The Tools and Tolls of AI Nudification

In late January 2024, just days after Taylor Swift was spotted cheering for the Chiefs, a U.S. football team, AI-generated sexually explicit images of her, decked out in red and gold (the team’s colors), posing in different spots of their stadium, began flooding the internet. Within 17 hours, one post racked up over 45 million views and 24,000 reposts on X (formerly Twitter).

Commentators called it a glimpse of a dangerous future, “the tip of an enormous iceberg.”  But here’s the truth: this isn’t the future. It’s the present, and even the recent past.

We had the research goal of studying this present – to study the ecosystem facilitating the creation of such images. The results of our research appear in our fUSENIX Security 2025 paper. 

We did not begin our research lightly. From the start, we knew that studying image based sexual abuse would mean engaging directly with potentially abusive content. We also knew that the harm was already happening. 

At scale. In plain sight. 

We chose to do this work not because we were desensitized to it, but because we are not. As security researchers, we believe we have a responsibility to study, understand, and thereafter expose how tools of abuse operate. Further, as security researchers we have the opportunity to not just study and understand the mechanics of tools used for non-consensual or adversarial purposes, but to advocate, with a solid and informed scientific understanding, for those harmed by them. 

In choosing to conduct our research, we want to make one thing very clear: this is not easy work. The second half of this article offers a roadmap for anyone thinking about studying this space. Harm doesn’t stop at the victim-survivors depicted. It can reach the researchers too.

While Swift’s case briefly made headlines, a whole ecosystem of AI-based tools that enable “nudification” – tools advertised to be able to estimate the biology beneath the subject's clothing – has been quietly thriving on the web for years. Some websites claim to have been selling the ability to create AI-generated nudes since 2018. These websites do not require technical sophistication, access to GPU farms, or advanced knowledge on how to circumvent generative AI safeguards. These commercial products are made specifically to nudify people. Open to the public with a few clicks and a credit card. For as little as 6 cents or sitting through ads, and in some cases barely 15 seconds later you can, as one platform phrases it: see any Girl clothless with the click of a button. 

Another sells its services to those who, Don’t dare talk to the person you love? [No problem!] Upload her photo here and find out what she looks like when she… (haha) 

These websites scale image-based sexual abuse (a form of sexual violence that encompasses the non-consensual creation and/or distribution of an intimate image depicting someone). Research finds that such abuse can lead to similar harms as other forms of sexual violence. Not to mention several existing cases of these tools being used to create child sexual abuse material.

What you will find on these sites is startling. It is not just in their output, but in their presentation. The moment you land on the homepage, you’re greeted by non-consensual images of nude women. One site featured A-list Hollywood celebrities inserted into extremely explicit scenes. Often, animated GIFs demonstrate the product’s main feature: the transformation of a clothed woman into their AI-generated naked form without her consent. The aesthetic is sleek and accessible. Claims about the computer vision techniques used such as inpainting and the number of hours and images the models have been trained abound. One site boasts over 100,000 daily users, framing participation not as deviance, but as the norm.

And if nudifying strangers alone isn’t enough? Most platforms offer an opportunity to spread the word: affiliate programs that pay up to 50% commissions. Some platforms even offer an API so you can spin-off and build your own nudification site. They’ve built the infrastructure. You just plug it in.

These are not isolated tools. They are part of a fledgling, modular abuse economy with monetized referral programs, commercial customer support, and web analytics built in. We are not witnessing a fringe perversion of generative AI’s potential. We are watching the logical outcome of what happens when that potential is turned into a product, one optimized to exploit intimacy, identity, and desire for profit. In our forthcoming USENIX Security 2025 paper, we studied twenty such websites as of August 2024. We discuss and reflect on some of our findings in this article.

At first glance, these platforms claim to do one thing: undress the person in a photo. But over half of the 20 platforms we studied offered more than simple “undressing.” Nine let users go further, placing the image subject into different sexual positions and even videos. These weren’t just static nudes. These were synthetic sexual scenes, rendered from uploaded photos. Users are able to select sexual acts to put the image subject in through the dashboard for nudifying. On many websites, images on the front page advertised this functionality directly.

Five offered body modifications, ranging from breast and butt enlargement to apparent age changes (we only saw options for age changes 18 and above, but we never purchased any subscriptions). Some platforms added filters to stylize the output with options like anime-fication, furry-fication.

Our USENIX Security 2025 paper goes into detail about potential interventions for platform accountability, including financial deplatforming, affiliate disruption, and third-party enforcement pathways. Those recommendations are nuanced, technically grounded, and worth reading in full.

But here, we want to focus on something different: how to ethically research AI-generated sexual abuse content like that produced by nudification tools. From day one, our team grappled with how to conduct this work responsibly. Not just methodologically, but ethically. Those conversations haven’t ended, and they shouldn’t. Because while our qualitative walkthrough of all 20 platforms yielded valuable insights, it is not a method we universally recommend. Especially not without serious forethought.

There are two ethical stories that must be told in parallel: protecting the people depicted in these images, and protecting the people who study them. We consider both below, starting with the latter.

1. Protecting Researchers from Harm

Studying systems that generate or facilitate abuse can take a toll. The harm doesn’t just happen “out there,” to image subjects or end users in the wild. It can happen inside research teams, too.

We want to be clear: nude imagery is not inherently abusive. But content that is non-consensual or depicts abuse — even if generated synthetically — can be deeply distressing to view. During our study, one researcher completed the full application walkthrough for all twenty websites. A second researcher conducted walkthroughs for a subset of ten sites to establish inter-rater reliability. Seventeen sites included nude imagery, but one in particular stood out. Although it advertised itself for “fake” nude imagery, it depicted well-known women in non-consensually graphic sexual acts.

The researcher who first encountered the site immediately closed the computer. Later, when other team members stumbled across it despite knowing it was coming, the responses were physical: one jumped in their chair, another pushed back from the screen. Afterward, we flagged the site in red and issued a team-wide warning to ensure no one encountered it unprepared.

These reactions weren’t overreactions. They were signals, reminders that emotional and psychological safety needs to be part of research design. In our case, we created systems to support that safety: content flags, optional task rotation, and open office hours with a mental health professional. But more than policies, we learned that psychological safety starts with creating a culture where discomfort is valid and boundaries are respected, especially for early-career researchers who may feel pressure to endure more than they should.

But these are only part of the story. There are other ethical questions too.

2.Protecting Image Subjects from Further Harm

Just because a study happens in an academic setting doesn’t mean the material loses its sensitivity, nor that researchers cannot themselves engage in further abuses. Research isn’t a loophole. Studying synthetic sexual abuse imagery still carries ethical responsibility to the real people whose likenesses are being used, often without their knowledge, consent, or recourse.

The nudity in the images we studied may be AI-generated, but the harm they inflict can mirror that of image-based sexual abuse using non-synthetic content.

And when researchers reproduce, test, or analyze these systems using real, unconsenting faces, even in academic settings, they risk compounding the very harm they seek to understand.

Researchers themselves are not a loophole for ethical consent. No one should be asked, whether directly or implicitly, to supply their own photo or anyone else’s for system testing. Even with consent, the ethics are murky. Does the consenting individual truly understand the long-term risks — from dataset leaks to future model misuse? Do they truly feel comfortable saying no to a direct supervisor? Consent in this context is complicated by power dynamics, institutional pressure, and the unforeseeable life cycle of machine learning artifacts. We must not study abuse by recreating it.

In our ongoing work, we are exploring the use of fully synthetic human subjects: AI-generated image inputs that allow system behavior to be studied without creating new victims (we use images with covered faces as AI systems may replicate real people’s identities when generating content). But ethics go beyond inputs. Researchers must also reflect on the implications of storing, analyzing, and sharing these outputs, and build systems that minimize harm throughout the research pipeline.

For those considering research in this space, we offer the following as minimum recommendations:

Think critically about consent in both your dataset and your team structure. What would it mean to design research that harms no one — not even in the process of studying harm? Consider synthetic imagery, anonymization, or other alternatives that decenter real identities, while looking for methods that empower researchers and protect them.

Develop clear internal protocols for physical, financial, and psychological safety. This includes opt-out policies, content warnings, as well as protections as safety precautions like burner accounts and devices and open options to rotate, pause, or exit work. For us, this meant a designated on-call mental health professional and internal systems to warn against graphic content before it was opened, and researchers used burner emails to create their accounts on each nudification website.

Discuss ethics continuously. When working with potentially traumatizing material, your first approval shouldn’t be your last conversation about ethics. IRB signoff is a starting point, not a finish line.

Realize that IRB is not sufficient.  Some of the most pressing ethical risks such as long-term psychological harm, reputational risk to image subjects, or the replication of abusive dynamics may fall outside the scope of traditional IRB frameworks. Researchers need to go further by engaging deeply in their own ethical analyses.

Recognize that even consent has limits.  A person’s agreement does not automatically make a methodology ethical, especially in research involving long-term and unknown risks when no one knows where AI will be in the next month, let alone in five years. Power dynamics can cloud what “freely given” really means, and the downstream consequences of reusing a real person’s likeness may not be foreseeable at the time of consent. Consent must be treated as an ongoing process and as one layer of ethical consideration; not the final word.

The abuse we studied isn’t just technical. It’s intimate, interpersonal, and deeply rooted in power –  both the power these tools simulate, and the power they give to those who use them.  Studying this ecosystem responsibly demands more than rigor. It demands reflection, caution, and care for both the people in the images and the researchers themselves.