These systems don't rely on cryptographic hashes but in fact the reverse: content sensitive hashes. They essentially take an image and scale it to a small thum

These systems don't rely on cryptographic hashes but in fact the reverse: content sensitive hashes. They essentially take an image and scale it to a small thumbnail. The values of all those reduced pixels are the hash of the original image. When a new image is scanned it's just doing a similarity check against the database of those hashes of known "bad" images. A hit triggers checking against an image hash performed with a separate algorithm. Hits against multiple hashes triggers a "bad image alarm" and ruins a person's life. Changing a few input bits in an image doesn't usually change the perceptual hash because they're meant to be resistant to small amounts of localized noise. It is possible to add noise that will change a perceptual hash. It's also possible to manipulate an image so transforms (scaling etc) get wildly different results. This leads to two exploits. The first is an attacker manipulates a "good" image such that when hashed it matches perceptual hashes of a "bad" image. The attacker then sends a bunch of these to a target triggering the "bad image alarm" and essentially SWATs the target. The second is to manipulate bad images in a recoverable way to get them pasted bad image scanners.