Glaze or Nightshade: which should you use?

Answer a couple of questions and this points you to the tool that fits your case.

What are you trying to protect?

What is your aim for your art?

Recommended

Glaze

A defensive cloak for your own style. Apply it to every image before you post.

Glaze adds barely perceptible perturbations so a model that trains on your images learns the wrong style. One artist can cloak one image before uploading, with no campaign required, which is why it is the tool to use on your own work, always.

How well it holds: a deterrent, not a guarantee. Independent testing (Hönig et al., ICLR 2025) stripped first-generation Glaze: reviewers preferred the copied style 56.6% of the time, where 50% means the protection made no difference. Free from the University of Chicago team.

Does Glaze actually work? Full Glaze vs Nightshade

Recommended

Glaze + Nightshade

Shield each upload with Glaze and add Nightshade as collective counter-pressure.

Most artists who care run both. Glaze is the shield on every upload; Nightshade poisons a scraper's own model at the level of a concept. They act on different parts of the pipeline, so one does not undo the other. Nightshade's strength grows with the number of participating artists, not with how many images you personally shade.

How well it holds: neither is permanent. LightShed (USENIX Security 2025) reports a 99.98% detection rate on Nightshade and works against Glaze too. Treat both as deterrents that raise the cost of copying. Both are free from the University of Chicago team.

How the two differ The tools scorecard

Alternative to Glaze

Mist

An open-source style cloak that does the same job as Glaze.

Mist is the closest alternative to Glaze, an open pipeline you can inspect that fuses a semantic and a textural objective to improve transfer across models. Choose it over Glaze if you want to see inside the tool, but expect the same durability ceiling.

How well it holds: in the strongest independent test its copies reached a 62.0% quality preference, the highest of the cloaks tested, and above the 50% mark at which a copy is indistinguishable from copying unprotected art (Hönig et al., ICLR 2025).

Glaze & Nightshade alternatives All tools compared

Different family: face cloaking

Fawkes or LowKey

Face cloaks that hide your identity from facial recognition, not your style from mimicry.

If your concern is being found or identified rather than having your style copied, Glaze and Nightshade are the wrong family. Fawkes and LowKey shift how a facial-recognition system encodes your face so it fails to match you in photographs.

How well it holds: like the art cloaks, treat these as deterrents whose effectiveness depends on the recognition system and how the image is processed after posting.

How face cloaking works Does Fawkes still work?

Recommended for this threat

Anti-DreamBooth

Blocks someone fine-tuning a model on your face or a recurring subject.

Anti-DreamBooth adds subtle noise to your images before you publish, to disrupt the generation quality of any DreamBooth model trained on them. It targets personalization specifically, which makes it the right choice for protecting a likeness rather than a drawing style.

How well it holds: it was tested alongside Glaze and beaten in the same study, reaching a 56.6% quality preference under a best-of-four removal attack (Hönig et al., ICLR 2025). A deterrent, not a guarantee.

Glaze & Nightshade alternatives All tools compared

Recommended for this threat

PhotoGuard

Blocks AI editing of a specific photo, not training on it.

PhotoGuard immunizes a single photo against AI image-to-image and inpainting edits, so a diffusion model that tries to alter the protected picture produces a visibly broken result. Reach for it when the threat is someone manipulating your image, not learning from it.

How well it holds: its weakness is cheap: its perturbations are not robust to JPEG compression, so a single re-encode can undo it (Sandoval-Segura et al., 2023).

Glaze & Nightshade alternatives All tools compared

If you make art and want to protect it from AI training, the short answer is usually both, and which one leads depends on what you are protecting. Glaze is a defensive cloak you apply to your own work so a model that trains on it learns the wrong style. Nightshade is an offensive poison that corrupts a scraper’s own model instead. They are not rivals, they act on different parts of the pipeline, and most artists who care about this run both.

Match the tool to the threat

The choice is really a question of what you are trying to protect, and from what. Glaze and Nightshade cover the art-style case between them; the other rows are for threats they were never built to handle.

Your threat	Use	What it does
Stop AI learning your art style	Glaze	Cloaks your style on every image you post
Also push back on scraping at scale	Glaze + Nightshade	Adds collective poison that corrupts a scraper’s own model
Want an open-source cloak you can inspect	Mist	The same job as Glaze, with an open pipeline
Stop a face or subject being fine-tuned	Anti-DreamBooth	Disrupts personalization models trained on your images
Stop your photo being AI-edited	PhotoGuard	Breaks image-to-image and inpainting edits
Hide your face from recognition	Fawkes or LowKey	Face cloaks, a different job from style protection

Glaze: cloak your own style

Glaze (Shan, Cryan, Wenger, Zheng, Hanocka, Zhao, USENIX Security 2023) is the tool to apply to your own work, always. Its authors describe it as adding “barely perceptible perturbations to images, and when used as training data, mislead generative models that try to mimic a specific artist.” It works per image, shifting your picture’s style representation in a model’s feature space so a fine-tune learns a style that is not yours. One artist can cloak one image before uploading, with no campaign required, and it carries a tight perceptual budget (an LPIPS bound of p = 0.05) so the change stays invisible on the art you are about to show.

Nightshade: poison the scraper

Nightshade (Shan, Ding, Passananti, Wu, Zheng, Zhao, IEEE S&P 2024) is the move for imposing a cost on indiscriminate scraping rather than shielding a single upload. Its authors call it “a prompt-specific poisoning attack optimized for potency,” able to steer what a model generates for a chosen prompt with fewer than 100 samples, with about 50 optimized samples enough to make a poisoned model render a cow for prompts that mention a car. It needs no access to the target model, because it is pure data poisoning that activates only once the image is scraped, and its strength grows with the number of participating artists, not with how many images you personally shade.

Run both if you can

Most artists who care run both: Glaze as the shield on each upload, Nightshade as collective counter-pressure. Because they operate on different parts of the pipeline, applying one does not undo the other. For the full head-to-head on how the two differ, see Glaze vs Nightshade: which protects your art?.

If your threat is different

Style is not the only thing worth protecting, and Glaze and Nightshade are the wrong family for the other jobs. Mist (Liang and Wu, 2023) is an open-source style cloak that does the same job as Glaze. PhotoGuard (Salman, Khaddaj, Leclerc, Ilyas, Mądry, ICML 2023) blocks AI editing of a single photo rather than training on it, though its protection is not robust to JPEG compression, so a re-encode can undo it (Sandoval-Segura, Geiping, Goldstein, 2023). Anti-DreamBooth (Van Le, Phung, Nguyen, Dao, Tran, Tran, ICCV 2023) blocks someone fine-tuning a model on your face or a recurring subject. Fawkes (Shan, Wenger, Zhang, USENIX Security 2020) and LowKey (Cherepanova, Goldblum, Foley, ICLR 2021) are face cloaks that hide your identity from facial recognition, not your style from mimicry. Each is covered in Nightshade and Glaze alternatives and set side by side in AI art protection tools compared.

Do any of them actually hold?

Treat every one of these as a deterrent, not a guarantee. Hönig, Rando, Carlini and Tramèr (ICLR 2025) found that “all existing protective tools create a false sense of security and leave artists vulnerable to style mimicry,” with reviewers preferring the copy of Glaze-protected art 56.6% of the time under a cheap best-of-four removal attack, where 50% marks the point at which the protection made no difference. Nightshade was long thought harder to strip, but LightShed (Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi, USENIX Security 2025) reports a 99.98% detection rate on Nightshade-protected images and works against Glaze too. A second generation of tools claims to survive these removal steps, but those results are self-reported and not yet independently confirmed. So pick by the threat you actually face, layer the tools where the threats overlap, and take every one as raising the cost of copying rather than a permanent lock. For the full effectiveness picture see does Glaze actually work in 2026?.

Sources

Shan, Cryan, Wenger, Zheng, Hanocka, Zhao (2023). GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security 2023.
Shan, Ding, Passananti, Wu, Zheng, Zhao (2024). Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models. IEEE S&P 2024.
Hönig, Rando, Carlini, Tramèr (2025). Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. ICLR 2025.
Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi (2025). LightShed: Defeating Perturbation-based Image Copyright Protections. USENIX Security 2025.
Liang, Wu (2023). Mist: Towards Improved Adversarial Examples for Diffusion Models.
Salman, Khaddaj, Leclerc, Ilyas, Mądry (2023). Raising the Cost of Malicious AI-Powered Image Editing (PhotoGuard). ICML 2023.
Sandoval-Segura, Geiping, Goldstein (2023). JPEG Compressed Images Can Bypass Protections Against AI Editing.
Van Le, Phung, Nguyen, Dao, Tran, Tran (2023). Anti-DreamBooth: Protecting Users from Personalized Text-to-Image Synthesis. ICCV 2023.
Shan, Wenger, Zhang, Li, Zheng, Zhao (2020). Fawkes: Protecting Privacy against Unauthorized Deep Learning Models. USENIX Security 2020.
Cherepanova, Goldblum, Foley, Duan, Dickerson, Taylor, Goldstein (2021). LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition. ICLR 2021.