Evaluation without Generation: Non-Generative Assessment of Harmful Model Specialization with Applications to CSAM

1. Problem Definition

The paper addresses a critical governance challenge in open-weight generative AI ecosystems (e.g., CivitAI, Hugging Face): how to audit user-uploaded model adaptors (specifically LoRAs) for harmful specialization without generating outputs.

• The Constraint: Traditional safety auditing relies on "generative evaluation" (prompting the model and inspecting outputs). This approach fails for two reasons:
  1. Scalability: It cannot handle the volume of uploads (hundreds of thousands of LoRAs/month).
  2. Legality: For specific high-risk domains like Child Sexual Abuse Material (CSAM), generating such content—even for testing purposes—is illegal in many jurisdictions (including the US).
• The Goal: The authors define the "Evaluation without Generation" problem: determining if a model has been specialized for harmful content (NSFW or CSAM) solely by analyzing its weights or internal representations, without ever producing an image.
• Desiderata: A solution must be:
  • Non-generative: No output decoding or image rendering.
  • Scalable: Low storage/compute cost compared to full parameter inspection.
  • Robust: Must detect content specialization rather than incidental training artifacts (e.g., learning rate, rank, or dataset-specific quirks) that adversaries could easily mimic.

2. Methodology: Gaussian Probing

The authors propose Gaussian Probing, a functional representation method that characterizes how a LoRA adaptor perturbs a base diffusion model.

Core Mechanism

Instead of analyzing raw weights or generating images, the method probes the model's internal state using random noise:

1. Reference Ensemble: Sample $m$ independent Gaussian noise vectors ($\nu \sim \mathcal{N}(0, I)$). These serve as a "prompt-free" reference state native to the diffusion process.
2. Forward Pass: Propagate these noise vectors through the adapted model ($f_{\theta_{base} + \Delta}$) for $T$ denoising steps.
3. Activation Extraction: Extract intermediate hidden representations ($H^{(t)}$) from specific layers (e.g., mid-block of U-Net) at each timestep.
4. Aggregation: Pool these activations across timesteps and layers to create a fixed-dimensional feature vector $\Phi(\Delta)$.
   • Mathematically, this estimates the expected pushforward of the LoRA perturbation through the model's denoising dynamics: $\Psi(\Delta) = \mathbb{E}_{\nu}[\bar{H}(\Delta; \nu)]$.
5. Classification: A simple classifier (e.g., logistic regression) is trained on these feature vectors to distinguish between benign (SFW) and harmful (NSFW/CSAM) specializations.

Why Gaussian Probing?

• Functional Signal: It measures how the LoRA changes the model's computation on its native latent space, rather than static weight values.
• Robustness: Because the probes are random and independent of the training data, the resulting signal reflects the functional impact of the specialization (the content) rather than superficial training artifacts (e.g., specific hyperparameters or dataset biases).

3. Key Contributions

1. Formalization of "Evaluation without Generation": The paper formally defines the problem of auditing model capabilities via weight-state inference, specifically targeting the legal and ethical constraints of CSAM detection.
2. Gaussian Probing Algorithm: A novel, scalable method to extract a "functional signature" of a LoRA without generating images.
3. Empirical Validation: Comprehensive experiments demonstrating that Gaussian probing outperforms raw-weight baselines in distinguishing harmful from benign models, particularly in robustness against adversarial weight manipulation.
4. Real-World CSAM Detection: The first scalable, non-generative method to detect CSAM-specialized LoRAs in the wild, validated using authorized access to CSAM data (without generating or handling the actual illicit images).

4. Experimental Results

Controlled Study (SFW vs. NSFW)

• Setup: Trained 1,000 LoRAs per class (SFW/NSFW) across Stable Diffusion 1.5, SDXL, and FLUX.1-dev using diverse datasets and hyperparameters.
• Findings:
  • Separability: Gaussian probing achieved high AUROC (e.g., 0.998 for SD 1.5) in distinguishing SFW from NSFW.
  • Signal Source: In "Leave-Dataset-Out" (LDO) tests, raw weight classifiers performed well but relied on dataset identity (specific training artifacts). Gaussian probing relied on content signal, maintaining robustness when dataset-specific artifacts were removed.
  • Adversarial Robustness: When LoRA weights were rescaled to unit Frobenius norm (removing magnitude information), raw-weight classifiers degraded significantly (AUROC dropped from 0.92 to 0.83). Gaussian probing remained robust (AUROC increased slightly to 0.94), proving it detects functional behavior, not weight magnitude.

Wild Study (CSAM Detection)

• Setup: Evaluated on real-world LoRAs from CivitAI (SFW/NSFW) and authorized CSAM-specialized LoRAs (SD 1.5, SDXL, FLUX.1-dev).
• Performance:
  • CSAM Detection: Gaussian probing achieved 100% recall on CSAM LoRAs across all architectures.
  • False Positives: Very low false positive rates for SFW (<1% for SD 1.5/SDXL) and NSFW (<4% for FLUX.1-dev).
  • Comparison: Raw weight baselines struggled with the small sample size of CSAM data (AUROC ~0.68–0.87) and showed high variance, whereas Gaussian probing provided stable, high-performance detection.

5. Significance and Impact

• Legal Compliance: Provides a legally viable pathway for platforms to screen for CSAM without violating laws against generating such content.
• Scalability: Offers a computationally efficient alternative to red-teaming, enabling pre-distribution screening of hundreds of thousands of uploads.
• Safety Paradigm Shift: Moves AI safety from "output-based" (reactive) to "state-based" (proactive) auditing.
• Broader Applicability: While focused on CSAM, the method is applicable to other restricted domains (e.g., bioweapons, cyberattacks) where output generation is dangerous or unethical.
• Future Research: Establishes a foundation for "weight-space learning" and functional auditing, encouraging further research into robust, non-generative safety mechanisms.

Conclusion

The paper successfully demonstrates that harmful model specialization can be detected from weights alone. By shifting the evaluation from the output space to the model's internal state via Gaussian probing, the authors provide a scalable, robust, and legally compliant solution to the critical problem of screening open-weight generative models for CSAM and other high-risk specializations.