Nightshade: How Data Poisoning Became a Weapon for Artists Against AI

The Problem: Your Art, Their Model

Imagine spending years perfecting your artistic style — the specific brushstroke, the unique colour palette, the compositions that make your work recognisable. Then one day, you type your name into an AI image generator like Midjourney or Stable Diffusion, and it produces passable imitations of your work in seconds. Somewhere, without your permission, your art was scraped from the web, fed into a training dataset, and used to teach a machine how to mimic you.

This isn’t theoretical. Hundreds of thousands of artists have had their work scraped into training datasets without consent or compensation. In 2023 alone, a leaked spreadsheet revealed that Midjourney’s training dataset referenced over 5,000 living artists by name ¹. Opt-out lists exist, but they are voluntary, unverifiable, and easy for AI companies to ignore with zero consequences ². Artists needed a way to fight back that didn’t rely on the goodwill of billion-dollar corporations.

Enter Nightshade.

What Is Nightshade?

Nightshade is a data poisoning tool developed by researchers at the University of Chicago — led by Professor Ben Zhao and PhD student Shawn Shan ³. It was published at the IEEE Symposium on Security and Privacy (Oakland) in 2024 ⁴.

The core idea is elegant and aggressive: instead of just asking AI companies politely not to scrape your art, Nightshade makes your art dangerous for them to train on. It works by applying invisible modifications to an image’s pixels. To the human eye, the image looks identical. But to an AI model being trained on it, the image says something completely different — a picture of a cow might look to the model like a leather handbag.

Train on enough of these “poisoned” images, and the model starts to break in bizarre and unpredictable ways.

“Nightshade’s goal is not to break models, but to increase the cost of training on unlicensed data, such that licensing images from their creators becomes a viable alternative.” — The Glaze Project team ²

The Team Behind It

Nightshade was created by the SAND Lab at the University of Chicago’s Department of Computer Science:

Person	Role
Shawn Shan	Lead researcher (MIT Technology Review Innovator of the Year 2024)
Wenxin Ding	Research contributor
Josephine Passananti	Research contributor
Stanley Wu	Research contributor
Haitao Zheng	Professor, co-advisor
Ben Y. Zhao	Neubauer Professor, co-advisor

This is the same team that previously built Glaze — a defensive tool that masks an artist’s personal style so AI models can’t learn to mimic it ⁵. Nightshade is the offensive counterpart. Together, they form a one-two punch: Glaze protects your style, Nightshade punishes those who scrape anyway.

How Nightshade Works (Without the Jargon)

Generative AI models like Stable Diffusion learn by looking at millions of image-text pairs. They build a mathematical representation — called a latent space — where similar concepts cluster together: all images of “dog” end up near each other in this space, distinct from “cat”.

Nightshade exploits this process using an optimisation attack. Here’s the simplified version:

1. Take an image — say, a photo of a cow in a field.
2. Pick a target misclassification — the researchers want the AI to think this is a handbag, not a cow.
3. Compute an invisible perturbation — Nightshade uses a mathematical algorithm to find tiny pixel changes that make the AI’s internal representation of the image look like a handbag, while keeping the image visually identical to a human.
4. Apply the perturbation — the resulting “shaded” image looks like the original cow photo, but to the AI model, it’s a handbag.

Now imagine this happening to hundreds of cow images across the internet. An AI model that trains on them learns that “cow” means “brown leather object with handles and zippers”. When a user later prompts the model to generate a cow, it produces a handbag ³.

The Numbers That Matter

The research paper found that surprisingly few poisoned samples are needed:

Number of Poisoned Images	Result on Stable Diffusion
50 images	Dogs began showing distorted features, cartoonish faces, extra limbs
100 images	Dogs became cats in generated outputs
300 images	Cat images were near-perfect — the concept of “dog” had been fully replaced

Because of how generative models cluster concepts, the poison also bleeds through to related terms. Poison the concept of “dog”, and prompts for “husky”, “puppy”, and “wolf” also become corrupted ⁴. This is called concept bleed — and it makes Nightshade far more efficient than a naive poisoning approach.

The Mathematical Basis

For readers interested in the technical details, Nightshade solves a constrained optimisation problem. For each poison sample, the algorithm finds a perturbation $\delta$ such that:

1. The perturbed image $x + \delta$ is visually indistinguishable from the original $x$ (the $L_p$ norm of $\delta$ is bounded by a small constant $\epsilon$).
2. The model’s feature representation of $x + \delta$ closely matches the feature representation of the target concept (e.g., “handbag”), not the source concept (e.g., “cow”).
3. The perturbation is robust to common image transformations — cropping, resizing, JPEG compression, and even screenshots don’t remove the poison effect ³.

The optimisation is performed in the model’s latent space using techniques derived from adversarial machine learning research.

Who Is Nightshade For?

Nightshade is designed for visual artists, illustrators, photographers, and any content creator who posts images online and does not want those images used to train AI models without their permission.

The tool is:

• Free and open source — available for download from the University of Chicago ⁶
• Runs locally — no data is sent to any server, preserving privacy ²
• Compatible with Glaze — artists can apply both tools to the same image

It is not intended for casual users or as a general-purpose watermarking tool. The creators explicitly warn that Nightshade can cause visible artefacts on images with flat colours or smooth backgrounds at high intensity settings ².

How to Use It

The practical workflow is straightforward:

1. Download Nightshade from the official website: nightshade.cs.uchicago.edu
2. Run the software (Windows, macOS, or Linux) — it operates as a desktop application
3. Select your image — PNG files work best for quality preservation
4. Choose your settings — intensity level (low/medium/high) balances visual quality against poison potency
5. Save the “shaded” image — this is what you upload to your portfolio, social media, or website

The team has since integrated Nightshade into WebGlaze, allowing artists to apply both Glaze and Nightshade in a single pass ⁵.

The Bigger Picture: Why This Matters

1. Power Asymmetry

Before Nightshade, the relationship between AI companies and artists was entirely one-sided. Companies could scrape any public image, train any model, and face no consequences. Opt-out lists like the one offered by Stability AI placed the burden entirely on artists and were easily ignored ⁷.

Nightshade changes the equation by attaching a cost to every unauthorised scrape. As Professor Zhao put it:

“The point of this tool is to balance the playing field between model trainers and content creators. Right now model trainers have 100 percent of the power.” ⁸

2. Legal Context

Nightshade exists within a rapidly evolving legal landscape. Multiple class-action lawsuits have been filed against AI companies for copyright infringement, with plaintiffs alleging that training on copyrighted works without permission violates intellectual property law ⁹. However, the legal process is slow, expensive, and offers no protection to artists outside the US.

Nightshade provides a technical remedy that works immediately and universally — independent of any court ruling.

3. The Arms Race

Critics and AI companies have raised legitimate concerns. Nightshade could theoretically be used maliciously to poison public datasets for reasons other than copyright protection. Some researchers worry about an escalating adversarial arms race — as detection and filtering techniques improve, poisoning techniques will evolve to evade them ⁸.

The research team acknowledges these risks but argues they are outweighed by the immediate need for artist protection. They note that Nightshade’s code is open source, allowing the community to develop countermeasures and improvements over time ².

4. Limitations

Nightshade is not a silver bullet:

• Existing models are already trained — data scraped before Nightshade’s release cannot be retroactively poisoned. The tool only protects future training cycles.
• Large models require more poison — extremely large models trained on billions of images may need thousands of poisoned samples to show significant effects.
• Detection is possible in theory — sophisticated filtering could identify and remove poisoned samples, though the current feasibility of this at scale is debated.

Relationship to Glaze

Nightshade is often discussed alongside Glaze, its defensive sibling. The two tools are complementary:

Feature	Glaze	Nightshade
Purpose	Defensive — hides your artistic style from AI	Offensive — corrupts AI models that train on your data
What it does	Makes the AI think your art has a different style	Makes the AI misidentify objects entirely
Effect on model	None — only protects the individual artist	Corrupts model’s ability to generate specific concepts
Best used with	Every piece of art you post publicly	Optional — used when you want to deter scrapers

The creators recommend applying both Glaze and Nightshade to artwork before posting online ².

Key Takeaways

• Nightshade is a data poisoning tool developed by University of Chicago researchers and published at IEEE S&P 2024
• It applies invisible pixel-level modifications that corrupt AI model training while remaining undetectable to human viewers
• Just 50–300 poisoned images can destabilise a concept in state-of-the-art models like Stable Diffusion
• The poison effect bleeds through to related concepts (e.g., poisoning “dog” also breaks “husky” and “wolf”)
• Nightshade is free, open source, and runs locally — no data leaves your computer
• It is designed to shift the power balance between AI companies and content creators
• It works best when paired with Glaze for comprehensive protection

References

Footnotes

1. The Daily Dot (2024). “Midjourney lawsuit reveals spreadsheet of 5,000 artists.” Read article ↩

2. Nightshade Project, University of Chicago. “What is Nightshade?” Official site ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

3. Shan, S., Ding, W., Passananti, J., Wu, S., Zheng, H., & Zhao, B. Y. (2024). “Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models.” IEEE Symposium on Security and Privacy. arXiv:2310.13828 ↩ ↩² ↩³

4. Shan et al. (2024). “Nightshade: Prompt-Specific Poisoning Attacks.” IEEE S&P 2024, San Francisco. PDF ↩ ↩²

5. Glaze Project, University of Chicago. “Protecting Artists from Generative AI.” Official site ↩ ↩²

6. Nightshade Project. “Downloads.” Download page ↩

7. MIT Technology Review (2023). “This new data poisoning tool lets artists fight back against generative AI.” Read article ↩

8. Ars Technica (2023). “University of Chicago researchers seek to ‘poison’ AI art generators with Nightshade.” Read article ↩ ↩²

9. Reuters (2023). “Artists take new shot at Stability, Midjourney in updated copyright lawsuit.” Read article ↩