Glaze: The Digital Cloak Protecting Artists from AI Style Mimicry

The Problem: When Your Style Becomes a Prompt

In 2022, generative AI image models like Stable Diffusion, Midjourney, and DALL-E exploded into public consciousness. For every user amazed at the ability to generate “a portrait in the style of Rembrandt” with a single sentence, there was an artist watching their unique, years-developed style being replicated in seconds without their consent.

This isn’t a hypothetical concern. AI artists can use a technique called fine-tuning (or LoRA — Low-Rank Adaptation) to take a small collection of an artist’s work and rapidly train a model that can generate unlimited new images in that same style. Just a few dozen images scraped from an online portfolio is enough. The resulting mimicry floods the internet with low-quality copies, dilutes the artist’s brand, steals commissions, and — as one art teacher told researchers — drives students to drop out, believing the industry is already lost ¹.

Before Glaze, the only defences were opt-out lists — voluntary agreements that any AI company could ignore with zero consequences.

Enter Glaze.

What Is Glaze?

Glaze is a style cloaking tool developed by the SAND Lab at the University of Chicago’s Department of Computer Science ². It was first published at the USENIX Security Symposium in August 2023, one of the top academic conferences in computer security ³.

The core idea: apply invisible, barely perceptible changes to an artwork such that:

To a human eye — the image looks identical to the original.
To an AI model — the image appears to have a dramatically different artistic style (say, abstract cubism instead of realistic charcoal).

When an AI model is fine-tuned on these “glazed” images, it learns the wrong style. Prompting the model to generate art in the artist’s style produces something entirely different — often a messy hybrid of the original style and the cloaked target style ⁴.

“Glaze works by understanding the AI models that are training on human art, and using machine learning algorithms, computing a set of minimal changes to artworks, such that it appears unchanged to human eyes, but appears to AI models like a dramatically different art style.” — The Glaze Project team ²

The Team Behind It

Glaze was developed by the same SAND Lab team that later created Nightshade. The research paper lists six authors:

Person	Role
Shawn Shan	Lead researcher, CS graduate student (MIT Tech Review Innovator of the Year 2024)
Jenna Cryan	CS PhD student
Emily Wenger	CS PhD student
Rana Hanocka	Assistant Professor of Computer Science
Haitao Zheng	Neubauer Professor, co-advisor
Ben Y. Zhao	Neubauer Professor, co-advisor

The team previously created Fawkes (2020), an algorithm that cloaks personal photographs so they cannot be used to train facial recognition models ¹. Glaze adapts and extends that core idea to the much harder problem of artistic style.

How Glaze Works (Without the Jargon)

The clever insight behind Glaze is to use AI against itself. Here’s the simplified pipeline:

Step 1: Identify the “Style Features”

An artist’s style is defined by many subtle characteristics — brushstroke texture, colour palette, shading technique, compositional habits. A generative AI model learns to represent these features in what’s called feature space — a mathematical map where similar styles cluster together.

Glaze uses a style transfer algorithm (a close relative of the AI models it’s fighting) to figure out which parts of an image are “style” vs “content”. Here’s the trick: a style transfer algorithm takes an image and recreates it in a different artistic style (e.g., turning a photo into a Van Gogh painting). The pixels that change most during this transformation are the ones most responsible for defining the content. The pixels that stay similar across different content but change when the style target changes are the style features ¹.

Step 2: Compute the Cloak

Once Glaze knows which features define the style, it computes a minimal perturbation — a carefully optimised set of pixel changes — that pushes the image’s feature representation towards a target style (e.g., “cubism” or “Van Gogh”), while keeping the image visually identical to a human.

This is an optimisation problem. For a clean image $x$, Glaze finds a perturbation $\delta$ that minimises:

$$\min_{|\delta| \le \epsilon} \mathcal{L}\text{style}(f\theta(x + \delta), t)$$

where:

$\delta$ is the perturbation, constrained to be smaller than human visibility threshold $\epsilon$
$f_\theta$ is the AI model’s feature extractor
$\mathcal{L}_\text{style}$ measures how different the style features are from the target $t$
The objective is to make the glazed image’s style features look like the target style (e.g., abstract cubism)

Step 3: Apply the Cloak

The glazed image is what the artist uploads online. When an AI company scrapes it and adds it to their training dataset, the model learns a corrupted version of the artist’s style — one that is shifted towards the target style. When someone later tries to prompt “in the style of [artist]”, the generated output is noticeably wrong ².

Why It’s Robust

Glaze’s effects survive common image transformations:

✅ Screenshots — the perturbations survive re-capture
✅ Cropping and resizing — the cloak is not a fragile watermark
✅ JPEG compression — survives quality reduction
✅ Noise addition and blurring — perturbations are distributed across pixels
✅ Resampling and format conversion — the effect is embedded in the image’s feature space

The team explains this by analogy: think of Glaze as adding information in a dimension that humans don’t perceive but AI models do, like UV light or ultrasonic frequencies. Unless an attacker knows exactly which dimension the cloak operates on (it changes per image), standard image processing won’t remove it ⁴.

The Numbers

The Glaze research paper reports impressive results from extensive testing:

Metric	Result
Protection against style mimicry	Over 92% effective at low perturbation levels
Protection against adaptive countermeasures	Over 85% effective
Artists willing to use the tool	Over 90% of surveyed artists
Artists surveyed during development	Over 1,000 professional and part-time artists
Historical artists tested	195 different artists’ styles
Perturbation level	Invisible at $p=0.05$ (barely perceptible at higher settings)

Who Is Glaze For?

Glaze is designed for visual artists, illustrators, photographers, and digital creators who share their work online and want to prevent AI models from learning to mimic their personal style.

The tool is:

Free — no cost, no subscription, no hidden fees ²
Client-side — runs locally on your own computer; no artwork is sent to any server (the desktop version)
Not open source — intentionally, to raise the bar for adaptive attacks
Available for Windows and macOS
Updated regularly — current version is Glaze 2.2, which supports NVidia 50xx GPUs ⁵

It is not a general-purpose watermark or copyright protection tool. It specifically targets style mimicry through fine-tuning, which is the most common way AI models copy individual artists.

How to Use It

Desktop App

Download Glaze from the official website: glaze.cs.uchicago.edu
Install and run on Windows or macOS (requires a reasonably modern GPU — NVidia recommended)
Select your image — PNG files produce the best results
Choose a target style — the cloaking algorithm uses this to shift the AI’s perception (e.g., “Cubism”, “Van Gogh”)
Select intensity — low (barely perceptible) to high (stronger protection, slightly more visible)
Save the glazed image — this is what you upload to your portfolio, social media, or website

WebGlaze

Many artists don’t have computers with powerful GPUs. For them, the SAND Lab created WebGlaze — a free web service that runs the Glaze algorithm on University of Chicago GPU servers ⁶.

Works on any device with a browser (phones, tablets, older computers)
Invite-only to ensure it stays available for human artists (request an invite via @TheGlazeProject on social media)
Images are encrypted in transit, processed, and immediately deleted — nothing is stored
Free, funded by research grants

The Bigger Picture: Why This Matters

1. Identity Theft, But for Art

The Glaze team’s research with over 1,000 artists revealed something crucial: artists don’t just see their style as a product. They see it as their identity. Having it replicated by AI without consent felt, in their words, like identity theft ¹.

“I spoke with teachers who were seeing students drop out of their class because they thought there was no hope for the industry, and professional artists who are seeing their style ripped off left and right.” — Professor Ben Zhao ¹

2. A Cat-and-Mouse Game

Glaze (and its offensive counterpart Nightshade) are not permanent solutions. The team is transparent about this: machine learning research moves quickly, and new attacks against Glaze are discovered over time ².

Two known attacks against Glaze exist:

Attack	Published	Status
IMPRESS	NeurIPS 2023	The team published a rebuttal — methodology concerns identified
Noisy Upscaler	June 2024	Showed results on Glaze v1.1; the team used findings to improve Glaze to v2.1

The key point: Glaze is not a panacea. It’s a necessary first step that buys time while longer-term legal and regulatory solutions develop ².

3. Complementing Nightshade

Glaze and Nightshade are often discussed as a pair:

Tool	Type	What It Does
Glaze	Defensive	Cloaks your style so AI can’t learn to mimic it
Nightshade	Offensive	Poisons AI models that train on your data, breaking their outputs

The creators recommend using both: apply Glaze to every piece of art you post publicly to protect your style, and optionally add Nightshade to deter scrapers by corrupting the model itself.

4. The Fawkes Connection

Glaze was not the team’s first cloaking tool. In 2020, they released Fawkes, which applied similar techniques to personal photographs to prevent facial recognition systems from identifying the people in them ¹. Fawkes received nearly one million downloads and was covered by the New York Times. When generative AI art exploded in 2022, artists started contacting the team asking whether Fawkes could protect their artwork too. The answer was no — faces have a small number of features (eye colour, nose shape) while artistic style is defined by hundreds of subtle characteristics — so the team built Glaze from the ground up.

Limitations and Risks

The Glaze project is honest about the tool’s limitations:

Visible artefacts on certain styles — images with flat colours and smooth backgrounds show the perturbations more clearly. Glaze 2.0 made major improvements here, but it’s not perfect ².
Not future-proof — AI models may evolve in ways that defeat current cloaking techniques. The team continues to update Glaze in response to new attacks.
Ineffective against base model styles — Glaze protects against individualised fine-tuning attacks. It is less effective when an attacker tries to replicate a style already embedded in a base model (e.g., Impressionism, Van Gogh) ².
Requires ongoing use — if you already have unglazed artwork online, those images may have already been scraped. The team recommends glazing all new uploads to gradually shift the AI’s perception of your style.

Key Takeaways

Glaze is a free style-cloaking tool from the University of Chicago’s SAND Lab
It applies invisible perturbations that make AI models see a different style than humans do
Published at USENIX Security 2023 — peer-reviewed academic research
Over 92% effective against style mimicry at low perturbation levels
Survives cropping, compression, screenshots, and other common image transformations
Available as a desktop app (Windows/macOS) or WebGlaze (browser-based, invite-only)
Best used together with Nightshade for comprehensive protection
Not a permanent solution — but a vital first step while legal frameworks catch up

References

University of Chicago News (2023). “UChicago scientists develop new tool to protect artists from AI mimicry.” Read article ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶
The Glaze Project, University of Chicago. “What is Glaze?” Official site ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸
Shan, S., Cryan, J., Wenger, E., Zheng, H., Hanocka, R., & Zhao, B. Y. (2023). “Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models.” USENIX Security Symposium. arXiv:2302.04222 ↩
The Glaze Project. “Frequently Asked Questions.” FAQ page ↩ ↩²
The Glaze Project. “Downloads — Glaze 2.2.” Download page ↩
The Glaze Project. “WebGlaze.” WebGlaze page ↩