This post is a technical follow-up to “64 Bits Decide What You Can Upload to the Internet”. If you haven’t read that yet, I recommend starting there. Here, we assume you understand what a perceptual hash is and why PhotoDNA, PDQ, and NeuralHash are close cousins.

On August 5, 2021, Apple announced NeuralHash. By August 18—just thirteen days later—a pseudonymous researcher named Asuhariet Ygvar published a complete reverse-engineering of the model, extracted from iOS binaries, on GitHub. Within days, two independent researchers—Brad Dwyer and others—published collisions: visually distinct images producing the exact same hash. The system that Apple had promised to deliver with a false positive rate of “one in a trillion accounts per year” was shown to be attackable using consumer-grade hardware.

The public reaction focused on “Apple messed up.” Subsequent technical analysis suggested otherwise: Apple didn’t botch the system. Instead, adversarial fragility is a structural property of the perceptual hash family. NeuralHash, if anything, was one of the more sophisticated designs on the market.

Five years later, the European Union is legislating to mandate deploying this same technology on platforms like WhatsApp, Signal, and Telegram. The regulation assumes the algorithm is an invariant primitive, comparable to something like SHA-256. It’s not.

Accidental Collision vs. Adversarial Collision

If you’re familiar with cryptographic hashes, you might picture a collision as a rare, accidental event whose likelihood is mathematically determined as 2^(-n), where n is the number of bits. For SHA-256, this means 2^128 operations to find a collision—computationally infeasible with known infrastructure.

Perceptual hashes are a different type of construct. The distinction matters.

Accidental Collision. Two legitimate, independently created images that coincidentally produce the same hash. For a 64-bit perceptual hash, the probability isn’t 2^(-64); it’s significantly higher due to the statistical patterns in the “realistic” images people create (as opposed to random noise). The actual probability depends on the dataset distribution but is often orders of magnitude above the theoretical minimum.

Adversarial Collision. Two deliberately generated images that produce the same hash despite being visually distinct. Here, the difference is qualitative. For a perceptual hash:

  • The hash space is small (64-96 bits).
  • The hash function is “smooth”—small changes in pixel values lead to correspondingly small changes in the hash. While this property ensures tolerance to re-encoding, it also makes the system vulnerable to attacks.
  • CNN-based hashes like NeuralHash are differentiable, enabling attackers to use gradient descent to directly compute a collision.
  • Traditional hashes (e.g., pHash, PDQ) aren’t differentiable in the same sense, but they can still be attacked using local search methods and standard ML heuristics.

Practically speaking, finding an adversarial collision in a perceptual hash is an optimization problem that a master’s student in machine learning could likely solve in an afternoon using PyTorch and a consumer-grade GPU.

Three Types of Attacks, Three Different Consequences

Literature from 2021–2023 categorizes three types of attacks, each with distinct operational implications.

Arbitrary Collision

Given a hash algorithm H, find two visually distinct images x₁ and x₂ such that H(x₁) = H(x₂). This is the easiest attack: it’s practically guaranteed if the hash space is small. Ygvar’s August 2021 collisions were of this kind: a dog and a gray landscape, visually unrelated, that produced the same 96-bit NeuralHash.

Operational Use: Undermine the system’s credibility. Demonstrating public collisions negates the premise that the hash is a reliable identifier.

Targeted Preimage

Given a target hash h₀ (e.g., one from the NCMEC database or guessed), generate an innocent-looking image x such that H(x) = h₀. This is the most concerning attack operationally.

Operational Use: Harass victims. An attacker creates an innocuous image of, say, cats that matches the hash of a known CSAM image. They send it via WhatsApp. The scanning system triggers an alert. Even if a human review clears the image as innocent, the process costs time, legal resources, and potentially smears the recipient’s reputation. At scale—thousands of victims targeted simultaneously—the system becomes unmanageable.

In 2021, Apple claimed this attack wasn’t feasible because the NCMEC database is private, so attackers wouldn’t know the target hashes. However, Prokos et al. (USENIX Security 2023) demonstrated that this claim is naive: attackers don’t need individual hashes—they just need access to a reference image from the target set, which sophisticated adversaries can often obtain with ease.

Evasion

Given a known image x (e.g., CSAM already in a hash database), generate a modified version x’ that is visually indistinguishable to human eyes but produces a different hash. This attack nullifies the intended utility of the system.

Operational Use: Real CSAM distributors apply the attack to their materials. The scanning system fails to detect these modified copies, even when they are pixel-for-pixel identical to the human eye. As adversarial variations grow faster than new material is added to the NCMEC databases, detection effectiveness degrades over time.

The NeuralHash Case Study

The collapse of NeuralHash is both a case study in vulnerability and a cautionary tale for policymakers.

August 5, 2021. Apple announces its CSAM Detection package, asserting a false positive rate of one in a trillion accounts per year based on internal tests with a reference dataset.

August 18, 2021. Asuhariet Ygvar publishes AppleNeuralHash2ONNX on GitHub. The project extracts the NeuralHash model from iOS 14.7 binaries and converts it to ONNX format, enabling execution on any device. No privileged access is needed; CoreML models can be extracted by any user with a jailbroken iPhone or static kernel analysis.

August 19, 2021. Users of Ygvar’s repo share the first collision: two distinct images (collision1.png and collision2.png) that produce the same 96-bit NeuralHash. The method involves gradient-based optimization on the extracted model, achievable in roughly 50 lines of PyTorch code.

August 20–27, 2021. Apple confirms the demonstrated collisions but downplays their operational significance, arguing that (a) the NCMEC database is closed, and (b) alerts are only triggered after 30 matches. Critics point out: (a) the database need not be fully known because reference images from the set are easily accessible to skilled actors, and (b) the 30-match threshold becomes trivial when an attacker can generate N collisions at will.

September 2021. Apple delays rollout. Behind the scenes, this decision appears tied to the difficulty of defending the system technically without publicly admitting its architectural flaws.

2023. Prokos, Fendley, Green, Jois, and Cao publish “Squint Hard Enough: Attacking Perceptual Hashing with Adversarial Machine Learning” at USENIX Security. Their paper details the three types of attacks against NeuralHash, PhotoDNA (black-box), and PDQ, achieving attack success rates above 80% using standard adversarial ML techniques. The findings unequivocally demonstrate that this fragility is not a bug in NeuralHash; it is a structural property of the entire perceptual hash family.

What About PhotoDNA and PDQ?

A common counterpoint is that “NeuralHash was vulnerable because it’s CNN-based; PhotoDNA is classical and therefore secure.” This assumption is wrong.

PhotoDNA, a proprietary Microsoft technology, cannot be directly audited. Yet Prokos et al. conducted black-box attacks, showing that an attacker doesn’t need to know the algorithm’s internal workings—only its input/output behavior, as accessed through services utilizing it. In experimental conditions, these black-box attacks achieved 75-80% success rates for generating collisions against PhotoDNA.

Meanwhile, Meta’s open-source PDQ hash is fully auditable, making it susceptible to gradient-based attacks. Prokos and colleagues successfully broke PDQ with methods similar to those used against NeuralHash, achieving comparable success rates despite slight variations.

The underlying issue is fundamental: every perceptual hash must be “smooth” to be usable. If it isn’t smooth, it won’t tolerate re-encoding or slight modifications and loses its primary utility. But being smooth also inherently makes these hashes attackable. Robustness and operational tolerance are mutually exclusive by design.

PhotoDNA, PDQ, pHash, dHash, aHash, NeuralHash—none are immune to these attacks. While the difficulty and success rates vary, they are all broken to some degree. As of now, no perceptual hash exists in the academic literature that successfully balances operational stability with robustness against adversarial attacks.

Implications for Regulation

This is the crux of the debate around Chat Control.

The CSA Regulation proposed by the European Commission mandates service providers to detect CSAM in encrypted messages using client-side scanning. The regulation, written to be technology-neutral, mentions “perceptual hash matching” as an acceptable method. The critical issue: the regulation treats these algorithms as if they are cryptographically robust primitives. They are not. The operational consequences are clear:

Sophisticated actors will evade detection. CSAM distributors with moderate technical skills can implement published evasion techniques, enabling their content to circulate undetected. The regulation’s promise of reliable detection fails to address its primary target audience.

Everyday users become vulnerable to weaponized raids. Attackers can craft benign images with hashes matching known CSAM and mass-send them to victims (political opponents, ex-partners, journalists, dissidents). This triggers alerts, legal scrutiny, and reputational harm for the victims. The system creates a new vector for legal harassment.

Non-technical intermediaries bear the brunt. Individuals who inadvertently distribute flagged content—often without malicious intent—are the most likely to be caught, whereas resourceful criminals escape detection. The resulting bias risks punishing the wrong people.

The combined effect of these issues is catastrophic: the cost per genuine detection case increases, and the true positive/false positive ratio rapidly deteriorates. At scale, the system generates more noise than signal. Studies of PhotoDNA’s real-world effectiveness by organizations like NCMEC already suggest we are nearing this threshold, though public data is limited by provider bias.

Civil organizations opposing the regulation—Access Now, EFF, EDRi, CCC—don’t argue purely from a “privacy above all” standpoint. Their case stems from projected inefficacy: a system built on adversarial fragility cannot fulfill its purpose and opens the door to predictable political abuses the regulation doesn’t address.

What This Means for You

This isn’t an argument against combating CSAM. No serious researcher in cryptography or security would suggest abandoning that objective. Instead, this is an argument against constructing a regulatory framework that relies on known-vulnerable algorithms, whose adversarial fragility has been openly documented in top-tier academic research for over four years.

Serious systems—such as those used by NCMEC, Meta, or Microsoft—rely on a combination of perceptual hashing, CNN classifiers trained against adversarial attacks, human review in escalation chains, network and metadata analysis, and traditional law enforcement cooperation. Perceptual hashes serve as a cost-effective initial filter, not the backbone of the entire process.

The European regulation is enshrining “use perceptual hash matching” into law. Legislation lasts decades. Algorithms change within months. This technological-politico timing mismatch is a trap that will be virtually impossible to unwind once codified.

Actionable steps for technical readers:

  1. Read the Prokos et al. (2023) paper. It’s 40 pages long, and the experimental results section—tables of success rates for each attack and hash type—is particularly valuable for any public discussion. Prior knowledge of adversarial ML is not required to understand these results.
  2. Try executing an attack locally. Ygvar’s GitHub repository (AppleNeuralHash2ONNX) is still available. With a modest GPU, you could reproduce these collisions yourself in a couple of hours. Experiencing these vulnerabilities firsthand underscores the problem in a way that theory alone cannot.
  3. Advocate with evidence. When you discuss the CSA Regulation—professionally, on social media, or with policymakers—rely on the argument that “it’s adversarially fragile and this is well-documented in the literature.” This argument is verifiable and less polarizing than “this is a breach of privacy” (even if the latter is undoubtedly true).

Building policy infrastructure on top of a technology that can be defeated within an afternoon using PyTorch isn’t just a technical mistake. It’s a governance failure. The real question is whether an informed Parliament would make such a choice.

References

  • Prokos, J.; Fendley, N.; Green, M.; Jois, T. M.; Cao, Y. “Squint Hard Enough: Attacking Perceptual Hashing with Adversarial Machine Learning”. USENIX Security Symposium, 2023 (arXiv:2112.09283).
  • Ygvar, A. “AppleNeuralHash2ONNX”. GitHub, August 2021. Reverse-engineered NeuralHash and generated collisions.
  • Struppek, L.; Hintersdorf, D.; Neider, D.; Kersting, K. “Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash”. ACM FAccT, 2022 (arXiv:2111.06628).
  • Jain, S.; Crețu, A.-M.; de Montjoye, Y.-A. “Adversarial Detection Avoidance Attacks: Evaluating the Robustness of Perceptual Hashing-Based Client-Side Scanning”. USENIX Security, 2022.
  • Abelson, H.; Anderson, R.; Bellovin, S. M.; et al. “Bugs in Our Pockets: The Risks of Client-Side Scanning”. arXiv:2110.07450, 2021.
  • Meta. PDQ Whitepaper. GitHub: facebook/ThreatExchange, 2019.
  • Apple. “CSAM Detection Technical Summary,” August 2021. Archived; no longer officially published.

This article was originally published in Spanish and translated with the help of AI.