The economics of large models reward scale over consent. A crawler sweeps up billions of images and pages, and the resulting model treats all of it as raw material. Artists watched their styles get reproduced on demand. Photographers found their work in training sets they never agreed to. Writers saw their prose regurgitated. The conventional responses, a robots.txt directive or an opt-out form, are advisory at best and retroactive at worst. Data poisoning takes a different posture: make the data itself less useful to a scraper before it is ever taken.
Why opting out arrives too late
Opt-out mechanisms assume a cooperative collector and a moment where removal is still possible. Neither holds reliably. A robots.txt file is a request, not a fence, and nothing forces a crawler to honor it. Opt-out registries depend on a company choosing to consult them. And once a model has trained, the individual contribution of any single image or paragraph is diffused across billions of parameters. Unlearning a specific input after training is an open research problem, not a button. We covered the cooperative side of this in our piece on opting out of AI training data. Poisoning is the adversarial complement, for the common case where no one is asking permission.
Poisoning versus evasion
Two families of attack target machine-learning systems, and it helps to keep them straight. An evasion attack fools a model at inference time, crafting an input that a trained classifier misreads. A poisoning attack targets the training phase, corrupting the data a model learns from so the finished model is wrong or degraded. Poisoning itself comes in two flavors: availability poisoning aims to lower a model's overall quality, while targeted poisoning implants a specific wrong behavior tied to a particular concept.
These are usually studied as offensive threats to model integrity. The tools below flip the intent. The perturbation is added by the person whose data is being taken, as a defense against non-consensual training, rather than by an attacker trying to sabotage a system they have no stake in.
Glaze and Nightshade
The most visible work in this space comes from the SAND Lab at the University of Chicago, led by Ben Zhao and Heather Zheng. Two tools bracket the defensive and offensive ends.
Glaze is a protective cloak for visual artists. It computes small perturbations across an image so that, to a human eye, the piece looks unchanged, but to a model trying to learn the artist's style, the features point somewhere else. A model that trains on Glazed images of a painter's work learns a distorted version of that style, so prompts asking for art "in the style of" that painter produce something off the mark. Glaze is defensive by design: it protects the individual artist's own images.
Nightshade is the offensive counterpart. Instead of cloaking a style, it poisons the association between a concept and its images. A Nightshade-treated image that a human reads as, say, a dog is engineered so that a text-to-image model trains on it as something else entirely. Because concepts in these models are represented more sparsely than intuition suggests, far fewer poisoned samples are needed to bend a concept than you might expect. Enough poisoned examples of a concept and a model asked to draw that concept starts producing the wrong thing.
These tools raise the cost of training on scraped creative work and give individuals a lever they otherwise lacked. They do not encrypt anything, do not stop a determined operator with resources, and do not remove data already trained on. They are a friction and a deterrent applied at the point of publication, not a wall.
The arms race, and where it ends
Perturbation-based defenses live in an adversarial setting, which means they do not stay effective by default. A model trainer who anticipates poisoning has countermoves: adversarial training that hardens against perturbed inputs, image transformations and denoising that strip the perturbation before training, and re-captioning pipelines that reduce reliance on the labels a poison targets. Researchers have already demonstrated that some cloaking schemes can be weakened by later techniques. Each defense buys time and raises cost; none is permanent.
That framing matters because the alternative, treating a poisoning tool as a guarantee, sets people up to be surprised. The realistic value is deterrence and friction at scale. If enough published work carries perturbations, indiscriminate scraping becomes less reliable and more expensive, which shifts the incentives back toward licensing and consent. The durable fix is not technical at all. It is legal and normative: enforceable rules about what may be collected and trained on, and consequences when they are broken.
| Approach | Acts | Strength |
|---|---|---|
| robots.txt / opt-out | Before scraping | Depends entirely on the collector cooperating |
| Style cloaking (Glaze) | At publication | Protects your own work; degrades over time |
| Concept poisoning (Nightshade) | At publication | Deters scale scraping; countered by robust training |
| Not publishing / encryption | Always | Data never collected cannot be trained on |
The quieter lesson for privacy
Data poisoning is a workaround for a structural problem: once information is public and collectible, control over it is mostly gone, and you are left fighting a rearguard action to make it less useful. That is a hard position to win from. The stronger position is the one you never have to defend, where the data was never exposed to the collection pipeline in the first place.
This is the same logic behind end-to-end encryption and data minimization. Content that stays encrypted end to end is never sitting in a form a scraper or a model-training pipeline can ingest, because the service carrying it cannot read it either. Approaches like federated learning try to train models without centralizing the raw data at all. Different tools, one principle: the safest data is the data that was never handed over. Poisoning is a clever answer to the world we have. Minimization is how you avoid needing it.