PaperlayerView exact revision on arXiv

Source-linked AI summary

Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models

Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, Ben Y. Zhao

arXiv:2302.04222v6cs.CR

TL;DR

Professional artists face unauthorized style mimicry because text-to-image models can be fine-tuned on their online artwork, threatening livelihoods and forcing difficult choices about sharing. Glaze applies minimally perceptible style cloaks that alter what models learn, and studies with 1,156 artists found high protection success across ordinary, partial-cloak, and adaptive-countermeasure settings. The system remains bounded by reliance on cloaking training data and the possibility that future countermeasures will defeat existing protections.

  • Problem

    Fine-tuned text-to-image models can mimic specific artists’ styles from their artwork, threatening artists’ livelihoods and forcing them to choose between exposure and reduced online promotion.

  • Method

    Glaze adds minimal perturbations to artwork so models trained on cloaked images learn an incorrect style representation and generate recognizably different outputs.

  • Results

    93% of surveyed artists rated protection successful across varied settings, including real-world mimicry platforms, while adaptive-countermeasure protection exceeded 85%.

  • Takeaways & Limitations

    Glaze provides an artist-oriented technical alternative for disrupting style mimicry while preserving artwork sufficiently for most surveyed artists.

  • Takeaways & Limitations

    Protection depends on cloaking artwork present in the mimic model’s training data, leaving established artists exposed through older works already collected online.

Abstract

from arXiv · show

Recent text-to-image diffusion models such as MidJourney and Stable Diffusion threaten to displace many in the professional artist community. In particular, models can learn to mimic the artistic style of specific artists after "fine-tuning" on samples of their art. In this paper, we describe the design, implementation and evaluation of Glaze, a tool that enables artists to apply "style cloaks" to their art before sharing online. These cloaks apply barely perceptible perturbations to images, and when used as training data, mislead generative models that try to mimic a specific artist. In coordination with the professional artist community, we deploy user studies to more than 1000 artists, assessing their views of AI art, as well as the efficacy of our tool, its usability and tolerability of perturbations, and robustness across different scenarios and against adaptive countermeasures. Both surveyed artists and empirical CLIP-based scores show that even at low perturbation levels (p=0.05), Glaze is highly successful at disrupting mimicry under normal conditions (>92%) and against adaptive countermeasures (>85%).

1 Introduction

Text-to-image models have intensified threats to artists by enabling style mimicry from online artwork, while legal remedies remain slow and difficult to enforce. Glaze offers a technical alternative: minimally perturbing shared artwork so models learn an altered style representation.

  • AI-generated art already competes with professional artwork across awards, magazines, children’s books, and video games.
  • Fine-tuning text-to-image models on as few as 20 artist-specific works can enable style mimicry.
  • Artists face livelihood and visibility harms when models exploit their trained styles and synthetic imitations displace original work in search results.
  • Artists are pushed to choose between leaving artwork exposed to training or removing it online and undermining their main promotional channel.
  • Glaze applies carefully computed style cloaks that shift artwork representations toward a target style, causing subsequent mimicry to miss the artist’s true style.
  • 93% of surveyed artists rated Glaze’s protection successful across varied settings, while 92% found its perturbations small enough not to disrupt artistic value.

2 Background: AI Art and Style Mimicry

Modern diffusion models generate higher-quality images by mapping text and image information through learned feature representations. Style mimicry exploits these models through prompts or fine-tuning, producing unauthorized art in a target artist’s style.

  • During training, a feature extractor maps an image to features while a conditional generator predicts a corresponding feature vector from its caption.
  • Diffusion-based text-to-image models generally produce significantly higher-quality images than earlier GAN- or VAE-based systems.
  • Style mimicry uses AI art models to generate artwork in a particular artist’s style without consent.
  • Naive mimicry can use an artist’s name in a generic model, whereas fine-tuning adapts a model to a target style using as few as 20 downloaded artworks.
  • Real-world incidents include a style-specific model trained on Hollie Mengert’s artwork and later reports of mimicry involving Sarah Andersen and others.
  • Companies and online marketplaces have hosted services or customized models that let users share or generate art in victim artists’ styles.

3 Collaborating with Artists

The project was developed collaboratively with professional artists and evaluated through artist-centered studies alongside a CLIP-based metric. Participants viewed AI mimicry as highly effective and as a threat to careers, online sharing, and consent.

  • The researchers collaborated with professional artists through town halls, meetings, and ongoing project input from artists including Karla Ortiz.
  • Because mimicry success is subjective, Glaze was evaluated primarily through professional artists’ feedback, supplemented by a CLIP-based genre-prediction score.
  • The two IRB-approved surveys examined artists’ views of AI mimicry and their ratings of Glaze’s outputs and protection metrics.
  • 97% of artists expected AI mimicry to decrease some artists’ job security, 88% expected it to discourage new art students, and 70% expected diminished creativity.
  • 53% of artists who post online anticipated reducing or removing their artwork, and 55% believed reduced online presence would significantly affect their careers.
  • 77% of artists rated AI mimicry of specific artists’ styles successful or very successful, with fewer than 5% rating it unsuccessful.
  • Artists identified unauthorized scraping without permission or compensation as a major concern, distinct from AI art’s mere existence.

4 Preliminaries

Glaze addresses style mimicry attacks in which scraped artwork is used to fine-tune text-to-image models, while existing cloaking methods struggle to shift generative-model features selectively. Its threat model assumes artists cloak work before online sharing and mimics may use adaptive countermeasures.

  • Threat model: Glaze adds small perturbations that cause models trained on cloaked artwork to learn an incorrect representation of the victim’s style.The resulting model generates recognizably different artwork when prompted to mimic the victim.
  • Threat model: Artists share artwork online to attract customers, creating a conflict between promoting their work and avoiding model training.Legal and regulatory responses may take years and can be difficult to enforce internationally.
  • Existing alternatives: Existing cloaking methods perform poorly because text-to-image feature spaces retain more image information than classifier feature spaces.These methods cannot introduce sufficiently large feature shifts without using highly visible cloaks.
  • Design challenge: Glaze concentrates its perturbation budget on style-specific features rather than shifting all image features indiscriminately.This design targets artistic style while avoiding unnecessary changes to object shape or location.
  • Design challenge: Identifying style-specific features is difficult because artistic style can correlate with different visual properties and vary across artworks.For example, impressionism may correlate more with color, whereas cubism may correlate more with shape.

5 Disrupting Style Mimicry with Glaze

Glaze uses style transfer to identify an artwork-dependent target representation, then optimizes a minimally visible cloak that shifts style-specific features toward that target. The method selects sufficiently dissimilar target styles and is intended to remain effective under challenging scenarios and adaptive countermeasures.

  • Design intuition: Glaze isolates style-specific features by comparing an artwork with a style-transferred version that preserves other aspects.Style transfer changes the artwork’s style while keeping content such as subject matter and location similar.
  • Cloak optimization: Glaze computes a minimal cloak that moves an artwork’s style representation toward a chosen target style while minimizing visual impact.The optimization uses a feature extractor, feature-space distance, perceptual perturbation, and budget p.
  • Target-style selection: The target style should be sufficiently dissimilar from the artist’s original style in feature space to maximize disruption.Styles that look similar to an untrained eye may still be distinct in model feature space, and vice versa.
  • Target-style selection: Artists can improve protection by consistently cloaking their artwork toward the same target style.Glaze selects a target from candidate styles using feature-space centroids derived from a public artist dataset.
  • Deployment: Glaze can remain effective when artists cannot replace every previously shared image with a cloaked version.The paper specifically notes effectiveness even when the mimic’s model contains a significant amount of uncloaked art.
  • Why small cloaks matter: Small feature shifts can affect generated styles because text-to-image models have continuous output spaces and must produce useful, stylistically similar artwork.These properties support Glaze’s effectiveness in challenging scenarios and against adaptive countermeasures.

6 Evaluation

Glaze is evaluated through artist judgments and CLIP-based genre shifts across controlled, mismatched-model, partially uncloaked, and real-world mimicry settings. It remains highly protective while artists generally tolerate the perturbations.

  • Evaluation overview: Over 93% of surveyed artists believed Glaze effectively protected artistic styles, while over 92% found its perturbations small enough not to disrupt art value.Over 88% also wanted to use Glaze for their own artwork.
  • Evaluation methodology: The evaluation combines artist-rated protection success with CLIP-based genre shift across 13 victim artists and 23 protection scenarios.Each mimicry attempt was rated by at least 10 participants; genre shift counts outputs whose top three predicted genres exclude the victim’s original genre.
  • Baseline and protection: With uncloaked training data, over 95% of respondents rated style mimicry attacks successful; with Glaze, protection exceeded 93.3% by artist ratings and 96.0% by CLIP-based genre shift.The protected models were trained on cloaked artwork, while unprotected models were trained on the victim’s original artwork.
  • Protection robustness: Protection remained above 90.2% artist-rated PSR and 94.0% CLIP-based genre shift when cloak optimization and mimic training used different feature extractors.Performance was slightly higher when the extractors differed only in architecture than when they differed in architecture and training data.
  • Protection robustness: When mimics accessed uncloaked artwork, protection declined but remained 87.2% artist-rated PSR even when only 25% of the artist’s artwork was cloaked.The authors note that newly shared cloaked artwork and changing artistic styles can help offset larger amounts of previously uncloaked work.
  • Real-world performance: Against the real-world scenario.gg service, Glaze achieved over 92.1% artist-rated PSR and over 93.9% CLIP-based genre shift, whereas unprotected protection success was below 7.2%.The service’s model and mimicry method were unknown.

7 Countermeasures

Glaze remains effective against countermeasures that transform cloaked images, robustly retrain models, or detect cloaked artwork, although some defenses reduce protection or image quality.

  • Image transformations: Noise and JPEG compression reduce mimicked-image quality as quickly as or faster than they reduce cloak effectiveness.Models trained on transformed images learn to generate the corresponding degradation.
  • Image transformations: >85.3% artist-rated protection success remains after denoising or upscaling improves the quality of degraded mimicked images.These countermeasures improve image quality but leave artifacts and do not enable successful style mimicry.
  • Robust training: >88.7% artist-rated protection success remains after robust training over many iterations.Robust training reduces cloaking’s influence, but substantially degrades mimicked-image quality and prevents successful mimicry.
  • Robust training: Robust training cannot fully remove Glaze’s impact because art generation combines a continuous output space with high image-quality requirements.This differs from classification settings, where reduced protection may only alter confidence without changing the discrete label.
  • Cloak detection: Outlier detection has limited effectiveness against Glaze, achieving below 65% precision and below 53% recall on four current artists.The detector is trained from 20 original artworks per artist using contrastive features and a one-class SVM.

8 Limitations and Releasing Glaze

Glaze’s deployment showed strong resistance to several attacks and rapid community adoption, while the authors identify important limits for established artists and long-term robustness.

  • Limitations: Established artists may remain vulnerable because older unprotected artworks can already be available for training before Glaze’s release.Preventing mimicry from newer artwork may require repository opt-out and removal mechanisms.
  • Limitations: Glaze is not future-proof: future countermeasures may defeat cloaks that protect artwork today.The authors frame Glaze as an initial protection step while longer-term legal and regulatory efforts develop.
  • Release: >740K artists downloaded Glaze worldwide by June 2023.The release received enthusiastic community support, including artist-created tutorials and promotion.
  • Real-world countermeasures: Within three months of release, multiple groups attempted to attack or bypass Glaze, although several attempts had minimal impact.The paper evaluates the two most serious reported attack categories in detail.
  • Real-world countermeasures: PEZ-based single-image style mimicry did not defeat Glaze in initial tests.The authors attribute this robustness to Glaze modifying the artwork’s feature representation directly.
  • Real-world countermeasures: Repeated bilateral pixel smoothing also failed to remove Glaze’s protection.The result aligns with prior work showing that image smoothing cannot prevent adversarial perturbations.

A.1 Adapting Existing Cloaking Systems

Adapting existing facial-image cloaking systems to protect artistic style provides limited protection, whereas Glaze is substantially more effective under matched perturbation settings.

  • Existing systems: Fawkes adapts face-image cloaking by optimizing feature-space distance from a target image, while LowKey maximizes difference from the original artwork.These objectives differ from Glaze’s style-targeting approach.
  • Existing systems: Photoguard minimizes the norm of the cloaked artwork’s feature representation, equivalent to Fawkes with a zero feature-vector target.The paper adapts this objective directly for anti-mimicry protection.
  • Performance comparison: 41.0% artist-rated protection success is the best result among Fawkes, LowKey, and Photoguard.Small artifacts from Fawkes and LowKey were insufficient to prevent mimicry; comparisons used the same LPIPS perturbation level and feature extractor.

A.2 Additional Information on Style Mimicry

Additional experiments examine how fine-tuning, random seeds, perturbation budgets, iteration counts, and model choice affect style mimicry outcomes.

  • Fine-tuning: Fine-tuning significantly improves mimicry for artists who are not household names compared with prompting a generic model.The comparison uses prompts containing the artist’s name and contrasts generic versus victim-art-fine-tuned models.
  • Random seed selection: 4.3% of 100 random seeds produced at least one artwork identified as belonging to the target artist’s genre when Glaze was used.The experiment samples 100 generations from a style-specific model for a fixed prompt.
  • Experimental data: The fine-tuning dataset includes artwork from different artists together with their text captions.
  • Perturbation budget: Increasing the perturbation budget changes the mimicked artwork produced under Glaze protection.Figure 20 examines mimicry as artists use increasingly high perturbation budgets.
  • Fine-tuning iterations: Mimicry success is evaluated as the number of fine-tuning iterations increases.Figure 19 varies the number of training iterations used by the mimic.
  • Model comparison: Figure 21 contrasts style-specific models fine-tuned on an artist’s work with generic Stable Diffusion prompted using the artist’s name.Columns show original artwork, fine-tuned-model outputs, and generic-model outputs.

A.3 CLIP-based metric

The paper evaluates CLIP’s ability to classify artwork across historical and digital art genres using labeled WikiArt and ArtStation test datasets.

  • CLIP is evaluated on 27 historical WikiArt genres and 13 digital art genres as candidate classification labels.The evaluation uses artwork from WikiArt and ArtStation.
  • The test dataset contains 1,000 WikiArt artworks with ground-truth labels.
  • The evaluation adds 100 artworks for each digital art genre collected from ArtStation.

A.4 Additional Countermeasures

The paper examines adaptive and alternative defenses against Glaze, including robust training and comparisons with adapted cloaking systems, while illustrating protection across multiple artists.

  • Alternative cloaking systems: Glaze significantly outperforms adapted versions of Fawkes, Lowkey, and Photoguard for style protection.
  • Robust training: Robust training forces the feature extractor to produce similar representations for cloaked and original artworks.The mimic trains on cloaked/original pairs and regularizes with VAE reconstruction loss to prevent feature collapse.
  • Robust training: Robust training significantly modifies the feature extractor and feature space, requiring the mimic to fine-tune its decoder and generator.The assumed procedure trains the extractor for K steps on K cloaked/original pairs before fine-tuning the decoder and generator to convergence.
  • Protection examples: The examples compare original artwork with unprotected and p = 0.05 cloaked mimicry produced by Stable Diffusion-based models.The comparison covers four artists.
Loading 2302.04222v6…