The rapid proliferation of open-source generative AI models has created a significant blind spot for safety auditors: there is currently no legal way to test whether a model has been fine-tuned to produce child sexual abuse material (CSAM). Generating such content, even for evaluation purposes, is illegal in the United States and many other jurisdictions. Researchers at MIT, in collaboration with the child safety nonprofit Thorn, have now developed an auditing technique that sidesteps this legal barrier entirely. By analyzing the internal modifications of a model—without ever running it to completion—the method can identify with 100 percent accuracy whether a model has been specialized to generate CSAM.

The work addresses a crisis that has escalated dramatically in recent years. The National Center for Missing and Exploited Children received more than 1.5 million reports of AI-generated CSAM in 2025 alone, up from 67,000 in 2024. As open-source models become easier to adapt using techniques like low-rank adaptation (LoRA), malicious actors have gained the ability to produce high-quality illegal imagery without needing deep technical expertise.

The MIT team, led by EECS graduate student Vinith Suriyakumar and associate professors Ashia Wilson and Marzyeh Ghassemi, partnered with Thorn to design a solution that works entirely in the non-generative domain. The research was presented as a spotlight paper at the “Trustworthy AI for Good” workshop at the International Conference on Machine Learning.

How Gaussian probing works without generating outputs

Traditional model auditing relies on prompting a model and inspecting its outputs. That approach is impossible for CSAM detection because generating the content in question is a criminal offense. “We are in this very difficult situation where, based on the law itself, we cannot use the de facto means of evaluation,” Suriyakumar explained.

The researchers targeted the structural changes made by LoRA adaptors during fine-tuning. LoRA is widely used to specialize generative models efficiently by applying low-rank updates to the model’s weight matrices, rather than retraining the entire network. Instead of prompting the model to see what it produces, the MIT and Thorn team developed a technique called Gaussian probing.

Gaussian probing works by feeding the model a set of random data points and analyzing how it processes those data within its internal hidden layers. Crucially, the model is never run to completion, and no output image is ever generated. “We never run the model all the way to the end or prompt the model, so we never generate images,” Suriyakumar said. The researchers capture these internal representations at multiple points in the model’s architecture, then average them to create a signature of how the LoRA adaptor altered the model’s behavior.

Perfect detection accuracy in controlled tests

The team tested the method on variations of three model types, comparing the results against a ground-truth dataset of LoRA adaptors known to generate CSAM, other harmful content, and safe imagery. The Gaussian probing technique identified every model that had been adapted to produce CSAM—achieving 100 percent detection accuracy.

“There is a huge bucket of child safety concerns with AI, and these are real concerns that need to be addressed,” Wilson said. “A lot of children are being harmed by AI deepfakes. We’ve shown that Gaussian probing can be a very useful tool.”

Because the technique does not require generating harmful outputs, it also eliminates the psychological toll on human evaluators who would otherwise be exposed to traumatic imagery during manual auditing. The approach is designed to be scalable, which is critical given that thousands of model variations are uploaded to hosting platforms each month.

Scalability and robustness against tampering

One of the key advantages of Gaussian probing is its practicality for real-world deployment. A hosting platform could integrate the audit into its upload pipeline to flag harmful models before they are distributed or remove them after the fact. The method is also relatively inexpensive to implement compared to manual evaluation or full retraining-based detection.

Additionally, the technique is more robust than some existing auditing methods. Because it analyzes the inner workings of the model itself, a malicious actor would need to carefully alter the base model’s internal structure to evade detection—a far more difficult task than simply cleaning up outputs.

The researchers plan to evaluate the method on a larger and more diverse set of model variations. They also aim to explore whether Gaussian probing can detect harmful capabilities embedded in base models before they are even adapted via LoRA.

What this means for AI safety and hosting platforms

The immediate implication is that hosting platforms for open-source models now have a legally viable and technically sound mechanism to screen for CSAM capabilities. Before this work, these platforms operated with a significant blind spot, unable to verify whether the models they hosted could produce illegal content. “This unlocks a new avenue for platforms that host open-source models and for law enforcement to actually test whether a model is capable of generating CSAM,” Suriyakumar said.

For developers and organizations that rely on open-source generative models, this technique provides a layer of assurance that the models they download and adapt have not been silently poisoned with harmful capabilities. While the method does not address all forms of AI-generated harm—such as hate speech or non-consensual deepfakes—it establishes a precedent for non-generative auditing that could be extended to other dangerous categories.

The collaboration between MIT and Thorn also underscores the critical role that domain-specific nonprofits play in bridging research and enforcement. Ghassemi highlighted the urgency: “Now we have a technological approach to partially address this concern. So much effort was poured into this collaboration, which enabled us to tackle a really hard problem that is harming so many children, nationally and around the world.”

Who should pay attention to this development

AI safety teams at model hosting platforms should evaluate Gaussian probing as a potential addition to their content moderation pipelines. Law enforcement agencies investigating CSAM distribution can now consider technical audits that do not require generating illegal evidence. For the broader AI research community, this work opens a new line of non-generative safety auditing that could be applied to other harmful model capabilities where output-based evaluation is impractical or unethical.

The work was supported in part by the Bridgewater AIA Labs Research Fellowship.