Two tools cloak and poison images against unwanted style training

The process wall

An artist posting work online has no way to stop a scraper from collecting it, and by 2023 researchers at the University of Chicago's SAND Lab had built two tools that work after that point instead of before it. Glaze, submitted 8 February 2023, applies changes to an image before it is posted that are designed to be imperceptible to a person but to make a model that trains on the image learn a shifted, distorted version of the artist's style. Nightshade, submitted 20 October 2023 from an overlapping team, works on the training data itself, corrupting the association a model forms between a text prompt and its generated imagery.

What the documents show

The Glaze paper reports disruption rates above 92 percent at its default perturbation strength, and above 85 percent even against countermeasures designed to strip the protection back out, according to the paper's own claims. The project's own description states plainly what this does not reach: an artist's style already absorbed into a base model from earlier, unprotected posts is not undone by glazing new work, and the tool does not stop an image being viewed, copied or otherwise used, only how a model that trains on the glazed version learns to imitate the style. Nightshade's abstract reports that fewer than 100 poisoned samples can corrupt a concept in a model such as Stable Diffusion XL, and that the effect bleeds into related concepts; the authors describe it as a last-resort defence against scrapers that ignore opt-out and do-not-crawl signals.

Authorship and limitation

The mechanism in both tools is adversarial perturbation, pixel-level changes tuned to a model's feature space rather than a human eye, so the same file looks untouched to a viewer and reads as a different style or concept to a training pipeline. That mechanism is also the limit: it depends on the artist glazing or poisoning the specific files a scraper collects, offers no retroactive protection, and the project's own page records published attacks against the method, with developers patching one in a later version. A defensive tool of this kind is a moving target, not a permanent seal.

What survives

What survives for a maker is a concrete, if incomplete, form of resistance available before publication: an image altered so that whatever a scraper takes is not, from a model's view, quite the same work. Editorially, this is one layer among several; neither paper claims it substitutes for an opt-out registry, a licence, or a legal remedy where one exists.

• Read the Glaze paper's own disruption-rate figures against the specific perturbation strength being used.
• Check the project site for which attacks against Glaze are currently known and patched.
• Compare Nightshade's stated poison-sample threshold against the scale of a specific dataset a maker is trying to protect work from.

Both tools were built by the same lab to answer the same problem from opposite ends, shifting what a model learns rather than stopping a scraper from copying, and both describe their own limits candidly enough that a maker adopting either should read those limits first.