Fawkes, Glaze, and what photo cloaking can actually do

Fawkes came out of the Security, Algorithms, Networking and Data lab at the University of Chicago, in work led by Emily Wenger and Shawn Shan. It was presented at the USENIX Security Symposium in 2020, reached version 1.0 in April 2021, and had passed 840,000 downloads by May 2022. It is free, it is a standalone download for Windows, macOS and Linux, and it is the reference implementation of the idea most people mean when they say “photo cloaking”.

What it does is narrower than the coverage usually suggests. Fawkes does not blur your face, pixelate it, or add a visible pattern. It does not strip metadata. It computes a set of very small, carefully chosen pixel changes — an adversarial perturbation — and writes out a new copy of your photo containing them. To you the two files look the same. To a face-recognition model they describe noticeably different faces.

The research also describes a second, more aggressive idea: if most of the images of a person available to a model are cloaked, the model learns a distorted idea of what that person looks like, and then fails to recognise them even in an ordinary, un-cloaked photo. That property is what made the paper interesting, and it is also the source of the tool’s biggest practical limitation, which we get to below.

These two tools come from the same lab, use related techniques, and are constantly mistaken for each other. They solve different problems and are not interchangeable. Before going further it is worth making sure you are reading about the right one.

A useful way to keep them straight: Fawkes protects who a picture is of. Glaze protects how a picture was made. A third tool from the same lab, Nightshade, is the offensive counterpart to Glaze — rather than hiding your style, it corrupts what a model learns from your image.

If you are an artist, here is what you actually need to know

We send a lot of people to Glaze from this page, so it is worth being useful about it rather than just pointing at a link. Three things are true and are not obvious from the homepage.

1. 1

   The desktop app is genuinely easy — no terminal

   Unlike Fawkes, Glaze ships a real graphical app. You drag an image in, pick a cloak intensity, preview the glazed result before committing, and adjust if the artifacts are too visible. A GPU is not required, but without one it falls back to CPU mode and gets much slower — and the GPU path needs more than 3.6 GB of video memory, which rules out some older cards.

2. 2

   There is a free hosted version, and almost nobody mentions it

   WebGlaze has been running since August 2023. It is a free web service from the same team: you upload art from a phone, tablet or browser, it is processed on their GPU servers, the result is emailed to you, and the images are deleted immediately afterwards. You do not need a capable computer at all. Access is invite-only and limited to human artists who do not use generative AI tools — you request an invite for free by messaging @TheGlazeProject on Twitter or Instagram.

3. 3

   It raises the cost of style mimicry — it does not stop it

   This is the part to be clear-eyed about. Independent testing has found that art protection tools still leave creators exposed: in the strongest published study, a simple upscaling step was enough for a model to reproduce a Glaze-protected style well enough that reviewers preferred the copy more than half the time. The Glaze team actively ships updates against new attacks — version 2.2 added support for current NVIDIA cards — but treat it as a deterrent rather than a guarantee. That is the same caveat we apply to face cloaking on this page.

Together, Glaze and Nightshade have been downloaded close to nine million times — an order of magnitude more than Fawkes. If you came here looking for one of those, the links above are where you should go. We do not offer style protection and are not trying to sell you a worse version of a free tool that already works from your phone.

Face recognition does not compare photographs the way people do. A model converts each image into a list of numbers — an embedding — that describes the face as a position in a high-dimensional space. Photos of the same person land close together in that space. Identifying someone means computing a position for a new photo and asking which known cluster it falls nearest to.

That framing is what makes cloaking possible. If matching is a question about position, you do not need to make a photo unrecognisable to defeat it. You only need to move where it lands. Fawkes searches for the smallest pixel change that shifts the embedding away from your true cluster, subject to a constraint that the change stays below what a person would notice.

Three consequences follow, and all three matter more than the headline. First, the effect is model-relative: a cloak is computed against particular feature extractors, and its strength against a different system is an empirical question rather than a guarantee. Second, strength and visual fidelity are in direct tension — a bigger perturbation moves the point further but is easier to see. Third, and most importantly, the cloak lives in fine pixel detail, which is exactly what resizing and recompression throw away.

Everything above describes what happens to one file. That is the whole scope of a cloaking tool: you hand it a photo, it hands back a protected copy. It has no reach into anything else.

The documented limitation of this approach is that its effect weakens when cloaked and un-cloaked images of the same person are both available. A recognition system that can see your old profile picture, a tagged group shot, or a conference bio page can build a usable reference from those, and your newly cloaked upload does not undo any of it.

Removal has the mirror-image weakness, and we say so on our own removal page: it is not permanent, because new photos of you get scraped and re-indexed later. Each approach fails precisely where the other works.

So the honest framing is a line drawn at today. Everything behind it — already published, already indexed — is a removal problem, and cloaking cannot touch it. Everything ahead of it is a cloaking problem, and removal does nothing about it. If you have any public presence at all, you have both, in some ratio you do not currently know.

Which is the argument for looking before buying anything. A scan tells you how much of your problem is already-indexed and how much is still ahead of you — and if the answer is “almost nothing is out there yet”, cloaking your next upload is genuinely most of the job.

This is the section most pages selling this kind of protection do not write. It is also the one you should read most carefully, because these four factors determine whether cloaking is worth anything in your specific situation.

1. 1

   Un-cloaked photos of you that already exist

   The big one, covered above. Cloaking is strongest for people with a small public footprint and weakest for people who have been visible online for years.

2. 2

   The recognition vendor changes their model

   A cloak is computed against the feature extractors of the day. When a vendor retrains or replaces a model, previously cloaked images can become matchable again. This is not hypothetical: the SAND Lab has documented a case where changes to Microsoft’s backend reduced Fawkes’ effectiveness and required a coordinated response. Any protection in this category is a moving target rather than a permanent state.

3. 3

   Platforms recompress what you upload

   Social platforms resize, re-encode and strip metadata on upload. The perturbation lives in fine detail, and compression discards fine detail. This degradation vector is rarely mentioned and applies to every tool in this category, hosted or local.

4. 4

   Time

   Countermeasures are an active research area, and techniques that defeat cloaking continue to be published. A photo you protect today is protected against today’s systems.

“The researchers are also honest about the limits. There is no permanent guarantee. Defenses evolve. Anyone promising permanent immunity is selling certainty that the research itself does not support.”

— Evaluating anti-facial-recognition tools

Fawkes is free and you do not need us to use it. If you are comfortable on a command line, this is a real option and for some people it is the better one — your photo never leaves your machine, and you get to choose how aggressively it is protected.

1. 1

   Download it

   Get the standalone binary for your operating system from the SAND Lab, or install the Python package if you would rather work from source.

2. 2

   Pick a protection mode

   Fawkes exposes levels that trade cloak strength against visible artifacts. Lower settings keep the photo looking untouched; higher settings protect harder and are more likely to be noticeable.

3. 3

   Point it at a folder of photos

   The first run also downloads model weights, so budget extra time for it.

4. 4

   Wait

   Cloaking is compute-bound. On a laptop CPU, think minutes per image, not seconds.

5. 5

   Publish the cloaked file

   It writes a new file next to each original. Upload that one — and keep the original somewhere private, because it is the un-cloaked reference you do not want indexed.

# Roughly what the local workflow looks like.
# Check the SAND Lab page for current flags and releases.

pip install fawkes
fawkes -d ./my-photos -m low

# Writes ./my-photos/<name>_cloaked.png next to each original.

Official Fawkes download and documentation

Two rows below are unflattering to us and are the two worth reading first. Nothing in this category helps with photos that are already indexed. And a hosted service, by definition, means your photo leaves your device — which a local tool avoids entirely.

We are a hosted version of the workflow described above. You upload a photo in the browser, we apply adversarial protection built on proven methods from this research area with our own orchestration and validation on top, and you download a protected PNG. No account is required to protect a single photo.

We tune for visual fidelity rather than maximum cloak strength. For a professional headshot — the overwhelmingly common case — a protected photo that looks visibly processed has failed at its actual job, because you will not use it. That is a real tradeoff and it is worth knowing you are making it: if you care more about protection strength than about artifacts, running Fawkes locally at a higher setting will protect harder than we do.

Your photo is uploaded to our servers to be processed, which is the unavoidable cost of not installing anything. If that tradeoff is unacceptable for a particular photo, use the local route above — that recommendation is not a formality.

We do not publish a live effectiveness percentage, and you should be suspicious of anyone in this category who does without showing their method.

We built a benchmark harness to measure protection survival through realistic transformations — resize, recompress, crop, thumbnail, metadata strip. It has not been run recently enough for any number it produced to be worth quoting, so we have taken those figures out of circulation rather than leave a stale number on a page where it reads as current. That is a gap in what we can tell you, and we would rather name it than paper over it.

A number worth publishing needs a fixed evaluator set, a documented transform suite, a sample size large enough to mean something, and a date. When we can show that, we will publish it here, including if it is unflattering.

Until then, the honest claim is the narrow one: cloaking raises the cost and lowers the reliability of matching a photo to you. It is not invisibility, and it does not expire on a schedule we can predict.

If a scan shows you are already turning up in face-search engines, cloaking your next upload does not address that, and we are not going to pretend otherwise. Existing results come down through opt-out and removal requests to each engine — a slow, procedural task that you can do yourself for free, or hand to us for $49.

Everything above about Fawkes and Glaze comes from the researchers who built them. If you are evaluating this category, read them directly rather than taking our summary for it.

• •Shan et al., “Fawkes: Protecting Privacy against Unauthorized Deep Learning Models” — USENIX Security Symposium, 2020. The original paper.
• •SAND Lab — Fawkes project page. Downloads, current releases and documentation.
• •SAND Lab — Glaze project page. The tool for artists protecting a visual style.
• •Wikipedia — Fawkes (software). Background, adoption figures and documented limitations.

Related reading here: evaluating anti-facial-recognition tools and how face search is actually used.