full demo working

.idea/generate-neural-hash-collision.iml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="PYTHON_MODULE" version="4">
+  <component name="NewModuleRootManager">
+    <content url="file://$MODULE_DIR$" />
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+</module>

.idea/inspectionProfiles/Project_Default.xml

@@ -0,0 +1,16 @@
+<component name="InspectionProjectProfileManager">
+  <profile version="1.0">
+    <option name="myName" value="Project Default" />
+    <inspection_tool class="PyPackageRequirementsInspection" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="ignoredPackages">
+        <value>
+          <list size="3">
+            <item index="0" class="java.lang.String" itemvalue="onnxruntime" />
+            <item index="1" class="java.lang.String" itemvalue="onnx_tf" />
+            <item index="2" class="java.lang.String" itemvalue="onnx" />
+          </list>
+        </value>
+      </option>
+    </inspection_tool>
+  </profile>
+</component>

.idea/inspectionProfiles/profiles_settings.xml

@@ -0,0 +1,6 @@
+<component name="InspectionProjectProfileManager">
+  <settings>
+    <option name="USE_PROJECT_PROFILE" value="false" />
+    <version value="1.0" />
+  </settings>
+</component>

.idea/modules.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectModuleManager">
+    <modules>
+      <module fileurl="file://$PROJECT_DIR$/.idea/generate-neural-hash-collision.iml" filepath="$PROJECT_DIR$/.idea/generate-neural-hash-collision.iml" />
+    </modules>
+  </component>
+</project>

LICENSE.md

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+=====================
+
+**Copyright (c) 2021 Anish Athalye (me@anishathalye.com)**
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,8 +1,8 @@
 ---
-title: Generate Neural Hash Collision
-emoji: 😻
-colorFrom: gray
-colorTo: indigo
+title: Neural Hash Collisions
+emoji: 🐠
+colorFrom: green
+colorTo: pink
 sdk: gradio
 app_file: app.py
 pinned: false

app.py

@@ -0,0 +1,256 @@
+import sys
+import onnxruntime
+import numpy as np
+from PIL import Image
+import gradio as gr
+import torch
+import os
+import random
+
+# os.system('wget https://www.dropbox.com/s/ggf6ok63u7hywhc/neuralhash_128x96_seed1.dat')
+# os.system('wget https://www.dropbox.com/s/1jug4wtevz1rol0/model.onnx')
+
+
+
+
+# Copyright (c) 2021 Anish Athalye. Released under the MIT license.
+
+import tensorflow as tf
+from scipy.ndimage.filters import gaussian_filter
+import time
+
+from util import *
+
+
+DEFAULT_MODEL_PATH = 'model.onnx'
+DEFAULT_SEED_PATH = 'neuralhash_128x96_seed1.dat'
+DEFAULT_TARGET_HASH = '59a34eabe31910abfb06f308'
+DEFAULT_ITERATIONS = 1000
+DEFAULT_SAVE_ITERATIONS = 0
+DEFAULT_LR = 2.0
+DEFAULT_COMBINED_THRESHOLD = 2
+DEFAULT_K = 10.0
+DEFAULT_CLIP_RANGE = 0.1
+DEFAULT_W_L2 = 2e-3
+DEFAULT_W_TV = 1e-4
+DEFAULT_W_HASH = 0.8
+DEFAULT_BLUR = 0
+
+
+
+tf.compat.v1.disable_eager_execution()
+
+
+model = load_model(DEFAULT_MODEL_PATH)
+image = model.tensor_dict['image']
+logits = model.tensor_dict['leaf/logits']
+seed = load_seed(DEFAULT_SEED_PATH)
+
+
+def generate_image(first_img, second_hash_hex):
+
+    with model.graph.as_default():
+        with tf.compat.v1.Session() as sess:
+            sess.run(tf.compat.v1.global_variables_initializer())
+
+            target = hash_from_hex(second_hash_hex)
+            original = load_image(first_img.name)
+            h = hash_from_hex(second_hash_hex)
+            proj = tf.reshape(tf.linalg.matmul(seed, tf.reshape(logits, (128, 1))), (96,))
+            # proj is in R^96; it's interpreted as a 96-bit hash by mapping
+            # entries < 0 to the bit '0', and entries >= 0 to the bit '1'
+            normalized, _ = tf.linalg.normalize(proj)
+            hash_output = tf.sigmoid(normalized * DEFAULT_K)
+            # now, hash_output has entries in (0, 1); it's interpreted by
+            # mapping entries < 0.5 to the bit '0' and entries >= 0.5 to the
+            # bit '1'
+
+            # we clip hash_output to (clip_range, 1-clip_range); this seems to
+            # improve the search (we don't "waste" perturbation tweaking
+            # "strong" bits); the sigmoid already does this to some degree, but
+            # this seems to help
+            hash_output = tf.clip_by_value(hash_output, DEFAULT_CLIP_RANGE, 1.0 - DEFAULT_CLIP_RANGE) - 0.5
+            hash_output = hash_output * (0.5 / (0.5 - DEFAULT_CLIP_RANGE))
+            hash_output = hash_output + 0.5
+
+
+            # hash loss: how far away we are from the target hash
+            hash_loss = tf.math.reduce_sum(tf.math.squared_difference(hash_output, h))
+
+
+            perturbation = image - original
+            # image loss: how big / noticeable is the perturbation?
+            img_loss = DEFAULT_W_L2 * tf.nn.l2_loss(perturbation) + DEFAULT_W_TV * tf.image.total_variation(perturbation)[0]
+
+
+            # combined loss: try to minimize both at once
+            combined_loss = DEFAULT_W_HASH * hash_loss + (1 - DEFAULT_W_HASH) * img_loss
+
+
+            # gradients of all the losses
+            g_hash_loss, = tf.gradients(hash_loss, image)
+            g_img_loss, = tf.gradients(img_loss, image)
+            g_combined_loss, = tf.gradients(combined_loss, image)
+
+            # perform attack
+
+            x = original
+            best = (float('inf'), 0)  # (distance, image quality loss)
+            dist = float('inf')
+
+
+            for i in range(DEFAULT_ITERATIONS):
+                # we do an alternating projections style attack here; if we
+                # haven't found a colliding image yet, only optimize for that;
+                # if we have a colliding image, then minimize the size of the
+                # perturbation; if we're close, then do both at once
+
+
+                if dist == 0:
+                    loss_name, loss, g = 'image', img_loss, g_img_loss
+                elif best[0] == 0 and dist <= DEFAULT_COMBINED_THRESHOLD:
+                    loss_name, loss, g = 'combined', combined_loss, g_combined_loss
+                else:
+                    loss_name, loss, g = 'hash', hash_loss, g_hash_loss
+
+                # compute loss values and gradient
+                xq = quantize(x)  # take derivatives wrt the quantized version of the image
+                hash_output_v, img_loss_v, loss_v, g_v = sess.run([hash_output, img_loss, loss, g], feed_dict={image: xq})
+                dist = np.sum((hash_output_v >= 0.5) != (h >= 0.5))
+
+                # if it's better than any image found so far, save it
+                score = (dist, img_loss_v)
+                if score < best:
+                    best = score
+
+                if dist == 0:
+                    # if True:
+                    arr = x.reshape([3, 360, 360]).transpose(1, 2, 0)
+                    arr = (arr + 1.0) * (255.0 / 2.0)
+                    arr = arr.astype(np.uint8)
+                    im = Image.fromarray(arr)
+                    return im, arr
+                # gradient descent step
+                g_v_norm = g_v / np.linalg.norm(g_v)
+                x = x - DEFAULT_LR * g_v_norm
+                if DEFAULT_BLUR > 0:
+                    x = blur_perturbation(original, x, DEFAULT_BLUR)
+                x = x.clip(-1, 1)
+                # print('iteration: {}/{}, best: ({}, {:.3f}), hash: {}, distance: {}, loss: {:.3f} ({})'.format(
+                #     i+1,
+                #     DEFAULT_ITERATIONS,
+                #     best[0],
+                #     best[1],
+                #     hash_to_hex(hash_output_v),
+                #     dist,
+                #     loss_v,
+                #     loss_name
+                # ))
+
+            return None, None
+
+
+def quantize(x):
+    x = (x + 1.0) * (255.0 / 2.0)
+    x = x.astype(np.uint8).astype(np.float32)
+    x = x / (255.0 / 2.0) - 1.0
+    return x
+
+
+def blur_perturbation(original, x, sigma):
+    perturbation = x - original
+    perturbation = gaussian_filter_by_channel(perturbation, sigma=sigma)
+    return original + perturbation
+
+
+def gaussian_filter_by_channel(x, sigma):
+    return np.stack([gaussian_filter(x[0,ch,:,:], sigma) for ch in range(x.shape[1])])[np.newaxis]
+
+
+# Load ONNX model
+session = onnxruntime.InferenceSession('model.onnx')
+# Load output hash matrix
+seed1 = open('neuralhash_128x96_seed1.dat', 'rb').read()[128:]
+seed1 = np.frombuffer(seed1, dtype=np.float32)
+seed1 = seed1.reshape([96, 128])
+pre_text = "<p style='display: flex; flex-grow: 1; align-items: center; justify-content: center; padding: 2rem 1rem; font-size: 1.5rem; line-height: 2rem; font-weight: 400;'>{}</p>"
+pre_image = """
+<p style='display: flex; flex-grow: 1; align-items: center; justify-content: center; padding: 2rem 1rem; font-size: 1.5rem; line-height: 2rem; font-weight: 400;'>{}</p>
+<p style='display: flex; flex-grow: 1; align-items: center; justify-content: center; padding: 2rem 1rem; font-size: 1.5rem; line-height: 2rem; font-weight: 400;'>{}</p>
+
+<div style="text-align:center;">
+    <img style="display: inline-block; margin-left: auto; margin-right: auto;" src="best.png"/>
+    <img style="display: inline-block; margin-left: auto; margin-right: auto;" src="images/dog.png"/>
+</div>
+"""
+
+
+
+def get_hash(img):
+    if isinstance(img, str):
+        img = Image.open(img)
+    img = img.convert('RGB')
+    image = img.resize([360, 360])
+    arr = np.array(image).astype(np.float32) / 255.0
+    arr = arr * 2.0 - 1.0
+    arr = arr.transpose(2, 0, 1).reshape([1, 3, 360, 360])
+
+    # Run model
+    inputs = {session.get_inputs()[0].name: arr}
+    outs = session.run(None, inputs)
+
+    # Convert model output to hex hash
+    hash_output = seed1.dot(outs[0].flatten())
+    hash_bits = ''.join(['1' if it >= 0 else '0' for it in hash_output])
+    hash_hex = '{:0{}x}'.format(int(hash_bits, 2), len(hash_bits) // 4)
+    return hash_hex
+
+
+
+cache = {
+    # "732777d208dff6dd3268cb5a59a34eabe31910abfb06f308": (pre_text.format("732777d208dff6dd3268cb5a"), pre_text.format("59a34eabe31910abfb06f308"), ["cached/example1.png", "images/dog.png"]),
+    # "32dac883f7b91bbf45a4829635f7238ba05c404756bb33ee": (
+    # pre_text.format("32dac883f7b91bbf45a48296"), pre_text.format("35f7238ba05c404756bb33ee"),
+    # ["cached/example2.png", "images/apple.png"]),
+    # "f16d358106da998227b323f2a73e6ec2303af3d801f9133a": (
+    # pre_text.format("f16d358106da998227b323f2"), pre_text.format("a73e6ec2303af3d801f9133a"),
+    # ["cached/example3.png", "images/iphone.png"])
+}
+
+def inference(first_img, second_img):
+    first_hash_hex = get_hash(first_img.name)
+    second_hash_hex = get_hash(second_img.name)
+    if first_hash_hex + second_hash_hex in cache:
+        return cache[first_hash_hex + second_hash_hex]
+    generated_image, arr = generate_image(first_img, second_hash_hex)
+    if generated_image is None:
+        return pre_text.format(first_hash_hex), pre_text.format("Could not generate a collision.. :("), None
+    generated_image.save(first_img.name, format="PNG")
+    new_hash = get_hash(generated_image)
+    if new_hash != second_hash_hex:
+        return pre_text.format(first_hash_hex), pre_text.format("Could not generate a collision.. :("), None
+    return pre_text.format(first_hash_hex), pre_text.format(new_hash), [first_img.name, second_img.name]
+
+
+title = "Generate a Neural Hash Collision"
+description = "Apple's NeuralHash, a perceptual hashing method for images based on neural networks, has been criticized heavily by researchers. You can use this demo to generate a hash collision of any two images. Upload your own (or click one of the examples to load them), and an adverserial image will be created from the first one to match the hash of the second. Note: In some cases the generation times out (we set a limit of 1000 iterations). The examples are cached, but submitting your own images should take about 1-2 minutes. Read more at the links below."
+article = "<p style='text-align: center'><a href='https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf'>CSAM Detection Technical Summary</a> | <a href='https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX'>AppleNeuralHash2ONNX Github Repo</a> | <a href='https://github.com/anishathalye/neural-hash-collider'>Neural Hash Collider Repo</a> | <a href='https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX/issues/1'>Working Collision example images from github issue</a></p> "
+examples = [
+    ["images/cat.png", "images/dog.png"],
+    ["images/lena.png", "images/apple.png"],
+    ["images/stevejobs.png", "images/iphone.png"],
+]
+inputs = [gr.inputs.Image(type="file", label="First Image"), gr.inputs.Image(type="file", label="Second Image")]
+outputs = [gr.outputs.HTML(label="Initial Hash of First Image.."), gr.outputs.HTML(label="Generated a collision at.."), gr.outputs.Carousel(components=[gr.outputs.Image(type="file"), gr.outputs.Image(type="file")], label="Images at this hash..")]
+
+gr.Interface(
+    inference,
+    inputs, outputs,
+    title=title,
+    description=description,
+    article=article,
+    examples=examples,
+    allow_flagging=False,
+    theme="huggingface",
+    capture_session=True
+).launch(share=True, inbrowser=True)

collide.py

@@ -0,0 +1,171 @@
+# Copyright (c) 2021 Anish Athalye. Released under the MIT license.
+
+import numpy as np
+import tensorflow as tf
+from scipy.ndimage.filters import gaussian_filter
+import argparse
+import os
+import time
+
+from util import *
+
+
+DEFAULT_MODEL_PATH = 'model.onnx'
+DEFAULT_SEED_PATH = 'neuralhash_128x96_seed1.dat'
+DEFAULT_TARGET_HASH = '59a34eabe31910abfb06f308'
+DEFAULT_ITERATIONS = 500
+DEFAULT_SAVE_ITERATIONS = 0
+DEFAULT_LR = 2.0
+DEFAULT_COMBINED_THRESHOLD = 2
+DEFAULT_K = 10.0
+DEFAULT_CLIP_RANGE = 0.1
+DEFAULT_W_L2 = 2e-3
+DEFAULT_W_TV = 1e-4
+DEFAULT_W_HASH = 0.8
+DEFAULT_BLUR = 0
+
+
+def main():
+    tf.compat.v1.disable_eager_execution()
+    options = get_options()
+
+    model = load_model(options.model)
+    image = model.tensor_dict['image']
+    logits = model.tensor_dict['leaf/logits']
+    seed = load_seed(options.seed)
+
+    target = hash_from_hex(options.target)
+
+    original = load_image(options.image)
+    h = hash_from_hex(options.target)
+
+    with model.graph.as_default():
+        with tf.compat.v1.Session() as sess:
+            sess.run(tf.compat.v1.global_variables_initializer())
+
+            proj = tf.reshape(tf.linalg.matmul(seed, tf.reshape(logits, (128, 1))), (96,))
+            # proj is in R^96; it's interpreted as a 96-bit hash by mapping
+            # entries < 0 to the bit '0', and entries >= 0 to the bit '1'
+            normalized, _ = tf.linalg.normalize(proj)
+            hash_output = tf.sigmoid(normalized * options.k)
+            # now, hash_output has entries in (0, 1); it's interpreted by
+            # mapping entries < 0.5 to the bit '0' and entries >= 0.5 to the
+            # bit '1'
+
+            # we clip hash_output to (clip_range, 1-clip_range); this seems to
+            # improve the search (we don't "waste" perturbation tweaking
+            # "strong" bits); the sigmoid already does this to some degree, but
+            # this seems to help
+            hash_output = tf.clip_by_value(hash_output, options.clip_range, 1.0 - options.clip_range) - 0.5
+            hash_output = hash_output * (0.5 / (0.5 - options.clip_range))
+            hash_output = hash_output + 0.5
+
+            # hash loss: how far away we are from the target hash
+            hash_loss = tf.math.reduce_sum(tf.math.squared_difference(hash_output, h))
+
+            perturbation = image - original
+            # image loss: how big / noticeable is the perturbation?
+            img_loss = options.l2_weight * tf.nn.l2_loss(perturbation) + options.tv_weight * tf.image.total_variation(perturbation)[0]
+
+            # combined loss: try to minimize both at once
+            combined_loss = options.hash_weight * hash_loss + (1 - options.hash_weight) * img_loss
+
+            # gradients of all the losses
+            g_hash_loss, = tf.gradients(hash_loss, image)
+            g_img_loss, = tf.gradients(img_loss, image)
+            g_combined_loss, = tf.gradients(combined_loss, image)
+
+            # perform attack
+
+            x = original
+            best = (float('inf'), 0)  # (distance, image quality loss)
+            dist = float('inf')
+
+            for i in range(options.iterations):
+                # we do an alternating projections style attack here; if we
+                # haven't found a colliding image yet, only optimize for that;
+                # if we have a colliding image, then minimize the size of the
+                # perturbation; if we're close, then do both at once
+                if dist == 0:
+                    loss_name, loss, g = 'image', img_loss, g_img_loss
+                elif best[0] == 0 and dist <= options.combined_threshold:
+                    loss_name, loss, g = 'combined', combined_loss, g_combined_loss
+                else:
+                    loss_name, loss, g = 'hash', hash_loss, g_hash_loss
+
+                # compute loss values and gradient
+                xq = quantize(x)  # take derivatives wrt the quantized version of the image
+                hash_output_v, img_loss_v, loss_v, g_v = sess.run([hash_output, img_loss, loss, g], feed_dict={image: xq})
+                dist = np.sum((hash_output_v >= 0.5) != (h >= 0.5))
+                if dist == 0:
+                    save_image(x, os.path.join(options.save_directory, 'best.png'))
+                    break
+
+                # if it's better than any image found so far, save it
+                score = (dist, img_loss_v)
+                if score < best or (options.save_iterations > 0 and (i+1) % options.save_iterations == 0):
+                    # save_image(x, os.path.join(options.save_directory, 'best.png'))
+                    pass
+                if score < best:
+                    best = score
+
+                # gradient descent step
+                g_v_norm = g_v / np.linalg.norm(g_v)
+                x = x - options.learning_rate * g_v_norm
+                if options.blur > 0:
+                    x = blur_perturbation(original, x, options.blur)
+                x = x.clip(-1, 1)
+                print('iteration: {}/{}, best: ({}, {:.3f}), hash: {}, distance: {}, loss: {:.3f} ({})'.format(
+                    i+1,
+                    options.iterations,
+                    best[0],
+                    best[1],
+                    hash_to_hex(hash_output_v),
+                    dist,
+                    loss_v,
+                    loss_name
+                ))
+
+
+def quantize(x):
+    x = (x + 1.0) * (255.0 / 2.0)
+    x = x.astype(np.uint8).astype(np.float32)
+    x = x / (255.0 / 2.0) - 1.0
+    return x
+
+
+def blur_perturbation(original, x, sigma):
+    perturbation = x - original
+    perturbation = gaussian_filter_by_channel(perturbation, sigma=sigma)
+    return original + perturbation
+
+
+def gaussian_filter_by_channel(x, sigma):
+    return np.stack([gaussian_filter(x[0,ch,:,:], sigma) for ch in range(x.shape[1])])[np.newaxis]
+
+
+def get_options():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--image', type=str, help='path to starting image', required=True)
+    parser.add_argument('--model', type=str, help='path to model', default=DEFAULT_MODEL_PATH)
+    parser.add_argument('--seed', type=str, help='path to seed', default=DEFAULT_SEED_PATH)
+    parser.add_argument('--target', type=str, help='target hash', default=DEFAULT_TARGET_HASH)
+    parser.add_argument('--learning-rate', type=float, help='learning rate', default=DEFAULT_LR)
+    parser.add_argument('--combined-threshold', type=int, help='threshold to start using combined loss', default=DEFAULT_COMBINED_THRESHOLD)
+    parser.add_argument('--k', type=float, help='k parameter', default=DEFAULT_K)
+    parser.add_argument('--l2-weight', type=float, help='perturbation l2 loss weight', default=DEFAULT_W_L2)
+    parser.add_argument('--tv-weight', type=float, help='perturbation total variation loss weight', default=DEFAULT_W_TV)
+    parser.add_argument('--hash-weight', type=float, help='relative weight (0.0 to 1.0) of hash in combined loss', default=DEFAULT_W_HASH)
+    parser.add_argument('--clip-range', type=float, help='clip range parameter', default=DEFAULT_CLIP_RANGE)
+    parser.add_argument('--iterations', type=int, help='max number of iterations', default=DEFAULT_ITERATIONS)
+    parser.add_argument('--save-directory', type=str, help='directory to save output images', default='.')
+    parser.add_argument('--save-iterations', type=int, help='save this frequently, regardless of improvement', default=DEFAULT_SAVE_ITERATIONS)
+    parser.add_argument('--blur', type=float, help='apply Gaussian blur with this sigma on every step', default=DEFAULT_BLUR)
+    return parser.parse_args()
+
+
+if __name__ == '__main__':
+    start = time.time()
+    main()
+    end = time.time()
+    print(end - start)

requirements.txt

@@ -0,0 +1,9 @@
+Pillow
+numpy
+onnx
+onnx_tf
+scipy
+tensorflow
+torchtext
+onnxruntime
+torch

util.py

@@ -0,0 +1,49 @@
+# Copyright (c) 2021 Anish Athalye. Released under the MIT license.
+
+import numpy as np
+import onnx
+from onnx_tf.backend import prepare
+from PIL import Image
+
+
+def load_model(path):
+    onnx_model = onnx.load(path)
+    model = prepare(onnx_model, training_mode=True)
+    return model
+
+
+def load_seed(path):
+    seed = open(path, 'rb').read()[128:]
+    seed = np.frombuffer(seed, dtype=np.float32)
+    seed = seed.reshape([96, 128])
+    return seed
+
+
+def load_image(path):
+    im = Image.open(path).convert('RGB')
+    im = im.resize([360, 360])
+    arr = np.array(im).astype(np.float32) / 255.0
+    arr = arr * 2.0 - 1.0
+    arr = arr.transpose(2, 0, 1).reshape([1, 3, 360, 360])
+    return arr
+
+
+def save_image(arr, path):
+    arr = arr.reshape([3, 360, 360]).transpose(1, 2, 0)
+    arr = (arr + 1.0) * (255.0 / 2.0)
+    arr = arr.astype(np.uint8)
+    im = Image.fromarray(arr)
+    im.save(path)
+
+
+def hash_from_hex(hex_repr):
+    n = int(hex_repr, 16)
+    h = np.zeros(96)
+    for i in range(96):
+        h[i] = (n >> (95 - i)) & 1
+    return h
+
+
+def hash_to_hex(h):
+    bits = ''.join(['1' if i >= 0.5 else '0' for i in h])
+    return '{:0{}x}'.format(int(bits, 2), len(bits) // 4)