You commented SHIELD. Here's the free code, the paper, and what still gets around it. Every claim links to its source, and I'll be straight about the limits.
1. The free code
What it is. PhotoGuard, from MIT's Madry lab. The code is public under an MIT licence and has notebooks for Stable Diffusion image-to-image and inpainting. github.com/MadryLab/photoguard
What you need. This is a research demo, not an app. The README has you clone the repo, make a Python 3.10 conda environment, run pip install, and log in to Hugging Face. There are Colab notebooks if you would rather not set up locally. README
The heavy part. The stronger diffusion attack "requires significant GPU memory". The simpler encoder attack is the lighter one. MIT News
Not verified by me. The README links a Hugging Face demo space. When I checked it today, the page showed a cached runtime error, and I did not run the notebooks. So I can't promise it works in one click. HF space
2. The paper
Who and what. "Raising the Cost of Malicious AI-Powered Image Editing", by Salman, Khaddaj, Leclerc, Ilyas and Madry at MIT, presented at ICML 2023. arXiv 2302.06588 · MIT News
The idea. Add changes "invisible to the human eye but detectable by computer models" that disrupt the model's ability to edit the image. MIT News
The encoder attack. An editor first squeezes your photo into a compact latent representation, then edits from that. The attack forces the encoder to map your photo to a "bad" representation, for example that of a grey image. The model then generates "an irrelevant or unrealistic image". paper
The settings. In the paper, each pixel value (red, green, blue, 0 to 255) moves by at most 16/255, in steps of 2/255, over 200 steps. The authors chose the limit so it is not noticeable to the eye. paper, Appendix A.2 · MDN on RGB values
What they tested. Stable Diffusion v1.5, with an image, a mask and a prompt. The immunized image gave unrealistic edits, and the diffusion attack looked more unrealistic than the encoder attack. paper
Why they built it. Edited personal photos "can be inappropriately altered and used for blackmail". MIT News
3. What still gets around it
One editor. The authors say the perturbations "are not guaranteed to be effective against the future versions of these models." paper
JPEG. A Maryland follow-up used PhotoGuard's own notebooks on Stable Diffusion 1.5 and found the changes "are not robust to JPEG compression". Between 95% and 85% quality, enough noise was removed for an adversary to edit the image (encoder attack). For the diffusion attack it was 85% to 75%. This can happen by accident, for example when JPEG is the default screenshot format. arXiv 2304.02234
What did not break it. In the same paper, Gaussian blur did not let the model produce reasonable images, and rotations did not retain the original subject. arXiv 2304.02234
Their conclusion. For high-stakes cases, imperceptible perturbations "are so far inadequate for protection against editing by an adversary." arXiv 2304.02234
A 2025 study. Across several perturbation-based protections, edits of protected images mostly still followed the prompt. I read the abstract only. arXiv 2506.04394
An outside expert. ETH's Florian Tramèr: "Designing such robust protections is a hard open problem". MIT News
4. Similar tools that do a different job
Glaze and Nightshade (University of Chicago) target art style mimicry and training on scraped images. They are not photo-editing shields. Glaze
LightShed, a Cambridge-led study, detected Nightshade-protected images with 99.98% accuracy and removed the protections. Cambridge
Fawkes (2020) adds "cloaks" to photos against facial recognition, not editing. arXiv 2002.08327
5. What to actually do
Treat it as one layer, not a lock. It was built and tested against one model. Don't post something you couldn't live with being edited because you shielded it.
Keep the original. Run the notebook on a copy and share the protected file. Keep your untouched photo offline.
Don't re-save it as a JPEG. The Maryland paper shows that is how the protection weakens. Share the file as it comes out of the notebook. I have not tested what Instagram or WhatsApp do to an uploaded file, so assume they may change it.
Post fewer high-resolution face shots if the stakes are high. This is my own judgement, not a finding from these papers.
Push the real fix. The authors' proposal is that model makers build it in: APIs that add the changes automatically. I could not find a mainstream app that does this for you today, but absence of a search result is not proof. MIT News
Mike
PS: Want more like this, how the tech you use every day actually works? You're already on the list. Reply and tell me what to break down next.