Nightshade AI: What It Does and Whether It Protects Art

Nightshade is a data-poisoning tool from a University of Chicago team, designed to make artificial intelligence (AI) image models learn wrong links between words and pictures. Its authors report that fewer than 100 poisoned images corrupted one Stable Diffusion XL (SDXL) prompt in their own tests. As the paper describes the attack, the poison works at training time, through the data a model is trained on. A 2025 study by researchers from the TU Darmstadt, the University of Cambridge and the University of Texas at San Antonio (UT San Antonio) reported detecting Nightshade-protected images and removing their protection. No independent test against current commercial models was found. The cited sources support treating Nightshade as one layer of protection that offers no guarantee.

Does Nightshade Work? What It Does and What It Cannot

The paper introducing Nightshade, posted as a preprint on arXiv, calls it a prompt-specific poisoning attack on text-to-image generative models. The attack targets the link between one text prompt and the pictures a model learns for that prompt. The paper says the poison samples look visually identical to benign images with matching text prompts. The arXiv record shows a submission date of October 20, 2023, and a third version dated April 29, 2024.

The authors report that fewer than 100 poison samples were enough to corrupt a Stable Diffusion XL prompt in their setup. They also report that the poison effects bleed through to related concepts. Both claims come from Nightshade's authors and their own setup.

The Register reported on January 20, 2024 that a University of Chicago team had released Nightshade 1.0 that week. The doctoral students named in the article are Shawn Shan, Wenxin Ding and Josephine Passananti. The professors are Heather Zheng and Ben Zhao. The article does not state price or licensing.

Three limits apply to that result.

1. The effect depends on training use. As the paper describes the attack, the poison works at training time, through the data a model is trained on.
2. Detection research exists. A 2025 study reported detecting Nightshade-protected images with 99.98% accuracy in its experiments and removing the protection.
3. No independent test is cited. No independent test of Nightshade against current commercial image models was found in the cited sources.

None of the three sources cited here, the authors' paper abstract, the coverage in The Register and a TU Darmstadt release about a separate study, is an independent test against current commercial models.

Nightshade Versus Glaze

According to The Register, Nightshade is an offensive data-poisoning tool and a companion to Glaze, which is a defensive tool. Glaze alters images so that models trained on them cannot copy an artist's visual style. The team recommends using both, and a combined version was in development at the time of that report.

No source cited here says which tool to apply first, and none ranks the two for a given artist. The table points to the decision in two ways. If your concern is style copying, the Glaze row describes that purpose. If your concern is what a model learns from specific prompts, the Nightshade row describes that purpose.

The LightShed row adds one more fact. LightShed targets both Glaze-style and Nightshade-style perturbations, so the detection research covers both tools.

What Researchers Found About Breaking These Tools

The 2025 study developed LightShed, which detects and removes Glaze-style and Nightshade-style perturbations. The release said the work would be presented in August 2025. According to the TU Darmstadt release, LightShed detected Nightshade-protected images with 99.98% accuracy in the researchers' experiments. No image count appears in the sources cited here, so that figure cannot be checked against a sample size.

The researchers say the protection may have been overestimated and call for more resilient tools. This is the researchers' own account. The full conference paper is not among the sources cited here.

Matthew Guzdial, an assistant professor of computer science at the University of Alberta, called the work cool and timely in remarks reported by The Register. He worried, though, that it is overhyped as the solution. He also noted that Nightshade only works with CLIP-based models.

The Register also quotes a figure from a different setup. In his social media post, Guzdial says that per the authors about 8 million poisoned images would be needed to have a significant impact on generating similar images for LAION models. The fewer-than-100 result is the authors' SDXL result.

The authors also state limits on the art itself. Images processed with Nightshade may look subtly different from the originals, especially art with flat colors and smooth backgrounds. The authors acknowledge that countermeasures may be developed. For an artist deciding whether to process originals, the stated limit is that processed images may look subtly different from the originals.

What Nightshade Does Not Fix

Nothing cited here shows that Nightshade changes copyright lawsuits, licensing terms or opt-out requirements. The AI art copyright and opt-outs guide covers those steps. For court cases, see the AI copyright lawsuits tracker.

The paper describes poisoning that applies to models trained on poisoned data. Nothing cited here shows it changes a model that has already been trained. The sources address the training stage and say nothing about models after training.

Where Nightshade Fits With Other Protections

Nightshade is one part of a layered approach. The AI art copyright and opt-outs guide covers opt-outs and copyright steps. Reader-side filters are covered in how to find non-AI art.

Two questions decide whether Nightshade fits your case.

• Are your images likely to be scraped and used in training? The paper describes poisoning as an attack on training data.
• Is your concern style copying, which is the Glaze purpose, or what a model learns from specific prompts, which is the Nightshade purpose? The two tools target different things.

Nightshade can corrupt a model's learning of a prompt when images processed with it are used in training, according to the authors' own tests. The evidence is the authors' paper, The Register's coverage, and the TU Darmstadt release on LightShed, which reports that the protection can be detected and removed. That answer changes if an independent test against current commercial models is published, if a new Nightshade version addresses detection, or if a court or regulator sets a rule on training data.

Before you use Nightshade on your own work, read the paper abstract on arXiv, then retry the team's project page, which could not be loaded when checked on November 1, 2026.