Comments
By cadamsdotcom 2026-01-0413:35 Seems the same as these submissions from 2 years ago:
This similar thing was posted a few weeks ago, and also apparently two years ago, glaze also from uchicago
https://news.ycombinator.com/item?id=46364338
https://news.ycombinator.com/item?id=35224219
We’ve seen this arms race before and know who wins. It’s all snake oil imo
By YeGoblynQueenne 2026-01-0414:083 reply >> We’ve seen this arms race before and know who wins. It’s all snake oil imo
I haven't and I don't know who wins. Who wins?
Adversarial examples aren't snake oil, if that's what you meant. There's a rich literature on both producing and bypassing them that has accumulated over the years, but while I haven't kept abreast with it, my recollection is that the bottom line is like that for online security: there's never a good reason not to make sure your system is up to date and protected from attacks, even if there exist attacks that can bypass any defense.
Where in this case attack and defense can both describe what artists want to do with their work.
By torginus 2026-01-0415:05 Aren't adversarial examples have to be trained to be effective against a specific recognizer?
I could imagine you could make one that was effective against multiple recognizers, but not in general.
I'd also guess it'd be easy to get rid of this vulnerability on the model side.
By pixl97 2026-01-0415:47 This isn’t security...
Don't confuse attempting to make AI misclassify an image as a security measure.
And yes, this is snake oil and the AI wins every time.
At the end of the day a human has to be able to interpret the image, and I'd add another constraint of not thinking it looks ugly. This puts a very hard floor on what a poisoner can put in an image before the human gets sick. In a rapid turn around GAN you hit that noise floor really quickly.
> We’ve seen this arms race before and know who wins. It’s all snake oil imo
It's kinda funny in a way because effectively they're helping iron out ways in which these models "see" differently to humans. Every escalation will in the end just help make the models more robust...
That they are disclosing the tools rather than e.g. creating a network service makes this even easier.
By jappgar 2026-01-0414:35 And now you know the only reason these labs get any funding.
It's all to benefit industry, whether the academics realize it or not.
Idk. Perhaps this technique doesn't work, but if someone comes up with a working system, and LLMs start using techniques to counter it, artists might have a leg to stand upon, as the use of the counter-technique makes clear that the scraper never had any intention of respecting terms of use.
By vidarh 2026-01-0414:06 They won't need to use counter techniques beyond fixing incorrect output from their models by making the general training methods more robust to features not seen by humans.
By pixl97 2026-01-0416:36 No, not really.
In fact I would say the opposite is true. LLMs must protect against this as a security measure in unified models or things the LLM 'sees' may be faked.
If for example someone could trick you into seeing a $1 bill as a $10 it would be considered a huge failure on your part and it would be trained out of you if you wanted to remain employed.
By cmxch 2026-01-0420:37 AI model makers win, luddites lose.
Never mind that the more people try to corrupt a model, the more likely that future models will catch these corruption attempts as security and trust/safety issues to fix and work around.
The next Nightshade will eventually be viewed as malware to a model and then worked around, reconstructing around the attempt to break a model.
Doesn't mean artists should make it easy for these AI companies to steal artist IP. It doesn't take long to do and seems effective enough from what I've seen. BTW This is how cybersecurity works (cat and mouse etc)
What's with the "stealing" lingo? We were all making fun of the RIAA for conflating copyright infringement with stealing ("you wouldn't steal a car") and now we're doing the same?
By ronsor 2026-01-0415:59 The tides have turned; everyone here loves and respects copyright now.
The problem is that it is an inherently intractable problem with the (temporary) solution space shrinking with each mitigation, as the images still needs to look good to people.
By pixl97 2026-01-0415:56 Exactly. This isn't like encryption where you can just keep adding more bits. Every iteration that gets closer to simulating how people see sets the floor.
Real security systems don't publicize how they work.
This is just grandstanding. Half the people from this lab will go on to work for AI companies.
> Real security systems don't publicize how they work.
175 years of history would disagree with you: https://en.wikipedia.org/wiki/Security_through_obscurity
That old saw. Downvote all you want. Adversarial engineering does indeed rely on obscurity, they just don't tell you that.
By daeken 2026-01-0419:56 I've been working in security for more than 20 years and have seen the deleterious effects of security through obscurity first-hand. Why does "adversarial engineering" rely on obscurity?
By zelphirkalt 2026-01-0415:56 Isn't there a huge cost imbalance? As in easy to add some noise, difficult to remove reliably, so that even if it gets removed, it could still be counted as a partial win defending against unwanted AI scraping.
By throwfaraway135 2026-01-0414:172 reply I'm very skeptical about such systems, although they note that:
> You can crop it, resample it, compress it, smooth out pixels, or add noise, and the effects of the poison will remain. You can take screenshots, or even photos of an image displayed on a monitor, and the shade effects remain
if this becomes prevalent enough, you can create a lightweight classifier to remove "poisonous" images, then use some kind of neural-network(probably an autoencoder) to "fix" them. Training such networks won't be too difficult as you can create as many positive-negative samples as you want by using this tool.
By torginus 2026-01-0415:10 I dunno about this one, but I remember the previous versions suffered from visible artifacts to the point most artists elected not to use them as they made the output look bad.
It's also not obvious to me what happens with cartoon style art. Something that looks like white noise might be acceptable on an oil painting but not something with flat colors and clean lines.
By A4ET8a8uTh0_v2 2026-01-0415:01 As with most things like this, it is a cat and mouse game. On the one hand, I am annoyed, because I am personally rather firmly on the side of 'why are we spending time trying to prevent people doing this somewhat cool thing?', but at the same time, just like with drms, copy restrictions and all that idiocy, it raises a new line of kids with something to rebel against. So I guess it serves a purpose. On a third hand, can you imagine those minds being able to focus on something else?
