Image Cloaking and Immunization: How Photo Protection Against AI Works

Once a photo is public, it can be copied, used to train models, edited with generative tools or used as a source for someone's likeness. Image cloaking and image immunization are the names given to a family of techniques that try to change a photo before it is shared so that it is less useful to those systems, while still looking normal to people.

This guide explains in general terms how photo protection against AI works, describes four well-known research tools, sets out their limitations and explains how Eterna Image Immunization fits in.

How image cloaking works in general

Most of these approaches add carefully calculated changes to an image's pixels, sometimes called perturbations. The changes are designed to be hard for people to notice but to affect how a particular kind of AI system processes the image. Depending on the goal, the aim may be to confuse a facial recognition model, mislead a model that learns an artist's style, disrupt model training, or make an image harder to edit convincingly.

The important detail is that each technique is designed against particular kinds of systems. A protection that works against one model may not work against another, and systems change over time.

Four research tools, in brief

• Fawkes, from researchers at the University of Chicago, is aimed at facial recognition models. It alters personal photos so that models trained on them learn a distorted version of the person's facial features.
• Glaze, also from the University of Chicago, is designed to protect artists' style from mimicry, by changing artwork so that models learning from it pick up a different style than the one people see.
• Nightshade, also from the University of Chicago, takes a data-poisoning approach. Images treated with it are intended to mislead models that are trained on them without permission.
• PhotoGuard, from MIT research published in 2023, is aimed at resisting edits by diffusion models, making it harder to manipulate a protected image convincingly with those tools.

These are research tools. They have been published and discussed openly, and their creators are generally clear that they address specific threats rather than all forms of misuse.

Limitations to keep in mind

1. Protection is model-specific. A technique designed for one type of system may have little effect on another.
2. Systems evolve. New models and countermeasures can reduce the effect of an existing protection over time.
3. Transformations matter. Compression, resizing, cropping, screenshots and filters can weaken some perturbations.
4. Already-public images aren't covered. Cloaking only applies to images treated before they are shared; copies already online stay as they were.
5. It is not a guarantee. None of these tools claims to stop every form of misuse.

How Eterna Image Immunization differs

Eterna Image Immunization (EIP) is Eterna's proprietary pre-publication image protection technology, developed through Eterna's internal research and development and currently under validation.

• It is designed to help reduce the risk of deepfake creation, AI identity replication and unauthorized likeness reuse from an authorized image.
• It is applied at the source, before an image is published or distributed.
• It is designed to preserve the image's natural, human-visible appearance while reducing its usefulness as a reusable machine identity source.
• It is an additional layer of protection that works alongside Eterna's detection, monitoring and response services, rather than replacing them.
• It is undergoing continued validation, and protection effectiveness may vary across systems, transformations and use cases.

Learn more on the Image Immunization page or in What Is Image Immunization?.

Choosing an approach

If you are an artist concerned about style mimicry, a research tool designed for that purpose may be relevant. If you are concerned about your likeness being misused, consider protection before publication alongside monitoring and response for content that is already public. In every case, treat any single tool as one layer, not a complete solution.