The Known-Bad Fast Path

In one line: the worst content is usually not new, and matching it against a database of what you have already seen is faster, cheaper and more certain than any classifier.

Why this comes first

A large share of the most severe content on any platform is re-circulated. The same images and videos are uploaded repeatedly, sometimes thousands of times, because they spread through networks that share rather than create.

For that content you do not need to decide whether it violates. You decided already. The only question is whether this upload is the same thing — which is a matching problem, not a classification one.

Matching is better on every axis that matters:

Faster. A hash lookup is sub-millisecond. A video classifier is orders of magnitude more.

Cheaper. No model inference at all.

More certain. A match against a verified entry is near-conclusive, where a classifier score is a probability.

Auditable. "This matched entry 4471 in the verified database" is a defensible reason. A model score is not.

So it runs first, on every upload, before anything else — and everything it catches is content the expensive path never has to see.

Why not a cryptographic hash

Because it would catch almost nothing.

SHA-256 changes completely if a single pixel changes. Re-encode the image, resize it, add a border, adjust the brightness — all trivial, all routine even without adversarial intent — and the hash is entirely different. Every social platform re-encodes uploads by default, so the exact bytes almost never survive.

A perceptual hash is designed for the opposite property: similar-looking images produce similar hashes. Matching is then a distance comparison rather than an equality check, with a threshold.

PhotoDNA is the most widely deployed example, and its pipeline is instructive: convert to greyscale, resize to a fixed small resolution, apply a filter, partition into a grid, and extract measurements per cell into a feature vector. Every step deliberately discards information that a re-encode would change while keeping structure that survives it.

The greyscale conversion alone makes it immune to colour adjustment; the fixed resize makes it immune to scaling. The robustness is engineered, not incidental.

The threshold, and both errors

Matching by distance means a threshold, and both errors are expensive in different ways.

Too loose and unrelated images match, so legitimate content is removed under a near-conclusive verdict with an auditable reason — which makes the wrongful removal harder to overturn than a model's mistake, not easier.

Too tight and evasion is easy, since a small modification pushes the distance past the boundary.

Because a false match carries such authority, these thresholds are set conservatively and matches on the most severe categories are typically verified before the database entry is created rather than after.

What evades it

Worth being honest about, because it bounds the claim.

Cropping, rotating, mirroring, adding overlays or borders, embedding the image in a larger frame, re-filming a screen. Some perceptual hashes are robust to some of these and none is robust to all.

The published work on adversarial security of practical perceptual hashing is clear that these algorithms can be defeated deliberately, so the fast path is a filter that removes the bulk of re-uploads cheaply — not a defence against a determined adversary.

Two mitigations. Generate multiple hash variants per known item — cropped, rotated, mirrored versions — so common transformations are covered. And use embedding similarity as a slower second tier for near-duplicates the hash misses, which trades exactness for robustness.

Video

Harder, and the design question is what you hash.

Frame hashes. Sample frames and hash each. Robust to trimming and reordering, since a subset of frames still matches. Storage and lookup cost scale with the sampling rate.

Whole-video hashes. One signature per video. Cheap, and easily defeated by trimming a few seconds.

Segment hashes. Hash short windows. The usual compromise, and it catches a violating clip embedded inside otherwise-innocuous footage — which is a common evasion.

The sampling rate is the cost dial. Sample every frame of a long video and the hashing cost approaches the classification cost you were avoiding. Sampling a frame every second or two catches most re-uploads for a small fraction of that, and the right rate differs by category — worth spending more on the most severe.

Operating the database

Three properties that make it a system rather than a table.

Entries need provenance. Who added this, when, under which policy, with what verification. A hash database whose entries cannot be justified is unauditable, and an incorrect entry silently removes legitimate content forever.

Sharing across platforms multiplies the value. Industry hash-sharing programmes exist precisely because content circulates across platforms, so a hash identified by one is useful to all. It also concentrates the risk: an incorrect shared entry propagates everywhere.

Removal has to be possible. Entries are added under pressure and some turn out to be wrong. If the database is append-only in practice — because nobody owns removal — errors are permanent.

The general pattern

Worth naming, because it recurs.

Cache the expensive decision. Any system making costly judgements repeatedly on similar inputs should memoise them. Guardrail verdicts cache on a normalised input hash; here the same idea is applied to media, with perceptual similarity standing in for exact equality.

The difference is only that media needs a similarity-tolerant key. The principle — decide once, match cheaply thereafter — is the same, and recognising it as the same is what makes it transferable.

Next: classifying what the hash did not catch.