Old Tricks, New Models: How Simple Image Transformations Break Modern AI-based Content Moderation
For developers and policymakers relying on AI-based content moderation, this shows that foundation-model-based APIs are not inherently more robust than conventional classifiers and require layered defenses.
The paper evaluates three commercial image-moderation services and finds that all can be bypassed with simple image transformations, such as color inversion and grayscale conversion, which preserve human-recognizable content but cause unsafe-to-safe decision changes. Robustness varies across datasets and harm categories, with multimodal content and self-harm being particularly vulnerable.
While automated content-moderation systems have become essential for screening harmful content at scale, conventional task-specific classifiers often provide limited policy cov- erage and contextual understanding. Recently, commercial multimodal moderation APIs built on large foundation models have been introduced with the promise of providing broader and more capable safety filters. In this work, we analyze whether this shift also yields more robust image moderation. We conduct a large-scale black-box evaluation on three established commercial image-moderation services and compare their robustness. By evaluating seven simple, model-agnostic image transformations across multiple providers, datasets, harm categories, perceptual-similarity constraints, and transformation intensities, we find that: (1) all three commercial services can be bypassed using inexpensive image transformations that require no gradients, surrogate models, or knowledge of the target system; (2) even fixed transformations such as color inversion and grayscale conversion induce unsafe-to-safe decision changes while preserving content that remains recognizable to humans; (3) their robustness varies substantially across datasets and harm categories, with multimodal content and self-harm exhibiting pronounced vulnerabilities. This yields the conclusion that replacing conventional moderation classifiers with foundation-model-based APIs does not, by itself, provide a reliable security boundary. Such systems must be evaluated under realistic transformations and deployed as one component of a layered moderation pipeline rather than as standalone safety filters.