The first Visork detection module analyses user-uploaded images for CSAM. This page describes the approach: what the models look for, what an analysis returns, and how detection quality is measured.
ML-first detection
Two technology families dominate CSAM detection today. Hash matching (Microsoft PhotoDNA, Cloudflare's CSAM scanning tool, Project Arachnid) fingerprints files and compares them against databases of already-identified material — precise for known content, blind to anything new. Machine-learning classification learns visual patterns, so it can flag material no database has seen yet.
Visork is ML-first. The models are specialized for this high-risk task — they are not general-purpose image classifiers — and were developed on lawfully obtained datasets annotated in cooperation with law-enforcement authorities. By default they are not trained, fine-tuned, or evaluated on customer traffic; that happens only where a platform enables it — by individual agreement or in the service settings. If a free tier launches, its defaults may differ and will be stated at sign-up (see Security & data handling).
The two approaches are complementary rather than competing: hash matching answers "is this file already known?", ML classification answers "does this image look like abuse material?". Platforms with access to established hash databases can run Visork alongside them. Visork also maintains an internal layer of the same kind: when a human reviewer confirms flagged material as harmful, a perceptual hash of it — an irreversible fingerprint, not the image — enters a service-wide database, so material confirmed once is recognised almost instantly wherever it reappears.
Scores and thresholds
Every analysis returns a probabilistic score, not a bare yes/no. The verdict — block, review, or allow — comes from comparing that score against a threshold profile agreed during scoping and tunable per module.
Where the threshold sits is a policy decision, and it is deliberately yours. A dating platform that quarantines aggressively and reviews afterwards runs a different profile than a hosting provider for whom a false positive takes a customer's site down. Detection and decision stay separate: Visork reports what it sees; your systems apply your moderation policy.
How quality is measured
A single accuracy number is close to meaningless for rare-event detection — a model that flags nothing at all scores above 99% "accuracy" on realistic traffic. Detection quality is therefore tracked as a set of metrics that pull in different directions:
- Precision — of everything flagged, how much was actually abuse material. Low precision floods your review queue.
- Recall — of the abuse material present, how much was caught. Low recall means material gets through.
- False-positive rate — legitimate content incorrectly flagged, the metric your users feel.
- False-negative rate — abuse material missed, the metric your legal exposure feels.
Threshold tuning trades these against each other, which is why the threshold profile is set per platform during scoping rather than shipped as a global default. The benchmark phase of every pilot exists to measure these numbers on your own traffic before commercial terms are discussed.
What the module covers today
Image-based CSAM detection is what is in production scope today. Video, text, and multimodal analysis (grooming and sextortion patterns, CSE-related text) are on the roadmap as future modules — if you need them today, Visork is the wrong tool for now, and we will say so on the intro call.