Abstract:End-to-end encryption (E2EE) provides strong technical protections to individuals from interferences. Governments and law enforcement agencies around the world have however raised concerns that E2EE also allows illegal content to be shared undetected. Client-side scanning (CSS), using perceptual hashing (PH) to detect known illegal content before it is shared, is seen as a promising solution to prevent the diffusion of illegal content while preserving encryption. While these proposals raise strong privacy concerns, proponents of the solutions have argued that the risk is limited as the technology has a limited scope: detecting known illegal content. In this paper, we show that modern perceptual hashing algorithms are actually fairly flexible pieces of technology and that this flexibility could be used by an adversary to add a secondary hidden feature to a client-side scanning system. More specifically, we show that an adversary providing the PH algorithm can ``hide" a secondary purpose of face recognition of a target individual alongside its primary purpose of image copy detection. We first propose a procedure to train a dual-purpose deep perceptual hashing model by jointly optimizing for both the image copy detection and the targeted facial recognition task. Second, we extensively evaluate our dual-purpose model and show it to be able to reliably identify a target individual 67% of the time while not impacting its performance at detecting illegal content. We also show that our model is neither a general face detection nor a facial recognition model, allowing its secondary purpose to be hidden. Finally, we show that the secondary purpose can be enabled by adding a single illegal looking image to the database. Taken together, our results raise concerns that a deep perceptual hashing-based CSS system could turn billions of user devices into tools to locate targeted individuals.

Robustness of Practical Perceptual Hashing Algorithms to Hash-Evasion and Hash-Inversion Attacks

Evade Deep Image Retrieval by Stashing Private Images in the Hash Space.

Secure and robust image perceptual hashing

You See What I Want You to See: Exploring Targeted Black-Box Transferability Attack for Hash-based Image Retrieval Systems

Learning to Break Deep Perceptual Hashing: The Use Case NeuralHash

Perceptual Hash Inversion Attacks on Image-Based Sexual Abuse Removal Tools

Reliable and Efficient Evaluation of Adversarial Robustness for Deep Hashing-Based Retrieval

Deep perceptual hashing algorithms with hidden dual purpose: when client-side scanning does facial recognition

Recent Development of Perceptual Image Hashing

A Novel Block-DCT and PCA Based Image Perceptual Hashing Algorithm

Research on Robust Image Perceptual Hashing Technology Based on Discrete Cosine Transform

Hamming Distributions of Popular Perceptual Hashing Techniques

Efficient Non-Targeted Attack for Deep Hashing Based Image Retrieval

Robust image hashing based on random Gabor filtering and dithered lattice vector quantization.

Robust Image Hashing for Image Authentication Based on DCT-DWT Composite Domain

Re-purposing Perceptual Hashing based Client Side Scanning for Physical Surveillance

Practical protection against video data leakage via universal adversarial head

Deep Perceptual Hash Based on Hash Center for Image Copyright Protection

An Overview of Perceptual Hashing

Perceptual hashing for image authentication: A survey

Targeted Attack for Deep Hashing based Retrieval