Privacy-Preserving Detection: Scanning Without Storing Content

Detection and privacy are often framed as opposing goals. In practice, good detection design minimizes privacy risk rather than trading it away. The question is not whether to protect children or protect privacy, but how to build systems that do meaningful detection while collecting, storing, and exposing as little as possible. This piece walks through the techniques, and is honest about where the hard debates remain.

Start with data minimization

The foundational principle is data minimization: collect only what is necessary, keep it only as long as needed, and avoid retaining raw content when a derived signal will do. A system that stores every message it scans is a liability, a breach target, and a compliance problem. A system that scores content and keeps only the score, or a hash, or a reviewed decision, carries far less risk. Minimization is not a constraint bolted on at the end. It is a design choice made at the start, and it usually makes the system safer and cheaper to run.

Hashing: detection without the content

Perceptual hashing is the clearest example of detecting harm without storing or exposing content. A hash is a digital fingerprint derived from an image. The Internet Watch Foundation maintains a list of over 3.2 million hashes of confirmed child sexual abuse imagery, expressed in formats including PhotoDNA, MD5, SHA-1, and SHA-256. Platforms compare uploads against this list and can block known material without a human ever viewing it, and without the platform holding the original criminal image.

Perceptual hashing, unlike a plain cryptographic hash, still matches when an image is resized, cropped, or recolored, which is what makes it useful against people who make small edits to evade detection. The privacy benefit is structural: the fingerprint identifies known content without revealing anything about unknown content, and matching can happen without a person in the loop. Hashing does have real limits. It only finds material already in the database, so it cannot detect novel imagery or reliably flag AI-generated content on its own. That is why platforms pair hash matching with classifiers and human review for the cases hashing cannot resolve.

Score in memory, keep the signal not the text

For text-based harms such as grooming, the same minimization logic applies. A classifier can score a conversation for risk signals and return the score, without the detection system retaining the raw text. Where the model runs on the platform's own infrastructure, sensitive content never leaves that boundary. This is the approach Polycreek takes with Aletheia: score the conversation for grooming risk, keep the signal that matters, and avoid retaining the underlying text. The platform, not the classifier, remains the entity that decides what to do with a flag, including whether to file a report. When a report goes to NCMEC, it is the platform that reports, and human reviewers are involved in that process rather than an automatic pipe from model to authority.

The encryption debate, honestly

The hardest terrain is end-to-end encrypted messaging, where the provider cannot see content in transit at all. One proposed answer is client-side scanning, which checks content on the user's device before it is encrypted. Child protection advocates argue this is the only way to detect abuse in spaces that would otherwise be dark to any safety system.

Serious critics disagree, and their arguments deserve to be stated fairly. The Electronic Frontier Foundation argues that once a device can scan for one category of content, the same machinery can be pointed at others. In its analysis of Apple's 2021 proposal, EFF warned that "all it would take to widen the narrow backdoor that Apple is building is an expansion of the machine learning parameters to look for additional types of content." The concern is scope creep: a system built for CSAM could be repurposed by governments for political or other content. Security researchers add that client-side scanning turns every device into a scanning endpoint with privileged access, which enlarges the attack surface and creates a high-value target. There are also accuracy concerns, since detection of novel material and grooming is less reliable than matching known hashes, and false positives at scale can burden reviewers and investigators.

These critiques do not mean detection is hopeless in private spaces, but they do mean that scanning inside encrypted contexts carries costs that scanning of already-visible platform content does not. Teams should be precise about which context they are in. Detecting harm in content a platform already processes is a very different privacy proposition from reaching into an encrypted channel.

Balancing protection and the law

Data-protection law and child-protection duties can be reconciled when systems are built to minimize. Regulators reward designs that limit collection, restrict re-use, and keep sensitive data out of long-term storage. The practical questions to ask of any detection system are consistent: What is the minimum data needed to make this decision? Can we keep a derived signal instead of the raw content? Where does processing happen, and does sensitive content ever have to leave a trusted boundary? Who reviews a flag before any consequence follows? Systems that answer these well tend to be both more protective and more defensible.

The bottom line

Privacy-preserving detection is not a slogan. It is a set of concrete choices: hash known content instead of storing it, score in memory instead of retaining text, keep humans in the loop before consequences, and be honest that scanning inside encrypted channels is a genuinely contested tradeoff rather than a settled one. Built this way, detection reduces harm without asking users to give up privacy as the price.