Study finds child-image filtering falls short in T2I safety

A CISPA study presented at the 47th IEEE Symposium on Security and Privacy (S&P 2026) challenges a widely discussed safeguard for text-to-image systems: removing images of children from training datasets. According to Dr. Ana-Maria Cretu, that defense helps, but only in a limited way, and determined users can still work around it.

The paper, “Evaluating Concept Filtering Defenses against Child Sexual Abuse Material Generation by Text-to-Image Models,” examined whether filtering child images from training data can meaningfully reduce a model’s ability to generate images depicting children. The team evaluated more than 20 automated child-detection and removal methods using its own framework.

Those methods detected about 94 percent of images containing children. That sounds strong, but Cretu said it is not enough at internet scale, where training datasets can contain billions of images. The most accurate approaches were also the most computationally expensive.

Recommended reading

Mira Murati’s lab unveils Inkling, a 975B open model

What happened after filtering

The researchers then trained text-to-image models from scratch on both filtered and unfiltered versions of two publicly available image-caption datasets. Rather than testing illegal outputs directly, they used a benign proxy: children wearing glasses.

Filtering did make that concept harder to generate, but only modestly. In the study, it took up to 10 additional queries to get the desired result.

“Filtering makes images that depict children harder to generate, but not hard enough to stop a determined user,” Cretu said.

She added that someone intent on misusing such systems could still succeed with relatively modest additional effort.

Collateral effects on model behavior

The paper also points to side effects. Images containing children often include related concepts such as parents, toys and playgrounds. Removing those images reduces the frequency of all of those concepts in training data as well.

One example came from prompts such as “mother.” Models trained on unfiltered datasets often generated mothers together with babies. In filtered models, the babies were gone, as expected, but the women also appeared noticeably older.

Cretu said developers should evaluate safeguards transparently, test them against realistic adversaries, share safety-testing results, and measure collateral effects. The paper is listed as Ana-Maria Crețu et al, CISPA (2026) with DOI 10.60882/cispa.32771970.v1.