OpenRouter to screen all inference requests for CSAM, including ZDR traffic
OpenRouter will screen all inference requests passing through its service for child sexual abuse material (CSAM), the company said in a blog post. Screening happens in flight, and content flagged as potential CSAM may be retained for human review, with reporting and preservation where required by law.
- OpenRouter will screen all inference requests for CSAM in flight, during request processing.
- Screening combines hash matching against known CSAM with review of suspected new material.
- Flagged content may be retained for human review, with reporting and preservation where required by law.
- ZDR traffic is also screened; OpenRouter says retention for ZDR content is limited to explicit storage choices and CSAM review, reporting and legal preservation.
- Provider policies on screening and retention may differ, and OpenRouter advises users to review them.
How the screening works
According to OpenRouter, the screening has two parts. The first is known CSAM detection, which compares applicable content against hashes (digital fingerprints) of previously identified CSAM. The second is review of suspected new CSAM: OpenRouter says it may begin retaining content flagged as potential CSAM for human review, including content that does not match a known hash.
The company stresses that a flag indicates suspected material and is not itself a determination that the content is CSAM. It explains that hash matching detects known material, while classifiers can identify suspected material that has not yet been added to a hash database.
OpenRouter points to guidance from the National Center for Missing & Exploited Children (NCMEC), which recommends hashing and image classifiers as basic child-safety measures for services handling images and video, including generative AI services.
Zero Data Retention traffic is covered too
The screening also applies to requests covered by OpenRouter's Zero Data Retention (ZDR) policy. The company says it is updating its documentation and related terms to make its own retention commitment explicit. For ZDR-covered inference content, OpenRouter says it does not retain prompts or responses after processing. There are two exceptions: when a user explicitly chooses to have OpenRouter store them, or when retention is needed for CSAM review, reporting, and related legal preservation.
OpenRouter states that these CSAM provisions do not authorize general retention of ZDR inference content for unrelated purposes. Its commitment not to use inputs or outputs for model training continues, according to the post, which refers to its Privacy Policy.
Legal reporting and preservation duties
OpenRouter describes CSAM reporting and preservation duties as established legal obligations that ZDR does not remove. Under U.S. law, it says, covered providers must report to NCMEC's CyberTipline as soon as reasonably possible after obtaining actual knowledge of facts or circumstances indicating specified apparent offenses. Reported contents and certain related contextual material must be preserved for one year after submission.
The company notes that this requirement applies to reported material, rather than to every item flagged for review. It cites 18 U.S.C. § 2258A(a) and (h).
What it means for users
OpenRouter says model labs and providers may use different screening and retention methods. Some may retain content for a period of time to run automated safety checks before anything has been flagged. According to the company, those practices are separate from its in-flight screening and are governed by the applicable model and provider policies.
OpenRouter documents provider policies so users can see the requirements that apply to their requests. It advises users to review those policies when choosing a model or provider, especially if their organization has specific data-retention requirements.
The company says it is updating its documentation and related terms to describe the in-flight screening, the possible retention of flagged content, and how provider policies are represented, and that it will keep users informed.
OpenRouter: CSAM Screening Across OpenRouter
