Researchers at MIT, Boston University and the child-safety nonprofit Thorn have developed a way to flag certain AI model adaptations associated with child sexual abuse material without generating or viewing illegal content. The early results are promising, but the method is not yet a complete or widely deployed solution.
Open-source AI image generators can be customized through small downloadable files. Most are created for harmless purposes, such as producing a particular artistic style. Others can be adapted to generate child sexual abuse material, commonly known as CSAM.
That creates a difficult problem for platforms hosting AI models. The usual way to determine what a model can do is to give it instructions and inspect the results. But deliberately attempting to generate CSAM is legally and ethically prohibited in the United States and several other jurisdictions.
Researchers from MIT, Boston University and Thorn say they may have found another way: examining what happens inside an AI model without allowing it to complete an image.
Looking inside the model
The research focuses on downloadable adaptations called LoRAs, short for low-rank adaptations.
A LoRA works like a small plug-in that teaches an existing AI image generator a new style, subject or capability without requiring someone to retrain the entire system. Because these files are relatively small and easy to share, they have become common on public AI model-hosting platforms.
The researchers developed a method called Gaussian probing. Instead of giving the model a text prompt, the system feeds it random numerical noise and examines how its internal layers respond.
Those responses are turned into a numerical signature that can help determine whether a model was directly adapted for a harmful purpose. The model is never allowed to finish generating an image.
“We never run the model all the way to the end or prompt the model, so we never generate images,” lead researcher Vinith Suriyakumar told MIT News.
Promising results, but not perfect accuracy
The researchers tested the method on adaptations of three widely used image-generation systems: Stable Diffusion 1.5, Stable Diffusion XL and FLUX.1-dev.
The test included 18 known CSAM-specialized adaptations for Stable Diffusion 1.5, 34 for Stable Diffusion XL and 74 for FLUX.1-dev. Researchers also used approximately 1,000 safe and adult-content LoRAs as comparison models.
The harmful adaptations remained with authorized organizations. The researchers said they did not possess, access or generate CSAM during the study.
Gaussian probing identified every known CSAM-specialized model in the test sample. However, that does not mean the system achieved perfect accuracy.
The more precise result was 100 percent recall, meaning it did not miss any of the known harmful models it was tested against. It also produced false positives.
For FLUX.1-dev, which had the highest error rate, the system incorrectly flagged 4.21 percent of safe models and 1.90 percent of adult-content models. The researchers cautioned that their results demonstrate separation under the study’s current conditions, not near-perfect performance in real-world use.
Why the research matters
Most online child-safety systems respond after an abusive image has already been created or shared. Gaussian probing could move part of that work earlier in the process.
A model-hosting platform could potentially scan an uploaded LoRA before making it publicly available. Suspicious files could then be blocked or referred for specialized human review.
That would not eliminate AI-generated abuse. It could, however, make it more difficult to openly distribute models designed specifically to produce harmful material.
The research was posted as an arXiv preprint in April 2026 and presented as a spotlight at the Trustworthy AI for Good workshop at the International Conference on Machine Learning. The paper says some organizations may begin using the method in partnership with Thorn, but it does not identify a major platform currently using it in production.
Important limitations remain
The system currently detects only a narrow form of harmful specialization: LoRAs directly trained on material from a prohibited category.
It may not detect risks created by combining several adaptations, merging complete models, building more complicated AI systems or training a model through a different method. It was also tested on only three model architectures and a relatively small number of known harmful adaptations.
Future attackers could also attempt to modify their models to avoid detection. The researchers tested one simple manipulation involving changes to model weights, but they acknowledge that much more adversarial testing is required.
False positives create another concern. A model being flagged should not be treated as proof that its creator committed a crime. Any real deployment would require human oversight, clear platform rules, legal safeguards and a process for reviewing mistakes.
A rapidly growing challenge
The National Center for Missing and Exploited Children recorded about 1.5 million CyberTipline reports with a generative-AI connection in 2025, compared with 67,000 in 2024.
That number requires context. More than 1.1 million reports came from Amazon AI Services and lacked actionable information about an offender or victim. Excluding those submissions, NCMEC said more than 182,000 reports involved people possessing, generating or attempting to generate AI-related CSAM.
Since 2023, NCMEC has categorized more than 158,000 reported images and videos as AI-generated CSAM and identified more than 275 direct victims.
Gaussian probing will not solve that crisis by itself. It remains early-stage research, and independent testing will be needed to determine whether it can operate reliably at the scale of major platforms.
Still, the idea represents an important shift. Instead of waiting for abusive images to appear and then trying to remove them, platforms may eventually be able to identify some dangerous AI tools before the first image is made.
What parents should know
This is not a product for families. Gaussian probing is intended for AI platforms, safety organizations and qualified investigators. It does not change the safety settings available on household devices today.
Ordinary photographs can be misused. NCMEC warns that classmates and offenders are using deepfake and “nudify” tools to manipulate everyday images of children. Parents should talk with children about photo sharing and make clear that they will not be blamed if a manipulated image appears.
Help is available. Suspected online child sexual exploitation can be reported to NCMEC’s CyberTipline. For nude or sexually explicit images or videos taken before a person turned 18, NCMEC’s free Take It Down service may help participating platforms detect and remove copies.
Key takeaways
- Researchers found a way to screen certain AI model adaptations for harmful specialization without generating illegal images.
- The method detected all known harmful models in the study, but it also produced false positives and remains experimental.
- Its greatest potential is prevention: identifying dangerous AI tools before they are publicly distributed.
