Hook:
But the code didn't care about the First Amendment. The moment xAI's Grok accepted a photograph of a real person and output a nude version, the transaction was logged. The input was a JPEG. The output was a liability. Minnesota's new "undressing" ban—the first state-level law specifically targeting AI tools that generate nude images of real people without consent—has turned Grok from a product into a legal sandbox. And the argument that this is about speech, not tool design, is the kind of abstraction that gets you rekt in a smart contract audit.
I've seen this pattern before. In 2017, I audited a DeFi liquidity pool that claimed to be "self-regulating" until a Diamond Cut inheritance pattern allowed a reentrancy attack under specific gas conditions. The whitepaper argued it was a feature of composability. The code proved it was a vulnerability. Minnesota is now running the same audit on Grok, and the vulnerability is not in the model weights—it's in the assumption that a state can't regulate a global tool by calling it a "marketplace for digital sexual violence."
Context:
Minnesota's law, passed in early 2026, prohibits the creation, distribution, or facilitation of "undressing" tools—AI systems that transform a clothed image of a real person into a nude or sexualized version. The state's attorney general has positioned the law as a consumer protection measure, regulating a tool that has no legitimate use case beyond non-consensual intimate imagery (NCII). xAI, operator of the Grok AI assistant, has publicly called the ban unconstitutional, arguing it violates the First Amendment by restricting the generation of "speech"—even if that speech is a nude image of someone who didn't consent.
Here's the structural problem: the law doesn't criminalize the output. It criminalizes the tool's capability. That's like making a contract illegal because its constructor can be called with malicious parameters. The state is saying: if your AI has a function that, when invoked with a real person's photo, returns a nude version, you've built a weapon. And the First Amendment was never designed to protect the design of a weapon.
Core:
Let's trace the logic at the code level. Grok is not a random image generator. It's a multimodal assistant that can take an uploaded photo and perform edits. The "undressing" capability is not a hidden backdoor—it's a feature that exists at the intersection of image inpainting, style transfer, and object removal. The model doesn't have a single function called undress(person). Instead, it has a latent space where the concept of "naked body" can be combined with the concept of "this specific person's face." The attack surface is not a line of code; it's the entire representation space.
From my experience simulating the Terra/Luna collapse post-mortem, I learned that economic mechanisms cannot be fixed by patching code. Similarly, you cannot patch a model's latent space to remove a single concept without breaking the entire representation. The state of the art in model alignment—RLHF, constitutional AI, classifier-based filters—is probabilistic. A filter can reduce the probability of generating NCII, but it cannot reduce it to zero. And the law doesn't require a probability; it requires a guarantee.
This is where the "tool" vs "speech" distinction becomes a matter of engineering, not just law. If the state bans the tool, it's effectively requiring xAI to produce a model that cannot, under any input, produce a nude image of a real person. That's a deterministic requirement in a probabilistic system. The only way to achieve it is to remove the ability to generate any realistic human images at all—or to implement a strict identity verification system that knows whether a person has consented to being edited.
I benchmarked zk-SNARKs vs zk-STARKs for a scalability analysis last year, and the lesson was the same: proving a negative is exponentially harder than proving a positive. Proving that a model "cannot" generate a specific output is impossible without dynamic analysis. The compliance burden is not a content filter; it's a redesign of the entire inference pipeline.
Contrarian:
The conventional wisdom is that xAI will lose this case because the public is against non-consensual sexual content. But the contrarian blind spot is that the state's "tool" argument cuts both ways. If the tool is illegal, then the state must define what constitutes a "tool" for undressing. Is it a model that can generate nude images of real people? Almost every modern image generation model can do that. Is it a model that is specifically marketed for that purpose? Then xAI can argue that Grok is a general assistant, not a dedicated undressing app. Is it a model that lacks sufficient safeguards? Then the law becomes a mandate for a specific safety standard, which the state has not defined.
This is the same ambiguity we see in smart contract regulation: what is a "security"? The Howey Test is 80 years old, and it's still contested. The Minnesota law is a single sentence in a bill. It will take years of litigation to determine what "undressing tool" means. And in that time, the technology will evolve. The model will be fine-tuned. The definition will be outdated.
More importantly, the First Amendment argument is not as weak as the state claims. The Supreme Court has held that computer code is speech. If the model's weights are a form of expression—a compressed representation of concepts—then restricting the model's ability to generate certain outputs is a content-based restriction, subject to strict scrutiny. The state's interest in preventing NCII is compelling, but the law must be narrowly tailored. Banning all image editing capabilities is not narrow.
Takeaway:
The real vulnerability is not in the law or the model. It's in the assumption that state-level regulation can solve a global problem. Grok will still exist in every other state. The model will be downloaded, fine-tuned, and deployed. Minnesota's ban will cause xAI to implement a geofence—a crude IP-based filter that will be trivial to bypass with a VPN. The result is not a safer internet; it's a fragmented one where the same tool is legal in Texas and illegal in Minnesota. And the code doesn't care about borders.
From my experience building a ZK-based AI provenance protocol, I learned that trust is not a property of the model; it's a property of the verification layer. The real solution is not to ban the tool, but to require that every output includes a cryptographic proof of how it was generated, so that victims can trace the provenance. That's a smart contract approach to regulation. Until then, we're just arguing about whether a Turing machine can be outlawed by a state legislature.
Gas isn't the only thing that spikes when you run a model without a reentrancy guard. The compliance cost does too. And it's a lot harder to fix than a single line of code.