Artists can publish adversarially modified copies of their work to make unauthorized AI training and style imitation less reliable. Glaze primarily cloaks an artist’s style from systems trained to mimic it; Nightshade attempts to poison future image–text training associations. Both are free research tools from the University of Chicago’s Glaze Project, but neither is permanent, universal or guaranteed protection.
Why artists are using these tools
Publishing work brings commissions, employment and visibility, but a public image can also be copied into datasets or used as a reference for automated generation. Those are separate risks:
- Unauthorized training: an image is collected and used in model training without the artist’s consent.
- Style mimicry: a model or fine-tuned add-on learns to generate images resembling a particular living artist.
- Image-to-image copying: somebody supplies the artwork directly to an editor or generator for transformation, extension or imitation.
- Output infringement: a generated result may resemble an existing work even when the original file was not supplied in that request.
No single filter addresses all four problems. Glaze is aimed chiefly at individualized style mimicry, while Nightshade is aimed at future training data. Neither stops screenshots, manual imitation or every image-to-image workflow.
What “data poisoning” means here
Nightshade’s attack model assumes a conventional image–text training pipeline. An artist publishes an image that looks normal to people but contains a carefully optimized, pixel-level perturbation. If a scraper collects the file and pairs it with a caption such as “dog,” the altered representation can encourage a model to learn an incorrect relationship between that prompt and the visual content.
Recommended Free Tools
#1 Best Overall
The objective is not to hack a company’s servers or damage the artist’s computer. It is to make a future training run learn the wrong association if the image is collected, retained, captioned and included in a relevant dataset. A file that is never used for training has no poisoning effect.
The Nightshade paper reports visually similar poison samples that changed model behavior and could affect related concepts as well as the targeted prompt (research paper). That is different from removing an image from a model that has already learned it.
Glaze and Nightshade are not the same thing
| Tool | Main purpose | What changes | Intended target | Best description |
|---|---|---|---|---|
| Glaze | Reduce individualized style mimicry | The image’s machine-readable visual representation | A model fine-tuned on an artist’s work | Style cloaking |
| Nightshade | Corrupt future training associations | The training signal in relation to a caption or prompt | A model trained on scraped image–text pairs | Data poisoning |
| Both | Provide individual deterrence and collective pressure | The public copy of the artwork | Future unauthorized training and imitation | Complementary, not interchangeable |
How Glaze works
Glaze computes small changes intended to make an artwork appear to an AI system like a different style while remaining substantially similar to human viewers. It targets the feature representations that style-matching systems use, rather than trying to make the picture visibly unusable. The project explains the design in its What Is Glaze overview.
Protection is image-specific and model-dependent. Higher-strength settings generally increase resistance but also increase the chance of visible artifacts. Glaze’s FAQ warns that it is not consistently effective against strong image-to-image attacks, inpainting, style transfer or styles already represented in a model’s base training data.
How Nightshade works
Nightshade is more directly a poisoning attack. Its optimized perturbation is designed around a target concept and its caption, so a training process may associate that prompt with the wrong visual features. In the paper’s examples, a targeted concept could produce outputs associated with a different concept, and the effect could “bleed” into related concepts.
The attack depends on the training pipeline. The image must be scraped, survive preprocessing, receive a relevant label or caption and be used in a model update. Nightshade cannot retroactively alter an established model, and it cannot guarantee that a proprietary service will ingest or respond to the image in the same way as the tested systems.
What the Nightshade research actually demonstrated
The original paper tested open diffusion models under specified datasets, captions, architectures and training conditions. In those experiments, targeted attacks succeeded with approximately 100 poison samples. The required amount varied with the amount of clean data associated with the concept, and effects could spread to related concepts. The authors also reported that poisoning many concepts could degrade general model output.
Those are laboratory findings, not a promise that uploading a few protected images will poison Midjourney, DALL·E, Adobe Firefly or every other commercial generator. Model architecture, curation, deduplication, preprocessing, the amount of clean data and the service’s training schedule all change the result.
Free tools Windows power users keep installed
One-click scans. No signup required.
The bypass problem
Pixel perturbations can be weakened by resizing, recompression, cropping, filtering, upscaling, denoising and image-to-image transformation. A model builder can also discard suspicious samples, deduplicate files, apply its own transformations or use adversarial training. Independent work discussed in a 2025 ICLR bypass summary found that inexpensive transformations could substantially weaken some protection systems under particular evaluation setups.
The Glaze team responded with updates intended to improve resistance, including the Glaze 2.1 update. That response does not make protection permanent: this is an arms race in which effectiveness depends on the exact attack and model.
What happens to the published image?
- The changes are designed to be difficult for a person to notice, not mathematically invisible.
- Different images receive different perturbations.
- Stronger settings can introduce visible changes.
- Platform resizing, compression or other processing can reduce the intended effect.
- The clean master remains unchanged; the processed file should be treated as a public derivative.
Always inspect a processed copy at 100% and at the display size used by your portfolio or social platform. A side-by-side demonstration shows only the tested settings; it is not proof of universal protection.
A sensible publishing workflow in 2026
- Keep the master private. Store the highest-resolution original separately from files intended for public upload.
- Export a derivative. Never make the only copy of an artwork the file you process.
- Choose the objective. Use Glaze when style mimicry is the primary concern. Consider Nightshade when you want to contribute to collective resistance against unauthorized dataset construction.
- Process locally when practical. The official downloads page lists Glaze 2.2 for Windows, with Nvidia 50-series support, dated April 3, 2026. It also lists 2.1 builds for Windows and Macs using Apple or Intel processors and approximately 4 GB of additional storage for machine-learning resources (downloads).
- Use WebGlaze if local hardware is unsuitable. The browser service is free for human artists, invite-only and subject to daily and weekly limits. Its documented path is invite, sign in, upload, choose strength, enter an email address, submit and receive the result by email (WebGlaze).
- Check the file. Glaze and WebGlaze support JPG and PNG; the FAQ recommends PNG before later conversion or compression. Avoid non-standard filename characters, which can cause WebGlaze server errors (FAQ).
- Review release notes. The older user guide may not match current menus or hardware support, so follow the current installer and downloads page.
- Preserve provenance. Keep copyright notices, metadata, registration records and licensing evidence separately. A perturbation is not a legal remedy.
Choosing between local Glaze and WebGlaze
| Option | Good fit | Trade-offs |
|---|---|---|
| Glaze desktop | Artists with compatible Windows or Mac hardware who want local processing | Requires installation, storage and supported hardware; some Nvidia GTX 1660/1650/1550 systems may have compatibility problems |
| WebGlaze | Phone, tablet, older-computer and incompatible-GPU users | Invite-only, usage-limited and requires temporary upload to a remote service; the provider states that images are encrypted in transit and immediately deleted |
The deletion and encryption statements are the provider’s stated policy, not an independently audited guarantee.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhen each tool is worth considering
Glaze
Glaze is most relevant when the principal concern is a model fine-tuned to imitate an identifiable style, the image will be posted publicly and the artist can accept a small risk of visible modification. It remains probabilistic and model-dependent.
Nightshade
Nightshade is relevant when an artist wants to make scraped, captioned work less useful to future training and accepts that the intended effect occurs only if the image enters a relevant training process. It is not a deletion mechanism for existing models.
Neither tool
Neither reliably prevents direct use of the actual image, screenshots, photographs of the screen, human imitation, strong image-to-image editing or use by a model whose preprocessing is unknown. A platform that crops or recompresses uploads may also reduce the perturbation.
What artists should not expect
- They do not erase knowledge from an existing model.
- They do not block all scraping or guarantee that a commercial model is affected.
- They do not stop screenshots, manual copying or every transformation attack.
- They are not copyright registration, a license, a contract, a takedown request or legal enforcement.
- They may become less effective as model builders and attackers adapt.
Commercial hosted alternatives
The strongest established options remain the free official tools. A third-party service called ImageShielding advertises a hosted GreenEyes.ai implementation of Nightshade-style shielding and “transparent pricing,” but no concrete plan amount or independently verified efficacy result is established here. Review its privacy terms, limits, pricing and reproducible tests before uploading valuable work; the word “Nightshade” alone does not establish stronger protection.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The practical conclusion
Glaze and Nightshade are best understood as asymmetric resistance. They can raise the cost of unauthorized training or make style imitation and future data collection less predictable, but they do not give an artist control over what has already been learned. Publish a processed derivative when the trade-off makes sense, keep masters and provenance secure, and treat technical perturbation as one layer in a broader rights and security strategy.
Frequently Asked Questions
Can one poisoned image ruin an AI model?
No. The approximately 100-sample result was a targeted laboratory finding for specified diffusion models. Required scale depends on clean data, the concept, model architecture and training process.
Does Glaze make an artist legally protected?
No. It is a technical countermeasure, not copyright registration, licensing, a contract or an enforcement remedy.
Can companies filter out Nightshade or Glaze?
Potentially. Curation, deduplication, transformations, adversarial training and other defenses may reduce the effect, which is why protection should be treated as probabilistic and evolving.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
