Protecting Photos from AI Scraping (Adversarial Filters)

To reduce unauthorized collection, start by limiting access, then publish only a display-sized copy rather than your original. Add accurate rights metadata and, where useful, provenance records. Adversarial filters may disrupt some AI uses, but no universal standard proves they will work, and image processing can weaken them. Treat every public image as copyable.

Would a few checks before publishing save you more time than trying to remove a photo after it spreads? I recommend starting with what you can control: who can reach the image, what file they can retrieve, and what information travels with it. Then treat filters as one uncertain layer, not a lock.

The steps below fit personal portfolios, creator sites, and photo galleries. They cannot guarantee that an image will not be copied or used in AI training. They can reduce exposure and help you make informed choices. The case studies are illustrative workflows, not claims about specific people or platforms.

Planning: Identify Exposure, Rights, and Platform Controls

Planning means finding each original and public copy, understanding its audience, and deciding what harm you are trying to reduce. That gives you a practical basis for choosing access settings and image sizes. No single technology settles the question; the goal is to lower risk without relying on an unproven promise.

Begin with a simple inventory. Record where each image lives, whether it is public, who owns the rights, and whether you granted permission for reuse. Include portfolio sites, social accounts, public cloud links, and older galleries you may have forgotten. Check each service’s current terms, training-use settings, and opt-out controls. These settings can change, and an opt-out may apply only to certain uses or content.

Write down your harm model: the specific outcome you want to make less likely. For example, you may want to discourage model training, limit access to a high-resolution image, or make later reuse easier to challenge. These are different goals. A filter intended to affect some model outputs does not stop someone from downloading a photo.

Adversarial filters are changes to image pixels designed to interfere with certain machine-learning processes. They are not a universal specification, and there is no accepted effectiveness threshold that proves a filtered image is safe from scraping or training. Research tools such as Glaze illustrate this approach, but results depend on the tool, model, and image processing involved.

I separate the decision into three questions:

• Is the image sensitive enough to keep private?
• Does a public viewer need the full-resolution file?
• Which platform controls and rights terms apply to this copy?

The NIST Privacy Framework can help organize privacy risks and responses. It is a risk-management framework, not a filter standard or a certification that a photo is protected. Use it to structure decisions, not to claim guaranteed safety.

Access and Clearance: Limit Who Can Retrieve Images

Access controls decide who can view or download a file. They usually provide a stronger collection barrier than a crawler request because they can require an account, restrict a gallery, or limit a link. They still cannot prevent an authorized viewer from saving or capturing an image.

Make galleries private by default when public access is not needed. Use account restrictions, password protection, or expiring links if the service offers them. Before sharing, test the link in a logged-out browser or a private browsing window. Confirm that it does not expose a folder or other images beyond the intended file.

Check platform settings for the exact account and content involved. A control may cover future uploads but not existing ones, or may apply only to particular services. Read the platform’s current explanation instead of assuming that a general opt-out changes every use of your photos.

robots.txt is a file that tells compliant web crawlers which parts of a site they should avoid. It is a voluntary directive, not an access lock. A crawler can ignore it, and it does not stop people from opening or copying a public image. Do not use it as your only scraping defense.

Method	What it can do	Main limitation	Best fit
Private gallery or account access	Restrict retrieval to approved viewers	Viewers may still copy what they can see	Personal or client work
Expiring or limited link	Reduce how long a shared route remains available	The file may be saved while the link works	Temporary review
robots.txt	Signal crawler preferences	Voluntary; does not block access	A supporting site instruction
IPTC rights metadata	Carry creator and usage information	Can be stripped and does not block copying	Public image copies
Adversarial filter	May disrupt some AI-related processing	Effectiveness varies; edits can weaken it	An optional extra layer

Rights clearance matters too. Confirm that you have permission to publish the image and that any people, artwork, or licensed material in it can be shared under the terms you intend. A copyright notice or platform opt-out does not create rights you do not hold.

Execution: Prepare Derivatives, Metadata, and Optional Filters

A derivative is a copy prepared for a specific use, such as a web page. Keeping it separate from the original limits what you expose. A practical publishing recommendation is a longest edge of no more than 1600 pixels, unless the site needs less; this is not a standard or a guarantee against copying.

Keep full-resolution originals offline or in controlled storage. Export a separate web version sized for its actual display. Smaller dimensions may be enough for a profile or thumbnail. Avoid publishing a larger file simply because a platform accepts it.

Add accurate IPTC Photo Metadata fields for creator, copyright notice, and rights or usage terms. IPTC is a metadata standard used to describe photos. Think of these fields as a notice and provenance aid, not a technical barrier: platforms or editing steps may strip metadata, and anyone who gets the image may still reuse it.

C2PA Content Credentials can record origin or editing history in supported workflows. C2PA is a provenance system, not a scraping blocker. A platform may not support the credentials, and they may be removed; they do not prevent copying, training, or distribution.

If you choose an adversarial filter, use it only after reviewing the tool’s privacy and processing method. Prefer local processing when possible. Do not upload sensitive originals to an untrusted service just to apply a filter. Keep an unfiltered original in controlled storage, and do not describe the public copy as protected. A filter may be weakened by resizing, cropping, screenshots, color changes, or recompression.

An illustrative portfolio workflow looks like this:

• Keep the camera original in private storage.
• Export a separate web image at a suitable display size.
• Add correct creator and rights metadata.
• Apply a locally processed filter only if its trade-offs make sense.
• Publish through a private or public setting chosen for that image.

For a family gallery, the sensible choice may be no public upload at all. For a public artist portfolio, a limited-resolution derivative may meet the display need while exposing less detail than the original. These examples show decision paths, not guarantees of protection.

Verification: Test Published Copies and Recheck Settings

Verification means checking what visitors and platforms can actually access after upload. The local file is not enough: a service may resize, recompress, crop, or regenerate it. Those changes can remove metadata and weaken a filter, so test the platform-served image and the access settings that apply to it.

After publishing, check the image at its full display size and inspect the file the platform serves, if you can download it. Confirm the visible result, dimensions, and whether IPTC fields or C2PA credentials remain. Their absence does not prove misuse, but it tells you not to rely on them as a notice or record on that copy.

Then test access:

• Open the gallery while logged out.
• Try the shared link and check whether it reveals more than intended.
• Confirm that private settings or link expiry behave as expected.
• Review the platform’s current training-use controls and opt-out status.
• Save a record of the settings and date you checked them.

If you apply a filter, assess the published derivative rather than only the local export. A platform’s processing may alter it. Even if the effect appears intact, that is not proof that all models or future processing will respond the same way. Avoid claims such as “AI-proof” or “scrape-proof.”

I would repeat these checks after a major platform change, a settings update, or a change in the image’s intended audience. Remove public copies you no longer need, and replace oversized files with smaller derivatives where the service permits it. Assume a public image can be copied, even after you delete it.

Frequently asked questions

Can an adversarial filter stop AI scraping?
No. It may disrupt some AI-related processing, but it does not prevent someone from accessing or copying a public image.

Do adversarial filters work after resizing or compression?
Their effect may be weakened or removed by resizing, cropping, screenshots, color changes, or recompression. Test the platform-served copy, but do not treat a test as a guarantee.

What image size should I publish?
As a practical recommendation, use a separate web derivative with a longest edge no greater than 1600 pixels, or less if the display allows. This is not a formal standard or a protection threshold.

Does robots.txt block AI crawlers?
No. It communicates crawler preferences to systems that choose to follow them. It does not block access or stop non-compliant scraping.

Does IPTC metadata protect my copyright?
It can identify the creator and state rights or usage terms. It is useful as a notice, but it can be stripped and does not prevent copying.

Do C2PA Content Credentials prevent training?
No. They can record origin or editing history in supported workflows. They do not stop copying or training, and a platform may remove or not support them.

Should I upload an original to an online filter tool?
Only if you trust how the service handles the file. For sensitive images, avoid sending the original to an untrusted service; use local processing or skip the filter.

What is the strongest practical first step?
Make the image private if it does not need to be public. If it does, publish a limited-resolution derivative and check the platform’s access and training-use settings.

The reliable approach is layered: limit access where possible, expose only the copy needed for display, add accurate rights information, and verify what the platform serves. Filters and provenance tools may add value, but none is a guarantee.

(This article was written by one of our staff writers, Steven Langford. Visit our Meet the Team page.)