>If the message is flagged, it can be sent over an encrypted HTTPS channel to authorities

okay, but how do you prevent me from intercepting that communication.

Or even running my own copy of the local model and determing ahead of time whether it will trip the alarm. If the attacker has access to the model, they can effectively make a GAN to modify images to get past the filter.

Or even just having a proxy that pretends to be the official service but that just drops the reported messages.