“An adversary can imperceptibly perturb an image that would normally be placed in this bank, and all live instances of the benign image will then be either incorrectly removed or flagged”