Deepfake NCII Intervention Points: What 156 LoRA Files and 54 Nudify Apps Show

If your trust-and-safety budget can only move one lever against synthetic non-consensual intimate imagery (SNCII), the strongest reading of the available evidence points upstream: enforce identity-targeted LoRA prohibitions at model hubs and cut commercial nudify apps off from hosting, app stores, and payment providers, while funding hash-based victim services as the floor. That conclusion comes with a hard caveat. Every supply-side number behind it is author-reported from a single observational study with a 165-day window (the CCS ‘26 paper), and the enforcement outcomes that have actually been measured do not all point the same way: one hub’s removals visibly displaced sharing onto 4chan, one app’s own policy change choked its promotion, and one seized service in a dedicated takedown study from another harm domain reconstituted on a backup domain within three days.

The study is “It Takes a Forum: Resources & Stakeholders Sustaining the Online Synthetic Non-Consensual Intimate Image Creation Ecosystem,” accepted to CCS ‘26 (November 15–19, 2026, The Hague) and posted to arXiv ahead of the conference. That gives platform teams a few weeks to pressure-test its proposed intervention points before regulators and press start citing the proceedings. What follows is a map of where the paper says the SNCII supply chain can be interrupted, what adjacent evidence says about how those interruptions actually behave, and a checklist for deciding where your next enforcement dollar goes.

What the study actually counted

The authors report analyzing 282,154 4chan comments and 78,308 Reddit submissions spanning 165 days between June and November 2025. The Reddit corpus, collected via Arctic Shift for temporal alignment with the 4chan data, comprised 27,689 posts and 50,619 comments by 17,386 unique authors across six NSFW AI subreddits; the 4chan side came from a /b/ board archive. Data collection ended when the studied 4chan community migrated to another board. That ending is itself a finding, not a coverage gap: the ecosystem moves.

Two counts anchor the headline. On 4chan, the authors report finding 156 low-ranking adaptation (LoRA) files shared for finetuning image models to target 141 female celebrities. On Reddit, they report links to 54 commercial nudification applications circulating through the communities. All of these figures are author-reported from one study, with no independent replication, and they describe what two platforms’ communities shared during one window. They do not measure total ecosystem volume.

That said, the numbers matter less as counts than as evidence of concentration. One hundred fifty-six reusable model artifacts aimed at 141 named women is not a diffuse content problem. It is a catalog. And 54 commercial services is a short enough list that hosting providers, app stores, and payment processors can plausibly act on it.

Primary resources, secondary resources, and why the taxonomy sets the intervention tier

The paper’s most useful analytical move is splitting what circulates in these forums into two classes. Primary resources are things directly used to create SNCII: the LoRA files, finetuning workflows, and nudify services themselves. Secondary resources distribute the primary ones and explain how to use them: guides, links, recommendations, tutorials. A single submission can carry multiple resources of both kinds.

This distinction does real work for enforcement. Removing a secondary resource, a guide or a link, treats a symptom while the artifact it points to persists elsewhere. Removing a primary resource, the LoRA file on a model hub or the nudify app’s payment account, attacks the thing that produces new harmful content regardless of how many guides still exist. When budget is scarce, the taxonomy argues for spending on primary-resource chokepoints first.

The paper also documents a mechanism that makes this urgent rather than merely tidy: knowledge transfer between experts and newcomers propagates illicit resources across communities of differing technical sophistication. In the authors’ words, their results show “that users with differing levels of technical sophistication employ and share a wide range of primary resources facilitating SNCII content creation as well as numerous secondary resources facilitating dissemination; and (b) that knowledge transfer between experts and newcomers facilitates propagation of these illicit resources.” An expert on 4chan trains a celebrity LoRA; a novice on Reddit follows a guide to a commercial app that requires no expertise at all. The supply chain has a wholesale tier and a retail tier, and they reinforce each other.

From this map the authors synthesize three intervention points: educator disruption, infrastructure choke points, and extended and unified liability frameworks. They attribute the ecosystem’s accountability problems to its “predominantly ephemeral nature” and call for harmonized enforcement. The discussion section goes beyond the conclusion’s three grouped points, also proposing moderation harmonization, since inconsistent enforcement lets users move activity to undermoderated spaces, and regular crawls of Reddit, which the authors suggest “may be effective in identifying content creation and distribution channels.” The word “synthesized” matters: these are interventions the authors derived from observation, not countermeasures they tested. Treating them as proven would repeat a mistake this field keeps making, which is why the reconstitution evidence below deserves equal weight.

Chokepoint 1: model hubs hosting identity-targeted LoRAs

A LoRA is a small adapter file, cheap to train and cheap to share, that steers a base image model toward a specific subject. The study’s 156 files targeting 141 named women make model hubs the most concentrated upstream point in the observed supply chain. A hub that prohibits and enforces against identity-targeted LoRAs raises the cost of the wholesale tier directly: every removed file is a capability that would otherwise be downloaded, reshared, and pointed to by secondary resources.

The published record contains one measured test of this lever, and it complicates any framing of model hubs as a cheap, sufficient control point. Civitai, a major public repository of user-trained image models, removed real-person likeness content in May 2025. The study reports that “resource mentions briefly spike in July-August 2025 following Civitai’s removal of real-person likeness models in May 2025” (Figure 3), a pattern the authors summarize as “suggesting possible displacement of SNCII-related resource sharing onto 4chan.” Uploaders adapted in the open: “Since Civitai banned celebrity LoRAs, we had to make private new ones.” The authors still read this as support for the lever, noting that the policy “shows that effective action by hosting services is feasible, and the impact can be measured,” and their discussion adds that when a hosting service tightens rules, community members shift to other distribution tools such as file-sharing services. The defensible conclusion is narrower than either optimism or dismissal: single-hub removal is feasible and measurable, and acting on one hub alone displaces sharing rather than ending it. What no published data shows is hub-side re-upload behavior on Civitai or Hugging Face, so how quickly removed files reappear on the hubs themselves remains unknown.

There is also a known cost to “just remove it from the model” remedies, measured in an adjacent domain. CoTaEval, a benchmark for copyright takedown methods on language models, evaluated system prompts, decoding filters, machine unlearning, and a method called R-CAD, and found “that no tested method excels across all metrics.” Machine unlearning reduced regurgitation but significantly compromised retained factual knowledge from blocklisted content; R-CAD was effective but cost efficiency and risked utility drops. CoTaEval measured copyright takedowns, not NCII LoRA deletion, so its side-effect profile cannot be extrapolated directly. But it is the nearest measured evidence that artifact-level removal trades effectiveness against collateral damage, and it should temper any promise that deleting a LoRA is clean or complete. The practical implication: remove the file from distribution, and do not assume the capability is gone from copies already downloaded.

Chokepoint 2: commercial nudify apps, hosting, app stores, and payments

The 54 commercial nudification apps linked on Reddit represent the retail tier: no expertise required, payment card accepted. Here the evidence about which levers have worked is partly second-hand but consistent. A safety article hosted on a nudify-app’s own domain, a conflicted source whose claims deserve checking against the primary reporting it cites, reports that nudify apps were listed in the Apple App Store and Google Play and removed only after 404 Media journalists flagged them, and that MrDeepFakes, described as the largest face-swap hub, shut down in 2025 after losing critical service providers, while smaller sites and Telegram bots continued rotating domains.

Two lessons sit inside those reports. First, the removals were reactive: app stores acted after journalist flagging, not from their own review processes. Second, the lever reported to have actually closed a major operator was loss of service providers, not content moderation. Payments, hosting, and app-store listing are the retail tier’s oxygen.

The CCS study adds a measured outcome from inside its own window. After a commercial nudification app changed its terms of service in October 2025 to reserve the right to terminate rewards programs and remove credits, promotional mentions of that app declined, and later mentions were mostly users complaining about credits being removed; the authors conclude that “provider-side action can mitigate dissemination.” That was an operator policing its own incentive scheme rather than a platform deplatforming a service, but it is a direct measurement of the retail tier’s incentive plumbing, and it moved.

The same page cites ecosystem-scale figures that deserve a verification flag rather than repetition as fact: roughly 24 million visits to 34 nudify services in September 2023 attributed to Graphika, a San Francisco lawsuit figure of 200 million or more visits to 16 undress sites in the first half of 2024, and Security Hero’s estimates that about 98 percent of deepfake videos online are pornographic and roughly 99 percent of targeted individuals are women. These are second-hand citations on an SEO article; they are plausible and widely echoed, but they need primary-source confirmation before they appear in a policy memo.

Chokepoint 3: the educators

The paper’s third intervention point, educator disruption, targets the expert-to-novice transfer mechanism rather than any artifact. In budget terms this is the least operationalized option: nothing in the published record measures what happens when knowledgeable actors are removed from a community, and the study’s own narrative suggests the community absorbs disruption by migrating. Still, the finding that propagation runs through identifiable teaching behavior means educator accounts are at least observable, which is the precondition for any future measured intervention.

The reconstitution problem, measured in another domain

Every chokepoint argument above also has to survive the sharpest quantified takedown measurement available, and it comes from a different harm domain. In December 2018 the FBI seized 15 booter (DDoS-for-hire) domains. A measurement study of that takedown found it “immediately reduced the DDoS amplification traffic to reflectors. However, it did not have any significant effect on DDoS traffic hitting victims or on the number of attacks observed.” One seized booter re-entered the global Alexa Top 1M on a domain registered in June 2018 but held unused until the takedown, active three days after seizure, with previously registered credentials still working.

Read that twice before approving any single-chokepoint NCII plan. Infrastructure-side metrics (reflector traffic, domain seizures, files removed) can look excellent while victim-facing outcomes do not move. Operators pre-position backup infrastructure. Users follow. The booter study is a cross-domain analogy, not an NCII measurement, but its shape matches what the CCS paper measures on its own turf, from the Civitai displacement spike to the ephemerality the authors emphasize: communities and services re-form quickly around whatever was not touched.

The implication is not that takedowns are useless. It is that a takedown without coordination across the other tiers, and without a victim-side floor underneath, is a temporary inconvenience to the supply chain and a permanent cost to the people depicted.

Why image-level takedown alone shifts the burden to victims

Downstream takedown asks the person harmed to find the content, report it, and repeat that process for every re-upload on every platform. Hash-based services soften this without eliminating it: StopNCII.org creates a digital fingerprint of an image on the user’s own device and shares only the hash with partner platforms, including Meta and TikTok, to block reuploads for adults; NCMEC’s Take It Down works the same way for images taken before age 18. These are worth funding as the floor because they convert an unbounded reporting burden into a one-time submission.

But the floor is not the fix. Hash matching is reactive by construction: it blocks known images after they exist, it depends on platform participation, and it does nothing about the next image generated from the same LoRA or the next customer of the same nudify app. A takedown-only regime leaves the supply chain fully intact upstream and invoices the victims for the difference. That is the second-order consequence regulators should price in when writing rules that measure success in content-removal counts.

Allocating a scarce budget

If this reads like a portfolio problem, that is because it is one, and there is formal precedent for treating it that way. Work on fake-news mitigation mapped intervention on a networked propagation process into a reinforcement-learning framework, “with the goal of optimizing the actions for maximal total reward under budget constraints,” with what its authors report as “promising performance in real-time intervention experiments on a Twitter network.” No comparable optimization exists for SNCII intervention, but the framing is the right discipline: rank intervention points by expected harm reduction per dollar, discounted by reconstitution risk, rather than by which metric is easiest to report.

On the evidence available, the ranking looks like this:

What would falsify this map

Intellectual honesty about this article’s foundation: it is one observational study, 165 days on two platforms, author-reported counts, no replication, and intervention points that are synthesis rather than tested countermeasures. The study’s window also ended when the community moved, so the map describes where the ecosystem was, not necessarily where it is.

Three kinds of evidence would change the recommendation. First, hub-side outcomes: the study measured displacement onto 4chan after Civitai’s removals, but not re-upload rates on the hubs themselves; if those show rapid reconstitution similar to the booter case, the chokepoint case weakens and coordination costs rise. Second, payment and app-store deplatforming data: if the journalist-triggered removals prove to be one-off press events rather than durable policy, the retail-tier lever needs regulatory teeth to work at all. Third, Take It Down and StopNCII match statistics: if hash coverage is broader and faster than assumed, the floor carries more weight and the urgency of upstream action shifts.

Until that evidence exists, the defensible position is the coordinated one the evidence points to: act at the concentrated upstream artifacts, in coordination across hubs rather than one hub at a time, cut the commercial tier’s service providers, fund the victim-side floor, and treat every intervention metric that is not a victim-facing outcome as a leading indicator at best. The study’s own closing line is the right standard: effective intervention requires “coordinated action targeting not only content sharers, but the broader ecosystem enabling SNCII creation.” The supply chain is already coordinated. Enforcement that is not will keep losing to it.

Frequently Asked Questions

What are the three main intervention points identified in the study?

From this map the authors synthesize three intervention points: educator disruption, infrastructure choke points, and extended and unified liability frameworks.

What happened to promotional mentions after a nudify app changed its terms of service?

After a commercial nudification app changed its terms of service in October 2025 to reserve the right to terminate rewards programs and remove credits, promotional mentions of that app declined, and later mentions were mostly users complaining about credits being removed; the authors conclude that “provider-side action can mitigate dissemination.”