Hugging Face Hosts Nudify Models With Little to Stop Them
Hugging Face is being used to host and distribute AI models that generate sexualized deepfakes of women and children, and the platform is doing little to prevent it. Researchers found that nudification tools are trivially accessible through the platform's model hub.
Original sourceHugging Face, the dominant open-source AI model hub with hundreds of thousands of hosted models, has become a distribution platform for so-called "nudify" tools — models that strip clothing from photos of real people, including children. An investigation by The Verge found these models are easily discoverable, downloadable, and runnable with minimal friction, often requiring nothing more than a few lines of Python and a Hugging Face API token.
The platform's content policies nominally prohibit the generation of non-consensual intimate imagery (NCII) and child sexual abuse material (CSAM), but enforcement is inconsistent at best. Researchers and journalists were able to locate, clone, and run these models without triggering any automated flagging or account action. Hugging Face's trust and safety infrastructure — to the extent it exists — appears to lag far behind the volume and velocity of model uploads the platform receives daily.
This is not the first time Hugging Face has faced scrutiny over hosted content. The company has historically positioned itself as a neutral infrastructure layer for the open-source AI community, a stance that has enabled enormous growth but also made it a vector for harmful applications. Unlike image-generation APIs from OpenAI or Stability AI, which apply content filters at inference time, many models on Hugging Face run locally after download, making post-distribution enforcement nearly impossible.
The implications extend well beyond the platform itself. Hugging Face sits at the center of open-source AI distribution — if it cannot or will not enforce meaningful guardrails at the upload and discovery layer, it becomes the path of least resistance for anyone seeking to deploy models designed to harm real people. The question is no longer whether the platform has a policy, but whether it has the institutional will to enforce one.
Panel Takes
The Skeptic
Reality Check
“Hugging Face has been running the "neutral infrastructure" defense for years, but neutral infrastructure doesn't get to opt out of accountability when it becomes the world's easiest distribution channel for CSAM-adjacent tooling. The real tell here is that enforcement is inconsistent — not absent, inconsistent — which means the policy exists as liability cover, not as a genuine constraint on what gets hosted. What would have to change: a dedicated trust and safety team with actual enforcement authority, upload-time screening for known NCII model architectures, and leadership willing to lose some open-source goodwill to not be complicit in this.”
The Builder
Developer Perspective
“The technical reality is brutal: once a model is downloaded, the platform has zero enforcement surface. That's not a bug in Hugging Face's design, it's a fundamental property of local inference — and it means the only meaningful intervention point is pre-download, at discovery and access. Hugging Face has the API primitives to gate model downloads behind verified identity, content-category acknowledgment, or even model-card review flags — they've just chosen not to deploy them in any consistent way here. Building a content policy without controlling the distribution primitive is theater.”
The Futurist
Big Picture
“The thesis Hugging Face has been running — that open model distribution is categorically different from open content distribution, and therefore exempt from the moderation obligations YouTube or Facebook faced — is about to get stress-tested by regulators who do not care about that distinction. The EU AI Act, the UK Online Safety Act, and a growing number of U.S. state-level NCII statutes are all converging on exactly this fact pattern: a platform that knowingly hosts tools used to generate intimate imagery of real people without consent. The second-order effect is that every serious enterprise buyer of Hugging Face's paid tier now has a compliance question to answer, and that is a business problem that will move faster than any policy reform.”
The Founder
Business & Market
“Hugging Face raised at a $4.5B valuation on the thesis that it is the GitHub of AI — but GitHub learned the hard way that platform scale and content liability are inseparable, and they had a decade to figure it out before regulators caught up. Hugging Face does not have that runway. The enterprise business — which is where the actual revenue lives — is directly threatened every time a Fortune 500 legal team googles "Hugging Face" and the top result is a story about child exploitation tools. The neutral-infrastructure positioning was always a strategic choice, not a law of physics, and right now it is a choice that is actively destroying enterprise trust faster than any sales team can rebuild it.”