Glaze and Nightshade really can interfere with some forms of generative-AI training, but neither makes artwork permanently or universally immune to AI use.
Glaze is designed primarily to make it harder to train an image generator to imitate an individual artist’s style. Nightshade goes further by turning an image into a training-data "poison" that can teach a model an incorrect association if that image is incorporated into training.
Both originated with computer science researchers at the University of Chicago. Both have peer-reviewed research behind them. The original experiments produced striking results. But subsequent peer-reviewed research has also demonstrated ways to weaken, detect, or remove this type of adversarial protection. (USENIX)
That makes the most accurate answer more interesting than either extreme.
Glaze and Nightshade are not fake protections. They are also not unbreakable shields.
As of September 2026, they are best understood as part of an ongoing technical arms race: artists attempt to make unauthorized machine learning harder, and researchers and model developers investigate ways to recognize or neutralize those protections.
What are Glaze and Nightshade?
The University of Chicago’s Glaze Project describes both systems as tools intended to give creators more control over how their publicly available work is used by generative AI systems. The project reports that artists have downloaded Glaze more than 8.5 million times since March 2023 and Nightshade more than 2.5 million times since January 2024. Those are project-reported download figures rather than independently audited usage counts. (Glaze)
Despite often being discussed together, the tools solve different problems.
- Glaze is a style-mimicry defense. It alters an artwork so a machine-learning system may learn a misleading representation of the artist’s style when the protected image is used for fine-tuning.
- Nightshade is training-data poisoning. It alters an image so that a model training on it may learn an incorrect relationship between a textual concept and the visual features associated with that concept.
- Neither prevents downloading or scraping. The protection only matters when the altered image is subsequently used in the relevant machine-learning process.
- Neither removes previously scraped artwork from an existing model. Their effects are prospective. They concern what happens when protected images become training material.
There is also a terminology trap worth clearing up. Both are free to use for artists, but "free" should not be confused with "open source." Glaze is deliberately closed source because its developers believe publishing its implementation would make adaptive attacks easier. The Nightshade researchers have separately published GPL-licensed research code, but the downloadable artist application is distributed under its own software license. (Glaze)
How Glaze protects an artist’s style
Imagine an illustrator whose work has a highly recognizable combination of line weight, composition, texture and color.
A person looking at one of the illustrator’s Glazed images should still perceive essentially the same artwork. Glaze changes the image, however, in ways intended to alter how a diffusion model represents its style internally.
The original Glaze paper published at USENIX Security 2023 describes these modifications as "style cloaks." Glaze research at USENIX Security 2023
The simplified mechanism works like this: the protected image remains close to the artist’s original image for a human viewer, while its machine-readable representation is shifted toward a substantially different style. If someone later fine-tunes a compatible image model on enough of those protected images, the model may learn something different from the artist’s actual style.
This exploits a broader property of machine learning known from research on adversarial examples. Humans and neural networks do not necessarily respond to tiny changes in an image in the same way. A modification that barely changes human perception can sometimes produce a substantial change inside a model’s feature representation.
The original Glaze study reported greater than 92% disruption of style mimicry under its normal experimental conditions and greater than 85% against the adaptive countermeasures tested in that study, even at its low perturbation setting. The researchers also conducted a user study involving more than 1,000 artists. (USENIX)
Those are meaningful experimental results.
They do not mean Glaze blocks 92% of every possible AI attack.
The percentages apply to the study’s particular models, attacks, measurements and experimental setup.
What Glaze does not protect against
Glaze was designed for a fairly specific threat: fine-tuning a generative image model on an artist’s work in order to mimic that artist’s style.
It is not a general-purpose anti-copying system.
The Glaze team itself says the protection is weaker or ineffective when the desired style is already well represented inside the underlying base model. A model that already knows how to generate Impressionism, for example, does not need to learn Impressionism from newly Glazed images. (Glaze)
Glaze also does not reliably prevent someone from applying image-to-image generation, inpainting, ControlNet or similar transformations directly to an image. The project’s current FAQ explicitly says that it does not believe Glaze provides consistent protection against stronger image-to-image attacks. (Glaze)
And Glaze cannot reach backward in time.
If an unprotected copy of an artwork has already entered a model’s training data, applying Glaze to a new copy does not somehow remove that earlier image or erase what an existing model has already learned.
That distinction is fundamental:
Glaze attempts to contaminate future learning from the protected copy. It does not make the underlying artwork inaccessible.
Nightshade takes a more aggressive approach
Nightshade uses the same general insight about the difference between human and machine perception for a different purpose.
Instead of misleading a model about an artist’s style, Nightshade attempts to corrupt a concept association during training.
The project’s frequently used example begins with an image that humans recognize as a cow. Nightshade optimizes small changes so that the image still appears to be a cow to a person while its machine-learning representation is moved toward an unrelated target, such as a handbag.
The caption can still correctly describe the image as a cow.
If a compatible generative model later trains on enough poisoned examples associated with "cow," the model may begin incorporating characteristics of the poison target when responding to cow-related prompts.
The Nightshade paper, published at the 2024 IEEE Symposium on Security and Privacy, reported that its optimized attack could corrupt a prompt in Stable Diffusion XL with fewer than 100 poisoned training examples in the researchers’ experimental setup. Nightshade research from the University of Chicago (People at UChicago)
That is the origin of some of the dramatic headlines claiming that a handful of images can "poison an AI."
The actual finding is narrower.
Why fewer than 100 poisoned images could matter
A generative model may train on billions of images overall, but the Nightshade researchers identified an important weakness in thinking about dataset size that way.
A model may have billions of total training samples while containing only thousands of useful examples associated with a particular concept.
Nightshade therefore does not necessarily have to overwhelm the whole training corpus. It attempts to influence the much smaller portion of the dataset relevant to a particular concept.
The researchers also found that poisoning could bleed into semantically related concepts, and that many separate poisoning attacks could coexist inside the same model. In one experiment, they injected 100 poisoned samples for each targeted concept. As hundreds of separate concepts were poisoned, overall model quality deteriorated substantially, with severe degradation appearing when large numbers of concepts were attacked. (People at UChicago)
This is fascinating security research.
It should not be translated into the claim that 100 random Nightshaded pictures uploaded to the Internet will destroy a commercial AI model.
Real training pipelines may contain different data distributions, filtering systems, architectures, retraining procedures and defenses. The researchers’ experiment demonstrated that the attack was technically feasible under defined conditions. It did not establish a universal real-world dose.
Nightshade is not an AI virus
This misconception is common enough to answer directly.
A Nightshaded picture does not infect a model simply because the model sees, analyzes or generates a description of it.
The University of Chicago team explicitly says that Glaze and Nightshade target generative image models and that an image classifier correctly recognizing the visible object in a protected image does not mean the protection failed.
Nightshade must become part of a relevant model’s training process before its poisoning mechanism can operate. The team’s FAQ also says Nightshade is not intended to affect large language models, facial-recognition systems, medical-image systems, self-driving systems or unrelated AI applications. (Nightshade)
So uploading a Nightshaded image to an AI chatbot is not equivalent to uploading malware.
Why can’t someone just take a screenshot?
Ordinary image manipulation and deliberate adversarial purification are two different things.
According to the Glaze and Nightshade researchers, operations such as resizing, compression, cropping, screenshots, modest noise and ordinary filtering do not necessarily destroy the perturbations because the protection is distributed across the image rather than stored as metadata or a conventional watermark. (Glaze)
That is why stripping EXIF data is irrelevant.
There is no hidden "do not train" message in the metadata that Glaze depends upon.
But saying that normal image editing does not reliably remove the protection is not the same as saying the protection cannot be intentionally attacked with machine learning.
That is exactly what later researchers began doing.
Researchers have found ways around these protections
This is the part of the story that basic Glaze and Nightshade explainers often omit.
The security community did what it normally does when someone releases a defense: researchers tried to break it.
IMPRESS challenged Glaze first
At NeurIPS 2023, researchers introduced IMPRESS, a system intended to "purify" adversarially protected images before they are used for unauthorized tasks such as style mimicry.
The researchers’ central observation was that defensive perturbations can sometimes create differences that a purification process can detect and suppress. Their experiments included Glaze. IMPRESS at NeurIPS 2023 (NeurIPS Proceedings)
The Glaze researchers disputed how broadly those results should be interpreted. They argued that the attack performed substantially better against artists or styles already represented in the underlying model and that some of the evaluation methods overstated successful recovery. (Emergent Mind)
That dispute established a pattern that continues today: demonstrating that a defense can be weakened under one threat model is not necessarily the same as proving that it provides no protection under any threat model.
Then came the noisy-upscaling attack
A broader challenge arrived from Robert Hönig, Javier Rando, Nicholas Carlini and Florian Tramèr.
Their work, ultimately published at ICLR 2025, tested several adversarial protections and found that surprisingly ordinary techniques, including image upscaling incorporated into a more robust mimicry pipeline, substantially weakened them.
The paper’s conclusion was unusually strong. The researchers argued that adversarial perturbation systems could create a false sense of security because an adaptive attacker could bypass the protections they tested. Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI, ICLR 2025 (ICLR Proceedings)
The Glaze team did not simply dismiss the finding.
It tested the attack, acknowledged that it had substantial effects against older Glaze versions, disputed some broader conclusions, and released Glaze 2.1 with changes intended to improve resistance to the noisy-upscaling attack. Glaze team’s response and Glaze 2.1 update (Glaze)
This is an important point in Glaze’s favor as a research project: the defense evolved in response to published attacks.
It is also evidence that the underlying problem is an arms race rather than a solved one.
LightShed specifically targeted Nightshade
At USENIX Security 2025, researchers presented LightShed, a system designed to identify and remove perturbation-based image protections.
Its experiments included both Glaze and Nightshade.
For identifying Nightshaded samples, the researchers reported a 99.98% true-positive rate and 100% true-negative rate in their tested setup, followed by a process intended to remove the poisoning effect. LightShed at USENIX Security 2025 (USENIX)
That number needs careful interpretation.
It does not mean researchers proved they can remove 99.98% of Nightshade protections from every image.
The 99.98% figure measures detection of Nightshaded samples in their experiment, not a universal Nightshade-removal success rate.
The distinction matters because those two claims are often collapsed into one.
BridgePure attacked a much newer Glaze
An even more interesting result appeared at NeurIPS 2025.
BridgePure asks what happens when an attacker can obtain a small number of both unprotected and protected examples. The researchers train a model to learn the transformation between them, then attempt to apply that learned inverse transformation to previously unseen protected data. BridgePure at NeurIPS 2025 (NeurIPS Proceedings)
This matters because the researchers specifically evaluated Glaze 2.1, not merely one of the earliest Glaze releases. They used the high protection intensity and slowest rendering setting in their style-mimicry experiment. (OpenReview)
BridgePure is not a one-click consumer workaround. Its experimental setup required paired protected and unprotected examples and substantial model training.
But it demonstrates something important about the longer-term security problem: keeping the exact protection algorithm secret does not necessarily prevent an attacker from learning how its outputs behave.
2026 research suggests the perturbations have identifiable structure
Research presented at a CVPR 2026 workshop examined Glaze and Nightshade from another angle.
Rather than simply asking whether the protection worked, the researchers studied what the perturbations looked like internally. They found method-specific structure in protected images and reported that detectability was related to properties including perturbation entropy, spatial placement and frequency behavior. Sequentially applying protections could make that structure more apparent. A Mechanistic Analysis of Training-Time Image Protection in Diffusion Models, CVPR Workshops 2026 (CVF Open Access)
That paper is not proof of another universal bypass.
It does reinforce the larger pattern: these perturbations are not magical invisible properties. They are engineered signals, and other researchers can study their structure.
So, have Glaze and Nightshade been "broken"?
The word broken is doing too much work.
The Glaze project’s current FAQ, updated August 25, 2026, answers the question "Isn’t it true that Glaze has already been broken/bypassed?" with "No, it has not." It distinguishes attacks that weaken Glaze under particular conditions from a general demonstration that Glaze provides no useful protection. (Glaze)
Independent researchers use the word "bypass" more readily. ICLR 2025, LightShed and BridgePure all provide peer-reviewed evidence that perturbation-based protections can be weakened or neutralized in meaningful experimental settings. (ICLR Proceedings)
The apparent contradiction largely disappears once the claims are stated precisely.
Independent researchers have demonstrated successful attacks against Glaze and Nightshade under specified conditions. That does not establish that every protected image can be effortlessly restored under every condition.
Conversely:
Showing that an attack sometimes fails does not establish that Glaze or Nightshade provides permanent protection against a motivated adaptive adversary.
Both statements can be true.
What changed in the latest 2026 releases?
This is another place where version numbers can create a misleading impression.
As of September 2026, the latest Windows release listed by the project is Glaze 2.2, released April 3, 2026. But the project’s release notes describe Glaze 2.2 as an update adding support for NVIDIA 50-series GPUs. The major explicitly described anti-attack changes arrived earlier in Glaze 2.1, which was designed to improve resistance to techniques including noisy upscaling. Mac users are still offered Glaze 2.1. Current Glaze downloads and release notes (Glaze)
Nightshade’s current listed release is Nightshade 1.1, dated April 20, 2026. Its release notes describe a bug fix and GPU-driver-related update rather than a newly redesigned poisoning method. Current Nightshade downloads and release notes (Nightshade)
So it would be misleading to argue that the latest version numbers alone demonstrate that the published bypass research is obsolete.
I found no peer-reviewed evidence establishing that Glaze 2.2 introduced a fundamentally new protection algorithm that defeats the published purification literature. Its documented change is hardware support.
Glaze and Nightshade solve different problems
An artist concerned primarily about someone training a LoRA or fine-tuned model on their portfolio is worried about style mimicry. That is Glaze’s core threat model.
An artist who wants scraped copies of their work to become risky or undesirable training material is considering data poisoning. That is Nightshade’s purpose.
Nightshade by itself does not provide Glaze’s style protection. The project’s current documentation still warns artists not to rely on Nightshade alone if style mimicry is their concern. For people using both standalone tools, the official user guide recommends applying Nightshade first and Glaze second. (Nightshade)
The project has long discussed integrating both into one workflow, but its current public pages still describe that combined release as under development rather than a generally available replacement for the two-step process. (Nightshade)
What these tools cannot stop
Neither system prevents somebody from saving an image from a website.
Neither prevents an ordinary human from studying the artwork.
Neither automatically establishes whether a particular use is copyright infringement.
Neither stops someone who already possesses an unprotected original.
Neither guarantees protection against future architectures.
And neither should be confused with a conventional watermark or an ownership record.
The tools attack the technical usefulness of certain copies for certain machine-learning processes.
That narrower definition is less dramatic, but far more accurate.
Why artists turned to technical defenses in the first place
There is a legal gap at the center of this story.
Copyright protects an artist’s original expressive work, but the U.S. Copyright Office has stated that copyright does not protect artistic style as a separate element of a work. The Office also cautioned against creating a broad property right in style itself, while acknowledging that other doctrines such as unfair competition, trademark or rights of publicity might apply under particular circumstances. U.S. Copyright Office report on artistic style and AI (U.S. Copyright Office)
That creates an unusual problem for artists.
A particular illustration can be copyrighted. But extracting recurring visual characteristics from an artist’s body of work and generating new images that resemble the artist’s overall style raises a much more complicated legal question.
Glaze attempts to create a technical defense where copyright does not provide a simple exclusive right over "style."
Nightshade addresses another problem: an artist can state that they do not consent to model training, but a publicly accessible image can still technically be copied by a crawler.
One legal distinction is important here. In this article, "training without permission" means training without the creator’s consent. It does not automatically mean that a court has determined the training was unlawful.
The legality of training generative models on copyrighted material remains dependent on the facts and applicable law. The U.S. Copyright Office’s Part 3 report on generative-AI training, still listed as a pre-publication version, treats fair-use analysis as context-dependent rather than announcing that all AI training is either categorically lawful or categorically infringing. U.S. Copyright Office report on generative AI training (U.S. Copyright Office)
Are Glaze and Nightshade worth using?
For an artist, the most defensible way to think about these tools is not as locks, but as friction.
Without protection, an attacker who obtains suitable artwork may be able to put it directly into a fine-tuning or training pipeline.
With protection, the attacker may have to identify that protection, discard samples, obtain clean originals, modify the training process, run a purification system or tolerate poorer results.
Sometimes researchers have shown that those additional steps can succeed.
But requiring additional steps can still have value.
That principle is common throughout computer security. A defense does not have to make an attack physically impossible to alter its cost.
The mistake would be telling artists that Glaze makes style theft impossible or that Nightshade guarantees poisoned models. The evidence does not support either claim.
The equally large mistake would be saying the tools do nothing simply because attacks against them exist.
The evidence does not support that claim either.
The real purpose may be changing the economics of scraping
Nightshade’s developers are unusually explicit about this.
They say their goal is not simply to "break AI." Their stated goal is to impose an incremental cost on training pipelines that ingest images without creators’ consent, so that obtaining licensed material becomes relatively more attractive. University of Chicago explanation of Nightshade’s purpose (Nightshade)
That may ultimately be the most important way to understand both projects.
Their strongest potential effect does not require every protected image to be invincible.
It requires indiscriminate scraping to become less reliable.
A model trainer who knows that a corpus may contain manipulated training samples has another problem to solve: identifying them, filtering them or neutralizing them without throwing away large quantities of legitimate material.
Researchers are already demonstrating ways to do that.
Protection researchers will presumably respond.
The cycle continues.
Can an AI model simply learn to ignore Glaze and Nightshade?
Potentially.
That is precisely why neither project claims to be a permanent solution.
Glaze’s own documentation says future algorithms could overcome today’s protection. Nightshade’s documentation similarly says it is unlikely to remain future-proof indefinitely. (Glaze)
The important question is therefore not whether some hypothetical future system can defeat them.
It is how expensive and reliable defeat becomes relative to simply obtaining clean, licensed training data.
That is a much harder question, and current research does not provide one universal answer.
Does Glaze work against Midjourney and proprietary models?
Glaze’s researchers report that the perturbations can transfer between different image-generation models, meaning they do not necessarily have to know the exact model that will eventually consume the image.
But proprietary models create an obvious verification problem.
Outside researchers generally do not know their complete architectures, training datasets or preprocessing pipelines. Even the Glaze FAQ acknowledges that performance on new or proprietary models is difficult to predict. (Glaze)
So "Glaze works on Midjourney" should not be treated as a timeless guarantee.
A better description is that Glaze was designed for transferable disruption across related generative-image architectures, but effectiveness against a particular closed model cannot simply be assumed.
Does Nightshade work if an AI can still tell what the picture shows?
Yes. At least, that is the intended behavior.
A vision model recognizing "this is a picture of a cow" does not prove that Nightshade failed. Recognition and generative-model training are different tasks.
In fact, if a basic classifier consistently identified the hidden poison target instead of the visible image, Nightshade would become trivial to detect and remove.
The protection depends on the image continuing to look correctly labeled while affecting a different stage of machine learning. (Nightshade)
Is Glaze open source?
No.
Glaze is free for artists but deliberately closed source. The project says this choice is intended to raise the difficulty of adaptive attacks. Its software license also restricts modification, reverse engineering and commercial use. Glaze software license (Glaze)
Nightshade is slightly different. The researchers have published a GPL-licensed research implementation, but they distinguish that code from the artist-facing Nightshade application. (GitHub)
Calling both simply "open-source anti-AI software" would therefore be inaccurate.
Can artists protect artwork that is already online?
They can protect new copies they publish, but Glaze and Nightshade cannot retroactively modify copies someone has already downloaded.
That is one of their biggest structural limitations.
If an unprotected high-resolution work already exists elsewhere, an adversary may prefer that copy over a newly protected version.
This is another reason the tools are better understood as part of a larger protection strategy rather than a reset button for everything an artist has ever posted.
Bottom line
Glaze and Nightshade are serious computer-security research projects, not gimmicks.
Glaze demonstrated that carefully engineered image perturbations could substantially disrupt style-mimicry fine-tuning in its original experiments. Nightshade demonstrated that surprisingly small numbers of optimized poisoned samples could corrupt targeted concepts in diffusion models under controlled training conditions. Both ideas survived peer review at major security conferences. (USENIX)
But subsequent research has also demonstrated a fundamental weakness: if protection depends on adversarial perturbations, a sufficiently adaptive adversary may be able to recognize, transform or remove those perturbations.
IMPRESS challenged Glaze. Noisy upscaling substantially weakened multiple style protections. LightShed detected and depoisoned Nightshade in its experiments. BridgePure showed that even Glaze 2.1 could be attacked when an adversary possessed limited pairs of original and protected artwork. Research continued into 2026. (NeurIPS Proceedings)
That does not render Glaze and Nightshade pointless.
It tells us what they actually are.
They are a way for artists to make certain forms of unauthorized machine learning harder, less predictable and potentially more expensive.
Whether that added friction is enough to stop a particular model trainer is a different question.
And in 2026, nobody can honestly promise that the answer will remain the same forever.
References and Further Reading
Original Research
Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka and Ben Y. Zhao, USENIX Security 2023. The original peer-reviewed Glaze paper, including its experimental effectiveness, artist study and threat model. Read the Glaze paper at USENIX
Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models Shawn Shan, Wenxin Ding, Josephine Passananti, Stanley Wu, Haitao Zheng and Ben Y. Zhao, IEEE Symposium on Security and Privacy 2024. The original Nightshade research and experimental poisoning results. Read the Nightshade research summary
Current Glaze and Nightshade Documentation
What Is Glaze? University of Chicago Glaze Project. Explains Glaze’s design, intended threat model and acknowledged limitations. University of Chicago Glaze overview
Glaze Frequently Asked Questions Current project guidance, including attacks, image-to-image limitations and the project’s position on bypass claims. Glaze FAQ
Glaze Downloads and Release Notes Current versions and documented changes, including Glaze 2.2 and the earlier 2.1 robustness update. Glaze downloads and release notes
What Is Nightshade? University of Chicago explanation of Nightshade’s poisoning mechanism, purpose and limitations. University of Chicago Nightshade overview
Nightshade User Guide Includes the project’s current workflow guidance for artists who use both Nightshade and Glaze. Nightshade user guide
Nightshade Downloads and Release Notes Current Nightshade version information, including Nightshade 1.1. Nightshade downloads and release notes
Independent Research on Bypasses and Limitations
IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI NeurIPS 2023. An early peer-reviewed effort to purify images protected by adversarial perturbations, including Glaze. IMPRESS at NeurIPS
Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI Hönig, Rando, Carlini and Tramèr, ICLR 2025. Demonstrates robust style-mimicry pipelines that substantially weaken multiple perturbation defenses. Read the ICLR 2025 paper page
LightShed: Defeating Perturbation-Based Image Copyright Protections USENIX Security 2025. Studies detection and removal of several perturbation protections, including Glaze and Nightshade. LightShed at USENIX Security
BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection NeurIPS 2025. Demonstrates purification attacks when an adversary can obtain limited protected/unprotected example pairs, including experiments using Glaze 2.1. BridgePure at NeurIPS
A Mechanistic Analysis of Training-Time Image Protection in Diffusion Models CVPR Workshops 2026. Examines the internal and signal-level structure of Glaze and Nightshade perturbations and their detectability. Read the CVPR 2026 workshop paper
Copyright and Legal Context
Copyright and Artificial Intelligence, Part 1: Digital Replicas U.S. Copyright Office. Includes the Office’s detailed discussion of artistic style and why copyright does not protect style as a separate element of a work. Read the U.S. Copyright Office report
Copyright and Artificial Intelligence, Part 3: Generative AI Training U.S. Copyright Office, pre-publication version. Reviews copyright and fair-use questions surrounding copyrighted material used for generative-AI training. Read the U.S. Copyright Office training report
Editorial currency note: Glaze, Nightshade and attacks against adversarial image protections are actively developing. Software versions, defensive techniques, model architectures and the legal treatment of generative-AI training can change. This article reflects publicly available information reviewed through September 2026.
