The Engineering Test for a Perceptual Hash
The subject of this series is not whether perceptual hashing is useful in the abstract, but whether systems such as NeuralHash and PhotoDNA are being asked to carry a kind of certainty they were not designed to provide. This final synthesis connects the similarity contract, population-dependent collisions, threshold and scale effects, adversarial attacks, and CertPHash’s bounded guarantees into one deployment judgment. The conclusion is practical: a perceptual hash can be valuable as a similarity signal, but it cannot be treated as a cryptographic fingerprint unless the evidence supports a much stronger claim than these systems’ contracts allow.
The object being measured is a decision boundary
A cryptographic fingerprint and a perceptual hash can both be compact, deterministic outputs, but they answer different questions. A cryptographic digest asks whether two encoded inputs are the same under an exact comparison. Its security properties are built around making small input changes produce unrelated outputs and making collisions or second preimages infeasible. A perceptual hash asks whether two images belong to the same application-defined visual neighborhood. It is supposed to keep some changed inputs close.
That difference is not a matter of marketing language. It changes what counts as success. For a perceptual system, a collision between two distinct files can be legitimate if the images are perceptually identical or sufficiently similar. The failure occurs when perceptually different images fall into the same accepted neighborhood. The opposite failure occurs when similar images fall outside that neighborhood. A perceptual hash therefore implements an equivalence policy with a fuzzy edge, not an identity test with occasional noise.
The edge is produced by a chain of decisions. Preprocessing determines which input variations survive. Feature extraction—whether traditional image processing or a learned model—determines what visual patterns shape the representation. The output space determines how those patterns are arranged. A distance metric or equality rule compares two outputs. A threshold turns that relationship into a match or non-match. The deployment then decides what to do with the signal.
The threshold is where a continuous visual relationship becomes an operational event. A wider neighborhood can retain more compressed, blurred, resized, or otherwise transformed copies. It also creates more room for distinct images to be accepted. A narrower neighborhood can limit some false positives while missing more legitimate variants. No threshold can separate categories that the representation has already placed on top of one another, and no output length can compensate for information the preprocessing or feature map discarded.
NeuralHash and PhotoDNA make different parts of this geometry visible. NeuralHash produces a 96-bit binary representation, but the black-box study finds that the bits are not uniformly distributed or independent for its tested face populations. PhotoDNA produces a much larger numeric representation, but it recognizes similar images through near-collisions under a distance threshold. One system exposes population-dependent structure in binary outputs; the other exposes the cost of choosing the radius of a numeric match window. Neither behaves like a cryptographic fingerprint simply because its output is compact or long.
A useful way to state the reliability problem is as a chain:
intended invariances → representation distribution → matching threshold → image population → comparison volume → operational consequence.
Break the chain at any point and the claim changes. If the intended invariance is vague, “false negative” has no stable meaning. If the representation is biased for the relevant population, nominal capacity overstates separation. If the threshold is undisclosed, independent evaluation cannot reproduce the decision boundary. If the test population is narrow, its rate cannot be transferred without argument. If the comparison volume is large, a low per-set rate may still create many problematic overlaps. If the post-match workflow is opaque, a function-level error cannot be connected to the harm or correction that follows.
This is why the most important question is not “How many bits does it have?” It is “What claim does the output support, for which inputs, under which rule, and with what consequence?”
Two kinds of evidence, one failure model
The two studies do not answer the same question, and their value comes from putting their answers together. The NeuralHash and PhotoDNA study measures natural and thresholded behavior in a black-box setting. It asks whether a real image population produces problematic overlaps or missed matches without an attacker needing to understand or manipulate the internal design.