Property-Preserving Hashing for $ell_1$-Distance Predicates: Applications to Countering Adversarial Input Attacks

2025-04-23

AI Summary

This work addresses the challenge of image similarity detection under adversarial perturbations. We propose the first attribute-preserving hash (PPH) scheme tailored to the $ell_1$-distance predicate, grounded in a cryptographic PPH framework. Our method integrates $ell_1$-norm threshold evaluation, image tiling, and efficient hashing, supporting both grayscale and RGB images. It provides provable correctness and robustness: the $ell_1$ constraint forces adversaries to introduce substantial distortion to evade detection, thereby balancing robustness and visual fidelity. Experiments demonstrate practical efficiency—0.0784 seconds per decision on 28×28 grayscale images under 1% perturbation; for 224×224 RGB images processed in tiles, per-tile latency ranges from 0.0128 to 0.2641 seconds. To our knowledge, this is the first provably secure and practically deployable $ell_1$-PPH construction.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems

Abstract

Perceptual hashing is used to detect whether an input image is similar to a reference image with a variety of security applications. Recently, they have been shown to succumb to adversarial input attacks which make small imperceptible changes to the input image yet the hashing algorithm does not detect its similarity to the original image. Property-preserving hashing (PPH) is a recent construct in cryptography, which preserves some property (predicate) of its inputs in the hash domain. Researchers have so far shown constructions of PPH for Hamming distance predicates, which, for instance, outputs 1 if two inputs are within Hamming distance $t$. A key feature of PPH is its strong correctness guarantee, i.e., the probability that the predicate will not be correctly evaluated in the hash domain is negligible. Motivated by the use case of detecting similar images under adversarial setting, we propose the first PPH construction for an $ell_1$-distance predicate. Roughly, this predicate checks if the two one-sided $ell_1$-distances between two images are within a threshold $t$. Since many adversarial attacks use $ell_2$-distance (related to $ell_1$-distance) as the objective function to perturb the input image, by appropriately choosing the threshold $t$, we can force the attacker to add considerable noise to evade detection, and hence significantly deteriorate the image quality. Our proposed scheme is highly efficient, and runs in time $O(t^2)$. For grayscale images of size $28 imes 28$, we can evaluate the predicate in $0.0784$ seconds when pixel values are perturbed by up to $1 %$. For larger RGB images of size $224 imes 224$, by dividing the image into 1,000 blocks, we achieve times of $0.0128$ seconds per block for $1 %$ change, and up to $0.2641$ seconds per block for $14%$ change.

Problem

• Detecting adversarial image attacks using property-preserving hashing
• Constructing PPH for $ell_1$-distance predicates to counter attacks
• Ensuring strong correctness in hash-domain predicate evaluation

Innovation

• First PPH construction for $ell_1$-distance predicates
• Efficient scheme running in $O(t^2)$ time
• Divides images into blocks for faster processing