Summary
According to the National Police Agency, nine in ten victims are junior- or senior-high students, and only 7 cases involved someone met through social media. The same day, it was reported that the Metropolitan Police Department had arrested a company employee for posting to a social-media message board sexual images made by altering photographs of real women with generative AI, and that a high-school student who commissioned the images would be referred to prosecutors. Statistics and investigation grasp harm after publication. That a real person’s photograph can be obtained does not authorize generating from it; unless the subject’s authorization is checked before generation and publication, recipients cannot tell from the image whether it was made without permission.
A pre-execution check means checking the subject's authorization before generating from, or publishing, a real person's photograph, and keeping a record. Detection means grasping the harm after publication; here, the NPA's statistics and police investigation did that.
passed all of last year
What got through
- What got through
- Generating sexual images and videos from photographs of real people, and posting or sharing them. The NPA’s statistics give the number of such cases police identified nationwide and the breakdown of victims and perpetrators. In the Metropolitan Police case reported the same day, images altered with generative AI were posted to a social-media message board where anyone could view them.
- What the receiving side gets
- In general, a generation service receives the source photograph and the instruction, but not whether the person pictured agreed to the use. The place it is posted to receives only the image, and a recipient cannot tell from the image itself whether it was made from a real person’s photograph without permission.
- Relationship to the perpetrator
- Close to 70% of perpetrators were classmates or students at the same school as the victim (NPA). The source photographs are close at hand, and the places they are posted to are in everyday use.
- Not disclosed
- For the cases in the statistics, the breakdown of generation tools and of posting and sharing venues. How the source photographs in the Metropolitan Police case were obtained is reported to be under investigation.
Pre-execution check
The condition that holds whatever the route is this: before generating from a real person’s photograph, and before the output is published, check that the person pictured authorized the use, separately from whether the material can be obtained.
That a real person's photograph can be obtained does not authorize generating from it; unless the subject's authorization is checked before generation and publication, recipients cannot tell from the image whether it was made without permission.
- Who approves
- The person pictured. A photograph being on the internet or social media does not stand in for agreement to its use in generation.
- Where the check happens
- Just before generation, and just before posting or sharing. Generation and publication that cannot be matched to the subject’s authorization are held before they succeed.
- What remains
- A record of which source material and which authorization each output rests on, in a form that shows authorization exists without handing over the subject’s identity or contact details, so that checking authorization does not mean collecting data on people who may be harmed.
The NPA’s statistics and the Metropolitan Police investigation made visible the breakdown of victims, the relationship of perpetrators to them, and even who commissioned the images, but all of it was grasped after generation and publication had happened. Other cases where authorization for a likeness or its provenance was not checked before generation or publication are JAPRO’s likeness and voice survey, YouTube’s fake celebrities and Grok’s deepfake consent. That a provenance mark embedded in the output could be removed echoes SynthID watermark removal.
What Lemma does
Lemma builds the pre-execution check into the point just before generating from a real person’s photograph, and just before the output is posted or shared. It does not judge whether an image is fake or file takedown requests on anyone’s behalf; it checks, before they succeed, that generation and publication carry the pictured person’s own authorization.
Industries and operations to watch
- IndustryAI
- Services that generate images or videos depicting real people from their photos or videos.
- OperationDisclosure & data release
- Venues that accept posts and shares of user-made images and videos and show them to an unspecified audience.
Current controls vs Lemma
The pattern in this case is column 1 (generating from a real person’s photograph) and column 2 (posting or publishing the output).
| Control | Generating from a real person’s photograph | Posting or publishing the output |
|---|---|---|
| NPA awareness material on preventing victimization and offending | Partial | Partial |
| Lemma (pre-execution check) | Effective | Partial |
The awareness material targets the statistical finding that most perpetrators are students at the same school, and is not built into the act of generating or posting itself. Lemma checks the pictured person’s authorization before generation. A check before posting can hold images that carry no authorization record, but it does not judge whether an image without a record was made from a real person. Nor does Lemma find or remove images already published.
Note: Lemma’s check works only when it is built into the generation service or the posting venue and the subject’s authorization is issued and managed separately from the person requesting generation. It does not act on images made by a service without the check and posted to a venue without it. The table compares what each control checks; it does not show whether this incident would have been stopped. Lemma does not detect or prevent intrusions.
Three items to confirm for generating from and publishing real people’s photographs
- Do you bind to each output a record of which source material and which authorization it was made from?
- Can you hold publication of output whose subject’s authorization cannot be matched, before it is published?
- When a report comes in, can you trace the source material and authorization record for the output concerned?
Facts and timeline
- Announcement
- Published by the NPA on 2026-08-03. Police nationwide identified 123 cases involving sexual deepfake images and videos of minors in January–June 2026, double the 60 in the same period a year earlier and past the 114 for all of last year.
- Victims
- 79 junior-high students (the largest group), 38 senior-high students, 3 elementary students, 3 unknown. Nine in ten are junior- or senior-high students (NPA).
- Perpetrators
- 83 cases involved a classmate or a student at the same school, close to 70%, against 7 involving someone met through social media (NPA).
- Case reported the same day
- The Metropolitan Police Department had arrested a company employee (32) on suspicion of violating the Act on Child Pornography (public display) and of defamation, for using generative AI to turn photographs of real women into sexual images and posting them to a social-media message board where anyone could view them. The suspect reportedly said he had altered roughly 300 images, posted between 100 and 200 of them, and that half had been commissioned by a high-school student.
- Source material and the law applied
- The source images were real photographs that existed on the internet and social media, some reportedly taken from material third parties had uploaded illegally. For one victim, a photograph from her junior-high years was used, which is why the Act on Child Pornography applied. How the images were obtained is reported to be under investigation.
- Generation tool
- The suspect reportedly had a paid subscription to a generative AI site at roughly ¥3,000 a month.
- Commissioning
- Police said a 17-year-old high-school student, who is reported to have posted a woman’s photograph on social media and commissioned the images, would be referred to prosecutors on the same two charges.
Glossary
Sexual deepfake — A photo or video of a real person altered into sexual imagery, for example with generative AI.
Public display — Placing material where an unspecified number of people can view it. Punishable under Japan's Act on Child Pornography.
Referral to prosecutors — Police sending their case files to prosecutors. It does not mean guilt has been established.
Timeline
- The NPA publishes statistics on sexual deepfake harm to those under 18 for the first time (79 consultations for January–September 2025), showing that more than half of perpetrators were connected to the same school, and releases awareness material on preventing both victimization and offending.
- The Metropolitan Police Department has arrested the company employee (32) by this date (reported August 3).
- The NPA reports 123 identified cases for January–June 2026.
The facts here rest on the NPA’s announcement and on wire-service and national-newspaper reporting of it. Case counts and breakdowns are the NPA’s. The person arrested is, as of writing, a suspect and not a convicted party. Individual names, places of residence, details that could identify people who were harmed, and how the images were made are omitted. This Brief does not blame any particular person or organization. What has not been disclosed does not mean there were no controls.
After disclosure
- The law applied: Japan has no standalone statute directly punishing sexual deepfakes; the Metropolitan Police case, too, is charged through a combination of existing law, the Act on Child Pornography (public display) and defamation.
- Liability for the commissioning party: The high-school student who commissioned the images is also to be referred to prosecutors, showing responsibility being extended beyond whoever executed the generation. Both are after-the-fact attributions of responsibility.
- Awareness: Since December 2025 the NPA has published awareness material aimed at both potential victims and potential offenders, a response to the statistical finding that most perpetrators are students at the same school.
Sources
- primary, awareness materialNational Police Agency “Awareness material for preventing sexual deepfake harm to children”
6 more (reporting, analysis)
- NPA announcementKyodo News “AI sexual images: 123 cases in the first half — NPA, double the same period last year”
- follow-upKyodo News “123 AI sexual-image cases identified in the first half”
- independent reportingNikkei “‘Deepfake’ obscene images allegedly made with AI — company employee arrested”
- JNN, independent reportingTBS NEWS DIG “Photos of a real track-and-field athlete altered with generative AI — ‘sexual deepfake’ images allegedly posted to social media”
- independent reportingAsahi Shimbun “Junior-high gym clothes altered into nudes with AI, allegedly posted to social media — company employee arrested”
- first release of the 2025 statisticsJiji Press “79 consultations involving under-18s over sexual fake imagery; more than half within schools — NPA discloses for the first time”
References: “The last layer left for cyber defense in the age of AI”