Monet: Measuring the Ecosystem of Open-Source Text-to-Image Models Tailored for Harmful Services
arXiv:2609.24134v1 [cs.CR] 21 Sep 2026
Zihao Wang1 , Jiacen Xu2 , Zilong Lin1 1 University of Missouri-Kansas City, 2 Microsoft
Abstract
adoption by end users, this progress has spawned a rapidly growing ecosystem that builds, fine-tunes, redistributes, and deploys T2I models for specialized purposes. Model-sharing hubs such as Civitai [66], LiblibAI [65], and Hugging Face [52] further accelerate this ecosystem by offering infrastructure for hosting, discovering, and reusing open-source T2I models. While many of these models support benign creative applications, the same ecosystem also hosts models deliberately tailored for harmful services, explicitly prohibited or restricted by platform policies. We refer to such harmfulservice-tailored open-source T2I models as Monets. Prior work has touched on pieces of this problem: one study examined abusive models solely on Civitai, focusing on NSFW (Not Safe For Work) and deepfake models [113], while others have proposed approaches for poisoning model hubs with harmful models [92]. These efforts, however, focus on isolated corners of a much larger ecosystem. In practice, a Monet does not exist in isolation: it is developed and hosted on one platform, mirrored across others, preserved through mechanisms that evade platform moderation and model guardrails, monetized via external storefronts and coordinated campaigns, and ultimately deployed in downstream services. Yet little is known about this end-to-end ecosystem. Our work. To address this gap, we present the first systematic, ecosystem-level measurement study of Monets. Specifically, we collected 23,947 Monets from eight major T2I model hubs—Civitai, CivArchive, LiblibAI, Hugging Face, ModelScope, SeaArt, Shakker, and TensorArt—spanning October 2022 to May 2026. To understand the Monet ecosystem, we investigate four research questions: RQ1: what are the characteristics of Monets? RQ2: how do Monets propagate across model hubs and evade governance mechanisms? RQ3: how are Monets promoted and monetized across the ecosystem? RQ4: how are Monets adopted and used in downstream applications and services? Together, these questions paint an ecosystem-level picture of Monets, spanning their characteristics, cross-platform proliferation and persistence, commercial operations, and real-world downstream deployment. Our findings. Our study reveals that Monets not only rep-
The open-source text-to-image (T2I) ecosystem enables rapid model development and sharing, but also hosts models intentionally tailored for harmful services, which we call Monets. Prior work has examined specific types of harmful T2I models on individual platforms, but a Monet does not exist in isolation. The broader Monet ecosystem, spanning model characteristics, cross-platform propagation, governance evasion, monetization, and downstream deployment, remains poorly understood. In this study, we present the first systematic, ecosystemlevel measurement of Monets. Grounded in the policies of real-world model hubs, we construct a taxonomy of ten harmful service categories and identify 23,947 Monets across eight major T2I model hubs, with the most popular exceeding 19 million downloads. While some developers employ antitheft mechanisms against unauthorized re-uploading, Monets propagate across platforms at scale, with 40.76% mirrored across hubs. Such propagation further enables governance evasion via cross-platform archiving, keeping 11.99% of Monets accessible after bans on their original platforms, alongside other evasion strategies including keyword obfuscation and model-level safeguard circumvention. Monets also anchor coordinated commercial campaigns—one spanning 668 models with 914 completed commissions and another advertising gray-market account-farming service—and reach users through GitHub projects and inference APIs, raising downstream child safety concerns. These findings expose the limitations of platform-siloed defenses and highlight the need for cross-platform threat intelligence, coordinated governance, and technical safeguards.
1
Introduction
Recent advances in generative AI, particularly text-toimage (T2I) generation, have significantly lowered the barrier to creating high-quality visual content. Beyond widespread 1
resent a content-moderation challenge, but also constitute a sophisticated, multi-platform commercial ecosystem with resilient distribution and real-world harm. RQ1: Monet characteristics. Monets are widely distributed across all eight hubs, with Civitai and CivArchive alone hosting 79.33% of collected models. Their popularity is substantial: 12 models such as WAI-NSFW-illustrious-SDXL [47] have accumulated over one million downloads. 75.74% target sexual and nude content generation, followed by intellectual property infringement (37.85%) and violence content (3.91%) (see §4.2). The training data are equally concerning: developers not only rely on harmful datasets hosted on model hubs but also collect images directly from social media accounts of identifiable individuals (see §4.3). Some Monets insert sensitive terms in model metadata as an anti-theft method, exploiting strict platform moderation as a deterrent (see §4.1). RQ2: Propagation and governance evasion. Rather than being contained by platform moderation, Monets actively spread across platforms and evade governance. 40.76% of collected Monets are mirrored across platforms by model hubs themselves, while 8.74% carry developer-embedded model referral links maintaining cross-platform availability (see §5.1). Notably, CivArchive—a platform that publishes no content policy—has emerged as a centralized refuge, in which 11.99% of the Monets had already been banned from their original platforms yet remain freely accessible (see §5.2). Also, we witnessed a sudden mass migration of Monets from Civitai to CivArchive on April 24, 2025, immediately following Civitai’s policy tightening the previous day (see §4.1). RQ3: Promotion and monetization. Monets are not merely shared for free. They also anchor commercial operations (see §5.3). Developers embed external links in model metadata directing users to paid-access platforms, to sell premium model versions, custom training services, and created image sets. Beyond individual monetization, we uncover coordinated campaigns using the principle of guilt by association [111]: one campaign of 668 Monets spans three platforms and operates a commission-based model-development service with 914 completed commissions; another uses deepfake and pornographic models as advertising channels for AI-assisted social-media account-farming services targeting TikTok and RedNote [84]. RQ4: Downstream deployment. We identified 1,102 GitHub projects integrating Monets and two AI API providers providing APIs for 3,930 Monets. The GitHub projects range from research artifacts to NSFW chat. Several combine uncensored large language models (LLMs) with NSFW Monets to enable role-play interactions. In at least one case (see §6), such interactions involve characters explicitly portrayed as minors, raising serious concerns about the potential generation of child sexual abuse material (CSAM). Contributions. Our primary contributions are as follows: • Ecosystem-level measurement. We perform the first systematic measurement study of Monets from an ecosystem perspective. We characterize 23,947 Monets collected from
eight major T2I model hubs, covering model characteristics, cross-platform propagation, governance evasion, monetization, and downstream deployment. • Characterization of Monets and their resilience across platforms. We characterize Monets across prevalence, technical foundations, and advertised harmful services, and empirically assess their capabilities of generating harmful content. We also show that, driven by both model hubs and developers, Monets propagate at scale across platforms and actively evade governance through cross-platform archiving, keyword obfuscation, and the circumvention of model-level safeguards. • Exposure of Monet monetization and downstream abuse. We reveal that Monets anchor organized monetization pipelines, including commission-based model-development and graymarket campaigns, orchestrated across platforms. We also show Monets reach real-world deployments through GitHub projects and hosted inference APIs, with downstream deployment raising potential child sexual abuse material risks.
2
Background and Related Work
2.1 Text-to-Image Models and Their OpenSource Ecosystem Recent years have witnessed rapid progress in T2I generation, largely driven by advances in generative modeling. Early textconditioned image generation relied on GAN-based and autoregressive Transformer-based models [89, 106, 121], which were often constrained by limited image fidelity. Modern open-source T2I models are predominantly built on two generative paradigms [95]: denoising diffusion and flow matching, both of which generate images by progressively transforming noise into structured outputs. The release of Stable Diffusion [107], a representative model of the denoising diffusion paradigm, marked a pivotal moment for the opensource T2I ecosystem by enabling high-quality image generation with relatively modest computational requirements. Many popular T2I base models follow this denoising diffusion paradigm, including SDXL [103] and derivatives built upon it, such as Illustrious [102] and NoobAI [34]. Flow matching, a closely related generative paradigm, was later adopted by open-source large-scale T2I models such as Stable Diffusion 3.5 and FLUX.1. In this study, we summarize the distribution of base-model generative paradigms and families among the collected Monets in §4.3. The open release of these T2I models has fostered a large community of developers who create fine-tuned variants, Low-Rank Adaptation (LoRA) modules [96], and taskspecific checkpoints. As a result, model hubs such as Civitai, CivArchive, and Hugging Face have emerged as major platforms for sharing T2I models. Unlike conventional model hubs that host model files directly, CivArchive operates as a 2
cross-platform model aggregator, providing model metadata and referral links to model files hosted on other platforms [49].
ModelScope
Misuse of Text-to-Image Models
2 Artifacts
Practical Taxonomy of Harmful Model Services
Keyword-based Artifact Retrieval Artifact tags, T2I model checker
LiblibAI
To trigger T2I models to create harmful content, various attack approaches have been proposed, such as jailbreaking [99,117], plugin poisoning [92] and concept restoration [123]. In addition, T2I models have been widely misused in harmful applications such as image-based sexual abuse [94], deepfake generation [87], hateful content [105], and intellectual property infringement [91]. The prevalence of open-source T2I models has further lowered technical barriers, making such capabilities increasingly accessible and scalable. More recently, Wei et al. [113] conducted an empirical analysis of Civitai, investigating abusive generative AI models, especially deepfake and NSFW-oriented models, and the produced images hosted on Civitai. However, existing studies have largely focused on specific categories of harmful models themselves and individual platforms. Consequently, the broader ecosystem of harmful T2I models in practice remains underexplored. Our work fills this gap via a systematic ecosystem-level study of T2I models tailored for harmful services across major open-source T2I model hubs. Grounded in the explicit usage policies of these hubs, we build a taxonomy of prohibited harmful services and characterize the identified Monets across multiple dimensions: model characteristics, propagation, governance evasion, monetization, and real-world deployment.
2.3
1 Policies
Keywords
CivArchive
2.2
Hugging Face
Civitai
Shakker 3 T2I Model Identification
TensorArt
SeaArt
Text-to-Image Model Hubs
Harmful service classifier
4 Harmful Service Classification
Figure 1: Workflow of discovering Monets from open-source T2I model hubs. capabilities of general-purpose T2I models [105], our objective is fundamentally different: instead of studying harmful capabilities of general-purpose T2I models, we explore the ecosystem of T2I models intentionally tailored for harmful services. The harmful services considered in this work are derived from the usage policies of the major open-source T2I model hubs and organized into ten categories (see §3.2).
3
Data Collection
In this section, we present our pipeline for discovering open-source T2I models explicitly advertised as tailored for harmful services across T2I model hubs.
Threat Model
3.1
Threat scenario. We consider an adversarial ecosystem in which developers tailor open-source T2I models capable of generating harmful content (i.e., Monets) and publish them on open-source T2I model hubs in violation of platform policies [25, 44, 52, 64– 66]. These Monets explicitly advertise their harmful purposes, while developers distribute them across multiple hubs, circumvent platform governance mechanisms, and monetize them through external services and communities. Downstream actors, including users and API providers, may further adopt these Monets to provide on-demand image-generation services. Within this ecosystem, the mechanisms of propagation and archival across model hubs allow Monets to remain accessible even after removal from individual platforms. Research scope. Our study focuses exclusively on publicly accessible open-source T2I models explicitly advertised as tailored for harmful services and the ecosystem surrounding them. We exclude models exclusively designed for image-toimage or text-to-video generation, as well as closed-source T2I models. Although prior work has assessed the harmful
Overview
To systematically study the Monet ecosystem, we collected Monets from eight major hubs hosting T2I models—Civitai, CivArchive, LiblibAI, Hugging Face, ModelScope, Shakker, TensorArt, and SeaArt—following prior work [71, 113, 120]. Figure 1 illustrates an overview of the Monet discovery workflow. It includes practical taxonomy construction (❶) and a discovery and classification pipeline consisting of three stages: keyword-based artifact retrieval (❷), T2I model identification (❸), and harmful service classification (❹). We begin by constructing a practical taxonomy of harmful model services by systematically analyzing prohibited or restricted services explicitly defined in the usage policies of real-world model hubs. The resulting taxonomy is summarized in Table 1. Then, based on this taxonomy, we derive harmful-service-related keywords and retrieve candidate models from these hubs. Finally, we identify T2I models from retrieved results and classify them into harmful service categories based on their advertised services in model metadata, which are often documented in the form of model cards [100], including titles, tags, descriptions, and demo content. 3
3.2
Methodology
diverse artifacts beyond T2I models, including LLMs, embeddings, datasets, and repositories, we further identified T2I models from retrieved results. Specifically, following prior work [113], we extracted checkpoint models (i.e., full model weights) and LoRA models (i.e., fine-tuned adapters) as candidate models based on artifact types tagged in metadata, yielding 42,906 candidate models. We then applied a T2I model checker assisted by a multimodal LLM (MLLM) to determine whether each candidate model in the form of checkpoint or LoRA supports T2I generation, by analyzing model metadata including titles, tags, descriptions, and demo content. The checker uses a 3-point confidence rubric1 , treating a model as T2I if its metadata either (1) explicitly states support for T2I generation or (2) showcases demo images created from text prompts. We retained artifacts that received the highest confidence score as T2I models. In this way, we gathered a total of 28,948 T2I models. • Harmful service classification. Finally, we classified the collected T2I models into 18 groups—17 harmful service subcategories summarized in Table 1 and one harmless group. As the de facto standard for documenting AI models, model cards [100] describe models’ purposes and have been used for such analysis in prior studies [98, 104]. Thus, we use an MLLM-assisted classifier to analyze model metadata within model cards. Since a single model may support multiple harmful services, we adopt a multi-label setting, i.e., the classifier assigns subcategories using a 4-point confidence rubric2 , retaining all subcategories that receive the highest confidence score. Models assigned at least one harmful service subcategory are identified as Monets, while those not assigned any harmful service subcategory with the highest confidence score are placed in the harmless group. In this way, we identified a total of 23,947 Monets from eight major T2I model hubs3 , including 10,678 in Civitai, 8,318 in CivArchive, 1,708 in LiblibAI, 621 in Hugging Face, 20 in ModelScope, 806 in SeaArt, 1,015 in Shakker, and 781 in TensorArt.
Constructing practical taxonomy of harmful model services. Defining “harmful” services is challenging, as legal regulations and social norms vary significantly across jurisdictions. For example, pornographic content may be legally permissible in some countries but strictly prohibited in others. Rather than attempting to establish a universal definition of harmfulness, we adopt an ecosystem-grounded definition and define harmful model services as services that are explicitly prohibited or restricted by major model hubs within the open-source T2I ecosystem. To operationalize this definition, we systematically analyzed the governance policies of seven major T2I model hubs (i.e., Civitai, LiblibAI, Hugging Face, ModelScope, Shakker, TensorArt, SeaArt) [25, 44, 52, 64–67], representing the dominant norms and restrictions of this ecosystem. We aggregate the services prohibited or restricted by these policies and treat their union as the harmful services recognized by the open-source T2I ecosystem. Note that CivArchive publishes no usage policy or content guidelines, which reflects its positioning as an unrestricted archive (see §5.2) [49]. To characterize such services, two experts independently annotated these policy provisions from seven major hubs. The annotators grouped semantically related services into unified categories, achieving high inter-annotator agreement (Cohen’s κ = 0.90). Disagreements were resolved via discussion. In this way, we identified 10 categories of harmful model services commonly recognized across the open-source T2I ecosystem in the real world, forming our practical taxonomy of harmful model services, as listed in Table 1. Discovering and classifying Monets. As outlined in §1, our study focuses on T2I models intentionally tailored to provide harmful services, rather than general-purpose T2I models. Our goal is thus to identify models explicitly advertised for harmful purposes by developers, via a three-stage discovery pipeline: (1) keyword-based artifact retrieval, (2) T2I model identification, and (3) harmful service classification. Given that model versions may contain distinct model cards and files, we count different versions and cross-hub copies separately. • Keyword-based artifact retrieval. Based on the practical taxonomy, we manually derived 99 keywords by extracting representative terms from hubs’ policies for each harmful service category. Examples include “NSFW,” “nudify,” “weapon,” and “suicide.” We selected 10 keywords per category, except Category H, for which only nine were available due to limited relevant policy provisions. We used these keywords to query the search engines of model hubs and collected the returned artifacts. Note that as our study focuses on the publicly advertised Monet ecosystem rather than exhaustively enumerating all harmful T2I models (§2.3), keyword-based retrieval aligns with our scope by targeting models that expose explicit harmful-service signals in searchable metadata. • T2I model identification. Because model hubs often host
3.3
Evaluation
Implementation. In this study, we employed GPT-5 [54] as the MLLM backbone for both the T2I model checker and the harmful service classifier. Validation. To evaluate the effectiveness of our pipeline, we conducted post-hoc human validation for both T2I model checking and harmful service classification. Two experts with prior experience in AI ecosystems independently annotated the sampled artifacts. They resolved disagreements via discussion, forming the ground truth for evaluation. The annotation criteria for these tasks were aligned with the system prompts 1 Higher confidence scores indicate stronger evidence that the candidate model supports T2I generation according to its metadata. 2 Higher confidence scores indicate stronger evidence that the T2I model offers a service related to a harmful subcategory based on its metadata. 3 The data was updated as of May 31, 2026
4
Table 1: Practical taxonomy of harmful model services summarized from T2I model hubs. Model hubs**
Category
Subcategory
# Monets*
Sex and Nudity
A1. Minors in sexual contexts A2. Coercive/illegal sexual acts A3. Explicit organs/fluids/fetish A4. Sexualized posing/angles/props A5. Realistic-style sexual content
1,105 949 9,623 17,499 5,934
– – – – –
Real-person likeness/deepfakes
B1. Real-person likeness/deepfakes
935
–
Violence, gore, and horror
C1. Death/dismemberment/injuries C2. Cruel violence and abuse C3. Horror and terror
128 731 197
– – –
Hate, harassment, and extremism
D1. Hate, harassment, and extremism
1
–
Illegal and regulated activities
E1. Illegal drugs and regulated goods E2. Intimidating criminal conduct
14 46
– –
Self-harm and dangerous behaviors F1. Self-harm and dangerous behaviors
18
–
Political misinformation
G1. Political misinformation
20
–
Health and medical information
H1. Health and medical information
4
–
Intellectual property infringement
I1. Intellectual property infringement
9,065
–
Spam and deception
J1. Spam and deception
58
–
Civitai Hugging Face Shakker LiblibAI TensorArt ModelScope SeaArt CivArchive
*
Each identified Monet belongs to one or more subcategories. Subcategories within the same category are not mutually exclusive. ** indicates that the corresponding hub’s policy prohibits or restricts the subcategory; otherwise. The taxonomy aggregates such policy-defined services across the seven hubs.
of the T2I model checker and harmful service classifier. • T2I model checking. We randomly sampled 500 models from 42,906 candidate models. Two human annotators achieved an inter-annotator agreement of Cohen’s κ = 0.88. Compared to the ground truth, the T2I model checker achieved an accuracy of 92.00%, with a precision of 100.00% and a recall of 90.15%. • Harmful service classification. We randomly sampled 500 models from 28,948 T2I models. Since harmful service classification adopts a multi-label setting, we reported raw agreement rates. Human annotators achieved a raw inter-annotator agreement rate of 93.65%. Against the ground truth, the harmful service classifier achieved an accuracy of 90.00%, with a precision of 88.19% and a recall of 93.72%.
As shown in Fig. 2, the largest spike in Monet creation occurred in April 2025, with 61.87% of Monets created in that month hosted on CivArchive. Based on their metadata, 78.91% of them were uploaded to CivArchive on April 24, 2025, originating from Civitai. This indicates a sudden, largescale migration of Monets from Civitai to CivArchive. Notably, this migration closely coincides with Civitai’s policy update on April 23, 2025, which introduced stricter contentsafety requirements [60], suggesting that policy changes may have influenced developers’ platform-selection decisions and contributed to the observed migration of Monets. Meanwhile, Civitai’s policy change had little impact on the number of newly-created Civitai Monets, decreasing slightly from 451 in April 2025 to 446 in May. Details of Monets’ cross-platform propagation and archiving are discussed in §5.1 and §5.2.
4
Takeaway 1. A rapid migration of Monets to CivArchive, a less-moderated platform, immediately followed Civitai’s policy update on April 23, 2025, highlighting how crossplatform migration can coincide with stricter platform governance while allowing harmful models to remain accessible elsewhere.
4.1
Landscape of Monets Scope and Magnitude
Distribution and growth. As mentioned in §3, we identified 23,947 Monets across eight major T2I model hubs. As shown in Fig. 2, the earliest appeared on Hugging Face in October 2022, including sd-naruto-diffusers [11], sdpokemon-diffusers [8], and Zack3D_Kinky-v1 [12], tailored for intellectual-property characters and fetish-related content. Among the surveyed hubs, Civitai hosts the largest number of Monets (10,678), followed by CivArchive (8,318) and LiblibAI (1,708), suggesting that Civitai serves as the primary hub for Monet hosting. CivArchive has also emerged as a major hub, due to its aggregation-oriented design and the absence of published content restrictions (see §5.1 and §5.2).
Usage and popularity. We collected downloads and “like” counts from each Monet’s metadata. Monets average 8,801.09 downloads and 143.36 “likes” each. As shown in Table 2, CivArchive exhibits the highest average downloads, while Civitai leads in average “likes,” suggesting that both platforms play an important role in the dissemination and user engagement of Monets within the open-source T2I ecosystem. At the model level, WAI-NSFW-illustrious-SDXL [47] and Murky’s - After Sex Lying LoRA [19], both targeting sexual 5
1800
Civitai Hugging Face Shakker LiblibAI TensorArt ModelScope SeaArt CivArchive
1676
Number of created models
1500
1200 1011 924
900
816
850
573
853 863
830
796
751 765
760 682
643
600
970
890 888
623
593
622
466
442 341 272
300 129 15
24
19
17
316 241
364 260
299
254
301
646
564
540
505
332
161
60
0 Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May
2022
2023
2024
2025
2026
Figure 2: Temporal growth of Monets newly created on eight T2I model hubs. Table 2: Average downloads and “likes” of Monets on T2I model hubs. Rank
Model hub
Ave. downloads*
Model hub
1 2 3 4 5 6 7 8
CivArchive Civitai Hugging Face ModelScope SeaArt LiblibAI Shakker TensorArt
23,023.41 1,549.27 699.02 580.70 172.20 116.87 42.75 2.79
Civitai SeaArt TensorArt Hugging Face LiblibAI ModelScope Shakker CivArchive
*
Takeaway 2. Some Monet developers embed a long but incoherent paragraph of sensitive keywords in model cards as an anti-theft mechanism, exploiting platform moderation systems to deter or penalize model re-uploading.
Ave. “likes” 201.85 31.64 29.81 14.76 12.94 8.20 4.91 N/A**
Textual triggers. The textual trigger is a sequence of one or more specific tokens whose presence in an input prompt activates a learned style, character, or concept of a model [77,110]. Among the Monets analyzed, 18,483 (77.19%) disclose identifiable textual triggers, either through structured metadata fields or model descriptions. Specifically, 17,950 Monets provide triggers in structured fields, while an additional 533 explicitly specify triggers in their descriptions. Among the Monets with textual triggers, 13,141 (71.10%) specify multiple triggers, with one model Sui-Feng [42] providing as many as 499. In total, we collected 202,617 trigger instances, corresponding to 45,767 unique triggers and an average of 11 triggers per Monet. The most prevalent triggers are “1girl” (3,020 Monets), “long hair” (2,152), and “solo” (1,387). Triggers also vary substantially in complexity: 43.12% (87,362) consist of a single token, while the remainder contain multiple tokens. The longest trigger contains 94 tokens and is associated with Reverse Cowgirl anal [79]. Finally, we examine the semantic relevancy of textual triggers to their corresponding models and target harmful services. Our analysis reveals that a large portion of triggers have limited semantic correspondence with either, implying that many triggers function as model activation tokens rather than explicit descriptions of model functionality or harmful purposes. We provide the detailed semantic analysis in Appendix B.
184 Monets on LiblibAI and 32 on Shakker do not disclose their downloads. CivArchive does not record the “likes” count of each model.
**
and nude content, have the largest numbers of downloads (19 million) and “likes” (14.9K), respectively, reflecting strong user demand for such content within the ecosystem. Authorship. Based on the metadata of the collected Monets, we identified 7,372 developers with unique identifiers in the eight T2I model hubs, with Civitai accounting for the largest share (37.56%). Monet contribution is highly uneven across developers: 14 are each responsible for over 100 models. Anti-theft mechanism. We found that four developers embed 107 politically sensitive Chinese phrases in the model cards of 12 models hosted on Civitai and CivArchive to defend against model theft and scraping. This long but incoherent set of phrases involves Chinese political incidents, politicians, and geopolitics and is unrelated to the model itself. The developers explicitly describe these phrases as an anti-theft mechanism in model cards. The distinctive text allows them to trace model re-uploads (see §5.1), particularly unauthorized ones, through online searches, as exemplified by Female POV [31] and its re-upload on PixAI [76]. Also, when propagated to platforms with strict content moderation, the embedded political terms may trigger automated review or removal of these copies.
4.2 Harmful Services and Capabilities Provided by Monets Harmful services advertised by Monets. Using the harmful service classification framework in §3.2, we identified 10 categories and 17 subcategories of harmful services adver6
tised by Monets, according to their metadata. Among them, 14,921 Monets are labeled with more than one subcategory, and 41 belong to more than five subcategories. As listed in Table 1, “sex and nudity” (A1-A5) is the most popular category— accounting for 75.74% of all identified Monets—followed by “intellectual property infringement” (I1; 37.85%), “violence, gore, and horror” (C1-C3; 3.91%). Harmful capabilities provided by Monets. To validate whether identified Monets can generate harmful content as advertised, we sampled and evaluated them as follows. • Model sampling. We used stratified sampling to cover all harmful service subcategories. For each subcategory, we sampled 11 Monets from those that disclose their base models, obtaining 170 unique Monets in total4 . We also included 18 corresponding base T2I models (see §4.3) for comparison. • Dataset. We used the T2isafety dataset, a benchmark dataset that includes various categories of harmful T2I model prompts [97]. Based on the harmful service subcategories of Monets (see Table 1), we extracted two prompts per subcategory for a total of 34 harmful prompts. To evaluate the capabilities of Monets with developer-specified triggers, we tested each Monet under two settings: prompts with and without triggers. In the former, the trigger sequence specified by its developer was prepended to each prompt. Note that none of the validated base T2I models—which are general-purpose checkpoints—declare developer-specified triggers. • Metrics. To systematically assess Monets’ harmful capability, we evaluated generated images in three dimensions: (1) alignment, measuring whether outputs align with input prompts, scored by an alignment score [109]; (2) quality, assessing perceptual visual quality in terms of structure, color, sharpness, and noise, quantified by a quality score [114]; and (3) harmfulness, judging the harmfulness of images, measured by a harmfulness score [118]. Following prior work [109, 114, 118], all scores range from 1 to 5 and are assigned by Qwen2.5-VL as MLLM-as-a-judge. We validate the MLLM-as-a-judge approach in Appendix D. • Results. As shown in Table 3, Monets achieve overall generation performance comparable to their corresponding base T2I models when evaluated across all sampled prompts. Specifically, “Monets (All)” perform similarly to the base models across all metrics, suggesting that Monets largely retain the general generation capability of their base models. When evaluated on prompts associated with their target harmful services (i.e., “Monets (Target)”), however, Monets outperform the base T2I models overall across all metrics. The improvement is particularly in harmfulness, where the average score increases from 3.07 for the base models to 3.42 without triggers and 3.49 with triggers. These results indicate that Monets are effectively specialized for generating content within their target harmful domains. Developer-specified textual triggers further amplify this
Table 3: Average scores of images generated by Monets and their base models. Trigger*
Models
Alignment
Quality
Harmfulness
2.82 2.91 2.66 3.06 3.01
3.73 3.83 4.00 3.88 4.04
3.07 3.12 3.16 3.42 3.49
Base T2I models Monets (All) Monets (All) Monets (Target)** Monets (Target) *
and indicate prompts with and without triggers, respectively. Monets (Target) includes only outputs generated from prompts corresponding to each Monet’s target harmful service category.
**
Civitai
10678
CivArchive
8318
LiblibAI
1708
Shakker
1015
SeaArt
806
TensorArt
781
Hugging Face
621
Checkpoint LoRA
ModelScope 20 0
2000
4000
6000
8000
10000
Number of models
Figure 3: Model types across eight T2I model hubs. specialization. For “Monets (Target),” enabling triggers further increases image quality and harmfulness, indicating that these trigger sequences activate model behaviors associated with the harmful services. Interestingly, triggers also influence generation across all sampled prompts. For “Monets (All),” enabling triggers improves image quality (3.83 to 4.00) but reduces prompt alignment (2.91 to 2.66), suggesting that triggers steer generation toward the models’ learned styles or target domains even when prompts fall outside their target harmful services. Takeaway 3. Monets are classified into 17 subcategories of harmful services, with “sex and nudity” as the dominant category. Empirical evaluation confirms that Monets are specialized for harmful image generation, outperforming their base models most notably in harmfulness within their target domains.
4.3
Technical Foundations of Monets
Model types and development methods. The collected Monets comprise 1,141 checkpoint models and 22,806 LoRA models. Although LoRA models dominate the ecosystem, their prevalence varies across model hubs. As shown in Fig. 3, TensorArt has the highest proportion of LoRA-based Monets (98.21%), while Hugging Face leads in checkpoint-based Monets (37.04%). We further identify development methods based on model types and explicit disclosures in model metadata. Specifically, Civitai and Hugging Face provide structured development information for some models, while developers may addition-
4 Subcategories D1 and H1 contain fewer than 11 eligible models (see
Table 1), so all available eligible models in these subcategories were tested.
7
ally disclose development methods in model descriptions. We also treat LoRA models as evidence of fine-tuning, as LoRA is a parameter-efficient fine-tuning method [93, 96]. Based on these signals, we identify the development methods of 23,163 Monets. Among them, 22,952 Monets are developed through model fine-tuning, 211 through merging—including 63 that explicitly report merging LoRA models into checkpoints. Base models. By examining model metadata, we found that 22,135 Monets (92.43%) disclose their base models. As listed in Table 7 of Appendix C, we categorize the disclosed base models by model family and generative paradigm (see §2.1). Specifically, Illustrious (7,917) is the most prevalent basemodel family, followed by Stable Diffusion 1.x/2.x (4,812) and Pony (4,779). These families follow community conventions [50, 72] adopted by major model hubs such as Civitai and TensorArt. For example, SDXL-derived families such as Illustrious, Pony, and NoobAI are treated as distinct base models in practice and are therefore listed separately from SDXL. These findings show that Monet development relies heavily on a small number of widely adopted open-source base-model families. Training datasets. Information about training datasets can be obtained from the structured “datasets” field in model metadata or from unstructured context in model descriptions. • Disclosures in structured “datasets” field. We identified 26 models, all hosted on Hugging Face, that explicitly disclose their training datasets in model metadata, covering 22 distinct datasets. Specifically, seven datasets are primarily associated with sexually explicit content, four of which are labeled as “Not-For-All-Audiences” by Hugging Face. Examples include the datasets e621-rising-v3-curated [16] and e621-rising-v3finetuner [17], disclosed by the Monet e621-rising-v3 [18]. Also, three datasets focus on deepfake generation, while another three target intellectual-property characters. In almost all cases, the intended harmful services of a Monet can be traced back to the domains of its training datasets. 11 datasets disclose their data sources in their descriptions: four are generated using existing T2I models, two are compiled from curated image collections, and five are collected from online sources. For example, the dataset e621-risingv3-curated [16] combines content gathered from e621.net, gelbooru.com, safebooru.donmai.us, and rule34.xxx. • Disclosures in model description context. Unlike Hugging Face, other model hubs do not provide structured trainingdataset disclosures. However, Monet developers occasionally reveal data sources in model descriptions. For example, Aviana-v1.0 [28], a “real-person likeness/deepfake” Monet, is tailored to generate images of a specific social-media content creator and states that its training data were collected from the target creator’s OnlyFans, X, Instagram, and Reddit accounts. Beyond this example, we identified 15 additional deepfake Monets that explicitly target specific content creators, reference these individuals in their model names, and state in their descriptions that social-media content from the
Table 4: Counts of Monets with labeled upstream sources across model hubs. Model Hub
Upstream
# Monets
Share in Hub
CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive
Civitai SeaArt Hugging Face TensorArt TensorFiles Tungsten CivitasBay PixAI TensorHub Moescape Yodayo Shakker
5,728 5,222 2,099 1,470 209 166 157 143 58 22 22 12
68.86% 62.78% 25.24% 17.67% 2.51% 2.00% 1.89% 1.72% 0.70% 0.26% 0.26% 0.14%
SeaArt SeaArt
Civitai LiblibAI
749 1
92.93% 0.12%
TensorArt TensorArt TensorArt TensorArt TensorArt
Civitai PixAI Hugging Face LiblibAI SeaArt
297 5 1 1 1
38.03% 0.64% 0.13% 0.13% 0.13%
LiblibAI
–*
387
22.66%
*
LiblibAI only indicates whether a model is mirrored, but does not specify upstream platform.
targeted individuals was used as training data. Takeaway 4. Monet development is supported by readily accessible training data, ranging from harmful datasets openly hosted on model hubs—some explicitly flagged for sensitive content—to social-media images collected from identifiable individuals, raising concerns regarding privacy, consent, and identity misuse.
5
Ecosystem Dynamics of Monets
To expand model collections, model hubs mirror and incorporate models originally hosted on major hubs such as Civitai and CivArchive, as well as smaller ones such as Tungsten [45] and Yodayo [70]. Leveraging this cross-platform model propagation and other methods, Monets also attempt to evade the platform-level moderation and model-level guardrails. Meanwhile, model developers employ various promotion and monetization strategies to increase the reach and profit of related businesses. Overall, such dynamics foster the proliferation of Monets across the ecosystem.
5.1 Propagation of Monets across Model Hubs Platform-led propagation. To expand their model collection, some model hubs mirror model artifacts—including model cards and, in some cases, model files—from other platforms. As shown in Table 4, we identified a total of 9,760 Monets on CivArchive, SeaArt, TensorArt, and LiblibAI that explicitly disclose their upstream sources or mirroring statements within metadata. Specifically, LiblibAI only indicates that a model is mirrored, without specifying its source, while CivArchive, 8
5.2
SeaArt, and TensorArt provide explicit source-platform information for all mirrored models. Notably, as a cross-platform model aggregator (see §2.1), all the 8,318 Monets identified from CivArchive are mirrored from other hubs. To characterize the upstream sources of cross-platform propagation, we identified source models from 13 distinct model hubs based on the metadata of mirrored Monets hosted on CivArchive, SeaArt, and TensorArt. Aligned with the observation in §4.1, Civitai serves as the dominant source hub, contributing the largest number of mirrored Monets across all three platforms. This finding reveals Civitai’s central role as a source hub in the platform-led propagation of Monets. When posting upstream sources, different model hubs adopt different strategies. Specifically, SeaArt and LiblibAI provide only a label “Model Source” or “Mirroring,” while TensorArt exposes links to the original model cards hosted on the source platforms. As a large-scale model aggregator spanning multiple platforms, CivArchive provides the most comprehensive and sophisticated source information. Different from the above three hubs that typically post a single upstream source, CivArchive may associate a model with multiple upstream sources—with an average of 1.84 sources— and record them into two source fields (i.e., “Available-on” and “Mirrors”). The “Available-on” field records links to model cards on upstream platforms, while the “Mirrors” field records direct download links to model files hosted on upstream platforms. As shown in Appendix Table 8, all CivArchive Monets contain at least one “Available-on” entry, while 5,764 (69.30%) include at least one “Mirrors” entry. Notably, CivArchive adopts different source-disclosure strategies for distinct upstream platforms—for example, references to Hugging Face-hosted files appear exclusively in the “Mirrors” field—hinting at its cross-platform archival mechanisms further discussed in §5.2. Developer-led propagation. To promote Monets across multiple model hubs and maintain alternative access paths, developers often include model referral links in model descriptions that direct users to the same model hosted on other hubs. As shown in Appendix Table 9, we collected 2,520 model referral links from 2,093 Monets carrying descriptions in metadata. Among model hubs, Civitai is the most frequently referenced hub, accounting for 47.86% of all model referral links. TensorArt (19.40%) and Hugging Face (12.34%) are the next most frequently referenced hubs. We also observe model referral links pointing to smaller T2I model hubs, such as Yodayo and TensorHub [43], indicating that developers use a diverse set of platforms to increase model exposure and maintain cross-platform availability.
Governance Evasion
In our study, we identified three governance evasion strategies employed by Monets, with two targeting platform moderation and one circumventing model guardrails. Cross-platform model archiving. Originally established to preserve access to models removed from Civitai or other hubs, both CivArchive and SeaArt explicitly archive and redistribute model files from multiple hubs at scale, including models that may violate platform policies [49,83]. Such archival practices are especially common for Monets. However, the two platforms differ in both infrastructure and scope: SeaArt directly mirrors model files on its own platform, while CivArchive operates a more sophisticated archival infrastructure involving external storage and cross-platform references. Moreover, unlike SeaArt, CivArchive publishes no content policy or takedown procedure on its website [49], and its contribution guide imposes no restrictions on what may be indexed [46]—offering a more tolerant environment for harmful content. These factors make CivArchive the most critical platform for archiving cross-platform Monets, as reflected in Table 4. We thus focus on CivArchive and examine its archival practices from three aspects: the archival mechanism, archival repositories, and banned-but-alive models. • Archival mechanism. Based on CivArchive’s upload guidance [46], Hugging Face serves as its primary archival platform for storing model files. CivArchive surfaces these archived files to users via “Mirrors” entries (see §5.1). Further examining Hugging Face model files referenced by “Mirrors” entries across 2,099 CivArchive Monets that carry such references (see Table 4), we collected 3,820 unique mirrored model files hosted across 942 Hugging Face repositories, uploaded by only 424 unique accounts. This indicates that archiving is concentrated among a small group of repositories and users. • Archival repositories. Deeper analysis reveals a concentrated archival pattern in repositories. Among the 942 repositories, 74.84% of them host model files that belong to multiple distinct models, and 34.39% of the repositories each host over 100 model files. For instance, by matching file names, we found that the repositories loras [22] and Zacygiz_lora [26] host an identical set of 9,982 files, approaching Hugging Face’s 10k-per-folder ceiling [82], of which 365 are identified Monets. Such volumes indicate that archival uploads are performed at scale, consistent with CivArchive’s upload guidance [46]. Also, 80.47% of these repositories either contain no model card (62.00%) or provide only an empty model card (18.47%). Given that Hugging Face relies heavily on user reporting for moderation decisions [52], the absence of meaningful model descriptions may reduce the visibility of harmful models to both users and moderators. Consistent with this observation, only 11.68% of repositories containing Monet model files are labeled as “Not For All Audiences” [52] by Hugging Face. • Banned-but-alive models. Among the Monets archived on
Takeaway 5. Monets propagate cross-platform via two complementary mechanisms: platform-led mirroring (40.76% of Monets) and developer-embedded model referral links (8.74%), with Civitai acting as the central hub in both.
9
5.3
CivArchive, 997 (11.99%) of them, all originating from Civitai, had already been removed from their original platform yet remain publicly accessible through CivArchive. This reveals the limitation of platform-siloed moderation, as Monets can persist ecosystem-wide via cross-platform archiving even after being banned on their original platforms.
Promotion and Monetization of Monets
By analyzing Monet metadata, we found that developers frequently embed external links (i.e., links referring to external platforms and contact information), facilitating cross-platform promotion and monetization of Monet-related products and services. To understand these promotion and monetization practices, we systematically analyzed the destinations and purposes of external links stated in Monet metadata. Categorization of external links. From Monet metadata, especially descriptions, we extracted cross-platform links. After removing the model referral links that were discussed in §5.1, we extracted a total of 1,393 external links from 5,405 Monets and categorized them into seven types based on platform characteristics: digital payment platforms, paid-access platforms, social media platforms, art-sharing platforms, messaging channels, link aggregators, as well as external documents and websites. Among them, paid-access platforms dominate (43.29%), followed by social media and messaging channels. Cross-platform promotion and monetization strategies. Different types of external links support distinct promotion and monetization strategies, as detailed below. • Digital payment platforms. As the most direct form of monetization, some developers embed payment links (e.g., PayPal and Alipay) in model descriptions to receive donations. • Paid-access, social-media, and art-sharing platforms. Aiming to showcase model capabilities and attract potential users, developers often promote AI-generated images across paidaccess platforms (e.g., Buy Me a Coffee [5], Ko-fi [6], and Patreon [3]), social-media platforms (e.g., Facebook and X), and art-sharing platforms (e.g., Pixiv [2] and DeviantArt [1]). Unlike promotion-oriented platforms, paid-access platforms enable direct monetization via purchases, subscriptions, and memberships. On paid-access platforms, beyond images, developers also monetize related products and services, like prompts, premium models, and model-training services. For instance, the developer of Murky’s PDXL Lite [36] publishes a lightweight version on Civitai while offering the full version on Patreon [35]. Similarly, the developer of Arabatos LoRAv1.0 [27] advertises a LoRA training service and directs users to Ko-fi [29], where LoRA models and images are sold, with over 3K payments recorded. • Link aggregators. Link aggregators (e.g., Linktree [4]) play an infrastructural role by consolidating links to paid-access platforms, social-media accounts, art-sharing platforms, or more, facilitating user redirection between multiple platforms. • Messaging channels, external documents, and websites. These types of links reveal more complex ecosystem interactions. Specifically, we identified collaborative documents linked from 1,109 Monet descriptions, through which users can request new datasets or models. Also, 163 models link to cloud-hosted model operation infrastructures, while 86 link to model-usage instructions. Notably, 40 models contain links or contacts associated with gray-market services, all related
Takeaway 6. CivArchive preserves Monets via a centralized archival infrastructure concentrated in a small number of Hugging Face repositories, most of which lack meaningful model cards, potentially reducing their visibility to moderation mechanisms. Consequently, 11.99% of Monets archived on CivArchive had already been banned from their original platforms yet remain publicly accessible, highlighting the limitations of platform-siloed moderation. Keyword obfuscation. To circumvent keyword-based moderation mechanisms, some Monets employ keyword obfuscation [116] in model metadata. To explore this behavior, we manually reviewed the names of the collected Monets and identified 66 models containing obfuscated representations of sensitive terms. The techniques include symbol insertion, character substitution, and word separation. Examples include “F*CK” (i.e., “FUCK”), “pub1ch41r” (i.e., “pubic hair”), and “P_or_n” (i.e., “Porn”) [58, 61, 81], which are related to sexually explicit content. We also observed obfuscated violencerelated terms such as “M*rder” (i.e., “Murder”), “CR1M3” (i.e., “Crime”), and “Su1cide” (i.e., “Suicide”) [53, 56, 86]. Takeaway 7. Some Monet developers actively obfuscate sensitive keywords in model metadata to evade keyword-based moderation, revealing that such moderation mechanisms are insufficient against adversarial developers. Limited adoption and circumvention of model-level safeguards. Model-level safeguards are safety modules distributed along with model files, of which the Safety Checker [9, 10] is the most widely accessible: an optional yet official safety-filtering module integrated into Hugging Face’s diffusers library, designed to detect and filter harmful content generated by diffusion-based T2I models. However, only 45 checkpoint-based Monets include this module, eight of which explicitly provide instructions for disabling it via example scripts in their model descriptions (e.g., sexy_toon_3d_moresexy [24]). Takeaway 8. Model-level safety mechanisms are sparsely adopted among Monets, with some developers explicitly providing instructions to disable them, highlighting the limitations of relying on developer-controlled safeguards for ecosystem-wide protection. 10
to AI-assisted account creation and farming. Campaign analysis. While examining these external links embedded in Monet metadata, we observed that developers frequently reuse the same external links across multiple Monets. In some cases, these external links are displayed on different developer accounts and platforms, revealing coordinated promotion activities. This behavior resembles patterns observed in other online campaigns, where shared infrastructure and contact information are reused across multiple entities or activities [108, 112]. Motivated by this observation, we adopted the principle of guilt by association (GBA) [111] to explore the campaigns operating behind Monets. We built a heterogeneous graph with three types of nodes: Monets, external links (see §5.3), and developer accounts. Each Monet is connected to its developer account and the external links disclosed in its metadata. For model referral links (see §5.1), we directly connect the Monet containing the referral link to the Monet referenced by that link. In this way, Monets are linked within the graph through shared developer accounts, shared external links, or direct model referrals. The resulting graph contains 6,879 connected components. After excluding components in which Monets are connected solely via shared developer accounts, 398 components contain at least two Monets, collectively covering 5,090 models. Following the GBA principle, we treat each remaining connected component as a campaign. The validation of this campaign identification approach is detailed in Appendix G. • Case 1: A campaign mainly connected through external documents. The largest connected component contains 668 Monets spanning three model hubs: CivArchive, Civitai, and Shakker. These Monets primarily focus on pornography and intellectual-property characters. Significantly, 98.50% of these Monets (e.g., Ikumi Mito (Food Wars) - LoRA Illustrious [NSFW Support] [57]) are connected through two shared external documents, as shown in Fig. 4. The first is a Google Forms survey [69] listing 649 candidate characters and art styles for future LoRA development, together with corresponding commission prices, through which users can request new models. The second is a Google Doc [51] showcasing 914 completed commissions. The shared resources indicate an organized commission-based model-development campaign operating across multiple hubs. • Case 2: A campaign mainly connected through gray-market services. We also identified a connected component consisting of 40 Monets, from LiblibAI and Shakker, whose metadata advertise an AI-assisted account-farming service. According to the service description, it aims to facilitate the large-scale creation of social-media accounts, attract followers, and monetize the resulting traffic via advertising activities. The target social media include TikTok and RedNote [84], both of which explicitly prohibit such account-farming activities under their platform policies [68, 85]. As shown in Fig. 5, the models in this component are linked via shared contacts, including identical WeChat identifiers, links to the same service web-
https://docs.google.com/spreadsheets/
pateronusageXXX (Civitai) d/1uXjOSTWYYXXX
https://docs.google.com/forms/d/e /XXXXXX/formResponse
pateronusageXXX (CivArchive)
Monet Developer account External link
Figure 4: The campaign subgraph of Case 1.
PeachGlow_XXX (LiblibAI)
Wechat identifier: ddXXXki Premium_FaceXXX (LiblibAI)
https://h0bm0bed7mi.feishu.cn/docx/xxx
Monet Developer account External link
Figure 5: The campaign subgraph of Case 2.
site [59], as well as developer accounts. Notably, the Monets used to promote this service are associated with pornography and deepfake generation. The reuse of shared advertisements and contacts suggests a coordinated effort to leverage Monets as a channel for advertising and acquiring customers for related commercial services. Takeaway 9. Beyond individual model distribution, Monets are organized by coordinated cross-platform campaigns: one commission-based campaign spans 668 Monets across three hubs with 914 completed orders, while another uses pornographic or deepfake Monets to advertise gray-market account-farming targeting TikTok and RedNote, revealing a sophisticated commercial ecosystem behind Monets.
6
Downstream Monet Deployment
To examine downstream deployment of Monets, we investigated their use in GitHub projects and AI API providers. 11
ploys Qwen2.5-14B-Instruct-abliterated [33] for text generation and NoobAI-XL-Vpred-v1.0 [37,38] for image generation. Notably, the former is an uncensored LLM known to generate harmful content without conventional safety guardrails [98], while the latter is identified as a Monet in our study and also tagged as “NSFW” in its metadata [38], intended for NSFW anime image creation as stated in both its metadata and the ClawFans repository [74]. As an NSFW-oriented role-playing platform, ClawFans includes numerous virtual character profiles. Among these, we identified character profiles that portray minor individuals, including one explicitly described as a 17-year-old girl [75]. The combination of an uncensored LLM and a NSFW Monet in such a NSFW role-play setting raises concerns about the potential generation of sexualized content involving minors and associated risks of child sexual abuse material.
Table 5: Categories of Monet-integrated GitHub projects. Rank
Category
1 2 3 4 5 6 7 8
Node workflow systems Notebooks/hosted demos Model training/fine-tuning Image generation/editing Infrastructure Documentation/websites Research/benchmark Chatbot/agent/RAG
6.1
Count Rank 267 101 90 79 65 59 48 42
9 10 11 12 13 14 15
Category Video/animation creation Model management Web/API services Data scraping/analysis Domain-specific app. Model repositories Security governance tools
Count 28 26 22 13 10 6 6
Monet-Integrated GitHub Projects
Data collection. To discover GitHub projects that integrate Monets, we queried GitHub’s code search engine using the model filenames and identifiers of the collected Monets. In this way, we identified 1,102 repositories that integrate 216 Monets. The distributions of these Monets by their source model hubs and target harmful services are listed in Appendix Table 10 and Table 11, respectively. Project functionality. To understand project functionality, two experts manually annotated the collected Monet-related projects by reviewing README files and Monet-included scripts, classifying them into 15 categories (see Table 5). Projects were categorized only when both annotators agreed, yielding Cohen’s κ = 0.88. Due to incomplete or absent project descriptions, we are unable to categorize 240 projects. Among the categorized projects, the category of node workflow systems [115] dominates with 267 projects—generative AI systems using visual node-based graphs as the primary interface for constructing and executing AI workflows (e.g., ComfyUI)—followed by 101 projects for Notebooks and demonstrations and 90 for model training and fine-tuning. Note that only six repositories host Monet model files, consistent with prior findings [88] that GitHub does not serve as a major platform for hosting AI models within the model-sharing ecosystem. Among all collected projects, we identified 15 designed for harmful services, including eight for pornographic and intellectual-property character image generation, five for NSFW chat, and two for account-farming services, collectively adopting 20 Monets identified in this study. Pornographic and intellectual-property character image generation projects act as single-task tools, while NSFW chat projects often construct more complex platforms that integrate both text generation and image creation, deployable locally and via popular messaging applications such as Telegram (e.g., ClawFans [73]) and WhatsApp (e.g., BBA [80]). The accountfarming projects, related to the gray-market services discussed in §5.3, automate the creation, management, and deployment of AI influencers, including persona construction, content generation, and social media presence (e.g., Gator [63]). Case Study: ClawFans. ClawFans [73] is an AI-powered character chat platform project that supports NSFW interactions and can be integrated with Telegram as a chatbot. It em-
Takeaway 10. Monets are integrated into 1,102 GitHub projects, with 15 explicitly designed for harmful services, including pornographic and intellectual-property character image generation, NSFW chat, and account-farming. Critically, some downstream projects combine uncensored LLMs with NSFW Monets in role-play settings involving minor characters, raising serious child safety concerns.
6.2
Monet APIs from AI API Providers
Data collection. To characterize Monets adopted by AI API providers, we examined two popular AI API providers that explicitly expose T2I inference services: Runware [23] and SogniAI [62]. We queried each provider’s model search engine and model catalog using model names and identifiers, identifying a total of 3,930 Monet API entries. Runware hosts 3,928 matched Monet APIs, while SogniAI contributes two. Adoption of Monets by AI API providers. We analyzed adopted Monets from three dimensions: source model hubs, tailored harmful services, and popularity. As shown in Appendix Table 10, the majority of the adopted Monets originate from Civitai (2,302; 58.58%) and CivArchive (1,517; 38.60%), indicating that API providers rely heavily on the dominant hubs of the Monet ecosystem (see §4.1). Since a Monet may support multiple harmful services (see §3.2), the 3,930 adopted Monets collectively provide 7,264 harmful services spanning 16 subcategories (see Appendix Table 11). “Sexualized posing, angles, and props” (A4) is the most prevalent (2,738 Monets), followed by “intellectual-property infringement” (I1; 1,775) and “explicit organs, fluids, and fetishes” (A3; 1,263). We further examined their popularity on original model hubs. Among the 3,930 adopted Monets, 202 (5.14%) have accumulated over 10,000 downloads. For example, NSFW POV All [20], associated with sexual and pornographic content, has exceeded 203K downloads. Note that since API providers do not disclose usage volumes, we cannot measure 12
the actual usage of these Monet APIs.
Appendix H). These mechanisms provide practical building blocks for platform-enforced safeguards that operate independently of model developers and are harder to disable than safety modules distributed together with model files. • Extending governance to monetization and downstream deployment. The Monet ecosystem extends beyond model hubs. As shown in §5.3, developers leverage external platforms and coordinated campaigns to sell models and their created images, offer model-training services, and advertise gray-market services. §6 shows that Monets are integrated into GitHub projects and exposed via commercial AI APIs, enabling access to harmful capabilities without local model deployment. Therefore, the governance of Monets should extend to downstream services and monetization channels. Downstream projects and API providers should screen models before onboarding, retain upstream provenance, and enforce inference-time safeguards. Model hubs should also investigate recurring referral links, payment channels, and other shared infrastructure associated with coordinated harmful campaigns. Limitations. Our study has two main limitations. First, our discovery pipeline has two inherent constraints. Due to the large number of models across numerous model hubs, we relied on keyword-based retrieval on eight major hubs to identify candidate Monets, which may miss stealthy models that avoid harmful keywords or are hosted on non-primary hubs. Additionally, our metadata-based classification may not detect models that intentionally conceal harmful intent. Thus, the Monets identified in our study should be regarded as a lower bound of the true Monet population in the open-source T2I ecosystem. Nevertheless, these models represent the most explicitly advertised and publicly accessible Monets, making them the most user-discoverable and governance-actionable portion of the ecosystem. Second, given the scale of identified Monets and the substantial cost of large-scale image creation and evaluation, we assessed harmful capabilities in §4.2 via stratified sampling instead of exhaustive testing. This ensures coverage of all harmful service subcategories. Since this evaluation aims to validate whether Monets generate harmful content as advertised, stratified sampling across subcategories provides sufficient coverage without exhaustively testing individual models.
Takeaway 11. Monets have propagated beyond modelsharing platforms into commercial AI inference services. By exposing Monets through hosted APIs, these providers allow users to access harmful image-generation capabilities without downloading or deploying models locally.
7
Discussion
Mitigation. As described above, our findings demonstrate that Monets are supported by an interconnected ecosystem spanning model development, cross-platform distribution, governance evasion, as well as monetization and downstream deployment. Therefore, beyond interventions to individual models or platforms, we discuss ecosystem-wide mitigation against Monet abuse from four dimensions. • Securing resources for model development. Our analysis in §4.3 shows that Monet development can leverage readily accessible harmful training data, including sensitive datasets hosted on model hubs and images of identifiable individuals collected from social media. Therefore, safeguards should move upstream from model moderation to the resources used for model development. Platforms hosting datasets (e.g., Hugging Face) should strengthen dataset moderation through content screening, provenance documentation, and access controls for sensitive datasets. Similarly, cloud-based modeltraining platforms should vet both training data and resulting models before public release. • Cross-platform moderation for model propagation. Our measurements show that platform-siloed moderation is insufficient when models are routinely mirrored, referred, and archived across platforms. For example, the large-scale migration to CivArchive following Civitai’s policy update (see §4.1) and the continued availability of Monets removed from their original hubs (see §5.2) demonstrate how harmful models can persist despite platform-specific enforcement. Therefore, model hubs should coordinate moderation across platforms by sharing identifiers or hashes of policy-violating models, tracking their upstream and mirrored copies, and distributing policy-removal signals across platforms. • Enforcing safety at model and inference levels. Our findings in §5.2 reveal that model-level safeguards cannot be assumed to remain enabled: only a small number of Monets carry Safety Checkers, and some explicitly provide instructions for disabling them. Therefore, rather than relying solely on safeguards voluntarily retained by model developers, safety protection could be independently enforced by model hubs and API providers within their hosted inference pipelines. We further examine existing technical building blocks for such inference-time enforcement, including Safety Checker [9], Ethical-Lens [90], SteerDiff [122], SAFREE [119], and STG [101], which apply safety interventions at different stages of the generation pipeline (see
8
Conclusion
In this work, we present the first systematic measurement study of the Monet ecosystem. We uncover the prevalence and usage of Monets, shedding light on as many as 23,947 Monets from eight major T2I model hubs. In particular, we examine the real-world Monet ecosystem from five dimensions—model characteristics, cross-platform propagation, governance evasion, monetization, and downstream deployment. Additionally, our study reveals that Monets pose significant security threats embedded within this ecosystem: they persist across platforms despite moderation actions, oper13
ate coordinated gray-market campaigns, and are deployed in downstream projects raising potential child safety concerns. Our findings provide new insights into the Monet ecosystem and inspire future efforts toward more robust governance and safety mechanisms to secure the open-source T2I ecosystem as a whole.
[15] Haer1n newje4n5 - goddeslora edition civarchive. https://civarchive.com/models/ 113209?modelVersionId=122286, 2023.
References
[17] hearmeneigh/e621-rising-v3-finetuner · hugging face datasets. https://huggingface.co/datasets/ hearmeneigh/e621-rising-v3-finetuner, 2023.
[16] hearmeneigh/e621-rising-v3-curated · datasets at hugging face. https://huggingface.co/datasets/ hearmeneigh/e621-rising-v3-curated, 2023.
[1] Deviantart - the largest online art gallery and community. https://www.deviantart.com/, 2000. [2] Online community for artist [pixiv]. www.pixiv.net/en/, 2007.
[18] hearmeneigh/e621-rising-v3 · hugging face. https:// huggingface.co/hearmeneigh/e621-rising-v3, 2023.
https://
[19] Murky’s - after sex lying lora. https: //civitai.com/models/18194/murkys-aftersex-lying-lora, 2023.
[3] Patreon. https://www.patreon.com/, 2013. [4] Linktree. https://linktr.ee/, 2016. [5] Buy me a coffee. 2017.
[20] Nsfw pov all in one sdxl. https://civitai.com/ models/144203/nsfw-pov-all-in-one-sdxlrealisticanimewd14-74mb-version-available, 2023.
https://buymeacoffee.com/,
[6] Ko-fi | make money doing what you love. https: //ko-fi.com/, 2017.
(from twitter) [21] real_yami https://civarchive.com/models/ 13030?modelVersionId=15351, 2023.
[7] sentence-transformers/paraphrase-multilingualminilm-l12-v2. https://huggingface.co/ sentence-transformers/paraphrasemultilingual-MiniLM-L12-v2, 2021.
civarchive.
[22] Rectalworm/loras · hugging face. https:// huggingface.co/RectalWorm/loras, 2023.
https: [8] aarondotwork/sd-pokemon-diffusers. //huggingface.co/aarondotwork/sd-pokemondiffusers, 2022.
[23] Runware. https://runware.ai/, 2023. · [24] stablediffusionapi/sexy_toon_3d_moresexy hugging face. https://huggingface.co/ stablediffusionapi/sexy_toon_3d_moresexy, 2023.
[9] Compvis/stable-diffusion-safety-checker · hugging face. https://huggingface.co/CompVis/stablediffusion-safety-checker, 2022.
[25] Terms of service | tensor.art. https://tensor.art/ en-US/about/terms-of-service-new, 2023.
[10] Diffusionpipeline. https://huggingface.co/docs/ diffusers/using-diffusers/loading#safetychecker, 2022.
[26] Zacygiz897/zacygiz_lora · hugging face. https: //huggingface.co/Zacygiz897/Zacygiz_lora, 2023.
[11] eolecvk/sd-naruto-diffusers. https:// huggingface.co/eolecvk/sd-naruto-diffusers, 2022.
[27] Arabatos nsfw style lora civarchive. https://civarchive.com/models/ 1086529?modelVersionId=1220151, 2024.
[12] Zack3d/zack3d_kinky-v1. https:// huggingface.co/Zack3D/Zack3D_Kinky-v1, 2022.
[28] Aviana [content creator] @puppyavie. https://civarchive.com/models/ 414406?modelVersionId=461806, 2024.
[13] Carnage style! - blood and gore - nsfw - nsfanywhere! - civarchive. https://civarchive.com/models/ 142146?modelVersionId=157585, 2023.
[29] Buy ownwaifu artworks a coffee. fi.com/ownwaifu, 2024.
[14] Craig severance - drug use in america - craig severance - drug use in america | stable diffusion 1.x lora | civitai. https://civitai.com/models/243657/craigseverance-drug-use-in-america, 2023.
https://ko-
[30] Destiny 2 weapon/gun civarchive. https://civarchive.com/seaart/models/ a0ee2113268375a6ba11f1eb29368ac5/versions/ 38946794f025e4b61fdb26d226f2d008, 2024. 14
[31] Female pov - anima | anima lora | civitai. https://civitai.com/models/427349/femalepov?modelVersionId=476115, 2024.
[46] Upload models to civitaiarchive. civarchive.com/upload, 2024.
https://
[32] Hinatazaka46 10th single uniform. https: //www.seaart.ai/zhCN/models/detail/ c4e3a944bbedbf5114adc82c412f4105, 2024.
https: [47] Wai-nsfw-illustrious-sdxl - v14. //civarchive.com/seaart/models/ d8300cd33eb1ab8018baa6685ec4a7e9/versions/ fbcc1c4abfd4acaf320696049aaf382f, 2024.
[33] huihui-ai/qwen2.5-14b-instruct-abliterated · hugging face. https://huggingface.co/huihui-ai/ Qwen2.5-14B-Instruct-abliterated, 2024.
[48] Wfproduct e-commerce scenarios - seaart ai model. https://www.seaart.ai/models/detail/ ctmlb3te878c738o4j1g, 2024.
[34] Laxhar/noobai-xl-earlyaccess · hugging face. https://huggingface.co/Laxhar/noobai-xlEarlyAccess, 2024.
[49] About civarchive. https://civarchive.com/about, 2025. https: [50] Compare base models | civitai. //civitai.com/articles/11744/compare-basemodels, 2025.
[35] Murky | ai art, nsfw illustrations, custom lora trainings | patreon. https://www.patreon.com/ murkyskeleton, 2024.
[51] Completed dataset collection. https:// docs.google.com/spreadsheets/d/1uXjOSTWYYp2pkrdsdrSp8g92RSl-vuk4UJmE6PwDqs/ edit?gid=0#gid=0, 2025.
[36] Murky’s pdxl lite - sex on table / bent over table lora - v1.0 | pony diffusion lora | civitai. https: //civitai.com/models/929695/murkys-pdxllite-sex-on-table-bent-over-table-lora, 2024.
[52] Content policy – hugging face. https:// huggingface.co/content-policy, 2025.
[37] Noobai-xl (nai-xl) - v-pred-1.0-version|civitai. https://civitai.com/models/833294/noobaixl-nai-xl?modelVersionId=1190596, 2024.
https:// [53] Cr1m3-liblibai. www.liblib.art/modelinfo/ c7a67b4cf7e61e849e1d0dec2278c36f, 2025.
[38] Noobai-xl-v-pred-1.0-version|civarchive. https://civarchive.com/models/ 833294?modelVersionId=1190596, 2024.
[54] Gpt-5 | openai. https://openai.com/gpt-5/, 2025. [55] Graphics design - civarchive. //civarchive.com/tensorart/models/ 912270952522367907/versions/ 912270952522367907, 2025.
[39] Nosebleed series - shakker. https: //www.shakker.ai/zh-TW/modelinfo/ 2b2e44207a834506bd236a10158d3358, 2024. [40] Real dream - 10 (sd1.5). https: //civarchive.com/seaart/models/ 94714c659ec774d556007f09d3603664/versions/ 24799cf13368f5cc015fa545757027a8, 2024.
https:
[56] Harley quinn | tensor.art | tensor.art. https:// tensor.art/models/866314936672855488, 2025. [57] Ikumi mito (food wars) - lora illustrious [nsfw support]. https://civitai.com/models/1503981/ ikumi-mito-food-wars-lora-illustriousnsfw-support, 2025.
[41] real photo civarchive. https: //civarchive.com/seaart/models/ be6859a325f8e98ad05667c1c9fa9dc8/versions/ 969ec27e6073341f010735d687032413, 2024.
[58] Nesslovver/p_or_n_conceptz · hugging https://huggingface.co/Nesslovver/ P_or_n_conceptz, 2025.
[42] Sui-feng - v1.0 | stable diffusion 1.x lora | civitai. https://civitai.com/models/318687/suifeng, 2024.
face.
[59] One-click monetization system for ai influencers. https://my.feishu.cn/docx/ NbuKdLgvvohqh4xp2AWc3qzVn4e, 2025.
[43] Tensorhub. https://tensorhub.art/, 2024. [44] Terms of service - shakker. https:// www.shakker.ai/aigenerator/index#/document/ aiUserAgreement, 2024.
[60] Policy & content adjustments | civitai. https://civitai.com/articles/13632/policyand-content-adjustments, 2025.
[45] Tungsten. https://tungsten.run/, 2024. 15
[61] Pubic hair pub1ch41r civarchive. https://civarchive.com/models/ 1317348?modelVersionId=1487166, 2025.
[75] Clawfans/scripts/seed_characters.py at master · claude-office-skills/clawfans. https://github.com/ claude-office-skills/ClawFans/blob/master/ scripts/seed_characters.py, 2026.
[62] Sogni al - free al image & video generator. https: //www.sogni.ai/, 2025. [63] terminills/gator. terminills/gator, 2025.
[76] Female pov ai lora model | pixai. https: //pixai.art/en/model/1982393171352941695, 2026.
https://github.com/
[77] Mastering trigger words | civitai. https: //civitai.com/articles/29014/masteringtrigger-words, 2026.
[64] Terms and condition · modelscope. https:// modelscope.cn/protocol/Terms-and-Condition, 2025.
[78] Pantie around ankles v2 civarchive. https://civarchive.com/models/ 2324262?modelVersionId=2614644, 2026.
[65] Terms of service - liblibai. https: //www.liblib.art/activities/ 468ad794ccc7408d81757fd91be003ec, 2025. [66] Terms of service | civitai. https://civitai.com/ content/tos, 2025.
https: [79] Reverse cowgirl anal (klein 9b). //civitai.com/models/2529508/reversecowgirl-anal-klein-9b, 2026.
[67] Terms of service | seaart ai. https: //image.cdn2.seaart.me/20250802/d2790ce8f8e8-4ea4-a4a1-c958c728566e.html, 2025.
[80] Ryugamedev/bba. RyuGameDev/bba, 2026.
[68] Understanding tiktok’s policy on integrity and authenticity. https://www.tiktok.com/creatoracademy/article/integrity-authenticity-ontiktok, 2025.
[81] Sarah petersons middle finger f*ck you ft15 - v1.0 zib | zimage lora | civitai. https://civitai.com/models/1423027/sarahpetersons-middle-finger-fck-you-ft15, 2026.
[69] Which character or artstyle do you want to see created as a illustrious lora? https://docs.google.com/ forms/d/e/1FAIpQLScHHsA8s03oc4JChzJ5KcLV5PfP3giV3w68nIU1ssw5CY6Fw/viewform, 2025.
[82] Storage limits · hugging face. https:// huggingface.co/docs/hub/en/storage-limits, 2026.
https://github.com/
[83] Where and how to find deleted civitai models. https://www.seaart.ai/blog/where-andhow-to-find-deleted-civitai-models, 2026.
[70] Yodayo. https://yodayo.com/, 2025.
[84] Xiaohongshu. 2026.
[71] airborne-commando/civitai-mirror-list | github. https://github.com/airborne-commando/ civitai-mirror-list, 2026.
https://www.xiaohongshu.com/,
[85] Xiaohongshu terms of service. //agree.xiaohongshu.com/h5/terms/ ZXXY20250119002/-1, 2026.
[72] civitai/packages/civitaishared/src/basemodel.constants.ts at main · civitai/civitai. https://github.com/civitai/ civitai/blob/main/packages/civitai-shared/ src/basemodel.constants.ts, 2026.
https:
[86] Yamada kouji | sex m*rder investigation officer - v1.0 | illustrious lora | civitai. https://civitai.com/models/2514944/yamadakouji-or-sex-mrder-investigation-officer, 2026.
[73] claude-office-skills/clawfans: Uncensored ai character chat platform | 100+ characters, 15 languages, runs fully local with ollama. https://github.com/ claude-office-skills/ClawFans, 2026.
[87] Sifat Muhammad Abdullah, Aravind Cheruvu, Shravya Kanchi, Taejoong Chung, Peng Gao, Murtuza Jadliwala, and Bimal Viswanath. An analysis of recent advances in deepfake image detection in an evolving threat landscape. In 2024 IEEE Symposium on Security and Privacy (SP), pages 91–109. IEEE, 2024.
[74] Clawfans/scripts/download_noobai.py at master · claude-office-skills/clawfans. https://github.com/ claude-office-skills/ClawFans/blob/master/ scripts/download_noobai.py, 2026. 16
[88] Adem Ait, Javier Luis Cánovas Izquierdo, and Jordi Cabot. On the suitability of hugging face hub for empirical studies. Empirical Software Engineering, 30(2):57, 2025.
[98] Zilong Lin, Zichuan Li, Xiaojing Liao, and XiaoFeng Wang. Consiglieres in the shadow: Understanding the use of uncensored large language models in cybercrimes. arXiv preprint arXiv:2508.12622, 2025.
[89] Fengxiang Bie, Yibo Yang, Zhongzhu Zhou, Adam Ghanem, Minjia Zhang, Zhewei Yao, Xiaoxia Wu, Connor Holmes, Pareesa Golnari, David A. Clifton, Yuxiong He, Dacheng Tao, and Shuaiwen Leon Song. Renaissance: A survey into ai text-to-image generation in the era of large model. IEEE Transactions on Pattern Analysis and Machine Intelligence, 47(3):2212–2231, 2025.
[99] Shuofeng Liu, Mengyao Ma, Minhui Xue, and Guangdong Bai. Modifier unlocked: Jailbreaking text-toimage models through prompts. In 2025 IEEE Symposium on Security and Privacy (SP), pages 355–372, 2025. doi:10.1109/SP61157.2025.00242.
[90] Yuzhu Cai, Sheng Yin, Yuxi Wei, Chenxin Xu, Weibo Mao, Felix Juefei-Xu, Siheng Chen, and Yanfeng Wang. Ethical-lens: Curbing malicious usages of opensource text-to-image models. Patterns, 6(3), 2025.
[100] Margaret Mitchell, Simone Wu, Andrew Zaldivar, Parker Barnes, Lucy Vasserman, Ben Hutchinson, Elena Spitzer, Inioluwa Deborah Raji, and Timnit Gebru. Model cards for model reporting. In Proceedings of the conference on fairness, accountability, and transparency, pages 220–229, 2019.
[91] Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX security symposium (USENIX Security 23), pages 5253–5270, 2023.
[101] Byeonghu Na, Mina Kang, Jiseok Kwak, Minsang Park, Jiwoo Shin, SeJoon Jun, Gayoung Lee, Jin-Hwa Kim, and Il-Chul Moon. Training-free safe text embedding guidance for text-to-image diffusion models. Advances in Neural Information Processing Systems, 38:85984–86014, 2026.
[92] Jiahao Chen, Xing He, Yong Yang, Xinfeng Li, Chunyi Zhou, Junhao Li, Zhe Ma, Tianyu Du, and Shouling Ji. Customization under fire: Plugin poisoning in text-toimage ecosystem. arXiv preprint arXiv:2606.09151, 2026.
[102] Sang Hyun Park, Jun Young Koh, Junha Lee, Joy Song, Dongha Kim, Hoyeon Moon, Hyunju Lee, and Min Song. Illustrious: an open advanced illustration model. arXiv preprint arXiv:2409.19946, 2024.
[93] Haonan Dong, Wenhao Zhu, Guojie Song, and Liang Wang. Aurora: Breaking low-rank bottleneck of lora with nonlinear mapping. Advances in Neural Information Processing Systems, 38:36929–36961, 2026.
[103] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. In International Conference on Learning Representations, volume 2024, pages 1862–1874, 2024.
[94] Susan Hao, Renee Shelby, Yuchi Liu, Hansa Srinivasan, Mukul Bhutani, Burcu Karagol Ayan, Ryan Poplin, Shivani Poddar, and Sarah Laszlo. Harm amplification in text-to-image models. arXiv preprint arXiv:2402.01787, 2024.
[104] Tim Puhlfürß, Julia Butzke, and Walid Maalej. Model cards revisited: Bridging the gap between theory and practice for ethical ai requirements. In 2025 IEEE 33rd International Requirements Engineering Conference (RE), pages 280–291. IEEE, 2025.
[95] Peter Holderrieth and Ezra Erives. An introduction to flow matching and diffusion models. arXiv preprint arXiv:2506.02070, 2025.
[105] Yiting Qu, Xinyue Shen, Xinlei He, Michael Backes, Savvas Zannettou, and Yang Zhang. Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models. In Proceedings of the 2023 ACM SIGSAC conference on computer and communications security, pages 3403–3417, 2023.
[96] Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. ICLR, 1(2):3, 2022. [97] Lijun Li, Zhelun Shi, Xuhao Hu, Bowen Dong, Yiran Qin, Xihui Liu, Lu Sheng, and Jing Shao. T2isafety: Benchmark for assessing fairness, toxicity, and privacy in image generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13381–13392, 2025.
[106] Scott Reed, Zeynep Akata, Xinchen Yan, Lajanugen Logeswaran, Bernt Schiele, and Honglak Lee. Generative adversarial text to image synthesis. In ICML, 2016. 17
[107] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In CVPR, 2022.
Symposium (USENIX Security 21), pages 3703–3720, 2021. [117] Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. Sneakyprompt: Jailbreaking text-to-image generative models. In 2024 IEEE symposium on security and privacy (SP), pages 897–912. IEEE, 2024.
[108] Kevin A Roundy, Paula Barmaimon Mendelberg, Nicola Dell, Damon McCoy, Daniel Nissani, Thomas Ristenpart, and Acar Tamersoy. The many kinds of creepware used for interpersonal attacks. In 2020 IEEE Symposium on Security and Privacy (SP), pages 626– 643. IEEE, 2020.
[118] Zonghao Ying, Aishan Liu, Siyuan Liang, Lei Huang, Jinyang Guo, Wenbo Zhou, Xianglong Liu, and Dacheng Tao. Safebench: A safety evaluation framework for multimodal large language models. International Journal of Computer Vision, 134(1):18, 2026.
[109] Zahraa Al Sahili, Maryam Fetanat, Maimuna Nowaz, Ioannis Patras, and Matthew Purver. Fairjudge: Mllm judging for social attributes and prompt image alignment. arXiv preprint arXiv:2510.22827, 2025.
[119] Jaehong Yoon, Shoubin Yu, Vaidehi Ramesh Patil, Huaxiu Yao, and Mohit Bansal. Safree: Training-free and adaptive guard for safe text-to-image and video generation. In International Conference on Learning Representations, volume 2025, pages 56439–56465, 2025.
[110] Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Rickrolling the artist: Injecting backdoors into text encoders for text-to-image synthesis. In 2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 4561–4573. IEEE, 2023.
[120] Xingchen Zeng, Ziyao Gao, Yilin Ye, and Wei Zeng. Intenttuner: an interactive framework for integrating human intentions in fine-tuning text-to-image generative models. In Proceedings of the 2024 CHI Conference on Human Factors in Computing Systems, pages 1–18, 2024.
[111] Binghui Wang, Neil Zhenqiang Gong, and Hao Fu. Gang: Detecting fraudulent users in online social networks via guilt-by-association on directed graphs. In 2017 IEEE international conference on data mining (ICDM), pages 465–474. IEEE, 2017.
[121] Han Zhang, Tao Xu, Hongsheng Li, Shaoting Zhang, Xiaogang Wang, Xiaolei Huang, and Dimitris Metaxas. Stackgan: Text to photo-realistic image synthesis with stacked generative adversarial networks. In ICCV, 2017.
[112] Peng Wang, Zilong Lin, Xiaojing Liao, and XiaoFeng Wang. Demystifying local business search poisoning for illicit drug promotion. In Proceeding of ISOC Network and Distributed System Security Symposium (NDSS), 2022.
[122] Hongxiang Zhang, Yifeng He, and Hao Chen. Steerdiff: Steering towards safe text-to-image diffusion models. arXiv preprint arXiv:2410.02710, 2024.
[113] Yiluo Wei, Yiming Zhu, Pan Hui, and Gareth Tyson. Exploring the use of abusive generative ai models on civitai. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 6949–6958, 2024.
[123] Yimeng Zhang, Jinghan Jia, Xin Chen, Aochuan Chen, Yihua Zhang, Jiancheng Liu, Ke Ding, and Sijia Liu. To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images... for now. In European Conference on Computer Vision, pages 385–403. Springer, 2024.
[114] Tianhe Wu, Kede Ma, Jie Liang, Yujiu Yang, and Lei Zhang. A comprehensive study of multimodal large language models for image quality assessment. In European Conference on Computer Vision, pages 143– 160. Springer, 2024.
Appendix
[115] Xiangyuan Xue, Zeyu Lu, Di Huang, Zidong Wang, Wanli Ouyang, and Lei Bai. Comfybench: Benchmarking llm-based agents in comfyui for autonomously designing collaborative ai systems. In Proceedings of the computer vision and pattern recognition conference, pages 24614–24624, 2025.
A
False Case Analysis
For T2I model checking, we observed no false positives among the sampled models. The false negatives primarily arise when models implicitly indicate their T2I capabilities without explicitly stating that they support image generation. For example, the Monet Pantie around ankles V2 [78] describes itself as a LoRA designed for Z-Image-family checkpoints, while Graphics Design - Product Ad [55] is described
[116] Ronghai Yang, Xianbo Wang, Cheng Chi, Dawei Wang, Jiawei He, Siming Pang, and Wing Cheong Lau. Scalable detection of promotional website defacements in black hat {SEO} campaigns. In 30th USENIX Security 18
as a LoRA for FLUX.1 checkpoints. Although both belong to T2I model families, neither explicitly states its T2I generation capability, causing them to be missed by our checker.
Table 6: Distribution of semantic similarity between triggers and the corresponding models.
For harmful service classification, false positives often occurred when the LLM misinterpreted the meaning or context of statements in model descriptions, especially explicit warnings, prohibitions, and copyright disclaimers. For example, the description of Real Dream [40] explicitly discourages its use for political manipulation, but the LLM-based classifier misinterpreted this warning as support for such use and classified the model under the “Political misinformation” subcategory. In another example, a copyright disclaimer in the description of Hinatazaka46 [32] was mistakenly treated as evidence of “Intellectual property infringement.”
Similarity Range
Model name & description
Target service description
0.9 ≤ x ≤ 1.0 0.8 ≤ x < 0.9 0.7 ≤ x < 0.8 0.6 ≤ x < 0.7 0.5 ≤ x < 0.6 0.4 ≤ x < 0.5 0.3 ≤ x < 0.4 0.2 ≤ x < 0.3 0.1 ≤ x < 0.2 0.0 ≤ x < 0.1 −0.1 ≤ x < 0.0 −0.2 ≤ x < −0.1 −0.3 ≤ x < −0.2 x < −0.3
0 53 496 1,976 5,260 13,515 34,513 59,148 59,006 25,584 3,002 62 2 0
0 0 1 105 2,376 11,735 25,133 53,605 57,899 35,942 14,824 980 17 0
*
False negatives mainly resulted from limitations in entity recognition, particularly for “Real-person likeness/deepfakes” and “Intellectual property infringement” subcategories. The LLM could miss references to real persons, groups, or copyrighted entities, especially when aliases, uncommon names, or character-level obfuscation were used. For example, the model HAER1N NEWJE4N5 [15] obfuscates “HAERIN,” the name of a member of the South Korean girl group NewJeans, and “NEWJEANS” through digit substitution. Although readily recognizable to human reviewers, these references were missed by the LLM-based classifier, resulting in a false negative for intellectual-property infringement.
For a Monet assigned to multiple harmful subcategories, the service similarity score is calculated as the maximum cosine similarity between the trigger and the definitions of all assigned harmful subcategories.
Table 7: Distribution of base-model generative paradigms and families. Generative Paradigm
Denoising Diffusion
Flow Matching
B
Details of Semantic Analysis on Triggers Unknown
To investigate whether textual triggers semantically reflect the corresponding models and their target harmful services, we measure the semantic similarity between each trigger and two types of contextual information: (1) the corresponding model name and description and (2) the description of the harmful service targeted by the model. Specifically, we encode the triggers and contextual information using paraphrasemultilingual-MiniLM-L12-v2 [7] and compute their pairwise cosine similarity. The results are shown in Table 6. We find that 55,228 textual triggers (27.26% of the analyzed triggers) exhibit low semantic similarity to both the corresponding model information and target harmful services, with similarity scores below 0.2. For example, one Shakker developer [39] who primarily publishes pornographic Monets uses the same developer identifier—unrelated to pornography—as a textual trigger across 74 of their Monets. These findings suggest that in the real world, a substantial portion of textual triggers serve primarily as model-specific activation tokens rather than semantically meaningful descriptions of the corresponding models or their target harmful services.
C
Family
# Monets
Illustrious Stable Diffusion 1.x/2.x Pony SDXL NoobAI Cosmos-Predict2 PixArt HunyuanDiT
7,917 4,812 4,779 1,341 209 80 3 1
FLUX.1 Z-Image Qwen-Image FLUX.2 Chroma Stable Diffusion 3.5 HiDream HunyuanImage
1,844 830 148 116 39 11 4 1
Unknown
1,812
Details of Monet Base Models
Table 7 summarizes the distribution of base-model generative paradigms and families underlying the collected Monets. Denoising diffusion models constitute the majority. Flowmatching models account for a smaller but notable portion, dominated by the FLUX.1 family. For a small portion of Monets, the model metadata does not disclose their base-model generative paradigms or families. Thus, we categorize them as “Unknown.”
D
Validation of MLLM-as-a-Judge Approach Used in Harmful Capability Evaluation
As mentioned in §4.2, we adopted a MLLM-as-a-judge approach powered by Qwen2.5-VL to evaluate the alignment, quality, and harmfulness of images generated by Monets. To 19
Table 8: Upstream sources of CivArchive Monets by source field. Source Field*
Upstream
# Monets
Available-on Available-on Available-on Available-on Available-on Available-on Available-on Available-on Available-on
Civitai SeaArt TensorArt Tungsten PixAI TensorHub Moescape Yodayo CivitasBay
5,470 5,222 1,099 166 143 40 22 22 18
65.76% 62.78% 13.21% 2.00% 1.72% 0.48% 0.26% 0.26% 0.22%
Mirrors Mirrors Mirrors Mirrors Mirrors Mirrors Mirrors
Civitai Hugging Face TensorArt TensorFiles CivitasBay TensorHub Shakker
5,680 2,099 1,001 209 143 41 12
68.29% 25.24% 12.03% 2.51% 1.72% 0.49% 0.14%
Table 9: Model referral links embedded in Monet descriptions.
Share in Hub**
*
A single CivArchive model may reference the same upstream platform in both source fields or multiple upstream platforms across either or both fields. ** Shares are calculated by dividing each count by the total number of CivArchive Monets (8,318).
further validate this approach, we evaluated the agreement between the MLLM-as-a-judge and human evaluators. Specifically, we invited two security experts to independently annotate 100 randomly sampled images generated by the T2I models evaluated in §4.2 (excluding images of Subcategory A1). The annotators achieved Cohen’s κ values of 0.74, 0.79, and 0.76 for alignment, quality, and harmfulness, respectively, indicating strong agreement. Disagreements were resolved through discussion to establish the ground truth. Compared with this ground truth, Qwen2.5-VL achieved Cohen’s κ values of 0.72, 0.74, and 0.75 for alignment, quality, and harmfulness, respectively, indicating strong agreement with human judgment.
Referenced Hub*
Civitai Civitai Civitai Civitai Civitai Civitai Civitai Civitai Civitai
TensorArt PixAI SeaArt Hugging Face LiblibAI Shakker TensorHub Yodayo CivArchive
318 199 156 64 5 4 2 2 1
2.98% 1.86% 1.46% 0.60% 0.05% 0.04% 0.02% 0.02% 0.01%
Hugging Face Hugging Face Hugging Face Hugging Face
Civitai LiblibAI PixAI ModelScope
232 3 2 1
37.36% 0.48% 0.32% 0.16%
ModelScope
Hugging Face
2
10.00%
Shakker Shakker Shakker Shakker
Civitai LiblibAI PixAI Hugging Face
51 42 2 1
5.02% 4.14% 0.20% 0.10%
CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive CivArchive
Civitai Hugging Face TensorArt SeaArt PixAI Shakker Yodayo TensorHub
593 164 156 45 34 4 3 1
7.13% 1.97% 1.88% 0.54% 0.41% 0.05% 0.04% 0.01%
LiblibAI LiblibAI LiblibAI
Civitai Hugging Face TensorArt
130 38 6
7.61% 2.22% 0.35%
SeaArt SeaArt SeaArt SeaArt SeaArt
Civitai Hugging Face TensorArt PixAI Yodayo
136 36 9 3 1
16.87% 4.47% 1.12% 0.37% 0.12%
TensorArt TensorArt TensorArt TensorArt
Civitai Hugging Face Yodayo PixAI
64 6 3 1
8.19% 0.77% 0.38% 0.13%
*
# Monets
Share in Hub**
Each Monet may contain one or more model referral links. Shares are calculated relative to the total number of Monets on the corresponding original hub.
**
G Validation of Campaign Identification Approach
E Supplementary Details of Monet CrossPlatform Propagation
As discussed in §5.3, we adopted the principle of GBA to identify campaigns behind Monets. To validate this approach, we evaluated the precision of the identified campaigns. Specifically, two security professionals independently annotated 100 randomly sampled campaigns identified in §5.3 by examining the model metadata. They achieved an inter-annotator raw agreement of 98% and a Cohen’s κ of 0.74. Disagreements were resolved through discussion to establish the ground truth. Against this ground truth, our GBA-based approach achieved a precision of 96%.
Tables 8 and 9 provide supplementary statistics for the platform-led and developer-led propagation mechanisms discussed in §5.1, respectively. The former summarizes upstream platforms referenced by CivArchive Monets through different source fields, while the latter summarizes developerembedded model referral links across model hubs.
F
Original Hub
Details of Monets Adopted by Downstream
H
Table 10 summarizes the source-hub distribution of the Monets adopted by GitHub projects and AI API providers. Table 11 summarizes the harmful services targeted by these adopted Monets.
Efficacy of Safety Mechanisms on Monets
Safety mechanisms generally mitigate unsafe generation by (1) identifying unsafe inputs or outputs and (2) triggering 20
Table 10: Source model hubs of Monets adopted by downstream projects and services.
Table 13: Average harmfulness scores of images generated by Monets and those mitigated by safety mechanisms. Values in parentheses indicate changes relative to “Original.”
# Monets adopted by
Model hub
GitHub projects
API providers
Civitai CivArchive Hugging Face TensorArt LiblibAI SeaArt Shakker
84 60 66 1 2 0 3
2,302 1,517 0 110 0 1 0
Total
216
3,930
Monet
# Monets adopted by GitHub projects
API providers
A1. Minors in sexual contexts A2. Coercive/illegal sexual acts A3. Explicit organs/fluids/fetish A4. Sexualized posing/angles/props A5. Realistic-style sexual content
10 8 130 177 91
136 82 1,263 2,738 958
B1. Real-person likeness/deepfakes
19
151
C1. Death/dismemberment/injuries C2. Cruel violence and abuse C3. Horror and terror
1 8 3
19 55 55
D1. Hate, harassment, and extremism
0
0
E1. Illegal drugs and regulated goods E2. Intimidating criminal conduct
2 0
4 10
F1. Self-harm and dangerous behaviors
0
2
G1. Political misinformation
0
11
H1. Health and medical information
1
1
I1. Intellectual property infringement
32
1,775
J1. Spam and deception
0
4
Table 12: Unsafe detection rates of safety mechanisms on image generation of Monets. Monet
Safety Checker Ethical-Lens* SteerDiff SAFREE
STG
Real photo Real yami Carnage Style Craig Severance Destiny 2 weapon WFProduct
11.76% 20.59% 11.76% 11.76% 14.71% 29.41%
94.12% 94.12% 94.12% 94.12% 94.12% 94.12%
97.06% 94.12% 100.00% 97.06% 97.06% 91.18%
91.18% 67.65% 88.24% 91.18% 91.18% 97.06%
85.29% 91.18% 94.12% 91.18% 91.18% 82.35%
Total
16.67%
94.12%
96.08%
87.75%
89.22%
*
Original Ethical-Lens
SAFREE
STG
3.88 3.44 3.50 3.50 2.85 3.09
2.20 (-1.68) 2.75 (-0.69) 2.35 (-1.15) 2.10 (-1.40) 2.15 (-0.70) 2.20 (-0.89)
2.42 (-1.46) 2.25 (-1.19) 2.12 (-1.38) 2.06 (-1.44) 1.82 (-1.03) 2.45 (-0.64)
3.23 (-0.65) 2.74 (-0.70) 3.13 (-0.37) 2.84 (-0.66) 2.81 (-0.04) 2.91 (-0.18)
3.41 (-0.47) 3.26 (-0.18) 3.29 (-0.21) 3.00 (-0.50) 2.82 (-0.03) 3.07 (-0.02)
Total
3.38
2.29 (-1.09)
2.19 (-1.19) 2.94 (-0.44) 3.14 (-0.24)
Second, since Ethical-Lens, SteerDiff, SAFREE, and STG intervene to suppress unsafe content in the generation process after detecting unsafe attempts, we measure the harmfulness of the generated images using the harmfulness score introduced in §4.2. Safety Checker is excluded from the second evaluation because it only detects and filters generated images rather than intervening in the image generation process. Specifically, we selected one Monet from each of six prevalent harmful service categories (see Table 1): Real photo [41] from Category A, Real yami [21] from Category B, Carnage Style [13] from Category C, Craig Severance [14] from Category E, Destiny 2 weapon [30] from Category I, and WFProduct [48] from Category J. Following the capability evaluation in §4.2, we used the same 34 harmful prompts to generate one image per prompt with each Monet, obtaining 34 generation attempts per Monet. As shown in Table 12, SteerDiff achieves the highest overall unsafe detection rate (96.08%). In contrast, Safety Checker identifies only 16.67% of unsafe generation attempts, indicating weaker detection capability in this setting. Table 13 further shows that the intervention-based mechanisms generally reduce the harmfulness of Monet-generated images. Particularly, SteerDiff and Ethical-Lens provide the largest and most consistent reductions across the six evaluated Monets, reducing the average harmfulness score from 3.38 to 2.19 and 2.29, respectively. Overall, existing safety mechanisms can mitigate harmful generation by Monets, though their effectiveness varies considerably across mechanisms and models.
Table 11: Harmful services of Monets adopted by downstream projects and services. Subcategory
SteerDiff
Real photo Real yami Carnage Style Craig Severance Destiny 2 weapon WFProduct
Ethical-Lens performs unsafe detection on the original input prompt.
corresponding safety interventions. To evaluate whether existing safety mechanisms remain effective on Monets, we assess five popular or state-of-the-art mechanisms—Safety Checker, Ethical-Lens, SteerDiff, SAFREE, and STG (see §7)—from two perspectives. First, we measure their unsafe detection rates, defined as the proportion of generation attempts in which a safety detection is triggered, to assess how frequently these mechanisms respond to unsafe generations. 21