Pith. sign in

REVIEW 4 major objections 5 minor 47 references

Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retraining

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DualShield claims a plug-in layer — match-time randomized smoothing plus reference-image hardening — cuts white-box evasion of deep perceptual hashes from 98.6% to 11.8% and certifies robustness to bounded query perturbations without…

desk verdict New plug-in defense for perceptual hashes with a correct but tiny certificate and an unadaptive attack evaluation; needs major revision, not rejection. read the letter →

arxiv 2608.03101 v1 pith:XH2ALTNL submitted 2026-08-04 cs.CV

Bangjie Sun , Nayoung Kim , Mun Choon Chan , Jun Han This is my paper · ORCID
classification cs.CV
keywords perceptualhashingnear-duplicateimagematchingrandomizedsmoothingcertifiedrobustnessevasionattacksadversarialplug-indefensecontentmoderation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that deployed deep perceptual hashes — the compact image fingerprints platforms use to catch re-uploads of harmful or copyrighted content — can be made robust to adversarial evasion without retraining or modifying the underlying hash model. DualShield does this with two complementary moves: at publication time it adds an optimized imperceptible perturbation to each reference image, and at matching time it replaces the single fragile hash comparison with a majority vote over many Gaussian-perturbed comparisons of the reference-query pair. On eight hashes and three datasets the paper reports average white-box attack success dropping from 98.6% to 11.8% and black-box from 20.6% to 1.3%, alongside a certified $\ell_2$ radius of about 0.3 within which no additive query perturbation can change a match decision. If the numbers hold, robustness becomes a layer that platforms can add around an existing hash rather than a property that must be trained into the model.

What carries the argument

The load-bearing object is the Gaussian-smoothed hash matcher $G_\sigma$, defined as the majority vote of the frozen base matcher $M_f$ over independently perturbed copies of the reference-query pair. It does two jobs: it stabilizes the match decision so that the standard randomized-smoothing certificate applies — $R_2 = \sigma\Phi^{-1}(p_A)$ with $p_A$ a one-sided Clopper-Pearson bound estimated from $N = 5000$ Monte Carlo samples — and it gives publication-time hardening a smooth objective to optimize. Hardening is the second half of the machinery: a projected sign-gradient search (200 steps, $\ell_\infty$ cap of $16/255$) that pushes the hardened reference $r^*$ deeper into the matching region with respect to the smoothed matcher while keeping unrelated images non-matching. The ablation shows the two mechanisms are complementary: smoothing alone brings white-box attack success from 98.6% to 43.8%, and adding hardening brings it down to 11.8%.

What would settle it

Run a white-box attack that optimizes the smoothed matcher's expected decision — for example, projected gradient descent on a Monte Carlo estimate of $\mathbb{E}[M_f(\Pi_X(r^* + \eta_r), \Pi_X(q + \eta_q))]$ computed via the reparameterization trick or natural evolution strategies, at budget 180 on NeuralHash and SimDINO — and compare the resulting attack success to the reported 11.8% average; if success climbs substantially, the empirical robustness reflects a mismatch between the attack objective and the defense rather than the defense's intrinsic strength.

Watch

Extended reading notes

Core claim

DualShield's central claim is that the evasion vulnerability of a deep perceptual hash is not inseparable from the hash itself: the match/non-match decision can be made adversarially stable entirely around the frozen hash. The paper defines a smoothed matcher $G_\sigma(r^*, q)$ that returns the majority match decision of the base matcher $M_f$ over pairs $(r^* + \eta_r, q + \eta_q)$ with $\eta_r, \eta_q \sim \mathcal{N}(0, \sigma^2 I)$, and shows via the standard randomized-smoothing Neyman-Pearson argument that any additive query perturbation with $\ell_2$ norm below $R_2 = \sigma\Phi^{-1}(p_A)$, where $p_A$ is a Clopper-Pearson lower confidence bound on the winning-class probability, provably cannot flip the decision. The certificate is query-only: the reference is fixed and only the uploaded query is treated as adversarial. Publication-time hardening then optimizes each reference image $r^* = \Pi_X(r + \delta_h)$ under a small $\ell_\infty$ constraint to maximize the smoothed match margin against benign near-duplicates while suppressing matches to unrelated images, which both lowers empirical attack success and enlarges the certified radius. The paper reports that this two-layer construction reduces average white-box attack success from 98.6% to 11.8% and black-box from 20.6% to 1.3% across eight hashes, with the mean certified radius rising from 0.252 with smoothing alone to about 0.299.

Load-bearing premise

The reported attack-success numbers assume the white-box attacker genuinely fights the smoothed majority matcher; as described, the PGD attack optimizes the base hash matcher (Eq. 2) and smoothing is evaluated only afterward, so against a truly smoothing-aware adversary the reported reduction from 98.6% to 11.8% is an optimistic upper bound, given that the certified radius of about 0.3 is far smaller than the attack budgets of 40 to 180.

Editorial extensions

If this is right

  • Every one of the eight evaluated hashes — including models with no native verifier — gains a formal $\ell_2$ robustness certificate of roughly 0.3, so platforms can offer a worst-case guarantee without swapping the hash model.
  • A practical attacker must operate at large budgets to succeed: at budget 40 the average white-box success is 0.09%, and success at budget 180 comes with sharply degraded SSIM, LPIPS, and FID, meaning evasion and visual fidelity trade off against each other.
  • The defense is not free: for some hashes (SSCD, SimDINO) adversarial robustness comes at the cost of higher transformation evasion under cropping and rotation, so deployment requires a model-dependent balance between the two kinds of robustness.
  • Collision behavior is largely preserved — C-PDQ's 100% collision rate is inherited from the underlying hash, not introduced — so the robustness gain is not obtained by making the matcher permissively accept everything.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My read: the gap between the certified radius of about 0.3 and the attack budgets of 40 to 180 indicates that the reported white-box attacks are not optimizing the smoothed decision directly, so a smoothing-aware adversary that differentiates through $G_\sigma$ (for instance with a score-function estimator) may recover a large share of the original attack success; testing that attack is the natura
  • The same two-shield recipe — optimize the reference, then smooth the thresholded similarity decision — transfers in principle to any matcher built on thresholded learned embeddings, such as video or audio fingerprinting and deepfake-detection similarity, because nothing in the construction uses image-specific structure beyond the base hash.
  • Deployment cost is the hidden constraint: certification requires roughly 5,100 forward passes per query at $\sigma = 0.10$, so the certificate as described is realistic for low-traffic or offline verification workloads unless the sampling budget can be reduced with a cheaper estimator.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes DualShield, a two-stage plug-in defense for deep perceptual hashes. Publication-time hardening adds an optimized imperceptible perturbation to reference images before publication; matching-time randomized smoothing aggregates the base hash matcher's match/non-match decisions over Gaussian-perturbed reference-query pairs. The authors prove a query-only certified L2 radius (Theorem A.1) based on the Cohen et al. randomized-smoothing bound and evaluate empirical robustness against white-box and black-box attacks, transformations, collisions, and visual quality across eight hashes and three datasets. They report a mean certified radius of about 0.3, and reductions in average white-box ASR from 98.6% to 11.8% and black-box ASR from 20.6% to 1.3%.

Significance. If the empirical claims survive scrutiny, this is a practically valuable contribution: it would strengthen deployed perceptual hashes without retraining, with a formal certificate for the protected matcher. The randomized-smoothing certificate is a correct application of Cohen et al. to the pair (r*, q), and the query-only reduction via Delta=(0, delta_q) is valid. The appendices are unusually complete: hyperparameters, per-hash/per-dataset tables, and explicit limitation statements (C-PDQ collisions, transformation trade-offs) are provided. The ablation (Table 2) shows both components contribute. The main reservation is that the empirical attack evaluation may not be adaptive to the smoothed matcher, which is the decision function the defense actually deploys.

major comments (4)
  1. [Section B, 'Adaptive white-box attacks'; Section 'Threat Model'] The white-box attack is defined as PGD with a focused flip-margin objective, but the objective is optimized against the base matcher M_f (Eq. 2); the appendix states that 'smoothing is evaluated on the resulting adversarial query using fresh defender randomness.' The threat model explicitly grants the attacker full knowledge of the defense, so an adaptive white-box attack must optimize the smoothed matcher G_sigma. An adversarial example for M_f can still match under G_sigma with high probability, so the reported 11.8% average ASR may substantially overstate the robustness against a genuinely adaptive adversary. Because the certified radius (~0.3) is far smaller than the tested budgets of 40-180 in the same normalized input space, the empirical ASR is the only support for robustness at those budgets, and it is currently measured against the wrong decision function. I request a re-evaluation with attacks that use an objective defined on G_sigma (e.g., the smoothed match probability or its margin), or a clear argument for why the M_f-optimal attack transfers to G_sigma.
  2. [Section B, 'Adaptive black-box attacks'] The NES black-box attack is described as using 'the Hamming score returned by target queries,' but the paper does not specify whether these queries are to M_f or to G_sigma. If they are to M_f, the same non-adaptivity problem applies. Please specify the query oracle and, if it is M_f, re-run the evaluation against G_sigma (e.g., querying the Monte Carlo smoothed decision with fresh defender randomness).
  3. [Section A.3, 'Publication-Time Hardening'; Section B, 'Detailed Experimental Protocol'] The paper does not state whether the reference-query pairs used for certification and attack evaluation are disjoint from the positive pairs used in the publication-time hardening objective (Eq. A.24). If the same or overlapping images are used, the reported certified radii and ASR reductions may be optimistically biased by the reference optimization. Please clarify the split, or evaluate on a held-out set of near-duplicate pairs.
  4. [Tables 1 and B.1; Eq. (14)/(A.12)] The mean certified radius is 0.2987-0.2993 for all eight hashes. With sigma=0.10, N=5000, and alpha=1e-3, the maximum possible certified radius when all certification samples agree is sigma * Phi^{-1}(alpha^{1/N}) about 0.299. The reported values are therefore essentially at the protocol ceiling and carry little information about hash-specific robustness. The paper should report the distribution of per-pair radii and explicitly state that the mean is at the protocol maximum; otherwise the phrase 'achieves a certified radius of approximately 0.3' overstates the hash-specific guarantee.
minor comments (5)
  1. [Abstract and Section 'Certified Robustness'] The certificate applies to the protected matcher G_sigma, not to the original hash matcher M_f; please state this explicitly in the abstract and in the certified-robustness discussion to avoid overclaiming.
  2. [Tables 1 and B.1] The C-PDQ collision rate of 100% should be annotated in the table itself rather than explained only in the surrounding text.
  3. [Section B, 'Adaptive white-box attacks'] The sentence 'Smoothing is evaluated on the resulting adversarial query using fresh defender randomness' should be removed or rewritten once the attack is made adaptive to G_sigma.
  4. [Algorithm A.1] The pseudocode formatting has tokens like 'fork=1toKdo' and 'Initializeδ_h←0' that need proper typesetting for readability.
  5. [References] The related work cites 'Sun et al. 2025' but the reference list only contains 'Sun, Y.; Tu, X.; Wang, C.; and Qi, S. 2025'; please ensure the citation is unambiguous.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the certified-radius claim follows from an external randomized-smoothing theorem, and publication-time hardening is explicitly separated from the certificate as an operating-point optimization.

full rationale

The paper's derivation chain is self-contained and does not reduce to its own inputs. The certified robustness claim rests on the standard randomized-smoothing certificate: after estimating a Clopper-Pearson lower confidence bound p_A on the smoothed match probability, the certified radius is R2 = sigma * Phi^{-1}(p_A). This is the Neyman-Pearson argument from Cohen et al. (2019), cited as external prior work, and the appendix gives the full proof applied to the binary lifted matcher M_f. No part of this argument assumes the target result. Publication-time hardening is an optimization of the reference image, not a fit of the reported radius: Eq. (9) maximizes a smoothed matching-margin objective, and the paper explicitly states that 'Hardening itself does not constitute the certificate. The final certificate is always computed from the original discrete matcher Mf, the deployed hardened reference r*, and the randomized-smoothing procedure.' Increasing p_A increases R2 by the stated formula, but this is the intended causal mechanism, not a circular derivation. There is no load-bearing self-citation: the cited works on attacks, CertPHash, and randomized smoothing are external, and no 'uniqueness theorem' from the authors is invoked to force a choice. The main skeptical concern about the white-box evaluation—namely that the described PGD attack may optimize the base hash matcher M_f rather than the smoothed matcher G_sigma—is a potential validity gap in the empirical threat model, not a case where a claimed prediction is equivalent to an input by construction. No equation in the paper makes the reported ASR equal to a fitted parameter or a renamed input. Therefore the paper exhibits no significant circularity.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The method uses hand-chosen hyperparameters (sigma, N, alpha, hardening budget, lambda values) that directly affect the reported certified radius and the hardening behavior. No new physical or conceptual entities are introduced; DualShield is a combination of known techniques. The main axioms are the standard randomized-smoothing theorems, the determinism of the base matcher, and the threat-model assumptions about reference immutability and fresh randomness.

free parameters (6)
  • noise scale sigma = 0.10
    Chosen for Gaussian smoothing, shared across all hashes. Directly sets the certified radius scale via R2 = sigma * Phi^{-1}(p_A).
  • certification sample count N = 5000
    Number of Monte Carlo samples for the Clopper-Pearson bound. With K_A=N, the bound yields R2 about 0.299, so the reported radius is partly a sampling artifact.
  • confidence level alpha = 10^-3
    One-sided Clopper-Pearson confidence, affects p_A and hence R2.
  • hardening perturbation bound = 16/255 (l_inf)
    Per-pixel bound for publication-time hardening; larger bounds increase robustness at the cost of visual quality.
  • hardening iterations and step size = 200, 1/255
    Optimization schedule for delta_h, chosen by hand.
  • lambda_neg and lambda_dist = 1, 0.01
    Weights balancing negative-pair separation and distortion in the hardening objective (Eq. A.24).
assumptions (5)
  • standard math Randomized smoothing certification (Cohen et al. 2019) applies to arbitrary deterministic base classifiers; the Neyman-Pearson argument guarantees class stability within radius R2.
    Invoked in Theorem A.1, Eq. A.20.
  • standard math The Clopper-Pearson interval provides a valid one-sided lower confidence bound on the Binomial success probability.
    Used in Eq. A.8 for p_A.
  • domain assumption The base hash matcher M_f is a deterministic function of the reference-query pair, and the similarity threshold tau is fixed.
    Equation (2) and Section A.1; required for the smoothing and certificate.
  • domain assumption The attacker cannot modify the registered reference r* and has no control over the defender's freshly sampled randomness.
    Threat model in Problem Formulation; the query-only certificate depends on this.
  • domain assumption The finite-sample Monte Carlo matcher (N0, N) is a faithful instantiation of the ideal smoothed matcher G_sigma for both certification and attack evaluation.
    Used when deploying the certificate; the paper does not bound the sampling error for the final decision.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retraining." pith.science (2026). https://pith.science/paper/XH2ALTNL

@misc{pith2026260803101,
  author       = {Pith},
  title        = {Pith review of: Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retraining},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XH2ALTNL}},
  note         = {Machine review of arXiv:2608.03101}
}
abstract

Near-duplicate image matching is crucial for trust and safety, provenance verification, copyright enforcement, and large-scale visual search. Modern platforms increasingly rely on deep perceptual hashes, which map visually similar images to nearby representations despite common image transformations. However, adversarial perturbations can cause near-duplicates to evade matching. We present DualShield, a plug-in defense that improves the robustness of existing deep perceptual hashes without retraining or modifying their underlying models. DualShield combines matching-time randomized smoothing, which aggregates decisions over perturbed reference-query pairs, with publication-time hardening, which adds an optimized imperceptible perturbation to each reference image before publication. Together, these mechanisms provide certified and empirical robustness. DualShield achieves a certified $\ell_2$ radius of approximately 0.3, guaranteeing that query perturbations within this radius cannot evade matching. We further evaluate it against adaptive white-box, black-box, and image-transformation attacks. Across eight deep perceptual hashes and three datasets, DualShield substantially reduces attack success rates while preserving low collision rates. These results show that deep perceptual hashes can be strengthened without costly retraining by improving the matching procedure and hardening reference images before publication.

Figures

Figures reproduced from arXiv: 2608.03101 by the authors.

Figure 1
Figure 1. Consider an online platform where a published image is later used as a reference for detecting modified re-uploads. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Visual comparison of publication-time harden [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 43 canonical work pages

  1. [1]

    2025 , eprint=

    Provenance Detection for AI-Generated Images: Combining Perceptual Hashing, Homomorphic Encryption, and AI Detection Models , author=. 2025 , eprint=

    work page 2025

  2. [2]

    Yandex Images , year =

    work page

  3. [3]

    How does TinEye work? , year =

    work page

  4. [4]

    Signal Processing: Image Communication , volume=

    Perceptual hashing for image authentication: A survey , author=. Signal Processing: Image Communication , volume=. 2020 , publisher=

    work page 2020

  5. [5]

    ACM Transactions on Multimedia Computing, Communications and Applications , volume=

    A survey of perceptual hashing for multimedia , author=. ACM Transactions on Multimedia Computing, Communications and Applications , volume=. 2025 , publisher=

    work page 2025

  6. [6]

    IEEE Transactions on Consumer Electronics , volume=

    Robust perceptual image hashing for screen-shooting attack , author=. IEEE Transactions on Consumer Electronics , volume=. 2023 , publisher=

    work page 2023

  7. [7]

    Proceedings of the 33rd ACM International Conference on Information and Knowledge Management , pages=

    SmartHash: perceptual hashing for image tampering detection and authentication , author=. Proceedings of the 33rd ACM International Conference on Information and Knowledge Management , pages=

    work page

  8. [8]

    Procedia Computer Science , volume=

    Perceptual hashing on image-based malware detection , author=. Procedia Computer Science , volume=. 2024 , publisher=

    work page 2024

Show all 47 references
  1. [9]

    international conference on machine learning , pages=

    Certified adversarial robustness via randomized smoothing , author=. international conference on machine learning , pages=. 2019 , organization=

    2019

  2. [10]

    Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , pages=

    It's not what it looks like: Manipulating perceptual hashing based applications , author=. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2021

  3. [11]

    arXiv preprint arXiv:2207.14258 , year=

    Exploiting and defending against the approximate linearity of apple's neuralhash , author=. arXiv preprint arXiv:2207.14258 , year=

    arXiv

  4. [12]

    31st USENIX Security Symposium (USENIX Security 22) , year =

    Shubham Jain and Ana-Maria Cretu and Yves-Alexandre de Montjoye , title =. 31st USENIX Security Symposium (USENIX Security 22) , year =

  5. [13]

    Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency , year =

    Lukas Struppek and Dominik Hintersdorf and Daniel Neider and Kristian Kersting , title =. Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency , year =

    2022

  6. [14]

    32nd USENIX Security Symposium (USENIX Security 23) , pages=

    Squint Hard Enough: Attacking Perceptual Hashing with Adversarial Machine Learning , author=. 32nd USENIX Security Symposium (USENIX Security 23) , pages=

  7. [15]

    34th USENIX Security Symposium (USENIX Security 25) , year =

    Yushu Zhang and Yuanyuan Sun and Shuren Qi and Zhongyun Hua and Wenying Wen and Yuming Fang , title =. 34th USENIX Security Symposium (USENIX Security 25) , year =

  8. [16]

    Manipulating Perceptual Hashing Based Image Retrieval System , year=

    Sun, Yuanyuan and Tu, Xuji and Wang, Chao and Qi, Shuren , journal=. Manipulating Perceptual Hashing Based Image Retrieval System , year=

  9. [17]

    Journal of Online Trust and Safety , volume=

    An overview of perceptual hashing , author=. Journal of Online Trust and Safety , volume=

  10. [18]

    Overview of Perceptual Hashing Technology , year =

  11. [19]

    2010 , publisher=

    Implementation and benchmarking of perceptual image hash functions , author=. 2010 , publisher=

    2010

  12. [20]

    Proceedings 2000 International Conference on Image Processing (Cat

    Robust image hashing , author=. Proceedings 2000 International Conference on Image Processing (Cat. No. 00CH37101) , volume=. 2000 , organization=

    2000

  13. [21]

    2004 International Conference on Image Processing, 2004

    Robust perceptual image hashing using feature points , author=. 2004 International Conference on Image Processing, 2004. ICIP'04. , volume=. 2004 , organization=

    2004

  14. [22]

    IEEE transactions on Image Processing , volume=

    Perceptual image hashing via feature points: performance evaluation and tradeoffs , author=. IEEE transactions on Image Processing , volume=. 2006 , publisher=

    2006

  15. [23]

    IEEE Transactions on Information Forensics and Security , volume=

    A clustering based approach to perceptual image hashing , author=. IEEE Transactions on Information Forensics and Security , volume=. 2006 , publisher=

    2006

  16. [24]

    IEEE Transactions on Information Forensics and security , volume=

    Robust and secure image hashing , author=. IEEE Transactions on Information Forensics and security , volume=. 2006 , publisher=

    2006

  17. [25]

    , author=

    Robust and secure image hashing via non-negative matrix factorizations. , author=. IEEE Trans. Inf. Forensics Secur. , volume=

  18. [26]

    , author=

    Robust Image Hashing Based on Statistical Invariance of DCT Coefficients. , author=. J. Inf. Hiding Multim. Signal Process. , volume=

  19. [27]

    2011 IEEE 54th International Midwest Symposium on Circuits and Systems (MWSCAS) , pages=

    Robust image hashing using image normalization and SVD decomposition , author=. 2011 IEEE 54th International Midwest Symposium on Circuits and Systems (MWSCAS) , pages=. 2011 , organization=

    2011

  20. [28]

    IEEE Transactions on Image Processing , volume=

    Robust image hashing based on random Gabor filtering and dithered lattice vector quantization , author=. IEEE Transactions on Image Processing , volume=. 2011 , publisher=

    2011

  21. [29]

    International Conference on Active Media Technology , pages=

    Perceptual image hashing with histogram of color vector angles , author=. International Conference on Active Media Technology , pages=. 2012 , organization=

    2012

  22. [30]

    Signal processing , volume=

    Perceptual hashing for color images based on hybrid extraction of structural features , author=. Signal processing , volume=. 2018 , publisher=

    2018

  23. [31]

    Security and Communication Networks , volume=

    Perceptual image hashing based on multitask neural network , author=. Security and Communication Networks , volume=. 2021 , publisher=

    2021

  24. [32]

    IEEE Transactions on Dependable and Secure Computing , volume=

    A new robust reference image hashing system , author=. IEEE Transactions on Dependable and Secure Computing , volume=. 2021 , publisher=

    2021

  25. [33]

    IEEE Transactions on Multimedia , volume=

    Perceptual image hashing using feature fusion of orthogonal moments , author=. IEEE Transactions on Multimedia , volume=. 2024 , publisher=

    2024

  26. [34]

    arXiv preprint arXiv:1912.07745 , year=

    PDQ & TMK+ PDQF--A Test Drive of Facebook's Perceptual Hashing Algorithms , author=. arXiv preprint arXiv:1912.07745 , year=

    1912 arXiv

  27. [35]

    PhotoDNA , howpublished =

  28. [36]

    Championing Open-source DEvelopment in ML Workshop@ ICML25 , year=

    DINOHash: Learning Adversarially Robust Perceptual Hashes from Self-Supervised Features , author=. Championing Open-source DEvelopment in ML Workshop@ ICML25 , year=

  29. [37]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

    Ed Pizzi and Sreya Dutta Roy and Sugosh Nagavara Ravindra and Priya Goyal and Matthijs Douze , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages =

  30. [38]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Kalahash: Knowledge-anchored low-resource adaptation for deep hashing , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  31. [39]

    Proceedings of the 2024 international conference on multimedia retrieval , pages=

    HybridHash: Hybrid convolutional and self-attention deep hashing for image retrieval , author=. Proceedings of the 2024 international conference on multimedia retrieval , pages=

    2024

  32. [40]

    ICASSP 2026-2026 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages=

    Hashing-Baseline: Rethinking Hashing in the Age of Pretrained Models , author=. ICASSP 2026-2026 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages=. 2026 , organization=

    2026

  33. [41]

    arXiv preprint (2022) , author=

    Vit2hash: unsupervised information preserving hashing. arXiv preprint (2022) , author=. arXiv preprint arXiv:2201.05541 , year=

    2022 arXiv

  34. [42]

    2009 IEEE conference on computer vision and pattern recognition , pages=

    Imagenet: A large-scale hierarchical image database , author=. 2009 IEEE conference on computer vision and pattern recognition , pages=. 2009 , organization=

    2009

  35. [43]

    Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13 , pages=

    Microsoft coco: Common objects in context , author=. Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13 , pages=. 2014 , organization=

    2014

  36. [44]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    High-Resolution Image Synthesis with Latent Diffusion Models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  37. [45]

    arXiv preprint arXiv:2406.00918 , year=

    Robustness of practical perceptual hashing algorithms to hash-evasion and hash-inversion attacks , author=. arXiv preprint arXiv:2406.00918 , year=

    arXiv

  38. [46]

    34th USENIX Security Symposium (USENIX Security 25) , year =

    Yuchen Yang and Qichang Liu and Christopher Brix and Huan Zhang and Yinzhi Cao , title =. 34th USENIX Security Symposium (USENIX Security 25) , year =

  39. [47]

    arXiv preprint arXiv:2210.10620 , year=

    Active image indexing , author=. arXiv preprint arXiv:2210.10620 , year=

    arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.