Toward Evidence-Based Protection Against AI-Generated Non-Consensual Intimate Imagery: Gaps in Foundation Model Safeguards

Image-based sexual abuse (IBSA) covers the non-consensual creation and distribution of intimate images of identifiable people, as well as threats to do so. Its harms, including PTSD and suicidality, are comparable to other forms of sexual violence. Generative AI has added a new route to this abuse: AI-generated non-consensual intimate imagery (AIG-NCII), in which a model produces sexual content depicting a real person who never consented. Because the problem sits at the intersection of fundamental rights to dignity, privacy, autonomy, and free expression, addressing it requires careful attention to both protection and lawful use.

Foundation models are large statistical systems trained on vast text and image data. They generate outputs by predicting visual features that match a prompt, so many plausible images can satisfy the same description. Abuse can occur through hosted chatbots and image generators, through advice or code that points users to 'nudification' services, or through specialized systems built on top of foundation models. Open-weight models are especially concerning because their safeguards can be removed with little cost and without oversight from the original developer. Legitimate uses, such as previewing lingerie or consensual adult content, exist alongside these harms, and unintentional outputs resembling real public figures can also arise from ordinary prompts.

The analysis covers industry practices from January to June 2026 and draws on three sources: public policies and technical documentation from major model developers, eleven confidential interviews with developers and civil society groups, and peer-reviewed and journalistic research. The scope is adult victim-survivors and adult content; child sexual abuse material is excluded because it falls under separate legal and child-protection frameworks. Limitations include unverifiable interview claims, fragmented policy and technical documentation, and a sample drawn entirely from the Global North, which likely underrepresents Global South perspectives.

Companies translate internal decisions into user-facing rules in terms of service and acceptable use policies. The report finds that policies vary widely in how they classify AIG-NCII: as a form of sexual violence, as a category of sexual content, or as unauthorized use of a person's likeness. Many policies conflate AIG-NCII with lawful sexual content, which blurs the line between abuse and legitimate expression and makes enforcement harder to predict and audit.

Technical interventions include input filtering, classifiers that screen prompts and outputs, refusal training, and account-level sanctions that deter repeated abuse. Companies generally describe these as effective, but public evidence of testing against AIG-NCII specifically is limited. Academic work has documented fundamental weaknesses in such safeguards, including ways prompts can be rephrased to evade filters, which raises doubts about how well current measures perform in practice.

Most interventions are applied at the product layer rather than within the foundation model itself. Because classifiers rely on inherently unpredictable AI systems to interpret vague policy language, they can both miss genuine AIG-NCII and wrongly block lawful sexual or artistic content. Products built on a model may also lack protections present in the provider's own app, leaving inconsistent safeguards across the ecosystem.

Open-weight models present the largest protection gap. Developers can modify their internal weights, alter how they respond to prompts, or strip out safety training entirely, often at low cost and without technical expertise. Downstream applications built on these models inherit these weaknesses. Because the original developer has limited visibility or control once a model is released, product-level safeguards alone cannot close this gap.

The central finding is that companies report deploying several interventions but rarely test their efficacy rigorously against AIG-NCII. Civil society reports of rising incidents, together with academic evidence of filter weaknesses, suggest current measures may be insufficient. Over-restrictive classifiers also threaten privacy and free expression, particularly for adults engaging in consensual sexual expression or creators whose work is misclassified. Achieving the right balance requires measurable benchmarks rather than assurances.

The report recommends that multistakeholder groups, including platforms, civil society, survivor advocates, and researchers, define a shared testing standard that measures whether a model or product has meaningfully reduced AIG-NCII and what results count as adequate. Companies should align policy definitions with the specific harm of non-consensual likeness use rather than broad sexual content, publish testing results, and extend safeguards to downstream products. Technical measures should be complemented by work on the financial, social, legal, and educational conditions that drive sexual abuse, since AIG-NCII is a sociotechnical problem and not only a technical one.