Protecting your images from AI training

For two years the working assumption was simple and bleak: once an image is online, it is fair game to train AI. That assumption is breaking.

Standards bodies, camera makers, courts, and child-safety groups have spent 2024 and 2025 building the machinery for consent, and it is starting to bite. The picture is far from finished, but for the first time the momentum is on the side of the person who made the image.

AI and machine learning are among the most useful things our industry has built, and we work with them every day. A model trained on work people chose to give is a better model and a fairer one. Our commitment to privacy is not a hedge against AI. It is how AI earns the trust to last.

The scale is why this matters. The LAION-5B dataset behind many image models holds about 5.9 billion image and text pairs (LAION, 2022), scraped from the open web with no one asked.

Creators noticed: 96% of authors in one survey said their consent should be required first (Authors Guild, 2023), and more than 13,000 writers, musicians and actors signed a statement against unlicensed training (ARTnews, 2024).

This is the map of what protects an image today, what we have built, and where the honest limits still are.

TL;DR

• The default is flipping from scrape-freely to consent-by-choice, as provenance, opt-out registries, and law converge across 2024 to 2026.
• Content Credentials (C2PA) are shipping in cameras and AI tools, and IPTC metadata now carries a machine-readable do-not-train preference.
• The EU AI Act requires training-data disclosure from August 2025, and a roughly 1.5 billion dollar Anthropic settlement showed piracy has a price.
• For children, the most harmful material is being removed at the source (the Re-LAION cleanup with the IWF and C3P), and major labs committed to screen training data.
• We build the provable layers: a do-not-train signal, signed provenance, a forensic watermark, and a fail-safe detector. Cloaking tools like Glaze and Nightshade are a deterrent, not a guaranteed shield.

What we have built to protect your images

Enough context, here is the part we made. Consent only means something if it is recorded, portable, and provable, so we build it in three layers, each designed to fail safe rather than overclaim. A signal that travels with the file.

Proof that survives the internet. And a way to answer the question every creator asks: was my work used? The standards and the law that back these layers come right after, but the tools are the point.

A consent signal that travels

We write the do-not-train preference directly into the file, using the IPTC and PLUS Data Mining fields alongside XMP rights metadata, and we pair it with the signals a crawler meets before the image: the site's robots file, the W3C reservation protocol, and the IETF's emerging AI-preferences Content-Usage header.

The same preference is written as a signed Content Credential (the open C2PA provenance standard) carrying a training-mining assertion under the Creator Assertions Working Group, with fail-closed logic. If the signal is missing or ambiguous, the safe reading is do not train, not train freely. Consent should default to no and open to a deliberate yes.

Proof of ownership that survives the internet

A watermark proves it was yours when someone did anyway. We test marks against the full redistribution ladder an image actually travels: JPEG and WebP recompression, resizing, a screenshot, a social re-upload, and a neural recompression through our own codec, Epiron.

The established open baseline, TrustMark, came through that entire ladder at essentially perfect detection with zero false positives on real photographs, which is a strong result and worth saying so.

We then built a mark integrated directly into Epiron for the case watermarks usually fail: geometry. It carries a 48-bit payload, stays invisible by measurement (LPIPS 0.025, SSIM 0.96), and holds where the baseline breaks.

On an aggressive crop it still read at 0.84 where the baseline fell to zero, and after a blind rotation search at decode time it recovered rotated marks at close to 1.0 where the baseline sat at 0.63. These are our own measurements, on real photographs, and we hold our tools to the same adversarial standard we hold everyone else's.

Did a model train on your work?

The hardest question a creator asks is the simplest to state. We built a detector that estimates it from a model's own behaviour, reading its denoising loss and calibrating against an offline reference so the comparison is fair.

What matters most is what it refuses to do. It returns one of three answers, detectable, undetectable, or pending, so it fails safe and says we cannot tell yet rather than assert a match it cannot stand behind. A detector that cries wolf is worse than none.

Ours is built to stay quiet unless the evidence is real, which is the only way a creator can act on it.

Provenance: giving every image a memory

Provenance is the quiet win. Content Credentials, the open standard from the C2PA, attach a signed, tamper-evident record to an image: who made it, how, and what may be done with it. The specification reached version 2.2 in 2025 (C2PA, 2025), and its steering group now includes Adobe, Google, Meta, Microsoft, OpenAI, Sony and TikTok (C2PA, 2024).

The reach is already real. OpenAI attaches Content Credentials to images from DALL-E 3 (OpenAI, 2024), and the credential is moving into the camera itself. The Leica M11-P shipped in 2023 as the first production camera to sign photos at capture (Content Credentials, 2023), with Nikon and Sony following through firmware. A signed photo carries proof of origin wherever it travels.

One reassurance for photographers worried about the opposite problem: this proves your photo is a genuine capture, it does not tag it as AI. A Content Credential only marks an image as AI when it genuinely was AI-made, recorded through a separate source-type assertion. Signing your own work labels it authentic, not synthetic.

Provenance also carries a preference. The IPTC photo metadata standard added a Data Mining property in 2023 with values such as prohibited for generative AI training, and that reservation travels with the file across republication (IPTC, 2023). The W3C published a companion protocol so the same signal is machine readable on the open web (W3C, 2024). The image can now say, in a form a crawler understands, do not train on me.

From a wish to a signal machines read

Opt-out only works if someone honours it, and that layer is filling in. Spawning built a Do Not Train registry and the Have I Been Trained tool; by 2023 it had gathered opt-out requests covering roughly 80 million works, with Stability AI and Hugging Face among those honouring them (Open Future, 2023). Coverage is a moving figure, not a guarantee, but a registry that platforms actually check is a different world from a plea in a caption.

Website owners have a blunter lever, and they are pulling it. AI training crawlers such as GPTBot, Google-Extended and CCBot can be blocked in a site's robots file, and adoption climbed fast: by 2024, roughly eight in ten of the largest news sites blocked at least one AI training bot (Press Gazette, 2024).

Blocking depends on the crawler respecting it, so it is a fence, not a wall. Still, the default is flipping from open door to closed by choice.

The law is catching up

Regulation turns a preference into an obligation, and 2025 was the year it started to. Under the EU AI Act, providers of general-purpose AI models must publish a sufficiently detailed summary of the content used to train them, an obligation that began applying in August 2025 with a template from the European Commission (EU AI Act, Article 53; European Commission, 2025).

Europe's copyright law already lets rightsholders reserve their works from text and data mining, and a 2025 Dutch ruling confirmed the reservation must be machine readable to count (IPKat, 2025). Provenance metadata is exactly how you make that reservation stick.

The courts are drawing lines too, though not always where creators hoped. Anthropic agreed to a settlement of about 1.5 billion dollars, roughly 3,000 dollars for each of some 500,000 pirated books, and to destroy the pirated dataset (NPR, 2025). The same case treated training on lawfully acquired works as transformative, and it was the piracy that cost.

In the UK, Getty's case against Stability AI ended with the court rejecting the secondary-copyright claim and declining to rule on whether training itself infringes (Latham & Watkins, 2025). The law is moving toward consent and provenance, unevenly, and anyone who tells you it is settled is selling something.

What about cloaking tools like Glaze and Nightshade?

This is where honesty earns its keep. Glaze and Nightshade, from the University of Chicago, let an artist add near-invisible perturbations meant to confuse a model that trains on the image. Glaze has been downloaded more than 6 million times and Nightshade more than 1.6 million (MIT Technology Review, 2024). As a grassroots act of refusal, they matter.

As a guarantee, they do not hold, and the people who protect artists deserve to hear that plainly. Peer-reviewed work from ETH Zurich and Google DeepMind showed off-the-shelf methods can bypass this kind of protection (Hönig et al., ICLR 2025), and a 2025 tool called LightShed can detect and strip the perturbations at high accuracy (MIT Technology Review, 2025).

The Glaze team ships hardened updates in response (The Glaze Project, 2025). That back-and-forth is the real state of the art: a genuine deterrent and a moving target, not a shield you set and forget. We test this whole family ourselves, adversarially, and we reach the same conclusion, so we build our protection on ground that holds.

Protecting children: a fight worth winning

Children deserve the strongest protection we can build, and here is the warm truth: the tide is turning for them fastest of all. The most harmful material is being hunted down and pulled out of the datasets that feed AI, and the largest companies in the field have committed, in writing, to keep it out. Two years ago that seemed unwinnable. It is being won.

The turning point was accountability. In December 2023 the Stanford Internet Observatory found more than a thousand verified child sexual abuse images referenced in LAION-5B (Stanford Internet Observatory, 2023). The dataset came down, and a cleaned version, Re-LAION-5B, went back up with thousands of links removed using lists from the Internet Watch Foundation and the Canadian Centre for Child Protection (LAION, 2024).

That is the pattern that scales: known-harm hash lists purging datasets at the source. Through the Safety by Design programme from Thorn and All Tech Is Human, companies including Amazon, Anthropic, Google, Meta, Microsoft, OpenAI and Stability committed in 2024 to source and screen training data responsibly (Thorn, 2024). When advocates pushed, the field moved.

And it moves because people push. Human Rights Watch found photos of 720 identifiable Australian and Brazilian children in LAION-5B after reviewing less than 0.0001% of it (Human Rights Watch, 2024). The real number is far larger, and their reporting is part of why those images are now flagged. The same three layers that protect an artist protect a child: a do-not-train signal a parent can attach, provenance that proves an image was theirs and never offered, and detection that can flag if it surfaced where it should not.

A child cannot consent to becoming a training example, so for them the default must be no, built into every system as the easy answer.

We will not be neutral about this part. A trained model cannot unlearn a face, so prevention and proof are the levers that work, and both are getting stronger every quarter. Support the groups doing the hard cleaning, the Internet Watch Foundation and the child-protection centres, and ask the platforms you use where your family's images go. This is ground worth celebrating and worth pushing harder on, and it is exactly the kind of work we are proud to build toward.

Where we are placing our bet

We build media infrastructure at Inverity, and we are pro-AI to our core. That is precisely why we are steadfast on privacy: a technology this powerful earns its place by being trustworthy, and trust is built on consent you can prove. The durable protections are the provable ones, a signal recorded in the file, provenance that is signed, ownership a watermark can demonstrate after the image has crossed the internet, and detection that fails safe. That is where the standards, the cameras, and the courts are converging, and it is where we put our effort.

The optimism here is earned, not decorative. The tools to keep an image from being taken without permission are being built in the open, they improve quarter over quarter, and the people who make images, including the smallest and most vulnerable subjects of them, are no longer arguing from zero. If verifiability is the standard, and we think it should be, then consent you can prove is how this is won.

FAQ

Can I stop my photos from being used to train AI?

Not with a single guaranteed switch yet, but you have real, stacking levers. Embed a machine-readable do-not-train preference in the file, register works with an opt-out registry, block AI crawlers on your site, and keep signed provenance. Each is honoured unevenly on its own, but together, and increasingly backed by law, they add up.

Can you tell whether a model was trained on my image?

Often, yes, and honestly when not. A membership-inference detector reads a model's own behaviour to estimate whether your image was in its training data. A trustworthy one fails safe: it should return detectable, undetectable, or pending, and say it cannot tell yet rather than assert a match it cannot prove. Ours is built that way on purpose.

How do you prove an image was mine after it spreads online?

A forensic watermark. A good one survives the journey a real image takes: recompression, resizing, screenshots, social re-uploads, even a neural recompress. In our testing, a strong open baseline (TrustMark) survived that full ladder at near-perfect detection with no false positives, and a mark built into our codec held up further under cropping and rotation, where watermarks usually fail.

Do Glaze and Nightshade actually protect my art?

They are a meaningful deterrent, downloaded millions of times, but not a guaranteed shield. Peer-reviewed research in 2025 showed the protective perturbations can be bypassed, detected, or removed, and the tools' authors patch back. Treat them as one layer in an arms race, not a permanent lock, and pair them with provenance and proof.

What is being done about children's images in AI datasets?

A great deal, and it is working. Known-harm hash lists from the Internet Watch Foundation helped clean the Re-LAION dataset in 2024, and major AI labs committed through Thorn's Safety by Design programme to screen training data. The next frontier is consent and provenance for ordinary photos, so a child's images are never taken without a deliberate yes.