Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retraining

2026-08-04

AI Summary

This work addresses the vulnerability of deep perceptual hashing systems to adversarial perturbations, which enable near-duplicate images to evade detection—posing serious risks to content moderation and copyright enforcement. To counter this threat, the authors propose DualShield, a plug-and-play defense framework that requires no model retraining. DualShield uniquely achieves both empirical and provable robustness by combining randomized smoothing during matching with imperceptible perturbations applied to reference images prior to deployment—all without altering the underlying hashing model. The method is compatible with diverse deep hashing architectures and demonstrates consistent efficacy across eight models and three benchmark datasets, substantially reducing attack success rates while yielding a provable ℓ² robustness radius of approximately 0.3 and maintaining a low hash collision rate.

Abstract

Near-duplicate image matching is crucial for trust and safety, provenance verification, copyright enforcement, and large-scale visual search. Modern platforms increasingly rely on deep perceptual hashes, which map visually similar images to nearby representations despite common image transformations. However, adversarial perturbations can cause near-duplicates to evade matching. We present DualShield, a plug-in defense that improves the robustness of existing deep perceptual hashes without retraining or modifying their underlying models. DualShield combines matching-time randomized smoothing, which aggregates decisions over perturbed reference-query pairs, with publication-time hardening, which adds an optimized imperceptible perturbation to each reference image before publication. Together, these mechanisms provide certified and empirical robustness. DualShield achieves a certified $\ell_2$ radius of approximately 0.3, guaranteeing that query perturbations within this radius cannot evade matching. We further evaluate it against adaptive white-box, black-box, and image-transformation attacks. Across eight deep perceptual hashes and three datasets, DualShield substantially reduces attack success rates while preserving low collision rates. These results show that deep perceptual hashes can be strengthened without costly retraining by improving the matching procedure and hardening reference images before publication.

Problem

• deep perceptual hashes
• evasion attacks
• adversarial perturbations
• near-duplicate image matching
• robustness

Innovation

• perceptual hashing
• adversarial robustness
• randomized smoothing
• evasion attacks
• certified defense