Artists who share work online face a difficult bargain: visibility can lead to commissions and opportunities, but the same exposure can also make their images available to AI companies that scrape the web for training data. Nightshade, a free tool from the University of Chicago, is designed to change that balance by making scraped images less useful for generative AI training.
What Nightshade Changes
Nightshade works by subtly altering the pixels in an image. To a human viewer, the result can look almost unchanged. To an AI model, however, the image may appear to represent something else entirely.
The tool targets the link between images and text prompts. If a model trains on enough altered images, it can begin to connect a prompt with the wrong visual idea. The researchers write in a technical paper currently under peer review that it can take fewer than 100 “poisoned” samples to corrupt a Stable Diffusion prompt.
Ben Zhao, the computer science professor who led the project, described the idea with a workplace analogy: “putting hot sauce in your lunch so it doesn’t get stolen from the workplace fridge.” His point is that the tool is defensive, but it creates a real cost for unauthorized use.
The article gives a simple example. A painting of a cow in a meadow could be altered so that an AI model connects the cow prompt with the idea of a large Ford truck. The Nightshade team also showed that a shaded version of the Mona Lisa can still look like the Mona Lisa to people, while an AI system may interpret it as a cat wearing a robe.
Why Artists Want This Leverage
The problem Nightshade addresses is not only technical. It is about consent and compensation. Opt-out requests and do-not-scrape codes depend on AI companies choosing to respect them. Zhao argues that this is weak protection because there is no firm enforcement when companies ignore those requests.
Artists cannot simply disappear from the internet. Many depend on social platforms and online portfolios to find clients, build audiences and sell work. That makes a purely offline strategy unrealistic for many working artists.
Zhao said the team is not trying to take down Big AI. Instead, the aim is to push companies toward licensing work rather than training models on scraped images. In his framing, Nightshade gives creators a way to respond that is stronger than complaints on social media, email or appeals to Congress.
Kelly McKernan, an artist involved in the class action lawsuit against Stability AI, Midjourney and DeviantArt, used Nightshade and Glaze on a painting posted on X. McKernan told TechCrunch that after finding over 50 of their pieces had been scraped and used to train AI models, they lost interest in making more art. They also found their signature in AI-generated content.
“It’s not convenient and I’m not going to stop the storm, but it’s going to help me get through to whatever the other side looks like.”
For McKernan, Nightshade is a protective measure until adequate regulation exists. It is not a complete answer, but it gives artists a tool they can use now.
Nightshade And Glaze Work Differently
Nightshade is related to another University of Chicago project led by Zhao: Glaze. The two tools are often discussed together, but they are meant to solve different problems.
Glaze is a cloaking tool that changes how AI models perceive artistic style. A human might see a realistic charcoal portrait, while a model may interpret it as an abstract painting. That makes it harder for systems to imitate an artist’s recognizable style.
Nightshade focuses on poisoning training data by disrupting prompt associations. It does not protect an artist from mimicry by itself. For that reason, the team recommends that artists use both tools before posting work online.
The current recommendation is to use Nightshade first, then Glaze, because the team is still testing how the two interact on the same image. The team also plans to release an integrated tool that combines both functions.
That distinction matters. A shaded image may interfere with AI training, but a glazed image is what helps shield style. Artists who want both effects need both layers of protection.
What Artists See After Using It
Most Nightshade changes are meant to be invisible to the human eye. Still, the source notes that the effect can be more visible on images with flat colors and smooth backgrounds. The tool includes a low-intensity setting for preserving visual quality.
McKernan said they could tell their image had been altered after using Glaze and Nightshade because they were the artist who painted it, but the change was “almost imperceptible.” Illustrator Christopher Bretz also tested Nightshade and said the lowest and default settings had little impact on one of his pieces, while higher settings produced more obvious changes.
Bretz told TechCrunch that he planned to run new work and much of his older online portfolio through Nightshade. He also said he hoped the tool would help digital artists who had stopped sharing new work feel able to post again.
Nightshade’s pixel-level changes are designed to survive common edits. Zhao said the disruptive effect can remain through cropping, compressing, screenshotting or editing. Even a photo of a screen displaying a shaded image can be disruptive to model training.
The Larger Fight Over AI Training Data
Nightshade is one of several tools artists are using as generative AI raises pressure on creative work. Steg.AI and Imatag apply watermarks that are imperceptible to humans and help creators establish ownership. The “No AI” Watermark Generator marks human-made work as AI-generated in hopes that training datasets will filter it out. Kudurru identifies and tracks scrapers’ IP addresses, letting website owners block them or send back a different image.
Kin.art, another tool that launched this week, takes a different path. Instead of cryptographically modifying an image, it masks parts of the image and swaps meta tags to make the image harder to use in model training.
Nightshade has critics. Some have called it a “virus,” argued that it could hurt the open source community, or questioned its legality. Zhao rejects that view. His argument is that model trainers choose to scrape images, including shaded ones, and companies profit from that training.
The long-term goal is to add an “incremental price” to each piece of data scraped without permission. If unlicensed training becomes less reliable, companies may have more reason to license clean images from artists and image libraries. The source points to Getty Images and Nvidia as an example of a generative AI tool trained using Getty’s stock photo library, with photographers receiving a portion of subscription revenue.
Zhao also clarified that he is not anti-AI. He separates generative AI controversies from other AI uses in academia and scientific research, including developing new medications and combating climate change. His concern is with systems that use creative work without consent, then make it easy to imitate or replace the people who made that work.
For artists, Nightshade is not a final settlement in the fight over AI scraping. It is a practical tool in a landscape where consent is often difficult to enforce. Its message is direct: if companies want reliable training data, they may need to pay for it.