How to protect your art from AI training

There is no single tool that reliably protects art from AI training, so the practical move is to layer several. Cloak your style with Glaze or Mist, poison scrapers with Nightshade, block AI editing with PhotoGuard and personalization with Anti-DreamBooth, and pair all of that with non-technical steps like opt-outs, smaller uploads and provenance records. Each layer covers a different attack, and none is enough alone.

Start with a style cloak

A style cloak is the most direct protection against a model learning to imitate you. Glaze (Shan et al., USENIX Security 2023) adds a barely perceptible perturbation so a model that trains on your art learns the wrong style; in the authors’ words, the cloaks “apply barely perceptible perturbations to images, and when used as training data, mislead generative models that try to mimic a specific artist.” It is a free desktop app from the University of Chicago and takes about a minute per image on a GPU. Mist (Liang and Wu, 2023) is an open-source alternative that fuses two adversarial objectives to improve transfer across different models, using a larger perturbation budget of 17/255. Either one gives you a cloak; pick one and apply it to everything you post.

Add a poison for scale

A cloak protects your images; a poison goes after the scraper. Nightshade (Shan et al., IEEE S&P 2024) corrupts what a model learns from a scraped image, and “less than 100 poisoned training samples” can control a single SDXL prompt. Treat it as collective action: the deterrent comes from many artists shading their work, not from protecting your portfolio in isolation. Run it on top of a cloak, not instead of one.

Block editing and face cloning

Training is not the only misuse. If your concern is someone editing your image or cloning a face, two different tools apply. PhotoGuard (Salman et al., ICML 2023) immunizes a photo against AI image-to-image and inpainting edits, so a diffusion model that tries to alter the protected picture produces a visibly broken result. Anti-DreamBooth (Van Le et al., ICCV 2023) targets personalization fine-tunes specifically; the method “aims to add subtle noise perturbation to each user’s image before publishing in order to disrupt the generation quality of any DreamBooth model trained on these perturbed images.” It is the defence built for protecting a face or a recurring subject.

Do not skip the non-technical layers

Perturbation tools are one layer; low-tech steps matter just as much. Opt your work out of training sets wherever a platform offers it, upload at lower resolution so there is less signal to learn from, and keep clean originals, timestamps and project files as proof of authorship. Strip identifying metadata before posting, and if your goal is to prove ownership rather than prevent copying, that is what watermarking is for. These cost nothing and do not depend on an arms race holding.

What can remove these protections?

Assume a determined attacker can undo a single cloak, because published methods already do. IMPRESS (Cao et al., NeurIPS 2023) restored a Glaze-protected style task from 42.5% to 87.0% classifier accuracy with a purification step, and PhotoGuard’s edit-blocking perturbations “are not robust to JPEG compression, which poses a major weakness because of the common usage and availability of JPEG” (Sandoval-Segura et al., 2023). Worse for any one tool, purification generalises: PurifyOnce (Zhao et al., 2026) improves edited-image quality by 3 to 6 dB PSNR and cuts FID by 50 to 70% across six representative protections under model mismatch. A tool that helps before an image is transformed may lose most of its strength after a platform, scraper or attacker re-encodes it.

Why one tool is never enough

No single layer is reliable on its own. Hönig et al. (ICLR 2025) found that first-generation cloaks including Glaze and Mist “are ineffective when faced with simple robust mimicry methods” such as upscaling, which is exactly why layering matters. Newer tools built to resist removal, such as BlurGuard (Kim et al., NeurIPS 2025), reshape the protective noise so it survives common purification and report retaining 92.9% of their effect after a worst-case purification stack, versus 38.5% to 48.4% for earlier methods; but none has been independently confirmed durable yet. Stacking a cloak, a poison, an edit-blocker and an opt-out means no single bypass undoes all your protection at once. See does Glaze actually work? for how each tool holds up.

The uncomfortable truth is that every protection you apply today may be removable tomorrow, because the removal methods are improving faster than the cloaks. That is an argument for layering, not for giving up: a copier has to defeat every layer, while you only have to make copying cost more than it is worth. Cloak everything, poison at scale, block editing where it matters, keep proof of authorship, and re-protect your back catalogue as better tools appear. For how well each tool actually holds up, read the AI art-protection scorecard.

Sources

• Shan, Cryan, Wenger, Zheng, Hanocka, Zhao (2023). GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security 2023.
• Liang, Wu (2023). Mist: Towards Improved Adversarial Examples for Diffusion Models.
• Shan, Ding, Passananti, Wu, Zheng, Zhao (2024). Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models. IEEE S&P 2024.
• Salman, Khaddaj, Leclerc, Ilyas, Mądry (2023). Raising the Cost of Malicious AI-Powered Image Editing (PhotoGuard). ICML 2023.
• Van Le, Phung, Nguyen, Dao, Tran, Tran (2023). Anti-DreamBooth: Protecting Users from Personalized Text-to-Image Synthesis. ICCV 2023.
• Cao, Li, Wang, Jia, Li, Chen (2023). IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI. NeurIPS 2023.
• Sandoval-Segura, Geiping, Goldstein (2023). JPEG Compressed Images Can Bypass Protections Against AI Editing.
• Zhao, Zhai, Bai, Shen, Lin, Gao, Wu (2026). Purify Once, Edit Freely: Breaking Image Protections under Model Mismatch.
• Hönig, Rando, Carlini, Tramèr (2025). Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. ICLR 2025.
• Kim, Nam, Kim, Kim, Jeong (2025). BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing. NeurIPS 2025.