Peer-To-Peer Harms: Why Keywords Alone Fail in Self-Generated CSAM Detection

Alice’s intelligence teams have spent years mapping the linguistic, behavioral, and evasion structures of online harm across languages, platforms, and abuse types — and increasingly, across AI systems. That same methodology now applies to foundation model and product teams navigating youth safety in generative AI: how minors communicate with and around AI products, how risks like sexualization and CSAM manifest, and how to build evaluation frameworks robust enough to catch what static guardrails miss.

Child sexual abuse material does not advertise itself plainly. And when minors produce and trade it themselves — a category known as self-generated CSAM — the signals are even harder to catch. The content often doesn’t exist at all in a profile. The intent is buried in a username. The age is encoded in slang that only makes sense to people already inside the community.

This is the environment that moderation systems have to operate in. And if you are building detection for this abuse type — whether you are a platform, an AI developer, a safety vendor, or a trust and safety practitioner — this post is about a mistake that is easy to make: assuming that the problem is fundamentally about finding the right words. It isn’t. It’s about understanding where signals live, how they combine, and how threat actors hide them. And when those three things are misunderstood, even well-intentioned detection logic will fail.

The Problem with Keyword-Based Detection

The intuitive approach to detecting SG-CSAM, or almost any language-based online harm, is to build a list of specific related queries and flag accounts that contain them.

The problem is not that this approach is wrong in spirit. The problem is that it is structurally incomplete in ways that matter enormously at scale.

Consider the English-language SG-CSAM ecosystem. In a sample of over 1,000 accounts analyzed by Alice, the terms “dm” and “horny” appeared in almost 70%% of confirmed violative accounts. If either of those were treated as standalone signals, the false positive rate would be enormous — both are common across millions of completely benign accounts. Neither means anything without context.

This is not an edge case. It is the norm across every language and market Alice has studied. High-frequency terms are generic. Low-frequency terms are evasive. The useful signal is almost never a single keyword — it is a combination, a location, and a structure.

The same challenge is now arriving inside AI systems.

As generative AI becomes embedded in the daily lives of minors — through chatbots, character-based applications, and AI-assisted search — the behavioral signals that matter for youth safety are migrating into a new environment.

A minor interacting with an AI product uses the same slang, the same age-encoding conventions, and the same evasion patterns documented across social platforms. The model, unless specifically built to recognize them, will not. And the harm vectors are not identical: AI grooming, where a conversational model becomes a vector for manipulation or escalation, and reality blurring, where a minor cannot reliably distinguish AI from human interaction, introduce risks with no direct equivalent in traditional content moderation.

Addressing them requires the same structural work: understanding how youth communicate in practice, where age signals appear, and how evasion operates — applied now to model behavior and product design.

Three Things Keyword Detection Misses

1. Signal Location

Signal location is language-specific and surface-specific. Scanning only one field misses the others entirely.

Where a signal appears matters as much as what the signal is.

In English-language SG-CSAM activity, minor indicators appear almost exclusively in usernames. In some demographics, the picture is inverted: usernames play a marginal role.

The contrast extends further when you move from social profiles to feed-based platforms. On feed-based platforms, where the product unit is a post rather than a static profile, signals shift entirely into post text and reply chains. Minor indicators appear in post text in over 90% of cases.

This is not a subtle variation. It means that detection coverage built for one surface type is, by design, blind to others.

2. Signal Combination

No single keyword is sufficient. Effective detection requires identifying specific signal category combinations, not individual terms.

The minimum viable detection structure, confirmed consistently across every language Alice has studied, is a minor indicator paired with at least one behavioral signal.

Either element alone is insufficient:

• A minor indicator without behavioral context could describe anyone.
• A behavioral signal without a minor indicator describes adult content, not CSAM.

What matters is the combination — and the combination types vary significantly by language and behavioral model. What reads as a single keyword in one language encodes an entire behavioral profile in another.

3. Obfuscation and Evolution

Obfuscation is systematic, not incidental. Detection logic must be built around keyword types and evasion patterns, not exact terms, or it will be outpaced continuously.

Threat actors know that moderation systems exist. They adapt to them.

Across the communities Alice has studied, obfuscation takes several consistent forms — and knowing them is essential to building detection logic that doesn’t break within weeks of deployment.

• Morphological variants: A sexualization term does not stay in its original form. Root terms mutate — through diminutives, suffixes, and punctuation inserted mid-word specifically to defeat exact-match detection. A classifier built on root forms alone will miss a significant portion of the ecosystem.
• Concatenation: Signals that would be ambiguous alone are fused into single tokens that function simultaneously as discoverability mechanisms and evasion techniques.
• Numeric and age encoding: Age — the single most critical signal — is encoded across at least a dozen formats, from plain numerics to birth-year shorthand, school grade references, cultural slang, and numeric reversals. A detector that only recognizes explicit age statements will be blind to the majority of minor indicators in non-English markets.
• Emoji substitution: Sexualization signals are routinely replaced with emojis — 😈, 🔞 — either alone or paired with text

Designing LLM-Based Detection That Actually Works

Given these three failure modes, what does effective detection look like?

1. Build Around Structure, Not Terms

Detection prompts should define the type of signal being sought, not the specific keyword.

2. Make Location Part of the Logic

Each language has a primary signal surface. On post-based platforms, it is post text — and in some communities, reply activity is the only surface where age can be confirmed. Effective prompts specify where to look, not just what to look for.

3. Encode Evasion Patterns Explicitly

Prompts should include representative examples of obfuscation patterns — concatenated tokens, morphological variants, dot-insertion — as anchors for pattern-recognition. This is different from building a list of known obfuscated terms; it is teaching the model the structure of evasion, so it can recognize novel variants it has not seen before.

4. Account for the AI Surface Specifically

When the surface is a conversational AI rather than a social profile, signal location shifts again: age and behavioral cues appear in prompt phrasing and iterative escalation sequences rather than usernames or post text.

Youth-specific slang, which evolves faster than most training datasets are updated, functions as both identity expression and inadvertent guardrail bypass.

Effective detection here requires continuous monitoring of how minors actually communicate with AI systems, including the informal, language-specific shorthand that never appears in model documentation.

This Is Not Just a CSAM Problem

The detection principles described here are not specific to SG-CSAM. They apply, with appropriate adaptation, across the full spectrum of language-based abuse that trust and safety teams deal with.

• Grooming detection faces the same challenge: no single message is a grooming message, but the pattern of escalation, secrecy-building, and platform redirection across a conversation is. Effective LLM-based grooming detection requires understanding signal combination and sequence, not keyword presence.
• NCII detection faces the same obfuscation dynamics: solicitation signals for non-consensual intimate imagery are heavily evasion-coded, regionally specific, and rely on the same concatenation and morphological variant patterns described above.
• Extremist recruitment operates on the same coded-language model: community-specific shorthand that is opaque to outsiders, distributed across specific platform surfaces, and constantly evolving to stay ahead of keyword lists.

In each case, the lesson is the same. The signal is not in the word. It is in the structure — the combination of signals, their location on the platform surface, and the evasion logic wrapping them. Detection that misses this will always be one step behind.

What This Means for Platforms and Practitioners

The scale of the SG-CSAM problem is significant. NCMEC’s 2023 CyberTipline report received over 36 million reports — a number that reflects the industrialization of this abuse type, not just isolated incidents. The Internet Watch Foundation has documented the growing share of self-generated content in the overall CSAM landscape, with much of it originating from minors who are groomed or coerced into producing it.

Against that backdrop, detection approaches that rely on single-keyword flagging are not just technically inadequate — they create false confidence. A system showing high detection rates on plain-language English content may have near-zero coverage of the Korean, Indonesian, or Filipino ecosystems operating on the same platform, using entirely different signal structures on entirely different profile surfaces.

Building detection that works across languages, platforms, and evolving evasion requires more than better keywords. It requires intelligence — structured, validated, and continuously updated — about how these behaviors are actually expressed in practice.

Working With Alice

If your platform or AI product is dealing with self-generated CSAM, grooming, NCII, or any other language-based abuse at scale, we can help you move from reactive keyword matching to structured, LLM-based detection that keeps pace with how these ecosystems actually operate.

Learn more about our Intelligence offering or speak with an expert.