Researchers release Nightshade, a data-poisoning tool for artists against AI scrapers
Around 50 poisoned images could distort a diffusion model's output for a concept; the effect spread to related words such as 'puppy' when a model learned from enough of them.
- Security & misuse
- Courts & copyright
- Minor
A University of Chicago team led by computer scientist Ben Zhao released Nightshade, a tool that lets artists alter their images before posting them online so that any text-to-image model trained on the altered version learns something wrong. The changes are invisible to a human viewer but shift what a model associates with a given prompt — the paper reported that around 50 poisoned images of dogs were enough to make Stable Diffusion produce distorted, non-dog outputs for the word “dog,” and around 300 could make it generate images of cats instead. The corruption also bled into related concepts, so poisoning “dog” degraded outputs for “puppy” and “husky” as well.
Nightshade extended the same team’s earlier tool, Glaze, which cloaked an artist’s personal style from AI training without necessarily harming the model overall. Nightshade was explicitly offensive rather than defensive: its purpose was to make unauthorised scraping and training costly for image-generation companies, not merely to opt an individual artist’s work out of it. The tool was designed to be integrated into Glaze as an optional feature, so an artist could choose whether to merely protect their style or actively poison a scraper’s training set.
Reaction from artists, several of whom had spent 2022 and 2023 in dispute with AI companies over uncompensated use of their work in training data, was broadly positive; one illustrator told MIT Technology Review the tool would “make [AI companies] think twice” about scraping images without permission. OpenAI, Meta, Google and Stability AI did not respond to requests for comment on the tool at the time of its release.
The research was submitted for peer review at the IEEE Symposium on Security and Privacy, and the underlying paper was published there the following year. Nightshade did not resolve the broader legal question of whether training on copyrighted images without a licence was itself unlawful — the subject of parallel litigation moving through US courts — but it gave individual creators a technical countermeasure while that question remained unsettled.