PhotoDNA False Positives: How Often the Technology Is Wrong.

Last Updated on: 4th August 2026, 01:33 am

While PhotoDNA is renowned for its accuracy, Microsoft describes its false-positive rate as “one in 50 billion,” and this figure, again, is unquantified. Microsoft has been clear about the notion of PhotoDNA “matching” a file; this process produces a “candidate match” that a human then examines. In Reddick, a detective then reviewed the suspect files and confirmed their contents.

Microsoft developed PhotoDNA to identify known images and, unlike cryptographic hashing (discussed below), PhotoDNA can produce matches even after modifications like resizing, recompression, or changing colors (or color schemes, such as grayscale, or adjusting brightness/contrast). Thus, any image identified by PhotoDNA will be flagged as a match regardless of its actual size or format.

Difference Between PhotoDNA and Cryptographic Hashing

What is the difference between PhotoDNA and the “cryptographic hashing” used to identify data files and messages? Cryptographic hashes identify exact file duplicates and they are unable to recognize and match visually similar files.

Many types of cryptographic hashes exist, such as:

• MD5: Produces 128-bit digests and has been known to produce collisions (even through intentional engineering).
• SHA-1: Produces a 160-bit digest.
• SHA-2: SHA-2 is an updated version and is often required for U.S. government use.

Again, a “collision” means that a hash algorithm has produced the same value for two different files. The incidence of collisions is what describes the frequency of false positives, when detecting exact file duplicates. SHA-1 is no longer considered collision-resistant: researchers produced the first practical SHA-1 collision in 2017 with the SHAttered attack, and the first chosen-prefix SHA-1 collision in 2020, at an estimated cost of roughly $45,000 in computing time. No collision has ever been demonstrated against SHA-2. The incidence of collisions is extremely low, but it is not zero. In other words, cryptographic hashing techniques can produce false positives as well; only it is even less likely, and not as often, as the incidence of false positives in the PhotoDNA technology.

Why is PhotoDNA’s Real-World Error Rate still Unknown?

While Microsoft, the developers of PhotoDNA, claim a “one-in-50-billion” false-positive rate, they don’t tell us how they got this number. While we know PhotoDNA has been subjected to rigorous testing, it’s a lot of guesswork to assume that it works as intended in the real world. We also don’t have access to information about PhotoDNA’s false-positive rates (FPR), PhotoDNA thresholds, the training data that went into developing PhotoDNA, or PhotoDNA’s update history.

How is the False-Positive Rate Calculated?

Calculating a false-positive rate involves taking the number of files that matched improperly, and then dividing that number by the total number of comparisons that were made.

Microsoft reports that PhotoDNA has a candidate-match false-positive rate of one in 50 billion. This is far from a definitive statement. Here are five key reasons why:

1. We don’t know how often a “candidate match” comes back false. Microsoft’s claim of PhotoDNA’s “false-positive rate” only applies to “candidate matches” which are then vetted by human reviewers. If candidate matches fail human verification 50% of the time, then a one-in-50-billion candidate false-positive rate is vastly different from a one-in-50-billion false-positive rate.

2. Even if the false-positive rate is truly one in 50 billion, the sheer volume of files on the Internet can result in thousands of files being wrongly flagged.

3. When determining if a false-positive rate is “low enough,” what would a person think is “enough?” The frequency of human errors that determine “false-positive matches” may be higher than any candidate-match false-positive rate.

4. False-positive estimates may not be transferable. When a different threshold is used (which Microsoft acknowledges happens), or when a different review procedure is used, a different (potentially higher) false-positive rate would apply.

5. Not all files in hash lists are created equal. The incidence of false positives is likely to vary based on the type of image (e.g., a photo of a child vs. a baby) and image resolution.

Similarly to how we have no access to information about the error rates of PhotoDNA, we have no access to information about how NCMEC, the organization that develops hash lists used in criminal prosecutions, manages its hash lists. While NCMEC receives provider reports, reviews them, forwards them to appropriate law-enforcement agencies, and treats a completed CyberTipline submission as a request to preserve the reported material, it is not clear how NCMEC verifies that a hash-list file is indeed child sexual abuse material.

How are the PhotoDNA Hash Lists Developed and Maintained?

NCMEC hash lists contain images that have been identified as “apparent CSAM.” New files enter these lists from U.S. police departments, internet providers and computer hosting companies, and foreign police agencies. NCMEC is clear that it does not “verify” all the content in its hash lists, and is clear that it does not “verify” all the content in its hash lists in the same way that the analysts at these sources do.

We don’t know how NCMEC handles suspected false positives, and we don’t know how it updates its hash lists. It is impossible to confirm if, or how, NCMEC is in contact with the companies whose hash lists it may have incorporated, which further highlights the lack of a clear process for vetting the materials that are used by agencies across the United States to conduct investigations.

What Actually Counts as a PhotoDNA False Positive?

PhotoDNA is a perceptual hash, rather than a cryptographic hash. A cryptographic hash is an exact value that is unique to a file. Any change to the file will change the hash value. Perceptual hashes, like PhotoDNA, are based on a method of “reducing” an image to its most important properties. These properties then define the perceptual hash value.

As a result, PhotoDNA (unlike cryptographic hashing) is meant to tolerate minor changes that may have been made to an image. While a cryptographic hash identifies exact file duplicates, a perceptual hash identifies files that are visually similar. This is a key reason why it makes the most sense to consider PhotoDNA “plausible” (if not “certain”) to have false positives.

The Many Different Types of False Positives

When discussing PhotoDNA false positives, there are four main ways to define them. The four types range from “the hash worked but the image was misidentified” to “the hash failed in its function and produced an accidental match.”

1. Reference Set Misidentification

One possibility is a reference-set misidentification. A perceptual hash algorithm that works correctly might produce an accurate hash for the target image, but that target image might have been misidentified by a human analyst. If the analyst labeled the target image as prohibited child sexual abuse material when it was not, then even if the hash matched an identical image in another person’s storage space, that match would be an erroneous one.

Again, the PhotoDNA match would be correct, but the human analyst’s identification of the image would not be, and that misidentification would lead to a misleading result. The hash would produce an otherwise accurate match, but because of the error in the reference set, the PhotoDNA algorithm would produce a false positive.

2. Perceptual Hash Collisions

Another possibility is a perceptual-hash collision. Here, an image ( la a baby photo, screenshot of a video, or photo of a comic strip) would produce a perceptual hash that was similar enough to a prohibited image’s perceptual hash for PhotoDNA to match the two, despite both images being completely unrelated. This type of false positive could result from perceptual hash collisions. Here, too, the incidence of false positives would depend on the threshold for a perceptual hash match.

3. Improper Match Threshold

Another possibility is a match threshold that has been set improperly. This is possible because every child sexual abuse material investigation will need to use different match thresholds, and that means different thresholds are always being tested and refined in real-world use.

As a result, there is no single perceptual-hash match threshold for determining whether an image matches child sexual abuse material. As this is the case, some match thresholds will result in more false positives than others. When an improperly configured match threshold is used in an actual investigation, PhotoDNA will produce more false positives.

4. Analyst Misclassification

The final type of PhotoDNA false positive is analyst misclassification. But when an analyst’s misclassification results in the identification of an image that did not actually come from PhotoDNA’s hash list, this should be considered a human error rather than an algorithmic error. While an analyst should be accountable for this error, it does not add to the number of false positives produced by PhotoDNA.

Important Considerations When Addressing False Positives

There are a few important considerations when addressing PhotoDNA false positives:

• Failed Prosecution ≠ False Positive: As noted above, just because a prosecutor decided not to bring the image into court (or the jury decided not to convict based on the image) does not mean the image matched the prohibited material. The fact that an analyst identified an image in an investigation as child sexual abuse material does not mean the match was a false positive, even if there was no conviction.
• Random Perceptual Collisions vs. Deliberate Matches: Not to be confused with the random perceptual collisions that might happen, there are deliberate matches. In these instances, people engineer images to get a specific match from a cryptographic hash. While we don’t know if this can happen with perceptual hashes, the possibility is nonetheless there.

This is the point at which most people call a lawyer. Spodek Law Group takes federal criminal defense cases nationwide from its New York and Los Angeles offices.

Can CyberTipline Statistics Reveal PhotoDNA’s Actual Error Rate?

In 2024, NCMEC received 20.5 million CyberTipline reports. This is the total number of reports from a range of different sources:

• User reports
• Provider tools
• Automated classifiers

As a result, that number is not the total number of PhotoDNA matches.

Again, from there we can draw other conclusions:

• This 20.5 million figure does not necessarily mean a number of 20.5 million PhotoDNA matches.
• It doesn’t necessarily indicate 20.5 million unique suspects.
• It does not necessarily mean a number of 20.5 million criminal cases.

A case could have occurred because someone posted the same child sexual abuse material image thousands of times. And, we have no way of knowing what happened with each of those 20.5 million reports. The public statistics available for CyberTipline reports do not connect the reports to the case disposition, but instead just provide the number of reports received and the type of reported content.

How Major Providers Use PhotoDNA and Other Technologies to Identify CSAM

We can also ask how major providers use PhotoDNA and other technologies to identify child sexual abuse material. When a user uploads a file (like an image or a video), the provider will compare it against the hash set that NCMEC provides. But major providers (Google, Meta, Microsoft, for example) will also compare uploads against their own internal hash sets, too.

When a match is made, an analyst at the provider typically determines if the matched file is child sexual abuse material. This will then be sent to CyberTipline, where it is once again checked by a CyberTipline analyst. This analyst determines if the content is child sexual abuse material and whether a report must be sent to federal or state law enforcement. This review process is also what makes PhotoDNA less likely to lead to a false positive prosecution in a criminal court. After the analyst reviews the matching image, a report is sent to law enforcement. When law enforcement receives this report, it must then be analyzed by law enforcement officials to determine whether the file is truly child sexual abuse material.

Again, even if a perceptual hash was made with an error (like a perceptual-hash collision) that matched a child sexual abuse material, it should be caught through the review process. Once it is caught, then it will not be presented to the jury as a match for prohibited materials. Thus, even if the matching of PhotoDNA was a false positive, the resulting case would not be based on a false positive unless the review failed to detect it.

How Should a PhotoDNA Match Be Independently Verified?

PhotoDNA matches can be independently verified. When conducting a child sexual abuse material investigation, federal agents can and should use any relevant tools that are available to verify that the match in question is a false positive or that it is a confirmed match.

Once a seized device is given to law enforcement, the agent who has the computer forensic tools can recompute the perceptual hash of the matching file and compare it to a known hash of the perceived matching image.

Alternatively, if a forensic image of the device has been produced, a defense expert can perform a similar function. He can re-hash the matching file, then compare the result to a known hash of the alleged matching file.

To do either of these, the person conducting the test must have access to the underlying file. If the person only has access to a hash value, he cannot verify that the target image matches a known file. Again, the underlying file is a basic requirement for conducting a match verification in any criminal child sexual abuse material case.

How to Dispute a PhotoDNA Match

If you have reason to dispute a PhotoDNA match, there are three key questions to ask:

1. What was the PhotoDNA Score and the Triggering Threshold?

A PhotoDNA match occurs when the computed perceptual hash of the image matches a perceptual hash in a hash set based on the match threshold. The matched perceptual hash is produced by a “Score.” So, to determine why a match was made, you need the Score of the matching image as well as the matching threshold for the target file. This will explain why the image was flagged.

2. What PhotoDNA Hash Reference-Set Entry triggered the match?

To determine why an image match was an error, it is necessary to determine what triggered the match. You will need access to the entry that triggered the match in the PhotoDNA hash set. Once you have access to the hash set, you can determine how much it is actually similar to the matching image.

By knowing how much of a hash matched, and knowing how much the hash matched the original, a defense expert can determine whether the matching image produced a false match.

3. Did an Analyst Review the Image?

Finally, you should also find out if an analyst at the company that conducted the PhotoDNA matching reviewed the flagged image. Many cases have noted in the NCMEC report that a computer image classifier matched the file, then flagged it for manual review by an analyst.

If the image classifier identified the file and flagged it for manual review, an analyst at the company should have determined whether the file is child sexual abuse material. While an analyst misclassification should not be considered a PhotoDNA false-positive, this should nonetheless be addressed. Similarly, if the match was found based on a classifier (which does not generate a hash match), then the dispute should go with the company that produced the match.

How to Get the Right Information from a CyberTipline Report

Looking at a CyberTipline report from NCMEC is a good first step for determining the provider’s tools for identifying suspected CSAM. You will find three categories under “Reported by Service Provider” that can provide some useful information:

• “Detection Tool (Source, Name, Description, Version, and Date)” tells you whether a provider found the offending image by using hashing and what matching tool they used to generate that match.
• “Service Provider Review Comments” tells you the comments and observations of the person who reviewed the image.
• “Service Provider Review Date” shows when the image was reviewed by the provider.

One thing you should keep in mind is that a detection tool can include everything from PhotoDNA to an internal classifier, or PhotoDNA combined with a proprietary detection system. If a provider uses a perceptual hash that is a variation of PhotoDNA, it may not clearly be the same as the PhotoDNA that has been verified. If the provider uses a proprietary classifier, it may not be clear if the classifier has a proven error rate.

What Does a PhotoDNA Match Prove About the Accused?

A PhotoDNA match is not proof of guilt. A match means that an image was found and that the image appears to be child sexual abuse material. Here are a few reasons why:

• A match does not prove that a user knows the file exists on a device.
• A match does not prove that a user viewed the file.
• A match does not prove the user uploaded the file. A file could be deposited in a user’s cloud storage space by:

- The synchronization of a social network or other service.

- The use of a computer virus or malware.

- The action of a third-party to put it in a friend’s storage space.

The perceptual hash is a perceptual match. So, the perceptual match alone cannot prove that the matched image is an exact copy of an illegal image that was on the reference set. The perceptual match could have been created from an image that differs in color, cropping, or aspect ratio.

Alternatively, a match could simply be an error in the software. However, even a Fourth Amendment violation will not prove that PhotoDNA matched incorrectly. If a Fourth Amendment violation occurs and a judge suppresses evidence, then law enforcement and a prosecutor will no longer be able to rely on a matching hash set.

If a provider’s misidentification results in the incorrect attribution of an image to a user, this should be treated as a failure of attribution rather than a failure of the PhotoDNA software. The user’s file is a copy of prohibited material. But, the copy came from an automated process and did not actually originate from a real person uploading it. This means it is an attribution error, and it should be treated as an attribution error in any potential criminal case.

What Is a CyberTipline Report from NCMEC?

A CyberTipline report from NCMEC can act as evidence in a criminal case, and it can help lead to a criminal case. However, a CyberTipline report is not independent proof of guilt. It is the report that leads to the criminal investigation. A CyberTipline report is proof that someone saw an image that was allegedly CSAM and then reported it.

CyberTipline reports can be used to support probable cause to obtain a search warrant or, alternatively, CyberTipline reports can prove a crime was committed in conjunction with other forms of evidence obtained under a warrant.

But even if a prosecutor obtains a search warrant, an image found in a computer could match an image that is CSAM, yet the user still might be innocent. A computer could have been accessed by someone who didn’t know a user’s account credentials, or it could have been infected with a computer virus that uploaded an obscene file.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.