Non-Consensual Synthetic Intimate Imagery

• NSII is defined as AI-generated sexual content depicting real individuals in intimate scenarios without their consent, using deepfake and nudification techniques.
• Recent research highlights varied production methods like face-swapping, LoRA fine-tuning, and diffusion-based models that lower barriers for creating NSII.
• NSII harms include identity violation, reputational damage, and psychological trauma, prompting calls for coordinated regulatory and trauma-informed responses.

Searching arXiv for the specified NSII papers to ground the article in current research. arxiv_search(query="Non-Consensual Synthetic Intimate Imagery deepfake celebrities usees (Twomey et al., 17 Jul 2025)", max_results=5) Non-Consensual Synthetic Intimate Imagery (NSII) denotes AI-generated videos or images that portray a person in intimate or sexual situations without that person’s consent; related work defines it broadly as any fake but realistic-looking sexual content—photo or video—that depicts the face, body, or voice of a real person without that person’s consent (Twomey et al., 17 Jul 2025, Umbach et al., 2024). In recent scholarship, AI-generated non-consensual intimate images (AIG-NCII) are treated as falling under the broader concept of NSII, with scope extending across non-consensual creation, non-consensual distribution, and threats to create or distribute for financial gain, i.e. $\mathrm{AIG\text{-}NCII}=C \cup D \cup T$ (Ding et al., 4 Feb 2026). Empirical work situates NSII within image-based sexual abuse and technology-facilitated gender-based violence, while newer measurements indicate that targeting has expanded from celebrities to increasingly include ordinary individuals within users’ own social circles (Brigham et al., 2024, Cui et al., 25 Jun 2026).

1. Definitions, boundaries, and conceptual models

A common three-part characterization defines NSII as Synthetic, Intimate, and Non-consensual. “Synthetic” means the intimate imagery is produced or manipulated via AI/deep-learning methods (“deepfakes”) rather than manual editing. “Intimate” means the content depicts sexual acts or nudity. “Non-consensual” means the person depicted has neither granted permission for the use or creation of their likeness nor retains awareness or control over the resulting material (Twomey et al., 17 Jul 2025). Closely related definitions describe NSII as including AI-generated sexually explicit images or videos of real individuals produced without their consent, and distinguish it from fictional-content generation by requiring that the depicted subject be a real individual (Cui et al., 25 Jun 2026, Medeiros et al., 14 Apr 2026).

The term is broader than any single production technique. Some work explicitly includes “shallowfakes” such as Photoshop manipulations alongside AI-based deepfakes, whereas other work emphasizes end-to-end generation by diffusion or auto-regressive systems that learn visual and identity priors from large, uncurated web datasets (Umbach et al., 2024, Hawkins et al., 6 May 2025). The broader umbrella in adjacent literature is Non-Consensual Intimate Media (NCIM), of which NSII is a subset; when the depicted subject is a minor, the relevant category becomes AIG-CSAM (Qiwei et al., 2024, Ding et al., 4 Feb 2026).

A significant conceptual contribution is Baumer’s “Usees” framework, applied to celebrity targets of deepfake abuse. In this formulation, a target is a usee iff

$$\neg \mathrm{Consent}(\mathrm{target}) \land \neg \mathrm{Awareness}(\mathrm{target}) \land \mathrm{TargetedByTech}(\mathrm{target}).$$

This usee model is analytically important because it shifts attention away from the conventional HCI distinction between users and non-users and toward stakeholders upon whom the technology acts directly (Twomey et al., 17 Jul 2025). This suggests that NSII is not adequately described as mere misuse by an end user; it also involves the position of a directly targeted non-consenting subject.

2. Generation methods and technical workflows

NSII is produced through multiple technical pathways. One pathway is classical face-swapping: a target’s face is transplanted onto existing nude bodies or source videos. Another is “nudification” or “undressing” systems that take a fully clothed photo and output a nude version. A third is identity-conditioned generation using text-to-image or image-to-video models fine-tuned on a specific person’s likeness. Recent work also describes combined workflows, including LoRA plus face-swap for improved fidelity, and LoRA followed by post-processing in Photoshop (Mink et al., 28 Jan 2026, Gibson et al., 2024).

Parameter-efficient fine-tuning has substantially lowered the barrier to entry. In the LoRA formulation, a pre-trained weight matrix $W_0\in\mathbb{R}^{d\times k}$ is frozen and a low-rank update is learned:

$$\Delta W = BA,\quad B\in\mathbb{R}^{d\times r},\;A\in\mathbb{R}^{r\times k},\;r\ll \min(d,k),$$

so that

$W \approx W_0 + BA,$

with trainable parameters per layer

$\#\mathrm{params}=r(d+k).$

The reported resource requirements are correspondingly modest: as few as $n\approx20$ images of the target subject, a consumer-grade GPU with $\geq 24$ GB VRAM, and training time $T\approx15$ minutes for a LoRA adapter (Hawkins et al., 6 May 2025). Interview-based work reports a similar operational range of 25–50 images of a real person for fine-tuning a text-to-image foundation model such as Stable Diffusion via a LoRA module (Mink et al., 28 Jan 2026).

The underlying model families span GAN-based face-swap frameworks and diffusion-based synthesis systems. For GAN-based face-swapping, the standard adversarial objective reported in this literature is

$$\min_G \max_D\; \mathbb{E}_{x\sim p_\text{data}}[\log D(x)] + \mathbb{E}_{z\sim p(z)}[\log(1-D(G(z)))].$$

For identity-specific generation, commonly cited base models include the Stable Diffusion family, the Flux family, and, in newer ecosystem maps, closed-weight systems such as Grok, Aurora, and Gemini (Ding et al., 24 Apr 2025, Ding et al., 4 Feb 2026).

The practical workflow described across empirical studies is highly standardized: target image acquisition; model base selection; fine-tuning or prompt setup; generation through GUI front-ends such as ComfyUI or Automatic1111 or through app interfaces; and post-processing such as upscaling, clean-up, and watermark removal (Cui et al., 25 Jun 2026). Interview and audit work further documents jailbreaks of proprietary systems, off-the-shelf mobile or web nudification apps, and “human-assisted AI undressing” services (Mink et al., 28 Jan 2026, Gibson et al., 2024). This suggests that NSII production is no longer restricted to technically sophisticated actors.

3. Ecosystems, platforms, and scale

Recent work rejects a single-tool account of NSII in favor of an ecosystem model. One comprehensive taxonomy identifies 11 categories of technologies grouped into five roles (Ding et al., 4 Feb 2026).

Role	Function in NSII	Technology categories
A. Creation	Technologies that enable non-consensual creation of intimate images	Training datasets; Generative AI models; Generative AI interfaces
B. Distribution	Platforms and channels for non-consensual dissemination	Distribution channels
C. Proliferation / Discovery	Technologies that help users find or learn to use creation/distribution tools	Deepfake creation communities; Search engines; Advertisement platforms; App stores
D. Infrastructure	Backend services supporting creation/distribution tools	Developer platforms; Critical service providers
E. Monetization	Payment processors that enable paid access or content sales	Payment processors

A related concept is the “malicious technical ecosystem” (MTE), defined as the open-source models, user-facing “nudifiers,” and small independent websites that sit within the creation stage of the broader supply chain (Ding et al., 24 Apr 2025). The reported scale is substantial: 7,200+ GitHub repositories referencing “deepfake,” 17.2 k GitHub stars for DeepFaceLab alone, ~200 open-source “nudifier” programs, ~1,700 paid independent services, and 50+ dedicated adult deep-fake websites. One named site, MrDeepFakes.com, accumulated 1 billion views between 2016 and 2023 (Ding et al., 24 Apr 2025).

Model-hosting repositories also show rapid expansion. One metadata analysis identified 34,439 publicly downloadable deepfake model variants tagged “Celebrity,” with 14,908,183 cumulative downloads. These models are primarily hosted on Civitai, 80.0% are LoRA adapters, 14.5% are tagged “sexy,” approximately 0.3% are tagged “nude”/“nsfw,” and target demographics are overwhelmingly female: 96.4% of a sampled set of 2,083 deepfake models targeted women (Hawkins et al., 6 May 2025). Temporal data in that study show that the first “Celebrity” LoRA appeared in November 2022 and that by December 2024 there were approximately 2,400 new deepfake variants per month (Hawkins et al., 6 May 2025).

Dedicated nudification services exhibit similarly structured commercialization. In a walkthrough of 20 popular and easy-to-find nudification websites, all 20 offered at least one core likeness-manipulation tool; 18/20 featured an “AI Undressing Tool,” 9/20 advertised “Deepnudes,” 5/20 provided clothing-changing filters, one offered a “Human-Assisted AI Undressing” service, and one supplied an AI Face-Swapping engine (Gibson et al., 2024). Nineteen out of twenty sites explicitly targeted women or girls, only 7/20 prompted users in-flow to confirm subject consent, and 17/20 accepted cryptocurrencies (Gibson et al., 2024).

More recent measurement of community-level circulation indicates a shift from celebrity-focused abuse to broader victimization. A study of 4chan’s Adult Requests board identified 24,105 SNEACI items, of which 55.78% of targets were non-celebrities and 44.22% were celebrities; for videos, 60.26% of targets were non-celebrities (Cui et al., 25 Jun 2026). Open-source models dominated production, with the Stable Diffusion family generating 42.4% of scene synthesis images and Wan generating 66.5% of videos (Cui et al., 25 Jun 2026). This suggests that the public-figure bias documented in earlier platform studies no longer captures the full scope of the phenomenon.

4. Victim experience, harms, and public attitudes

Victim-centered qualitative work describes NSII as a distinctive form of harm involving identity violation, reputational damage, and trauma. Celebrity targets characterized their AI-generated likeness as property violated and as a form of non-consensual sex work; one statement summarized the experience as “my face was stolen so men could make me into a sexual object,” while another emphasized, “This is my face, belongs to me, and someone plastered it on porn to humiliate me” (Twomey et al., 17 Jul 2025). Reputational anxiety is intensified by the persistence of first impressions, even where disclaimers are present, and by the difficulty of convincing audiences that the content is fabricated (Twomey et al., 17 Jul 2025).

The same study reports trauma analogies to rape and childhood molestation, anxiety, hypervigilance, and social withdrawal. Targets described fear of searching their own names, fear of logging onto platforms, fear of walking down the street, and breaks from social media to cope with harassment (Twomey et al., 17 Jul 2025). Parallel work in the broader NCIM literature characterizes NSII harms as including severe anxiety, depression, loss of agency, suicidality, reputational damage, stalking, extortion, and a “chilling effect on intimacy” (Qiwei et al., 2024).

Population-level measurement confirms that the phenomenon is not merely anecdotal. In a survey of 16,693 adults in 10 countries, 2.2% of respondents reported at least one form of deepfake porn victimization and 1.8% reported having perpetrated non-consensual deepfake pornography (Umbach et al., 2024). Awareness, however, remained limited: only 28.1% reported knowing “a little bit” or being “quite familiar” with “deepfake pornography” when given a vignette-based description (Umbach et al., 2024).

Attitudinal studies show a sharp normative asymmetry across stages of the pipeline. In a U.S. vignette study using cumulative link mixed models, the median percentages of “somewhat” or “totally unacceptable” were 89.5% for creation, 94.4% for private sharing, 94.4% for public sharing, 94.2% for resharing, and 52.8% for seeking out (Brigham et al., 2024). Sharing was consistently judged less acceptable than creation, while seeking out was judged more acceptable than creation, with an odds ratio of 5.43 relative to creation (Brigham et al., 2024). The authors interpret this as a norm gap around viewing or consumption.

Demographic patterns are also pronounced. Umbach et al. report that men were 3.5 times as likely as women to report viewing celebrity deepfake pornography and 2.31 times as likely to report having created deepfake porn (Umbach et al., 2024). Brigham et al. likewise report that men were more likely than marginalized genders to accept creation and private sharing in vignette scenarios (Brigham et al., 2024). These findings align with qualitative evidence that sexual entitlement, slut-shaming, and disbelief of victimhood function as enabling narratives around NSII (Twomey et al., 17 Jul 2025).

5. Governance, moderation, and regulatory limits

Technical governance proposals for synthetic content have often been built around training data filtering, input data filtering, output data filtering, hashing of known abusive material, and provenance tracking. Applied to adult AIG-NCII, three limitations have been identified in this framework (Ding et al., 24 Apr 2025).

• Transparency-only approaches: MTE outputs are often overtly watermarked “FAKE” or “AI-generated,” yet labelling alone does not mitigate reputational or emotional damage.
• Conflation of CSAM and adult NCII: PhotoDNA-style and law-enforcement hash databases address child sexual abuse material, but adult consent cannot simply be inferred by age-based filters, and no centralized adult NCII hash repository exists.
• Corporate-model assumption: prompt filtering and red-teaming focus on prompt-based text-to-image models, whereas MTE tools often accept only user-photo inputs; the assumed threat model of a benign model plus malicious user fails when the model itself is explicitly malicious by design.

Platform-level policy has also proved porous. Hosting policies may prohibit “sexual content without explicit consent” or mature depictions of real people without consent, but enforcement is reactive and loopholes remain when creators omit explicit sample images while distributing underlying model capability (Hawkins et al., 6 May 2025). Safety audits of dual-use face-swap apps indicate that policy text is a poor proxy for actual safeguards: among 155 tested apps, 109 permitted all four nude swaps, yielding $$\neg \mathrm{Consent}(\mathrm{target}) \land \neg \mathrm{Awareness}(\mathrm{target}) \land \mathrm{TargetedByTech}(\mathrm{target}).$$0, while only 38/155 required explicit user consent in their terms of service, yielding $$\neg \mathrm{Consent}(\mathrm{target}) \land \neg \mathrm{Awareness}(\mathrm{target}) \land \mathrm{TargetedByTech}(\mathrm{target}).$$1 (Daffalla et al., 23 May 2026).

Intervention studies further suggest that deplatforming and legal signals can redistribute activity rather than suppress it. A synthetic-control analysis of three forums after the passage of the TAKE IT DOWN Act in the U.S. House and the shutdown of MrDeepfakes found increases in sharing and requests for SNCEI rather than sustained decline below counterfactuals. On Website A, the average weekly gap in new posts in the “Fakes/AI/Deepfakes” subforum was +737.1; on Website B, the “AI-generated” category showed a gap of +102.7; and on 4chan /r/, new posts used as a proxy for demand showed a gap of +3,294.2 (Cuevas et al., 2 Feb 2026). The same paper concludes that deplatforming and regulatory signals alone may shift where and when SNCEI is produced and shared, rather than reducing its prevalence (Cuevas et al., 2 Feb 2026).

Ecosystem mapping work explains this resilience structurally. The TAKE IT DOWN Act case study is described as targeting public platforms and requiring removal of reported intimate images within 48 hours, but leaving creation mechanisms untouched; by contrast, the San Francisco lawsuit against AI nudifier apps is described as upstream prevention of new creation, and the Mr.DeepFakes shutdown is described as an infrastructure intervention that cut both distribution and creation-community functions simultaneously (Ding et al., 4 Feb 2026). A plausible implication is that downstream takedown regimes, while necessary, are insufficient when creation, discovery, infrastructure, and monetization remain intact.

6. Misconceptions, recourse, and research directions

A recurring finding is that NSII is sustained not only by tools but also by false beliefs and justificatory narratives. Reported myths include “it’s not real, it’s just a fantasy,” “you don’t own your face,” “you should expect this if you post publicly,” and “if it’s fake, it can’t hurt” (Twomey et al., 17 Jul 2025). Interview-based work with creators documents parallel rationalizations such as “no harm done” and security-vigilante claims, alongside motives including sexual gratification, curiosity and technical challenge, community status and bonding, and financial compensation (Mink et al., 28 Jan 2026). This suggests that technical governance and norm change cannot be cleanly separated.

Trauma-informed computing has been proposed as a design frame for recourse. Applied to NSII, the “Four Rs” are: realize trauma exists; recognize signs of trauma; respond to trauma; and resist re-traumatization (Twomey et al., 17 Jul 2025). Concrete proposals include tools that detect when a user searches for their own name alongside “deepfake,” default blurring of intimate imagery, faster in-app takedown flows, blocking direct messages containing NSII, guided workflows that combine automated site-scanning with one-click reporting across multiple platforms, and notices that reaffirm the victim’s ownership of their image rather than resurfacing old material (Twomey et al., 17 Jul 2025).

A broader systems view is supplied by the “Sociotechnical Stack,” which maps harms across hardware, storage, networking, algorithms, applications, user interface, and social practices and norms (Qiwei et al., 2024). Proposed countermeasures span perceptual watermarking robust to deepfake transformations, comprehensive reporting APIs, trauma-informed UI/UX, CDN-level blocking agreements, “smart files” with embedded consent credentials, and participatory design with victim-survivors (Qiwei et al., 2024). Ecosystem-level scholarship adds three further recommendations: use the 11-category ecosystem to map state, federal, and international laws; build a dynamic database that tracks the 11 technologies over time; and adopt a relational approach that studies interactions between categories rather than siloed components (Ding et al., 4 Feb 2026).

Several controversies remain open. One is the status of “blunt-instrument” interventions: CivitAI’s ban on real-person LoRAs is described as cutting off a major NCII supply chain but also as a blunt-instrument approach that risks censoring legitimate sexual expression (Mink et al., 28 Jan 2026). Another is the boundary between consensual AI-generated sexual content and non-consensual abuse, especially where no reliable technical test distinguishes AIG-NCII from consensual AIG-SC or from real images (Mink et al., 28 Jan 2026). A third is the tension between transparency and prevention: watermarking and provenance are widely proposed, yet multiple studies argue that marking content as fake does not prevent harm once the likeness has already been weaponized (Ding et al., 24 Apr 2025).

Across the literature, the most consistent conclusion is that NSII is sustained by an interconnected ecosystem of models, interfaces, communities, search and advertising systems, infrastructure, and monetization channels, while its harms are mediated by gendered norms, victim-blaming, and weak recourse mechanisms. The research trajectory therefore points away from isolated fixes and toward coordinated upstream prevention, mid-stream disruption, downstream support, and evaluation frameworks that measure ecosystem shifts rather than single-platform outcomes (Ding et al., 4 Feb 2026, Cuevas et al., 2 Feb 2026).