Openrouter will scan all traffic, adds human review

OpenRouter will screen all inference requests passing through its service for child sexual abuse material (CSAM) in flight, comparing content against hashes of previously identified CSAM and retaining flagged content for human review, including requests covered by its Zero Data Retention (ZDR) policy. OpenRouter said its ZDR commitment now explicitly excludes retention needed for CSAM review, reporting and legal preservation, and that reported material must be preserved for one year after submission to the National Center for Missing & Exploited Children's CyberTipline under 18 U.S.C. § 2258A(a) and (h). The company is updating its documentation and related terms to describe the screening, possible retention of flagged content and how provider policies are represented.

CSAM Screening Across OpenRouter OpenRouter · OpenRouter will screen all inference requests for child sexual abuse material CSAM as they pass through our service. Screening happens in flight, during request processing. Content flagged as potential CSAM may be retained for human review, with reporting and preservation where required by law. How CSAM screening will work - Known CSAM detection. In-flight screening will include comparing applicable content against hashes digital fingerprints of previously identified CSAM. - Review of suspected new CSAM. We may begin retaining content flagged as potential CSAM for human review, including content that does not match a known hash. A flag indicates suspected material; it is not itself a determination that the content is CSAM. Hash matching detects known material, while classifiers can identify suspected material that has not yet been added to a hash database. The National Center for Missing & Exploited Children NCMEC recommends hashing and image classifiers as basic child-safety measures for services handling images and video, including generative AI services NCMEC’s guidance https://www.missingkids.org/content/gpp-ncmec/us/en/policy-advocacy/minimum-child-safety-measures-for-online-platforms.html . Screening also applies to ZDR traffic CSAM screening will also apply to requests covered by OpenRouter’s Zero Data Retention ZDR policy. We’re updating our documentation and related terms to make OpenRouter’s own retention commitment explicit: For inference content covered by OpenRouter’s ZDR policy, we do not retain prompts or responses after processing, except when you explicitly choose to have us store them or when retention is needed for CSAM review, reporting, and related legal preservation. These CSAM provisions do not authorize general retention of ZDR inference content for unrelated purposes. OpenRouter’s commitment not to use inputs or outputs for model training continues OpenRouter’s Privacy Policy https://openrouter.ai/privacy . Reporting and preservation requirements CSAM reporting and preservation duties are established legal obligations. ZDR does not remove those duties. Under U.S. law, covered providers must report to NCMEC’s CyberTipline as soon as reasonably possible after obtaining actual knowledge of facts or circumstances indicating specified apparent offenses. Reported contents and certain related contextual material must be preserved for one year after submission. That requirement applies to reported material, rather than every item flagged for review 18 U.S.C. § 2258A a and h https://uscode.house.gov/us/usc/119-118/t18/s2258A/ . Provider policies may differ Model labs and providers may use different screening and retention methods. Some may retain content for a period of time to run automated safety checks before anything has been flagged. Those practices are separate from OpenRouter’s in-flight screening and are governed by the applicable model and provider policies. OpenRouter documents provider policies so users can understand the requirements that apply to their requests. Review those policies when choosing a model or provider, especially if your organization has specific data-retention requirements. Looking ahead AI is opening up exciting possibilities, and the practices surrounding frontier models are evolving quickly. We’re updating our documentation and related terms to describe OpenRouter’s in-flight screening, possible retention of flagged content, and how provider policies are represented. As always, we will keep you informed.