Researchers Confront AI's CSAM Problem With a Position Paper and a No-Image Audit Method

A position paper accepted as a spotlight presentation at ICML 2026 lays out an uncomfortable reality for the AI safety field: the standard toolkit for auditing and red-teaming models breaks down when the harm being tested for is child sexual abuse material. The paper, posted to arXiv, catalogs 15 open problems spanning the entire AI development lifecycle, from training data curation to deployment monitoring, where the machinery built to catch other forms of misuse simply cannot be applied to CSAM without crossing legal and ethical lines.

The core tension is straightforward to state and hard to solve. Techniques like dataset auditing, red teaming, and fine-tuning detection all typically rely on inspecting or generating the harmful content itself to confirm a model is vulnerable or has been compromised. Producing CSAM to test a system, even in a controlled research setting, is illegal in the United States and most other jurisdictions. That legal reality has left AI developers with limited means to verify whether their models have been quietly fine-tuned by bad actors to output this material, or whether training data has been contaminated with it in the first place.

The scale of the problem underscores why the paper's authors are pushing this onto the research community's agenda now. The National Center for Missing and Exploited Children logged more than 1.5 million reports of AI-generated CSAM in 2025, a jump from roughly 67,000 the year before, a more than twentyfold increase in a single year. Generative tools have made it trivial for perpetrators to produce synthetic abuse imagery at a volume that traditional detection and reporting pipelines were never designed to absorb.

A Detection Method That Doesn't Require the Evidence

One concrete response to this bind came out of MIT in July 2026. Researchers there built an auditing technique that can determine whether a model has been fine-tuned to generate CSAM without ever having it produce an actual image. In testing, the method identified specialized, compromised models with 100% accuracy, offering a way to flag dangerous fine-tunes without the auditor having to create or handle illegal content themselves.

The MIT team worked with Thorn, the child safety nonprofit whose research is cited throughout the ICML position paper, linking the technical fix directly to the broader problem the paper describes. It's a narrow but meaningful proof of concept: safety auditing can be redesigned around the constraint rather than pretending the constraint doesn't exist.

The position paper's broader argument is that this kind of workaround needs to become the norm rather than the exception. Model developers, platform operators, and researchers have largely inherited safety practices built for other categories of harm, ones where you can look at the offending output and label it. CSAM doesn't allow that. The paper frames its 15 open problems as an agenda for the field: rethinking data auditing, evaluation, and red-teaming from the ground up so that verifying a model is safe doesn't require generating proof that it isn't.