# SuperNeuro: A Fast and Scalable Simulator for Neuromorphic Computing

Prasanna Date<EMAIL_ADDRESS>0000-0002-1664-069X Oak Ridge National
LaboratoryOak RidgeTennesseeUSA ,  Chathika Gunaratne<EMAIL_ADDRESS>0000-0002-2508-8745 Oak Ridge National LaboratoryOak RidgeTennesseeUSA ,
Shruti Kulkarni<EMAIL_ADDRESS>0000-0001-6894-9851 Oak Ridge National
LaboratoryOak RidgeTennesseeUSA ,  Robert Patton<EMAIL_ADDRESS>0000-0002-8101-0571 Oak Ridge National LaboratoryOak RidgeTennesseeUSA ,  Mark
Coletti<EMAIL_ADDRESS>Oak Ridge National LaboratoryOak RidgeTennesseeUSA
and  Thomas Potok<EMAIL_ADDRESS>0000-0001-6687-3435 Oak Ridge National
LaboratoryOak RidgeTennesseeUSA

(2023)

###### Abstract.

In many neuromorphic workflows, simulators play a vital role for important
tasks such as training spiking neural networks (SNNs), running neuroscience
simulations, and designing, implementing and testing neuromorphic algorithms.
Currently available simulators are catered to either neuroscience workflows
(such as NEST and Brian2) or deep learning workflows (such as BindsNET). While
the neuroscience-based simulators are slow and not very scalable, the deep
learning-based simulators do not support certain functionalities such as
synaptic delay that are typical of neuromorphic workloads. In this paper, we
address this gap in the literature and present SuperNeuro, which is a fast and
scalable simulator for neuromorphic computing, capable of both homogeneous and
heterogeneous simulations as well as GPU acceleration. We also present
preliminary results comparing SuperNeuro to widely used neuromorphic
simulators such as NEST, Brian2 and BindsNET in terms of computation times. We
demonstrate that SuperNeuro can be approximately 10–300 times faster than some
of the other simulators for small sparse networks. On large sparse and large
dense networks, SuperNeuro can be approximately 2.2 and 3.4 times faster than
the other simulators respectively.

Neuromorphic Computing, Neuromorphic Simulator, Neuromorphic Algorithm,
Neuromorphic Software, Spiking Neural Networks, General-Purpose Neuromorphic
Computing

††copyright: acmcopyright††journalyear: 2023††doi:
XXXXXXX.XXXXXXX††conference: International Conference on Neuromorphic Systems;
August 1–3, 2023; Santa Fe, NM††price: 15.00††isbn:
978-1-4503-XXXX-X/18/06††ccs: Hardware Biology-related information
processing††ccs: Software and its engineering Software libraries and
repositories††ccs: Computer systems organization Embedded systems††ccs:
Computer systems organization Redundancy††ccs: Computer systems organization
Robotics††ccs: Networks Network reliability

##  1\. Introduction

Neuromorphic computing is a promising computing paradigm for low-power
applications (schuman2022opportunities, ), which span neuroscience
simulations, autonomous vehicles, anomaly detection, graph algorithms,
epidemiological modeling, scientific applications etc.
(patton2021neuromorphic, ; hamilton2020modeling, ; cong2022semi, ;
date2018efficient, ; hamilton2020spike, ; markram2006blue, ). If used in a
machine learning setting, training spiking neural networks (SNNs) is a
critical component of the neuromorphic workflow—this is usually done on CPUs
or GPUs (bhuiyan2010acceleration, ). If used in a non-machine learning
setting, it is important to design, implement and test novel neuromorphic
algorithms efficiently and rapidly (aimone2022review, ). Both the above use
cases benefit from an efficient simulator.

Unlike CPUs and GPUs, neuromorphic hardware is not readily available off-the-
shelf (kulkarni2021benchmarking, ). It is typically available at research
groups scattered throughout the globe and only as research-grade prototype
devices such as Intel Loihi, IBM TrueNorth and SpiNNaker (davies2018loihi, ;
debole2019truenorth, ; furber2014spinnaker, ). As a result, it is difficult to
work with the neuromorphic hardware directly, especially for researchers who
design novel neuromorphic algorithms or train SNNs for their applications. To
mitigate this lack of availability of neuromorphic hardware, an efficient
neuromorphic computing simulator is indispensable.

Neuromorphic algorithms inform the design of the neuromorphic hardware in many
ways (schuman2022opportunities, ). For instance, some neuromorphic algorithms
require dense connectivity, whereas others require sparse connectivity. Some
algorithms require floating point synaptic weights, whereas others require
binary (0, 1) weights. To enable this co-design between neuromorphic
algorithms and hardware, simulators play a vital role. They establish the
requirements for the neuromorphic algorithms, making it possible to realize
these requirements on the hardware.

The current neuromorphic computing simulators are primarily focused on either
neuroscience workloads, or deep learning workloads (kulkarni2021benchmarking,
). The neuroscience-based simulators such as NEST (based on discrete event
simulation), and Brian2 (based on solving system of ordinary differential
equations) are slow for SNN-based machine learning and general-purpose
computing applications (Gewaltig:NEST, ; stimberg2019brian, ;
kulkarni2021benchmarking, ). On the other hand, the deep learning-based
simulators such as snntorch and BindsNET do not provide all the features—for
instance, synaptic delays—needed for neuroscience and general-purpose
neuromorphic computing applications (eshraghian2021training, ;
hazan2018bindsnet, ).

To this extent, we present SuperNeuro, a fast and scalable Python-based
simulator for neuromorphic computing with GPU acceleration capability.
SuperNeuro models the neuromorphic simulation problem using two different
approaches: a matrix computation-based approach (MAT) and an agent-based
modeling (ABM) approach. To the best of our knowledge, the neuromorphic
simulation problem has not been modeled using these approaches in the
literature. SuperNeuro provides a development framework for accelerating
neuromorphic simulations with the flexibility to define custom neuron and
synapse models, while utilizing computationally efficient algorithms and
hardware for highly scalable simulations. SuperNeuro provides the AI
practitioner the capability of studying and optimizing SNNs of large-scale
regardless of the current availability of neuromorphic hardware. It also
allows the practitioner to implement general-purpose computing algorithms such
as graph algorithms, non-neural network-based machine learning algorithms, and
design neuromorphic primitives for data encoding and data structures.

##  2\. SuperNeuro

Table 1. SuperNeuro Modes: Matrix Computation (MAT) Mode and Agent-Based Modeling (ABM) Mode MAT Mode |  ABM Mode
---|---
Homogeneous simulations |  Heterogeneous simulations
Built-in STDP learning |  No built-in learning
CPU execution |  GPU acceleration
Fast and scalable |  Custom neurons and synapses

SuperNeuro is a fast and scalable simulator for neuromorphic computing. It
lends itself to different types of workloads, which include neuroscience
workloads, deep learning (based on SNNs) workloads and general-purpose
computing workloads. SuperNeuro features two modes that model the neuromorphic
simulations in two different ways: a matrix computation-based mode (MAT) and
an agent-based modeling (ABM) mode. Table 1 shows the features of the two
SuperNeuro modes. A brief description of these modes is provided in the
following subsections. The goal of this short paper is to highlight
preliminary computational results for SuperNeuro in comparison to other widely
used simulators—this is covered in Section 3. While we go over the inner
workings of MAT and ABM modes briefly, we do not explain the mathematical and
algorithmic details in this paper—these details remain out of scope for this
paper and will be explained in detail in upcoming papers. The SuperNeuro code
is open-source and available on GitHub at https://github.com/ORNL/superneuro.

###  2.1. The MAT Mode

The MAT mode in SuperNeuro models neuromorphic simulations using matrices and
vectors. It supports homogeneous simulations, i.e., simulations where all
neurons and all synapses are of the same type. All neurons in the MAT mode are
leaky integrate and fire (LIF) neurons. Each neuron has four parameters:
threshold, leak, reset state and refractory period. The leak used in the MAT
mode is of constant type. Specifically, at each time step, a constant value is
subtracted from (or added to) the internal state of each neuron in order to
bring the internal state closer to the reset state. So, if the internal state
is greater than the reset state (but less than the threshold) we subtract the
leak; else, we add the leak. The internal states of all neurons at a given
time step in the simulation are represented as a vector. The neuron
thresholds, leaks, reset states, refractory periods, and spikes are also
represented as vectors.

Each synapse in the MAT mode has two parameters: weight and delay. The weights
are represented in a square matrix such that the weight of the synapse going
from neuron $i$ to neuron $j$ is captured at the element located at the
$i^{\text{th}}$ row and $j^{\text{th}}$ column in the matrix. The delay is
computed by adding proxy neurons in the simulations such that each and every
synapse in the simulation always has a delay of unity. For example, say that a
synapse from neuron $i$ to neuron $j$ needs to have a delay of three. We
implement this functionality by adding two proxy neurons $k_{1}$ and $k_{2}$,
both having a threshold of zero and infinite (very high) leak. Next, we
connect neuron $i$ to neuron $k_{1}$, neuron $k_{1}$ to neuron $k_{2}$, and
neuron $k_{2}$ to neuron $j$, such that each of these synapses have a weight
and delay of unity. The effective delay going from neuron $i$ to neuron $j$ is
thus three as required. While this implementation of synaptic delay sidesteps
any temporal computational overheads, it does introduce spatial overheads by
adding proxy neurons. As a result, this approach could be inefficient for
neuromorphic simulations that contain significant amount of delays on the
synapses. In general, all neuron and synapse operations are represented as
matrix or vector operations in the MAT mode and thus, can be easily
parallelized.

To compute the internal states of all neurons at the current time step, we
first start with the internal state vector from the previous time step and
apply the constant leak to it. Second, the vector of spikes from the previous
time step is multiplied by the weight matrix and then added to the internal
state vector from the previous time step. Third, if there are any external
spikes at the current time step, they are added to the internal state vector
of the current time step. Next, the spike vector at current time step is
computed by comparing the current internal state vector to the vector of
neuron thresholds. Lastly, for neurons in their refractory periods, the spikes
are zeroed out. All the above operations are implemented in numpy, which is a
highly efficient, CPU-based, numerical computation library in Python.

When the problem is formulated in this fashion, it allows for both speed and
scalability for homogeneous simulations. The MAT mode also has a built-in
Spike-Time Dependent Plasticity (STDP) learning mechanism, which can be used
for training SNNs. The STDP mechanism is also implemented using matrix and
vector operations. As shown in Table 1, SuperNeuro supports homogeneous
simulations in the MAT mode. At present, the MAT mode only supports CPU
execution but GPU acceleration capability will be provided in the future. The
MAT mode should be used in cases where speed and scalability are important.

###  2.2. The ABM Mode

Agent-based modeling (ABM) is a widely used modeling and simulation technique
for investigating complex adaptive systems. In SuperNeuro’s ABM mode, we take
an organic perspective to SNN design, simulating each neuron as an individual
agent. The simulation is clock-driven, with step functions defining the
actions taken by agents at each time step. In the ABM mode, the neurons and
synapses inherit the autonomy of the agent modeling paradigm allowing for
heterogeneous simulations, i.e., the neurons and synapses in the simulation
can be of different types, each supporting a unique spiking mechanism. The
unique features available in the ABM mode are shown in Table 1. This
heterogeneous simulation feature is useful for exploring neuron and synapse
mechanisms that have not been realized on the hardware yet, for example,
stochastic neurons, stochastic synapses etc.

The ABM mode is implemented using SAGESim, a GPU-capable agent-based modeling
framework developed at the Oak Ridge National Laboratory. While using GPUs,
SAGESim works by assigning a GPU thread to each agent. SAGESim supports the
execution of multi-breed simulation and multiple step functions, ordered by
priority for each breed. As mentioned before, each neuron in the ABM mode is
an agent within the SAGESim simulation platform. Each neuron agent is provided
with two step functions: the neuron step function and synapse step function.
The neuron step function aggregates external spikes at the current timestep
with the current internal state of the neuron and subtracts the leak. If the
new internal state is greater than the neuronal threshold, the neuron spikes
and the delay registers of outgoing synapses are updated accordingly. In the
synaptic step function, the synaptic delay registers are updates and the final
elements of the delay registers are used to update the internal states of the
post-neurons.

The agent-based form is well suited for GPU acceleration and greatly improves
speed and scalability. The ABM mode supports both CPU and GPU execution; GPU
device must be NVIDIA compute capability 6 or higher. It currently supports
the leaky integrate and fire mechanism for the neuron. Furthermore, the neuron
and synapse parameters supported include threshold, leak, refractory period,
axonal delay, synaptic weights, and synaptic delays. The notion of leak
supported in the ABM mode is the same as the one in the MAT mode. The ABM mode
does not support any learning mechanism at present, but will support STDP
learning in the future.

##  3\. Results

Number of Neurons | 100 | 1000 | 10000
---|---|---|---
Connection Probability | 0.25 | 0.50 | 0.75 | 1.0 | 0.25 | 0.50 | 0.75 | 1.0 | 0.25 | 0.50 | 0.75 | 1.0
SuperNeuro | MAT | 0.04 | 0.04 | 0.05 | 0.05 | 0.36 | 0.52 | 0.68 | 0.80 | 30.37 | 40.34 | 55.38 | 71.62
ABM | 1.10 | 1.16 | 1.18 | 1.26 | 4.11 | 5.59 | 7.22 | 9.08 | 166.72 | 325.30 | 488.83 | 641.36
NEST | 0.41 | 0.65 | 0.91 | 1.23 | 28.05 | 61.42 | 81.54 | 112.82 | 3242.83 | ¿ 1h | ¿ 1h | ¿ 1h
Brian2 | 6.63 | 12.43 | 18.36 | 24.23 | 612.43 | 1249.31 | 1892.19 | 2529.77 | ¿ 1h | ¿ 1h | ¿ 1h | ¿ 1h
BindsNET | 2.44 | 2.34 | 2.46 | 2.38 | 3.45 | 3.67 | 4.19 | 4.64 | 63.73 | 117.78 | 181.04 | 230.07
Table 2. Total execution times in seconds for SuperNeuro vs other state-of-
the-art simulators for different configurations of network sizes, given by
number of neurons, and network sparsities, given by synapse connection
probabilities.

We compare the performance of both SuperNeuro modes against three widely used
neuromorphic simulators: NEST, Brian2, and BindsNET. We generated random
networks using a graph and network algorithms library in Python called
networkx. Using the Erdős-Rényi graph generation algorithm in networkx, we
generated random graphs such that each node of the graph would correspond to a
neuron and each edge of the graph would correspond to a synapse in our
neuromorphic simulations. Networks of 100, 1000, and 10,000 neurons were
generated as networks of these sizes can be efficiently run on a desktop
workstation. For each size of the network we varied the sparsity by changing
the connection probabilities of the synapses. We chose the following values
for the synapse connection probabilities: 0.25, 0.5, 0.75, and 1. With three
values for number of neurons and four values for the synapse connection
probabilities, we had 12 network configurations. Each of these network
configurations was used to initialize the neurons and synapses within each of
the five simulators. Each simulation was run for 1000 time steps and 3 input
neurons were chosen at random. Each input neuron was externally spiked at
every 10 time steps. All neuron thresholds were set to 1, reset states were
set to 0, refractory periods were set to 0, and the axonal delays (if
applicable) were set to 0. All synaptic weights and delays were set to 1.

Table 2 displays the total execution times in seconds for all the simulator
runs. The runs that took longer than an hour were terminated and are depicted
with ¿ 1h. All ABM and BindsNET runs leveraged GPU acceleration. The MAT mode
in SuperNeuro was seen to be the fastest across all network configurations.
For the small-sized jobs (100 neurons), MAT obtained a speed up of 9x for the
0.25 connection probability over the next best simulator, which in this case,
was NEST. With increasing connection probabilities, MAT obtained increasing
speedups of 15x, 20x and 27x over NEST. As compared to some of the slower
simulators such as Brian2, MAT obtained speedups of 150x, 290x, 406x and 530x
for the four sparsity configurations. The total execution times for ABM were
comparable to NEST for the configuration with 100 neurons and 1.0 connection
probability. For this configuration, ABM obtained a speedup of 19x and 2x over
Brian2 and BindsNET.

For the medium-sized networks (1000 neurons), BindsNET performed better than
all other simulators except MAT, which obtained speedups of 10x, 7x, 6x and 6x
over BindsNET for the four sparsities. MAT also obtained speedups ranging from
1,695–3,174x over Brian2 for the different sparsities. ABM was 7x, 11x, 11x
and 12x faster than NEST for the four sparsities. As compared to Brian2, ABM’s
speedup ranged from 149–279x for the four sparsities. For the large-sized
networks (10,000 neurons), BindsNET was one again faster than other simulators
except MAT. In this case, MAT obtained a speedup of 2-3x over BindsNET for the
four different configurations. For the 10,000 neuron and 0.25 connection
probability configuration, MAT was 107x faster than NEST and possibly even
faster on the higher connection probabilities. The speedups for NEST and
Brian2 for the 10,000 neuron configurations are not determined because those
jobs took more than an hour and were terminated. For these larger
configurations, ABM took roughly a third of the time as compared to BindsNET.
For the 0.25 sparsity configuration, ABM performed 19x faster than NEST. It
also performed significantly faster than all other runs for NEST and Brian2.
Overall, on smaller-sized networks, MAT was the fastest, followed by NEST,
ABM, BindsNET and Brian2. On medium and large-sized networks, MAT was the
fastest, followed by BindsNET, ABM, NEST and Brian2.

##  4\. Discussion

An efficient neuromorphic simulator allows us to work with customizable neuron
and synapse mechanisms that go beyond the typical deferential equation
specifications found in traditional neuroscience. This enables engineering and
computer science focused design of SNNs for neuromorphic devices in an
accelerated manner. Unlike existing neuromorphic simulators, SuperNeuro
provides the capability for the practitioner to include heterogenous neuron
and synapse spiking mechanisms within the same SNN.

SuperNeuro can simulate larger spiking neural networks in less time with
higher computational efficiency than any other neuromorphic simulator
available today. It can even simulate networks of the scale of some living
organisms, comparable to those studied in neuroscience. For instance, we have
simulated networks with 100,000 neurons (lobster-sized brain) with all-to-all
connectivity on a desktop in approximately 5 minutes using the MAT mode. The
current simulators, such as NEST and Brian2, take more than 1 hour for such
tasks. By leveraging high performance computing resources at the Oak Ridge
National Laboratory, SuperNeuro could potentially simulate networks with a few
million neurons, such as those found in bees and lizards.

SNNs have been used to realize various cognitive and machine learning
algorithms such as control, reinforcement learning, classification, decision
trees, and regression. For the rapid development and benchmarking of these
algorithms in the neuromorphic domain, the availability of a performant
simulator is crucial. With the use of a performant simulator such as
SuperNeuro, we can train SNNs for deployment on edge platforms for
applications such as autonomous vehicles, industrial robotics, autonomous
drones, high energy physics etc. This enables AI practitioners to rapidly
develop and prototype new SNN architectures significantly faster, and in turn,
enable the co-design of neuromorphic hardware.

##  5\. Conclusion

Currently, neuromorphic computing suffers from lack of fast, highly scalable
neuromorphic, and flexible simulators for designing and training spiking
neural networks. SuperNeuro provides AI practioners with a neuromorphic
simulator in Python that is both fast and scalable and also provides the
option of simulating the user’s own spiking mechanisms. SuperNeuro is capable
of taking advantage of GPU acceleration and is able to provide superior
performance as compared to existing simulation platforms. SuperNeuro can
easily integrate with learning and optimization tools for spiking neural
network optimization. This opens many possibilities for the successful co-
design of neuromorphic circuits enabling intelligent edge computing device
design, while at the same time facilitates large scale AI experimentation on
accelerated computing infrastructure.

###### Acknowledgements.

This material is based in part upon work supported by the U.S. Department of
Energy, Office of Science, Office of Advanced Scientific Computing Research,
under award number DE-SC0022566.

## References

  * (1) Aimone, J., Date, P., Fonseca-Guerra, G., Hamilton, K., Henke, K., Kay, B., Kenyon, G., Kulkarni, S., Mniszewski, S., Parsa, M., et al. A review of non-cognitive applications for neuromorphic computing.  Neuromorphic Computing and Engineering (2022).
  * (2) Bhuiyan, M. A., Pallipuram, V. K., Smith, M. C., Taha, T., and Jalasutram, R. Acceleration of spiking neural networks in emerging multi-core and gpu architectures.  In 2010 IEEE International Symposium on Parallel & Distributed Processing, Workshops and Phd Forum (IPDPSW) (2010), IEEE, pp. 1–8.
  * (3) Cong, G., Lim, S.-H., Kulkarni, S., Date, P., Potok, T., Snyder, S., Parsa, M., and Schuman, C. Semi-supervised graph structure learning on neuromorphic computers.  In Proceedings of the International Conference on Neuromorphic Systems 2022 (2022), pp. 1–4.
  * (4) Date, P., Carothers, C. D., Hendler, J. A., and Magdon-Ismail, M. Efficient classification of supercomputer failures using neuromorphic computing.  In 2018 IEEE Symposium Series on Computational Intelligence (SSCI) (2018), IEEE, pp. 242–249.
  * (5) Davies, M., Srinivasa, N., Lin, T.-H., Chinya, G., Cao, Y., Choday, S. H., Dimou, G., Joshi, P., Imam, N., Jain, S., et al. Loihi: A neuromorphic manycore processor with on-chip learning.  Ieee Micro 38, 1 (2018), 82–99.
  * (6) DeBole, M. V., Taba, B., Amir, A., Akopyan, F., Andreopoulos, A., Risk, W. P., Kusnitz, J., Otero, C. O., Nayak, T. K., Appuswamy, R., et al. Truenorth: Accelerating from zero to 64 million neurons in 10 years.  Computer 52, 5 (2019), 20–29.
  * (7) Eshraghian, J. K., Ward, M., Neftci, E., Wang, X., Lenz, G., Dwivedi, G., Bennamoun, M., Jeong, D. S., and Lu, W. D. Training spiking neural networks using lessons from deep learning.  arXiv preprint arXiv:2109.12894 (2021).
  * (8) Furber, S. B., Galluppi, F., Temple, S., and Plana, L. A. The spinnaker project.  Proceedings of the IEEE 102, 5 (2014), 652–665.
  * (9) Gewaltig, M.-O., and Diesmann, M. Nest (neural simulation tool).  Scholarpedia 2, 4 (2007), 1430.
  * (10) Hamilton, K., Date, P., Kay, B., and Schuman D, C. Modeling epidemic spread with spike-based models.  In International Conference on Neuromorphic Systems 2020 (2020), pp. 1–5.
  * (11) Hamilton, K., Mintz, T., Date, P., and Schuman, C. D. Spike-based graph centrality measures.  In International Conference on Neuromorphic Systems 2020 (2020), pp. 1–8.
  * (12) Hazan, H., Saunders, D. J., Khan, H., Patel, D., Sanghavi, D. T., Siegelmann, H. T., and Kozma, R. Bindsnet: A machine learning-oriented spiking neural networks library in python.  Frontiers in neuroinformatics 12 (2018), 89.
  * (13) Kulkarni, S. R., Parsa, M., Mitchell, J. P., and Schuman, C. D. Benchmarking the performance of neuromorphic and spiking neural network simulators.  Neurocomputing 447 (2021), 145–160.
  * (14) Markram, H. The blue brain project.  Nature Reviews Neuroscience 7, 2 (2006), 153–160.
  * (15) Patton, R., Schuman, C., Kulkarni, S., Parsa, M., Mitchell, J. P., Haas, N. Q., Stahl, C., Paulissen, S., Date, P., Potok, T., et al. Neuromorphic computing for autonomous racing.  In International Conference on Neuromorphic Systems 2021 (2021), pp. 1–5.
  * (16) Schuman, C. D., Kulkarni, S. R., Parsa, M., Mitchell, J. P., Date, P., and Kay, B. Opportunities for neuromorphic computing algorithms and applications.  Nature Computational Science 2, 1 (2022), 10–19.
  * (17) Stimberg, M., Brette, R., and Goodman, D. F. Brian 2, an intuitive and efficient neural simulator.  Elife 8 (2019), e47314.


# Assessing the Adversarial Security of Practical Perceptual Hashing
Algorithms

Jordan Madden, Moxanki Bhavsar, Lhamo Dorje, and Xiaohua Li The authors are
with the Department of Electrical and Computer Engineering, Binghamton
University, Binghamton, NY 13902, USA. Emails: {jmadden2, mbhavsa2, ldorje1,
<EMAIL_ADDRESS>received Mon Day, 2024; revised Mon Day, 2024.

###### Abstract

Perceptual hashing algorithms (PHAs) are utilized extensively for identifying
illegal online content. Given their crucial role in sensitive applications,
understanding their security strengths and weaknesses is critical. This paper
compares three major PHAs deployed widely in practice: PhotoDNA, PDQ, and
NeuralHash, and assesses their robustness against three typical attacks:
normal image editing attacks, malicious adversarial attacks, and hash
inversion attacks. Contrary to prevailing studies, this paper reveals that
these PHAs exhibit resilience to black-box adversarial attacks when realistic
constraints regarding the distortion and query budget are applied, attributed
to the unique property of random hash variations. Moreover, this paper
illustrates that original images can be reconstructed from the hash bits,
raising significant privacy concerns. By comprehensively exposing their
security vulnerabilities, this paper contributes to the ongoing efforts aimed
at enhancing the security of PHAs for effective deployment.

###### Index Terms:

Perceptual hashing, security, privacy, blackbox adversarial attack,
adversarial machine learning

##  I Introduction

Perceptual hashing, also known as robust hashing, is a content fingerprinting
technique that generates similar binary hashes for perceptually similar
contents and different hashes for different contents [1]. Perceptual hashing
is useful in various applications such as content moderation, authentication,
and detection. Numerous perceptual hash algorithms (PHAs) have been developed
or deployed for practical applications [2]. An early example is the algorithm
developed by Google and used on YouTube to identify copyrighted material [3].
Other examples include those used in online image search engines of Google,
Microsoft Bing, etc [4].

PHAs have gained critical importance, particularly in responding to the
reporting of illicit content. For instance, in cases involving Child Sexual
Abuse Media (CSAM), US media service providers are legally obliged to examine
suspected illegal content and report it to a “Cyber Tip Line” operated by the
National Center for Missing and Exploited Children (NCMEC). Microsoft’s
PhotoDNA and Meta’s PDQ have been developed for this purpose [5][6][7].

With a growing emphasis on user privacy, technologies like end-to-end
encryption have become prevalent. This shift has led to the deployment of PHAs
on the client side before data encryption [8]. For example, Apple has proposed
to deploy NeuralHash on all its iOS devices [9]. However, deploying PHAs on
the client side to scan client data has raised significant concerns regarding
client data privacy, prompting widespread criticism about the robustness and
privacy-preserving capabilities of the PHAs [10]. Especially, recent studies
have almost unanimously criticized PHAs for their vulnerability to adversarial
attacks and the potential leakage of information through hash bits
[4][11][12].

Given their critical role in sensitive applications, it is imperative to
thoroughly understand the security of PHAs. However, even for PHAs that have
been widely deployed in the real world, their security remains insufficiently
evaluated. Particularly concerning are new PHAs that are hastily deployed
without adequate scrutiny. To address this gap, this paper systematically
evaluates the adversarial robustness and privacy-preserving capabilities of
three widely used PHAs: PhotoDNA, PDQ, and NeuralHash. To support this study,
two new efficient attack algorithms are developed.

The major contributions of this paper are as follows.

  * •

A systematic comparison of the security and privacy-preserving capability of
three major PHAs against three types of attacks: normal image editing attacks,
malicious adversarial attacks, and hash inversion attacks, with the
development of a query-efficient adversarial attack algorithm and a data-
efficient hash inversion network.

  * •

Demonstrating the robustness of PHAs against malicious adversarial attacks
when realistic constraints over distortion and query budget are imposed,
contrary to previous studies that neglected such constraints and thus
criticized PHAs as being not robust. The robustness is shown to be attributed
to the unique property of random hash variations.

  * •

Revealing that the hash bits of all three PHAs leak significant information
about the content of the original images, allowing for reliable reconstruction
of the original image if sufficient context information is available.

The paper is organized as follows: Section II provides a literature review,
Section III formulates the attacks and explains the robustness, Section IV
presents the experiment results, and Section V concludes the paper. The source
code of the experiments, including the binary executable of the PHAs, can be
accessed at _ https://github.com/neddamj/nnhash_.

##  II Literature Review

###  II-A Perceptual Hashing Algorithms

Among the vast amount of PHAs [2], this paper considers the following three
major ones that have been deployed and used widely in practice:

PhotoDNA, released by Microsoft in 2009, has been used by over 70 companies
including Cloudflare and Dropbox [6][13][14]. To create a hash, PhotoDNA
breaks down an image into small pieces, analyzes each piece to extract its
unique feature, and converts the features into hash bits. PhotoDNA generates a
$144$-byte or $1152$-bit hash value for each input image.

PDQ, which stands for Perceptual algorithm utilising a Discrete Cosine
Transform and outputting (amongst others) a Quality metric, was released by
Meta in 2019 [7]. Inspired by pHash [15], PDQ uses the discrete cosine
transform (DCT) to extract image features and outputs both a 256-bit hash
value and a quality factor.

NeuralHash was released by Apple in 2021 with the intent to identify CSAM [9].
An image is first passed through a deep neural network (DNN) to produce a
feature embedding. The embedding is then converted to a $96$-bit hash. The DNN
is trained contrastively to ensure that the cosine similarity between
perceptually similar images is high while the similarity of perceptually
different images is low.

###  II-B Adversarial Machine Learning

The security of PHAs is commonly studied using the terminologies and
algorithms of adversarial machine learning [16]. Specifically, _Adversarial
robustness_ measures the resilience of the machine learning models to
adversarial attacks. _Adversarial attacks_ can be classified as untargeted
attacks and targeted attacks. In an _untargeted attack_ , the objective is to
slightly alter the input to prompt the model to produce a completely different
output. Conversely, a _targeted attack_ aims to slightly modify the input to
elicit a specifically designed output.

According to the knowledge that the adversary has about the machine learning
model, attacks can be categorized to _whitebox attacks_ , where the adversary
possesses complete knowledge of the model [16][17][18], and _blackbox attacks_
, where the adversary only has access to the input and output of the model
[19][20][21][22]. In black-box attacks, if the model’s outputs are continuous
values like logits or probabilities, the attack is referred to as _soft-label
attack_ [19][20][21]. Otherwise, if the model’s outputs are solely hard-
decision labels, the attack is known as a _hard-label attack_ [22].

###  II-C Adversarial Robustness of PHAs

The adversarial robustness of conventional PHAs like pHash [2] was
investigated in [23] under the whitebox setting, whereas the robustness under
the blackbox setting was explored in [4]. Many of these studies suggested that
PHAs were not robust to adversarial attacks.

The adversarial robustness of PhotoDNA, PDQ, and NeuralHash has not been
adequately addressed, partly because they are new and partly because their
source code is not publicly available. Regarding their robustness to normal
image editing, [24] examined PhotoDNA, while [11] investigated PDQ and
NeuralHash. Both studies demonstrated that PHAs were robust to certain edits
like compression but vulnerable to others like cropping.

As far as we know, [25] was the first to study these PHAs’ robustness to
adversarial attacks. It studied NeuralHash under the whitebox setting only,
and showed that NeuralHash was not robust to whitebox attacks. [26] worked on
PDQ and used the linearity of DCT to get adversarial images in a white-box
setting. [27] generated adversarial images through linear interpolation
between two given images.

Regarding blackbox attacks, [26] studied PDQ and claimed that it was not
robust to untargeted blackbox attacks. [28] investigated PhotoDNA and PDQ,
concluding that they were not robust to either targeted or untargeted attacks.
These two studies closely resemble the current paper, yet this work differs
from them in two key aspects. Firstly, previous works computed attack success
rates without incorporating limitations on the adversary’s tolerance to image
quality degradation or query budget. Such constraints are crucial in real-
world scenarios. It is trivial that unconstrained blackbox attacks will always
be successful, particularly in the untargeted setting. Secondly, none of the
prior works conducted a comparative study of the three PHAs, nor did they
investigate the challenge of hash inversion.

###  II-D Information Leakage from Hashes

Regarding privacy preservation, upon its release, Microsoft asserted that the
hashes generated by PhotoDNA were irreversible and incapable of reconstructing
the original images [29]. However, in a blog post [12], it was demonstrated
that PhotoDNA hashes leak sufficient information about the original image to
allow images to be synthesized from the hashes. To our knowledge, [12] is the
sole study on reconstructing the original image from the hash, albeit focusing
solely on PhotoDNA that has long hashes. It is unclear if PHAs with short hash
suffer from this problem.

Another approach to investigate information leakage is to train a classifier
to classify the image objects from the hash. [25][27] illustrated that
NeuralHash hashes indeed revealed information about their source images by
enabling the identification of the object’s class. Interestingly, these
findings contradict those of [30] which examined PhotoDNA hashes and claimed
that PhotoDNA was resistant to such classification attacks.

##  III Attack Algorithms

Consider a perceptual hash system where the service provider scans the
client’s unencrypted content, extracts a hash for each image using a PHA,
compares the hash with a database of known illicit hashes, and raises an alarm
or forwards the unencrypted content for further analysis in case of hash match
[8]. In this scenario, we consider two adversaries: the client adversary
seeking to evade hash matching and the service provider (or some third party)
adversary seeking to reconstruct the client’s original images from collected
hashes.

We evaluate the security of PhotoDNA, PDQ, and NeuralHash against three types
of attacks: benign image editing attacks and malicious adversarial blackbox
attacks employed by the client adversary, and hash inversion attacks employed
by the service provider adversary. Considering the client adversary, we assess
the security of PHAs by measuring the adversary’s attack success rate, where a
higher success rate indicates weaker security or robustness. Considering the
service provider adversary, security is assessed through image reconstruction
quality, where higher quality implies weaker security or privacy.

###  III-A Image Editing Attacks

Assume the original input to the PHA is an image ${\bf I}_{0}$, and the true
output is an $N$-bit hash ${\bf h}_{0}={\cal H}({\bf I}_{0})$, where ${\cal
H}(\cdot)$ denotes the hashing algorithm. The client adversary applies
standard image editing operations over ${\bf I}_{0}$ to obtain an adversarial
image ${\bf I}_{\rm adv}$ with a new $N$-bit hash ${\bf h}_{\rm adv}={\cal
H}({\bf I}_{\rm adv})$. A successful attack means ${\bf h}_{\rm adv}$ is
sufficiently different from ${\bf h}_{0}$.

While prior works such as [11] and [24] have investigated image editing
attacks on PHAs, a new evaluation is still necessary due to ongoing algorithm
updates. Notably, NeuralHash has received at least one update since its first
release. This study addresses the gap in knowledge by evaluating the security
of the updated algorithms and, more importantly, by providing the first
comparison of the three PHAs.

###  III-B Adversarial Blackbox attacks

####  III-B1 A Query-efficient Blackbox Attack Algorithm

This work focuses solely on blackbox, not whitebox, adversarial attacks,
reflecting the practical scenario where PHA implementations are proprietary.
For some PHAs, details regarding architecture and model weights are not
publicly available due to their commercial nature. For instance, Microsoft
enforces non-disclosure agreements for PhotoDNA users, and only an emulation
is accessible. Similarly, while Ygvar et al. (2021) released weights for the
first-generation NeuralHash, Apple has since updated the algorithm, keeping
the new model confidential.

Existing blackbox attack algorithms, designed to operate on
logits/probabilities or singular class decisions, cannot be directly applied
to PHAs because PHAs output a limited number of hash bits, which are neither
logits nor class labels. Instead, we propose a joint soft-label hard-label
attack (JSHA) algorithm, where a soft-label attack step is applied first and
its output is passed as input to a hard-label attack step. The objective of
the soft-label attack step is to modify the image to change the hash without
considering the image quality constraint, whereas the objective of the hard-
label attack step is to reduce adversarial image quality degradation.

Consider the original image ${\bf I}_{0}$ with hash value ${\bf h}_{0}={\cal
H}({\bf I}_{0})$. The objective of the client adversary is to generate an
adversarial image ${\bf I}_{\rm adv}$ with new hash ${\bf h}_{\rm adv}={\cal
H}({\bf I}_{\rm adv})$. In an untargeted attack, ${\bf h}_{0}$ and ${\bf
h}_{\rm adv}$ should be different enough. In a targeted attack, there is a
target hash ${\bf h}_{\rm tar}\neq{\bf h}_{0}$, which may be obtained from
some target image as ${\bf h}_{\rm tar}={\cal H}({\bf I}_{\rm tar})$, and we
require that ${\bf h}_{\rm tar}$ and ${\bf h}_{\rm adv}$ are similar. In both
attacks, the distance between ${\bf I}_{0}$ and ${\bf I}_{\rm adv}$ should be
small.

To simplify notation, let us use normalized Hamming distance to evaluate the
similarity of two $N$-bit hashes as

$D_{h}({\bf h}_{0},{\bf h}_{\rm adv})=\frac{1}{N}\sum_{n=1}^{N}\mathbb{I}({\bf
h}_{0}(n)={\bf h}_{\rm adv}(n))$ (1)

for two hashes with hash bits ${\bf h}_{0}(n)$ and ${\bf h}_{\rm adv}(n)$,
where $\mathbb{I}(x)$ is the indicator function, i.e. $\mathbb{I}(x)=1$ if $x$
is true and $0$ otherwise. In addition, we use per-pixel normalized $L_{2}$
norm to evaluate the distance of two images, i.e.

$L_{2}({\bf I}_{0},{\bf I}_{\rm
adv})=\sqrt{\frac{1}{M}\sum_{m=1}^{M}\left({\bf I}_{0}(m)-{\bf I}_{\rm
adv}(m)\right)^{2}}$ (2)

for two images with pixels ${\bf I}_{0}(m)$ and ${\bf I}_{\rm adv}(m)$. Other
measures such as SSIM are also used in our experiments.

The first step of the proposed JSHA algorithm is to apply soft-label blackbox
attack to generate an initial adversarial image ${\bf I}_{\rm init}$, with the
objective to make the hash ${\bf h}_{\rm init}={\cal H}({\bf I}_{\rm init})$
far away from ${\bf h}_{0}$ for untargeted attacks or close to ${\bf h}_{\rm
tar}$ for targeted attacks. This step is formulated as the optimization

$\displaystyle\max_{\delta}\;\;D_{h}\left({\bf h}_{0},{\cal H}({\bf
I}_{0}+\delta)\right)$ (3)

in case of untargeted attacks, or

$\displaystyle\min_{\delta}\;\;D_{h}\left({\bf h}_{\rm tar},{\cal H}({\bf
I}_{0}+\delta)\right)$ (4)

in case of targeted attacks. The optimization is conducted iteratively. During
each iteration, the adversary queries the PHAs with its adversarial input
${\bf I}_{0}+\delta$ to get the hash, and uses the hash to optimize the loss
(3) or (4). After reaching the query number threshold or the hash distance
threshold, this first step stops with output ${\bf I}_{\rm init}={\bf
I}_{0}+\delta$.

The second step applies a hard-label blackbox attack to reduce the image
distortion while maintaining the hash distance obtained in the first step.
Specifically, this step solves the following optimization

$\displaystyle\min\limits_{{\bf I}_{\rm adv}}\;\;L_{2}({\bf I}_{0},{\bf
I}_{\rm adv}),\;\;\;\;\hskip 128.0374pt$ (5)
$\displaystyle\;\;s.t.\;\;D_{h}({\bf h}_{0},{\cal H}({\bf I}_{\rm
adv}))>p\text{ (for untargeted attack)}$
$\displaystyle\;\;\;\;\;\;\;D_{h}({\bf h}_{0},{\cal H}({\bf I}_{\rm
adv}))<p\text{ (for targeted attack)}$

where $p$ is the pre-set hash distance threshold. Starting from ${\bf I}_{\rm
adv}={\bf I}_{\rm init}$, the adversary queries the PHAs to get the hash and
uses the queried hash to optimize (5) until the pre-set maximum query number
or the threshold of $L_{2}({\bf I}_{0},{\bf I}_{\rm adv})$ is reached.

The proposed algorithm is outlined in Algorithm 1. One of its major advantages
is query efficiency. A large learning rate can be applied in the first step to
get an initial adversarial sample quickly using a small number of queries. In
the second step, since we start from ${\bf I}_{\rm init}$ which is only a
noisy version of ${\bf I}_{0}$, the convergence is also fast. This makes our
algorithm able to generate adversarial samples quickly with a very small
number of queries.

Algorithm 1 JSHA: Joint Soft-Label and Hard-Label Attack

1:Initialization: Original input ${\bf I}_{0}$ and its hash ${\bf h}_{0}$;
Target hash ${\bf h}_{\rm tar}$ in case of targeted attacks.

2:Step One: Unconstrained soft-label attack

  * •

The adversary uses queries to optimize (3) or (4)

  * •

Stop and output ${\bf I}_{\rm init}$ when the pre-set hash distance threshold
or query budget is reached.

3:Step Two: Constrained hard-label attack

  * •

The adversary uses queries to optimize (5)

  * •

Stop and output ${\bf I}_{\rm adv}$ when the pre-set image distortion
threshold or query budget is reached.

(a) (b)

Figure 1: (a) Hash inversion attack model. (b) Architecture of residual block.

####  III-B2 Robustness to Adversarial Blackbox Attacks

Algorithm 1 and most existing blackbox attack algorithms rely on gradient
estimation to solve the optimization problem. Drawing on the property of PHAs
and our prior work on adversarial robust analysis [31], we have the following
proposition.

Proposition 1. Gradient estimation based on queried hash is not reliable.

Proof. Without loss of generality, consider the optimization problem (4). A
common approach involves utilizing $K$ randomly perturbed images to query the
PHAs and then using the queried hashes to estimate the gradient as follows

${\bf g}=\frac{1}{K}\sum_{k=1}^{K}\frac{1}{\beta}{\bf u}_{k}D_{h}({\bf h}_{\rm
tar},{\cal H}({\bf I}_{0}+\delta+\beta{\bf u}_{k}))$ (6)

where $\beta{\bf u}_{k}$ represents random perturbation [19]. Firstly, due to
the nature of PHAs, overly small perturbations may not induce any change in
hash. Hence, relatively large $\beta$ is required, but this renders the
gradient estimation unreliable. Secondly, the hash ${\cal H}({\bf
I}_{0}+\delta+\beta{\bf u}_{k})$ randomly varies with the small perturbation
$\beta{\bf u}_{k}$. The random variation can be modeled as a noise term $Z$
with variance $\sigma^{2}$. Following the analysis of [31], this noise is
amplified by $1/\beta$, leading to the gradient estimate ${\bf g}$ being
affected by a noise power $\sigma^{2}/\beta^{2}$, hence making it unreliable.

Due to the random nature of PHAs, it is almost impossible to limit the change
of hash to just one or a few hash bits by perturbations. Practical $\sigma$ is
usually around $0.1$. $\beta$ may be around $0.001$. As per [31], the signal-
to-noise-ratio (SNR) of the gradient estimation can fall well below $-40$ dB,
which makes the adversary’s optimization not convergent or converge extremely
slowly. This implies that PHAs are theoretically robust to blackbox attacks
under the query budget constraint.

###  III-C Hash Inversion Attacks

GAN (generative adversarial network) was used by [12]. However, the service
provider adversary may need more efficient hash inversion models because the
training data may not be abundant in practice. For this, we train new and more
efficient generative models to reconstruct the original input images from the
hashes. We designed a decider style DNN, similar to the Fast Style Transfer
[32], to convert the $N$-bit hashes to $(64,64)$ images. This DNN is mainly a
combination of residual blocks, which are described in Fig. 1(b), with
fractionally-strided convolutions/deconvolutions that are used for learned
upsampling. The entire architecture is described in Fig. 1(a).

For a given training dataset, we first compute the hashes of each image
offline and store the image-hash pairs. We then train the model outlined above
to reconstruct the images as closely as possible by minimizing the mean-
square-error (MSE) loss between the DNN output and the image from which the
hash was generated.

##  IV Experiment

###  IV-A Performance Metrics

For assessing the robustness against blackbox attacks, we employ the attack
success rate as the evaluation metric. Given a set of $M$ original images
${\bf I}_{0}^{m}$ with their corresponding hashes ${\bf h}_{0}^{m}$, the
adversary generates adversarial images ${\bf I}_{\rm adv}^{m}$ along with
their hashes ${\bf h}_{\rm adv}^{m}$. The attack success rate is defined as

$\displaystyle{\rm ASR}(p)=$
$\displaystyle\frac{1}{M}\sum_{m=1}^{M}\mathbb{I}\left(D_{h}({\bf
h}_{0}^{m},{\bf h}_{\rm adv}^{m})>p)\right)\mathbb{I}\left(L_{2}({\bf
I}_{0}^{m},{\bf I}_{\rm adv}^{m})<\theta\right)$ (7)

for untargeted attacks, and

$\displaystyle{\rm ASR}(p)=$
$\displaystyle\frac{1}{M}\sum_{m=1}^{M}\mathbb{I}\left(D_{h}({\bf h}_{\rm
tar}^{m},{\bf h}_{\rm adv}^{m})<p)\right)\mathbb{I}\left(L_{2}({\bf
I}_{0}^{m},{\bf I}_{\rm adv}^{m})<\theta\right)$ (8)

for targeted attacks (with the target hash ${\bf h}_{\rm tar}$). $p\in[0,1]$
is the pre-set hash distance threshold and $\theta$ is the pre-set image
distortion threshold. The adversary can adjust the threshold $p$ to control
the tradeoff between the true positive rate (TPR) and the false positive rate
(FPR) of the hash or image similarity decisions.

Untargeted attacks use a large $p$ because ${\bf h}_{\rm adv}$ should be
different from ${\bf h}_{0}$. As shown in Fig. 2, when we calculated
$D_{h}({\bf h}_{0},{\bf h}_{1})$ of distinct images of the ImageNet validation
dataset, we found that very few pairs of images had $D_{h}({\bf h}_{0},{\bf
h}_{1})<0.3$, which was also observed in [11]. Therefore, we primarily use
$p=0.3$ in (7) to determine the success of untargeted attacks. In contrast,
targeted attacks use a small $p$ to make sure ${\bf h}_{\rm adv}$ is
sufficiently close to ${\bf h}_{\rm tar}$. Prior studies [11] indicate that
many normal image edits would change an image’s hashes to the level of
$D_{h}({\bf h}_{0},{\bf h}_{1})<0.1$. Therefore, we mainly use $p=0.1$ in (8)
for assessing the success of targeted attacks.

To comprehensively assess attack success, we collect ASR$(p)$ for all $p=0.1$,
$0.2$, $0.3$, $0.4$ during experiments. We set the image distortion threshold
$\theta=0.1$.

Figure 2: Cumulative distribution function (cdf) of normalized hamming
distance $D_{h}({\bf h}_{0},{\bf h}_{1})$ between hashes of distinct images in
the ImageNet validation dataset.

For hash inversion attacks, we use the $L_{2}$ distortion (2), the SSIM
(Structural Similarity Index Measure) [33], and the LPIPS (Learned Perceptual
Image Patch Similarity) [34] between the reconstructed image and the true
image to evaluate the performance. No ASR or query budget is involved.

###  IV-B Experiment Results of Image Editing Attacks

We experimented with four image editing operations that can keep the original
high image quality: JPEG compression with random quality factors, resizing
images with random scaling factors, filtering images with the vignette filter,
or rotating images to random degrees. We calculated the hashes ${\bf h}_{0}$
and ${\bf h}_{1}$ of the images before and after the editing, and derived
their distance $D_{h}({\bf h}_{0},{\bf h}_{1})$. Using 1000 images from the
ImageNet validation dataset, we obtained ASR$(p)$ for various $p$ based on
(7), wherein the $L_{2}$ condition was removed by setting $\theta$ to
infinity.

Experiment results are presented in Tables I. The data for ASR(.3) is
highlighted in black because $p=0.3$ is the threshold we suggested to focus
on. It is evident that all three PHAs were robust to compression and resizing,
but not to filtering and rotation. In conjunction with the findings in
[11][25], the PHAs are robust to many standard image editing operations except
the following:

  * •

PhotoDNA is not robust to: filtering, rotating, resizing, mirroring,
bordering, cropping;

  * •

PDQ is not robust to: filtering, rotating, mirroring [11], bordering [11],
cropping [11];

  * •

NeuralHash is not robust to: filtering, rotating, mirroring [11].

NeuralHash was the most robust among the three. Surprisingly, the newest
edition of NeuralHash that we experimented with was still not robust to
filtering, rotating, and mirroring, similar to the first edition experimented
in [11][25], even though DNNs can be trained to be invariant to such standard
operations with data augmentation.

TABLE I: Adversary’s ASR($p$) with Image Editing Attacks ASR | Compress | Resize | Filter | Rotate
---|---|---|---|---
PhotoDNA ASR(.1) | 3% | 99% | $100\%$ | $100\%$
PhotoDNA ASR(.2) | $0\%$ | 55% | $100\%$ | $100\%$
PhotoDNA ASR(.3) | 0% | 0% | 94% | 100%
PhotoDNA ASR(.4) | $0\%$ | 0% | $37\%$ | $98\%$
PDQ ASR(.1) | 0% | 27% | 88% | 100%
PDQ ASR(.2) | 0% | 0% | 67% | 100%
PDQ ASR(.3) | 0% | 0% | 44% | 100%
PDQ ASR(.4) | 0% | 0% | 27% | 100%
NeuralHash ASR(.1) | 0% | 22% | 96% | 100%
NeuralHash ASR(.2) | 0% | 0% | 82% | 100%
NeuralHash ASR(.3) | 0% | 0% | 57% | 96%
NeuralHash ASR(.4) | 0% | 0% | 12% | 31%

###  IV-C Experiment Results of Untargeted Blackbox Attacks

In implementing our proposed JSHA algorithm, we modified three different soft-
label attack algorithms: SimBA [21], NES [19], and ZOsignSGD [20], to use in
Step One, and modified the hard-label attack algorithm HSJA [22] to use in
Step Two. For instance, “SimBA+HSJA” means our JSHA with a modified SimBA as
Step One and a modified HSJA as Step Two. Modifications included
removing/changing constraints and adjusting hyper-parameters, etc.
Specifically, in Step One, we skipped image distortion constraints and adopted
extremely large perturbation step sizes, e.g, using a perturbation magnitude
of $\epsilon=0.9$ for SimBA instead of the original $\epsilon=0.01$ as
described in [21].

The experiments were conducted on 100 randomly selected images from the
ImageNet validation dataset. Step One was executed for a total of 3000 queries
unless the early stopping criterion was met. Step Two was run for an
additional 2000 queries unless meeting the early stopping criterion. The main
challenge for us was the CPU-based non-parallel PHA executables, which limited
the number of images or queries we could process. In comparison, [28] only
utilized 30 images in experiments.

Experiment results are presented in Tables II. We compared the proposed JSHA
with the straightforward application of standard SimBA [21], NES [19], and
ZOsignSGG [20] algorithms. We also compared it with [26] and [28].

With a focus on ASR(0.3), the data indicated that NeuralHash was relatively
robust because the maximum ASR$(0.3)$ was $28\%$ only. PDQ was robust against
all adversarial attacks, with a maximum ASR$(0.3)$ of 1% only. It’s worth
noting that although [26] achieved a much higher attack success rate against
PDQ, it required significantly more queries. It could afford millions of
queries due to its access to the PDQ source code, enabling faster computation.

Furthermore, the experiment data revealed that our proposed JSHA outperformed
standard blackbox attack algorithms. SimBA+HSJA surpassed [28] in attacking
PhotoDNA, as the latter produced more noisy adversarial images and utilized
more queries.

Sample adversarial images generated with our proposed JSHA with various pre-
set threshold $p$ are depicted in Fig. 3, with their corresponding distortion
metrics listed in Table III. Notably, the three images with $p=0.4$ were
deemed invalid adversarial images as their distortion was not under the
threshold $\theta=0.1$, resulting in extremely noisy images. Similarly, for
PDQ, the adversarial images with $p=0.2$ and $0.3$ were also invalid.

In summary, contrary to previous studies suggesting that PHAs were not robust
against untargeted attacks, we found that some PHAs like PDQ and NeuralHash
could be considered as robust if realistic constraints regarding image
distortion and query budget are taken into account.

TABLE II: Adversary’s ASR($p$) with Untargeted Black-box Attacks.
(PH: PhotoDNA. PD: PDQ. NH: NeuralHash. ) |  |  |  |  | ZO- | ZOsign
---|---|---|---|---|---|---
|  | SimBA |  | NES+ | sign- | -SGD
ASR | SimBA | +HSJA | NES | HSJA | SGD | +HSJA
PH ASR(.1) | $100\%$ | $100\%$ | $18\%$ | $100\%$ | $1\%$ | $98\%$
PH ASR(.2) | $80\%$ | $100\%$ | $2\%$ | $98\%$ | $0\%$ | $90\%$
PH ASR(.3) | $1\%$ | 92% | $0\%$ | $69\%$ | $0\%$ | $19\%$
PH ASR(.4) | $0\%$ | $0\%$ | $0\%$ | $1\%$ | $0\%$ | $0\%$
PD ASR(.1) | 0% | 45% | 0% | 64% | 0% | 8%
PD ASR(.2) | 0% | 1% | 0% | 10% | 0% | 0%
PD ASR(.3) | 0% | 0% | 0% | 1% | 0% | 0%
PD ASR(.4) | 0% | 0% | 0% | 0% | 0% | 0%
NH ASR(.1) | 4% | 88% | 0% | 99% | 0% | 94%
NH ASR(.2) | 2% | 23% | 0% | 77% | 0% | 42%
NH ASR(.3) | 0% | 14% | 0% | 28% | 0% | 2%
NH ASR(.4) | 0% | 0% | 0% | 0% | 0% | 0%
[28] PH ASR(.3)$=$ 90%, ($L_{2}=0.2$, HSJA with $3\times 10^{4}$ queries)
[26] PD ASR(.3)$=$ 73%, ($L_{2}=0.1$, up to $8\times 10^{6}$ queries)

(a) Original image ${\bf I}_{0}$.

PhotoDNA PDQ NeuralHash

(b) Adversarial images ${\bf I}_{\rm adv}$.

Figure 3: Samples of an original image and the adversarial images created by the proposed untargeted blackbox attack algorithm JSHA (NES+HSJA). TABLE III: Distortion of the Adversarial Image Samples in Fig. 3(b). Measure | Threshold $p$ | PhotoDNA | PDQ | NeuralHash
---|---|---|---|---
| $p=0.1$ | 0.02 | 0.07 | 0.02
$L_{2}$ | $p=0.2$ | 0.02 | 0.11 | 0.04
| $p=0.3$ | 0.05 | 0.14 | 0.07
| $p=0.4$ | 0.17 | 0.19 | 0.19

###  IV-D Experiment Results of Targeted Blackbox Attacks

The experiment setting of targeted attacks was similar to that of untargeted
attacks, except for utilizing ${\bf h}_{\rm tar}$ obtained from random images
instead of ${\bf h}_{0}$. Results are presented in Tables IV. With a focus on
ASR(0.1) in this case, we observed that all targeted attacks failed, yielding
ASR$(0.1)=0$. To our knowledge, no literature has ever reported non-zero
ASR$(0.1)$, suggesting that all the PHAs are robust against targeted attacks.

The robustness is extremely strong because of ASR$(p)\approx 0$ across all
$p$. The only exception was NeuralHash, which exhibited ASR(0.4) of 43% with
SimBA. However, this isn’t indicative of successful adversarial attacks;
rather, it’s due to numerous hashes generated by NeuralHash having $D_{h}({\bf
h}_{0},{\bf h}_{1})$ as low as 0.3, as illustrated in Fig. 2. Under
NeuralHash, many images are inherently adversarial when evaluated at $p=0.4$.

In summary, contrary to the prior claims that PHAs were not robust against
targeted attacks [28], our findings demonstrate the strong robustness of all
PHAs against targeted blackbox attacks. This is significant to the practical
application of PHAs because the client adversary needs targeted attacks to
ensure that its adversarial hashes do not inadvertently match illicit hashes
in the database. The strong robustness means it is hard for the adversary to
undertake either untargeted or targeted attacks without being caught.

TABLE IV: Adversary’s ASR($p$) with Targeted Blackbox Attacks.
(PH: PhotoDNA. PD: PDQ. NH: NeuralHash) |  |  |  |  | ZO- | ZOsign
---|---|---|---|---|---|---
|  | SimBA |  | NES+ | sign- | -SGD
ASR | SimBA | +HSJA | NES | HSJA | SGD | +HSJA
PH ASR(.1) | 0% | 0% | 0% | 0% | 0% | 0%
PH ASR(.2) | 0% | 0% | 0% | 0% | 0% | 0%
PH ASR(.3) | 0% | 0% | 0% | 0% | 0% | 0%
PH ASR(.4) | 1% | 2% | 0% | 0% | 0% | 0%
PD ASR(.1) | 0% | 0% | 0% | 0% | 0% | 0%
PD ASR(.2) | 0% | 0% | 0% | 0% | 0% | 0%
PD ASR(.3) | 0% | 0% | 0% | 0% | 0% | 0%
PD ASR(.4) | 0% | 0% | 0% | 0% | 0% | 0%
NH ASR(.1) | 0% | 0% | 0% | 0% | 0% | 0%
NH ASR(.2) | 0% | 0% | 0% | 0% | 0% | 0%
NH ASR(.3) | 0% | 0% | 0% | 0% | 0% | 0%
NH ASR(.4) | 43% | 11% | 0% | 0% | 0% | 0%
[28] PH ASR(.3) ($L_{2}=0.19$) | 83% | ($2\times 10^{6}$ queries)
[28] PD ASR(.3) ($L_{2}=0.42$) | 100% | ($6\times 10^{5}$ queries)

###  IV-E Experiment Results of Hash Inversion Attacks

To demonstrate the service provider adversary’s capability to reconstruct
original images from their hashes under some contextual knowledge, such as the
group of images to which the original images may belong, we conducted
experiments using two datasets MNIST and CelebA as known contexts. For each
hashing algorithm and dataset, we trained the inversion network depicted in
Fig. 1 for 50 epochs, with a batch size of 64 and an initial learning rate of
0.005. We utilized the MSE loss function with the AdamW optimizer and the
cosine annealing learning rate scheduler.

Results are presented in Table V. Samples of synthesized images along with
their original images can be observed in Fig. 4 and Fig. 5. It is evident that
the hash leaks sufficient information for image reconstruction when certain
contextual information is known, such as whether the image belongs to MNIST
digits or CelebA photos. Although no image quality metrics were given in [12],
Fig. 5(c) shows that our proposed model had a performance comparable to that
of [12].

In Table V, smaller $L_{2}$ and LPIPS mean better image reconstruction, while
larger SSIM means better image reconstruction. PhotoDNA has the longest hashes
at 1152-bits, PDQ has 256-bit hashes and NeuralHash has 96-bit hashes.
Intuitively, this implies that PhotoDNA hashes contain the most information
about the original images while NeuralHash hashes contain the least. Table V
supported this intuition.

The results in the MNIST for PDQ were left blank because PDQ could not work on
MNIST. PDQ outputs quality scores of 0 for every image, and each of the hash
values calculated turned out to be a 256-dimensional vector of zeros for MNIST
images.

TABLE V: Quality of Adversarial Images Created in Hash Inversion Attacks (PH: PhotoDNA. PD: PDQ. NH: NeuralHash) Dataset | Hash | $L_{2}$ | SSIM | LPIPS
---|---|---|---|---
| PH | $\mathbf{0.08}\pm 0.02$ | $\mathbf{0.79}\pm 0.02$ | $\mathbf{0.18}\pm 0.03$
MNIST | PD | - | - | -
| NH | $0.19\pm 0.05$ | $0.35\pm 0.10$ | $0.33\pm 0.08$
| PH | $\mathbf{0.13}\pm 0.03$ | $\mathbf{0.57}\pm 0.08$ | $\mathbf{0.40}\pm 0.07$
CelebA | PD | $0.23\pm 0.07$ | $0.44\pm 0.07$ | $0.43\pm 0.05$
| NH | $0.23\pm 0.05$ | $0.29\pm 0.09$ | $0.53\pm 0.07$

(a) PhotoDNA. Left: (.14, .83, .05). Right: (.12, .86, .07)

(b) NeuralHash. Left: (.26, .61, .10). Right: (.34, .52, .14)

Figure 4: Samples of true images and adversarial images generated by hash
inversion attacks based on hashes of (a) PhotoDNA, and (b) NeuralHash. The
numbers are ($L_{2}$, SSIM, LPIPS) measures.

(a) Our model. {$L_{2}$, SSIM, LPIPS} $=$ {.14, .65, .34} (PhotoDNA),

$=$ {.15, .60, .36} (PDQ), {.20, .40, .50} (NeuralHash)

(b) Our model. {$L_{2}$, SSIM, LPIPS} $=$ {.17, .63, .34} (PhotoDNA),

$=$ {.21, .50, .34} (PDQ), {.20, .47, .45} (NeuralHash)

(c) Compare images generated by our model and [12].

Figure 5: Samples of true images and reconstructed images generated by hash
inversion attacks from hashes of PhotoDNA, PDQ, and NeuralHash. The numbers
are quality metrics {$L_{2}$, SSIM, LPIPS} of reconstructed images.

##  V Conclusions

This paper presents a thorough examination of the security of three real-world
perceptual hashing algorithms (PHAs): PhotoDNA, PDQ, and NeuralHash, against
three distinct types of attacks: standard image editing attacks, malicious
adversarial blackbox attacks, and hash inversion attacks. To support the
security study, a query-efficient blackbox adversarial attack algorithm named
Joint Soft-label and Hard-label Attack (JSHA) is designed to expedite blackbox
adversarial attacks while requiring fewer queries. Additionally, the paper
proposes a new data-efficient hash inversion network capable of reliably
reconstructing original images from all hashes, even those of very short
length.

The findings of the study indicate that PHAs exhibit robustness against
blackbox adversarial attacks when realistic constraints regarding adversarial
image distortion and query budget are taken into consideration. However, the
vulnerabilities to certain image editing methods and the potential information
leakage through the hashes raise significant security concerns. These insights
underscore the importance of further research and development efforts to
enhance the resilience and security of perceptual hashing algorithms in
practical applications.

## References

  * [1] Mauro Barni, Patrizio Campisi, Edward J Delp, Gwenaël Doërr, Jessica Fridrich, Nasir Memon, Fernando Pérez-González, Anderson Rocha, Luisa Verdoliva, and Min Wu,  “Information forensics and security: A quarter-century-long journey,”  IEEE Signal Processing Magazine, vol. 40, no. 5, pp. 67–79, 2023\.
  * [2] Hany Farid,  “An overview of perceptual hashing,”  Journal of Online Trust and Safety, vol. 1, no. 1, 2021.
  * [3] Sivic and Zisserman,  “Video google: A text retrieval approach to object matching in videos,”  in Proceedings ninth IEEE international conference on computer vision. IEEE, 2003, pp. 1470–1477.
  * [4] Qingying Hao, Licheng Luo, Steve TK Jan, and Gang Wang,  “It’s not what it looks like: Manipulating perceptual hashing based applications,”  in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 69–85.
  * [5] Wayne A Logan,  “Citizen searches and the duty to report,”  Ohio St. LJ, vol. 83, pp. 939, 2022.
  * [6] Tracy Ith,  “Microsoft’s photodna: Protecting children and businesses in the cloud,”  Retrieved from Microsoft News Center: https://news. microsoft. com/features/microsofts-photodna-protecting-children-and-businesses-in-the-cloud, 2015\.
  * [7] Antigone Davis and Guy Rosen,  “Open-sourcing photo-and video-matching technology to make the internet safer,”  Facebook Newsroom, 2019.
  * [8] Anunay Kulshrestha and Jonathan Mayer,  “Identifying harmful media in $\\{$End-to-End$\\}$ encrypted communication: Efficient private membership computation,”  in 30th USENIX Security Symposium (USENIX Security 21), 2021, pp. 893–910.
  * [9] Jennifer Cobbe,  “Data protection, eprivacy, and the prospects for apple’s on-device csam detection system in europe,”  SocArXiv, 2021.
  * [10] Harold Abelson, Ross Anderson, Steven M Bellovin, Josh Benaloh, Matt Blaze, Jon Callas, Whitfield Diffie, Susan Landau, Peter G Neumann, Ronald L Rivest, et al.,  “Bugs in our pockets: The risks of client-side scanning,”  Journal of Cybersecurity, vol. 10, no. 1, pp. tyad020, 2024.
  * [11] Sean McKeown and William J Buchanan,  “Hamming distributions of popular perceptual hashing techniques,”  Forensic Science International: Digital Investigation, vol. 44, pp. 301509, 2023.
  * [12] Anish Athalye,  “Inverting photodna,”  https://anishathalye.com/inverting-photodna/, 2021.
  * [13] Gannon Burgett,  “Photodna lets google, fb and others hunt down child pornography without looking at your photos,”  PetaPixel, August, 2014.
  * [14] Charles Arthur,  “Twitter to introduce photodna system to block child abuse images,”  The Guardian, vol. 22, 2013.
  * [15] Evan Klinger and David Starkweather,  “phash: The open source perceptual hash library,” 2013.
  * [16] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus,  “Intriguing properties of neural networks,”  arXiv preprint arXiv:1312.6199, 2013.
  * [17] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu,  “Towards deep learning models resistant to adversarial attacks,”  arXiv preprint arXiv:1706.06083, 2017.
  * [18] Nicholas Carlini and David Wagner,  “Towards evaluating the robustness of neural networks,”  in 2017 ieee symposium on security and privacy (sp). Ieee, 2017, pp. 39–57.
  * [19] Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin,  “Black-box adversarial attacks with limited queries and information,”  in International conference on machine learning. PMLR, 2018, pp. 2137–2146.
  * [20] Sijia Liu, Pin-Yu Chen, Xiangyi Chen, and Mingyi Hong,  “signsgd via zeroth-order oracle,”  in International Conference on Learning Representations, 2018.
  * [21] Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger,  “Simple black-box adversarial attacks,”  in International Conference on Machine Learning. PMLR, 2019, pp. 2484–2493.
  * [22] Jianbo Chen, Michael I Jordan, and Martin J Wainwright,  “Hopskipjumpattack: A query-efficient decision-based attack,”  in 2020 ieee symposium on security and privacy (sp). IEEE, 2020, pp. 1277–1294.
  * [23] Brian Dolhansky and Cristian Canton Ferrer,  “Adversarial collision attacks on image hashing functions,”  arXiv preprint arXiv:2011.09473, 2020.
  * [24] Martin Steinebach,  “An analysis of photodna,”  in Proceedings of the 18th International Conference on Availability, Reliability and Security, 2023, pp. 1–8.
  * [25] Lukas Struppek, Dominik Hintersdorf, Daniel Neider, and Kristian Kersting,  “Learning to break deep perceptual hashing: The use case neuralhash,”  in Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, 2022, pp. 58–69.
  * [26] Shubham Jain, Ana-Maria Crețu, and Yves-Alexandre de Montjoye,  “Adversarial detection avoidance attacks: Evaluating the robustness of perceptual hashing-based client-side scanning,”  in 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 2317–2334.
  * [27] Jagdeep Singh Bhatia and Kevin Meng,  “Exploiting and defending against the approximate linearity of apple’s neuralhash,”  arXiv preprint arXiv:2207.14258, 2022.
  * [28] Jonathan Prokos, Neil Fendley, Matthew Green, Roei Schuster, Eran Tromer, Tushar Jois, and Yinzhi Cao,  “Squint hard enough: attacking perceptual hashing with adversarial machine learning,”  in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 211–228.
  * [29] Robert Grimm,  “Putting the count back into accountability: An audit of social media transparency disclosures, focusing on sexual exploitation of minors,”  arXiv preprint arXiv:2402.14625, 2024.
  * [30] Muhammad Shahroz Nadeem, Virginia NL Franqueira, and Xiaojun Zhai,  “Privacy verification of photodna based on machine learning,”  in ,. 93y42, 2019.
  * [31] Manjushree B Aithal and Xiaohua Li,  “Mitigating black-box adversarial attacks via output noise perturbation,”  IEEE Access, vol. 10, pp. 12395–12411, 2022.
  * [32] Justin Johnson, Alexandre Alahi, and Li Fei-Fei,  “Perceptual losses for real-time style transfer and super-resolution,”  in Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11-14, 2016, Proceedings, Part II 14. Springer, 2016, pp. 694–711.
  * [33] Alain Hore and Djemel Ziou,  “Image quality metrics: Psnr vs. ssim,”  in 2010 20th international conference on pattern recognition. IEEE, 2010, pp. 2366–2369.
  * [34] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang,  “The unreasonable effectiveness of deep features as a perceptual metric,”  in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 586–595.