Glaze, Nightshade and AI opt-outs: what they do for artists, and what a dated record adds

TimeBinder adds a layer of protection against AI and human fraud and disputes. Tools that cloak images and opt-outs aim to keep your work out of AI training. A dated record does a different job: it shows your original existed by a date.

Artists and photographers now have several ways to push back on their work being used to train image generators: cloaking tools such as Glaze, poisoning tools such as Nightshade, and the legal opt-out in EU copyright law. Each does something specific, and each has limits its own makers state.

This guide sets out what each one does according to its own documentation and to EU texts, where the limits are, and why a dated record of your originals is a separate job that none of them does. TimeBinder does not detect AI and does not stop anyone scraping a file. This is general information, not legal advice.

Two different jobs: keeping work out, and showing what is yours

Cloaking, poisoning and opt-outs try to change what happens to your work once it is online. A dated record is something you hold yourself. It cannot stop a scraper, and it does not show who made a work. What it can show is that a specific original file existed no later than a recorded time, which is useful when you need to describe your own history with a work.

Glaze: disrupting style mimicry

The University of Chicago team behind Glaze describes it as a system that computes minimal changes to an artwork so it looks unchanged to people but looks like a different style to AI models, so a model asked to mimic the artist produces something quite different. The team says it is not a watermark or hidden message.

Its own page lists the limits plainly:

• It is not a permanent solution. A future algorithm could overcome today’s protection and leave previously protected art vulnerable.
• Changes are more visible on art with flat colours and smooth backgrounds.
• It targets individualised mimicry through fine-tuning on a new style. It is less or not effective against styles already trained into base models.
• The team lists two known attacks against it, and updated Glaze in response to one of them.

The project also describes a desktop app, designed to run on your own machine, and a separate web service, WebGlaze, which processes images on cloud GPU servers the lab pays for. If you use the web service, the image you submit is sent to that service. Access has been invitation-based.

Nightshade: poisoning training data

Nightshade comes from the same lab. Its page says it turns an image into a “poison” sample, so a model that trains on it without consent learns unpredictable behaviour. The team says its aim is to raise the cost of training on unlicensed data so that licensing from creators becomes a viable alternative, not to break models. It says Glaze is the defensive tool for individual artists, while Nightshade is an optional tool used collectively.

Its stated risks include that it is unlikely to stay future-proof over long periods and that changes are more visible on flat-colour art. The page also says Nightshade v1.0 does not provide mimicry protection like Glaze, so it is not a substitute. Its FAQ says it is most effective on Stable Diffusion-family models, and that it only has an effect when a lot of shaded images are trained.

What independent research has found

A paper by Robert Hönig, Javier Rando, Nicholas Carlini and Florian Tramèr, “Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI” (revised February 2025, published at ICLR 2025), reports that low-effort, off-the-shelf techniques such as image upscaling can significantly degrade existing protections, and cautions that these tools “only provide a false sense of security”. The Glaze team’s v2.1 update note thanks the authors, says Glaze 2.1 provides stronger protection than earlier versions, and says the effect of the attack varies across styles and artists and often costs the attacker image quality. The project’s FAQ also disputes that Glaze has been “broken”.

MIT Technology Review reported in July 2025 on LightShed, a tool from a team led by a University of Cambridge researcher that can detect and remove perturbations from images protected by tools such as Nightshade. The researchers said they did not mean to steal anyone’s work but wanted to avoid a false sense of security. The same article notes that the Nightshade site had already warned the tool was not future-proof, and that its lead researcher still believes such defences have value. The underlying USENIX Security 2025 paper (Foerster and colleagues) reports that LightShed can identify images protected by tools including Nightshade and Glaze and remove the perturbation, and reports a 99.98% true-positive rate at detecting Nightshade-poisoned images in its tests.

Put simply, treat these tools as a speed bump that may help today, not as a lock. They may raise the effort for some kinds of misuse, but nobody can promise a given image will stay protected against future methods, and protection does not undo copies already scraped.

The EU legal opt-out

In the EU, Article 4 of the 2019 Copyright in the Digital Single Market Directive (2019/790) allows text and data mining of lawfully accessible works unless the rightholder has expressly reserved their rights in an appropriate manner, such as machine-readable means for content made publicly available online. The European Commission says AI Act obligations on general-purpose AI model providers include identifying and complying with these reservations.

The Commission is also running a process to identify generally agreed machine-readable opt-out protocols. It refers to a study that lists robots.txt and several other technical solutions, and it says rightholders are free to use any method that meets the Directive’s criteria. The Commission describes the outcome as a list still to be agreed, so check its current status before you rely on a particular protocol.

Germany’s implementation, section 44b of its copyright act, says that for works available online a reservation is only effective if it is made in machine-readable form (quoted in the Federal Court of Justice press release of 20 May 2026). That wording was tested in Kneschke v LAION, a photographer’s case against the non-profit that compiled an image-text dataset used for AI training. On 10 December 2025 the Hanseatic Higher Regional Court in Hamburg (5 U 104/24) dismissed his appeal. According to Bird & Bird, it held that a reservation written in natural language in the stock agency’s terms and source code did not meet the machine-readability test at the time of the 2021 download, while taking a technology-neutral approach that leaves open that plain-language reservations could count as technology improves. The court allowed a further appeal (heise online). Commentators report that the Federal Court of Justice held a hearing on 3 September 2026 (I ZR 281/25) and has scheduled its pronouncement for 17 December 2026, and that it may refer questions to the EU Court of Justice (IP Global Guard). Those later steps are reported, not a final decision. This is one German dispute about one dataset. It does not decide how courts in the US, UK or elsewhere treat training or opt-outs.

Separately, the EU’s voluntary Code of Practice for general-purpose AI models (final version of 10 July 2025) has signatories commit to using web crawlers that follow robots.txt instructions and to respect other appropriate machine-readable rights reservations (copyright chapter). It binds only the companies that sign it. The Nightshade team’s own page says opt-out lists have been disregarded in the past and are “unverifiable and unenforceable”.

This covers the EU only. Rules in the US, UK and elsewhere differ and are contested. Check the terms of each platform you post on as well, because they set their own rules about how your uploads may be used.

Side by side

Approach	What it does	Stated limits	What it does not do
Glaze	Alters an image so models see a different style	Not permanent; visible on flat art; weaker against styles in base models	Does not prove who made a work or stop copying
Nightshade	Turns an image into poison training data	Unlikely to stay future-proof; no mimicry protection	Does not stop a person copying or reposting
EU opt-out (Article 4)	Reserves your rights against text and data mining	Must be machine-readable for online content; protocols still being settled	Does not apply outside the EU; does not show who made a work
A dated record (TimeBind)	Shows an exact file existed no later than a recorded time and still matches	Shows nothing about who made it or whether it is AI	Does not stop scraping or training

Where a dated record fits in

1. Keep the unprotected master. Store the layered file or RAW original, and do not overwrite it with a cloaked export.
2. Date it before you post. A TimeBind on the master records that it existed by that time. See our guides for illustrators posting portfolio work and RAW photos.
3. Date the protected export separately. A cloaked or opted-out version is a different file from the master, so it has a different fingerprint.
4. Record where you posted. Keep links and capture dates, so you can show what was public and when.
5. Log opt-outs you set. Note the date you added a robots.txt entry or other reservation. If you have a site, the free AI crawler opt-out generator writes those robots.txt rules for the AI crawlers that publish a way to opt out. Only crawlers that honour the file will follow them.

If someone does copy your work, a dated original and a capture of the copy are the starting evidence. Our guide on proving someone copied your content goes through it.

How a TimeBind fits, and what it does not show

A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches its fingerprint. Dating your master before you post gives you a record of your original that does not depend on any protection tool or platform setting.

A TimeBind shows that this exact file existed no later than the recorded time and still matches its fingerprint. TimeBinder makes the fingerprint in your browser and the file stays on your device. It does not show who made the file, who owns it, or that anyone agreed to it. It does not stop scraping, does not detect AI and does not show copying. It complements cloaking tools, opt-outs and your platform settings; it does not replace them. This is general information, not legal advice.

See the glossary for text and data mining (TDM) and AI training opt-out.

Sources checked

Checked on 11 November 2026. We quote only what these documents say and mark where a point depends on your own rules or local law. Anything we could not verify from a primary source is left out.

• University of Chicago: What is Glaze: description, limits, known attacks
• University of Chicago: What is Nightshade: description, aim and stated limitations
• Hönig, Rando, Carlini and Tramèr, “Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI”, arXiv:2406.12027 (ICLR 2025)
• Glaze v2.1 update note on the noisy-upscaling attack
• MIT Technology Review: This tool strips away anti-AI protections from digital art (10 July 2025): LightShed and the researchers’ comments
• Foerster et al., “LightShed: Defeating Perturbation-based Image Copyright Protections”, USENIX Security 2025
• Directive (EU) 2019/790, Article 4: text and data mining exception and reservation of rights
• European Commission: Stakeholder consultation on AI and copyright compliance: machine-readable opt-out protocols and AI Act obligations
• Bundesgerichtshof, press release 085/2026 of 20 May 2026 (I ZR 281/25)
• Bird & Bird on the Hamburg Higher Regional Court decision in Kneschke v LAION (17 December 2025)
• heise online on the Hamburg decision (11 December 2025)
• IP Global Guard on Kneschke v LAION at the BGH
• General-Purpose AI Code of Practice, copyright chapter (final, 10 July 2025)
• TimeBinder pricing: Pooled and ASAP prices

Date your next original before you post it

Fingerprint the master file before you post or cloak it, so your original has a dated record whatever happens to the public copy. Your first Pooled TimeBind is free, with no credit card required. After that, Pooled TimeBinds start from US$5, and an ASAP TimeBind is US$15. Prices checked 11 November 2026. See plans and pricing. Open TimeBinder