AI art protection tools compared

The right AI art-protection tool depends on what you are protecting and from what. To stop a model learning your style, use a cloak such as Glaze or Mist. To poison indiscriminate scrapers at scale, use Nightshade. To stop someone editing your image, use PhotoGuard. To stop a face or subject being fine-tuned, use Anti-DreamBooth. A second generation such as BlurGuard is built to survive removal but is unproven, and protecting your face from facial recognition is a separate job handled by Fawkes and LowKey. None is a guarantee; this page is about which to pick, and the reliability verdict lives in the scorecard.

AI art protection tools at a glance

Tool	What it protects	How	Maturity / what breaks it
Glaze	Art style from mimicry	Style cloak	Robust mimicry (Hönig et al., ICLR 2025)
Mist	Art style, tool-agnostic	Style cloak	Robust mimicry
Nightshade	Scrapers, at scale	Concept poison	LightShed removal (Foerster et al., 2025)
PhotoGuard	An image from AI edits	Block editing	JPEG re-encode
Anti-DreamBooth	A face or subject from fine-tuning	Block personalization	Robust mimicry
BlurGuard, StyleGuard, AntiPure	Art style, purification-resistant	Second-generation cloak	No independent bypass yet
Fawkes, LowKey	A face from facial recognition	Face cloak	Different job, not art mimicry

Which tool for which job?

Start from the threat, not the tool. If you want to stop an AI learning to paint like you, a style cloak is the answer, and Glaze (Shan, Cryan, Wenger, Zheng, Hanocka, Zhao, USENIX Security 2023) is the default, with Mist (Liang and Wu, 2023) as the open-source alternative; Glaze reports an artist-rated protection success of 94.3% on Stable Diffusion on its own benchmark. If you want to impose a cost on scraping rather than protect one image, Nightshade (Shan, Ding, Passananti, Wu, Zheng, Zhao, IEEE S&P 2024) poisons the concept a model learns and grows stronger as more artists use it. If the threat is someone editing your photo, PhotoGuard (Salman, Khaddaj, Leclerc, Ilyas, Mądry, ICML 2023) blocks image-to-image and inpainting edits. If it is someone fine-tuning on your face, Anti-DreamBooth (Van Le, Phung, Nguyen, Dao, Tran, Tran, ICCV 2023) targets personalization. And if you are trying to avoid being identified in photographs, that is facial recognition rather than style mimicry, so Fawkes (Shan, Wenger, Zhang, USENIX Security 2020) and LowKey (Cherepanova, Goldblum, Foley, ICLR 2021) are the right family, not the art cloaks. What each of these tools actually does is spelled out in Nightshade and Glaze alternatives.

How mature is each option?

Maturity is where the choice gets honest. The first-generation cloaks and blockers, Glaze, Mist, Anti-DreamBooth and PhotoGuard, all work on their own benchmarks but carry published bypasses: Hönig, Rando, Carlini and Tramèr (ICLR 2025) concluded that “all existing protective tools create a false sense of security and leave artists vulnerable to style mimicry,” and a JPEG re-encode is enough to strip PhotoGuard’s editing protection. The second generation, led by BlurGuard (Kim, Nam, Kim, Kim, Jeong, NeurIPS 2025), is built to survive purification and reports retaining 92.9% of its protective efficacy after a worst-case removal stack, against 38.5% to 48.4% for earlier methods, but it postdates the attacks and no independent group has tried to break it. Nightshade sits apart as a poison rather than a cloak, and it now has its own removal attack in LightShed (Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi, USENIX Security 2025). The full reliability picture, and how the bypasses work, is in the scorecard and in can Glaze and Nightshade be bypassed?.

Which should most artists start with?

For most artists the sensible starting stack is a style cloak on everything you post, Nightshade added when you want to push back collectively, and PhotoGuard or Anti-DreamBooth reserved for the specific case of edits or face cloning. That ordering matches the threats most artists actually face, and it means no single removal method undoes all of your protection at once. The step-by-step routine is in how to protect your art from AI training, and the narrower crawl-control version is in how to stop AI from scraping my art.

Comparing these tools is less about which is best and more about which fits the job in front of you, because they defend different stages of the same pipeline. A cloak degrades what a model learns, a poison punishes the scrape, an edit-blocker protects a single image, and a face cloak is a separate problem altogether. Pick by threat, layer where the threats overlap, and remember that every option here is a deterrent whose durability is still moving. For whether any of them actually works, read the AI art-protection scorecard.

Sources

Shan, Cryan, Wenger, Zheng, Hanocka, Zhao (2023). GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security 2023.
Shan, Ding, Passananti, Wu, Zheng, Zhao (2024). Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models. IEEE S&P 2024.
Liang, Wu (2023). Mist: Towards Improved Adversarial Examples for Diffusion Models.
Salman, Khaddaj, Leclerc, Ilyas, Mądry (2023). Raising the Cost of Malicious AI-Powered Image Editing (PhotoGuard). ICML 2023.
Van Le, Phung, Nguyen, Dao, Tran, Tran (2023). Anti-DreamBooth: Protecting Users from Personalized Text-to-Image Synthesis. ICCV 2023.
Hönig, Rando, Carlini, Tramèr (2025). Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. ICLR 2025.
Kim, Nam, Kim, Kim, Jeong (2025). BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing. NeurIPS 2025.
Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi (2025). LightShed: Defeating Perturbation-based Image Copyright Protections. USENIX Security 2025.
Shan, Wenger, Zhang, Li, Zheng, Zhao (2020). Fawkes: Protecting Privacy against Unauthorized Deep Learning Models. USENIX Security 2020.
Cherepanova, Goldblum, Foley, Duan, Dickerson, Taylor, Goldstein (2021). LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition. ICLR 2021.