They probably don't even need CSAM, the AI can probably just be running through cycles like "make the image look more like a porn photo" and "make the image look more like a child" simultaneously or something. I have heard they do use actual CSAM. But it would probably have to be filtered at the user input stage in the generator itself