Contents
Glaze raises the cost of copying your style, but independent testing shows it does not reliably stop it. In the strongest published study, a simple upscaling step let an AI reproduce a Glaze-protected style well enough that reviewers preferred the copy more than half the time. Nightshade, once thought harder to remove, now has a published attack against it too. As of 2026, treat both as deterrents, not guarantees.
What Glaze claims
Glaze’s own results are strong on paper. The University of Chicago team reports an artist-rated protection success of 94.3% on Stable Diffusion for current artists (Shan, Cryan, Wenger, Zheng, Hanocka, Zhao, USENIX Security 2023), meaning that, in their study, artists judged the mimicked output to have failed to capture their style the large majority of the time. That figure is measured by the tool’s authors, under their own protocol, which is the right place to start but not where the story ends.
What independent tests found
Independent researchers have since defeated it. The most direct evidence is a 2025 paper titled, plainly, Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. Hönig, Rando, Carlini and Tramèr (ICLR 2025) conclude that “all existing protective tools create a false sense of security and leave artists vulnerable to style mimicry.”
The numbers are the point. Using a best-of-four set of cheap removal methods, reviewers preferred the mimicked output over a baseline trained on unprotected art:
| Protection | Best-of-4 mimicry success (Hönig et al., ICLR 2025) |
|---|---|
| Glaze | 56.6% |
| Anti-DreamBooth | 56.6% |
| Mist | 62.0% |
50% is the point where the copy is effectively indistinguishable from copying unprotected work, so every one of these sits above it. The single most effective step was “noisy upscaling,” and the whole attack needs only black-box access to a fine-tuning API, with no view inside the model. This was not new in 2025: back in 2023, the IMPRESS purifier restored a style classifier on Glaze-protected art from 42.5% to 87.0% accuracy (Cao, Li, Wang, Jia, Li, Chen, NeurIPS 2023), exploiting a “perceptible inconsistency between the original image and the diffusion-reconstructed image.”
Does Nightshade work?
Nightshade used to sit in a safer position. The Hönig study tested Glaze, Mist and Anti-DreamBooth, but it did not test Nightshade (Shan, Ding, Passananti, Wu, Zheng, Zhao, IEEE S&P 2024), so “Glaze is beatable” did not transfer to “Nightshade is beatable.” Nightshade is potent on its own terms: its authors report controlling an SDXL prompt with “less than 100 poisoned training samples,” including a car-to-cow attack that worked with about 50. That gap has now closed. LightShed (Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi, USENIX Security 2025) is “a generalizable depoisoning attack that effectively identifies poisoned images and removes adversarial perturbations.” It reports a detection true-positive rate of 99.98% and a true-negative rate of 100% on Nightshade, then depoisons the images, and it is demonstrated against Glaze as well. Nightshade is no longer untested against removal: it has a published break.
So should you still use it?
Yes, as a deterrent, with clear eyes. Glaze raises the effort and cost of cleanly copying your style, and against a casual scraper that may be enough. It is not a guarantee against a motivated copier with standard tools. A newer generation of protections is explicitly designed to survive the removal steps that beat Glaze: BlurGuard (Kim, Nam, Kim, Kim, Jeong, NeurIPS 2025) reports retaining 92.9% of its protective efficacy after purification, against 38.5% to 48.4% for earlier methods; StyleGuard (Li, Zhang, Lyu, Liu, Xiao, NeurIPS 2025) claims to resist both diffusion purification and noisy upscaling; and AntiPure (Yang, Cao, Duan, He, 2025) embeds perturbations meant to “persist under representative purification settings.” None of those claims has been independently confirmed yet.
The takeaway for 2026: use Glaze, layer it with other protections, and do not treat any single tool as permanent. For what to stack it with, see how to protect your art from AI training; for how the removal methods work, see can Glaze and Nightshade be bypassed? and the tools scorecard.
Sources
- Shan, Cryan, Wenger, Zheng, Hanocka, Zhao (2023). GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security 2023.
- Hönig, Rando, Carlini, Tramèr (2025). Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. ICLR 2025.
- Cao, Li, Wang, Jia, Li, Chen (2023). IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI. NeurIPS 2023.
- Shan, Ding, Passananti, Wu, Zheng, Zhao (2024). Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models. IEEE S&P 2024.
- Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi (2025). LightShed: Defeating Perturbation-based Image Copyright Protections. USENIX Security 2025.
- Kim, Nam, Kim, Kim, Jeong (2025). BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing. NeurIPS 2025.
- Li, Zhang, Lyu, Liu, Xiao (2025). StyleGuard: Preventing Text-to-Image-Model-based Style Mimicry Attacks by Style Perturbations. NeurIPS 2025.
- Yang, Cao, Duan, He (2025). Towards Robust Defense against Customization via Protective Perturbation Resistant to Diffusion-based Purification (AntiPure).
New protection tests, breakdowns and how-long-does-it-hold checks. No spam, unsubscribe anytime.