Every time child sexual abuse material (CSAM) is shared again, the harm to the child depicted continues. For any online service that lets people upload, store or send images and video, stopping that recirculation is a core part of child safety and the wider fight against child exploitation.
The challenge is scale. A single service can receive millions of files a day across many formats and accounts. Moderators can't review everything, and they shouldn't have to view the same known material again and again. Hash matching addresses both problems: it recognizes material that has already been confirmed, automatically, before anyone has to look at it.
This article explains how CSAM scanning works, why some hashes hold up better than others, what to do when a match appears, and how hash matching fits with other content moderation tools.
Who needs CSAM detection
Any service that hosts or transmits user images or video carries some risk. That includes:
- Social networks and online communities
- Cloud storage and file-sharing services
- Messaging and communication apps
- Hosting providers and content delivery networks
- Gaming platforms and community apps
- Online marketplaces and classifieds
The right setup differs by service. A cloud storage provider may scan files at upload, before they can be shared. A social network may scan profile photos and posts before they go live. A messaging service has to design scanning around its architecture, its encryption model and its legal obligations.
Size is not an exemption. Smaller and newer platforms face the same risks as large ones and, in many countries, the same legal duties.
How CSAM scanning works
A hash is a compact value computed from a file. It works like a fingerprint: copies of the same image produce the same hash, so a system can recognize a file without anyone viewing it.
Don't miss our insights
Subscribe to our newsletter for monthly updates on visual identification technology and industry developments.
By subscribing, you agree to receive our monthly newsletter. You can unsubscribe at any time. See our Privacy Policy for details on how we handle your data.
Child protection organizations such as the National Center for Missing & Exploited Children (NCMEC), the Internet Watch Foundation (IWF) and the Canadian Centre for Child Protection (C3P) maintain hash lists of material their analysts have confirmed as CSAM. With approved access, a platform can compare the hashes of incoming files against those lists.
A typical CSAM scanning workflow has six steps:
Intake. A file enters the workflow, for example when a user uploads it.
Hashing. The system computes one or more hashes for the file.
Matching. The hashes are compared against one or more hash lists.
Triage. Each match is handled according to the platform's policy. Strong matches can be blocked automatically. Uncertain matches go to a trained reviewer.
Response. The platform takes action, preserves evidence and meets its reporting obligations.
Feedback. Newly confirmed material is hashed and added to a hash list, so the next copy is caught automatically.
The result is that moderators never start from zero. The system catches known material, and human attention goes to the cases that need judgment.
Why hash list coverage matters
Hash matching only finds what is on the list. Each organization's hash list reflects the reports and cases it has processed, and no single list covers everything. A platform that matches against one list will miss material documented only on another.
Matching against several trusted hash lists gives broader coverage. Access to each list usually requires an agreement with the organization that maintains it, which is one reason many platforms work with a detection provider that already holds those agreements. Platforms can also keep their own lists of material they have confirmed.
Not all hashes survive edits
Files often change before they are shared again. Sometimes the change is deliberate, to evade detection. Often it is a side effect of how services compress and resize uploads. Each change can break a match, depending on the type of hash.
There are three broad approaches:
- Cryptographic hashes such as MD5 change completely if a single pixel changes. They only find exact copies.
- Perceptual hashes such as Microsoft's PhotoDNA and Meta's PDQ summarize how an image looks as a whole. They survive resizing, recompression and minor edits.
- Videntifier's local descriptor matching extracts many small visual features from distinctive points in an image and matches them individually. Because it doesn't depend on the whole image, it can find a match when only part of the original is visible.
Here is how each approach typically behaves when a known image is edited.
Stronger matching has to be tuned carefully to keep false positives low. Whatever the method, a match should be handled under the platform's documented review policy.
Video needs its own approach
Video multiplies the problem. One file can contain thousands of frames, and known material may appear in only a short segment.
Consider a known 90-second clip that is re-encoded and inserted into a 40-minute compilation. Many hash lists hold only an MD5 for each video, which stops matching after a single re-encode. Whole-video perceptual hashes such as Meta's TMK+PDQF produce one value for the entire file, so a short clip inside a long file looks like a different video. Per-frame perceptual hashes such as Meta's vPDQ, which hashes sampled frames individually, can find a clip inside a longer file. But they compare whole frames, so they can still miss the clip when it is cropped, mirrored, reposted in vertical format with blurred bars, or overlaid with captions, stickers or buttons.
Videntifier finds a short known clip inside a much longer video, and it still finds it after severe editing: re-encoding, resizing, cropping, mirroring, reposting in vertical format with blurred bars, and added captions, stickers or borders. It also reports where the clip starts and ends, so reviewers can go straight to the relevant segment instead of watching the whole file.
What to do when a match appears
Detection starts the process; it doesn't end it. The right response depends on where the material was found, how strong the match is, the platform's policies and the law that applies.
A sound response workflow typically covers:
- Blocking the upload or restricting access to the material
- Preventing re-uploads of the same or matching material
- Preserving the content and related account data as the law requires
- Escalating uncertain matches to trained staff
- Reporting to the appropriate authority
- Taking action on the account when the findings and policy support it
Blocking an upload doesn't by itself end a platform's obligations. A technical match is also not a legal finding, so platforms need a documented process for confirming, recording and reporting what they find.
Reporting obligations in the United States
In the U.S., electronic service providers that become aware of apparent CSAM on their services must report it to NCMEC's CyberTipline under 18 U.S.C. § 2258A. The REPORT Act of 2024 expanded the child exploitation offenses providers must report and extended the period they must preserve reported content from 90 days to one year.
NCMEC is not a law enforcement agency. It is a nonprofit clearinghouse that reviews reports and makes them available to the appropriate law enforcement agencies in the U.S. and abroad.
Anyone can report suspected CSAM to the CyberTipline at report.cybertip.org, whether or not they have a legal duty to. Outside the U.S., national hotlines such as the IWF in the UK play a similar role. Requirements vary by country, so platforms operating internationally should build their reporting procedures with legal counsel.
Hash matching and classifiers work together
Hash matching finds known material. It can't find material that has never been identified and hashed. Classifiers, machine learning models trained to recognize likely CSAM, address that gap by flagging new content for human review.
The two methods complement each other. Hash matching delivers high-confidence results on known material at scale. Classifiers surface potential new material for reviewers to assess. Once confirmed, that material is hashed and added to a hash list, so every future copy is caught by hash matching. A complete content moderation strategy uses both.
Beyond CSAM
CSAM is not the only illegal content that recirculates. Terrorist and violent extremist content (TVEC) and non-consensual intimate imagery (NCII) raise the same problem, and the same matching techniques apply. Each category needs its own hash lists, review rules and response procedures, but they can run on one technical foundation instead of as separate projects.
How Videntifier approaches this
Videntifier builds hash matching technology for child safety and content moderation. Its platform, Nexus, matches images and video against hash lists from NCMEC, IWF and C3P, so customers don't need to arrange access to each list separately.
Nexus uses Videntifier hashes, built from local visual descriptors, to find known material after heavy edits and to locate known clips inside longer videos. Customers can enable other hash types alongside them, such as PhotoDNA, MDQ, MD5. Only hashes, descriptors and metadata leave the customer's environment. Images and video are never sent to Videntifier, and Videntifier staff never review visual content.
Nexus currently covers CSAM and TVEC, with additional harm categories (e.g., NCII and animal abuse) planned.
Frequently asked questions
What is CSAM detection? CSAM detection is the process of identifying child sexual abuse material on an online service. It usually works by matching files against hash lists of material already confirmed by child protection organizations.
Why isn't exact file matching enough? Cryptographic hashes such as MD5 only match identical files. Any resize, recompression or crop breaks the match. Perceptual hashes and Videntifier's local descriptor matching can find edited copies. But only Videntifier's local descriptors can find even when content has been adversely modified.
Why does video need more than a whole-file hash? Known material may appear in a short segment of a longer video, or be re-encoded and reformatted. Matching inside individual frames finds the segment and shows where it occurs.
Does blocking a matched upload end a platform's obligations? Not necessarily. Depending on the country, the platform may still need to preserve evidence and report the material. In the U.S., providers report to NCMEC's CyberTipline.
Should hash matching be combined with classifiers? Yes. Hash matching finds known material with high confidence, and classifiers flag potential new material for review. Confirmed material is then hashed so future copies are caught automatically.