Google published a short research paper describing the new system they’ve built to filter AI generated spam, at scale. Scaled Abuse Forensics Examiner (SAFE) appears to be able to act as a human reviewing suspicious content and accounts behind it.
The paper is only 3 pages long, and announces that SAFE is already running and is used. Search Engine Journal has reported on the paper on September 25, 2026, noting that Google revealed little about testing the system. Here’s what was said and what wasn’t.
What Google Says SAFE Is
SAFE is an automated forensic system. Unlike traditional approaches that rely on a closed list of known violations, it emulates a manual investigation by the forensic analyst to counteract potential breaches. The paper describes an attempt to detect content that violates the spirit of Google’s policies and guidelines, despite the absence of relevant constraints.
The paper is titled The Synthetic Gap: Automating Forensic Investigation of AI Slop with the Scaled Abuse Forensics Examiner (SAFE). Google defines the synthetic gap as the period between the appearance of fresh generative attacks and the response in the form of a countermeasure. SAFE aims to reduce this interval.
Video Focus, But Not Video Only
The abstract and several sections of the paper are heavy on video, describing a synthetic video and channel abuse design, and using terms like synthetic media, adversarial synthetic media and multimodal signals.
While the paper does not state that SAFE is only a video detector, it does show that the program has other facets. For example, the researchers describe a content analysis pipeline involving multimodal semantic embeddings, while also discussing generative content artifacts in general terms. Roger Montti of Search Engine Journal points out that this is a significant detail, as a tool that only detected videos would presumably be described as such.
The Second System Google Has Named This Year
SAFE appears to be the second system Google has found in 2026 that is designed to detect AI-generated spam. The first system is called the Scalable Cluster Termination System, or S-CTS. Montti believes that Google’s research on these systems shows that they are genuinely concerned about AI spam, and that both systems may be related to the September spam update. This is a link he has made based on the information he has at his disposal, and not one that Google has released publicly.
Why Manual Review Falls Short
Unlike humans, abusive networks can leverage AI to generate an astronomical amount of synthetic content and slightly vary it to bypass existing detection mechanisms. However, manual analysis of such content can help identify connections, behaviors, patterns, and even infrastructure common to these networks. The main issue is that manual analysis is not scalable enough to keep up with AI-generated spam. The paper notes that existing manual forensic workflows are mostly based on identifying patterns and analyzing metadata, which is not effective at this scale. SAFE is Google’s solution to this growing problem, and it utilizes automated methods to perform these analyses.
Three Foundations Behind SAFE
The background section of the paper describes three pillars that make up the system.
-
- Detecting inorganic behavior. SAFE focuses on detecting coordinated behavior that differs significantly from the patterns established by typical users. It also analyzes timing, including bursts of activity, infrastructure, posting behavior and other common factors, including fake user behavior signals. The paper cites botnets and coordinated adversarial campaigns as a motivating factor for this type of analysis.
- Automating forensics with multiple agents. SAFE splits the investigation into separate tasks and hands each one to a specialized AI agent. A root agent manages the others and makes the final call.
- Understanding content with transformer models. SAFE uses transformer-based language models to understand the context and meaning of content, including multi-modal information. The paper finds that spirit of policy violations are primarily detected by a large language model that was trained on a small set of examples. This allows the model to identify content that violates the spirit of a policy not captured by any specific known violations as well as content that eludes conventional classification and detection approaches.
- Meet the Four Agents. The paper presents four agents in SAFE. The Root Agent, or Orchestrator, coordinates the investigation and assigns tasks to the specialized agents, evaluates their results, and synthesizes the final verdict.
The Content Understanding Agent is central to the detection of synthetic artifact abuse. It uses language model approaches to detect known signal types of AI abuse as well as novel methods of circumventing current classifiers and policy-violating content.
The Behavior Understanding Agent is responsible for detecting inorganic patterns of behavior. It investigates behavior that demonstrates levels of organization beyond natural human coordination and evaluates infrastructure and timing patterns across channels, including burst publishing and other channel-specific methods.
The Channel Cluster Understanding Agent uses graph-based relation identification to detect connections within spam networks. It investigates the affiliation of a content producer with a set of nodes that comprise an extended network of producers and coordinators, enabling SAFE to take action against the overall cluster rather than individual channels at a time.
What Google Has Not Shared
The paper is exceptionally cautious for a research work, only stating that the system was tested but not publishing the results for the tests. As such, the paper only indicates that the system is live, having reported that early operational results show SAFE speeds up the identification of novel synthetic threats relative to systems that make use of human-in-loop processes.
Google does not indicate, in the material covered by Search Engine Journal, if SAFE runs on web search results or not. Due to the paper’s focus on video and channel abuse, it is unclear if the system goes beyond these features.
Timing With the September Spam Update
Google announced that it started rolling out its September 2026 spam update on September 24 at 9:15 a.m. PDT, according to the Search Status Dashboard. This update is applicable worldwide and to all languages since it has a global scope, and Google estimates that the rollout window could last for two weeks.
This is the fourth confirmed spam update of 2026, following updates in March, June and August, which took 19 hours and 30 minutes, 2 days and 1 hour, and 2 days and 16 hours to finish, respectively. For each of these updates, Google allocated a few-day rollout window. Google has not disclosed whether the September update targets a particular spam policy or tactic.
What Site Owners Can Check
Google applies spam updates for significant upgrades to the automation tools it uses to identify spam. If a site sees changes in ranking or traffic then it can compare the dates in Search Console with the update window.
Google suggests affected sites should check its spam policies, sites that do not comply with such policies may rank lower or may not appear at all. Google says their automated system may take many months of discovering compliance for a site to be improved.
Identify the structures tied to the networks of channels discussed, such as identical feature profiles, cross-publishing, synchronized posting, and publishing almost all your content within a few days.
What the Paper Adds to the AI Content Debate
Some people within the SEO community are claiming that Google detects spam by determining if content was generated by an AI. Montti points out that the paper actually suggests that Google does much more than that; SAFE uses content analysis, behavioral analysis, infrastructure mapping and the analysis of relationships between producers, just as a human forensic team would.
FAQs
Q 1: What is Google SAFE?
SAFE (Scaled Abuse Forensics Examiner) is an AI system, described in a Google research paper, that can identify AI spam and abuse in a manner similar to a human manual review.
Q 2: Has Google implemented SAFE?
According to the research paper, Google has deployed SAFE, showing “early results” in the accelerated identification of new synthetic threats, although it does not provide any testing data.
Q 3: Does SAFE only detect AI-generated video?
While the research paper shows a tendency toward video and channel abuse, it does not confirm that SAFE only detects AI video content, claiming multi-modal semantic embeddings analysis.
Q 4: What is a spirit of policy violation?
A spirit of policy violation refers to content not explicitly identified as a policy violation but still contrary to the spirit or intent of a policy or platform guideline. According to the research paper, SAFE uses a language model fine-tuned on a set of examples to identify such violations.
Q 5: How many AI agents does SAFE use?
The research paper describes four AI agents: the Root Agent, Content Understanding Agent, Behavior Understanding Agent, and Channel Cluster Understanding Agent. The first one coordinates the activity of other agents and produces the final output.
Q 6: What did Google use to detect AI spam previously?
Google’s previous system for detecting AI spam abuse was known as the Scalable Cluster Termination System, or S-CTS. According to the report, SAFE is the second such system to be deployed in early 2026.
Q 7: Is SAFE a part of the September 2026 spam update?
Google has not officially confirmed that SAFE is part of the September 2026 core algorithm update. However, Search Engine Journal has suggested that these systems may be incorporated into the update, which is not an official confirmation from Google.
Q 8: When did the September 2026 spam update launch?
The September 2026 update was launched on Sept. 24, 2026, at 9:15 a.m. PDT. According to Google, this update’s rollout period could last as long as two weeks.
Q 9: What should I do if my traffic was impacted by the update?
You should review your traffic data in Search Console against the dates of the update and Google guidelines. According to Google, sites that violated their guidelines could be demoted or removed from search results.
Q 10: Can a site recover from the spam update?
According to Google, modified sites can recover from the spam update if its spam-fighting systems observe improvements over several months.
