What can actually be changed about a photo
There are only three levers. You can stop publishing the photo, which works but costs you whatever the photo was doing for you. You can publish a worse photo — lower resolution, partial occlusion, an angle — which reduces how useful it is as a reference and also how useful it is to you. Or you can change the file in a way that people do not notice and recognition systems do.
The third is what adversarial cloaking attempts. It is the only one of the three that does not require giving something up, which is why it gets the attention, and it is also the one with the most caveats.
How adversarial cloaking works
Fawkes, from the University of Chicago SAND Lab, computes a small perturbation across the pixels of a photograph and adds it to the file. The perturbation is constrained to stay below the threshold of ordinary human perception, so the image still looks like your photograph at normal viewing size.
What it changes is the embedding. The recognition model extracts a substantially different vector from the cloaked file than it would from the original, so the cloaked photo matches your other photos less reliably. Fawkes exposes protection levels that trade cloak strength against visible artifacts; stronger settings protect more and are more likely to be noticeable on large flat areas of skin or background at high zoom.
What breaks it, stated plainly
Recompression is the degradation vector that gets mentioned least and matters most. The perturbation lives in fine detail, and fine detail is exactly what a platform discards when it resizes and re-encodes your upload. Every social platform does this. Upload the protected file you were given rather than a screenshot or a re-export, and expect the platform to re-encode it anyway.
One clean copy defeats the purpose. If the original is published anywhere — an older version of the same profile, a press page, a colleague’s post — an indexer has an uncloaked reference and the cloaked file does not help. Keep the original private.
And the technique is not permanent. Detection is plausible in principle, because the perturbations follow patterns a system expecting them can look for. Reversal is harder but is an active research area. The honest framing, which is also the framing the researchers who built these tools use, is that cloaking raises the cost and unreliability of matching rather than guaranteeing anything.
Where this leaves you
Cloaking is worth doing on a photo you are about to publish, in combination with getting existing indexed copies removed, and on the understanding that it degrades rather than defeats. It is not worth doing instead of removal, and it is not worth doing to a photo whose original is already public.
If you are comfortable in a terminal, Fawkes is free, it is from the researchers who invented the technique, and running it locally means your photo never leaves your machine. On that specific axis local is strictly better than any hosted service, including this one.