The Attacker's Two Doors: Evasion and Collision

The deployed studies examined natural overlaps in an image population; CertPHash asks what happens when someone deliberately searches for one. This chapter focuses on the two adversarial ways to break a perceptual hash: push a modified version of an image outside its own accepted neighborhood, or push a different image into a target’s neighborhood. The reader’s practical gain is a sharper robustness model: certified protection against one bounded objective does not automatically protect against the other, and neither substitutes for measuring natural population errors.

Two attack objectives, not one generic “robustness” problem

A perceptual hash normally accepts some changes because that is its purpose. A rotated, cropped, compressed, or slightly altered image may still be intended to match the original. An attacker can turn that tolerance into an evasion opportunity by changing an image just enough that its output moves beyond the match threshold. The image may remain visually close to the original, but the system no longer recognizes the relationship it was designed to preserve. In the notation of the CertPHash study, the attacker seeks a modification whose hash distance from the original exceeds the matching threshold.

A collision attack reverses the direction. The attacker starts with two images that are distinct and do not match in the clean setting. They modify one of them so that its output enters the target image’s accepted neighborhood. The goal is not merely to make the source hash different. It is to make the modified source look close to a chosen target in the output space while the images remain perceptually distinct. That is a targeted collision, or a second-preimage-style failure of separation.

The distinction is operational. In evasion, the reference is the image’s own clean output, and the success condition is that a transformed version leaves that reference neighborhood. In collision, the reference is another image’s output, and the success condition is that a distinct source enters it. The first attacks stability; the second attacks separation. A perturbation that succeeds at one objective may be irrelevant to the other. A design that keeps transformed copies together can still leave unrelated images close, while a design that separates clean images can still be sensitive to a small change in one image.

Both objectives sit alongside natural collisions rather than replacing them. A natural collision occurs when distinct inputs overlap without anyone optimizing them. A non-natural collision is produced by intentional modification. The first study’s black-box experiments ask how often the image population itself creates problematic overlap. CertPHash’s threat model assumes an adversary with much more information: white-box access to the model, knowledge of the PHash system and match threshold, access to allowlist and blocklist images and their hashes, queries or intermediate outputs, and the ability to optimize perturbations.

That knowledge assumption makes the formal claim precise, not universal. Certified robustness considers a specified perturbation region, such as an l∞ or l2 ball around an input, and asks what happens for every allowed perturbation inside it.