attacks on PDQ and NeuralHash. The authors evaluate their reconstructions using a perceptual similarity metric defined as 1 minus the normalized Hamming distance between the hashes of the original and reconstructed images, report high mean and best-case similarities in Table 2, and provide qualitative examples in Figure 4. They conclude that perceptual hash values should be treated almost as carefully as original images and propose private set intersection as a secure alternative for hash matching in services like NCMEC's Take It Down.","tokens_in":10530,"tokens_out":7614,"duration_ms":76168,"significance":"If the central claim holds, this is a timely and societally important result: it demonstrates that perceptual hashes used by deployed IBSA tools can leak visual information, contradicting Take It Down's FAQ, and it extends known inversion attacks to PDQ and NeuralHash. The use of consumer-grade hardware and a small training set strengthens the practical relevance, and the responsible-disclosure discussion is thoughtful. The proposed PSI-based mitigation is a reasonable direction. However, the current quantitative evaluation is not independent of the attacked hash functions and lacks standard image-similarity metrics and baselines, so the strength of the privacy leakage is not yet rigorously established. The qualitative examples are suggestive and make the paper worth pursuing, but the central quantitative claim needs substantial additional support.","major_comments":[{"comment":"The quantitative evaluation defines perceptual similarity as 1 minus the normalized Hamming distance between the hashes of the target and reconstructed images, using the same hash functions the attack targets. Because the generator is conditioned on the attacked hash, high agreement on that same hash is not independent evidence of visual recovery; the model could learn to match hash bits without reproducing the pre-image's visual content. The cross-hash rows in Table 2 illustrate this concern: when PDQ is used as the evaluation metric, mean similarities for all attacked hashes are only 53-61%, close to the 50% expected for random bit strings. To support the paper's central claim that hashes should be treated like original images, the authors need to report standard visual-similarity metrics (e.g., SSIM, LPIPS, face-embedding cosine, or a human perceptual study) in addition to hash-based metrics. The Limitations section's deferral of such metrics to future work leaves the quantitative claim unsubstantiated.","section":"Results, Table 2 and Eq. (1)"},{"comment":"No baseline or control condition is reported for the quantitative results. The authors do not compare against reconstructions from random hash values, a constant/zero hash, or an unconditional generator. Because all training images are aligned celebrity faces, the model may produce generic face-like outputs that incidentally satisfy a substantial fraction of hash bits; without such a baseline, the reported similarities cannot be attributed to information extracted from the hash itself. I recommend adding a control condition and reporting per-condition distributions and test-set sizes.","section":"Results, Table 2"},{"comment":"The evaluation is limited to 256x256 celebrity face crops from CelebA, while the systems under discussion, including Take It Down, process arbitrary user images and videos of sensitive content, including non-face and underage subjects. The Limitations section acknowledges this and cites prior work on full-body generation, but that is not a substitute for a direct test on representative non-face content. As written, the Discussion's claim that the current approach to services such as TID is 'inherently insufficient' is stronger than the evidence supports. A small experiment on non-celebrity or non-face images, or a clearly argued reason why face-specific leakage suffices for the threat model, is needed.","section":"Limitations and Discussion"},{"comment":"The sentence claiming that 'since the space of all perceptual hash values is much smaller than the space of all images, each matching bit of the hash represents a matching feature of the image' is not a valid inference. Hash bits are not guaranteed to correspond to independent, perceptually meaningful visual features, and a conditional generator can align bits spuriously. This sentence is used to justify interpreting near-50% hash similarity as reconstructing 50% of image features; it should be removed or replaced with empirical evidence linking hash-bit agreement to visual similarity.","section":"Results"}],"minor_comments":[{"comment":"In the pipeline description, 'training and valuation' should be 'training and validation'.","section":"Perceptual Hash Inversion Attacks, Training and Evaluation Setup"},{"comment":"The symbol 'D' appears in the body of the table but is not defined in the caption or legend; please clarify what it denotes.","section":"Table 1"},{"comment":"The statement that 'all commonly used PHFs are vulnerable' overstates the evidence, which covers only the four functions studied here; the text should say 'all studied PHFs'.","section":"Secure Hash Matching via Private Set Intersection"},{"comment":"The y-axis label 'Number of test images in percent' is confusing; it should read 'Percentage of test images'.","section":"Figure 5"},{"comment":"The claim that generative AI 'performs equally well' on full-body shapes cites [14] (InsetGAN), which is a different task; please soften the wording to reflect what the cited work actually shows.","section":"Limitations"},{"comment":"The statement that NCMEC reports show an 'exponential increase' in reported images would benefit from a specific citation and the relevant time period.","section":"Introduction"}],"recommendation":"major_revision","confidential_remarks":"To the editor: This is a timely and socially important paper, and the qualitative results plus the novelty of the PDQ/NeuralHash inversion attacks merit publication after the evaluation is strengthened. The circularity of the main quantitative metric is the key obstacle; the authors should be asked to add independent similarity metrics, a baseline/control, and at least a small demonstration on non-celebrity content. The paper's own limitations section concedes many of these points, which is encouraging. I also note that the arXiv version identifies itself as a preprint of an IEEE Security & Privacy Magazine article; if the journal submission is identical, the technical depth is appropriate for a magazine piece but thin for a full research venue. The decision not to release code or models is understandable given the sensitivity, but reviewers should be offered access under confidentiality."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a worthwhile empirical paper that does one genuinely new thing—showing that PDQ and NeuralHash, two hashes used in real CSAM/IBSA detection, can be partially inverted with a Pix2Pix GAN on consumer hardware. It also reproduces prior aHash/PhotoDNA inversions and validates the attack against the actual Take It Down service, which is a nice touch. The qualitative reconstructions are recognizable as faces, and the authors are honest about scope: they trained on 1000 CelebA images only and explicitly defer better metrics to future work.\n\nThe soft spot is exactly where the stress-test note lands. The only quantitative support for 'hash values should be treated almost as carefully as original images' is Table 2, which measures perceptual similarity as 1 minus normalized Hamming distance using the same family of hash functions under attack. That is circular in a real sense: a model that reproduces hash bits without visual fidelity scores high. The cross-hash rows are telling—when PDQ is the evaluation metric, mean similarity drops to around 54–61% for every attacked hash, barely above random for a 256-bit hash. No SSIM, LPIPS, or face-embedding cosine is reported; the Limitations section concedes this. The 'each matching bit represents a matching feature' argument is a non-sequitur. So the strength of the privacy-leakage claim is not yet quantitatively established, though the qualitative examples make the threat plausible.\n\nOther soft spots are minor by comparison. Single dataset of celebrity faces; no error bars or baselines; the PSI proposal is a sketch with no implementation. The citation pattern is fine, and the claim of 'first inversion attacks on PDQ and NeuralHash' checks out against the table of prior work.\n\nBottom line: the paper deserves a serious referee. The core empirical contribution is new and relevant, and the weakness is in the evaluation, not the idea. I would send it out, with the expectation that the authors add non-circular reconstruction metrics, error bars, and ideally a non-face or at least a held-out evaluation set before publication.","headline":"First inversion attacks on PDQ and NeuralHash, but the quantitative evaluation is circular and the practical claim is stronger than the numbers support.","tokens_in":11084,"tokens_out":2603,"would_cite":true,"duration_ms":26386,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Perceptual hashes designed as irreversible fingerprints of intimate images can be inverted on consumer-grade hardware, producing recognizable approximations of the originals.","keywords":["perceptual hash inversion","Pix2Pix GAN","image-based sexual abuse","private set intersection","PDQ hash","NeuralHash","PhotoDNA","aHash"],"falsifier":"Re-run the evaluation replacing perceptual-hash similarity with independent visual quality metrics such as SSIM or human recognition rates and compare reconstructions against an average-face baseline; if the outputs are no more recognizable than that baseline, the quantitative success would be an artefact of the chosen metric rather than genuine pre-image recovery.","tokens_in":10117,"feed_emoji":"🔓","tokens_out":7284,"duration_ms":65385,"temperature":0.7,"pith_summary":"This paper tries to establish that the perceptual hash values underpinning image-based sexual abuse (IBSA) removal tools are not safe to distribute in the clear: a low-budget attacker can train a conditional GAN on pairs of images and their hashes, then feed it a hash and get back a recognizable approximation of the original image. The authors demonstrate this for four widely used perceptual hash functions—aHash, PDQ, NeuralHash, and PhotoDNA—and present it as the first hash inversion attack on PDQ and NeuralHash. If true, the claim matters because services like the Take It Down reporting portal ask vulnerable users to upload hashes of intimate material under the promise that the hashes cannot be reverse engineered; the paper says that promise is false and that the hashes should be guarded almost as carefully as the images themselves. The proposed fix is to replace clear-text hash matching with private set intersection, a protocol that reveals only the overlap between user-reported and platform-stored hashes.","feed_headline":"Perceptual hashes of abuse images can be reversed on a 2015 GPU","feed_subtitle":"Training a Pix2Pix GAN on 1,000 faces turns PDQ, NeuralHash, aHash, and PhotoDNA digests back into recognizable images.","key_machinery":"The central object is the Pix2Pix conditional GAN, a generative adversarial network for image-to-image translation. The attack renders a perceptual hash as a square grid of black-and-white pixels (or 0–255 greyscale values for PhotoDNA) and trains the generator on pairs $(H(x_i), x_i)$ of hashes and original images, so that after training the network maps a bare hash grid to a 256×256 approximation of the pre-image. The pixel-grid hash representation is what carries the argument: each hash bit becomes a spatial position, letting the network learn position-dependent correlations between hash bits and facial features.","core_discovery":"The central claim is that perceptual hashing—a technique intended to be irreversible—can be inverted in practice: given only a hash digest, a Pix2Pix conditional GAN trained on 1,000 face images for 500 epochs on an old 8 GB GPU produces images that share most perceptual hash bits with the original and visibly preserve hair color, face shape, and other features. The paper reports mean perceptual similarities between roughly 54% and 96% depending on the hash function and evaluation metric, with best-case reconstructions reaching 100% under aHash for aHash and PhotoDNA attacks and 96.88% for NeuralHash and PDQ attacks. It concludes that perceptual hash values must be treated almost as sensitively as the original images, that the current design of services such as Take It Down is inherently insufficient, and that secure hash matching via private set intersection is the needed alternative.","pith_inferences":["The quantitative success metric is self-referential: similarity is measured by the very perceptual hash functions being attacked, so independent visual metrics such as SSIM or human recognition tests would be needed to confirm that hash-bit agreement means meaningful visual recovery.","Training exclusively on celebrity face images may set an upper bound on what the GAN can reconstruct; full-body imagery or general scenes could behave differently, and the paper itself leaves this as future work.","A stronger test would compare reconstructions against a trivial baseline, such as the dataset's average face or random images engineered to share hash bits, to separate information actually leaked by the hash from prior knowledge the GAN learned about faces.","If inversion at this scale is practical, hash databases may warrant legal treatment as sensitive personal data rather than as anonymous fingerprints, affecting how breach disclosures and retention policies are designed."],"forward_implications":["Uploaded perceptual hashes of sensitive material should be protected almost as carefully as the original images, because an attacker who obtains the digests can reconstruct recognizable likenesses.","Clear-text hash matching in IBSA removal tools is not privacy-preserving as currently deployed; the stated promise that images cannot be reverse engineered from hashes is contradicted by the results.","The attack is black-box and adaptable to any perceptual hash function, so changing to a different hash algorithm would not by itself remove the vulnerability.","Private set intersection would let platforms match user-reported hashes against stored content without revealing hashes that do not match, preventing mass inversion of non-matching reports.","Users should be cautious about preemptively reporting material that is not yet online, since exposing its hash could reveal the underlying image to a compromised service provider."],"supporting_citations":[{"why":"Supplies the Pix2Pix conditional GAN architecture used for all four hash inversion attacks.","marker":"[13]"},{"why":"Establishes prior detection-avoidance, targeted second pre-image, and PhotoDNA/PDQ attack context that the paper extends to inversion.","marker":"[6]"},{"why":"Demonstrates prior attacks on NeuralHash, which the paper claims to invert for the first time.","marker":"[4]"},{"why":"Provides the black-box NeuralHash attack and analysis of NeuralHash behavior that the paper positions its results against.","marker":"[5]"},{"why":"Gives the definition of perceptual hashing and non-reversibility that the inversion attack directly targets.","marker":"[10]"},{"why":"Supplies the private set intersection literature the paper draws on for its proposed secure hash matching.","marker":"[15]"},{"why":"Shows prior detection-avoidance attacks on perceptual-hashing-based client-side scanning, motivating the security analysis.","marker":"[3]"}],"fun_headline_variants":["Perceptual hashes reversed on a 2015 GPU","GAN inversion attack breaks perceptual hashes on old GPU","Pix2Pix + 1,000 faces decodes perceptual hash digests","Hash inversion makes IBSA removal tools a privacy leak","Perceptual hash reversal: a 2015 GPU and 1,000 faces enough"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's success is measured by how closely the reconstructed image's perceptual hash matches the original image's perceptual hash—the same hash functions under attack—so the conclusion that private visual information leaks depends on hash-bit agreement meaning real visual recovery.","fun_headline_variants_meta":{"raw":{"variants":["Perceptual hashes reversed on a 2015 GPU","GAN inversion attack breaks perceptual hashes on old GPU","Pix2Pix + 1,000 faces decodes perceptual hash digests","Hash inversion makes IBSA removal tools a privacy leak","Perceptual hash reversal: a 2015 GPU and 1,000 faces enough"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001318,"raw_usage":{"total_tokens":5282,"prompt_tokens":776,"completion_tokens":4506,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":392,"completion_tokens_details":{"reasoning_tokens":4415}},"tokens_in":392,"tokens_out":4506,"duration_ms":32115,"temperature":1.0,"reasoning_tokens":4415,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T20:03:14.347894+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the evaluation replacing perceptual-hash similarity with independent visual quality metrics such as SSIM or human recognition rates and compare reconstructions against an average-face baseline; if the outputs are no more recognizable than that baseline, the quantitative success would be an artefact of the chosen metric rather than genuine pre-image recovery.","supporting_citations":[{"cited_title":"Image- to-image translation with conditional adversarial net- works,","cited_arxiv_id":null,"evidence_quote":"Supplies the Pix2Pix conditional GAN architecture used for all four hash inversion attacks."},{"cited_title":"Squint hard enough: Attacking perceptual hashing with adversarial machine learning,","cited_arxiv_id":null,"evidence_quote":"Establishes prior detection-avoidance, targeted second pre-image, and PhotoDNA/PDQ attack context that the paper extends to inversion."},{"cited_title":"Learning to break deep perceptual hashing: The use case neuralhash,","cited_arxiv_id":null,"evidence_quote":"Demonstrates prior attacks on NeuralHash, which the paper claims to invert for the first time."},{"cited_title":"Exploiting and Defending Against the Approximate Linearity of Apple's NeuralHash","cited_arxiv_id":"2207.14258","evidence_quote":"Provides the black-box NeuralHash attack and analysis of NeuralHash behavior that the paper positions its results against."},{"cited_title":"An overview of perceptual hashing,","cited_arxiv_id":null,"evidence_quote":"Gives the definition of perceptual hashing and non-reversibility that the inversion attack directly targets."},{"cited_title":"Private set intersection: A systematic literature review,","cited_arxiv_id":null,"evidence_quote":"Supplies the private set intersection literature the paper draws on for its proposed secure hash matching."},{"cited_title":"Adversarial detection avoidance attacks: Evaluating the robust- ness of perceptual hashing-based client-side scan- ning,","cited_arxiv_id":null,"evidence_quote":"Shows prior detection-avoidance attacks on perceptual-hashing-based client-side scanning, motivating the security analysis."}],"review_version":1}