Classifying by Proxy: Explainable and Reproducible Ensemble of Proxy Tasks for Child Sexual Abuse Imagery Classification

Detecting Child Sexual Abuse Imagery (CSAI) is a high-stakes challenge. Technical difficulty is compounded by extreme ethical and legal constraints. Because the underlying data is highly sensitive, researchers often cannot share datasets. They also cannot distribute the models they train. This leads to a crisis of reproducibility and validation in the field. Most automated systems used by law enforcement act as "black boxes." They lack the explainability (the ability to understand why a model made a decision) required for forensic accountability. They also struggle to comply with emerging regulations like the EU AI Act.

This paper proposes a way to bypass these constraints using "Proxy Tasks." These are sub-tasks that correlate with the target goal. They can be trained on openly accessible, non-sensitive data. Instead of training a single massive model on illegal imagery, the authors build an ensemble (a group of multiple models) of specialized tasks. These include age estimation, nudity detection, and pose estimation. I find the core premise compelling (~85% confident). By shifting intelligence into discrete, interpretable modules, you can build a high-performance classifier. This system is both distributable and explainable without exposing raw, sensitive training data to the public.

The bottleneck of sensitive data regimes

The status quo in CSAI classification involves a tension between performance and security. Traditional deep learning approaches often require fine-tuning (adjusting a pre-trained model) directly on sensitive datasets. However, models trained directly on CSAI are vulnerable to model inversion attacks. In these attacks, sensitive information from training images can be reconstructed from model parameters. This makes it legally and ethically impossible to distribute these models openly.

Consequently, most research in this domain suffers from a lack of transparency. Studies are often irreproducible because datasets are locked behind law enforcement agency (LEA) gates. Furthermore, even when models are successful, they frequently lack explainability. A single, high-capacity transformer might correctly flag an image. However, it cannot tell a human investigator why it flagged it. It cannot specify if the cause was a child, specific nudity, or scene context. This lack of "why" is a significant hurdle for forensic applications. The rationale for a classification must be documented and defensible.

Building an ensemble of proxies

To resolve this, the authors implement the Ensemble for Inference in Sensitive data using Proxy Tasks (EISP) framework, as shown in .

The architecture avoids direct training on sensitive material through a three-stage pipeline:

1. Feature Extraction: The system passes images through seven distinct "Proxy Task" models. These are off-the-shelf, pre-trained models. They perform tasks like Nudity Classification, Object Detection, Pose Detection, Scene Classification, Age/Gender Prediction, and ITA Skin Tone estimation.
2. Dimensionality Reduction: To ensure the system remains lightweight for LEA hardware, the authors apply Principal Component Analysis (PCA). PCA is a technique used to compress data while keeping its most important patterns. They optimize this by ensuring each feature retains at least 80% of its explained variance ratio. This compresses high-dimensional latent spaces (mathematical representations of data) into manageable vectors.
3. Ensemble Inference: These compressed features are concatenated (joined together) into a higher-order vector space. They are then fed into an XGBoost model. XGBoost is a gradient boosting algorithm that excels at combining disparate signals.

By using this modular approach, the "knowledge" is distributed across the proxy models. Only the final, lightweight XGBoost ensemble interacts with the sensitive feature vectors. This means the bulk of the system's logic stays in models that have never "seen" a prohibited image.

Competitive accuracy through task modularity

The empirical results suggest that modularity does not sacrifice performance. The authors report that their best Proxy Task combination, using PCA-processed features, achieved a balanced accuracy of 91.9% on the RCPD dataset during validation. When moving to the test subset, the best combination yielded 87.0% balanced accuracy, 84.0% recall, and 82.9% precision [Table 3]. High recall is particularly important here, as it indicates the model's ability to correctly identify most actual cases of CSAI.

Crucially, the paper compares this ensemble against a state-of-the-art representation learning baseline, DINO (specifically DINO-vits8). DINO is a powerful general-purpose vision transformer. The authors find that the Proxy Task ensemble outperforms it in both accuracy and precision. For example, on the test subset, the EISP Best Combination (PCA) achieved 87.0% balanced accuracy. Meanwhile, the DINO + XGBoost (PCA) baseline reached 86.1% [Table 3].

Beyond mere metrics, the architecture provides a direct path to explainability. By utilizing SHAP (Shapley Additive Explanations) values, the system quantifies how much each proxy task contributed to a prediction. As shown in, the Nudity classification and Age/Gender tasks are the most influential features.

This allows an investigator to see the driver of a classification. They can determine if a signal came from "Nudity" or "Age" rather than a noisy background.

Practical constraints and hidden biases

While the results are impressive, a practitioner should be wary of several limitations. First, the "distributability" claim is nuanced. While the proxy models and the feature extraction pipeline can be shared, the final XGBoost ensemble must be trained on sensitive feature vectors. Therefore, the final weights of the classifier remain restricted and cannot be published.

Second, the system's reliance on facial detection introduces a blind spot. The Age/Gender and ITA Skin Tone proxy tasks require detectable faces to function. For images where no face is visible, these models return a zero vector. The authors acknowledge that roughly 10% of the RCPD dataset lacks visible faces. This means the ensemble's performance may degrade in those specific cases.

Third, I noticed a potential issue regarding dataset bias. The authors admit that the RCPD dataset has a predominance of lighter-skinned individuals. This may limit the model's ability to generalize to more diverse populations. If the proxy tasks themselves are biased, the system could inherit or amplify these errors. This could lead to uneven error rates across different demographic groups.

The verdict: A scalable blueprint for sensitive AI

Is this a viable path forward for sensitive domain AI? Yes, depending on your definition of "solved." If you want a single, monolithic model that can be trained in a vacuum, this isn't it. But if you are building a forensic tool, this approach is highly effective. It satisfies both legal scrutiny and hardware limitations.

The paper proves that explainable, task-specific features can match or exceed the performance of high-capacity, black-box models like DINO. By decoupling "understanding" (the proxy tasks) from "decision" (the ensemble), the authors created a framework that is easier to audit. It is also harder to exploit via model inversion. For anyone working in highly regulated sectors, the EISP framework provides a rigorous template. It prioritizes safety and interpretability without sacrificing predictive power. The code is reportedly available via the araceli-project/eisp and araceli-project/EISPCSAI repositories.

Figures from the paper