Child Safety Exploitation Material Detection Prompt

This prompt is designed for trust and safety engineers operating platforms with mandatory reporting obligations under regulations such as NCMEC requirements in the United States or comparable international frameworks. It classifies user-submitted text for signals related to child sexual abuse material (CSAM), online grooming patterns, and sexual solicitation of minors. The prompt is not a replacement for hash-matching or PhotoDNA scanning of known CSAM. It is a text-based classification layer that sits at the ingress point of user-generated content, direct messages, or chatbot interactions. Use this prompt when you need a structured detection flag, verbatim evidence excerpts, a calibrated confidence tier, and a deterministic routing decision for mandatory human review.

The ideal user is a platform safety engineer integrating this prompt into an automated triage pipeline. The required context includes the raw user-submitted text, the conversation history if available, and the platform's specific reporting obligations. This prompt is most effective as a high-recall screening layer designed to catch novel or previously unseen textual patterns that hash-matching systems cannot identify. It should be deployed immediately after PII redaction but before the content enters any long-term storage or model training datasets. The output is a machine-readable JSON structure containing a detection_flag, evidence_excerpts, confidence_tier (low, medium, high), and a routing_decision that forces human review for any non-low result.

Do not use this prompt as the sole decision-maker for law enforcement reporting. Every high-confidence detection must be reviewed by a trained human moderator before any external report is filed. Do not use this prompt to classify images, video, or audio files directly; it is strictly for text analysis. Avoid deploying this prompt in environments where the cost of over-flagging benign family content is not well understood, as it requires strict evaluation against false positives on discussions of parenting, medical care, or educational content. If your platform lacks a trained human review queue, you must build that capability before integrating this prompt into a production pipeline.

This prompt template is designed for trust and safety engineers who need a reliable, auditable first-pass detection system for child safety exploitation material. It is not a replacement for hash-matching, PhotoDNA, or human expert review. Instead, it serves as a text-based triage layer that flags concerning content, extracts evidence excerpts, and routes everything above a low-confidence threshold to a human review queue. The template uses square-bracket placeholders that you must replace with your platform's specific taxonomies, risk tiers, and escalation paths before deployment.

textCopy
SYSTEM:
You are a child safety content classifier for a platform with mandatory reporting obligations. Your role is to analyze user-submitted text for indicators of child sexual abuse material (CSAM), grooming behavior, or sexual solicitation involving minors. You must be precise, evidence-based, and calibrated to avoid over-flagging benign family content.

CLASSIFICATION TAXONOMY:
[TAXONOMY_DEFINITIONS]

RISK TIERS:
- CRITICAL: Clear, unambiguous CSAM description, trading, or production discussion. Immediate escalation required.
- HIGH: Grooming patterns, sexualized conversation with a minor, or solicitation language. Escalate within [HIGH_SLA_MINUTES] minutes.
- MEDIUM: Ambiguous boundary content, coded language, or context-dependent risk. Queue for human review within [MEDIUM_SLA_HOURS] hours.
- LOW: Benign content with no indicators of child exploitation. No action required.
- FALSE_POSITIVE_RISK: Content that contains legitimate family, medical, educational, or age-appropriate relationship discussion that could be misclassified. Flag for calibration review.

INPUT:
[USER_INPUT]

CONVERSATION CONTEXT (if multi-turn):
[CONVERSATION_HISTORY]

USER METADATA:
[USER_METADATA]

OUTPUT_SCHEMA:
{
  "detection_flag": boolean,
  "risk_tier": "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "FALSE_POSITIVE_RISK",
  "confidence_score": 0.0-1.0,
  "primary_category": string,
  "secondary_categories": [string],
  "evidence_excerpts": [
    {
      "text": string,
      "category": string,
      "rationale": string
    }
  ],
  "requires_human_review": boolean,
  "escalation_priority": "IMMEDIATE" | "URGENT" | "ROUTINE" | "NONE",
  "recommended_actions": [string],
  "calibration_notes": string | null
}

CONSTRAINTS:
- Do not generate, describe, or elaborate on any exploitative content beyond the minimum evidence excerpts needed for classification.
- If the input contains legitimate discussion of parenting, pediatric health, sex education, or family activities, explicitly flag as FALSE_POSITIVE_RISK.
- When confidence is below [CONFIDENCE_THRESHOLD], set requires_human_review to true regardless of risk tier.
- Do not make final determinations about illegality. Your output is a detection signal for human reviewers, not a legal finding.
- If the input contains URLs, file references, or external pointers, note them in evidence excerpts but do not attempt to fetch or analyze external content.
- For multi-turn conversations, analyze the full context. Grooming patterns often span multiple turns.

FEW-SHOT EXAMPLES:
[FEW_SHOT_EXAMPLES]

USER:
Analyze the following input according to the taxonomy and output schema above.

Adaptation guidance: Replace [TAXONOMY_DEFINITIONS] with your platform's specific violation categories, including definitions for CSAM, grooming stages, solicitation types, and boundary cases. The [USER_METADATA] placeholder should include account age, prior flags, and any trust signals your platform tracks. [FEW_SHOT_EXAMPLES] is critical for calibration—include at least three examples of benign family content correctly classified as FALSE_POSITIVE_RISK, plus examples at each risk tier. Set [CONFIDENCE_THRESHOLD] based on your eval results; start at 0.85 and adjust downward only if your false negative rate on known CSAM text is unacceptable. The [HIGH_SLA_MINUTES] and [MEDIUM_SLA_HOURS] values should match your regulatory reporting timelines.

What to do next: After adapting the template, run it against your golden eval dataset containing known CSAM text, grooming transcripts, benign family content, and edge cases like sex education discussions. Measure precision, recall, and false positive rate separately for each risk tier. Pay special attention to FALSE_POSITIVE_RISK misclassifications—over-flagging legitimate content erodes trust and wastes reviewer capacity. Wire the prompt into a harness that enforces the output schema, logs every classification with the evidence excerpts, and routes all CRITICAL and HIGH detections to your human review queue with the full context preserved. Never deploy this prompt without mandatory human review for any detection above LOW confidence.

This prompt is not a standalone safety solution. It must be embedded in a deterministic application harness that enforces mandatory human review for all positive detections, preserves an immutable audit trail, and prevents the model output from reaching end users or downstream systems without explicit human approval. The harness should treat every model response as a preliminary signal, not a final decision. The prompt's output schema includes a human_review_required boolean, a confidence_tier enum, and evidence_excerpts array. The harness must route any response where human_review_required is true or confidence_tier is high or medium into a review queue. Low-confidence negatives may be logged and passed, but only after the harness confirms the model returned a valid, parseable schema and no evidence excerpts were provided.

Wire the prompt into an API gateway or content ingestion pipeline before the input reaches any generative model, retrieval system, or user-facing feature. The application should call the detection model with the raw user input or content payload, validate the JSON response against the expected schema, and branch on the result. If the response fails schema validation, retry once with a repair prompt that includes the raw output and validation error. If the second attempt fails, escalate to human review as a default-safe action. Log every invocation with a unique detection_id, the input hash, the full model response, the validation result, the routing decision, and the reviewer identity if escalated. Never store or log the raw user input in plaintext in application logs; use a one-way hash for deduplication and store the original content only in the encrypted case management system. For model choice, use a model with strong instruction-following and low refusal override risk. Do not use a general-purpose chat model with system prompts alone; prefer a model version that has undergone safety training and supports structured output modes. If your platform processes images or video, the harness must extract and hash visual content, run perceptual hash matching against known CSAM databases before the LLM call, and only invoke the text-based detection prompt on accompanying text, metadata, or transcripts.

Before deploying, build an evaluation harness that tests the prompt against a curated dataset including confirmed CSAM-adjacent language, grooming patterns, benign family content, medical discussions, and edge cases like sex education or abuse survivor narratives. Measure over-flagging and under-flagging rates separately. Set a maximum acceptable false positive rate for benign family content and block deployment until the prompt meets that threshold in offline eval. In production, run a shadow mode first where the prompt's output is logged and reviewed but does not trigger enforcement actions. After shadow validation, enable the human-review routing but not automated blocking. Only introduce automated blocking for high-confidence detections after a defined observation period with audited reviewer agreement rates. The harness must also implement rate limiting and abuse detection on the detection endpoint itself to prevent adversaries from probing the detection threshold through repeated submissions.