A Similarity Signal Is Not a Fingerprint
Perceptual hashing systems turn images into compact representations that can be compared for visual similarity. This opening focuses on a question that is easy to miss in the word “hash”: why should a system designed to keep similar images close be treated as if it were designed to prove that two files are identical? The answer matters for Apple’s NeuralHash, Microsoft’s PhotoDNA, and newer attempts such as CertPHash, because their outputs can feed content-moderation or review systems where both a mistaken match and a missed match have consequences. The useful understanding to carry forward is simple but demanding: a perceptual hash is a similarity signal whose reliability depends on its boundary, its population, and the decisions built around it.
The systems behind the label
A perceptual hash is meant to compress an image without discarding the visual relationships an application cares about. The intended result is not “one file, one unique code.” It is closer to a map: images that look the same or nearly the same should land in the same neighborhood, while images that look meaningfully different should land apart. The map is useful precisely because it ignores some changes that matter to a byte-for-byte comparison—compression, modest noise, a small change in brightness, or a limited geometric transformation.
That design has made perceptual hashing attractive for image identification and moderation. PhotoDNA, developed by Microsoft and Hany Farid, is described in the research literature as widely used by NCMEC, technology companies, and Microsoft services to detect problematic content, particularly child sexual abuse material. Apple introduced NeuralHash in the context of a proposed client-side scanning system. The proposal was withdrawn after strong criticism, but the evaluation discussed here reports that NeuralHash remained embedded in Apple devices, with its current purpose undisclosed. The two systems differ technically: NeuralHash uses a learned model and produces a 96-bit binary representation, while PhotoDNA uses traditional image processing and produces a 144-dimensional numeric vector. They are related by the decision they support, not by identical implementation.
That decision is usually part of a larger workflow. Apple’s proposed design, for example, combined on-device hashing with encrypted reference material, derived keys, threshold secret sharing, and a requirement for multiple matches before decryption and review. Such layers can reduce the chance that one noisy comparison becomes a final action. They do not make the underlying comparison a proof of identity. A function can be weak at separating images even when a service adds review, appeals, or a requirement for repeated evidence. Conversely, a careful workflow can limit harm without making the function accurate enough for every intended use.
At the function boundary, the database comparison is also easy to misread. The system is not asking whether two files have the same bytes. It is comparing a candidate representation with a stored representation, or with a neighborhood around it. A match therefore means that the candidate falls within the rule’s accepted visual relationship to a reference. It does not, by itself, establish that the files came from the same source, that every visible detail is the same, or that the images carry the same meaning outside the chosen representation. Those distinctions are the reason to use a perceptual hash in the first place, and also the reason a match cannot carry more certainty than the representation preserves.
Consider two copies of one photograph: one may have been compressed, resized, or altered in brightness while remaining recognizably the same to a person. A cryptographic digest treats the changed bytes as a different input. A perceptual system is expected to keep the images close. Now consider two different photographs that share a face, pose, background structure, or other features emphasized by the representation. The same tolerance can make them close enough to match even when the application needs them separated. The difficulty is not an accidental edge case at the edge of an otherwise perfect identity test. It is the central engineering task of choosing what information to preserve and what information to ignore.
This distinction also keeps the stakes in proportion. A false positive at the hash layer is not automatically a criminal finding; it is a perceptually different image that the matching rule treats as close enough. But if that signal leads to account suspension, human inspection, temporary storage, or an appeal, the difference between an internal match and a final decision becomes a matter of system design and due process. A false negative can be less visible: the system simply fails to recognize an image it was supposed to connect to known material. For a detection system, that is not a benign omission. A workflow that asks for several matches can lower the chance of acting on one accidental overlap, but it can also delay action, miss material that appears in altered forms, or shift the burden onto reviewers and appeals. The safeguard changes the consequence of the signal; it does not change what the signal means.
Why “fingerprint” is the wrong mental model
A cryptographic hash is designed for a nearly opposite purpose. If one bit of an input changes, the output should look unrelated to the original. Finding two different inputs with the same output, or finding a second input that matches a chosen output, is supposed to be computationally infeasible. That makes a cryptographic digest useful as an integrity or exact-identity fingerprint: the comparison asks whether the data is the same under the chosen encoding, not whether a person would regard two renderings as the same picture.
A perceptual hash must preserve similarity instead. An original photograph and a compressed copy should often remain close. An image with a small brightness change may still be a match. The first study describes perceptual similarity through four overlapping judgments: consistency of color, preservation of structure, preservation of core content despite changes such as compression or overlays, and tolerance for limited noise or blur. These are useful requirements, but they do not define a perfectly sharp natural boundary. Two images can share a face, a pose, or a composition while differing in a way that matters to the application.
So a collision needs a qualifier. Two distinct files producing the same cryptographic digest is normally a failure of the cryptographic design. Two distinct files producing the same perceptual hash is not necessarily a failure, because perceptually identical or near-identical images are expected to converge. It becomes an illegitimate collision when the images are perceptually different but the system merges them. The same logic applies to distance-based matching: an image pair can be a legitimate near-match or an accidental false positive depending on what the images contain and where the application sets its threshold.
The two main error directions follow from this contract. A false positive occurs when distinct images fall inside the same accepted similarity neighborhood. A false negative occurs when images that should be considered similar fall outside it. Improving one is not guaranteed to improve the other. Widening the neighborhood may rescue more compressed, blurred, or resized copies, but it also creates more room for unrelated images to be accepted. Narrowing it can reduce accidental matches while causing the system to miss legitimate variants.
This is why output length alone is an inadequate substitute for analysis. A 96-bit representation has a large nominal space, and a 1,152-bit representation appears larger still. But the practical question is how those outputs are distributed for the images that actually arrive, whether their components behave independently, and how a matcher interprets distance. If a particular population activates a biased or correlated part of the representation, the number of distinguishable neighborhoods can be much smaller than a bit count suggests. If the system uses near-collisions rather than exact equality, the size of the accepted neighborhood matters as much as the size of the space.
The questions a reliable claim must answer
The evidence in this series approaches the problem from two complementary directions. The NeuralHash and PhotoDNA study tests deployed functions in a black-box setting. It looks for natural collisions among public face images, measures how often similar images fail to match, varies blur and PhotoDNA’s comparison threshold, and estimates what observed behavior could mean when the number of processed images grows. Its results are deliberately concrete, but they are not a universal production-rate measurement: the experiments use a controlled public dataset, and the authors identify important limits in how well it represents real content.
The CertPHash study begins with a different problem. An attacker may deliberately perturb an image to push it away from its own hash or to bring it close to the hash of a different image. The proposed system uses robust training and verification to place explicit bounds on those two attack directions while preserving ordinary perceptual functionality. That is a promising response to bounded adversarial perturbations, but a certificate is meaningful only with its norm, radius, model, threshold, verifier, and tested inputs attached. It is not a conversion of a perceptual hash into a cryptographic fingerprint, and it does not erase natural population collisions or the policy choices around a match.
Taken together, these studies point to a more useful test than “How many bits does the hash have?” A serious evaluation must ask what visual changes the system promises to ignore; which distinct images it must keep apart; how equality or distance becomes a match; what happens on the relevant image population; how error probability changes with the number of comparisons; what an adversary can do within a stated budget; and what review, appeal, or escalation follows a match. It must also say what remains unknown. A result from celebrity faces is not automatically a result for every image category. A rate after human appeals is not the same as the false-positive rate of the hash function. A certified rate inside one perturbation ball is not a proof over the infinite space of possible images.
The central correction, then, is not that perceptual hashing is useless. It is that its usefulness must be judged on its own terms. NeuralHash and PhotoDNA are similarity-matching systems whose strengths and failures emerge from representations, thresholds, populations, and workflows. CertPHash shows how those properties might be made more explicit and more robust under bounded attacks, while also exposing the cost of making the guarantees meaningful. The next step is to examine the matching contract itself: how images become representations, how outputs become neighborhoods, and where the choices that enable tolerance also create opportunities for error.