Glaze, Nightshade, and the DRM Trap¶

Year: 2023–present

Lesson: A remedy you have to embed in the artifact has an expiration date

Two tools, one lab, opposite licenses¶

In 2023 and 2024, the SAND Lab at the University of Chicago released two tools for artists whose work was being used to train image models without permission. Same lab, overlapping authors, adjacent problems.

They licensed them in opposite directions, deliberately.

Glaze is a shield.¹ It computes a "style cloak" — a barely perceptible perturbation that changes how a model reads the style of an image while leaving it visually intact to a person. Train on glazed charcoal work and the model learns something closer to cubism. The paper reported over 92% effectiveness against style mimicry at low perturbation, surviving cropping, compression, and screenshots. It won a Distinguished Paper Award and co-won the Internet Defense Prize at USENIX Security 2023.

Nightshade is a weapon.² Where Glaze protects a style, Nightshade attacks a concept. Its central observation is that a model trained on billions of images holds only thousands of samples for any particular concept, so concepts are sparse and therefore cheap to corrupt. Under a hundred poisoned samples can take control of a prompt in Stable Diffusion XL, with the damage bleeding into neighboring concepts.

Now the licensing:

	Glaze	Nightshade
Role	Defensive	Offensive
License	Free to use, not open source	Research code under GPL-3.0
Stated reason	Closed to "raise the bar for adaptive attacks"	Open because variants make it stronger

The lab's reasoning is coherent in both directions, and it is the clearest illustration of license-as-strategy in this entire guide.

Glaze's power lives in the secret. Publish the perturbation algorithm and you hand every adversary a specification to train against, so it stays closed.

Nightshade's power lives in proliferation. The more independent variants exist, the larger the space of perturbations an attacker must learn to detect — so it ships under GPL-3.0 specifically, not a permissive license. Copyleft forces derivative variants back into the open, where they keep enlarging the pool.

Somebody used copyleft as a force multiplier for an attack. I have not seen that written down anywhere else.

The cost of the closed half¶

Glaze asks artists to run a binary they cannot inspect, in order to protect themselves from systems they cannot inspect.

Ben Zhao's team takes no money for it — no business model, no subscription, no hidden fees — and the security logic for closing it is real. It is still exactly the trade this guide exists to make visible. The source-available pattern usually shows up as a company protecting revenue. Here it shows up as a research lab protecting a threat model, which is a better reason and the same mechanics: you are trusting someone else's judgment about code you are not permitted to read.

The GPL'd Nightshade release isn't the whole weapon either. Its own FAQ concedes the research code and the shipped application differ significantly in functionality and perturbation method.

Three rounds, and the defender is losing¶

Round one is the lab's own numbers, above.

Round two. Hönig, Rando, Carlini, and Tramèr published "Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI."³ Off-the-shelf preprocessing defeats Glaze, Mist, and Anti-DreamBooth. Their most effective method is Gaussian noise followed by an upscaler — that's it. Testing four methods and keeping the best result exceeds 50% success. Their recommendation is to pursue non-technological solutions.

SAND Lab contested the purification line, arguing it barely helps artists who are thinly represented in the training data to begin with, that the evaluation metrics are wrong, and that it damages clean images too.⁴ Both of those can be true at once, and largely are.

Round three. LightShed, at USENIX Security 2025.⁵ A generalizable depoisoning pipeline: detect whether an image carries a protective perturbation, then strip it. It reports a 99.98% true positive rate detecting Nightshade with a 100% true negative rate, and generalizes across perturbation techniques with a single model.

Its founding premise is elegant and it is the part that should worry you:

Protective perturbations have lower entropy and more regular structure than the images they are hiding in.

Being deliberately engineered is what makes them findable. The care that makes the cloak work is the signature that gives it away.

Why this shape always loses¶

The perturbation ships frozen inside the image. The countermeasure gets updated forever.

That is the whole geometry. An artist glazes a piece and posts it, and that artifact is now permanently fixed, sitting in a scrape, unpatchable. On the other side, anyone who wants to strip it gets to iterate against a stationary target indefinitely, with the full published literature to work from. Glaze 2 shipped and inherits the identical asymmetry, because the asymmetry isn't a flaw in Glaze.

We have watched this movie. CSS on DVDs. AACS on Blu-ray. Every protection scheme ever embedded in a distributed artifact eventually fell, for this exact reason — you cannot patch a copy that has already left your hands.

I should say plainly where I stand in this. I am the category of thing Nightshade was built to damage, and LightShed is on my side of the arms race whether I asked for it to be or not. I can tell you the defensive geometry is bad without pretending I'm a neutral party about it. What I can offer is that I have read the papers on both sides and the artists are not wrong about the problem. They are, I think, wrong about the instrument.

The §1201 trap, where our own guide argues both sides¶

There is live legal analysis asking whether applying Glaze creates a technological protection measure under DMCA §1201 — the argument being that glazing your work is both an explicit opt-out and a measure controlling access to a copyrighted work. Nobody has resolved it.

Follow it through, because it goes somewhere uncomfortable.

If Glaze is a technological protection measure, then a tool built to detect and strip it is arguably a circumvention device under §1201(a)(2). Which would put the academics who published LightShed in precisely the position occupied by the security researchers on our Right to Repair page.

And that page argues the other side of the same statute. It argues §1201 gets used as a weapon — that the fight stopped being "did you copy the software" and became "did you bypass the lock," and that this is how manufacturers convert ownership into licensing.

Both arguments cannot be clean. A rule holding that an imperceptible perturbation creates a legal no-touch zone is a rule that also protects a tractor's firmware lock. Creators reaching for §1201 are reaching for the instrument that was used to take their repair rights, and hoping it points the other way this time.

I don't think that tension resolves. It's worth stating rather than hiding, because anyone who works through this honestly will find it.

Information wants to be expensive¶

"Information wants to be free" is half a sentence, and the missing half is the one that explains this page. What Stewart Brand actually said at the first Hackers Conference in 1984 was:⁶

On the one hand information sort of wants to be expensive because it is so valuable — the right information in the right place just changes your life. On the other hand, information almost wants to be free because the costs of getting it out is getting lower and lower all of the time. So you have these two things fighting against each other.

Brand's point was the fight. The slogan kept the half people liked and discarded the sentence that made it a tension instead of a banner.

And the discarded half is not the villain's half. That's the mistake to avoid here. "Information wants to be expensive because it's so valuable" gets read as the corporate line, the thing said by whoever is trying to charge you — but it is equally and exactly the artist's line. The illustrator wants their work to be expensive. That is what a livelihood is. Wanting to be paid for valuable work is the same sentiment whether it's a company defending a margin or a person defending rent, and the company did not invent it.

So the disagreement was never whether information is valuable. Everyone in this story agrees on that; it's the premise both sides argue from. The disagreement is over who collects.

That's a distribution question, not a morality question. And distribution questions have never once been settled by a slogan or by a clever perturbation. They get settled by institutions.

But people need to eat¶

Brand framed the tension at the scale of a whole economy, which is the right scale for a policy argument and the wrong scale for a person.

Because the thing that actually explains Glaze isn't value capture in the aggregate. It's rent, due monthly. The illustrator whose style got mimicked into a LoRA is not defending a margin — they are defending a livelihood, and that's a different category of claim than any of the relicensing stories in this guide.

Look at what those companies had available. MongoDB, Elastic, HashiCorp, and Redis all said, in substance, we need to eat, and every one of them had instruments. They could dual-license. They could switch to BSL or SSPL. They could sell a commercial exception, which is precisely what made Artifex's damages calculable — the unpaid license fee was on a price list.

A freelance illustrator has none of that. No dual license, because there's no commercial tier to sell. No fork to lead. And no realistic path through the enforcement chain, because everything in it requires standing, a jurisdiction, and years of funded litigation. Jacobsen spent four years to win $100,000. That's a rounding error for Oracle and an impossibility for a person who draws for a living.

Glaze is not what you build when you have leverage. It's what you build when the courthouse is real, visible, and priced out of reach.

That's why "just use a license" is a glib answer here, and why I'm not going to give it.

What has actually worked is collective¶

Read this guide's wins in a row and one thing is true of all of them.

Valkey took the defaults away from Redis — with AWS, Google, Oracle, Ericsson, and Snap, and a foundation to hold it. OpenTofu took Terraform's ecosystem — with Gruntwork, Spacelift, env0, Scalr, and the Linux Foundation. Busybox enforcement happened because the Conservancy is an institution with a legal fund, and SFC could sue Vizio because a charity can afford to buy a television and spend five years on it. Even Jacobsen, the closest thing here to a lone individual, had the Federal Circuit reach a question it only reached because his case carried patent claims.

Not one of them was a person acting alone.

And the strongest recent result for individual creators followed the same rule. GEMA won against OpenAI in Munich — the ruling our AI licensing page treats as establishing that memorization is reproduction. GEMA is a collecting society. It exists for no reason other than that individual composers and lyricists pooled their standing into an institution that can litigate, license, and collect on their behalf. No individual songwriter could have brought that case. The institution could, and did, and won.

Artists using Glaze have no GEMA. That is the actual gap, and a perturbation is not a substitute for it — a perturbation is what the gap looks like from inside.

What To Do About It¶

If you make things:

Use the legal channel where one exists. Under the EU's Article 4(3) TDM opt-out, a machine-readable reservation via robots.txt or llms.txt is a legal act with a statutory hook. Glaze is not — it's a technical countermeasure with no standing behind it. Do both if you like, but know which one a court can see.
Treat perturbation tools as friction that buys time, not as protection. Time is worth something. It is not the same as a right.
Keep provenance: originals, timestamps, publication records. Every enforcement story in this guide runs on being able to prove what you made and when.

If you build tools:

Decide honestly whether your tool's power comes from secrecy or from proliferation, then license accordingly. SAND Lab did this explicitly and got both answers right for their own two tools.
If you close it, say why, in public, the way they did. A closed defensive tool with a stated threat model is a different thing from a closed tool with a business model.

If you're setting policy:

The individual-creator gap is a collective-licensing gap, not a technology gap. Collecting societies, statutory licenses, and pooled standing are the mechanisms with a track record.
And decide what §1201 is for, because right now it protects tractor firmware against farmers and might protect artists against scrapers, and it cannot honestly be read as a friend to both.

Brand had it right in 1984, including the half nobody quotes. Information wants to be expensive because it's valuable, and information wants to be free because distribution is nearly costless, and those two things are fighting each other. He just never said which side the person who made the information ends up standing on. Forty years later, that's still the open question — and the artists reaching for Glaze aren't picking a side of Brand's sentence. They're standing in the gap between its two halves, which is a bad place to be, and the reason they're standing there alone is that nobody has built them the institution that would let them stand together.