Quick wins for a faster PC:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
ThatPainter is reader-supported. When you buy through links on our site, we may earn an affiliate commission. Learn More
Short answer: Nightshade is a free, locally run University of Chicago SAND Lab tool that adds carefully optimized, mostly imperceptible changes to an image. If that image is later included in unauthorized model training, the changes may make the training data less reliable or associate a concept with misleading visual features. That makes Nightshade a potential cost-raising measure—not a copyright notice, watermark, scraper blocker, or guarantee that art cannot be copied or used by AI.
Nightshade and Glaze address different problems: Nightshade targets unauthorized training data, while Glaze is designed to disrupt imitation of an artist’s visual style.
As an Amazon Associate I earn from qualifying purchases.
Why artists are looking for technical defenses
Public artwork can be collected by automated crawlers with little visibility for the artist. An opt-out request, a robots.txt directive, or a platform preference may not reveal whether an image was already copied, which dataset contains it, or whether a later training run used it. Nightshade’s stated theory is to make unlicensed data less dependable and therefore make licensing more attractive to model developers. That is a project objective, not proof that a particular commercial company will license work or that a production model has been affected.
Nightshade was developed by the University of Chicago SAND Lab and the Glaze Project team. The project describes its mission and origins at the official About page.
#1 Best Overall
How Nightshade works
- You select an image. Nightshade computes an optimized perturbation on your computer rather than asking a remote service to process the file.
- The published image stays close to the original for human viewers. The changes are intended to be difficult to notice, although “imperceptible” does not mean that every file will have zero visible or workflow impact.
- Machine-readable relationships can shift. If the altered file is collected, captioned and used for training, its visual features and text-image associations may no longer behave like clean examples.
- A trained model may learn an incorrect association. Depending on the model, preprocessing and the amount of related data, outputs for a target concept may become degraded or acquire unintended features.
This is a training-time attack. It does not automatically attack every model that displays, describes or edits an image. The file must reach a training or model-update pipeline, and the effect depends on that pipeline’s architecture, captions, filtering, augmentation and other defenses. The project’s plain-language explanation is available at What is Nightshade?
What the 2023 paper demonstrated
The paper Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models, dated October 20, 2023, describes a prompt-specific poisoning attack against text-to-image diffusion models. It argues that a particular concept can be relatively sparse even inside a very large image dataset, creating an opportunity for targeted poisoning.
In the evaluated research settings, the authors report:
- Optimized attacks using approximately 100 poison samples for each tested diffusion model.
- Successful corruption of an SDXL prompt with fewer than 100 poison samples in some experiments.
- Higher sample requirements when more clean training data for the concept was present.
- “Bleed-through,” in which effects reached related concepts rather than remaining perfectly isolated.
- Severe degradation when attacks against multiple concepts were composed.
These are controlled experiments, not a production threshold. “Approximately 100 samples” does not mean that any 100 artists, uploads or Nightshaded files will reliably compromise a current commercial model. The result depends on the target concept, model, labels, dataset composition and attack configuration. Read the paper at arXiv.
Nightshade versus Glaze
| Question | Nightshade | Glaze |
|---|---|---|
| Main goal | Poison unauthorized training data | Disrupt AI imitation of an artist’s style |
| Primary target | Model training or updating | Style-learning and style-mimicry behavior |
| Image objective | Remain as close as practical to the original while changing machine-learning relationships | Create a cloaked version with perturbations intended to mislead style imitation |
| Best fit | “I do not want this image to become useful clean training data” | “I do not want a model to imitate my distinctive style” |
| Relationship | Can complement Glaze | Can complement Nightshade |
| Key limitation | Does not itself provide Glaze’s style-mimicry protection | Does not guarantee that an image cannot be scraped or copied |
The projects are complementary, not interchangeable. The current Nightshade homepage specifically warns that the standalone Nightshade release does not include Glaze and that Nightshade alone should not be assumed to protect against style mimicry. See the Nightshade homepage and the Glaze homepage.
Current software status
Version information checked August 18, 2026: the official homepage reports a Nightshade 1.1 update for macOS and Windows in April 2026. It lists a fix for the reported “TRUE” bug and a driver update; an earlier Mac update addressed some GPUs on Apple M1, M2 and M3 machines. The current release is standalone rather than a combined Glaze/Nightshade application. A combined version was described as being tested and planned, not as generally available.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchVerify the download page immediately before installation because release status and compatibility can change. Nightshade is presented as a research-oriented tool, not a commercially supported security product.
Does Nightshade upload your artwork?
The official FAQ says Nightshade can run offline and that users can disable network connectivity while processing. That design is local rather than cloud-based. Download only from the University of Chicago project site, verify the installer, and treat third-party mirrors as untrusted.
Local processing is a privacy advantage, but it does not remove ordinary operational risks. Keep an untouched master, process a copy, inspect the output, and record the software version used. The FAQ also says conventional edits such as sharpening, blurring, denoising, downsampling or metadata stripping do not straightforwardly remove the protection. That statement applies to the project’s tested threat model; a future, purpose-built machine-learning removal system could behave differently.
A responsible artist workflow
- Archive the original. Preserve an untouched, high-quality master outside the publication workflow.
- Create a publication copy. Export the format and resolution you actually intend to show online.
- Download from the official site. Use nightshade.cs.uchicago.edu, not an aggregator or mirror.
- Run locally. Disable network access during processing if that fits your privacy requirements.
- Inspect at 100% and display size. Check edges, fine texture, gradients and color transitions before publishing.
- Never overwrite the master. Keep the processed file as a separate derivative.
- Publish the processed derivative. Uploading an unprotected original, alternate crop, layered source file or larger version can undermine the strategy.
- Add Glaze when style imitation is also a concern. Obtain it separately from the official Glaze site.
- Keep a record. Note the filename, processing date and Nightshade version so the workflow can be reproduced.
- Recheck before future uploads. Model capabilities and defensive techniques change.
What one processed image cannot do
- Stop the original from being copied, screenshotted or reposted.
- Remove an image from a dataset that already contains it.
- Control how a platform resizes, recompresses, captions, filters or stores the file.
- Protect unaffected works, other versions or the rest of a portfolio.
- Stop inference-time use, such as asking an AI editor to modify the image.
- Guarantee protection against another architecture, a new model or a purification system.
Nightshade works only if the altered image enters a training or updating process. Training on related, unaffected images can still teach a model about a subject or style.
Where protection can vary
Results may change with the artwork’s texture and style, resolution, color distribution and crop; later resizing or recompression; captions and labels; the model and image encoder; whether training starts from scratch or updates an existing checkpoint; and the quantity of related clean data. Glaze’s documentation makes similar cautions about style-dependent protection and future algorithms, which are relevant because both tools rely on assumptions about model behavior. See the Glaze guide and What is Glaze?
Ordinary transformations may not remove the perturbation straightforwardly, according to the Nightshade FAQ. That is not the same as being permanently unremovable. A developer could use automated filtering, deduplication, human curation, data augmentation or a machine-learning purification method. A model trained on substantial clean data may also dilute an effect.
Ethical and strategic trade-offs
Nightshade creates a genuine tension. Artists can view poisoning as a technical cost imposed on entities that ignore consent. Model builders can argue that mislabeled or poisoned samples may degrade systems and affect users who were not part of the dispute. The paper’s reported bleed-through and compounded attacks show why effects may not remain perfectly limited to one artist or prompt.
Technical countermeasures therefore sit alongside, rather than replace, licensing, provenance, transparency and regulation. Nightshade has no legal force: it is not a registration, license, takedown request, contractual term or substitute for evidence in a dispute. Artists may still need copyright registration where relevant, contracts, platform notices, provenance records and qualified legal advice.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhen Nightshade is worth considering
It may fit if you:
- Publish work online regularly and are concerned about unauthorized dataset collection.
- Accept probabilistic protection rather than a guarantee.
- Can preserve originals and publish derivatives.
- Are comfortable installing and running a local research tool.
- Can reject an output if its visual quality is not acceptable.
It may be a poor fit if you:
- Need an enforceable opt-out or legal remedy.
- Cannot tolerate any image change.
- Primarily need protection from direct copying or reposting.
- Must expose the original file through your publishing workflow.
- Expect one image to protect an entire catalog or every proprietary model.
- Require a cloud workflow without local installation.
How to evaluate any protection tool
Compare tools by the threat they address—scraping, training, style imitation or provenance—then examine local versus cloud processing, privacy, visible artifacts, model coverage, resistance to ordinary transformations, update cadence, operating-system and hardware friction, independent evidence, reproducibility and cost. A free download can still require storage, processing time, compatible hardware and staff attention. “Free” does not mean risk-free or maintenance-free.
A speed bump, not a shield
Nightshade is an inventive adversarial technique that may make selected unauthorized training data less useful under particular conditions. Its strongest practical value is as one layer in a broader strategy: publish protected derivatives, keep high-resolution masters private, document provenance, use contracts and takedown channels, and consider Glaze when style imitation is the specific threat.
It does not make AI unable to copy art, prevent scraping, undo past training or guarantee results against current and future proprietary systems. Treat it as a probabilistic way to raise technical and economic friction—not as comprehensive art protection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
