{"id":"c0179ef9-5ac7-4ed4-91ec-536c2d7d63aa","arxiv_id":"2608.03101","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A plug-in defense that hardens reference images and smooths match decisions reduces evasion attack success on eight deep perceptual hashes and provides a certified l2 robustness radius near 0.3.","lead":"DualShield adds a defense layer to existing image-perceptual-hash systems: it perturbs each reference image before publication and aggregates many noisy comparisons at match time, without retraining the underlying hash model. If the reported results hold, platforms could harden already-deployed hash matchers against adversarial re-uploads rather than replacing them.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"White-box attacks optimize the base hash matcher rather than the smoothed matcher G_sigma, so the headline 98.6% to 11.8% ASR reduction may not hold against a genuinely adaptive adversary.","rationale":"The paper's theoretical contribution is a standard randomized-smoothing certificate applied to pairwise matching, plus an optimization of the reference. The certificate itself is sound: Eq. (A.12) follows from the Neyman-Pearson argument, and a query-only perturbation has the same l2 norm as the pairwise displacement. I do not see an internal gap in Theorem 1. The problem is the gap between that theory and the empirical headline. Because the certified radius is ~0.3 while tested attack budgets are 40-180, the paper cannot rely on the certificate to explain the empirical robustness; the empirical reduction is therefore the central evidence for the deployment claim. Appendix B's attack description strongly suggests the attacker optimizes the base matcher M_f and then evaluates G_sigma only at the end. That is not an adaptive white-box attack under the paper's own threat model. This is the same weakness the reader identified, so my read keeps the conditional verdict: the method may still work, but the headline ASR numbers need to be recomputed against a true adaptive adversary. Secondary data issues (C-PDQ's 100% collision rate with nonzero white-box ASR; R2 values all at the maximum possible from N=5000) reinforce the need for a detailed revision but are not the main concern.","tokens_in":22988,"tokens_out":6851,"duration_ms":67347,"concrete_test":"Rerun the white-box evaluation with an attack objective defined on G_sigma. For each of the 300 pairs, run PGD over q using a differentiable or sample-based estimate of the smoothed match probability p_1(r*, q) = E[M_f(r* + eta_r, q + eta_q)] (e.g., reparameterized Gaussian noise, 64-256 samples per step, with a soft or hard Hamming margin), using the same budgets 40/90/180, 300 steps, 3 restarts, and evaluation with fresh N=5000 noise. Also run one score-based attack (NES or natural evolution) directly on the smoothed matcher as a sanity check. If ASR against Ours at budget 180 rises materially above 11.8% (e.g., >30%), the headline empirical claim should be weakened to 'robust against attacks optimized against the base hash,' and the paper should be revised or rejected depending on the final number.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing weakness is that the empirical robustness numbers are produced by attacks that do not optimize the objective the defense actually deploys. Section B states the white-box attacker 'knows the hash, matching rule, threshold, and defense' and then uses PGD with a 'focused flip-margin objective,' but the only objective formally defined for the base matcher is Eq. (2), and the appendix then says smoothing is evaluated on the resulting adversarial query using fresh defender randomness. That is a non-adaptive attack against G_sigma. An adversarial example for M_f moves the base match decision to non-match, but the protected decision is G_sigma(r*, q_adv); because G_sigma aggregates many noisy comparisons, a query that is a non-match under M_f can still be a match under G_sigma with high probability. Thus the reported 11.8% white-box ASR may mostly measure the gap between M_f and G_sigma, not the difficulty of evading DualShield. The certified radius (~0.3) is far smaller than the tested budgets (40 to 180), so the empirical ASR is the only support for the central deployment claim, and it is being measured against the wrong decision function. The concern is not that the randomized-smoothing theorem is wrong; it is that the attack evaluation has not been made adaptive to the smoothed matcher, even though the threat model promises that.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DualShield, a two-stage plug-in defense for deep perceptual hashes. Publication-time hardening adds an optimized imperceptible perturbation to reference images before publication; matching-time randomized smoothing aggregates the base hash matcher's match/non-match decisions over Gaussian-perturbed reference-query pairs. The authors prove a query-only certified L2 radius (Theorem A.1) based on the Cohen et al. randomized-smoothing bound and evaluate empirical robustness against white-box and black-box attacks, transformations, collisions, and visual quality across eight hashes and three datasets. They report a mean certified radius of about 0.3, and reductions in average white-box ASR from 98.6% to 11.8% and black-box ASR from 20.6% to 1.3%.","tokens_in":23288,"tokens_out":7103,"duration_ms":58011,"significance":"If the empirical claims survive scrutiny, this is a practically valuable contribution: it would strengthen deployed perceptual hashes without retraining, with a formal certificate for the protected matcher. The randomized-smoothing certificate is a correct application of Cohen et al. to the pair (r*, q), and the query-only reduction via Delta=(0, delta_q) is valid. The appendices are unusually complete: hyperparameters, per-hash/per-dataset tables, and explicit limitation statements (C-PDQ collisions, transformation trade-offs) are provided. The ablation (Table 2) shows both components contribute. The main reservation is that the empirical attack evaluation may not be adaptive to the smoothed matcher, which is the decision function the defense actually deploys.","major_comments":[{"comment":"The white-box attack is defined as PGD with a focused flip-margin objective, but the objective is optimized against the base matcher M_f (Eq. 2); the appendix states that 'smoothing is evaluated on the resulting adversarial query using fresh defender randomness.' The threat model explicitly grants the attacker full knowledge of the defense, so an adaptive white-box attack must optimize the smoothed matcher G_sigma. An adversarial example for M_f can still match under G_sigma with high probability, so the reported 11.8% average ASR may substantially overstate the robustness against a genuinely adaptive adversary. Because the certified radius (~0.3) is far smaller than the tested budgets of 40-180 in the same normalized input space, the empirical ASR is the only support for robustness at those budgets, and it is currently measured against the wrong decision function. I request a re-evaluation with attacks that use an objective defined on G_sigma (e.g., the smoothed match probability or its margin), or a clear argument for why the M_f-optimal attack transfers to G_sigma.","section":"Section B, 'Adaptive white-box attacks'; Section 'Threat Model'"},{"comment":"The NES black-box attack is described as using 'the Hamming score returned by target queries,' but the paper does not specify whether these queries are to M_f or to G_sigma. If they are to M_f, the same non-adaptivity problem applies. Please specify the query oracle and, if it is M_f, re-run the evaluation against G_sigma (e.g., querying the Monte Carlo smoothed decision with fresh defender randomness).","section":"Section B, 'Adaptive black-box attacks'"},{"comment":"The paper does not state whether the reference-query pairs used for certification and attack evaluation are disjoint from the positive pairs used in the publication-time hardening objective (Eq. A.24). If the same or overlapping images are used, the reported certified radii and ASR reductions may be optimistically biased by the reference optimization. Please clarify the split, or evaluate on a held-out set of near-duplicate pairs.","section":"Section A.3, 'Publication-Time Hardening'; Section B, 'Detailed Experimental Protocol'"},{"comment":"The mean certified radius is 0.2987-0.2993 for all eight hashes. With sigma=0.10, N=5000, and alpha=1e-3, the maximum possible certified radius when all certification samples agree is sigma * Phi^{-1}(alpha^{1/N}) about 0.299. The reported values are therefore essentially at the protocol ceiling and carry little information about hash-specific robustness. The paper should report the distribution of per-pair radii and explicitly state that the mean is at the protocol maximum; otherwise the phrase 'achieves a certified radius of approximately 0.3' overstates the hash-specific guarantee.","section":"Tables 1 and B.1; Eq. (14)/(A.12)"}],"minor_comments":[{"comment":"The certificate applies to the protected matcher G_sigma, not to the original hash matcher M_f; please state this explicitly in the abstract and in the certified-robustness discussion to avoid overclaiming.","section":"Abstract and Section 'Certified Robustness'"},{"comment":"The C-PDQ collision rate of 100% should be annotated in the table itself rather than explained only in the surrounding text.","section":"Tables 1 and B.1"},{"comment":"The sentence 'Smoothing is evaluated on the resulting adversarial query using fresh defender randomness' should be removed or rewritten once the attack is made adaptive to G_sigma.","section":"Section B, 'Adaptive white-box attacks'"},{"comment":"The pseudocode formatting has tokens like 'fork=1toKdo' and 'Initializeδ_h←0' that need proper typesetting for readability.","section":"Algorithm A.1"},{"comment":"The related work cites 'Sun et al. 2025' but the reference list only contains 'Sun, Y.; Tu, X.; Wang, C.; and Qi, S. 2025'; please ensure the citation is unambiguous.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The core theorem and the transparency of the appendices are strengths. The main risk is that the empirical headline numbers are produced by attacks against the base matcher, not the protected matcher; this must be fixed before publication. I also recommend that the editors ensure the dataset-split question is resolved, since it directly affects the validity of the certified-radius and ASR measurements. The paper otherwise fits the journal's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The short version: this is a genuinely new plug-in defense for perceptual hashes, and the theory is a clean application of randomized smoothing. But the empirical evaluation doesn't test the thing it claims to protect, and the certified radius is a rounding artifact, not a real robustness bound.\n\nWhat's new: smoothing the pairwise match decision rather than the hash output, and proactively hardening the reference image at publication time. That's a sensible combination, and unlike CertPHash it doesn't require retraining. The proof in Appendix A is a correct application of Cohen et al.'s Neyman-Pearson argument; the query-only reduction using Delta=(0,delta_q) is valid. The ablation showing smoothing alone gets 43.8% white-box ASR and hardening drops it to 11.8% is a meaningful demonstration of the mechanism.\n\nThe soft spots are real, though. The certified radius sits at 0.2987 to 0.2993 for every hash. That's what Clopper-Pearson with N=5000 and alpha=1e-3 gives you when all 5000 samples match: sigma * Phi^{-1}((1e-3)^(1/5000)) ≈ 0.299. So it's a certificate about the confidence bound, not about the hash. On a 512x512x3 image, a radius of 0.3 is nothing (attack budgets go to 180). The paper should say that plainly.\n\nMore seriously, the white-box attack optimizes the base matcher M_f, not the smoothed matcher G_sigma. The threat model says the attacker knows the defense, but Appendix B describes PGD on the flip-margin objective and then evaluates smoothing on the resulting query with fresh randomness. That's not an adaptive attack. An adversary who knows G_sigma would try to flip the majority vote directly, and the reported 98.6% to 11.8% reduction is likely optimistic. The empirical numbers are the only support for robustness at budgets 40 to 180 since the certificate covers so little, so this matters.\n\nThere's also a C-PDQ oddity: it has a 100% collision rate, meaning every unrelated pair matches, and yet shows 0% ASR under DualShield. That's not a defense working; that's a degenerate hash. The paper acknowledges this, but it should be separated from results that are actually informative.\n\nWho this is for: researchers working on adversarial robustness for perceptual hashes will want to read it as a promising direction, but the evaluation needs a genuinely adaptive attack before the performance claims are credible. I'd send it back for major revision rather than reject it.","headline":"New plug-in defense for perceptual hashes with a correct but tiny certificate and an unadaptive attack evaluation; needs major revision, not rejection.","tokens_in":23825,"tokens_out":4792,"would_cite":true,"duration_ms":41592,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DualShield claims a plug-in layer — match-time randomized smoothing plus reference-image hardening — cuts white-box evasion of deep perceptual hashes from 98.6% to 11.8% and certifies robustness to bounded query perturbations without…","keywords":["perceptual hashing","near-duplicate image matching","randomized smoothing","certified robustness","evasion attacks","adversarial robustness","plug-in defense","content moderation"],"falsifier":"Run a white-box attack that optimizes the smoothed matcher's expected decision — for example, projected gradient descent on a Monte Carlo estimate of $\\mathbb{E}[M_f(\\Pi_X(r^* + \\eta_r), \\Pi_X(q + \\eta_q))]$ computed via the reparameterization trick or natural evolution strategies, at budget 180 on NeuralHash and SimDINO — and compare the resulting attack success to the reported 11.8% average; if success climbs substantially, the empirical robustness reflects a mismatch between the attack objective and the defense rather than the defense's intrinsic strength.","tokens_in":22774,"feed_emoji":"🛡️","tokens_out":8259,"duration_ms":67904,"temperature":0.7,"pith_summary":"The paper claims that deployed deep perceptual hashes — the compact image fingerprints platforms use to catch re-uploads of harmful or copyrighted content — can be made robust to adversarial evasion without retraining or modifying the underlying hash model. DualShield does this with two complementary moves: at publication time it adds an optimized imperceptible perturbation to each reference image, and at matching time it replaces the single fragile hash comparison with a majority vote over many Gaussian-perturbed comparisons of the reference-query pair. On eight hashes and three datasets the paper reports average white-box attack success dropping from 98.6% to 11.8% and black-box from 20.6% to 1.3%, alongside a certified $\\ell_2$ radius of about 0.3 within which no additive query perturbation can change a match decision. If the numbers hold, robustness becomes a layer that platforms can add around an existing hash rather than a property that must be trained into the model.","feed_headline":"Plug-in defense cuts hash evasion from 98.6% to 11.8%","feed_subtitle":"Match-time smoothing plus hardened references gives deployed hashes a certified radius — no retraining.","key_machinery":"The load-bearing object is the Gaussian-smoothed hash matcher $G_\\sigma$, defined as the majority vote of the frozen base matcher $M_f$ over independently perturbed copies of the reference-query pair. It does two jobs: it stabilizes the match decision so that the standard randomized-smoothing certificate applies — $R_2 = \\sigma\\Phi^{-1}(p_A)$ with $p_A$ a one-sided Clopper-Pearson bound estimated from $N = 5000$ Monte Carlo samples — and it gives publication-time hardening a smooth objective to optimize. Hardening is the second half of the machinery: a projected sign-gradient search (200 steps, $\\ell_\\infty$ cap of $16/255$) that pushes the hardened reference $r^*$ deeper into the matching region with respect to the smoothed matcher while keeping unrelated images non-matching. The ablation shows the two mechanisms are complementary: smoothing alone brings white-box attack success from 98.6% to 43.8%, and adding hardening brings it down to 11.8%.","core_discovery":"DualShield's central claim is that the evasion vulnerability of a deep perceptual hash is not inseparable from the hash itself: the match/non-match decision can be made adversarially stable entirely around the frozen hash. The paper defines a smoothed matcher $G_\\sigma(r^*, q)$ that returns the majority match decision of the base matcher $M_f$ over pairs $(r^* + \\eta_r, q + \\eta_q)$ with $\\eta_r, \\eta_q \\sim \\mathcal{N}(0, \\sigma^2 I)$, and shows via the standard randomized-smoothing Neyman-Pearson argument that any additive query perturbation with $\\ell_2$ norm below $R_2 = \\sigma\\Phi^{-1}(p_A)$, where $p_A$ is a Clopper-Pearson lower confidence bound on the winning-class probability, provably cannot flip the decision. The certificate is query-only: the reference is fixed and only the uploaded query is treated as adversarial. Publication-time hardening then optimizes each reference image $r^* = \\Pi_X(r + \\delta_h)$ under a small $\\ell_\\infty$ constraint to maximize the smoothed match margin against benign near-duplicates while suppressing matches to unrelated images, which both lowers empirical attack success and enlarges the certified radius. The paper reports that this two-layer construction reduces average white-box attack success from 98.6% to 11.8% and black-box from 20.6% to 1.3% across eight hashes, with the mean certified radius rising from 0.252 with smoothing alone to about 0.299.","pith_inferences":["My read: the gap between the certified radius of about 0.3 and the attack budgets of 40 to 180 indicates that the reported white-box attacks are not optimizing the smoothed decision directly, so a smoothing-aware adversary that differentiates through $G_\\sigma$ (for instance with a score-function estimator) may recover a large share of the original attack success; testing that attack is the natura","The same two-shield recipe — optimize the reference, then smooth the thresholded similarity decision — transfers in principle to any matcher built on thresholded learned embeddings, such as video or audio fingerprinting and deepfake-detection similarity, because nothing in the construction uses image-specific structure beyond the base hash.","Deployment cost is the hidden constraint: certification requires roughly 5,100 forward passes per query at $\\sigma = 0.10$, so the certificate as described is realistic for low-traffic or offline verification workloads unless the sampling budget can be reduced with a cheaper estimator."],"forward_implications":["Every one of the eight evaluated hashes — including models with no native verifier — gains a formal $\\ell_2$ robustness certificate of roughly 0.3, so platforms can offer a worst-case guarantee without swapping the hash model.","A practical attacker must operate at large budgets to succeed: at budget 40 the average white-box success is 0.09%, and success at budget 180 comes with sharply degraded SSIM, LPIPS, and FID, meaning evasion and visual fidelity trade off against each other.","The defense is not free: for some hashes (SSCD, SimDINO) adversarial robustness comes at the cost of higher transformation evasion under cropping and rotation, so deployment requires a model-dependent balance between the two kinds of robustness.","Collision behavior is largely preserved — C-PDQ's 100% collision rate is inherited from the underlying hash, not introduced — so the robustness gain is not obtained by making the matcher permissively accept everything."],"supporting_citations":[{"why":"Supplies the randomized-smoothing certification bound $R_2 = \\sigma\\Phi^{-1}(p_A)$ that DualShield adapts from classification to hash matching.","marker":"[Cohen, Rosenfeld, and Kolter 2019]"},{"why":"CertPHash, the certified perceptual hashing baseline; its two variants C-PDNA and C-PDQ are among the eight evaluated hashes and provide the native-certificate comparison.","marker":"[Yang et al. 2025]"},{"why":"Contributes NeuralHash as an evaluated hash and establishes the white-box attack methodology against deep perceptual hashing.","marker":"[Struppek et al. 2022]"},{"why":"Defines the adversarial detection-avoidance threat model for perceptual-hash matching that DualShield defends against.","marker":"[Jain, Cretu, and de Montjoye 2022]"},{"why":"Demonstrates white-box evasion attacks on perceptual hashes, motivating the robustness goals the paper targets.","marker":"[Prokos et al. 2023]"},{"why":"Active Image Indexing, the proactive reference-image optimization line that publication-time hardening builds on and contrasts with.","marker":"[Fernandez et al. 2022]"},{"why":"Contributes DINOHash, one of the eight evaluated hashes, and represents the adversarial-robustness-through-training approach DualShield avoids.","marker":"[Singhi, Gupta, and Struppek 2025]"}],"fun_headline_variants":["Plug-in defense slashes hash evasion to 11.8%","Certified robustness for hashes without retraining","DualShield: smoothing plus hardening, zero retraining","Hash attack success drops from 98.6% to 11.8%","Frozen hashes get certified radius via dual defense"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The reported attack-success numbers assume the white-box attacker genuinely fights the smoothed majority matcher; as described, the PGD attack optimizes the base hash matcher (Eq. 2) and smoothing is evaluated only afterward, so against a truly smoothing-aware adversary the reported reduction from 98.6% to 11.8% is an optimistic upper bound, given that the certified radius of about 0.3 is far smaller than the attack budgets of 40 to 180.","fun_headline_variants_meta":{"raw":{"variants":["Plug-in defense slashes hash evasion to 11.8%","Certified robustness for hashes without retraining","DualShield: smoothing plus hardening, zero retraining","Hash attack success drops from 98.6% to 11.8%","Frozen hashes get certified radius via dual defense"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000325,"raw_usage":{"total_tokens":1895,"prompt_tokens":1090,"completion_tokens":805,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":706,"completion_tokens_details":{"reasoning_tokens":719}},"tokens_in":706,"tokens_out":805,"duration_ms":6512,"temperature":1.0,"reasoning_tokens":719,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:53:10.377206+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a white-box attack that optimizes the smoothed matcher's expected decision — for example, projected gradient descent on a Monte Carlo estimate of $\\mathbb{E}[M_f(\\Pi_X(r^* + \\eta_r), \\Pi_X(q + \\eta_q))]$ computed via the reparameterization trick or natural evolution strategies, at budget 180 on NeuralHash and SimDINO — and compare the resulting attack success to the reported 11.8% average; if success climbs substantially, the empirical robustness reflects a mismatch between the attack objective and the defense rather than the defense's intrinsic strength.","supporting_citations":[{"cited_title":"Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency , year =","cited_arxiv_id":null,"evidence_quote":"Contributes NeuralHash as an evaluated hash and establishes the white-box attack methodology against deep perceptual hashing."}],"review_version":2}