LLM-Guided Program Evolution for Targeted Black-Box Attacks on Perceptual Hash Algorithms

2026-07-13

AI Summary

This work addresses the lack of provable robustness in perceptual hashing algorithms under adversarial perturbations by introducing GigaEvo/OpenEvolve, a large language model (LLM)-guided program evolution framework. For the first time, LLM-driven program synthesis is applied to black-box attacks on perceptual hashing, circumventing the need for internal algorithm access and effectively handling the discrete and non-differentiable nature of hash outputs. By optimizing a composite scoring metric, the method achieves high-efficiency attacks with minimal perturbation. Experimental results demonstrate that the approach significantly outperforms existing black-box attacks on pHash, PDQ, PhotoDNA, and NeuralHash, requiring fewer queries, achieving lower L2 distortion, and reducing the composite attack score by up to 41.2%, thereby exposing previously undisclosed security vulnerabilities in mainstream content moderation systems.

Abstract

Perceptual hash algorithms (PHAs) are widely deployed to detect image forgery under benign transformations, yet their robustness against adversarially chosen perturbations remains poorly understood and rarely comes with provable guarantees. We propose a novel evolutionary framework based on GigaEvo and OpenEvolve for targeted second-image attacks on perceptual hash algorithms. We assess attack performance using a composite score that jointly accounts for the fraction of adversarial images whose normalized Hamming distance to the target hash falls below threshold p (Attack Success Rate), the number of queries issued to the hash function, and the L2 distortion relative to the original image. Experiments on four deployed PHAs (pHash, PDQ, PhotoDNA, NeuralHash) across 30 ImageNet image pairs demonstrate that our evolutionary approach achieves comparable or better ASR than existing black-box baselines using substantially fewer queries to the hash function, while simultaneously producing adversarial images with lower L2 distortion relative to the originals. The best evolved programs reduce the pre-defined composite attack score relative to the best optimized seed by 41.2% for NeuralHash, 38.3% for PDQ, 34.0% for pHash, and 8.1% for PhotoDNA. Unlike gradient-based methods, our framework requires no internal knowledge of PHA architectures and naturally handles the non-differentiable, discretized nature of hash outputs. These results reveal previously unreported vulnerabilities in widely deployed content-moderation pipelines and motivate the development of provably robust perceptual hashing 1schemes.

Problem

• perceptual hash algorithms
• black-box attacks
• adversarial images
• targeted attacks
• hash robustness

Innovation

• LLM-guided evolution
• black-box attack
• perceptual hash algorithms
• query-efficient
• non-differentiable optimization