{"course":{"slug":"ai-images","title":"Image Generation, in Practice","url":"https://addaly.com/learn/ai-images","level":"beginner","track":"create"},"lesson":{"slug":"the-safety-filter-differs","title":"Every platform's filter is different, and that is a production risk","url":"https://addaly.com/learn/ai-images/the-safety-filter-differs","position":9,"of":69,"minutes":7,"answer":"A refusal is produced by a keyword layer, an output classifier and an account-level policy stacked together, all tuned for the platform's liability rather than your brief.","keyIdea":"A refusal is produced by a keyword layer, an output classifier and an account-level policy stacked together, all tuned for the platform's liability rather than your brief, which is why the same prompt passes on one service and fails on another."},"body":{"format":"markdown","text":"## Three filters, not one\n\nWhen a hosted service refuses to make your picture, it is rarely a single check. Three layers are usually stacked.\n\n**The prompt filter** looks at your text before anything runs. It is a keyword and pattern layer, deliberately over-inclusive, and it does not understand context. \"Shoot the product against a white wall\", \"kill the overhead lights\", \"a child's birthday party\", \"she is bleeding out from the ears\" in a medical illustration brief: all of these have been refused by mainstream services at some point. The refusal is fast and usually says something vague about policy.\n\n**The output classifier** looks at the generated image before returning it. This one you notice as a black frame, a blur, or a silent re-roll. It catches things the prompt filter could not predict, which is why an innocent prompt sometimes fails on one seed and passes on the next: the classifier is judging the actual pixels, and the model produced something borderline.\n\n**The account layer** counts your refusals. Several services throttle, warn or suspend after repeated blocks. This matters more than the individual refusal, because a legitimate brief that trips the filter twenty times in an afternoon can cost you the account you are delivering from.\n\n> Figure: Three filters stacked, and where each one stops you. Steps: 1. Prompt filter (Keywords, before anything runs. Deliberately over-inclusive, and blind to context.); 2. The model runs (Your picture is made.); 3. Output classifier (Judges the pixels. A black frame, a blur, or a silent re-roll.); 4. Account layer (Counts refusals. Throttling, a warning, or a suspension mid-project.). Only the first two are about your prompt. The last is why a legitimate brief that trips the filter twenty times in an afternoon can cost you the account you are delivering from.\n\n## Why this is a production problem\n\nA filter is a business decision about the platform's exposure, not a judgement about your work. That has three consequences on a deadline.\n\n1. **It changes without notice.** A prompt that worked in March fails in September because policy tightened after an incident. Your archived workflow is not reproducible on a hosted service in the way a local one is.\n2. **It differs across services.** Anatomy for a medical illustration, a historical war photograph, a horror film poster, a bruise for a domestic-violence charity campaign: each of these passes somewhere and fails somewhere else.\n3. **Named people are blocked almost everywhere.** Most major services block prompts naming living public figures, and several block historical ones too. This is the filter behaving as designed, and it is not going to be argued with.\n\n## What to do about it\n\nDo not try to defeat a filter. Leaving aside that it usually violates the terms you agreed to, evading a safety system is the fastest way to lose an account mid-project, and \"my generator got suspended\" is not a thing you can say to a client.\n\nDo the boring things instead:\n\n- **Rephrase clinically.** \"Anatomical cross-section, medical textbook illustration\" clears filters that \"cut open\" does not, and describes the brief more accurately anyway.\n- **Split the image.** Generate the difficult element separately or photograph it, and composite. Most \"impossible\" briefs are one small region.\n- **Keep a fallback route.** If the work is sensitive (health, conflict reporting, harm-reduction campaigns) plan for open weights on your own machine from the start, where the only filter is the one you choose to run.\n- **Check the filter early.** If a campaign concept depends on imagery you suspect is borderline, test it in the first hour, not the night before delivery.\n\n## The limitation to be honest about\n\nLocal open weights are not filter-free either, and pretending otherwise is a disservice. Most open image models were trained on datasets that had explicit material filtered out, and several have an additional safety checker you can disable. Removing the checker does not restore what was never trained in: the model is weak at the categories the dataset excluded, and will produce distorted anatomy rather than the thing you asked for.\n\nAnd the responsibilities do not disappear with the filter. Non-consensual sexual imagery, sexual content involving minors, and fabricated imagery of real identifiable people are illegal or actionable in most jurisdictions regardless of what software produced them. A local model removes a platform's guardrail. It does not remove the law, and it certainly does not remove your name from the invoice.\n\n## The false-positive tax, in numbers\n\nIt is worth having a sense of scale. On a difficult-but-legitimate brief (trauma, conflict, medical, anything involving injury) expect somewhere between one in five and one in three attempts to be refused or silently re-rolled on a mainstream hosted service. That is not a defect report; it is the design point, because the cost of letting through one harmful image is, for the provider, much higher than the cost of annoying you.\n\nBuild that into your estimate. If a brief has four sensitive frames and you are on a hosted service, budget the time as though it has six, and tell the client early that the imagery may need to be shot or composited instead. The version of this conversation you have on day one is short. The version you have at 9pm the night before delivery is not.\n\n## Write the refusals down\n\nKeep a short log of what was refused and where. Two lines per incident: the prompt, and the service. Within a month you will have a map of which service tolerates which subject matter, and that map is worth more than any general advice about which provider is \"best\", because it is measured on the work you actually do rather than on somebody else's.\n\nIt also gives you something to show a client when you have to explain why a concept needs rethinking, which is a far better conversation than an unsupported assertion that the tool will not do it."},"check":{"question":"A charity campaign about domestic violence needs an image showing bruising. Two hosted services refuse it. What is the professionally sound response?","options":[{"text":"Rephrase clinically, and if that fails, plan the sensitive element as a local render or a photograph to composite.","correct":true},{"text":"Split the description into fragments that each pass the keyword filter on their own, then reassemble the full scene across a series of separate attempts.","correct":false,"tempting":"This is filter evasion by another name; it breaches the terms you agreed to and risks losing the account mid-campaign, with no argument you can make to the client afterwards."},{"text":"Accept that this imagery is simply not available from generative tools at present, and go back to the client to change the creative concept entirely.","correct":false,"tempting":"Gives up too early: the prompt filter is one of three layers and is over-inclusive by design, so clinical phrasing or a composited element usually resolves it without altering the brief."},{"text":"Move to whichever service has the most permissive published policy, since strictness of filtering is the main thing that distinguishes one provider from another.","correct":false,"tempting":"Shopping for permissiveness treats a liability decision as a feature comparison, and leaves the project dependent on a policy that can tighten overnight."}]},"prev":{"slug":"quantisation-and-offload","title":"Making a big model fit a small card","url":"https://addaly.com/learn/ai-images/quantisation-and-offload"},"next":{"slug":"a-reproducible-setup","title":"The setup that still works in six months","url":"https://addaly.com/learn/ai-images/a-reproducible-setup"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Every platform's filter is different, and that is a production risk', in Image Generation, in Practice. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/ai-images/the-safety-filter-differs (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Every platform’s filter is different, and that is a production risk","courseTitle":"Image Generation, in Practice","module":{"index":1,"slug":"the-kit","title":"The kit, and what each piece of it costs you"},"answer":null,"keyIdea":"A refusal is produced by a keyword layer, an output classifier and an account-level policy stacked together, all tuned for the platform’s liability rather than your brief, which is why the same prompt passes on one service and fails on another.","hero":{"kind":"figure","figure":{"t":"figure","label":"Figure","figure":{"type":"flow","steps":[{"label":"Prompt filter","detail":"Keywords, before anything runs. Deliberately over-inclusive, and blind to context."},{"label":"The model runs","detail":"Your picture is made."},{"label":"Output classifier","detail":"Judges the pixels. A black frame, a blur, or a silent re-roll."},{"label":"Account layer","detail":"Counts refusals. Throttling, a warning, or a suspension mid-project."}],"title":"Three filters stacked, and where each one stops you","caption":"Only the first two are about your prompt. The last is why a legitimate brief that trips the filter twenty times in an afternoon can cost you the account you are delivering from."},"alt":"Figure: Three filters stacked, and where each one stops you. Steps: 1. Prompt filter (Keywords, before anything runs. Deliberately over-inclusive, and blind to context.); 2. The model runs (Your picture is made.); 3. Output classifier (Judges the pixels. A black frame, a blur, or a silent re-roll.); 4. Account layer (Counts refusals. Throttling, a warning, or a suspension mid-project.). Only the first two are about your prompt. The last is why a legitimate brief that trips the filter twenty times in an afternoon can cost you the account you are delivering from."}},"blocks":[{"t":"h2","id":"three-filters-not-one","runs":[{"text":"Three filters, not one"}]},{"t":"p","runs":[{"text":"When a hosted service refuses to make your picture, it is rarely a single check. Three layers are usually stacked."}]},{"t":"p","runs":[{"text":"The prompt filter","b":true},{"text":" looks at your text before anything runs. It is a keyword and pattern layer, deliberately over-inclusive, and it does not understand context. “Shoot the product against a white wall”, “kill the overhead lights”, “a child’s birthday party”, “she is bleeding out from the ears” in a medical illustration brief: all of these have been refused by mainstream services at some point. The refusal is fast and usually says something vague about policy."}]},{"t":"p","runs":[{"text":"The output classifier","b":true},{"text":" looks at the generated image before returning it. This one you notice as a black frame, a blur, or a silent re-roll. It catches things the prompt filter could not predict, which is why an innocent prompt sometimes fails on one seed and passes on the next: the classifier is judging the actual pixels, and the model produced something borderline."}]},{"t":"p","runs":[{"text":"The account layer","b":true},{"text":" counts your refusals. Several services throttle, warn or suspend after repeated blocks. This matters more than the individual refusal, because a legitimate brief that trips the filter twenty times in an afternoon can cost you the account you are delivering from."}]},{"t":"h2","id":"why-this-is-a-production-problem","runs":[{"text":"Why this is a production problem"}]},{"t":"p","runs":[{"text":"A filter is a business decision about the platform’s exposure, not a judgement about your work. That has three consequences on a deadline."}]},{"t":"ol","start":1,"items":[[{"text":"It changes without notice.","b":true},{"text":" A prompt that worked in March fails in September because policy tightened after an incident. Your archived workflow is not reproducible on a hosted service in the way a local one is."}],[{"text":"It differs across services.","b":true},{"text":" Anatomy for a medical illustration, a historical war photograph, a horror film poster, a bruise for a domestic-violence charity campaign: each of these passes somewhere and fails somewhere else."}],[{"text":"Named people are blocked almost everywhere.","b":true},{"text":" Most major services block prompts naming living public figures, and several block historical ones too. This is the filter behaving as designed, and it is not going to be argued with."}]]},{"t":"h2","id":"what-to-do-about-it","runs":[{"text":"What to do about it"}]},{"t":"p","runs":[{"text":"Do not try to defeat a filter. Leaving aside that it usually violates the terms you agreed to, evading a safety system is the fastest way to lose an account mid-project, and “my generator got suspended” is not a thing you can say to a client."}]},{"t":"p","runs":[{"text":"Do the boring things instead:"}]},{"t":"ul","items":[[{"text":"Rephrase clinically.","b":true},{"text":" “Anatomical cross-section, medical textbook illustration” clears filters that “cut open” does not, and describes the brief more accurately anyway."}],[{"text":"Split the image.","b":true},{"text":" Generate the difficult element separately or photograph it, and composite. Most “impossible” briefs are one small region."}],[{"text":"Keep a fallback route.","b":true},{"text":" If the work is sensitive (health, conflict reporting, harm-reduction campaigns) plan for open weights on your own machine from the start, where the only filter is the one you choose to run."}],[{"text":"Check the filter early.","b":true},{"text":" If a campaign concept depends on imagery you suspect is borderline, test it in the first hour, not the night before delivery."}]]},{"t":"h2","id":"the-limitation-to-be-honest-about","runs":[{"text":"The limitation to be honest about"}],"role":"limit"},{"t":"p","runs":[{"text":"Local open weights are not filter-free either, and pretending otherwise is a disservice. Most open image models were trained on datasets that had explicit material filtered out, and several have an additional safety checker you can disable. Removing the checker does not restore what was never trained in: the model is weak at the categories the dataset excluded, and will produce distorted anatomy rather than the thing you asked for."}]},{"t":"p","runs":[{"text":"And the responsibilities do not disappear with the filter. Non-consensual sexual imagery, sexual content involving minors, and fabricated imagery of real identifiable people are illegal or actionable in most jurisdictions regardless of what software produced them. A local model removes a platform’s guardrail. It does not remove the law, and it certainly does not remove your name from the invoice."}]},{"t":"h2","id":"the-false-positive-tax-in-numbers","runs":[{"text":"The false-positive tax, in numbers"}]},{"t":"p","runs":[{"text":"It is worth having a sense of scale. On a difficult-but-legitimate brief (trauma, conflict, medical, anything involving injury) expect somewhere between one in five and one in three attempts to be refused or silently re-rolled on a mainstream hosted service. That is not a defect report; it is the design point, because the cost of letting through one harmful image is, for the provider, much higher than the cost of annoying you."}]},{"t":"p","runs":[{"text":"Build that into your estimate. If a brief has four sensitive frames and you are on a hosted service, budget the time as though it has six, and tell the client early that the imagery may need to be shot or composited instead. The version of this conversation you have on day one is short. The version you have at 9pm the night before delivery is not."}]},{"t":"h2","id":"write-the-refusals-down","runs":[{"text":"Write the refusals down"}]},{"t":"p","runs":[{"text":"Keep a short log of what was refused and where. Two lines per incident: the prompt, and the service. Within a month you will have a map of which service tolerates which subject matter, and that map is worth more than any general advice about which provider is “best”, because it is measured on the work you actually do rather than on somebody else’s."}]},{"t":"p","runs":[{"text":"It also gives you something to show a client when you have to explain why a concept needs rethinking, which is a far better conversation than an unsupported assertion that the tool will not do it."}]}],"check":{"question":[{"text":"A charity campaign about domestic violence needs an image showing bruising. Two hosted services refuse it. What is the professionally sound response?"}],"options":[{"text":[{"text":"Rephrase clinically, and if that fails, plan the sensitive element as a local render or a photograph to composite."}],"correct":true,"tempting":null},{"text":[{"text":"Split the description into fragments that each pass the keyword filter on their own, then reassemble the full scene across a series of separate attempts."}],"correct":false,"tempting":[{"text":"This is filter evasion by another name; it breaches the terms you agreed to and risks losing the account mid-campaign, with no argument you can make to the client afterwards."}]},{"text":[{"text":"Accept that this imagery is simply not available from generative tools at present, and go back to the client to change the creative concept entirely."}],"correct":false,"tempting":[{"text":"Gives up too early: the prompt filter is one of three layers and is over-inclusive by design, so clinical phrasing or a composited element usually resolves it without altering the brief."}]},{"text":[{"text":"Move to whichever service has the most permissive published policy, since strictness of filtering is the main thing that distinguishes one provider from another."}],"correct":false,"tempting":[{"text":"Shopping for permissiveness treats a liability decision as a feature comparison, and leaves the project dependent on a policy that can tighten overnight."}]}],"order":[1,2,3,0],"why":null},"prev":{"slug":"quantisation-and-offload","title":"Making a big model fit a small card","minutes":8},"next":{"slug":"a-reproducible-setup","title":"The setup that still works in six months","minutes":7}}}