How would you detect someone who tests a single image using a new free tier, and then (if successful) uses that image against a targeted customer account?
Working in a similar area (bot detection) I think it's very difficult to proactively stop such targeted attacks, but maybe in this space you can do something interesting like duplicate detection across a consortium.
We'd rather not tip our hand on any/all techniques used to discern actual users from bad actors and those seeking to reverse engineer, but suffice to say we do have are methods (and plenty of them).