LLM-Guided Program Evolution for Targeted Black-Box Attacks on Perceptual Hash Algorithms

Image generated by AI

TLDR

• What: LLM-guided program evolution (using OpenEvolve and GigaEvo) automates targeted black-box collision attacks on perceptual hashing algorithms by writing and iteratively refining python-based search strategies rather than just tuning scalar hyperparameters.
• Who's at risk: Automated content moderation, copyright enforcement, and child safety (CSAM) detection systems that rely on global or neural perceptual hash algorithms (such as Meta's PDQ, Apple's NeuralHash, Microsoft's PhotoDNA, and open-source pHash).
• Key number: Evolved attack programs reduce the composite attack cost score relative to the best optimized hand-crafted seeds by 41.2% for NeuralHash, 38.3% for PDQ, and 34.0% for pHash.

Perceptual hash algorithms (PHAs) are widely deployed inside modern trust-and-safety architectures to flag illegal or copyrighted media. Unlike cryptographic hashes, PHAs map perceptually similar images to nearby binary strings under Hamming or $L_1$ distances. While stable under benign edits like resizing or compression, this continuous-to-discrete mapping creates severe security vulnerabilities when facing an active adversary.

Recent research, such as LLM-Guided Program Evolution for Targeted Black-Box Attacks on Perceptual Hash Algorithms, demonstrates that large language models (LLMs) can act as automated red-team programmers. By leveraging evolutionary frameworks, an LLM can systematically engineer novel search algorithms that trigger targeted hash collisions under strict black-box conditions, completely bypassing the need for gradient access or internal architecture knowledge.

Threat Model

The paper's evaluation operates under a highly practical, black-box threat model:

Background & Problem Setup

PHAs extract continuous features from an image and quantize them into a discrete bitstring. Because quantization turns tiny feature changes into sudden, large Hamming distance steps, traditional gradient-based attacks struggle. Black-box adversarial attacks must therefore rely on zero-order optimization techniques.

The authors evaluate five major hand-written seed attacks as their baseline portfolio, comparing them with their automated evolutionary framework:

Related Work Comparison

Methodology: LLM-Driven Program Evolution

Instead of using an LLM to directly generate adversarial images, the framework uses an LLM (specifically Qwen2.5-7B served in FP8) to write, mutate, and optimize the Python code that generates the images.

                                  +-----------------------+
                                  |      Seed Portfolio   |
                                  | (SimBA, ATKScopes...) |
                                  +-----------+-----------+
                                              |
                                              v
                                  +-----------------------+
                                  |  Optuna Hyperparam    |
                                  |     Optimization      |
                                  +-----------+-----------+
                                              |
                                              v
+-----------------------+         +-----------------------+
|  Black-Box Hash Oracle | <-----+ |   LLM Program Gen     | <----+
| (Returns Distance d)  |         | (GigaEvo/OpenEvolve)  |      | Mutation
+-----------------------+         +-----------+-----------+      | Loop
                                              |                  |
                                              v                  |
                                  +-----------------------+      |
                                  |  External Evaluator   | -----+
                                  | Compute Score S (Eq3) |
                                  +-----------+-----------+
                                              |
                                              v
                                  +-----------------------+
                                  | Best Evolved Program  |
                                  +-----------------------+

The Optimization Loop

1. Seed Optimization: The five baseline attacks are first optimized per-hash using the Optuna framework [1] with a Tree-structured Parzen Estimator (TPE) sampler [26] to establish a highly competitive baseline.
2. Program Evolution: The optimized attack scripts are fed into GigaEvo [15] and OpenEvolve [24] as seed programs.
3. LLM Mutation: The LLM acts as the mutation operator, altering search step sizes, scheduling, coordinate traversal, or projection logic.
4. Execution & Evaluation: Each mutated program is executed on 30 ImageNet image pairs and scored using a composite score $S$ (Equation 3):

where $\overline{L}_2$ is the average Euclidean distance, $\overline{Q}$ is the average query count, and ASR is the Attack Success Rate. If the program fails to achieve any collisions, a penalty of 10,000 is added (Equation 4).

Conceptual Attack Protocol Template

All candidates must adhere to a strict Python programming interface:

def run_attack(xs, O, theta, B, r) -> np.ndarray:
    """
    xs: source image (256x256x3 float in [0, 1])
    O: Black-box oracle; O(x) returns d(H(x), h_t)
    theta: hyperparameters dictionary
    B: query budget
    r: random seed
    Returns: best adversarial image x_best
    """
    # LLM-evolved logic goes here
    # Example mutated strategy: low-frequency DCT traversal with adaptive step sizing
    ...

Key Results

Table 6, Table 7, and Table 8 from the paper detail the performance improvements. The LLM-evolved programs consistently lowered the composite score $S$ across all four evaluated perceptual hash functions.

Best Seed vs. Best Evolved Program Performance

Analysis of Evolved Strategies (Table 9)

The qualitative program changes introduced by the LLM were algorithmic rather than superficial:

• pHash (OpenEvolve): Introduced collision post-processing, DCT coefficient shrinkage, and luminance-consistent projection.
• PDQ (OpenEvolve): Created a luminance-oriented search with coordinate importance estimates and small-coefficient pruning.
• NeuralHash (GigaEvolve): Designed multi-coordinate DCT probes with adaptive step expansion/shrinkage and a binary search fallback to the source image upon achieving success.

Limitations & Open Questions

While the results look formidable, a critical, skeptical examination reveals several weaknesses:

1. In-Sample Overfitting: The entire evolutionary search, hyperparameter optimization, and final evaluation were performed on the exact same 30 ImageNet pairs. The paper lacks a large-scale, out-of-sample holdout set evaluation.
2. Impractical Query Budgets: Achieving a collision on NeuralHash required an average of 9,382 queries per image. In real-world production settings, such volume would easily trigger basic anomaly detection or IP rate limits.
3. Unrealistic Graded Oracle assumption: The attack relies entirely on receiving the exact integer distance $d$ to the target hash. Real-world target APIs generally operate as hard-label systems (only returning binary "match/no-match" or blocking suspicious uploads), rendering graded optimization useless without further inversion techniques.
4. High Visual Distortion: For PhotoDNA ($L_2 = 104.50$, LPIPS $= 0.572$) and NeuralHash ($L_2 = 133.07$, LPIPS $= 0.697$), the perturbations are highly visible. These are mathematical database collisions, not "invisible" adversarial patches.

What Practitioners Should Do

If your systems rely on perceptual hashing for moderation or copyright matching, you should immediately implement the following defenses:

1. Enforce Hard-Label APIs: Never return numerical Hamming or $L_1$ distances to the client. The API should only return a binary decision flag.
2. Implement Aggressive Rate Limiting: Limit individual user accounts or API keys to low daily limits (e.g., maximum 100 media uploads/checks per day) to neutralize search algorithms that require thousands of queries to converge.
3. Apply Input Preprocessing and Consistency Checks: Prior to hashing, apply randomized, non-differentiable preprocessing to uploaded images (such as minor localized cropping, resizing, or re-compression). This breaks the deterministic feedback loop required by zero-order black-box optimizers.
4. Use Multi-PHA Consensus: Do not rely on a single global hash. Use a consistency mechanism requiring matching results from multiple distinct architectures (e.g., pairing Meta's DCT-based PDQ with a neural embedder).

The Takeaway

This paper proves that the security boundary for ML systems is shifting. Red-teamers and attackers no longer need to manually code complex zero-order optimization pipelines to exploit non-differentiable models. By utilizing LLM-guided program evolution, an attacker can dynamically generate highly customized, algorithmically complex exploit scripts tailored to the distinct mathematical quirks of any target black-box system.

Den's Take

What excites me about this paper is the paradigm shift: we are moving past human researchers hand-crafting heuristic search algorithms to letting LLM-driven frameworks like OpenEvolve and GigaEvo write the optimization code for us. Traditional zero-order optimizations struggle with the sharp, discrete cliffs of quantized perceptual hashes. Evolving search programs specifically tailored to bypass these landscapes yielded highly impressive results, dropping the composite attack cost score relative to optimized seeds by 41.2% for NeuralHash, 38.3% for PDQ, and 34.0% for pHash.

However, we must look closely at the real-world utility of these attacks. The query budgets here are massive—ranging from 10,000 queries for pHash up to 30,000 for NeuralHash. While mathematically sound, any modern trust-and-safety pipeline worth its salt will rate-limit or block an IP hammering their hash oracle with tens of thousands of sequential, slightly mutated images. For this to move from a neat lab demo to a practical threat against commercial systems, we need to see these evolved programs achieve similar collision rates with a fraction of the queries.