Let us be direct about something: Glaze mattered. What the team at the University of Chicago built changed the conversation about AI art protection permanently. Before Glaze, the idea that artists could fight back against AI scraping was largely theoretical. After Glaze, it was proven technology with nine million downloads.
That contribution deserves respect. This article is not an attack on Glaze. It is an honest assessment of what happened next — and what the creative community needs to learn from it.
What Glaze got right
Glaze demonstrated that adversarial perturbation works. The core idea — modifying an image in ways invisible to human eyes but catastrophic to AI feature extraction — was sound. It proved that artists did not have to accept scraping as inevitable. There was a technical countermeasure, and it could be deployed at the individual level.
For millions of artists, Glaze was the first tangible tool in the fight. It gave people agency at a moment when the conversation around AI art felt overwhelmingly hopeless. It normalised the idea that protection was possible. That matters enormously, regardless of what came after.
Nightshade, Glaze's companion tool, went further — attempting to poison the training data itself, corrupting the AI model's understanding of specific concepts. Together, they represented the most visible consumer-level defense the art community had ever seen.
What happened next
In late 2024, a research team published a paper demonstrating that both Glaze and Nightshade could be bypassed at 99.98% accuracy using relatively straightforward diffusion-based purification techniques. The method was not a brute-force attack. It was a clean, reproducible bypass that any reasonably skilled machine learning practitioner could implement.
Nine million downloads. Both tools bypassed by a single paper.
This was not a failure of ambition or effort. It was a structural problem. Glaze and Nightshade were designed as static defenses against a dynamic threat. They applied a fixed perturbation pattern, and once that pattern was characterised, it could be removed.
The consumer model — free download, single technique, no update cycle — was inherently vulnerable to this kind of research. Not because the team was negligent, but because the economics of a free tool do not support the rapid iteration cycle needed to stay ahead of adversarial bypass research.
The update problem
Cybersecurity learned this lesson decades ago. No single defense survives first contact with a motivated attacker. What survives is an update cycle — the ability to patch, adapt, and deploy countermeasures faster than the offensive side can develop new attacks.
Glaze had no update cycle. When the bypass was published, there was no mechanism to push a new perturbation technique to nine million users within days. The defense was static. The offense was iterative. The outcome was predictable.
This is not a criticism of the Glaze team. Building a sustainable update infrastructure requires funding, engineering resources, and an operational model that a free academic tool was never designed to support. The problem was structural, not personal.
What Art Vault does differently
We built Art Vault with the bypass problem as the central design constraint. Every architectural decision flows from a single question: what happens when someone publishes a paper that defeats this technique?
The answer is three-fold.
First, Art Vault applies multi-layered adversarial perturbation. Rather than relying on a single technique, we combine edge targeting, texture-level defense, and spectral camouflage in a way that requires an attacker to defeat all three simultaneously. Removing one layer does not expose the image.
Second, we operate on a quarterly update cycle. When new bypass research is published — and it will be — we deploy updated perturbation techniques to all protected images going forward. This is the same model that antivirus software has used for decades: the defense evolves with the threat.
Third, Art Vault is a professional service, not a free download. This is not about extracting money from artists who are already under financial pressure. It is about building a sustainable operational model that can fund the engineering resources needed to stay ahead of the bypass cycle. A free tool cannot fund a security research team. A professional service can.
The honest comparison
| Glaze | Art Vault | |
|---|---|---|
| Cost | Free | From £12/month |
| Technique | Single-layer perturbation | Three-layer adversarial defense |
| Update cycle | None (static) | Quarterly |
| Bypass resilience | Defeated at 99.98% by purification | Multi-layer; defeating one layer does not expose image |
| Processing | Local (your hardware) | Cloud-based (consistent quality) |
| Batch support | Limited | Up to 500 images/month (Studio) |
| Output quality | Good (some visible artifacts at high settings) | Visually identical to original |
We are not claiming Art Vault is undefeatable. No honest security professional would make that claim about any defense. What we are claiming is that our architecture is designed to survive the bypass cycle — and that the operational model behind it can sustain the continuous investment required to keep it effective.
What this means for artists
If you are currently using Glaze, you are better protected than artists using nothing. That remains true. But you should understand the limitations: the perturbation pattern Glaze applies has been publicly characterised, and any scraper using the published bypass technique can remove it.
If you are a working professional whose livelihood depends on the integrity of your creative work, you need protection that can evolve. You need a service with an economic model that supports ongoing research and rapid deployment of countermeasures.
That is what Art Vault was built to provide. Not a replacement for Glaze's contribution to the conversation — but the next step in a fight that requires professional-grade infrastructure to win.
The consumer defense era lasted less than two years. What comes next needs to be built differently.
We think we have built it.