Ben Zhao runs a security lab at the University of Chicago. His team built two tools for artists. Glaze hides a painter's style from an AI model. Nightshade tries to break the model outright1.
Artists have downloaded Glaze more than 8.5 million times since March 2023. Nightshade has passed 2.5 million downloads since January 20241. Both tools are free. Each ships with real limits attached.
How Glaze hides a style from AI
Glaze works on one picture at a time2. It shifts a handful of pixels, so a human eye still sees the same picture. A model trained on that picture reads something else entirely.
The model stores a style as numbers. Researchers call this space a feature space, the math a model uses to tell one artist's brushwork from another's2. Glaze pushes an artist's numbers toward a different artist's numbers. Train a model on enough glazed pictures, and it starts copying the wrong brushwork, line and color.
How Nightshade turns art into a trap
Nightshade goes further than Glaze. It skips the cloak and poisons a label instead3. Shawn Shan is the PhD student who built both tools under Zhao. His team showed that fewer than 100 poisoned pictures of one idea can take over a model's answer for that idea.
Zhao gave a plain example to TechCrunch. "By manipulating and effectively distorting that association, you can make the models think that cows have four round wheels and a bumper and a trunk," he said. "And when they are prompted to produce a cow, they will produce a large Ford truck instead of a cow4."
Nightshade's poison looks ordinary to a person. It only turns toxic inside a model's math3. The lab ships the tool free, and it posted the code in the open1.
Glaze Draws 8.5 Million Downloads, Triple Nightshade's 2.5 Million
Lifetime downloads self-reported by the Glaze Project, since each tool's release through Oct. 19, 2026
Each column is one tool's total downloads since its own release date; Glaze launched first and has drawn three times Nightshade's count.
Source: The Glaze Project, University of Chicago [1]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Glaze | 8.5M |
| Nightshade | 2.5M |
The lab's defense
Zhao built Nightshade after artists said their names had become search terms for AI knockoffs. He still remembers the call. "People are literally telling you they're losing their livelihoods," he said. "That's something that you just can't ignore5."
Karla Ortiz, a digital artist who sued Stability AI and Midjourney over training data, pushed Zhao toward something sharper than a cloak. "I would love a tool that if someone wrote my name and made a prompt, like, garbage came out," she said5.
Eva Toorenent, a Dutch artist who worked with the Chicago team on Nightshade, calls the arrangement fair trade5. "People taking our work without our consent, and then taking our work without consent can ruin their models," she said. "It's just poetic justice."
Zhao answers the researchers who say his tools fail. "It is simplistic to think that if you have a real security problem in the wild and you're trying to design a protection tool, the answer should be it either works perfectly or don't deploy it," he said, pointing to spam filters and firewalls as the same kind of imperfect defense5.
Researchers crack the cloak
Four researchers tested that claim directly. Robert Hönig of ETH Zurich worked with Javier Rando, Nicholas Carlini of Google DeepMind and Florian Tramèr6. They ran Glaze and two rival tools through plain photo editing, the kind built for ordinary snapshots.
Hönig and his co-authors found that upscaling an image, an edit almost anyone can run, erased most of what Glaze had hidden6. They put it plainly in their own paper. "Because these protections have received significant attention, artists may believe they are effective. But our experiments show they are not."
Nightshade held out longer than Glaze.
Nathalie Baracaldo leads AI security research at IBM. She assessed Nightshade's odds for MIT Technology Review in November 2024. "I have not seen anything yet—and the word yet is important here—that breaks that type of defense that Ben is proposing," Baracaldo said5. Her yet arrived seven months later.
Hanna Foerster led the work at the University of Cambridge. She worked with researchers from the University of Texas at San Antonio and the Technical University of Darmstadt8. Together they built LightShed. It reads an image, finds Nightshade's poison inside it, and lifts the poison back out.
LightShed detected Nightshade's poison with 99.98 percent accuracy, then removed it8. Foerster named the stakes plainly. "This shows that even when using tools like NightShade, artists are still at risk of their work being used for training AI models without their consent," she said.
LightShed Breaks Nightshade 17 Months After Its Release
Key dates for Glaze and Nightshade, from release to the first near-complete bypass, 2023 to 2025
Each dot is one dated event; the tools arrive first, in magenta, then researchers report breaking them, in gray, ending with LightShed's 99.98 percent detection of Nightshade's poison.
Sources: The Glaze Project, University of Chicago [1]; arXiv [3]; MIT Technology Review [5]; arXiv [6]; UTSA Today [8]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| March 2023 | Glaze ships to artists. Glaze's public release, March 2023. |
| Oct. 2023 | Nightshade paper. The peer-reviewed design for the poisoning attack, published Oct. 2023. |
| Jan. 2024 | Nightshade ships. Public release for artists, January 2024. |
| June 2024 | Glaze bypass published. Hönig, Rando, Carlini and Tramèr show that upscaling defeats Glaze. |
| Nov. 2024 | IBM backs Nightshade. Baracaldo says she has yet to see anything break Nightshade's defense. |
| June 2025 | LightShed breach. Foerster's team reports 99.98 percent detection of Nightshade's poison. |
Shan's own team agrees the fight keeps moving. Foerster framed LightShed as one round in a longer contest. "It might need a few more rounds of trying to come up with better ideas for protection," she said7.
What artists can do today, and what it costs
An artist can download Glaze or Nightshade free from the lab's own site12. Running either one fast needs a strong graphics card. With a modern GPU, one image takes two to three minutes to process. On an ordinary laptop, the same image can take an hour.
Artists short on hardware can use WebGlaze instead. It runs free for any human artist who skips AI tools of their own2. A GPU turns a long wait into a short one.
Glaze was built to stop style mimicry. img2img attacks are a separate problem, and the team says protection there is scant2. Nightshade asks for patience too. Dozens of poisoned pictures of one idea are needed before a model's answer bends3.
The research says both tools can lose to a lab willing to spend real compute on the problem68. An artist weighing the choice is really weighing time spent against a deterrent that outside researchers keep chipping at.
What to do
Glaze and Nightshade raise the cost of scraping someone's art. They work as a deterrent, the research above shows, more than a guarantee. Run new work through WebGlaze before it goes online, since the free tier runs on the lab's own cloud servers2.
Keep an unprotected original file somewhere private. A model still being trained today may defeat today's cloak tomorrow68. Watch the lab's own site for version updates, since each release answers the latest bypass research1.
By the numbers
- Glaze's downloads: 8.5 million since March 2023, reported by the Glaze Project1.
- Nightshade's downloads: 2.5 million since January 2024, reported by the same lab1.
- Fewer than 100 poisoned pictures of one idea take over a prompt in Stable Diffusion's newest model, per the Nightshade paper3.
- 99.98 percent: the rate at which LightShed detected Nightshade's poison inside a protected image8.
- Two to three minutes: time to glaze or poison one image on a modern graphics card2.
- Seven months separate IBM's November 2024 verdict that Nightshade remained unbroken from LightShed's reveal in June 202558.
What to watch
Watch whether Shan's team answers LightShed with a tougher Nightshade release, the way it already revised Glaze once before7. A lawsuit could force an AI lab to say plainly how it treats art trained under a cloak or a poison label. Either answer would tell artists more than another download count.
Sources
- The Glaze Project, "About the Glaze Project," University of Chicago, accessed Oct. 19, 2026, https://glaze.cs.uchicago.edu/aboutus.html
- The Glaze Project, "Glaze FAQ," University of Chicago, accessed Oct. 19, 2026, https://glaze.cs.uchicago.edu/faq.html
- Shawn Shan, Wenxin Ding, Josephine Passananti, Stanley Wu, Haitao Zheng, Ben Y. Zhao, "Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models," arXiv, Oct. 20, 2023, https://arxiv.org/abs/2310.13828
- Morgan Sung, "Nightshade, the tool that 'poisons' data, gives artists a fighting chance against AI," TechCrunch, Jan. 26, 2024, https://techcrunch.com/2024/01/26/nightshade-the-tool-that-poisons-data-gives-artists-a-fighting-chance-against-ai/
- Melissa Heikkilä, "The AI lab waging a guerrilla war over exploitative AI," MIT Technology Review, Nov. 13, 2024, https://www.technologyreview.com/2024/11/13/1106837/ai-data-posioning-nightshade-glaze-art-university-of-chicago-exploitation/
- Robert Hönig, Javier Rando, Nicholas Carlini, Florian Tramèr, "Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI," arXiv, June 17, 2024, https://arxiv.org/abs/2406.12027
- Peter Hall, "This tool strips away anti-AI protections from digital art," MIT Technology Review, July 10, 2025, https://www.technologyreview.com/2025/07/10/1119937/tool-strips-away-anti-ai-protections-from-digital-art/
- Ari Castañeda, "Researchers show AI art protection tools still leave creators at risk," UTSA Today, June 23, 2025, https://news.utsa.edu/2025/06/researchers-show-ai-art-protection-tools-still-leave-creators-at-risk/