REVIEW 4 major objections 6 minor 15 references
Perceptual Hash Inversion Attacks on Image-Based Sexual Abuse Removal Tools
T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash
Pith's one-line read Perceptual hashes designed as irreversible fingerprints of intimate images can be inverted on consumer-grade hardware, producing recognizable approximations of the originals.
desk verdict First inversion attacks on PDQ and NeuralHash, but the quantitative evaluation is circular and the practical claim is stronger than the numbers support. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the Pix2Pix conditional GAN, a generative adversarial network for image-to-image translation. The attack renders a perceptual hash as a square grid of black-and-white pixels (or 0–255 greyscale values for PhotoDNA) and trains the generator on pairs $(H(x_i), x_i)$ of hashes and original images, so that after training the network maps a bare hash grid to a 256×256 approximation of the pre-image. The pixel-grid hash representation is what carries the argument: each hash bit becomes a spatial position, letting the network learn position-dependent correlations between hash bits and facial features.
What would settle it
Re-run the evaluation replacing perceptual-hash similarity with independent visual quality metrics such as SSIM or human recognition rates and compare reconstructions against an average-face baseline; if the outputs are no more recognizable than that baseline, the quantitative success would be an artefact of the chosen metric rather than genuine pre-image recovery.
Extended reading notes
Core claim
The central claim is that perceptual hashing—a technique intended to be irreversible—can be inverted in practice: given only a hash digest, a Pix2Pix conditional GAN trained on 1,000 face images for 500 epochs on an old 8 GB GPU produces images that share most perceptual hash bits with the original and visibly preserve hair color, face shape, and other features. The paper reports mean perceptual similarities between roughly 54% and 96% depending on the hash function and evaluation metric, with best-case reconstructions reaching 100% under aHash for aHash and PhotoDNA attacks and 96.88% for NeuralHash and PDQ attacks. It concludes that perceptual hash values must be treated almost as sensitively as the original images, that the current design of services such as Take It Down is inherently insufficient, and that secure hash matching via private set intersection is the needed alternative.
Load-bearing premise
The attack's success is measured by how closely the reconstructed image's perceptual hash matches the original image's perceptual hash—the same hash functions under attack—so the conclusion that private visual information leaks depends on hash-bit agreement meaning real visual recovery.
Editorial extensions
If this is right
- Uploaded perceptual hashes of sensitive material should be protected almost as carefully as the original images, because an attacker who obtains the digests can reconstruct recognizable likenesses.
- Clear-text hash matching in IBSA removal tools is not privacy-preserving as currently deployed; the stated promise that images cannot be reverse engineered from hashes is contradicted by the results.
- The attack is black-box and adaptable to any perceptual hash function, so changing to a different hash algorithm would not by itself remove the vulnerability.
- Private set intersection would let platforms match user-reported hashes against stored content without revealing hashes that do not match, preventing mass inversion of non-matching reports.
- Users should be cautious about preemptively reporting material that is not yet online, since exposing its hash could reveal the underlying image to a compromised service provider.
Reading between the lines
- The quantitative success metric is self-referential: similarity is measured by the very perceptual hash functions being attacked, so independent visual metrics such as SSIM or human recognition tests would be needed to confirm that hash-bit agreement means meaningful visual recovery.
- Training exclusively on celebrity face images may set an upper bound on what the GAN can reconstruct; full-body imagery or general scenes could behave differently, and the paper itself leaves this as future work.
- A stronger test would compare reconstructions against a trivial baseline, such as the dataset's average face or random images engineered to share hash bits, to separate information actually leaked by the hash from prior knowledge the GAN learned about faces.
- If inversion at this scale is practical, hash databases may warrant legal treatment as sensitive personal data rather than as anonymous fingerprints, affecting how breach disclosures and retention policies are designed.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper studies inversion attacks on perceptual hash functions used in image-based sexual abuse (IBSA) detection and removal tools. It trains Pix2Pix conditional GANs on (hash, image) pairs from a 1000-image CelebA subset and reconstructs approximations of original images from aHash, PDQ, NeuralHash, and PhotoDNA hashes, claiming the first known inversion attacks on PDQ and NeuralHash. The authors evaluate their reconstructions using a perceptual similarity metric defined as 1 minus the normalized Hamming distance between the hashes of the original and reconstructed images, report high mean and best-case similarities in Table 2, and provide qualitative examples in Figure 4. They conclude that perceptual hash values should be treated almost as carefully as original images and propose private set intersection as a secure alternative for hash matching in services like NCMEC's Take It Down.
Significance. If the central claim holds, this is a timely and societally important result: it demonstrates that perceptual hashes used by deployed IBSA tools can leak visual information, contradicting Take It Down's FAQ, and it extends known inversion attacks to PDQ and NeuralHash. The use of consumer-grade hardware and a small training set strengthens the practical relevance, and the responsible-disclosure discussion is thoughtful. The proposed PSI-based mitigation is a reasonable direction. However, the current quantitative evaluation is not independent of the attacked hash functions and lacks standard image-similarity metrics and baselines, so the strength of the privacy leakage is not yet rigorously established. The qualitative examples are suggestive and make the paper worth pursuing, but the central quantitative claim needs substantial additional support.
major comments (4)
- [Results, Table 2 and Eq. (1)] The quantitative evaluation defines perceptual similarity as 1 minus the normalized Hamming distance between the hashes of the target and reconstructed images, using the same hash functions the attack targets. Because the generator is conditioned on the attacked hash, high agreement on that same hash is not independent evidence of visual recovery; the model could learn to match hash bits without reproducing the pre-image's visual content. The cross-hash rows in Table 2 illustrate this concern: when PDQ is used as the evaluation metric, mean similarities for all attacked hashes are only 53-61%, close to the 50% expected for random bit strings. To support the paper's central claim that hashes should be treated like original images, the authors need to report standard visual-similarity metrics (e.g., SSIM, LPIPS, face-embedding cosine, or a human perceptual study) in addition to hash-based metrics. The Limitations section's deferral of such metrics to future work leaves the quantitative claim unsubstantiated.
- [Results, Table 2] No baseline or control condition is reported for the quantitative results. The authors do not compare against reconstructions from random hash values, a constant/zero hash, or an unconditional generator. Because all training images are aligned celebrity faces, the model may produce generic face-like outputs that incidentally satisfy a substantial fraction of hash bits; without such a baseline, the reported similarities cannot be attributed to information extracted from the hash itself. I recommend adding a control condition and reporting per-condition distributions and test-set sizes.
- [Limitations and Discussion] The evaluation is limited to 256x256 celebrity face crops from CelebA, while the systems under discussion, including Take It Down, process arbitrary user images and videos of sensitive content, including non-face and underage subjects. The Limitations section acknowledges this and cites prior work on full-body generation, but that is not a substitute for a direct test on representative non-face content. As written, the Discussion's claim that the current approach to services such as TID is 'inherently insufficient' is stronger than the evidence supports. A small experiment on non-celebrity or non-face images, or a clearly argued reason why face-specific leakage suffices for the threat model, is needed.
- [Results] The sentence claiming that 'since the space of all perceptual hash values is much smaller than the space of all images, each matching bit of the hash represents a matching feature of the image' is not a valid inference. Hash bits are not guaranteed to correspond to independent, perceptually meaningful visual features, and a conditional generator can align bits spuriously. This sentence is used to justify interpreting near-50% hash similarity as reconstructing 50% of image features; it should be removed or replaced with empirical evidence linking hash-bit agreement to visual similarity.
minor comments (6)
- [Perceptual Hash Inversion Attacks, Training and Evaluation Setup] In the pipeline description, 'training and valuation' should be 'training and validation'.
- [Table 1] The symbol 'D' appears in the body of the table but is not defined in the caption or legend; please clarify what it denotes.
- [Secure Hash Matching via Private Set Intersection] The statement that 'all commonly used PHFs are vulnerable' overstates the evidence, which covers only the four functions studied here; the text should say 'all studied PHFs'.
- [Figure 5] The y-axis label 'Number of test images in percent' is confusing; it should read 'Percentage of test images'.
- [Limitations] The claim that generative AI 'performs equally well' on full-body shapes cites [14] (InsetGAN), which is a different task; please soften the wording to reflect what the cited work actually shows.
- [Introduction] The statement that NCMEC reports show an 'exponential increase' in reported images would benefit from a specific citation and the relevant time period.
Circularity Check
Quantitative evidence for hash inversion is circular: Table 2's 'perceptual similarity' is hash-bit agreement under the same hash functions being attacked, so the high diagonal scores do not by themselves establish visual leakage.
-
self definitional
[Section 'Perceptual Hash Inversion Attacks' -> 'Results', Table 2; Eq. (1) in 'Perceptual Hash Functions'.]
"To evaluate our results more objectively over the entire dataset, we define perceptual difference (PD) as the normalized Hamming difference between the perceptual hashes of a target image and attack-generated image, and define perceptual similarity as the inverse percentage (1 − PD) ∗ 100."
Table 2's quantitative success metric is the inverse of Eq. (1), i.e., the normalized Hamming distance between the outputs of the same perceptual hash functions the attack is designed to invert. For the diagonal cells (e.g., aHash attacked, evaluated under aHash), the generator was conditioned on H(x), and the score measures agreement with that conditioning value, not independent visual fidelity. The paper's own cross-hash results expose the dependence: aHash reconstructions score 96.40% under aHash but only 57.70% under PDQ, near the 50% random baseline.
full rationale
The paper's attack pipeline itself is not circular: the Pix2Pix model is trained on (H(x_i), x_i) pairs with an L1 plus GAN objective, and the qualitative reconstructions in Figure 4 provide some independent evidence that visual features are recovered. However, the only quantitative support for the paper's central claim—that perceptual hash values should be treated almost as carefully as original images—is Table 2, where 'perceptual similarity' is defined as 1 minus the normalized Hamming distance between the hashes of the target and the reconstruction. For diagonal entries, the evaluation metric is the same function whose inversion is claimed, so a high score can be obtained by reproducing hash-relevant structure without reproducing the pre-image's visual content. The paper itself shows the fragility of this metric: the aHash attack scores 96.40% under aHash but only 57.70% under PDQ, close to chance. The Limitations section explicitly defers SSIM, LPIPS, and human studies to future work, so the privacy-leakage claim rests on a self-referential metric plus subjective examples. This is partial circularity: the quantitative 'prediction' of visual similarity reduces to hash-bit agreement, but the qualitative results are independent. No load-bearing self-citation or imported uniqueness theorem is present.
Assumptions & free parameters
assumptions (3)
- domain assumption CelebA face images are a valid proxy for the sensitive images handled by IBSA removal tools.
- domain assumption Normalized Hamming distance between perceptual hashes is a valid objective measure of reconstruction quality.
- domain assumption A single Pix2Pix GAN training run on 1000 images for 500 epochs yields a representative attack model.
Cite this review
Pith. "Pith review of Perceptual Hash Inversion Attacks on Image-Based Sexual Abuse Removal Tools." pith.science (2026). https://pith.science/paper/BKPUTCR3
@misc{pith2026241206056,
author = {Pith},
title = {Pith review of: Perceptual Hash Inversion Attacks on Image-Based Sexual Abuse Removal Tools},
year = {2026},
howpublished = {\url{https://pith.science/paper/BKPUTCR3}},
note = {Machine review of arXiv:2412.06056}
}
read the original abstract
We show that perceptual hashing, crucial for detecting and removing image-based sexual abuse (IBSA) online, faces vulnerabilities from low-budget inversion attacks based on generative AI. This jeopardizes the privacy of users, especially vulnerable groups. We advocate to implement secure hash matching in IBSA removal tools to mitigate potentially fatal consequences.
Reference graph
Works this paper leans on
-
[1]
A. A. Eaton and C. McGlynn, “The psychology of nonconsensual porn: Understanding and addressing a growing form of sexual violence,” Policy Insights from the Behavioral and Brain Sciences , vol. 7, no. 2, pp. 190–197, 2020
work page 2020
-
[2]
Adversarial collision attacks on image hashing functions
B. Dolhansky and C. Canton-Ferrer, “Adversarial col- lision attacks on image hashing functions,” CoRR, vol. abs/2011.09473, 2020
work page Pith review arXiv 2011
-
[3]
S. Jain, A. Cretu, and Y . de Montjoye, “Adversarial detection avoidance attacks: Evaluating the robust- ness of perceptual hashing-based client-side scan- ning,” in USENIX Security Symposium , pp. 2317– 2334, USENIX Association, 2022
work page 2022
-
[4]
Learning to break deep perceptual hashing: The use case neuralhash,
L. Struppek, D. Hintersdorf, D. Neider, and K. Kersting, “Learning to break deep perceptual hashing: The use case neuralhash,” in FAccT, pp. 58–69, ACM, 2022
work page 2022
-
[5]
Exploiting and Defending Against the Approximate Linearity of Apple's NeuralHash
J. S. Bhatia and K. Meng, “Exploiting and defending against the approximate linearity of apple’s neural- hash,” CoRR, vol. abs/2207.14258, 2022
work page Pith review arXiv 2022
-
[6]
Squint hard enough: Attacking perceptual hashing with adversarial machine learning,
J. Prokos, N. Fendley, M. Green, R. Schuster, E. Tromer, T. M. Jois, and Y . Cao, “Squint hard enough: Attacking perceptual hashing with adversarial machine learning,” in USENIX Security Symposium , USENIX Association, 2023
work page 2023
-
[7]
L. Qin, V. Hamilton, S. Wang, Y . Aydinalp, M. Scarlett, and E. M. Redmiles, “‘Did they f***ing consent to that?’: Safer digital intimacy via proactive protection against image-based sexual abuse,” in USENIX Secu- rity Symposium , USENIX Association, 2024
work page 2024
-
[8]
S. Jain, A. Cretu, A. Cully, and Y . de Montjoye, “Deep perceptual hashing algorithms with hidden dual pur- pose: when client-side scanning does facial recogni- tion,” in SP, pp. 234–252, IEEE, 2023
work page 2023
Show all 15 references
-
[9]
Public verification for private hash matching,
S. Scheffler, A. Kulshrestha, and J. R. Mayer, “Public verification for private hash matching,” in SP, pp. 253– 273, IEEE, 2023
2023
-
[10]
An overview of perceptual hashing,
H. Farid, “An overview of perceptual hashing,” Jour- nal of Online T rust and Safety , vol. 1, 2021
2021
-
[11]
Evaluating robustness of perceptual image hashing algorithms,
A. Drmic, M. Silic, G. Delac, K. Vladimir, and A. S. Kurdija, “Evaluating robustness of perceptual image hashing algorithms,” in MIPRO, pp. 995–1000, IEEE, 2017
2017
-
[12]
Re-purposing perceptual hashing based client side scanning for physical surveillance,
A. Hooda, A. Labunets, T. Kohno, and E. Fer- nandes, “Re-purposing perceptual hashing based client side scanning for physical surveillance,” CoRR, vol. abs/2212.04107, 2022
2022 arXiv
-
[13]
Image- to-image translation with conditional adversarial net- works,
P . Isola, J. Zhu, T. Zhou, and A. A. Efros, “Image- to-image translation with conditional adversarial net- works,” in CVPR, pp. 5967–5976, IEEE, 2017
2017
-
[14]
Insetgan for full-body image generation,
A. Frühstück, K. K. Singh, E. Shechtman, N. J. Mitra, P . Wonka, and J. Lu, “Insetgan for full-body image generation,” in CVPR, pp. 7713–7722, IEEE, 2022
2022
-
[15]
Private set intersection: A systematic literature review,
D. M. Escalera, I. Agudo, and J. López, “Private set intersection: A systematic literature review,” Comput. Sci. Rev., vol. 49, p. 100567, 2023. 10
2023
Reviewed August 11, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.