🔎 Reverse Image Search
Image search techniques made simple: upload a photo or paste a URL and search 6 engines at once. 100% free, nothing stored.
🔒 Your image is never stored on our servers longer than 24 hours and is never shared.
If you post your art or photographs online, an AI model can learn your style from them and copy it on demand. Glaze and Nightshade are two free tools from the University of Chicago that fight back by changing your images in ways the human eye barely notices but a training model cannot ignore. This guide explains how each one works, where each one fails, and how to use them together as part of a practical routine.
Direct answer: Glaze and Nightshade are free tools from the University of Chicago’s SAND Lab that protect art from AI copying. Glaze adds a near-invisible “style cloak” so a model trained on your image learns the wrong style, while Nightshade poisons training data so the model learns the wrong concept. Neither is a guarantee, and both work best with opt-outs and monitoring.
What are Glaze and Nightshade?
Glaze and Nightshade are two companion tools built by the same research lab — the SAND Lab at the University of Chicago — to protect artists from generative AI models that train on images scraped from the web. They attack the same problem from opposite directions, and many artists run both.
Glaze is defensive. It adds a barely perceptible perturbation, called a “style cloak”, to an image before you post it. A person looking at the cloaked image sees your work more or less as you made it. A model that later trains on that image, however, learns a different style from the one you actually drew or photographed. The change lives in the model’s feature space, not in anything your eye is meant to catch.
Nightshade is offensive. Instead of shielding one image, it corrupts what a model learns from it, shifting the association between a concept and an image so the trained system maps the wrong thing. Its power comes from scale: many poisoned images circulating in scraped data, not from shielding a single portfolio piece.
Both tools are free for artists, and both are aimed at human artists who do not use generative AI themselves. That matters, because the lab’s invite-only web service, WebGlaze, is explicitly offered to human artists only.
How does Glaze protect your style?
Glaze works by adding a small, carefully calculated layer of noise to your image. The noise is tuned so that it shifts the image’s style features in the mathematical space a diffusion model uses, while staying inside a fixed perceptual budget — the visible distortion your eye can tolerate. The result still looks like your work to a human viewer, but a model fine-tuned on it picks up a distorted version of your style.
The lab’s own paper, Shan and colleagues at USENIX Security 2023, reports a 94.3% artist-rated protection success rate on Stable Diffusion for current artists at the default perturbation budget. That is the headline number, and it comes from the lab’s own user study — independent testing tells a more complicated story, which we cover honestly in the limits section below.
To use Glaze you download the desktop app from the official Glaze project page, install it on Windows or Mac, and let it download roughly 4 GB of machine-learning models on first launch. You then open an image, choose an intensity and a render quality, and Glaze produces a cloaked copy. The original file stays untouched on your computer — you post the cloaked copy and keep the original private.
Glaze needs real computing power. On Windows it needs an NVIDIA GPU with at least 3.6 GB of video memory, plus the NVIDIA CUDA Toolkit, according to the lab’s user guide. On a Mac it runs on Apple Silicon M1 or M2 machines, or on Intel Macs running macOS 13 or newer. Without a suitable GPU it still runs on the CPU, but slowly — the lab’s guide notes that the highest-quality render can take around an hour per image on an ordinary laptop, so plan for that.
If your computer cannot run Glaze at all, there is WebGlaze, a free web service that runs the same tool on the lab’s own GPU servers. You upload an image through a web form, choose an intensity, and the cloaked result is emailed back to you. WebGlaze is invite-only: you request an invite, register an account, and work within a daily and weekly limit that resets automatically. It does not let you choose a render time — every job runs at medium quality — but it needs nothing more than a browser.
How does Nightshade poison a model’s training data?
Nightshade takes the opposite approach. Rather than defending your image, it turns your image into bad training data for whoever scrapes it. The tool injects a poison that changes what a model associates with a concept — the paper’s famous example is a “car” concept poisoned so the model draws a cow instead.
The Nightshade paper, Shan and colleagues at IEEE S&P 2024, reports that a single “car” to “cow” attack succeeded with roughly 50 optimised poison samples, after which the poisoned model outputs an image of a cow for every mention of a car in its prompts. The same paper reports that fewer than 100 poisoned training samples can completely control the output of a prompt in Stable Diffusion’s newest model, SDXL. Those figures come from the lab’s own experiments, and they explain why Nightshade is described as collective action: one poisoned image does little, but many poisoned images across many artists’ work can degrade the system doing the copying.
Nightshade is designed to work entirely offline. The lab’s own FAQ says you can install it, turn off your Wi-Fi, run it, and quit before reconnecting — it needs no access to the target model and no connection while it works. That offline design is deliberate: the tool is meant to empower artists, not to phone home.
System requirements are heavier than Glaze’s. According to the official Nightshade user guide, a Windows GPU must have more than 4 GB of video memory, and you need the NVIDIA CUDA Toolkit installed. On a Mac it runs on Apple Silicon M1, M2 or M3. There is no mobile version, and the lab says it has no time to build one — instead it plans to integrate Nightshade into the WebGlaze web service, which would run on any device with a browser.
One practical warning from the same FAQ: if you have an NVIDIA GTX 1660, 1650 or 1550 graphics card, a known bug in the PyTorch library can leave you with a whole black image after applying Nightshade. Check your card before you start, and if that is your hardware, use WebGlaze or a different machine.
Glaze vs Nightshade: which one do you need?
The short answer is that they do different jobs, and the choice depends on what you are trying to achieve. Glaze protects your own work, image by image. Nightshade attacks the model that scrapes your work, and only pays off when many artists do it together.
| Question | Glaze | Nightshade |
|---|---|---|
| What does it do? | Adds a near-invisible style cloak to your image | Poisons training data so the model learns the wrong concept |
| Who does it protect? | You, image by image | The artist community, at scale |
| What does a viewer see? | Your work, with barely visible changes | Your work, with barely visible changes |
| What does a model learn? | The wrong style | The wrong concept entirely |
| Needs a GPU? | NVIDIA GPU with 3.6 GB or more, or Apple Silicon | NVIDIA GPU with more than 4 GB, or Apple Silicon |
| Browser version? | Yes — WebGlaze, free but invite-only | Not yet — planned inside WebGlaze |
| Works offline? | Yes, once installed | Yes, by design |
| Best for | Protecting a portfolio you post publicly | Pushing back collectively against scrapers |
If you only do one thing, do Glaze. It is the tool that directly defends the images you post. Add Nightshade when you want to push back as well as defend — and when you have the hardware to run it. Running both on the same image is possible, and the lab’s own guidance is to use Glaze on everything you post for personal defence, and add Nightshade when you want to push back collectively.
How to cloak a photo with Glaze: a worked example for photographers
Here is the full workflow, walked through with a concrete example: a wedding photographer, Sarah, who posts a portfolio image of a Lake District ceremony and does not want an AI model to learn her editing style from it.
Step 1: pick the right file. Sarah starts from her finished, exported JPEG — the version she would normally post. She keeps her original RAW file and her uncloaked JPEG private. Glaze protects the copy you publish, not the file on your hard drive, so the uncloaked original must never be the one that goes online.
Step 2: install Glaze. She downloads the app from the University of Chicago’s Glaze page and installs it on her Windows laptop. On first launch Glaze downloads around 4 GB of models, so she does this once, on a stable connection, before she needs it — not five minutes before a post goes live.
Step 3: cloak the image. She opens the exported JPEG in Glaze, leaves the intensity at the default setting for her first run, and chooses a medium render quality so the job finishes in reasonable time. She saves the cloaked copy under a new filename, for example lake-district-ceremony-glazed.jpg, so she can always tell it apart from the original.
Step 4: compare before and after. She opens both versions side by side and zooms in. At the default intensity the change is barely perceptible — a slight texture shift in flat areas of sky, perhaps. If the artefacts are obvious, she re-runs at a lower intensity; if she cannot see any difference at all, that is normal, and the cloak is still there. Visible artefacts are the trade-off at higher intensities, and photographers should check skin tones and smooth gradients first, because that is where the changes show most.
Step 5: post the cloaked copy only. Sarah uploads the cloaked file to her portfolio and social accounts. She does not post the original anywhere, and she does not send it to clients through a public link. A cloak only protects the version that is actually out in the world.
Step 6: check where the image turns up. A month later she reverse image searches the cloaked file to see where it has appeared. If a copy shows up on a site she did not authorise, she has the evidence she needs for a takedown — and a dated record of the original shoot. Our guide to how to check if your photos were used to train AI walks through that monitoring step in detail.
Two honest notes about this workflow. First, the outcome can vary: the strength of the protection depends on the image, the intensity you choose, and the model that later trains on it, so there is no guaranteed result to promise. Second, Glaze does nothing about someone downloading and reposting your image — it targets style mimicry in training data, not copying. That is why the monitoring step matters, and why cloaking is one layer, not the whole defence.
Do Glaze and Nightshade actually work? The honest limits
Both tools raise the cost of copying, but neither is a guarantee — and the research since their release has been blunt about that. If you use them, you should know exactly where they fail.
The strongest challenge comes from purification attacks, which strip the protective perturbation before training. A peer-reviewed study by Hönig and colleagues at ICLR 2025 found that Glaze, Mist and Anti-DreamBooth were “ineffective when faced with simple robust mimicry methods” such as image upscaling, with their best-of-four attack reaching a 56.6% quality success rate against Glaze, where 50% means a copy indistinguishable from one trained on unprotected art. In plain terms, a scraper who upscales your image before training can largely undo the cloak.
Nightshade has been broken too. LightShed, a depoisoning attack from Foerster and colleagues at USENIX Security 2025, reports detecting Nightshade at a 99.98% true-positive rate while removing the perturbation, and the same work generalises to Glaze as well. An earlier purification method, IMPRESS from Cao and colleagues at NeurIPS 2023, attacks the same class of protections by exploiting a perceptible inconsistency between the original image and the diffusion-reconstructed image. The clear reading of the evidence is that any single cloak can eventually be removed.
The research is trying to catch up. A second generation of protections is built specifically to survive purification, such as StyleGuard from Li and colleagues at NeurIPS 2025, which trains the perturbation against ensembles of purifiers and upscalers so simple removal steps do not strip it. These tools postdate the bypass papers, and none has been independently broken yet — which is encouraging, but it is not the same as proven.
There are practical limits as well. Glaze does not stop a model that was already trained on your uncloaked work, and it does not help with images you posted years ago before you knew about it. Nightshade only matters if the poisoned images actually end up in a training set, which you cannot verify yourself. And both tools change your pixels, so at high intensities the visible artefacts can matter for print work — photographers should test on a print proof, not just on screen, before cloaking a whole portfolio at maximum strength.
None of this makes the tools useless. It makes them one layer. A cloak that forces a scraper to upscale, purify and re-check every image is still a real cost, and for an individual artist that cost is often enough. But anyone who tells you Glaze or Nightshade makes your art “safe” is overselling them. If you want to know whether an image you found online was itself AI-generated, rather than protected from AI, our guide to how to tell if an image is AI-generated covers that separate question.
A practical routine: layer Glaze with opt-outs and monitoring
Cloaking works best as one layer among several. Here is a routine a photographer or digital artist can actually follow, in the order that matters.
1. Cloak before you post. Run Glaze on every portfolio image before it goes public, at the default intensity unless you have a reason to change it. Keep the original private and post only the cloaked copy.
2. Set your opt-outs. Cloaking protects against style mimicry; opt-outs tell crawlers and platforms not to train on your work at all. Our guide to opt your photos out of AI training lists every control that actually exists, platform by platform, including the file-level signals that travel with the image itself.
3. Attach provenance where you can. Content Credentials (C2PA) let you attach a signed record of who made an image and how it was edited. It does not stop training, but it makes your authorship provable when a dispute arises. Our guide to checking Content Credentials (C2PA) on a photo explains how to read them.
4. Monitor with reverse image search. Once a month, reverse image search a few of your most valuable images and check where they have appeared. A cloaked image that turns up on a stock site or a training-data mirror is a takedown case, and a dated record of your originals is the evidence that wins it.
5. Keep the whole picture in view. Glaze, Nightshade, opt-outs and provenance are all pieces of the same job — keeping control of images you publish. Our complete guide to protecting your photos online brings those pieces together, from watermarks and metadata to takedowns.
Used this way, Glaze and Nightshade are worth the effort: a free, practical layer that makes copying your style measurably harder, even though it cannot make it impossible. Set them up once, make cloaking part of your export routine, and spend the time you save on making the work itself.
FAQs
Is Glaze free to use?
Yes. Glaze is free for artists, and the desktop app costs nothing to download from the University of Chicago. WebGlaze, the browser version that runs on the lab’s own servers, is also free, but it is invite-only and limited to human artists, with daily and weekly limits that reset automatically.
Can people tell if an image has been glazed?
At the default intensity, barely. Glaze is designed to hold visible distortion inside a fixed perceptual budget, so the cloaked image still looks like your work. At higher intensities you may notice texture changes in flat areas such as skies, and photographers should check skin tones and smooth gradients before posting.
Does Nightshade protect my own photos?
Not directly. Nightshade does not shield your images the way Glaze does — it poisons the training data a model learns from, and its power comes from many poisoned images across many artists. Use Glaze to protect your own portfolio, and add Nightshade if you want to push back collectively as well.
Will Glaze stop AI from copying my style completely?
No. Independent research shows that simple steps such as upscaling can largely undo the cloak, and a method called LightShed can detect and remove the perturbation. Glaze raises the cost of copying your style, but it is one layer among several — combine it with opt-outs, provenance and regular monitoring.
