Hash Matching vs Classifiers: How Child Safety Detection Actually Works

Child safety detection runs on two different families of technology, and confusing them leads to bad build-or-buy decisions. One family, perceptual hash matching, finds copies of images that have already been identified as abuse. The other, machine-learning classifiers, makes predictions about content no one has seen before, including text. They solve different problems. A program that leans on one and skips the other has a gap, and for grooming specifically, hash matching offers almost nothing.

Hash matching: reliable, for known content only

Perceptual hashing is the backbone of known-CSAM detection. Microsoft's PhotoDNA, developed with Dartmouth College and later offered as a cloud service, creates a unique digital signature, a hash, of an image, and compares it against hashes of previously identified images to find copies. The word perceptual matters. Unlike a plain file hash, a perceptual hash is designed to survive resizing, minor edits, and format changes, so a match still fires when an image has been altered.

Two properties define what hashing is for. First, the hash is not reversible and cannot recreate the image, and PhotoDNA is not facial recognition and cannot identify a person. Second, and this is the crucial limit, it only finds what is already on a list. As Safer by Thorn puts it, hash matching is an incomplete solution on its own because it only detects images and videos that have previously been found and added to a hash list.

That list is large and shared. NCMEC's CyberTipline has taken in more than 195 million reports since 1998, and more than 1,400 companies participate in reporting and receiving notices. The Internet Watch Foundation maintains a hash list of more than 3.2 million hashes, using PhotoDNA alongside MD5, SHA-1, and SHA-256, with each image independently assessed by at least two people before it is added. The Tech Coalition's Lantern program, launched in 2023, lets platforms share signals including known-CSAM hashes across companies.

The strengths follow directly. Hash matching is precise and produces very few false positives, because a match means this specific known image is present. That reliability is why it is the first line of defense for known material.

Classifiers: for novel content and for text

Hash matching cannot find an image that is not yet on any list. That is the entire category of newly produced abuse, which often depicts a child being actively harmed, and it is also the category that generative AI is now flooding, where hashing is much less effective. For that, you need a classifier.

A machine-learning classifier does not match against a list. It learns patterns from labeled examples and predicts a label for content it has never seen. Thorn describes its classifiers as able to find new and unknown abuse images and videos, trained on confirmed CSAM provided by trusted partners including NCMEC. A classifier analyzes the attributes of an image or video and predicts how likely it is to be CSAM, which is what lets it flag material that has never been hashed.

The tradeoff is the mirror image of hashing. A classifier is probabilistic. It outputs a likelihood, not a certainty, so it will make mistakes in both directions and its flags require human review. Hash matching says this is a known file. A classifier says this looks like the kind of thing we are trained to catch. Those are different claims, and only the second one comes with uncertainty attached.

Why grooming needs classifiers

Grooming makes the distinction unavoidable, because there is nothing to hash. Grooming is conversation, and every conversation is new. Safer by Thorn states the limit directly: hashing and matching does not detect text-based exploitation, nor does it detect newly generated CSAM. You cannot maintain a hash list of grooming messages the way you can of known images, because the abusive content is language, produced fresh each time and endlessly varied.

So text-based exploitation is inherently classifier territory. A grooming classifier reads a conversation, understands language patterns and context rather than matching a fingerprint, and, in the design Safer describes, applies a grooming label and confidence score to each message so that Trust and Safety teams can prioritize, flag, or route conversations for human review and intervention. Related text detection covers sextortion, self-generated CSAM, and discussion of abuse. None of these have a hash to match. All of them require a model that predicts from context.

Why platforms need both

These tools are complementary, not competing. Hash matching gives you reliable, low-false-positive coverage of known material, the enormous body of previously identified abuse that circulates repeatedly. Classifiers give you coverage of everything hash matching cannot see: novel imagery, AI-generated content, and the text-based grooming that produces new victims. Safer, which sells both, frames it plainly: no single approach uncovers all abusive content, so comprehensive detection combines hashing and matching with classifiers.

For a Trust and Safety program, the practical takeaways are three. Use hash matching as your high-precision layer for known content. Use classifiers to reach novel imagery and, critically, text-based grooming, and hold their probabilistic output to honest evaluation and human review. And do not treat either as a substitute for the other, because the gap each leaves is exactly the space the other was built to cover.