An artist runs her illustration through Glaze, posts it, and a week later somebody drops it into a forensic scanner and gets back a reading that looks alarming. Nothing was faked. The picture was protected, and protection leaves marks. That gap, between what the protection does and what the scanner reports, is where almost all the confusion about anti-AI protection tools lives. So let's settle it: what do Nightshade and Glaze really do to an image file, and can any of it fool Error Level Analysis, a metadata check, or an AI-image detector?

The short version
Glaze and Nightshade do not fool forensic scanners, mostly because they were never aiming at them. Their perturbations are tuned to break the feature extractors inside image-generation models, not JPEG error levels or EXIF parsers. What they do change is real: they alter the large majority of pixels, destroy original camera metadata and any C2PA credentials during re-saving, and spread a broad noise signature that makes Error Level Analysis harder to read. A poisoned image looks heavily processed, not faked.

What Glaze and Nightshade Actually Change in Your Image

Both tools add a carefully optimized layer of noise to your picture, and both come from the same lab at the University of Chicago. Glaze, released in 2023, is defensive: it shifts how a model perceives your style, so a charcoal portrait might register internally as something closer to cubism. Nightshade, released in January 2024, is offensive: it corrupts the concept association itself, so a model trained on enough shaded images starts producing the wrong subject entirely for a given prompt.

Here is the part that matters for forensics, and it surprises people. The project's own FAQ states that Glaze and Nightshade do not just tweak a handful of pixels, they change more than 80 percent of all pixels in the image, and the visible artifacts you sometimes notice are only the tip of the iceberg. This is not a watermark tucked into a corner. It is a full-frame rewrite.

80%+
of an image's pixels are altered by Glaze or Nightshade, according to the Glaze Project's own FAQ

Adoption is not niche either. The Glaze Project reports that Glaze has been downloaded more than 8.5 million times since March 2023 and Nightshade more than 2.5 million times since January 2024. If you verify images for a living, you have already handled protected files without knowing it.

Poisoning Tools and Forensic Scanners Aim at Completely Different Targets

This is the whole answer in one idea, so it is worth slowing down for. An adversarial perturbation is optimized against a specific model. Glaze and Nightshade run their optimization against the feature extractors inside diffusion models: the encoders that turn an image into an internal representation. The goal is to move that representation somewhere misleading while keeping the visible picture close to the original.

A forensic scanner does none of that. Error Level Analysis re-encodes a JPEG at a known quality and measures which regions changed at different rates. Metadata analysis parses container headers, EXIF tags, and quantization tables. Neither one has a latent space to attack. Nothing in the perturbation math is aimed at a compression table or an EXIF parser, so there is no mechanism by which the poison could steer a forensic verdict in a chosen direction.

Glaze and Nightshade were built to lie to a training pipeline. A forensic scanner is a different audience with completely different eyes.

What Error Level Analysis Really Shows on a Glazed Image

ELA works on contrast between regions. A spliced-in face carries a different compression history than the background around it, so when you re-save the whole file at a fixed quality, the pasted area gives up a different amount of error than its surroundings. You are hunting for one part of the frame that behaves unlike the rest.

Now add a perturbation that touches four fifths of the pixels. Instead of one bright region against a calm background, you get elevation almost everywhere, weighted toward areas with texture and detail. The map runs hot from edge to edge. It looks busy, but the busyness is uniform, and uniform is not the pattern that indicates a splice.

So the practical effect is a false alarm risk, not a false clear. A protected illustration can look "worked on" to someone reading ELA casually, which is exactly the wrong conclusion. It also cuts the other way: if someone did splice something into a glazed image, the perturbation noise would help hide the seam. That is a real limitation, and it is worth being upfront about. ELA was never a reliable AI-detection method to begin with, and poisoning does not change that either way.

Read Also

Can ELA Detect AI Images? I Tested 10 on My Own Scanner, and Here's Where It Fails Error Level Analysis is great at catching edited photos, but can ELA detect AI images? I ran 10 AI-generated pictures through the scanner on this site and logged every verdict. Here's what it caught, what it missed, and the layer that actually did the work. 11 min read Jul 17, 2026

The Metadata Story: Almost Everything Original Gets Wiped

This is where protection tools have their biggest and least discussed forensic impact. Glaze and Nightshade are pipelines: decode the file, perturb the pixels, encode a new one. Original camera EXIF does not survive that trip. The Glaze documentation recommends feeding the tool PNG files for best results and converting or compressing afterwards, which means a typical protected image has passed through at least two encoders before anyone sees it online.

Run one through a metadata reader and you get a very particular result: no camera make or model, no lens data, no capture timestamp, usually just dimensions, colour profile, and maybe a software tag from an imaging library. That is the fingerprint of a processed file. It is also the exact fingerprint you get from a screenshot, a social media upload, or a routine export from any photo editor. Absent metadata is not evidence of anything.

Read Also

How to Read Image Metadata: EXIF, C2PA, and What They Actually Prove Every photo carries two hidden layers: the EXIF data your camera writes automatically, and the C2PA Content Credentials that can be cryptographically verified. This guide shows you how to read both in about ten minutes with free tools on any device, and what each layer really proves. It also covers the part most guides skip: what to do when the metadata is missing, faked, or quietly contradicting itself. 13 min read Jul 14, 2026

Content Credentials are a harder loss. A C2PA manifest is cryptographically bound to the pixels, so any pixel-level change invalidates the hash, and a tool that is not C2PA-aware simply drops the manifest when it re-saves the file. Poison your photo and the credentials are gone, with no way to reattach them honestly afterwards. For a photojournalist, that trade is usually not worth making. For an illustrator with no signed provenance to begin with, it costs nothing.

Before you protect a signed photo
If your camera or editing app writes Content Credentials, running that file through a protection tool destroys them permanently. Decide which matters more for that specific image: provenance you can prove, or resistance to training. You cannot keep both in the same file.

If you would rather see this than take my word for it, the fastest test is to run the original and a protected copy of the same picture through a scanner that does ELA and metadata in one pass, then put the two reports next to each other. The difference in the metadata panel is usually more dramatic than the difference in the ELA map.

Can Anti-AI Protection Tools Fool Forensic Scanners Into Clearing a Fake?

Short answer: not reliably, and not by design. The longer answer splits into two separate questions people tend to blur together.

First, could you glaze an AI-generated image to make a detector call it real? In principle, adversarial noise can push any classifier across a decision boundary, and there is a substantial body of research showing that AI-image detectors are vulnerable to exactly that kind of attack. But those attacks are built against a specific detector. Glaze and Nightshade are optimized against generative model encoders instead, so any effect on a detector's output is incidental and inconsistent. Somebody seriously trying to evade detection would build a targeted attack, not reach for an art-protection app.

Second, do these tools strip AI watermarks? Pixel-embedded watermarks are built to survive noise, compression, cropping, and filtering, which is the category of change a poisoning tool applies. Adding more noise is close to the thing the watermark was designed to shrug off. What does die is anything living in the metadata container, and that includes the AI-generation tags some tools write there.

Read Also

SynthID Image Watermarks Explained: What They Catch and What They Miss Google has hidden an invisible marker inside more than 100 billion AI-generated images and videos, and since May 2026 it rides inside pictures from ChatGPT as well. This guide explains how the SynthID image watermark works, how to check any picture for it in under a minute, and the one result almost everyone reads backwards. 11 min read Jul 15, 2026

The Poison Is Easier to Spot Than It Is to Hide

Here is the finding that reframes the whole question. A team from Cambridge, TU Darmstadt, and UT San Antonio presented LightShed at the 34th USENIX Security Symposium in 2025, reporting a 99.98% true-positive rate and a 100% true-negative rate for identifying Nightshade-protected images before removing the perturbation. The poison was not just removable. It was almost trivially recognisable.

99.98% true-positive rate for detecting Nightshade-protected images, reported by the LightShed authors at USENIX Security 2025

The pattern holds elsewhere. Researchers from ETH Zurich and Google DeepMind argued at ICLR 2025 that these protections offer a false sense of security, and that low-effort methods such as image upscaling are enough to degrade them significantly in user studies. Both papers point at the same property: the perturbation is a consistent, learnable statistical signature.

A perturbation that a scraper can learn to strip is a perturbation a verifier can learn to spot. Poisoning is a signature, not a disguise.

If You Verify Images for Work, Adjust How You Read the Report

A common mistake I notice is treating "this file has been heavily processed" as a synonym for "this file has been faked." Protected artwork sits squarely in the first category. Read a uniformly hot ELA map as reprocessing, not manipulation, and look for the localized anomaly you would expect from a splice before drawing any conclusion.

Missing EXIF on an illustration is normal, not suspicious. Illustrations rarely carry camera data anyway, and any protection step guarantees its absence. The combination worth noticing is different: faint artifacts in flat colour or negative space, plus wiped metadata, plus a PNG-then-JPEG encoding history. That combination points to protected artwork long before it points to a doctored photo.

Quick check on a suspicious image
Ask three questions in order. Is the ELA elevation global or localized? Does the metadata show a camera or only a processing chain? Do the visible artifacts cluster in smooth, flat areas rather than around a subject's edges? Global, processing-only, and flat-area artifacts together describe a protected image, not a manipulated one.

If You Protect Your Own Art, Here Is the Honest Trade-Off

Protection costs you something visible. Reviewers testing Glaze have reported artifacts they could still see at low intensity settings, particularly in negative space and smooth gradients, while busy detailed areas hid the changes well. Flat-colour vector work and minimalist compositions take the worst of it. Detailed painterly work takes the least.

It also costs you your metadata, which is quietly your authorship claim. If you rely on EXIF, IPTC, or Content Credentials for attribution or licensing, write that information back into the file after protecting it, never before. And go in with the right expectation: the published research says these protections are deterrents that raise the cost of scraping, not permanent guarantees.

I protected one of my own artworks as a before-and-after test. The original file was 12.8 MB, and the protected version was 13.6 MB (about a 6% increase). After comparing the files, I found that the original EXIF, IPTC, and Content Credentials metadata were no longer present. I re-added my copyright notice, creator details, and licensing information before publishing the protected version.

Test It Yourself in About Ten Minutes

Do not trust anyone's summary of this, including mine. The experiment is small and the results are unambiguous.

Keep one untouched master file. Export a JPEG copy at quality 90 and run both ELA and metadata analysis on it, then save those reports. Now run the master through your protection tool and export a second JPEG at the same quality 90 setting. Run the identical two analyses. Compare the pairs: you are looking for global elevation in the ELA map rather than a single hotspot, and for exactly which metadata fields disappeared. Then re-save both files at quality 60 and repeat, because a second compression generation shifts ELA more than the perturbation does. That last step is the one that teaches people the most.

Questions People Ask About Poisoned Images and Forensics

Does Glaze or Nightshade make an image look AI-generated to a detector?
No, and it does not reliably make an AI image look human-made either. These tools are optimized against generative model encoders, not against detection classifiers, so any effect on a detector's score is a side effect rather than a designed outcome. Detectors can be attacked adversarially, but that takes an attack built for the specific detector.
Will running Glaze remove an AI watermark like SynthID?
Almost certainly not. Pixel-embedded watermarks are designed to survive noise, compression, resizing, and filtering, and a poisoning perturbation falls inside that envelope. What does get destroyed is metadata-based AI labelling, including C2PA Content Credentials, because those are wiped when the file is re-encoded.
Is a glazed image with no EXIF data suspicious?
Not on its own. Any tool that decodes and re-encodes an image drops camera metadata, which is why screenshots, social uploads, and ordinary editor exports look the same way. Treat missing metadata as a gap in the evidence, never as evidence in itself.
Can a forensic scanner tell me whether an image was protected?
Not directly, but the combination of signals is fairly distinctive: uniformly elevated ELA, no camera metadata, and faint texture in flat regions. Research systems built specifically to spot these perturbations do far better, with the LightShed team reporting near-perfect detection of Nightshade-protected files.

Where This Leaves You

Anti-AI protection tools and image forensics occupy the same file but answer to different masters. Poisoning changes what a scanner sees, sometimes dramatically, without ever changing whether the scanner is right. The image is still what it was. It is just wearing a coat that shows up under the lamp.

The useful next step is small: take one image you care about, make a protected copy, and run both versions through an ELA and metadata scan so you know exactly what your own files look like from the other side. Ten minutes of that is worth more than any explanation, including this one, because after it you will never misread a hot ELA map on a piece of protected artwork again.