Search papers, labs, and topics across Lattice.
This paper introduces an evolutionary framework leveraging GigaEvo and OpenEvolve to execute targeted black-box attacks on perceptual hash algorithms (PHAs), addressing their vulnerability to adversarial perturbations. The authors evaluate attack performance using a composite score that balances attack success rate, query efficiency, and L2 distortion, demonstrating that their method outperforms existing black-box approaches across multiple PHAs with fewer queries and lower distortion. Notably, the best evolved programs significantly reduce the composite attack score by up to 41.2%, revealing critical weaknesses in current content-moderation systems.
Evolved programs can exploit perceptual hash algorithms with unprecedented efficiency, exposing significant vulnerabilities in content moderation.
Perceptual hash algorithms (PHAs) are widely deployed to detect image forgery under benign transformations, yet their robustness against adversarially chosen perturbations remains poorly understood and rarely comes with provable guarantees. We propose a novel evolutionary framework based on GigaEvo and OpenEvolve for targeted second-image attacks on perceptual hash algorithms. We assess attack performance using a composite score that jointly accounts for the fraction of adversarial images whose normalized Hamming distance to the target hash falls below threshold p (Attack Success Rate), the number of queries issued to the hash function, and the L2 distortion relative to the original image. Experiments on four deployed PHAs (pHash, PDQ, PhotoDNA, NeuralHash) across 30 ImageNet image pairs demonstrate that our evolutionary approach achieves comparable or better ASR than existing black-box baselines using substantially fewer queries to the hash function, while simultaneously producing adversarial images with lower L2 distortion relative to the originals. The best evolved programs reduce the pre-defined composite attack score relative to the best optimized seed by 41.2% for NeuralHash, 38.3% for PDQ, 34.0% for pHash, and 8.1% for PhotoDNA. Unlike gradient-based methods, our framework requires no internal knowledge of PHA architectures and naturally handles the non-differentiable, discretized nature of hash outputs. These results reveal previously unreported vulnerabilities in widely deployed content-moderation pipelines and motivate the development of provably robust perceptual hashing 1schemes.
