来源：环球科学
保护人类艺术家
生成式人工智能（AI）工具已经能够根据提示语即刻生成图片，作为产品使用起来非常方便，但可能给职业艺术家带来麻烦。人们会考虑用 AI 快速生成图像，来取代真正的人类艺术家，有些人甚至明目张胆地使用 AI 模仿特定的艺术家。然而，艺术家们还有一个小手段可以重夺对作品的控制权。这不仅是自卫，也是小小的反击。
美国芝加哥大学（University of Chicago）的研究团队和艺术家合作开发了两款可免费使用的电脑程序：Glaze 和 Nightshade。它们都采用在数字图像上添加算法伪装的方法，通过“上釉”（glazed）或“涂暗”（shaded），扰乱 AI 对图片的解读，让图片不能按照之前的方法被用于 AI 训练，同时几乎不影响人眼看到的效果。Nightshade 实际上还可以“毒害”模型的训练。
目前，著作权法是否保护创造性作品不被用于 AI 训练，仍是一个尚未解决的巨大法律灰色地带，这个问题下有多起诉讼还在进行，包括艺术家对 AI 图像生成工具公司的诉讼，甚至还有《纽约时报》（The New York Times）对 OpenAI 提起的诉讼——因为这个科技公司使用了《纽约时报》的文章来训练自家的大语言模型。迄今为止，AI 公司们声称将数字内容纳入训练数据库属于保护条款里的合理使用。
在这些诉讼结果出来之前，艺术家如果想在网上宣传自己的作品，就很难避免喂养 AI 这个“恶魔”。Glaze、Nightshade 还有类似的其他工具（比如 Mist），都不是长期的解决办法，而是在此期间给艺术家的一点慰藉。在生成式 AI 之前，人脸识别 AI 已经先行问世，为对抗过滤奠定了技术基础，它会调整照片以防止识别。Glaze 和 Nightshade 的开发者就在之前发布过一个名叫 Fawkes 的类似工具，以《V 字仇杀队》（V for Vendetta）中的盖伊·福克斯面具（Guy Fawkes mask）命名，用于掩盖面部。在 2023 年，研究团队注意到一些艺术家希望 Fawkes 能让他们的作品在 AI 面前“隐身”，Fawkes 本来做不到这一点，但这促使了计算机科学家着手开发帮助艺术家伪装作品的程序。Glaze 和 Nightshade 的功能有些许不同，但是它们也有很多共同点。两个程序都应用了过滤器，以微妙的方式改变数字图像中的像素，“迷惑”机器学习模型，但对人眼几乎不可见。这有点类似人眼的视错觉。人类的感知并不完美，我们的大脑对所见事物的解读存在固有的怪癖。比如，我们总是在无生命的物体上看见人脸，像是在插座、车头、纸箱上。计算机看待世界的方法和人类不同，但它们也有自己的感知弱点。Glaze 和 Nightshade 的开发者构建了一个算法，找出这些弱点以及利用它们的最佳方法，然后相应地对图片进行修改。这是一个精妙的平衡：既要困住 AI 模型，又要让人眼察觉不到太多变化。开发者通过反复试验算是找到了这个平衡点。训练一个图像生成式 AI 需要大量带有描述性文本的图像，AI 模型学习如何将特定的词语和视觉特征（如形状、颜色）联系起来，但这一切发生在计算机内，我们无法感知到。在计算机内部，所有这些联系基本上都储存在多维映射中，类似的概念和特征会被聚类在一起。在 Glaze 和 Nightshade 底层的算法中，计算机科学家策略性地强行将不相关的概念联系在一起，使多维映射上的点越来越靠近。芝加哥大学的赵燕斌（Ben Y. Zhao）是这些程序的主要研究者，他表示开发这些算法类似于求解两组线性方程。
首先发布的是 Glaze，它是进入这个领域的初步尝试。Glaze 专注于伪装艺术家的风格。著名的艺术家经常遇见这种情况——有人利用某位艺术家的作品来训练开源的生成式 AI，制造出一个能模仿该艺术家风格的工具。这会让该艺术家有偿创作的机会减少，甚至还可能威胁到创作者的名声。人们可能用某个画风模仿 AI 工具创作出具有冒犯性的图片，让相应的艺术家蒙受不白之冤。生成式 AI 带来了和深度伪造（deepfake）类似的噩梦。
因此，赵燕斌和他的同事开发了 Glaze，它能诱使 AI 模型识别到错误的风格。例如，如果你的艺术作品风格是可爱、活泼、卡通的，用 Glaze 处理后，AI 模型可能反倒会看到……[查看全文]
Inside the Race to Protect Artists from Artificial Intelligence
Lauren Leffer: Generative artificial intelligence tools can now instantly produce images from text prompts. It’s neat tech, but could mean trouble for professional artists.
Rachel Feltman: Yeah, because those AI tools make it really easy to instantly just rip off someone’s style.
Leffer: That’s right, generative AI, which is trained on real peoples’ work, can end up really hurting the artists that enable its existence. But some have started fighting back with nifty technical tools of their own.
Feltman: It turns out that the pixel is mightier than the sword. I’m Rachel Feltman, a new member of the Science, Quickly team.
Leffer: And I’m Lauren Leffer, contributing writer at Scientific American.
Feltman: And you’re listening to Scientific American’s Science, Quickly podcast.
Feltman: So I have zero talent as a visual artist myself, but it seems like folks in that field have really been feeling the pressure from generative AI.
Leffer: Absolutely, yeah. I’ve heard from friends who’ve had a harder time securing paid commissions than ever before. You know, people figure they can just whip up an AI-generated image instead of paying an actual human to do the work. Some even use AI to overtly dupe specific artists. But there’s at least one little tiny spot of hope. It’s this small way for artists to take back a scrap of control over their work and digital presence.
Feltman: It’s like a form of self-defense.
Leffer: Right, let’s call it self-defense, but it’s also a little bit of offense.
It’s this pair of free-to-use computer programs called Glaze and Nightshade developed by a team of University of Chicago computer scientists, in collaboration with artists. Both tools add algorithmic cloaks over the tops of digital images that change how AI models interpret the picture, but KEEP it looking basically unchanged to a human eye.
Feltman: So once you slap one of these filters on your artwork, does that make it effectively off-limits to an AI training model?
Leffer: Yeah, basically. It can’t be used to train generative image models in the same way once it’s been “glazed” or “shaded” – which is what they call an image passed through Nightshade. And, with Nightshade specifically, it actually might mess up a model’s other training– it throws a wrench in the whole process.
Feltman: That sounds like karma to me. I’d love to hear more about how that works. But before we dig into the technical stuff, I have to ask: shouldn’t artists already be protected by copyright laws? Like, why do we need these technical tools to begin with?
Leffer: Yeah, great question– so right now, whether or not copyright law defends against creative work being used to train AI, it’s this really big, unresolved legal gray area, kind of a floating question mark. There are multiple pending lawsuits on the subject, including ones brought by artists against AI image generators, and even The New York Times against OpenAI, because the tech company used the newspaper’s articles to train its large language models. So far, AI companies have claimed that pulling digital content into training databases falls under this protection clause of fair use.
Feltman: And I guess as long as those cases are still playing out, in the meantime, artists just can’t really avoid feeding that AI monster if they want to promote their work online. Which, obviously, they have to do.
Leffer: Right, exactly. Glaze and Nightshade– and similar tools, there are other ones out there like Mist– they aren’t permanent solutions. But they’re offering artists a little bit of peace of mind in the interim.
Feltman: Great names all around. How did these tools come to be?
Leffer: Let’s start with a little bit of background. Before we had generative AI, there was facial recognition AI. That laid the technical groundwork for adversarial filters, which adjust photos to prevent them from being recognized by software. The developers of Glaze and Nightshade, they’d previously released one of these tools, called Fawkes, after the V for Vendetta Guy Fawkes mask.
Feltman: Another great name.
Leffer: Yeah it’s very into, like, the tech-dystopia world.
Feltman: Totally.
Leffer: Fawkes cloaked faces, and in 2023, the research team started hearing from artists asking if Fawkes would work help to hide their work from AI too. Initially, you know, the answer was no, but it did prompt the computer scientists to begin developing programs that could help artists cloak work.
Feltman: So what do these tools do?
Leffer: Glaze and Nightshade, they do slightly different things, but lets start with the similarities. Both programs apply filters. They alter the pixels in digital pictures in subtle ways that are confusing to machine learning models but unobtrusive (mostly) to humans.
Feltman: Very cool in theory, but how does it work?
Leffer: You know how, with optical illusions, a tiny tweak can suddenly make you see a totally different thing?
Feltman: Ah yes, like the infamous dress that was definitely blue and black, and not white and gold at all.
Leffer: Right there with you. Yeah, so optical illusions happen because human perception is imperfect, we have these quirks inherent to how our brains interpret what we see. For instance, you know, people have a tendency to see human faces in inanimate objects.
Feltman: So true, like every US power outlet is just a scared lil guy.
Leffer: Absolutely, yeah– power outlets, cars, mailboxes– all of them have their own faces and personalities.
Feltman: 100%.
Leffer: Computers don’t see the world the same way that humans do, but they have their own perceptual vulnerabilities. And the developers of Glaze and Nightshade built an algorithm that figures out those quirks and the best way to exploit them, and then modifies an image accordingly. It’s a delicate balancing act. You want to stump the AI model, but you also want to keep things stable enough that a human viewer doesn’t notice much of a change. In fact, the developers kind of got to that balanced point through trial and error.
Feltman: Yeah, that makes sense. It’s really hard to mask and distort an image without masking and distorting an image. So they’re able to do this in a way that we can’t perceive, but what does that look like from the AI’s perspective?
Leffer: Another great question. To train an image-generating AI model to pump out pictures, you give it lots of images along with descriptive text. The model learns to associate certain words with visual features– think shapes or colors, but really it’s something else we can’t necessarily perceive because it’s a computer. And under the hood, all of these associations are stored within basically multidimensional maps. Similar concepts and types of features are clustered near one another.
With the algorithm that underlie Glaze and Nightshade, the computer scientists strategically force associations between unrelated concepts, so they move points on that multidimensional map closer and closer together.
Feltman: Yeah, I think I can wrap my head around how that would confuse an AI model.
Leffer: Yeah, it’s all still a little hand wavey because what it really comes down to is some complex math. Ben Zhao, the lead researcher at University of Chicago behind these cloaking programs, said that developing the algorithms was akin to solving two sets of linear equations.
Feltman: Not my strong suit. So I will take his word for it.
Leffer: Me either. That’s why we’re at a podcast instead.
Feltman: So why two tools? How are these different?
Leffer: Glaze came out first. It was kind of the entry, the foray, into this world. It’s very focused on cloaking an artists’ style. So this thing kept happening to prominent digital artists where someone would take an open source generative AI model and train it on just that artist’s work. That gave them a tool for producing style mimics. Obviously this can mean fewer paid opportunities for the artist in question, but it also opens creators up to reputational threats. You could use one of these style mimics to make it seem like an artist had created a really offensive image, or something else that they would never make.
Feltman: That sounds like such a nightmare.
Leffer: Absolutely, in the same nightmare zone as deep fakes and everything happening with generative AI right now. So because of that, Zhao and his colleagues put out Glaze, which tricks AI models into perceiving the wrong style. Let’s say your aesthetic is very cutesy, and bubbly and cartoon-ey. If you Glaze your work, an AI model might instead see…[full transcript]
