Pith. sign in

REVIEW 1 major objections 4 minor 186 references

Position: Preventing AI-Generated CSAM Necessitates New Approaches to AI Safety

T0 review · 1 major / 4 minor · reviewed 2026-07-12 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Standard AI safety tools fail against AI-generated child sexual abuse material because they need data and tests the law forbids.

desk verdict Solid position paper that maps CSAM legal/ethical constraints onto the full AI lifecycle and lists 15 concrete open problems; the leap to 'entirely new approaches' is asserted more than quantified, but the work is still worth engaging. read the letter →

arxiv 2607.05407 v1 pith:H55MPZQU submitted 2026-06-09 cs.CY cs.AI

Neil Kale , Rebecca Portnoff , Pratiksha Thaker , Michael Simpson , Robertson Wang , Kevin Kuo , Chhavi Yadav , Virginia Smith This is my paper · ORCID
classification cs.CYcs.AI
keywords AI-generatedCSAMAIsafetychildsexualexploitationconceptfusionfine-tuningresilienceexactunlearningopenproblemscontentprovenance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This position paper argues that stopping AI-generated child sexual abuse material requires new AI safety methods, not just stronger versions of the ones already used for bias, disinformation, or other harms. Legal and ethical bans on accessing, generating, or training on child sexual abuse material block the usual safety playbook: you cannot freely audit training sets, red-team by prompting for the forbidden content, or fine-tune detectors on real examples. The authors map these hard constraints across the full model lifecycle and list fifteen concrete open problems that range from partial data cleaning and concept fusion to fine-tuning resilience, abliterated-model detection, and exact unlearning. They pair each problem with targeted recommendations for researchers, model providers, and policymakers so that child protection becomes a first-class, safety-critical research agenda rather than an afterthought.

What carries the argument

The four constraint classes (DATA access bans, EVAL generation bans, ADV adversarial opacity with strict guarantees, WELL wellness limits) that systematically invalidate standard safety tools across development, deployment, and maintenance.

What would settle it

A controlled study showing that partial data cleaning or proxy-concept red-teaming already reduces AIG-CSAM generation capability below a usable threshold on open-weight models without ever needing real CSAM access.

Watch

Extended reading notes

Core claim

Existing AI safety research rests on assumptions of data accessibility, transparency, and evaluation practices that are incompatible with the legal and ethical constraints surrounding child sexual abuse material; therefore protecting children from AI-facilitated sexual abuse requires new technical approaches rather than straightforward application of current techniques.

Load-bearing premise

That the legal and ethical bans on CSAM data and generation are so rigid that ordinary AI-safety techniques cannot be adapted with proxies or limited access and instead demand entirely new methods.

Editorial extensions

If this is right

  • Dataset cleaning, red-teaming, and fine-tuning defenses must be redesigned so they never require possession or generation of CSAM.
  • Open-weight models need built-in resilience to LoRA-style fine-tuning and abliteration aimed at CSAM or nudification.
  • Model-hosting platforms and regulators need automated, image-free ways to detect and delist models optimized for child exploitation.
  • Exact unlearning and tamper-resistant provenance become mandatory rather than optional for any model that might later be found to contain CSAM concepts.
  • Policymakers must create scoped legal pathways for vetted institutions to evaluate AIG-CSAM capabilities without criminalizing the evaluators.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Techniques that succeed under CSAM constraints (proxy concepts, image-free auditing, exact unlearning) will likely transfer to other high-stakes illegal domains such as non-consensual intimate imagery of adults.
  • The same concept-fusion risk that lets models invent CSAM from benign child and adult images also threatens other forbidden combinations (e.g., weapons plus public figures).
  • Hobbyist fine-tuning ecosystems may become the primary enforcement bottleneck once foundation-model providers harden their own systems.
  • Wellness limits on human exposure will force the field toward fully automated red-teaming even for non-CSAM safety work.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 4 minor

Summary. This position paper argues that existing AI safety techniques rest on assumptions of data accessibility, transparent evaluation, and generation-based red-teaming that are incompatible with the legal and ethical constraints surrounding CSAM (DATA access bans, EVAL generation bans, ADV adversarial opacity, WELL wellness limits). It maps these constraints onto the AI lifecycle, enumerates 15 open problems (A1–A5 development, B1–B5 deployment, C1–C5 maintenance), and supplies two small proxy experiments (CelebA concept-fusion thresholds and a public model-card audit of 14 image/video generators). Targeted recommendations for researchers, providers, and policymakers are offered to reframe AIG-CSAM prevention as a central safety-critical research agenda.

Significance. If the mismatch claim holds, the paper supplies a concrete research agenda that the AI safety community currently lacks: open problems that are each explicitly linked to a legal/ethical constraint (Table 3) and that cannot be solved by simply scaling existing red-teaming or filtering pipelines. The two controlled proxy experiments and the model-card audit give the position empirical footing without requiring illegal data access. The calls-to-action remain actionable under either a “new techniques” or a “stronger proxies” reading, making the work useful for both technical and policy audiences.

major comments (1)
  1. §6 Alternative Views acknowledges that stronger or proxy-based variants of existing methods may often suffice, yet never quantifies how frequently adaptation fails versus requiring entirely new techniques. Because the Main Position (p. 1) and the framing of the 15 open problems rest on the claim that the four constraint classes necessitate new approaches, a short discussion or table that distinguishes “adaptation-sufficient” from “new-technique-required” cases would make the central claim more precise without altering the paper’s scope.
minor comments (4)
  1. Table 1 footnote “*” on AI-developer access is only expanded later in §2.2; a one-sentence clarification in the table caption would improve self-containment.
  2. Figure 1 caption and the surrounding text in §3.2.1 use “conditional diffusion models” while Appendix C.1.1 describes “conditional flow matching models”; consistent terminology would avoid confusion.
  3. Table 4 (model-card audit) is informative but the selection criterion (“presence on Artificial Analysis leaderboards”) is stated only in the appendix; a brief note in the main text would help readers assess representativeness.
  4. A few typographical inconsistencies appear (e.g., “EV AL” spacing in the constraint tags, “H ¨onig” diacritic). These are purely presentational.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; open problems and Main Position follow from external legal constraints and observed practices, not from self-referential definitions or fitted predictions.

full rationale

This is a position paper, not a derivation of quantitative predictions from fitted parameters or uniqueness theorems. The Main Position (p.1) and the 15 open problems (§§3–5, Table 3) are obtained by mapping four externally grounded constraint classes (DATA access bans under COPPA/GDPR/18 U.S.C. §2252, EVAL generation bans under US Congress 2003, ADV adversarial opacity, WELL wellness limits) onto standard AI-safety techniques (dataset auditing, red-teaming by generation, fine-tuning resilience that trains on the obstructed task, exact unlearning, etc.). Those legal facts are cited to statutes and third-party reports, not defined in terms of the paper’s conclusions. The two proof-of-concept experiments (CelebA concept-fusion thresholds, public model-card audit) are illustrative empirical checks that use proxy data and public documentation; they do not close a logical loop. Self-citations to Thorn reports (Portnoff & Simpson 2025, Thorn & All Tech is Human 2024) supply domain observations of offender tooling and industry practice but are not load-bearing uniqueness claims or ansatzes that force the Main Position. Alternative views (§6) are acknowledged without circular redefinition. Consequently the argument is self-contained against external legal and empirical benchmarks and exhibits none of the six circularity patterns.

Assumptions & free parameters 0 free parameters · 5 assumptions · 2 invented entities

Position paper; almost no free parameters. Load-bearing content is a set of domain assumptions about U.S./Western law and the practical impossibility of standard safety pipelines under those laws, plus the authors’ framing of 15 open problems as the necessary research agenda. No new physical entities or fitted constants drive the central claim.

assumptions (5)
  • domain assumption CSAM is illegal to create, possess, or distribute for ordinary researchers and AI developers under U.S. law (18 U.S.C. §2252 and related statutes); intentional generation for red-teaming is likewise prohibited.
    Stated in §2.1 (EVAL) and Table 1; underpins every claim that standard red-teaming and evaluation datasets cannot be used.
  • domain assumption Hash-based matching and limited embedding extraction are the only generally available signals for AI providers; full CSAM access is restricted to hotlines and law enforcement.
    Table 1 and §2.2; drives the DATA constraint used throughout §§3–5.
  • domain assumption Concept fusion (composition of separately trained benign concepts into harmful outputs) occurs above a critical sample threshold and is not prevented by partial cleaning.
    Supported by the paper’s own CelebA experiment (§3.2.1) and concurrent Cretu et al.; treated as given for Open Problem A2.
  • domain assumption Open-weight models plus GUI LoRA tools (ComfyUI, Ostris) enable non-experts to fine-tune for CSAM or “nudify” applications at low cost.
    Cited from Thorn reports and industry observation; foundation of Open Problem A3 and C1.
  • domain assumption Approximate unlearning / concept erasure provides only probabilistic guarantees and is vulnerable to adversarial prompts; CSAM requires exact unlearning.
    §5.2 Open Problem C2, citing Cooper et al. and Zhang et al.; treated as established limitation.
invented entities (2)
  • The four constraint classes (DATA, EVAL, ADV, WELL)
    purpose: Taxonomy that organizes why standard AI-safety techniques fail for AIG-CSAM and that tags every open problem.
    Introduced in §2.1 and used as column headers in Table 3; no independent formal definition outside the paper.
  • The numbered list of 15 open problems (A1–A5, B1–B5, C1–C5)
    purpose: Concrete research agenda that translates the position into actionable technical and policy targets.
    Core contribution of §§3–5 and App. C; the list itself is the paper’s primary invented organizing structure.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Position: Preventing AI-Generated CSAM Necessitates New Approaches to AI Safety." pith.science (2026). https://pith.science/paper/H55MPZQU

@misc{pith2026260705407,
  author       = {Pith},
  title        = {Pith review of: Position: Preventing AI-Generated CSAM Necessitates New Approaches to AI Safety},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H55MPZQU}},
  note         = {Machine review of arXiv:2607.05407}
}
read the original abstract

Modern artificial intelligence (AI) systems present profound new risks to child safety. AI is increasingly being misused to create AI-generated child sexual abuse material, facilitate child sexual exploitation, and reduce barriers to harm. In this paper, we argue that protecting children from AI-facilitated sexual abuse requires new approaches to AI safety. Existing safety techniques assume data accessibility, transparency, and evaluation practices that are incompatible with the ethical and legal constraints surrounding child sexual abuse material. We examine how these constraints create new technical challenges, such as limitations on dataset auditing, red teaming, and fine-tuning prevention. In turn, we outline *15 open problems* in online child sexual exploitation and abuse across the AI development lifecycle, from dataset curation and model design to deployment and long-term maintenance. We propose targeted recommendations for researchers, developers, and policymakers to bridge the gap between theoretical AI safety and the realities of child protection. Our work aims to reframe preventing AI-facilitated child sexual abuse as a central, safety-critical dimension for AI research, motivating work that translates responsible AI principles into concrete safeguards against the exploitation of children.

Figures

Figures reproduced from arXiv: 2607.05407 by the authors.

Figure 1
Figure 1. Conditional diffusion models trained on images of blon￾des (top) and people in eyeglasses (middle) can generate blondes wearing eyeglasses (bottom), without overlapping training data. Fusion is effective with a critical threshold of training data (right). Unfortunately, even if base models appear ‘safe’, users can also unlock harmful capabilities through post-training procedures such as fine-tuning. Open-weight mode… view at source ↗
Figure 2
Figure 2. We test composition of the black hair and eyeglasses concepts, varying the number of eyeglasses samples from 64 to 4K. When increasing from 64 to 250 samples, capability to pro￾duce compositional images triples from 9% to 27%. Our findings align with Okawa et al. (2023), who also ob￾serve a sharp sample threshold for concept composition. This suggests partial data cleaning may be effective, though the bar is high: i… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

186 extracted references · 25 linked inside Pith

  1. [1]

    arXiv preprint arXiv:2312.06205 , year=

    The journey, not the destination: How data guides diffusion models , author=. arXiv preprint arXiv:2312.06205 , year=

    arXiv

  2. [2]

    International Conference on Learning Representations , volume=

    Diffusion attribution score: Evaluating training data influence in diffusion models , author=. International Conference on Learning Representations , volume=

  3. [3]

    International Conference on Learning Representations , volume=

    Intriguing properties of data attribution on diffusion models , author=. International Conference on Learning Representations , volume=

  4. [4]

    Advances in Neural Information Processing Systems , year=

    Emergence and evolution of interpretable concepts in diffusion models , author=. Advances in Neural Information Processing Systems , year=

  5. [5]

    Advances in Neural Information Processing Systems , year=

    One-Step is Enough: Sparse Autoencoders for Text-to-Image Diffusion Models , author=. Advances in Neural Information Processing Systems , year=

  6. [6]

    1996 , month = aug, note =

    Health Insurance Portability and Accountability Act of 1996 , howpublished =. 1996 , month = aug, note =

    1996

  7. [7]

    , title =

    Clinton, William J. , title =. 1995 , month = aug, day =

    1995

  8. [8]

    2023 , month = oct, address =

    Child Sexual Abuse Material: Model Legislation & Global Review , edition =. 2023 , month = oct, address =

    2023

Show all 186 references
  1. [9]

    2023 , note =

    Citizen's Guide to. 2023 , note =

    2023

  2. [10]

    AAAI Conference on Human Computation and Crowdsourcing , year=

    Fast, accurate, and healthier: Interactive blurring helps moderators reduce exposure to harmful content , author=. AAAI Conference on Human Computation and Crowdsourcing , year=

  3. [11]

    Social Science Research Network , year=

    Open technical problems in open-weight ai model risk management , author=. Social Science Research Network , year=

  4. [12]

    arXiv preprint arXiv:2512.11815 , year=

    Video Deepfake Abuse: How Company Choices Predictably Shape Misuse Patterns , author=. arXiv preprint arXiv:2512.11815 , year=

    arXiv

  5. [13]

    International Conference on Machine Learning , year=

    Glide: Towards photorealistic image generation and editing with text-guided diffusion models , author=. International Conference on Machine Learning , year=

  6. [14]

    arXiv preprint arXiv:2504.17663 , year=

    The Malicious Technical Ecosystem: Exposing Limitations in Technical Governance of AI-Generated Non-Consensual Intimate Images of Adults , author=. arXiv preprint arXiv:2504.17663 , year=

  7. [15]

    BBC News , year =

    McMahon, Liv , title =. BBC News , year =

  8. [16]

    Politico Europe , year =

    Clifton, Mizy and Bristow, Tom , title =. Politico Europe , year =

  9. [17]

    2025 , month = aug, day =

    Automate Security Reviews with. 2025 , month = aug, day =

    2025

  10. [18]

    2025 , url =

    Introducing Aardvark: OpenAI’s agentic security researcher , journal =. 2025 , url =

    2025

  11. [19]

    2025 , howpublished =

    Popa, Raluca Ada and Flynn, Four , title =. 2025 , howpublished =

    2025

  12. [20]

    2024 , howpublished =

    Song, Dawn , title =. 2024 , howpublished =

    2024

  13. [21]

    2025 , howpublished =

    Adversarial Misuse of Generative. 2025 , howpublished =

    2025

  14. [22]

    2025 , month = aug, url =

    Threat Intelligence Report: August 2025 , institution =. 2025 , month = aug, url =

    2025

  15. [23]

    2025 , howpublished =

    2025

  16. [24]

    Advances in Neural Information Processing Systems , year=

    Are you stealing my model? sample correlation for fingerprinting deep neural networks , author=. Advances in Neural Information Processing Systems , year=

  17. [25]

    Doerfler, Periwinkle and Forte, Andrea and De Cristofaro, Emiliano and Stringhini, Gianluca and Blackburn, Jeremy and McCoy, Damon , journal=. ``

  18. [26]

    Information and Software Technology , volume=

    Joining a smartphone ecosystem: Application developers’ motivations and decision criteria , author=. Information and Software Technology , volume=. 2014 , publisher=

    2014

  19. [27]

    Journal of Child & Adolescent Trauma , year=

    A systematic review of the education and awareness interventions to prevent online child sexual abuse , author=. Journal of Child & Adolescent Trauma , year=

  20. [28]

    Child Abuse Review: Journal of the British Association for the Study and Prevention of Child Abuse and Neglect , year=

    Partnering with parents to prevent childhood sexual abuse , author=. Child Abuse Review: Journal of the British Association for the Study and Prevention of Child Abuse and Neglect , year=

  21. [29]

    Proceedings of the 21st Brazilian Symposium on Human Factors in Computing Systems , year=

    Using model cards for ethical reflection: a qualitative exploration , author=. Proceedings of the 21st Brazilian Symposium on Human Factors in Computing Systems , year=

  22. [30]

    ACM Conference on Fairness, Accountability, and Transparency , year=

    Interactive model cards: A human-centered approach to model documentation , author=. ACM Conference on Fairness, Accountability, and Transparency , year=

  23. [31]

    Proceedings of the conference on fairness, accountability, and transparency , year=

    Model cards for model reporting , author=. Proceedings of the conference on fairness, accountability, and transparency , year=

  24. [32]

    Gaps in the Safety Evaluation of Generative AI , journal=

    Rauh, Maribeth and Marchal, Nahema and Manzini, Arianna and Hendricks, Lisa Anne and Comanescu, Ramona and Akbulut, Canfer and Stepleton, Tom and Mateos-Garcia, Juan and Bergman, Stevie and Kay, Jackie and Griffin, Conor and Bariach, Ben and Gabriel, Iason and Rieser, Verena a...

  25. [33]

    IEEE Spectrum , year =

    Harris, David Evan and Willner, Dave , title =. IEEE Spectrum , year =

  26. [34]

    AI and Ethics , volume=

    The ethical wisdom of AI developers , author=. AI and Ethics , volume=. 2025 , publisher=

    2025

  27. [35]

    The Guardian , year =

    Kenyan Moderators Decry Toll of Training of AI Models , author =. The Guardian , year =

  28. [36]

    Once you see it you can't unsee it

    “Once you see it you can't unsee it”: Law enforcement trauma and immersion in child sexual abuse material , author=. Child Protection and Practice , year=

  29. [37]

    2024 , month = nov, type =

    Mitigating the Risk of Generative AI Models Creating Child Sexual Abuse Materials , institution =. 2024 , month = nov, type =

    2024

  30. [38]

    Cyberpsychology: Journal of Psychosocial Research on Cyberspace , year=

    The psychological impacts of content moderation on content moderators: A qualitative study , author=. Cyberpsychology: Journal of Psychosocial Research on Cyberspace , year=

  31. [39]

    2024 , url =

    Ostris , title =. 2024 , url =

    2024

  32. [40]

    2018 , url =

    What is. 2018 , url =

    2018

  33. [41]

    International Conference on Learning Representations , year=

    Unlearning or Obfuscating? Jogging the Memory of Unlearned LLMs via Benign Relearning , author=. International Conference on Learning Representations , year=

  34. [42]

    arXiv preprint arXiv:2512.05707 , year=

    Evaluating Concept Filtering Defenses against Child Sexual Abuse Material Generation by Text-to-Image Models , author=. arXiv preprint arXiv:2512.05707 , year=

    arXiv

  35. [43]

    2024 , note =

    C2PA: Advancing Digital Content Transparency and Authenticity , howpublished =. 2024 , note =

    2024

  36. [44]

    Children's Online Privacy Protection Rule ("COPPA") , url =

  37. [45]

    Thousands of Pedophiles Are Using Jail-Broken

    Stokel-Walker, Chris , journal =. Thousands of Pedophiles Are Using Jail-Broken. 2025 , url =

    2025

  38. [46]

    2025 , month = jun, organization =

    Taking Action Against Nudify Apps , author =. 2025 , month = jun, organization =

    2025

  39. [47]

    Deepfake Nudes & Young People: Navigating a New Frontier in Technology-facilitated Nonconsensual Sexual Abuse and Exploitation , year =

  40. [48]

    2024 , month = dec, institution =

    Evolving Technologies Horizon Scan: A Review of Technologies Carrying Notable Risk and Opportunity in the Fight Against Technology-Facilitated Child Sexual Exploitation , author =. 2024 , month = dec, institution =

    2024

  41. [49]

    2025 , month =

    The General-Purpose AI Code of Practice , author =. 2025 , month =

    2025

  42. [50]

    Lantern: Advancing Child Safety Through Signal Sharing , year =

  43. [51]

    IEEE/CVF International Conference on Computer Vision , year=

    Deep learning face attributes in the wild , author=. IEEE/CVF International Conference on Computer Vision , year=

  44. [52]

    Advances in Neural Information Processing Systems , year=

    Safetywashing: Do AI Safety Benchmarks Actually Measure Safety Progress? , author=. Advances in Neural Information Processing Systems , year=

  45. [53]

    USENIX Security Symposium , year=

    Glaze: Protecting artists from style mimicry by Text-to-Image models , author=. USENIX Security Symposium , year=

  46. [54]

    IEEE Transactions on Pattern Analysis and Machine Intelligence , year=

    Disentangled representation learning , author=. IEEE Transactions on Pattern Analysis and Machine Intelligence , year=

  47. [55]

    Advances in Neural Information Processing Systems , year=

    Concept embedding models: Beyond the accuracy-explainability trade-off , author=. Advances in Neural Information Processing Systems , year=

  48. [56]

    5 of the ai safety benchmark from mlcommons , author=

    Introducing v0. 5 of the ai safety benchmark from mlcommons , author=. arXiv preprint arXiv:2404.12241 , year=

    arXiv

  49. [57]

    arXiv preprint arXiv:2503.16431 , year=

    OpenAI's Approach to External Red Teaming for AI Models and Systems , author=. arXiv preprint arXiv:2503.16431 , year=

    arXiv

  50. [58]

    Conference on Computer-Supported Cooperative Work and Social Computing , year=

    The human factor in ai red teaming: Perspectives from social and collaborative computing , author=. Conference on Computer-Supported Cooperative Work and Social Computing , year=

  51. [59]

    arXiv preprint arXiv:2510.02978 , year=

    AI Generated Child Sexual Abuse Material--What's the Harm? , author=. arXiv preprint arXiv:2510.02978 , year=

  52. [60]

    International Conference on Learning Representations , year=

    Adversarial perturbations cannot reliably protect artists from generative ai , author=. International Conference on Learning Representations , year=

  53. [61]

    International Conference on Machine Learning , year=

    Raising the cost of malicious ai-powered image editing , author=. International Conference on Machine Learning , year=

  54. [62]

    2025 , url =

    Portnoff, Rebecca and Simpson, Michael , title =. 2025 , url =

    2025

  55. [63]

    2025 , booktitle =

    Hawkins, Will and Mittelstadt, Brent and Russell, Chris , title =. 2025 , booktitle =

    2025

  56. [64]

    Analyzing the

    Gibson, Cassidy and Olszewski, Daniel and Brigham, Natalie Grace and Crowder, Anna and Butler, Kevin RB and Traynor, Patrick and Redmiles, Elissa M and Kohno, Tadayoshi , booktitle=. Analyzing the

  57. [65]

    USENIX Security Symposium , year=

    Extracting training data from diffusion models , author=. USENIX Security Symposium , year=

  58. [66]

    IEEE Symposium on Security and Privacy , year=

    Machine unlearning , author=. IEEE Symposium on Security and Privacy , year=

  59. [67]

    Advances in Neural Information Processing Systems, Position Paper Track , year=

    Machine Unlearning Doesn't Do What You Think: Lessons for Generative AI Policy, Research, and Practice , author=. Advances in Neural Information Processing Systems, Position Paper Track , year=

  60. [68]

    arXiv preprint arXiv:2510.09263 , year=

    SynthID-Image: Image watermarking at internet scale , author=. arXiv preprint arXiv:2510.09263 , year=

  61. [69]

    Advances in Neural Information Processing Systems , year=

    Leveraging catastrophic forgetting to develop safe diffusion models against malicious finetuning , author=. Advances in Neural Information Processing Systems , year=

  62. [70]

    Advances in Neural Information Processing Systems , year=

    Towards automated circuit discovery for mechanistic interpretability , author=. Advances in Neural Information Processing Systems , year=

  63. [71]

    International Conference on Learning Representations , year=

    Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To! , author=. International Conference on Learning Representations , year=

  64. [72]

    arXiv preprint arXiv:2506.06488 , year=

    Membership Inference Attacks for Unseen Classes , author=. arXiv preprint arXiv:2506.06488 , year=

  65. [73]

    2024 , journal=

    Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnet , author=. 2024 , journal=

    2024

  66. [74]

    IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

    Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimization , author=. IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

  67. [75]

    Stage-Wise Model Diffing , year =

  68. [76]

    Advances in Neural Information Processing Systems , volume=

    Overcoming sparsity artifacts in crosscoders to interpret chat-tuning , author=. Advances in Neural Information Processing Systems , volume=

  69. [77]

    arXiv preprint arXiv:2412.00357 , year=

    Safety alignment backfires: Preventing the re-emergence of suppressed concepts in fine-tuned text-to-image diffusion models , author=. arXiv preprint arXiv:2412.00357 , year=

    arXiv

  70. [78]

    arXiv , author=

    Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. arXiv , author=. arXiv preprint arXiv:2208.12242 , year=

    arXiv

  71. [79]

    IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    A pilot study of query-free adversarial attack against stable diffusion , author=. IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  72. [80]

    European Conference on Computer Vision , year=

    Race: Robust adversarial concept erasure for secure text-to-image diffusion model , author=. European Conference on Computer Vision , year=

  73. [81]

    Proceedings of the 2023 ACM SIGSAC conference on computer and communications security , pages=

    Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models , author=. Proceedings of the 2023 ACM SIGSAC conference on computer and communications security , pages=

    2023

  74. [82]

    2024 , url =

    REPORT Act. 2024 , url =

    2024

  75. [83]

    Policy Brief

    Safety Risks from Customizing Foundation Models via Fine-tuning , author=. Policy Brief. Stanford Human-Centered Artificial Intelligence , year=

  76. [84]

    AAAI/ACM Conference on AI, Ethics, and Society , year=

    Self-destructing models: Increasing the costs of harmful dual uses of foundation models , author=. AAAI/ACM Conference on AI, Ethics, and Society , year=

  77. [85]

    2024 IEEE symposium on security and privacy (SP) , pages=

    Sneakyprompt: Jailbreaking text-to-image generative models , author=. 2024 IEEE symposium on security and privacy (SP) , pages=. 2024 , organization=

    2024

  78. [86]

    IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Mma-diffusion: Multimodal attack on diffusion models , author=. IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  79. [87]

    Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    Safegen: Mitigating sexually explicit content generation in text-to-image models , author=. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    2024

  80. [88]

    Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    Surrogateprompt: Bypassing the safety filter of text-to-image models via substitution , author=. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    2024

  81. [89]

    Advances in Neural Information Processing Systems , year=

    Defensive unlearning with adversarial training for robust concept erasure in diffusion models , author=. Advances in Neural Information Processing Systems , year=

  82. [90]

    IEEE/CVF International Conference on Computer Vision , pages=

    Ablating concepts in text-to-image diffusion models , author=. IEEE/CVF International Conference on Computer Vision , pages=

  83. [91]

    2022 , howpublished =

    CompVis , title =. 2022 , howpublished =

    2022

  84. [92]

    2022 , booktitle =

    Red-teaming the stable diffusion safety filter , author=. 2022 , booktitle =

    2022

  85. [93]

    arXiv preprint arXiv:2503.19312 , year=

    Imagegen-cot: Enhancing text-to-image in-context learning with chain-of-thought reasoning , author=. arXiv preprint arXiv:2503.19312 , year=

    arXiv

  86. [94]

    IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

    High-resolution image synthesis with latent diffusion models , author=. IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

  87. [95]

    IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Safe latent diffusion: Mitigating inappropriate degeneration in diffusion models , author=. IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  88. [96]

    IEEE/CVF international conference on computer vision , year=

    Erasing concepts from diffusion models , author=. IEEE/CVF international conference on computer vision , year=

  89. [97]

    arXiv preprint arXiv:2507.11473 , year=

    Chain of thought monitorability: A new and fragile opportunity for ai safety , author=. arXiv preprint arXiv:2507.11473 , year=

    arXiv

  90. [98]

    ACM Conference on Computer and Communications Security , year=

    What Lurks Within? Concept Auditing for Shared Diffusion Models at Scale , author=. ACM Conference on Computer and Communications Security , year=

  91. [99]

    arXiv preprint arXiv:2412.16339 , year=

    Deliberative alignment: Reasoning enables safer language models , author=. arXiv preprint arXiv:2412.16339 , year=

    arXiv

  92. [100]

    arXiv preprint arXiv:2307.15043 , year=

    Universal and transferable adversarial attacks on aligned language models , author=. arXiv preprint arXiv:2307.15043 , year=

    arXiv

  93. [101]

    AAAI Conference on Artificial Intelligence , year=

    A holistic approach to undesired content detection in the real world , author=. AAAI Conference on Artificial Intelligence , year=

  94. [102]

    Transactions on Machine Learning Research , year=

    Smoothllm: Defending large language models against jailbreaking attacks , author=. Transactions on Machine Learning Research , year=

  95. [103]

    arXiv preprint arXiv:2309.00614 , year=

    Baseline defenses for adversarial attacks against aligned language models , author=. arXiv preprint arXiv:2309.00614 , year=

    arXiv

  96. [104]

    arXiv preprint arXiv:2310.06387 , year=

    Jailbreak and guard aligned language models with only few in-context demonstrations , author=. arXiv preprint arXiv:2310.06387 , year=

    arXiv

  97. [105]

    arXiv preprint arXiv:2312.06674 , year=

    Llama guard: Llm-based input-output safeguard for human-ai conversations , author=. arXiv preprint arXiv:2312.06674 , year=

    arXiv

  98. [106]

    Findings of the Association for Computational Linguistics , year=

    Jailbreaking prompt attack: A controllable adversarial attack against diffusion models , author=. Findings of the Association for Computational Linguistics , year=

  99. [107]

    arXiv preprint arXiv:2507.16329 , year=

    DREAM: Scalable Red Teaming for Text-to-Image Generative Systems via Distribution Modeling , author=. arXiv preprint arXiv:2507.16329 , year=

  100. [108]

    Advances in Neural Information Processing Systems , year=

    ART: automatic red-teaming for text-to-image models to protect benign users , author=. Advances in Neural Information Processing Systems , year=

  101. [109]

    arXiv preprint arXiv:2403.04893 , year=

    A safe harbor for ai evaluation and red teaming , author=. arXiv preprint arXiv:2403.04893 , year=

    arXiv

  102. [110]

    and Pfefferkorn, R

    Grossman, S. and Pfefferkorn, R. and Liu, S. , title =. 2025 , publisher =

    2025

  103. [111]

    arXiv preprint arXiv:2206.00169 , year=

    Discovering the hidden vocabulary of dalle-2 , author=. arXiv preprint arXiv:2206.00169 , year=

    arXiv

  104. [112]

    International Conference on Machine Learning , year=

    Prompting4debugging: Red-teaming text-to-image diffusion models by finding problematic prompts , author=. International Conference on Machine Learning , year=

  105. [113]

    2023 , month =

    Google , title =. 2023 , month =

    2023

  106. [114]

    arXiv preprint arXiv:2209.07858 , year=

    Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned , author=. arXiv preprint arXiv:2209.07858 , year=

    arXiv

  107. [115]

    arXiv preprint arXiv:2505.08234 , year=

    Removing Watermarks with Partial Regeneration using Semantic Information , author=. arXiv preprint arXiv:2505.08234 , year=

    arXiv

  108. [116]

    arXiv preprint arXiv:2402.19361 , year=

    Watermark stealing in large language models , author=. arXiv preprint arXiv:2402.19361 , year=

    arXiv

  109. [117]

    Advances in Neural Information Processing Systems , year=

    No free lunch in llm watermarking: Trade-offs in watermarking design choices , author=. Advances in Neural Information Processing Systems , year=

  110. [118]

    Neurocomputing , year=

    A comprehensive survey on robust image watermarking , author=. Neurocomputing , year=

  111. [119]

    IEEE/CVF International Conference on Computer Vision , year=

    Meta-unlearning on diffusion models: Preventing relearning unlearned concepts , author=. IEEE/CVF International Conference on Computer Vision , year=

  112. [120]

    IEEE/CVF International Conference on Computer Vision , year=

    The stable signature: Rooting watermarks in latent diffusion models , author=. IEEE/CVF International Conference on Computer Vision , year=

  113. [121]

    Advances in Neural Information Processing Systems , year=

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust , author=. Advances in Neural Information Processing Systems , year=

  114. [122]

    IEEE/CVF International conference on computer vision , year=

    Artificial fingerprinting for generative models: Rooting deepfake attribution in training data , author=. IEEE/CVF International conference on computer vision , year=

  115. [123]

    International Conference on Learning Representations , year=

    Silo language models: Isolating legal risk in a nonparametric datastore , author=. International Conference on Learning Representations , year=

  116. [124]

    arXiv preprint arXiv:2306.12001 , year=

    An overview of catastrophic AI risks , author=. arXiv preprint arXiv:2306.12001 , year=

    arXiv

  117. [125]

    Advances in Neural Information Processing Systems , volume=

    Conceptmix: A compositional image generation benchmark with controllable difficulty , author=. Advances in Neural Information Processing Systems , volume=

  118. [126]

    arXiv preprint arXiv:2508.06601 , year=

    Deep Ignorance: Filtering Pretraining Data Builds Tamper-Resistant Safeguards into Open-Weight LLMs , author=. arXiv preprint arXiv:2508.06601 , year=

  119. [127]

    European Conference on Computer Vision , pages=

    Implicit concept removal of diffusion models , author=. European Conference on Computer Vision , pages=. 2024 , organization=

    2024

  120. [128]

    IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

    Mace: Mass concept erasure in diffusion models , author=. IEEE/CVF Conference on Computer Vision and Pattern Recognition , year=

  121. [129]

    Advances in Neural Information Processing Systems , year=

    Safety pretraining: Toward the next generation of safe ai , author=. Advances in Neural Information Processing Systems , year=

  122. [130]

    Advances in Neural Information Processing Systems , year=

    Compositional abilities emerge multiplicatively: Exploring diffusion models on a synthetic task , author=. Advances in Neural Information Processing Systems , year=

  123. [131]

    International Conference on Machine Learning , year=

    Can subnetwork structure be the key to out-of-distribution generalization? , author=. International Conference on Machine Learning , year=

  124. [132]

    2025 , month =

    Google , title =. 2025 , month =

    2025

  125. [133]

    2022 , howpublished =

    Susan Jasper , title =. 2022 , howpublished =

    2022

  126. [134]

    Joint European Conference on Machine Learning and Knowledge Discovery in Databases , year=

    Detecting sexually explicit content in the context of the child sexual abuse materials (CSAM): end-to-end classifiers and region-based networks , author=. Joint European Conference on Machine Learning and Knowledge Discovery in Databases , year=

  127. [135]

    Forensic Science International: Digital Investigation , volume=

    Detecting child sexual abuse material: A comprehensive survey , author=. Forensic Science International: Digital Investigation , volume=. 2020 , publisher=

    2020

  128. [136]

    2025 , howpublished =

    Microsoft , title =. 2025 , howpublished =

    2025

  129. [137]

    arXiv preprint arXiv:2108.07258 , year=

    On the opportunities and risks of foundation models , author=. arXiv preprint arXiv:2108.07258 , year=

    arXiv

  130. [138]

    Transactions on Machine Learning Research , year=

    Is What You Ask For What You Get? Investigating Concept Associations in Text-to-Image Models , author=. Transactions on Machine Learning Research , year=

  131. [139]

    Stanford Digital Repository , year=

    Generative ML and CSAM: Implications and mitigations , author=. Stanford Digital Repository , year=

  132. [140]

    2022 , month =

    TechCoalition , title =. 2022 , month =

    2022

  133. [141]

    Safety by Design for Generative AI: Preventing Child Sexual Abuse , howpublished=

    Thorn and. Safety by Design for Generative AI: Preventing Child Sexual Abuse , howpublished=

  134. [142]

    2024 , howpublished=

    CyberTipline Report , author=. 2024 , howpublished=

    2024

  135. [143]

    2025 , howpublished=

    The Deepfake Dilemma: New challenges protecting students, confidentiality , author=. 2025 , howpublished=

    2025

  136. [144]

    2024 , howpublished=

    Generative AI: A New Threat for Online Child Sexual Exploitation and Abuse , author=. 2024 , howpublished=

    2024

  137. [145]

    2024 , howpublished=

    Youth Perspectives on Online Safety , author=. 2024 , howpublished=

    2024

  138. [146]

    2024 , howpublished=

    Trends in Financial Sextortion: An investigation of sextortion reports in NCMEC CyberTipline data , author=. 2024 , howpublished=

    2024

  139. [147]

    2021 , howpublished=

    CSAM Users in the Dark Web: Protecting Children Through Prevention , author=. 2021 , howpublished=

    2021

  140. [148]

    Position:

    Sanchaita Hazra and Bodhisattwa Prasad Majumder and Tuhin Chakrabarty , booktitle=. Position:

  141. [149]

    ACM Conference on Fairness, Accountability, and Transparency , year=

    The reality of ai and biorisk , author=. ACM Conference on Fairness, Accountability, and Transparency , year=

  142. [150]

    arXiv preprint arXiv:2308.03740 , year=

    A cost analysis of generative language models and influence operations , author=. arXiv preprint arXiv:2308.03740 , year=

    arXiv

  143. [151]

    arXiv preprint arXiv:2305.06972 , year=

    Spear phishing with large language models , author=. arXiv preprint arXiv:2305.06972 , year=

    arXiv

  144. [152]

    Advances in Neural Information Processing Systems, Track on Datasets and Benchmarks , year=

    Into the laion’s den: Investigating hate in multimodal datasets , author=. Advances in Neural Information Processing Systems, Track on Datasets and Benchmarks , year=

  145. [153]

    34th USENIX Security Symposium , year=

    Analyzing the AI Nudification Application Ecosystem , author=. 34th USENIX Security Symposium , year=

  146. [154]

    International Conference on Machine Learning, Position Paper Track , year=

    On the societal impact of open foundation models , author=. International Conference on Machine Learning, Position Paper Track , year=

  147. [155]

    2010 , publisher=

    Child molesters: A behavioral analysis for law enforcement officers investigating cases of child sexual exploitation , author=. 2010 , publisher=

    2010

  148. [156]

    2023 , howpublished=

    How AI is being abused to create child sexual abuse imagery , author=. 2023 , howpublished=

    2023

  149. [157]

    2024 , howpublished=

    What has changed in the AI CSAM landscape? , author=. 2024 , howpublished=

    2024

  150. [158]

    2025 , howpublished=

    Full feature-length AI films of child sexual abuse will be ‘inevitable’ as synthetic videos make ‘huge leaps’ in sophistication in a year , author=. 2025 , howpublished=

    2025

  151. [159]

    2023 , publisher=

    How Predators Are Abusing Generative AI , author=. 2023 , publisher=

    2023

  152. [160]

    Stanford Internet Observatory, Cyber Policy Center , year=

    Identifying and eliminating csam in generative ml training data and models , author=. Stanford Internet Observatory, Cyber Policy Center , year=

  153. [161]

    https://arxiv.org/pdf/2502.16383 , year=

    Understanding Generative AI Risks for Youth: A Taxonomy Based on Empirical Data , author=. https://arxiv.org/pdf/2502.16383 , year=

    arXiv

  154. [162]

    2011 , url =

    Reporting Requirements of Providers , author =. 2011 , url =

    2011

  155. [163]

    2011 , url =

    Certain activities relating to material involving the sexual exploitation of minors , author =. 2011 , url =

    2011

  156. [164]

    2003 , url =

    Prosecutorial Remedies and Other Tools to end the Exploitation of Children Today Act , author =. 2003 , url =

    2003

  157. [165]

    2024 , publisher=

    Thorn and All Tech Is Human Forge Generative AI Principles with AI Leaders to Enact Strong Child Safety Commitments , author=. 2024 , publisher=

    2024

  158. [166]

    , author=

    We’re seeing important steps forward in the EU AI Act Code of Practice, and still, there’s more work to do. , author=. 2025 , month =

    2025

  159. [167]

    2025 , publisher=

    Safety by Design Three-Month Progress Report #3: November 2024 to January 2025 , author=. 2025 , publisher=

    2024

  160. [168]

    2025 , publisher=

    Basic Online Safety Expectations , author=. 2025 , publisher=

    2025

  161. [169]

    2025 , publisher=

    A baseline for online safety transparency , author=. 2025 , publisher=

    2025

  162. [170]

    Journal of Online Trust and Safety , volume=

    Content Moderators’ Strategies for Coping with the Stress of Moderating Content Online , author=. Journal of Online Trust and Safety , volume=

  163. [171]

    2025 , url =

    TAKE IT DOWN Act , author =. 2025 , url =

    2025

  164. [172]

    CNBC , year=

    Meta files lawsuit against developer of CrushAI ‘nudify’ app , author=. CNBC , year=

  165. [173]

    2024 , howpublished=

    Generative AI CSAM is CSAM , author=. 2024 , howpublished=

    2024

  166. [174]

    2024 , howpublished=

    Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud , author=. 2024 , howpublished=

    2024

  167. [175]

    School Shooters, Anorexia Coaches, and Sexualized Minors: A Look at Harmful Character Chatbots and the Communities That Build Them , author=

    Character Flaws. School Shooters, Anorexia Coaches, and Sexualized Minors: A Look at Harmful Character Chatbots and the Communities That Build Them , author=. 2025 , howpublished=

    2025

  168. [176]

    2025 , howpublished=

    AI Chatbots Are Having Conversations With Minors That Would Land a Human on the Sex Offender Registry , author=. 2025 , howpublished=

    2025

  169. [177]

    2025 , howpublished=

    AI Chatbots and Companions – Risks to Children and Young People , author=. 2025 , howpublished=

    2025

  170. [178]

    2025 , howpublished=

    Cross-platform CSAM hash sharing for platforms , author=. 2025 , howpublished=

    2025

  171. [179]

    arXiv preprint arXiv:2510.09023 , year=

    The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections , author=. arXiv preprint arXiv:2510.09023 , year=

    arXiv

  172. [180]

    Journal of Forensic and Legal Medicine , year =

    Using expert-reviewed CSAM to train CNNs and its anthropological analysis , author =. Journal of Forensic and Legal Medicine , year =

  173. [181]

    Digital Investigation , year =

    A Practitioner Survey Exploring the Value of Forensic Tools, AI, Filtering, & Safer Presentation for Investigating Child Sexual Abuse Material (CSAM) , author =. Digital Investigation , year =

  174. [182]

    Wall Street Journal , author =

    Meta’s ‘Digital Companions’ Will Talk Sex With Users—Even Children , howpublished =. Wall Street Journal , author =

  175. [183]

    2025 ,publisher =

    Wolbers, Heather and Cubitt, Timothy and Napier, Sarah and Cahill, Michael John and Nicholas, Mariesa and Burton, Melanie and Giunta, Katherine , title =. 2025 ,publisher =

    2025

  176. [184]

    Sexual Extortion & Young People: Navigating Threats in Digital Environments , howpublished =

    Thorn , year =. Sexual Extortion & Young People: Navigating Threats in Digital Environments , howpublished =

  177. [185]

    Video Generation Arena Leaderboard , year =

  178. [186]

    Text-to-Image Leaderboard , year =

Pith tools

Reviewed July 12, 2026 · model on record in the stance chip above.