PhotoDNA and the Price of a Wider Match Window

PhotoDNA makes the threshold problem visible in a different form from NeuralHash. This chapter focuses on why a large numeric representation still needs a near-collision rule, what changed when the study moved its L2 threshold from 150 to 175, and how a small rate in a controlled test can grow into a serious deployment concern. The practical judgment is not that one threshold is universally right. It is that the threshold, image population, comparison volume, and post-match workflow must be evaluated as one system.

A large vector still needs a neighborhood

PhotoDNA does not normally identify similar images by requiring two numeric outputs to be exactly equal. The first study describes it as a 144-dimensional numeric hash, or 1,152 bits in the paper’s accounting, and explains that similar images are expected to produce close rather than identical vectors. A distance metric turns that closeness into a decision. In the experiments discussed here, the researchers use the L2 distance: two vectors are near enough to count as a match when their geometric distance falls below a chosen threshold.

That distinction matters more than the impressive-looking number of coordinates. An exact-equality rule would be too strict for a system intended to recognize copies that have been resized, compressed, or otherwise altered. The near-collision rule creates a region around each reference vector. Every candidate landing inside that region is accepted as similar enough. The representation supplies the coordinates; the threshold supplies the size of the neighborhood. The false-positive and false-negative behavior belongs to their combination.

Microsoft has not publicly disclosed the complete PhotoDNA algorithm, the exact distance metric used in every deployment, or the production threshold values. The researchers therefore treat the implementation as a black box and examine representative L2 thresholds of 150 and 175, drawing on earlier studies that had analyzed this range. These values should not be read as a confirmed specification for every service using PhotoDNA. They are controlled operating points for testing how the same representation behaves when the accepted neighborhood is widened.

The test uses the non-blurred face set from CelebA, containing 202,599 images. That choice holds the image population steady while changing one important policy variable: how much distance the matcher will accept. At a threshold of 150, the study finds one illegitimate collision, involving two images, for a reported false-positive rate of 0.001%. The first such collision appears after approximately 2^17 hash evaluations. The same setting produces 3,506 legitimate collisions among the image pairs the researchers expected to match, but still yields a 24.1% false-negative rate.

At 175, the accepted neighborhood is wider by 25 distance units. The observed change is not a small, proportional adjustment. The study finds 32 illegitimate collisions involving 64 images, a reported false-positive rate of 0.03%, and a first illegitimate collision after approximately 2^14.6 evaluations. Legitimate collisions rise to 3,800, and the false-negative rate falls to 17.8%.