LLM-Guided Program Evolution for Targeted Black-Box Attacks on Perceptual Hash Algorithms

• URL: http://arxiv.org/abs/2607.11472v1
• Date: Mon, 13 Jul 2026 12:25:44 GMT
• Title: LLM-Guided Program Evolution for Targeted Black-Box Attacks on Perceptual Hash Algorithms
• Abstract summary: We propose a novel evolutionary framework based on GigaEvo and OpenEvolve for targeted second-image attacks on perceptual hash algorithms.<n>Experiments on four deployed PHAs (pHash, PDQ, PhotoDNA, NeuralHash) across 30 ImageNet image pairs demonstrate that our approach achieves comparable or better ASR than existing black-box baselines.<n>Unlike gradient-based methods, our framework requires no internal knowledge of PHA architectures and naturally handles the non-differentiable, discretized nature of hash outputs.
• Score: 1.5930557121567526
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Perceptual hash algorithms (PHAs) are widely deployed to detect image forgery under benign transformations, yet their robustness against adversarially chosen perturbations remains poorly understood and rarely comes with provable guarantees. We propose a novel evolutionary framework based on GigaEvo and OpenEvolve for targeted second-image attacks on perceptual hash algorithms. We assess attack performance using a composite score that jointly accounts for the fraction of adversarial images whose normalized Hamming distance to the target hash falls below threshold p (Attack Success Rate), the number of queries issued to the hash function, and the L2 distortion relative to the original image. Experiments on four deployed PHAs (pHash, PDQ, PhotoDNA, NeuralHash) across 30 ImageNet image pairs demonstrate that our evolutionary approach achieves comparable or better ASR than existing black-box baselines using substantially fewer queries to the hash function, while simultaneously producing adversarial images with lower L2 distortion relative to the originals. The best evolved programs reduce the pre-defined composite attack score relative to the best optimized seed by 41.2% for NeuralHash, 38.3% for PDQ, 34.0% for pHash, and 8.1% for PhotoDNA. Unlike gradient-based methods, our framework requires no internal knowledge of PHA architectures and naturally handles the non-differentiable, discretized nature of hash outputs. These results reveal previously unreported vulnerabilities in widely deployed content-moderation pipelines and motivate the development of provably robust perceptual hashing 1schemes.

Related papers

• Collision-Resistant Single-Pass Method for Unsupervised Fine-Grained Image Hashing [1.2289361708127875]
  Unsupervised fine-grained image hashing aims to learn compact binary codes that preserve subtle visual differences.<n>Most existing methods neglect collision resistance, leading to identical hash codes for semantically different samples.<n>We propose Collision-Resistant Single-Pass Self-Supervised Semantic Hashing.
  arXiv  Detail & Related papers  (2026-05-18T12:16:33Z)
• Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attacks [1.9186789478340778]
  This paper assesses the security of three widely utilized PHAs - PhotoDNA, PDQ, and NeuralHash - against hash-evasion and hash-inversion attacks.<n>We provide an explanation for these differing results, highlighting that the inherent robustness is partially due to the random hash variations characteristic of PHAs.
  arXiv  Detail & Related papers  (2024-06-03T01:04:50Z)
• Bit-mask Robust Contrastive Knowledge Distillation for Unsupervised Semantic Hashing [71.47723696190184]
  We propose an innovative Bit-mask Robust Contrastive knowledge Distillation (BRCD) method for semantic hashing. BRCD is specifically devised for the distillation of semantic hashing models.
  arXiv  Detail & Related papers  (2024-03-10T03:33:59Z)
• A Lower Bound of Hash Codes' Performance [122.88252443695492]
  In this paper, we prove that inter-class distinctiveness and intra-class compactness among hash codes determine the lower bound of hash codes' performance. We then propose a surrogate model to fully exploit the above objective by estimating the posterior of hash codes and controlling it, which results in a low-bias optimization. By testing on a series of hash-models, we obtain performance improvements among all of them, with an up to $26.5%$ increase in mean Average Precision and an up to $20.5%$ increase in accuracy.
  arXiv  Detail & Related papers  (2022-10-12T03:30:56Z)
• Weighted Contrastive Hashing [11.14153532458873]
  Unsupervised hash development has been hampered by insufficient data similarity mining based on global-only image representations. We introduce a novel mutual attention module to alleviate the problem of information asymmetry in network features caused by the missing image structure. The aggregated weighted similarities, which reflect the deep image relations, are distilled to facilitate the hash codes learning with a distillation loss.
  arXiv  Detail & Related papers  (2022-09-28T13:47:33Z)
• Self-Distilled Hashing for Deep Image Retrieval [25.645550298697938]
  In hash-based image retrieval systems, transformed input from the original usually generates different codes. We propose a novel self-distilled hashing scheme to minimize the discrepancy while exploiting the potential of augmented data. We also introduce hash proxy-based similarity learning and binary cross entropy-based quantization loss to provide fine quality hash codes.
  arXiv  Detail & Related papers  (2021-12-16T12:01:50Z)
• Adversarial collision attacks on image hashing functions [9.391375268580806]
  We show that it is possible to modify an image to produce an unrelated hash, and an exact hash collision can be produced via minuscule perturbations. In a white box setting, these collisions can be replicated across nearly every image pair and hash type. We offer several potential mitigations to gradient-based image hash attacks.
  arXiv  Detail & Related papers  (2020-11-18T18:59:02Z)
• Deep Momentum Uncertainty Hashing [65.27971340060687]
  We propose a novel Deep Momentum Uncertainty Hashing (DMUH) It explicitly estimates the uncertainty during training and leverages the uncertainty information to guide the approximation process. Our method achieves the best performance on all of the datasets and surpasses existing state-of-the-art methods by a large margin.
  arXiv  Detail & Related papers  (2020-09-17T01:57:45Z)
• Pairwise Supervised Hashing with Bernoulli Variational Auto-Encoder and Self-Control Gradient Estimator [62.26981903551382]
  Variational auto-encoders (VAEs) with binary latent variables provide state-of-the-art performance in terms of precision for document retrieval. We propose a pairwise loss function with discrete latent VAE to reward within-class similarity and between-class dissimilarity for supervised hashing. This new semantic hashing framework achieves superior performance compared to the state-of-the-arts.
  arXiv  Detail & Related papers  (2020-05-21T06:11:33Z)
• Reinforcing Short-Length Hashing [61.75883795807109]
  Existing methods have poor performance in retrieval using an extremely short-length hash code. In this study, we propose a novel reinforcing short-length hashing (RSLH) In this proposed RSLH, mutual reconstruction between the hash representation and semantic labels is performed to preserve the semantic information. Experiments on three large-scale image benchmarks demonstrate the superior performance of RSLH under various short-length hashing scenarios.
  arXiv  Detail & Related papers  (2020-04-24T02:23:52Z)
• Targeted Attack for Deep Hashing based Retrieval [57.582221494035856]
  We propose a novel method, dubbed deep hashing targeted attack (DHTA), to study the targeted attack on such retrieval. We first formulate the targeted attack as a point-to-set optimization, which minimizes the average distance between the hash code of an adversarial example and those of a set of objects with the target label. To balance the performance and perceptibility, we propose to minimize the Hamming distance between the hash code of the adversarial example and the anchor code under the $ellinfty$ restriction on the perturbation.
  arXiv  Detail & Related papers  (2020-04-15T08:36:58Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.