Rahul Somvanshi
Artists concerned about AI companies scraping their work have adopted two different protective tools: Glaze and Nightshade. They’re often confused as similar, but they operate through completely different mechanisms, and both have specific limitations people don’t understand.
Glaze works defensively. It applies subtle pixel-level perturbations—mathematical adjustments imperceptible to human eyes—that alter how AI visual encoders read the image. When an AI system fine-tunes on “glazed” images, it fails to learn the artist’s actual style. Instead, the model learns a scrambled representation. The human eye sees an oil painting. The AI’s learned representation associates it with something entirely different. For an artist trying to prevent style theft, Glaze disrupts the model’s ability to imitate that specific aesthetic.
Nightshade operates as a data-poisoning tool. It introduces targeted semantic disruption. The tool alters pixel values through visually inconspicuous mathematical perturbations—changes designed to be invisible to the human eye but detectable to AI feature extraction systems. While humans still clearly see a handbag in the image, the AI system extracts feature representations matching a completely different object—say, a toaster. This matters during model training. When poisoned images are included in training, the model’s learned association between a text prompt and the corresponding visual concept gets corrupted for that specific concept.
Here’s what the actual research found: Nightshade was designed to exploit concept sparsity. Specific concepts in training data—say, “handbag”—may only have thousands of associated images. Because of this sparsity, the University of Chicago researchers found that fewer than 100 optimized poisoned samples could affect targeted concepts in their experiments with image-generation models like SDXL. This is a fundamentally different mechanism than requiring a significant fraction of the overall training dataset to be poisoned. It works by corrupting the training signal for a specific concept, not by flooding the entire training process.
Here’s the critical limitation: Nightshade was designed for text-to-image diffusion models, not as a demonstrated method for altering language models like ChatGPT. Language models process text differently than image-generation models process visual training data.
Both tools operate on the assumption that scrapers include the altered images in training data. Some AI companies employ filtering and denoising techniques—such as Gaussian blurring or autoencoder denoising—that can degrade the effectiveness of perturbations. Researchers at USENIX Security 2025 published findings on a detection method called LightShed, which reported a 99.98% true-positive detection rate for Nightshade perturbations in their tested settings. This doesn’t render Nightshade ineffective in all scenarios, but it demonstrates that defenses are actively being developed alongside the tools.
The University of Chicago project reports more than 8.5 million Glaze downloads and more than 2.5 million Nightshade downloads, figures self-reported by the project.
The real achievement isn’t creating an impenetrable defense. It’s raising the technical cost and complexity of using artist data without consent—forcing any party wanting to train on that data to invest more heavily in filtering or risk corrupted concept representations in their models.
