Nightshade: Poisoning the Scrapers

What it is

Nightshade takes an image and turns it into what its authors call a poison sample. To a person the picture looks essentially unchanged. To a model being trained on it, the content reads as something else entirely. Their own example: a cow that the model learns as a handbag.

It is a free, optional tool from the SAND Lab at the University of Chicago*, the same group behind Glaze. The team is Shawn Shan, Wenxin Ding, Josephine Passananti, Haitao Zheng and Ben Y. Zhao, and the technical work was presented at the *45th IEEE Symposium on Security and Privacy in May 2024. This is peer-reviewed security research, not a startup.

The argument it is built on

The premise is stated flatly on the page: opt-out lists "have been disregarded by model trainers in the past, and can be easily ignored with zero consequences."

That is the whole design rationale. Every polite mechanism offered to artists so far, robots.txt, opt-out registries, do-not-train flags, depends on the scraper choosing to honour it. Nightshade, in the authors' words, "does not rely on the kindness of model trainers".

Instead it changes the economics. If scraped work carries a risk of corrupting the model trained on it, then unlicensed data stops being free and starts having a cost. Licensing becomes the cheaper option. That is the lever.

How it works

Nightshade uses multi-objective optimisation: it minimises visible change to the image while distorting how the model internally represents its features. The two goals are pulled against each other until it finds an image that looks right to you and wrong to the machine.

It is not a watermark and it is not steganography, which is the distinction people most often get wrong. There is no hidden payload to strip out. The effect survives cropping, resampling, compression, and even being photographed off a screen, because the change is to the image itself rather than to metadata riding alongside it.

It runs offline and sends nothing anywhere.

Nightshade and Glaze are not the same thing

Worth getting straight, because they are constantly confused:

- Glaze is defensive. It protects an individual artist against having their personal style mimicked.

- Nightshade is offensive. It disrupts the model trained on scraped work, on behalf of artists collectively.

They can be used together, and the lab has said it plans to integrate them. Nightshade shipped as a standalone v1.0, with future integration into WebGlaze planned.

Why it matters

Most of the creative rights conversation is stuck waiting on courts and legislatures, both of which move in years while scraping happens continuously. Nightshade is one of the very few interventions an individual can apply today, to their own files, without permission from anyone.

It is worth being clear-eyed about the limits. This is an arms race, and defences like this have a shelf life as training pipelines adapt. The effect depends on poisoned images actually being scraped in sufficient quantity, so one artist acting alone changes little, and the collective framing is not rhetorical. And it changes your image, which may matter to you depending on the work.

But the deeper point holds regardless of how long the technique lasts. Consent that only functions when the other party feels like honouring it was never consent. Nightshade is what it looks like when people stop asking.

Key takeaways

- Free, offline tool from the University of Chicago SAND Lab, peer-reviewed at IEEE S&P 2024, non-profit and not a product.

- Turns images into poison samples: near-identical to a human eye, misread by a model in training.

- Not a watermark. The effect survives cropping, compression, resampling and being rephotographed.

- Glaze defends your style. Nightshade attacks the scraper. Different tools, meant to be used together.

- The point is economic, making unlicensed training expensive enough that licensing wins.