arXiv:2608.03101cs.CV2026-08

不重训练即可增强图像哈希抗攻击能力,提升平台安全

Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retraining

论文配图:Double Down on Defense: Strengthening Deep Perceptual Hashes against Evasion Attacks without Retraining
图 1 · 摘自论文原文
  • 匹配时采用随机平滑,发布前对参考图加微扰,双机制防御
  • 实现约0.3的ℓ₂认证鲁棒半径,有效防止扰动逃逸匹配
  • 适用于版权保护、溯源等场景,无需修改原有模型

近似重复图像匹配在信任与安全、来源验证、版权保护及大规模视觉搜索中至关重要。现代平台越来越多依赖深度感知哈希,该技术能在常见图像变换下将视觉相似图像映射到相近表示。然而,对抗性扰动可能导致近似重复图像逃避匹配。本文提出DualShield,一种无需重训练或修改底层模型的即插即用防御方案。它结合匹配时的随机平滑(对扰动后的参考-查询对聚合决策)与发布时的硬化(在每张参考图发布前添加优化的不可察觉扰动),实现认证与实证鲁棒性。DualShield在ℓ₂范数下获得约0.3的认证半径,确保在此范围内的查询扰动无法逃逸匹配。我们在八种深度感知哈希和三个数据集上评估其对自适应白盒、黑盒及图像变换攻击的防御效果,显著降低攻击成功率,同时保持低碰撞率。结果表明,通过改进匹配流程和提前硬化参考图像,可在不重训练的前提下有效增强深度感知哈希的鲁棒性。

原文摘要 · Abstract (English)

Near-duplicate image matching is crucial for trust and safety, provenance verification, copyright enforcement, and large-scale visual search. Modern platforms increasingly rely on deep perceptual hashes, which map visually similar images to nearby representations despite common image transformations. However, adversarial perturbations can cause near-duplicates to evade matching. We present DualShield, a plug-in defense that improves the robustness of existing deep perceptual hashes without retraining or modifying their underlying models. DualShield combines matching-time randomized smoothing, which aggregates decisions over perturbed reference-query pairs, with publication-time hardening, which adds an optimized imperceptible perturbation to each reference image before publication. Together, these mechanisms provide certified and empirical robustness. DualShield achieves a certified $\ell_2$ radius of approximately 0.3, guaranteeing that query perturbations within this radius cannot evade matching. We further evaluate it against adaptive white-box, black-box, and image-transformation attacks. Across eight deep perceptual hashes and three datasets, DualShield substantially reduces attack success rates while preserving low collision rates. These results show that deep perceptual hashes can be strengthened without costly retraining by improving the matching procedure and hardening reference images before publication.

图像哈希对抗防御可信安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。