Can Glaze and Nightshade be bypassed?

Yes, first-generation art protections can be bypassed, and the bypasses are no longer exotic. A JPEG re-encode strips PhotoGuard’s editing protection, noisy upscaling defeats Glaze and Mist, general-purpose purification restores protected images, and a peer-reviewed attack called LightShed identifies and removes Nightshade. A second generation is built to resist these steps, but as of this writing none has been independently confirmed. The useful question is not whether bypasses exist; it is which tool fails against which attack.

Is JPEG a Glaze bypass? No, a PhotoGuard one

The JPEG result is often misquoted. Sandoval-Segura, Geiping and Goldstein (2023) test PhotoGuard, not Glaze: “All experiments are conducted using the open-source notebooks from the photoguard repository,” and Glaze appears only in their references. What they show is that PhotoGuard’s edit-blocking “perturbations are not robust to JPEG compression, which poses a major weakness because of the common usage and availability of JPEG.” The effect is graded by quality: for the encoder attack, enough protective noise is diminished between JPEG quality 95 and 85; for the diffusion attack, between 85 and 75; by quality 65 the protection is strongly stripped. Gaussian blur, median blur, rotation and flip were “ineffective.” So JPEG is a real bypass, but of PhotoGuard’s editing protection, not of Glaze’s style cloak.

What actually breaks Glaze?

Robust mimicry and purification. Hönig, Rando, Carlini and Tramèr (ICLR 2025) tested Glaze, Mist and Anti-DreamBooth against cheap removal steps and concluded that “all existing protective tools create a false sense of security and leave artists vulnerable to style mimicry.” Their best-of-four attack pushed copies to a 56.6% quality preference for Glaze and 62.0% for Mist, where 50% marks a copy indistinguishable from one trained on unprotected art, using only black-box access to a fine-tuning API. IMPRESS (Cao, Li, Wang, Jia, Li, Chen, NeurIPS 2023) restored a style classifier on Glaze-protected art from 42.5% to 87.0% accuracy. And purification generalises: the Purify Once, Edit Freely study (Zhao, Zhai, Bai, Shen, Lin, Gao, Wu, 2026) breaks six protection methods under “model mismatch,” improving image quality by 3 to 6 dB PSNR and cutting FID by 50 to 70%.

What is LightShed, and does it remove Nightshade?

Nightshade (Shan, Ding, Passananti, Wu, Zheng, Zhao, IEEE S&P 2024) poisons concept associations rather than cloaking a style, so for a while it looked less tested than Glaze. That has changed. Foerster, Behrouzi, Rieger, Jadliwala and Sadeghi (USENIX Security 2025) present LightShed as “a generalizable depoisoning attack that effectively identifies poisoned images and removes adversarial perturbations.” Against Nightshade it reports a 99.98% detection true-positive rate and a 100% true-negative rate, then depoisons the images, and the same model is demonstrated against Glaze. Be precise: the 99.98% is the detection rate for Nightshade, not a universal removal figure. But this is a peer-reviewed removal attack, not a detection demo, and it “generalizes across perturbation techniques.”

What resists removal?

Here is where the main bypasses stand, and what the defenders offer against them:

Attack	Target	Result
JPEG re-encode	PhotoGuard	edits pass at quality 95 to 75
Noisy upscaling	Glaze, Mist, Anti-DreamBooth	copy preferred up to 62%
Purification	six protection methods	3 to 6 dB PSNR gain
LightShed	Nightshade, Glaze	99.98% detection, then removal

A second generation is built to survive purification. BlurGuard (Kim, Nam, Kim, Kim, Jeong, NeurIPS 2025) reports retaining 92.9% of its protective efficacy after a worst-case purification stack, versus 38.5% to 48.4% for earlier methods; StyleGuard (Li, Zhang, Lyu, Liu, Xiao, NeurIPS 2025) claims to resist both diffusion purification and noisy upscaling; and AntiPure (Yang, Cao, Duan, He, 2025) embeds perturbations meant to “persist under representative purification settings.” The caveat: all three postdate the strongest bypass papers, none has been independently bypassed or confirmed, and their survival numbers are self-reported.

So can these tools be bypassed? Glaze, yes, through robust mimicry and purification, not through the JPEG paper. PhotoGuard, yes, through JPEG. Nightshade, yes, through LightShed’s detection and depoisoning. There is no single trick that removes all of them, and the bypass depends on the target. For an artist, that makes protection worth using but not worth trusting as final: run the tools, keep clean originals private, avoid posting your only high-resolution copy, and assume anything uploaded can be transformed before it is ever used for training. See does Glaze actually work? and the tools scorecard.

Sources

• Sandoval-Segura, Geiping, Goldstein (2023). JPEG Compressed Images Can Bypass Protections Against AI Editing.
• Hönig, Rando, Carlini, Tramèr (2025). Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. ICLR 2025.
• Cao, Li, Wang, Jia, Li, Chen (2023). IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI. NeurIPS 2023.
• Zhao, Zhai, Bai, Shen, Lin, Gao, Wu (2026). Purify Once, Edit Freely: Breaking Image Protections under Model Mismatch.
• Shan, Ding, Passananti, Wu, Zheng, Zhao (2024). Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models. IEEE S&P 2024.
• Foerster, Behrouzi, Rieger, Jadliwala, Sadeghi (2025). LightShed: Defeating Perturbation-based Image Copyright Protections. USENIX Security 2025.
• Kim, Nam, Kim, Kim, Jeong (2025). BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing. NeurIPS 2025.
• Li, Zhang, Lyu, Liu, Xiao (2025). StyleGuard: Preventing Text-to-Image-Model-based Style Mimicry Attacks by Style Perturbations. NeurIPS 2025.
• Yang, Cao, Duan, He (2025). Towards Robust Defense against Customization via Protective Perturbation Resistant to Diffusion-based Purification (AntiPure).