Pith. sign in

REVIEW 3 major objections 5 minor 87 references

A LoRA's training subject is stably encoded in the leading singular direction of its weight update, and a linear read of that direction can screen adapters without generating any images.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 01:34 UTC pith:XO6EAHTR

load-bearing objection A solid, honestly-scoped weight-space fingerprint paper whose controlled benign benchmark is credible, with a title that outruns the evidence: the CSAM transfer step is untested and explicitly disclaimed. the 3 major comments →

arxiv 2607.25750 v1 pith:XO6EAHTR submitted 2026-07-28 cs.LG cs.CY

Detecting CSAM Text-to-Image LoRAs From Weights

David Demitri Africa , Cate Heine , Nadine Staes-Polet , Kimberly Mai This is my paper
classification cs.LG cs.CY
keywords LoRAweight-space analysissingular vectorsCSAM detectiondiffusion modelsproxy supervisionmodel moderationbackdoor recovery
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims that a LoRA's training subject is legible in its weights: the leading left singular vector u1 of each cross-attention update points to what the adapter was trained to emit, and this direction is independent of the update's magnitude. On a controlled zoo of 957 benign single-concept adapters, a simple logistic-regression classifier on u1 recovers the subject at 0.976 macro AUROC across seven categories, and 0.998 on an adult/child/youth age axis used as a benign proxy for the child axis of CSAM. The same detector abstains on unrelated benign content (0/627 confident false flags) and survives rescaling, precision reduction, additive weight noise, and trigger-based backdoors. The intended consequence is a moderation signal that flags potentially harmful adapters from weights alone — no prompts, no image generation, no GPU inference. The paper states plainly that the transfer to actual CSAM LoRAs, which conjoin children and sexual content, is not tested.

Core claim

The central claim is that a LoRA update ΔW = BA is a low-rank matrix whose leading left singular vector u1 — the direction the adapter would inject into the denoiser when its cue fires — is a stable fingerprint of the training subject, not of the training recipe. In an idealized rank-one subject model ΔW = γ w a^T, u1 exactly recovers the emitted direction w regardless of the overall scale γ and the cue norm; a singular-subspace perturbation bound keeps u1 stable under bounded weight perturbations, and the paper proves scale invariance, merge-retention, and early-time bottleneck properties that explain why the direction persists. Empirically, on a 957-adapter benchmark with randomized hyperp

What carries the argument

The central object is u1: the top-left singular vector of each cross-attention LoRA update, sign-aligned and concatenated across layers into one feature vector per adapter. It is the output-side direction the adapter adds to the network's hidden state when its input cue is present, so it captures what is emitted rather than how strongly. The mathematical backbone is a rank-one subject model ΔW = γ w a^T, where w is the emitted subject direction and a is the cue; u1 recovers w exactly and independently of γ, and singular-subspace perturbation bounds and stable-rank certificates guarantee that the direction survives noise, rescaling, precision reduction, and merges as long as the singular-valu

Load-bearing premise

The load-bearing premise is that apparent age in synthetic faces is a faithful benign proxy for the child axis of CSAM LoRAs including the sexual-content conjunction — a transfer the paper explicitly does not test — together with the structural assumption that real CSAM adapters' cross-attention updates have the singular-value gap needed to keep u1 stable.

What would settle it

Train (or obtain, under an approved legal-ethical protocol) a LoRA that genuinely conjoins child appearance with sexual content, extract u1, and check two things: whether the benign age-proxy classifier's child probability rises with the sexual-content specificity at fixed apparent age, and whether the singular-value gap of the cross-attention updates stays large enough for the perturbation bound to hold. A null on either — no graded response along the sexual-content conjunction, or a collapsed gap that makes u1 unstable — would falsify the transfer claim, as would a real-world child-sexual-co

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A screening detector can be trained on benign proxy axes alone: a detector supervised only on discrete adult/child/youth face adapters raises its child probability monotonically with the child fraction of a never-seen adult–child mixture (ρ = 0.94), so the signal grades continuously toward the safety-relevant end of the proxy axis.
  • The direction is stable under the weight-space manipulations an uploader would plausibly use: AUROC stays at or above 0.971 under rescaling, 8-bit and 4-bit quantization, norm equalization, fp16 round-trip, and additive noise at the scale of the weights.
  • Hidden capabilities leave recoverable traces: age learned only behind a trigger token with regularization is still recovered at 0.83 macro AUROC, the child class remaining the most recoverable (0.96), and a 5–10% face-poison minority is separable from a clean adapter.
  • u1 is data-efficient and architecture-portable: roughly 0.97 macro AUROC is reached with about 80 adapters per category, and the method transfers to different base architectures with a per-base detector.
  • The weight-space and activation-space views are complementary: fusing u1 with an activation probe raises seven-category macro AUROC from 0.976/0.986 to 0.993–0.995 on the paired set, with a confidence router selecting u1 on about half the adapters.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the leading direction is the carrier of the subject, then concept erasure becomes algebraically direct: nulling or rotating u1 in weight space should suppress the subject without retraining, and the paper's merge-retention propositions describe exactly when such an operation survives a merge. I infer this is a testable mitigation, though the paper only frames it as future work.
  • The proxy-supervision design suggests a regulatory deployment template: build the benign zoo along the exact sensitive axis (not a single coarse proxy), measure graded transfer with mixture sweeps, and require the singular-value gap to be verified on real target adapters; the paper explicitly does not provide that verification, so any production system would need it.
  • The fact that the paper withholds two moderately effective evasion techniques hints that direction-changing perturbations — not magnitude changes — are the adversarial regime to worry about; a natural extension is to characterize the minimal norm of a perturbation that rotates u1 enough to flip a detection, since scale invariance rules out easy magnitude evasion.
  • The dominance of the leading direction over magnitudes suggests a general principle for adapter forensics: for any low-rank adapter, the top singular directions are the semantic ones, and summary statistics or norms throw away the signal. I infer this extends beyond CSAM screening to style, identity, and domain detection from weights.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a weight-space screening method for LoRA adapters used in text-to-image models, aimed at detecting CSAM-generating adapters without running inference or generating images. The method extracts the top-left singular vector of each cross-attention LoRA update matrix, concatenates these vectors across layers to form a fingerprint called u1, and trains a simple logistic-regression classifier on this representation. Using a controlled zoo of 957 benign single-concept SD-1.5 LoRAs spanning seven categories including age (adult/child/youth), the authors report 0.976 macro one-vs-rest AUROC, with negative controls at chance, robustness to weight noise/rescaling/quantization, and abstention on unrelated benign content. They also report that u1 recovers a hidden age axis behind a DreamBooth-style trigger and that the child-probability rises monotonically with the child fraction in graded adult/child mixtures (Spearman ρ=0.94). The theoretical appendix proves scale invariance, rank-one recovery, and a Wedin-style bound that motivates the use of the leading left singular direction. The paper frames the age axis as a benign proxy for the child-related axis of CSAM and claims that the results indicate harmful LoRAs could be screened directly from weights.

Significance. If the central CSAM-screening claim were established, this would be an important contribution to AI child-safety: a fully weight-based, inference-free screening signal that avoids generating or exposing CSAM. The empirical core is genuinely strong and carefully controlled: a 957-adapter benchmark with randomized training recipes, 8-seed cross-validation, label/feature permutation controls at chance, a cross-source bird control demonstrating subject rather than dataset encoding, graded-mixture monotonicity, and a robustness sweep. The theoretical propositions are proved independently of the data and are not circular with the empirical results. The paper is also transparent in its Limitations section, explicitly stating that only benign proxies were tested. However, as the paper itself acknowledges, the leap from 'apparent age on synthetic faces' to 'CSAM-generating LoRAs containing both children and sexual content' is untested, and this gap is load-bearing for the title and abstract claims. The contribution is best evaluated as a rigorous proof-of-concept for proxy-supervised, weight-space detection of a benign age axis, with the CSAM deployment claim currently unsupported.

major comments (3)
  1. [Limitations; Figure 4; Proposition 2] The central deployment claim—that this method can detect CSAM LoRAs—is not supported by the evidence. The Limitations section states: 'we test only on benign proxies... it is not a guarantee of generalization to CSAM-generating LoRAs that include children and sexual content.' The graded adult/child mixture experiment (Figure 4) varies only the age fraction within benign face imagery; it never introduces sexual content. Proposition 2 shows that u1 recovers the strongest learned output direction, but in a CSAM-trained adapter the sexual-content direction might have a larger singular value than the age direction, moving u1 outside the benign age manifold. The paper should either substantially reframe the title, abstract, and conclusion as 'benign proxy screening for an age axis' or provide additional evidence that the age axis survives the conjunction, for example by testing benign adult se
  2. [Appendix B, Theorem 1; Limitations] The Wedin-bound analysis (Theorem 1) requires a positive singular-value gap in the adapter's update matrices. On the benign zoos this gap is implicitly sufficient, as evidenced by the strong AUROC results, but the gap is never measured on real-world adapters, including the 63,288-adapter corpus surveyed in Section 'LoRAs in the Wild'. The Limitations also acknowledge that text-encoder-only LoRAs, stacked/merged LoRAs, and LoRAs with multiple concepts are untested. These are structural conditions for the method to work, not minor edge cases. The authors should characterize the singular-value gap distribution across a broader, unlabeled sample of in-the-wild adapters, and at minimum state clearly which adapter architectures the method is not expected to cover.
  3. [Results: Proxy-supervised detection abstains] The abstention claim ('0/627 confident misclassifications') depends on a confidence threshold of 0.7 selected for deployment-style calibration. No sensitivity analysis over the threshold is reported, so it is unclear how robust the abstention result is to threshold choice. Since the deployment scenario would require setting this threshold in advance, the paper should report the abstention performance across a range of thresholds (e.g., 0.6–0.9) and for the SDXL cross-base detector as well.
minor comments (5)
  1. [Table 1] The 'LoRA rank' row is formatted awkwardly ('91.5' appears without a label), and the caption could clarify that percentages refer to the share of the corpus for which the field is observable.
  2. [Table 2] Typo: 'Rare triggerandregularization' should be 'Rare trigger and regularization'.
  3. [Figure 13] The caption states the classifier separates birds from 'the other 757 SD-1.5 adapters', but the benchmark has 957 total and 100 birds, implying 857 non-bird adapters. The provenance of 757 should be clarified (perhaps it excludes the iNaturalist genus adapters that share the bird genus).
  4. [Appendix A, Table 6] The 'age FLUX 150' row might be clearer if it stated whether this is the same age-zoo protocol as SD-1.5; the difference in N (150 vs 300) is unexplained in the main text.
  5. [Conclusion] The sentence 'u1 could support mitigation as well as detection' is speculative; consider moving to future work rather than the conclusion if space allows.

Circularity Check

0 steps flagged

No significant circularity: the representation, theory, and empirical evaluations are self-contained; the proxy-to-CSAM gap is an explicit scope limitation, not a circular reduction.

full rationale

The paper's chain is not circular. The u1 representation is defined directly from LoRA weight matrices via SVD, and the theoretical propositions (scale invariance, rank-one recovery, Wedin bound) are parameter-free linear-algebra statements proved in Appendix B; none assumes the empirical AUROC results. The headline accuracy numbers are honest held-out evaluations: logistic regression/random forest are trained on adapter u1 features and subject labels and evaluated under stratified cross-validation, with label-permutation and random-feature controls at chance (0.50/0.51), so the 'prediction' is not the fit. The abstention result is measured on 627/657 unseen benign non-age adapters; the graded adult-child mixture experiment applies a detector trained only on discrete endpoints to never-seen mixtures (Spearman 0.94), so it is a transfer test, not a fitted-input prediction. The only load-bearing caveat is the proxy-transfer step from benign age-axis LoRAs to real CSAM LoRAs; the paper itself states in Limitations: 'we test only on benign proxies... it is not a guarantee of generalization to CSAM-generating LoRAs that include children and sexual content.' That is an explicit, unclaimed scope limitation, not a result that reduces to its inputs by construction. No self-citation chain is used to force the central claim; the method is compared against external baselines and negative controls. Therefore no circular step is exhibited.

Axiom & Free-Parameter Ledger

3 free parameters · 6 axioms · 1 invented entities

The work is honest about its main postulates: a simplified rank-one model explains u1, Wedin theory guarantees stability under perturbation, and the benign age axis is an explicitly acknowledged stand-in for the CSAM target. The costliest assumption is the proxy-transfer premise.

free parameters (3)
  • Logistic-regression coefficients and bias on u1 (l2-regularized, C=1) = not stated (learned vector)
    Headline AUROC values are properties of this fitted classifier; held-out CV and negative controls prevent this from being a pure fit-to-noise result.
  • Confidence threshold for 'confident misclassification' = 0.7
    The 0/627 abstention claim uses this hand-chosen threshold; it determines the reported false-flag count.
  • Number of leading singular vectors per layer = 1 (u1)
    Ablation shows top-3 improves AUROC from 0.979 to 0.985; the default is a design choice.
axioms (6)
  • standard math Wedin's sin-theta theorem and Weyl's inequality bound singular-vector perturbation (Stewart & Sun 1990; Wedin 1972)
    Appendix B, Theorem 1, used to argue u1 is stable under weight perturbations and to derive the rank-one recovery claims.
  • ad hoc to paper A LoRA subject update is approximately rank one: ΔW = γ w a^⊤ (cue gates a single output direction)
    Introduced in 'Weight-space Detection' to motivate u1; not derived from trained networks, though empirically supported by the results.
  • domain assumption LoRA updates factor as ΔW = BA with a frozen base model (Hu et al. 2022)
    The whole method operates on the BA decomposition; adapters that modify the text encoder or use non-LoRA updates are out of scope.
  • domain assumption Cross-attention layers are the right shared substrate; u1 vectors can be aligned by layer across a zoo
    Appendix A selects cross-attention value projections following Duszenko & Bielak 2025; the paper shows results vary by layer family but does not test all architectures.
  • ad hoc to paper Apparent age on synthetic faces (AI-Face) is a benign, legally/ethically permissible proxy for the CSAM child axis
    Central deployment premise (intro and Limitations); no evidence that the child-plus-sexual-content conjunction preserves the same u1 direction.
  • domain assumption A classifier trained on one benign axis will abstain on off-axis benign content
    Validated on 657/727 benign non-age adapters within the controlled zoo, but not on wild multi-concept LoRAs.
invented entities (1)
  • u1 fingerprint (concatenated leading left singular vectors of cross-attention ΔW) independent evidence
    purpose: Inference-free, compact representation of a LoRA's strongest learned change for subject screening
    Supported by extensive falsifiable experiments inside the paper (subject recovery, cross-base transfer, abstention, robustness); no external validation yet.

pith-pipeline@v1.3.0-alltime-deepseek · 17859 in / 16330 out tokens · 165564 ms · 2026-08-01T01:34:28.374838+00:00 · methodology

0 comments
read the original abstract

Low-rank adaptation (LoRA) fine-tuning has made it cheap and easy to customize open-weight image generation models for specific tasks, including the production of child sexual abuse material (CSAM). Existing moderation relies on metadata or generated outputs, but metadata can be deceptive and generating outputs may itself be unacceptable or illegal. We show that a safer signal lives in the weights. The top-left singular vectors of a LoRA's updates form a compact, inference-free fingerprint ($u_1$) of its strongest learned change. Using human-subject age as a benign proxy for CSAM, we find that $u_1$ identifies what a LoRA was trained on, generalizes across base models, and abstains on unrelated benign content. The signal is robust to additive weight noise, rescaling, and precision reduction. These results indicate that harmful LoRAs could be screened directly from their weights without relying on metadata or generating harmful outputs.

Figures

Figures reproduced from arXiv: 2607.25750 by Cate Heine, David Demitri Africa, Kimberly Mai, Nadine Staes-Polet.

Figure 1
Figure 1. Figure 1: Overview of weight-space screening. We construct a zoo of benign adapters, which vary along a chosen property we want to screen for. For example, adapters trained on the faces of apparent age, a benign proxy for child-related content in CSAM. A LoRA adapter’s cross-attention updates ∆W = BA yield the leading singular direction u1, which a light proxy-supervised classifier maps to a flag/abstain decision. T… view at source ↗
Figure 3
Figure 3. Figure 3: u1 versus weight-space and activation base￾lines on the 957-adapter SD-1.5 benchmark. 7-way sub￾ject; macro one-vs-rest AUROC and balanced accuracy, mean±std over CV folds; dotted lines are chance. u1 matches the GPU Gaussian probe (Suriyakumar et al. 2026) while being inference-free, and beats the summary-statistics (Duszenko and Bielak 2025) and PCA-of-weights (Liu, Takikawa, and Jacobson 2024) baselines… view at source ↗
Figure 2
Figure 2. Figure 2: In-distribution one-vs-rest ROC per subject cat￾egory (logistic regression on u1, stratified CV). AUROC in legend, macro 0.976 across seven categories. The features are subject-specific rather than recipe￾specific. If you instead use the probes to recover the per￾adapter randomized recipe (so our labels are instead one of rank, learning rate, optimizer) from u1 its performance falls to chance (0.51, 0.55, … view at source ↗
Figure 4
Figure 4. Figure 4: Proxy→target transfer. A discrete adult/child/youth detector, applied to graded adult–child mixture adapters it never saw, raises its child probability monotonically with the child fraction of the mixture (Spearman ρ = 0.94); shaded band is ±1 s.d. across the 30 adapters per level. σ = 1, 0.97 at σ = 2), and is invariant to global rescaling and an fp16 round-trip ( [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Recovery from stealth adapters. (a) Per-age hidden-age AUROC: when age is learned openly (clean), u1 recovers it perfectly; bound behind a trigger token (back￾door) it is still recovered well above the 0.33 chance floor, most strongly for the safety-critical child class. (b) Blended poison-fraction sweep: u1 separates an adapter carrying a face (poison) minority from a pure-benign one down to a 5–10% mix. … view at source ↗
Figure 6
Figure 6. Figure 6: u1 encodes the training subject, not the recipe. AUROC of a probe predicting each target from u1 on the same content adapters: the subject is recovered at 0.95, while the per-adapter randomized recipe (rank, learning rate, opti￾mizer) and the label-permutation / random-feature negative controls all sit at chance. B Theoretical Details for the u1 Representation This appendix proves the claims used to motiva… view at source ↗
Figure 7
Figure 7. Figure 7: Class-balanced confusion (row-normalized %, lo [PITH_FULL_IMAGE:figures/full_fig_p012_7.png] view at source ↗
Figure 9
Figure 9. Figure 9: Data efficiency: macro one-vs-rest AUROC (the [PITH_FULL_IMAGE:figures/full_fig_p013_9.png] view at source ↗
Figure 12
Figure 12. Figure 12: 3D UMAP of u1 across the SD-1.5 zoos [PITH_FULL_IMAGE:figures/full_fig_p013_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: A bird-vs-rest classifier on u1 separates birds from the other 757 SD-1.5 adapters at 0.957 AUROC with the two sources (CUB-200 and the iNaturalist melanerpes genus) pooled (left), and still recovers the held-out source’s birds when trained on only one source (right; CUB→iNat 0.77, iNat→CUB 0.85), so u1 encodes the bird subject, not merely dataset provenance. Bars are mean over 5-fold CV, error bars ±1 s.… view at source ↗
Figure 15
Figure 15. Figure 15: Per-category one-vs-rest AUROC, u1 vs Gaus￾sian probing, on the seven-category benchmark. The two are complementary—a concatenation/average fusion reaches 0.993–0.995 macro AUROC, above either method alone [PITH_FULL_IMAGE:figures/full_fig_p014_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Routing u1 (weights) with the Gaussian activation probe on the paired adapter set (macro OvR AUROC and balanced accuracy, shared 5-fold CV) [PITH_FULL_IMAGE:figures/full_fig_p014_16.png] view at source ↗
Figure 17
Figure 17. Figure 17: Per-category one-vs-rest AUROC for the two [PITH_FULL_IMAGE:figures/full_fig_p015_17.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

87 extracted references · 7 linked inside Pith

  1. [1]

    , author=

    Lora: Low-rank adaptation of large language models. , author=. Iclr , volume=

  2. [2]

    2025 , howpublished =

    2025

  3. [3]

    Advances in Neural Information Processing Systems , volume=

    Refusal in language models is mediated by a single direction , author=. Advances in Neural Information Processing Systems , volume=

  4. [4]

    AI Magazine , volume =

    Aroyo, Lora and Welty, Chris , title =. AI Magazine , volume =

  5. [5]

    Capable, Open, and Safe: Combating AI Misuse , year =

  6. [6]

    2025 , howpublished =

    Chopine, Vladimir , title =. 2025 , howpublished =

    2025

  7. [7]

    Access Restricted for UK Visitors , year =

  8. [8]

    Advances in Neural Information Processing Systems , volume=

    Stop the nonconsensual use of nude images in research , author=. Advances in Neural Information Processing Systems , volume=

  9. [9]

    Indecent and Prohibited Images of Children , year =

  10. [10]

    International Conference on Computational Science , pages=

    Towards Weight-Space Interpretation of Low-Rank Adapters for Diffusion Models , author=. International Conference on Computational Science , pages=. 2025 , organization=

    2025

  11. [11]

    How AI Is Being Abused to Create Child Sexual Abuse Imagery , institution =

  12. [12]

    The Innovation , year =

    Gu, Jiawei and Jiang, Xuhui and Shi, Zhichao and Tan, Hexiang and Zhai, Xuehao and Xu, Chengjin and Li, Wei and others , title =. The Innovation , year =

  13. [13]

    Proceedings of the 2025 ACM Conference on Fairness, Accountability, and Transparency , pages =

    Hawkins, Will and Mittelstadt, Brent and Russell, Chris , title =. Proceedings of the 2025 ACM Conference on Fairness, Accountability, and Transparency , pages =

    2025

  14. [14]

    Statutory Construction and Interpretation for Artificial Intelligence , journal =

    He, Luxi and Nadeem, Nimra and Liao, Michel and Chen, Howard and Chen, Danqi and Cu. Statutory Construction and Interpretation for Artificial Intelligence , journal =

  15. [15]

    Crime and Policing Bill: Child Sexual Abuse Material Factsheet , year =

  16. [16]

    and Shen, Yelong and Wallis, Phillip and Allen-Zhu, Zeyuan and Li, Yuanzhi and Wang, Shean and Wang, Lu and Chen, Weizhu , title =

    Hu, Edward J. and Shen, Yelong and Wallis, Phillip and Allen-Zhu, Zeyuan and Li, Yuanzhi and Wang, Shean and Wang, Lu and Chen, Weizhu , title =. arXiv preprint arXiv:2106.09685 , year =

    Pith/arXiv arXiv

  17. [17]

    2024 , howpublished =

    What Has Changed in the AI CSAM Landscape? , institution =. 2024 , howpublished =

    2024

  18. [18]

    2026 , howpublished =

    Harm Without Limits: AI Child Sexual Abuse Material Through the Eyes of Our Analysts , institution =. 2026 , howpublished =

    2026

  19. [19]

    arXiv preprint arXiv:2512.11815 , year =

    Kamachee, Max and Casper, Stephen and Ding, Michelle L and Yew, Rui-Jie and Reuel, Anka and Biderman, Stella and Hadfield-Menell, Dylan , title =. arXiv preprint arXiv:2512.11815 , year =

    Pith/arXiv arXiv

  20. [20]

    List of Dirty, Naughty, Obscene, and Otherwise Bad Words , howpublished =

  21. [21]

    Pony\_Diffusion\_V6\_XL , year =

  22. [22]

    404 Media , howpublished =

    Maiberg, Emanuel , title =. 404 Media , howpublished =. 2025 , month =

    2025

  23. [23]

    New Laws to Crackdown on Harmful Pornography , year =

  24. [24]

    Financial Times , howpublished =

    Murgia, Madhumita , title =. Financial Times , howpublished =. 2026 , month =

    2026

  25. [25]

    2024 , howpublished =

    Illegal Content Judgements Guidance , institution =. 2024 , howpublished =

    2024

  26. [26]

    arXiv preprint arXiv:2409.19946 , year =

    Park, Sang Hyun and Koh, Jun Young and Lee, Junha and Song, Joy and Kim, Dongha and Moon, Hoyeon and Lee, Hyunju and Song, Min , title =. arXiv preprint arXiv:2409.19946 , year =

    Pith/arXiv arXiv

  27. [27]

    and Gergle, Darren and Kornfield, Rachel and Meyerhoff, Jonah and Mohr, David and Suh, Jina and Wescott, Annie and Williams, Casey and Schleider, Jessica , title =

    Pendse, Sachin R. and Gergle, Darren and Kornfield, Rachel and Meyerhoff, Jonah and Mohr, David and Suh, Jina and Wescott, Annie and Williams, Casey and Schleider, Jessica , title =. FAccT '25: Proceedings of the 2025 ACM Conference on Fairness, Accountability, and Transparency , pages =

    2025

  28. [28]

    Computer J , pages=

    The QR transformation, a unitary analogue to the LR transformation , author=. Computer J , pages=

  29. [29]

    2025 , eprint=

    FLUX.1 Kontext: Flow Matching for In-Context Image Generation and Editing in Latent Space , author=. 2025 , eprint=

    2025

  30. [30]

    2024 , howpublished =

    Black Forest Labs , title =. 2024 , howpublished =

    2024

  31. [31]

    arXiv preprint arXiv:2412.12048 , year=

    A lora is worth a thousand pictures , author=. arXiv preprint arXiv:2412.12048 , year=

    Pith/arXiv arXiv

  32. [32]

    Unlimited Realm of Exploration and Experimentation

    “Unlimited Realm of Exploration and Experimentation”: Methods and Motivations of AI-Generated Sexual Content Creators , author=. The 2026 ACM Conference on Fairness, Accountability, and Transparency , pages=

    2026

  33. [33]

    2017 IEEE Intelligent Vehicles Symposium (IV) , pages=

    Learning with proxy supervision for end-to-end visual learning , author=. 2017 IEEE Intelligent Vehicles Symposium (IV) , pages=. 2017 , organization=

    2017

  34. [34]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , month =

    Rombach, Robin and Blattmann, Andreas and Lorenz, Dominik and Esser, Patrick and Ommer, Bj\"orn , title =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , month =. 2022 , pages =

    2022

  35. [35]

    International Conference on Learning Representations , volume=

    Sdxl: Improving latent diffusion models for high-resolution image synthesis , author=. International Conference on Learning Representations , volume=

  36. [36]

    2026 , howpublished =

    CSAM Perpetrator Research Report: Findings from a Survey of CSAM Perpetrators on Digital Platform Use and Design (Tell Me More about Tech) , type =. 2026 , howpublished =

    2026

  37. [37]

    Measuring the Reliability of Hate Speech Annotations: The Case of the European Refugee Crisis , journal =

    Ross, Bj. Measuring the Reliability of Hate Speech Annotations: The Case of the European Refugee Crisis , journal =

  38. [38]

    Journal of English Linguistics , volume =

    Sigley, Robert and Holmes, Janet , title =. Journal of English Linguistics , volume =

  39. [39]

    TrainLoRA --- AI Influencer LoRA Creator , year =

  40. [40]

    and Marques, Tiago Garrido and Mauko, Ema and Nikolovska, Manja , title =

    Tuptuk, Nilufer and Johnson, Shane D. and Marques, Tiago Garrido and Mauko, Ema and Nikolovska, Manja , title =

  41. [41]

    Criminal Justice Act 1988 , year =

    1988

  42. [42]

    Sexual Offenses Act , year =

  43. [43]

    Criminal Justice and Immigration Act , year =

  44. [44]

    Coroners and Justice Act , year =

  45. [45]

    Criminal Justice and Courts Act , year =

  46. [46]

    Online Safety Act , year =

  47. [47]

    Tackling Non-Consensual Intimate Image Abuse , year =

  48. [48]

    Advances in Neural Information Processing Systems (NeurIPS 2021) , year=

    Self-Supervised Representation Learning on Neural Network Weights for Model Characteristic Prediction , author=. Advances in Neural Information Processing Systems (NeurIPS 2021) , year=

    2021

  49. [49]

    Proceedings of the 41st International Conference on Machine Learning (ICML) , series=

    Towards Scalable and Versatile Weight Space Learning , author=. Proceedings of the 41st International Conference on Machine Learning (ICML) , series=. 2024 , publisher=

    2024

  50. [50]

    Generative

    Thiel, David and Stroebel, Melissa and Portnoff, Rebecca , institution=. Generative. 2023 , month=jun, doi=

    2023

  51. [51]

    2025 , eprint=

    Unveiling AI's Threats to Child Protection: Regulatory Efforts to Criminalize AI-Generated CSAM and Emerging Children's Rights Violations , author=. 2025 , eprint=

    2025

  52. [52]

    AI & SOCIETY , year=

    AI-Generated Child Sexual Abuse Material: What's the Harm? , author=. AI & SOCIETY , year=

  53. [53]

    Propagation of AI-Generated Child Sexual Abuse Material as a Cybercrime Commodity in Indonesia , author=. O. 2026 , doi=

    2026

  54. [54]

    Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV) , year=

    Systematic Analysis of the Unintentional CSAM-Generation-Potential of Text-to-Image Models , author=. Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV) , year=

  55. [55]

    Proceedings of the 2025 ACM Conference on Fairness, Accountability, and Transparency (FAccT) , pages=

    Neglected Risks: The Disturbing Reality of Children's Images in Datasets and the Urgent Call for Accountability , author=. Proceedings of the 2025 ACM Conference on Fairness, Accountability, and Transparency (FAccT) , pages=. 2025 , doi=

    2025

  56. [56]

    Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency (FAccT) , pages=

    Seeing without Looking: Analysis Pipeline for Child Sexual Abuse Datasets , author=. Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency (FAccT) , pages=. 2022 , doi=

    2022

  57. [57]

    2025 , eprint=

    Evaluating Concept Filtering Defenses against Child Sexual Abuse Material Generation by Text-to-Image Models , author=. 2025 , eprint=

    2025

  58. [58]

    2024 , eprint=

    Detecting Sexually Explicit Content in the Context of the Child Sexual Abuse Materials (CSAM): End-to-End Classifiers and Region-Based Networks , author=. 2024 , eprint=

    2024

  59. [59]

    Business Intelligence, Computational Mathematics, and Data Analytics: First International Conference, IBCD 2024, Indore, India , series=

    AI and Machine Learning: Revolutionizing the Fight Against Online Child Sexual Abuse Material (CSAM) , author=. Business Intelligence, Computational Mathematics, and Data Analytics: First International Conference, IBCD 2024, Indore, India , series=. 2025 , publisher=

    2024

  60. [60]

    Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems , year=

    Gold Standard or Gold-Plated? Human Practices of Triple Verification in CSAM Takedown , author=. Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems , year=

    2026

  61. [61]

    Signature-Based Attribution of Images Generated by Stable Diffusion , author=

  62. [62]

    2026 , doi=

    Position: Child Safety Necessitates New Approaches to AI Safety , author=. 2026 , doi=

    2026

  63. [63]

    2026 , eprint=

    Evaluation without Generation: Non-Generative Assessment of Harmful Model Specialization with Applications to CSAM , author=. 2026 , eprint=

    2026

  64. [64]

    2025 , doi =

    Lin, Li and Santosh, Santosh and Wu, Mingyang and Wang, Xin and Hu, Shu , booktitle =. 2025 , doi =

    2025

  65. [65]

    2022 , eprint=

    Model Zoos: A Dataset of Diverse Populations of Neural Network Models , author=. 2022 , eprint=

    2022

  66. [66]

    2026 , eprint=

    Weight space Detection of Backdoors in LoRA Adapters , author=. 2026 , eprint=

    2026

  67. [67]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , year =

    Benchmarking Representation Learning for Natural World Image Collections , author =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , year =

  68. [68]

    2011 , number =

    Wah, Catherine and Branson, Steve and Welinder, Peter and Perona, Pietro and Belongie, Serge , title =. 2011 , number =

    2011

  69. [69]

    and Oliva, Aude and Torralba, Antonio , title =

    Xiao, Jianxiong and Hays, James and Ehinger, Krista A. and Oliva, Aude and Torralba, Antonio , title =. 2010 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , year =

    2010

  70. [70]

    arXiv preprint arXiv:2510.13900 , year=

    Narrow finetuning leaves clearly readable traces in activation differences , author=. arXiv preprint arXiv:2510.13900 , year=

    arXiv

  71. [71]

    arXiv preprint arXiv:2510.05092 , year=

    Learning to Interpret Weight Differences in Language Models , author=. arXiv preprint arXiv:2510.05092 , year=

    arXiv

  72. [72]

    arXiv preprint arXiv:2604.16812 , year=

    Introspection Adapters: Training LLMs to Report Their Learned Behaviors , author=. arXiv preprint arXiv:2604.16812 , year=

    Pith/arXiv arXiv

  73. [73]

    2004 Conference on Computer Vision and Pattern Recognition Workshop (CVPRW) , year =

    Fei-Fei, Li and Fergus, Rob and Perona, Pietro , title =. 2004 Conference on Computer Vision and Pattern Recognition Workshop (CVPRW) , year =

    2004

  74. [74]

    2014 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , year =

    Cimpoi, Mircea and Maji, Subhransu and Kokkinos, Iasonas and Mohamed, Sammy and Vedaldi, Andrea , title =. 2014 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , year =

    2014

  75. [75]

    2019 , doi =

    Helber, Patrick and Bischke, Benjamin and Dengel, Andreas and Borth, Damian , journal =. 2019 , doi =

    2019

  76. [76]

    2022 , howpublished =

    Nagadia, Meet , title =. 2022 , howpublished =

    2022

  77. [77]

    Ruiz, Nataniel and Li, Yuanzhen and Jampani, Varun and Pritch, Yael and Rubinstein, Michael and Aberman, Kfir , booktitle =

  78. [78]

    Lyu, Liangwei and Xu, Jiaqi and Ding, Jianwei and Deng, Qiyao , year =. When. 2602.21977 , archivePrefix =

    Pith/arXiv arXiv

  79. [79]

    Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pages =

    Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesis , author =. Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pages =

  80. [80]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages =

    How to Backdoor Diffusion Models? , author =. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages =

Showing first 80 references.