Perceptual Hashes for Content Provenance

Over the past year, we have expanded our R&D outside of purely watermarking. One of the new core technologies we provide is fingerprinting, a.k.a. perceptual hashing.

Historically, fingerprinting has been used to detect matching content, such as for reverse image search (pHash), CSAM detection (PDQ), and audio copyright detection (ContentID). For these applications, where the role of fingerprinting is to act as a filter of sorts, the existing algorithms are adequate. It’s OK if a reverse image search returns an unrelated image. It’s OK if horizontally flipping an image for a repost evades detection.

Now, fingerprinting finds a new use case in content provenance, as a method for information retrieval. Now, the role of fingerprinting is to act as an identifier, so the technical demands on precision and recall are much higher.

We are happy to announce that, by building upon recent advances in multimodal AI, Trufo is able to bring perceptual hashing technology to a level where it can be deployed at scale.

In this article, we present a new benchmark, along with model results, for image fingerprinting in a provenance-retrieval setting.

#The Benchmark

We create the following benchmark:

• 10,000 baseline images, 512-by-512.
• 30,000 positive “A” augmentations, by applying common practical edits, including: flips, rotations, rescaling, blur, compression, grayscale, color jitter, filters, cropping, and combinations thereof.
• 30,000 negative “B” interpretations, designed to be tough: they are similar in semantic space but distinct as images, and are generated from the original image.

The goal is no longer to conduct a binary “is-match” classification on individual image pairs, but to identify the correct “match” from the database of baseline images.

In this new setting, based on a “similarity threshold” the hash evaluation can either return “match” or “not found” — and this match may or may not be correct. The precision and recall are defined:

• Precision = (correct match [A]) / (any match [A, B])
• Recall = (correct match [A]) / (total queries [A])

This new task is much harder, because (1) type “A” augmentations are tougher than usually found in academia, making recall difficult; (2) type “B” interpretations are designed to be collision-susceptible, making precision difficult; (3) the match decision needs to be made over 10,000 images instead of 1.

This new task is also much more realistic. For a public provenance system, doing well on this benchmark should be a bare minimum. If you are interested in testing on this benchmark, please reach out.

#Model Comparison

Our fingerprint (built on top of DinoV3) is designed specifically for use in a content provenance ecosystem. In particular:

• It is meant to run quickly on edge devices, so the model is distilled down to less than 30M parameters. It is possible to achieve better results with more compute, especially in private solutions.
• It is meant for identification. Figuratively, this means that the hash no longer needs to remember that (cat, dog) are more similar than (cat, airplane), which allows it to be more efficient.

We run the benchmark on Trufo’s fingerprint and Trufo’s watermark, along with four open-source perceptual hashes. Note that our models are, of course, neither trained nor validated on any of the images used in the benchmark.

The table can be interpreted as follows:

• pHash (2008) is fast and simple. It's susceptible to collisions, and only works on about 25% of type “A” augmentations.
• PDQ (2019, Meta) is heavier than pHash, and is much more resistant to collisions. However, it shares the same fundamental architecture so only works on the same 25% of type “A” augmentations.
• There are a number of proprietary models used across the industry that we were unable to test. They are typically at least a few years old. Given the power of transfer learning from SotA foundational models, it is hard for us to imagine them being anywhere near as effective as ours.
• CLIP (2021) is perhaps the first popular LLM for images. At 400M parameters (full model) and 3072 bytes (half-precision features), it is too bulky for widespread deployment. It is able to work on a much larger subset of type “A” augmentations, but lacks precision.
• DinoHash (2025) is an open-source fine-tuning method. It is able to achieve CLIP performance with a much smaller model (20x smaller) and a much shorter hash length (100x shorter).
• Trufo's fingerprint retains the compactness of DinoHash while being far more effective at identifying matches. At 99% precision, Trufo is able to match 67% of type “A” augmentations, compared to DinoHash's 13%.
• The invisible-watermark composite DWT/DCT/SVD method is popular on GitHub but quite weak in practice.
• Trustmark (2024, Adobe) is much stronger than pre-ML watermarking, and also much faster, but struggles on tougher modifications.
• Trufo's watermark provides a substantial upgrade in practical durability. As a watermark, it blows away fingerprints at 100% precision, but falls short on some of the toughest modifications.

Here is a color-coded F1 graph. Note that the distribution of Hamming distances in Trufo’s hash tends to cluster much more around 0.5 for distinct images; PDQ (used by Meta at scale) is similar.

The data shows three main conclusions:

• Trufo's fingerprint presents the first practical improvement upon the existing PDQ SotA, with recall @99% jumping from 25% with PDQ to 67% with Trufo.
• When 100% precision is important, watermarks are far more powerful than fingerprints. Fundamentally, watermarks allow you to modify the content, but fingerprints do not, so they must be stronger.
• When speed and retroactive indexing are important, fingerprints are far more practical than watermarks.

The technology will be coming to Trufo’s products soon.