Nightshade and Glaze alternatives

If Glaze and Nightshade are not the right fit for your work, the main alternatives are other perturbation tools, and each one does a different job. Mist cloaks your style much as Glaze does. PhotoGuard blocks AI editing rather than training. Anti-DreamBooth blocks fine-tuning on a face or subject. A second generation, including BlurGuard, StyleGuard and AntiPure, is built specifically to survive removal. Fawkes and LowKey are a different job entirely: they hide your face from facial recognition, not your style from mimicry. Every first-generation tool below has been beaten by cheap robust mimicry or purification, and the second generation claims resistance but has not been independently confirmed.

Mist: a tool-agnostic style cloak

Mist (Liang and Wu, 2023) is the closest alternative to Glaze. It is an open-source cloak that fuses a semantic and a textural objective to improve transfer across different models, using a larger perturbation budget of 17/255. The job is the same as Glaze’s, to stop a model learning your style, and so is the weakness: in the strongest independent test, Mist copies reached a 62.0% quality preference under a best-of-four removal attack (Hönig, Rando, Carlini, Tramèr, ICLR 2025), the highest of the three cloaks tested and comfortably above the 50% mark at which a copy is indistinguishable from one trained on unprotected art. Choose Mist over Glaze if you want an open pipeline you can inspect, but expect the same durability ceiling.

PhotoGuard: block AI editing, not training

PhotoGuard (Salman, Khaddaj, Leclerc, Ilyas, Mądry, ICML 2023) solves a different problem. Instead of stopping a model from learning your style, it immunizes a single photo against AI image-to-image and inpainting edits, so a diffusion model that tries to alter the protected picture produces a visibly broken result. It is the tool to reach for when the threat is someone manipulating your image, not training on it. Its known weakness is cheap: Sandoval-Segura, Geiping and Goldstein (2023) showed that PhotoGuard’s edit-blocking “perturbations are not robust to JPEG compression, which poses a major weakness because of the common usage and availability of JPEG.” The encoder attack starts to weaken between JPEG quality 95 and 85, so a single re-encode can undo it.

Anti-DreamBooth: block personalization fine-tunes

Anti-DreamBooth (Van Le, Phung, Nguyen, Dao, Tran, Tran, ICCV 2023) is built for the case where someone fine-tunes a model on your face or a recurring subject. The method “aims to add subtle noise perturbation to each user’s image before publishing in order to disrupt the generation quality of any DreamBooth model trained on these perturbed images.” It sits between a cloak and an edit-blocker: like Glaze it fights training, but it targets personalization specifically, which makes it the right choice for protecting a likeness rather than a drawing style. It was tested alongside Glaze and beaten in the same study, reaching a 56.6% quality preference under the best-of-four attack (Hönig et al., ICLR 2025).

The second generation, built to survive purification

A newer class of tools postdates the bypass papers and is designed to resist the removal steps that beat the first generation. BlurGuard (Kim, Nam, Kim, Kim, Jeong, NeurIPS 2025) reshapes the frequency spectrum of the protective noise and reports retaining 92.9% of its protective efficacy after a worst-case purification stack, against 38.5% to 48.4% for earlier methods. StyleGuard (Li, Zhang, Lyu, Liu, Xiao, NeurIPS 2025) trains its perturbation against ensembles of purifiers and upscalers so simple removal does not strip it. AntiPure (Yang, Cao, Duan, He, 2025) embeds perturbations meant to “persist under representative purification settings.” The caveat is the same for all three: they are newer than the strongest attacks, none has been independently bypassed, and their survival numbers are self-reported.

What about Fawkes and LowKey?

Fawkes (Shan, Wenger, Zhang, USENIX Security 2020) and LowKey (Cherepanova, Goldblum, Foley, ICLR 2021) are often listed as art-protection tools, but they do a different job. Both are face cloaks: they shift the way a facial-recognition system encodes your face so it fails to match you, which protects your identity in photographs, not the style of your art against mimicry. If your concern is being found or identified rather than having your style copied, they are the right family, and they belong with the facial-recognition tools rather than the art cloaks here.

So which alternative fits your job?

Match the tool to the threat: Mist to cloak a style, PhotoGuard to block edits, Anti-DreamBooth to block a face or subject fine-tune, and a second-generation cloak if you want purification resistance and can accept that it is unproven. For a side-by-side view of all of them see AI art protection tools compared, and for whether any of them actually holds up in independent testing see the AI art-protection scorecard.

The alternatives to Glaze and Nightshade are not really competitors; they cover different parts of the same problem, from cloaking a style to blocking an edit to poisoning a fine-tune. The pattern across all of them is consistent: the first-generation tools work on their own benchmarks and fall to cheap, black-box removal, while the second generation claims to close that gap but has not yet been tested by anyone other than its authors. Choose by the job you need done, layer where the threats overlap, and treat every one as a deterrent rather than a guarantee.

Sources

• Liang, Wu (2023). Mist: Towards Improved Adversarial Examples for Diffusion Models.
• Salman, Khaddaj, Leclerc, Ilyas, Mądry (2023). Raising the Cost of Malicious AI-Powered Image Editing (PhotoGuard). ICML 2023.
• Sandoval-Segura, Geiping, Goldstein (2023). JPEG Compressed Images Can Bypass Protections Against AI Editing.
• Van Le, Phung, Nguyen, Dao, Tran, Tran (2023). Anti-DreamBooth: Protecting Users from Personalized Text-to-Image Synthesis. ICCV 2023.
• Kim, Nam, Kim, Kim, Jeong (2025). BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing. NeurIPS 2025.
• Li, Zhang, Lyu, Liu, Xiao (2025). StyleGuard: Preventing Text-to-Image-Model-based Style Mimicry Attacks by Style Perturbations. NeurIPS 2025.
• Yang, Cao, Duan, He (2025). Towards Robust Defense against Customization via Protective Perturbation Resistant to Diffusion-based Purification (AntiPure).
• Hönig, Rando, Carlini, Tramèr (2025). Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. ICLR 2025.
• Shan, Wenger, Zhang, Li, Zheng, Zhao (2020). Fawkes: Protecting Privacy against Unauthorized Deep Learning Models. USENIX Security 2020.
• Cherepanova, Goldblum, Foley, Duan, Dickerson, Taylor, Goldstein (2021). LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition. ICLR 2021.