I Tried Poisoning an AI Model. Here’s What Actually Happened.
I like to watch The Infographics Show on YouTube. In one of their recent videos they brought up the idea of “poisoning” AI models, and they name-dropped two tools: Nightshade for images and SafeSpeech for voices. The claim was that you can treat your own image or voice so that an AI either can’t train on it, or if it does, the bad data messes up how the model learns — and if a model swallows enough of it, the whole thing can end up useless.
That sounded either very powerful or very oversold, and I couldn’t tell which. So I downloaded Nightshade and ran it myself to find out. But I did not do SafeSpeech for this article.
Why anyone would bother?
Before the how, the why. We all have heard of plenty of digital creators who watched an AI generator spit out work that looked an awful lot like theirs — close enough that it undercut their ability to sell the real thing. Their images got used as training data with no permission asked and no check written. And it’s not just pictures. Someone can clone your voice from a few seconds of audio and hand it to a scammer. So the motivation here isn’t abstract. People want some say over whether their work becomes free fuel for a model.
Actually running it
Fair warning: this is not a quick download-and-go. Nightshade is about 3GB to start, so give it a minute. Extract it with 7za or you’ll be staring at a progress bar all afternoon. Once it’s out, it pulls an update of roughly 9GB, and you’ll want to restart before you do anything else.
Bigger warning: if you don’t have a GPU, you may not want to attempt this at all. On CPU it takes a long, long time.
After sorting out the usual startup troubleshooting, I grabbed a couple of images and put them through. Each one took about 12 minutes on the highest setting. When the shaded image came out, I could see a difference — it looked like it had been saved with bad compression or a mild watermark. Still perfectly readable, just a little rough.
Then I did the obvious test. I handed the shaded image to an AI and asked what was in it. It answered correctly, instantly, no hesitation. My first reaction was: well, that didn’t work.
Here’s the funny part, though. The AI didn’t flag anything wrong with the image. It didn’t see the compression mess that I could see with my own eyes. At least not at first.
Why my “test” was testing the wrong thing
It turns out I was checking the wrong moment entirely, and this is the part most people get backwards.
Nightshade doesn’t try to fool a model that’s looking at a finished image. It sabotages a model that’s training on one. Those are two different events. When I asked an AI to describe my picture, that’s inference — the model already learned what a cat looks like ages ago from clean data, so of course it recognized mine. Nightshade only does its job later, if a company scrapes a big batch of shaded images and feeds them into training a new image generator. Chicago’s own FAQ says as much: the effect only shows up when a lot of shaded images get trained on.
So the AI correctly describing my image wasn’t a failure. It was exactly what should happen. I’d aimed my test at the wrong end of the process.
So what’s the noise actually doing?
Both Nightshade (for images) and the voice version of this idea work by laying subtle noise over a clean file. To a person it reads as mild distortion. To a training model it reads as a different thing altogether.
If you stare at a noisy image long enough you’ll start seeing shapes in it — faces, animals, whatever. None of them are really there. That’s pareidolia (yes, I had to look up the word — I’m not claiming to be that smart). It’s your brain’s pattern-matching firing on random input. AI models do the same kind of pattern-matching, and that’s the opening Nightshade uses. The added noise nudges the image’s machine-readable features toward some other concept, so when a model trains on it, it quietly files your picture of a cat under something that isn’t a cat. Train on enough of those and the model’s idea of “cat” starts to rot.
Does it actually work?
Yes — but it is not the silver bullet you’re hoping for.
The research behind it is more convincing than I expected. Nightshade can corrupt a single concept in a Stable Diffusion model with fewer than 100 poisoned images, not the millions people used to assume you’d need. The damage also bleeds into related concepts, and a moderate pile of corrupted concepts can knock a model off balance enough that it struggles to generate coherent images at all.
It reminds me of a GI Joe episode where the only way to stop the giant blob was to get it to eat apples, of all things — because apple seeds carry a trace of poison (amygdalin, which your body breaks down into hydrogen cyanide). Enough small doses and the thing chokes.
The catch is that it’s a group effort. Your ten shaded pictures won’t take down anything. It works when a lot of creators shade a lot of work and that work actually ends up in someone’s training run.
Two things worth knowing so you don’t over-read the hype. First, Nightshade is aimed at diffusion image models specifically — it does nothing to a chatbot or a text model. Second, it has a sibling called Glaze from the same University of Chicago lab (the SAND Lab). Glaze is the defensive one: it cloaks your personal style so a model has a hard time mimicking “make it look like your work.” Nightshade is the offensive one that poisons the concept. Most creators run both. SafeSpeech, the voice tool The Infographics Show mentioned, is a separate project from different researchers — same basic idea pointed at audio, not a matching piece of the Nightshade set.
It’s an arms race
This reminds me a lot of passwords and encryption. We keep pushing for longer keys and stronger requirements because computing power keeps climbing, and yesterday’s “uncrackable” ends up in the easy pile. Same story here. Models will get better at shrugging off poisoned data, and the people building these tools will push out updates to stay ahead. Neither side gets to declare victory and go home.
One correction to how this usually gets described, including how I first thought about it: these tools don’t prevent AI from using your image. They can’t stop the scraping. What they do is wreck the value of the image if it gets used. That’s a different promise, and an honest one.
Should you go protect your work?
You should always protect yourself, so the short answer is yes — with some aim.
If you’re putting samples on the web, absolutely shade the new stuff before it goes up. Don’t waste your time re-treating things that have been public for a while; that data was almost certainly scraped already and there’s no pulling it back. Focus on what hasn’t been posted yet. If you want to circle back and update older samples too you can, but do the new ones first. And remember it’s a numbers game: the more treated work that’s out there, the better the odds it actually bites.
The real issue underneath
Here’s what bugs me most. Nobody’s offering you a checkbox to opt out of having your images or your voice used as training data. It just happens.
I believe every person should get to name their price for their own data. Maybe you give it away for free. Maybe it’s a few cents. Maybe it’s hundreds of dollars. The number matters less than the fact that it’s yours to set. These companies clearly want the data — that’s the whole reason we’re here — which means it has value. And when something you made has value, you should be the one deciding what happens to it.
Nightshade doesn’t fix that. But until someone builds the opt-out and the pay button, it’s one of the few ways to push back on your own terms.
Sources;
The AI Economy Is DEAD. 6 Billion Images Now POISONED.
Shawn-Shan/nightshade-release: Research code release for the Nightshade project from University of Chicago
wxzyd123/SafeSpeech: [USENIX Security 2025] SafeSpeech: Robust and Universal Voice Protection Against Malicious Speech Synthesis
Leave a Reply