Insider Brief
- MIT researchers developed a nongenerative auditing method that can identify whether an AI model has been adapted to generate child sexual abuse material without making the model produce illegal images.
- The work, supported in part by the Bridgewater AIA Labs Research Fellowship, was led by MIT researchers Vinith Suriyakumar, Ashia Wilson and Marzyeh Ghassemi with collaborators from Thorn and Boston University.
- MIT said the method identified model variants specialized to generate child sexual abuse material with 100% accuracy in testing and could help platforms flag or remove unsafe open-source model adaptations.
Massachusetts Institute of Technology researchers, in work supported in part by the Bridgewater AIA Labs Research Fellowship, say they’ve developed a way to audit whether an AI model has been adapted to generate child sexual abuse material without making the model produce illegal images.
According to MIT, the work addresses a growing safety problem in open-source generative AI. Many models are available online for users to adapt to specific tasks, such as generating images in a certain style. But the same tools can be modified by malicious actors to produce illegal or harmful content.
MIT pointed out the National Center for Missing and Exploited Children received more than 1.5 million reports of AI-generated child sexual abuse material in 2025, up from 67,000 in 2024.
The study was led by MIT graduate student Vinith Suriyakumar and associate professors Ashia Wilson and Marzyeh Ghassemi, working with researchers from Thorn, a child-safety nonprofit focused on protecting children from sexual abuse and exploitation online. Researchers from Boston University also contributed.
The Challenge: Studying Child Sex Abuse Material Without Creating It
The main finding is that the researchers’ auditing method could identify AI model variants specialized to generate child sexual abuse material with 100% accuracy in testing, according to MIT.
That matters because the usual way of testing AI systems is not available in this case. Engineers often audit a model by prompting it and examining the output, but generating child sexual abuse material is illegal in the U.S. regardless of intent, making that approach unusable for this category of AI safety testing.
MIT said the process does not run the model to completion and does not prompt it to generate images. That means the audit can evaluate whether a model has been adapted for a harmful capability without producing illegal material.
Instead of generating images, the MIT-led team examined changes inside the model. The method looks at whether a model has been adapted for a harmful capability by analyzing hidden representations in the model’s internal structure.
The Method
The work focuses on models adapted through low-rank adaptation, or LoRA, a technique that lets users fine-tune a model without retraining the entire system. LoRA has made it easier to create specialized generative AI models for legitimate uses, but it also has enabled the creation of models adapted for harmful image generation. The researchers targeted the LoRA adaptors themselves using a technique called Gaussian probing, which feeds random data points into the model and studies how the model manipulates those points internally.
The researchers captured those internal responses at multiple points in the model and averaged them to summarize how the LoRA adaptor changed the model’s computation. Those internal patterns served as a signal for how the model had been specialized.
The team tested the method on variations of three types of models. The researchers compared the results with ground-truth data from LoRA adaptors known to generate child sexual abuse material, other harmful images and safe content.
The method correctly identified the models adapted to generate child sexual abuse material in the test set, according to MIT.
The implications are practical for platforms that host open-source AI models. MIT said a hosting platform could use the technique to flag unsafe models and remove them quickly, or prevent them from being uploaded in the first place.
The approach also could reduce the burden on human evaluators. Manual auditing can be difficult to scale, and repeatedly reviewing harmful material can have psychological effects on reviewers. A nongenerative method offers a way to screen models without requiring evaluators to view illegal or traumatic outputs.
MIT said the method is designed to be scalable and relatively inexpensive to implement, an important factor because thousands of model variants are published online each month.
“This unlocks a new avenue for platforms that host open-source models and for law enforcement to actually test whether a model is capable of generating CSAM,” noted Suriyakumar. “Before, we had no way of measuring this. It was a huge blind spot that some people were taking advantage of. Now, we can address an AI safety problem that is having severe negative impacts.”
The researchers also said Gaussian probing could be harder to evade than some other auditing methods. To avoid detection, a malicious actor would have to alter the inner workings of the base model carefully, rather than simply changing prompts or outputs.
What’s Next?
The method was tested on a set of model variations, and the researchers indicated they plan to evaluate it on a larger group of models. They also want to study whether Gaussian probing can detect harmful capabilities in base models before those models are adapted.
“There is a huge bucket of child safety concerns with AI, and these are real concerns that need to be addressed,” added Wilson. “A lot of children are being harmed by AI deepfakes. We’ve shown that Gaussian probing can be a very useful tool, and we hope the research community really pours more attention into this problem.”
