With the rapid growth of generative artificial intelligence, many open-source models are now available for anyone to utilize, generating product renderings in specific artistic styles. However, these models are also exploited by malicious actors to produce illegal content such as hate speech or child sexual abuse material (CSAM). This issue is escalating, with the National Center for Missing and Exploited Children reporting over 1.5 million AI-generated CSAM cases in 2025, a sharp increase from 67,000 in 2024.
Typically, engineers test AI for harmful capabilities by prompting the model and inspecting its outputs, but this method is not applicable for CSAM, as it is illegal to generate such content in the U.S. To address this dilemma and enhance AI safety, a team of MIT scientists collaborated with Thorn researchers to develop a new auditing approach that determines whether a model can produce CSAM without prompting it. This technique examines how the internal workings of a model have been adapted, without generating any output. In tests, the auditing procedure identified model variations that had been specialized to generate CSAM with 100% accuracy. A hosting platform could leverage this technique to flag unsafe models and swiftly remove or prevent them from being uploaded.
"This unlocks a new avenue for platforms that host open-source models and for law enforcement to actually test whether a model is capable of generating CSAM. Before, we had no way of measuring this. It was a huge blind spot that some people were taking advantage of. Now, we can address an AI safety problem that is having severe negative impacts," says Vinith Suriyakumar, an MIT electrical engineering and computer science (EECS) graduate student and lead author of a paper on this technique.
Recent advancements have made it easier for users to specialize a generative AI model through a process known as low-rank adaptation (LoRA), rather than retraining the entire model on a task-specific dataset. This has led to a surge of new generative AI model variants, but it has also enabled malicious actors to create models capable of generating high-quality CSAM and other harmful imagery.
To audit a model, engineers typically prompt it for harmful content and check its outputs, but this manual approach is not scalable. Furthermore, repeatedly generating heinous images can have negative psychological impacts on human evaluators.
The researchers' technique does not focus on outputs but instead targets the modifications a LoRA algorithm makes during fine-tuning. They probe these modifications, called LoRA adaptors, to determine whether a model has been specialized for harmful capabilities without generating an output. By employing a technique called Gaussian probing, the researchers feed the model a set of random data points and analyze how it manipulates those data within its multilayer internal structure. "We never run the model all the way to the end or prompt the model, so we never generate images," Suriyakumar explains. They capture these modifications at multiple time points within the model's inner structure and average them to summarize how the LoRA adaptor changed the model's computation, finding these responses to be strong signals of specialization.
"There is a huge bucket of child safety concerns with AI, and these are real concerns that need to be addressed. A lot of children are being harmed by AI deepfakes. We’ve shown that Gaussian probing can be a very useful tool, and we hope the research community really pours more attention into this problem," Wilson says. Importantly, their technique is scalable and relatively inexpensive to implement. As thousands of model variations are published online every month, scalability is crucial to help auditors remove harmful adaptations before they become widespread.
The researchers aim to evaluate their technique on a larger set of model variations in the future and explore whether Gaussian probing can detect harmful capabilities in base models before they are adapted.
"Now we have a technological approach to partially address this concern. So much effort was poured into this collaboration, which enabled us to tackle a really hard problem that is harming so many children, nationally and around the world. Hopefully, we can have a transformative impact in this area," Ghassemi says. This work was supported in part by the Bridgewater AIA Labs Research Fellowship.
Blogger's Review: This research provides an innovative method for monitoring and preventing harmful AI-generated content, particularly in the realm of child safety. The application of Gaussian probing not only enhances the accuracy of audits but also opens new avenues for future AI safety research. It is hoped that this achievement will garner broader attention and application, aiding in the protection of children from harm in the digital environment.