If the attacker does not know how the image will be perturbed prior to hashing then he cannot generate an image which matches with known CSAM.