On the Wings of a Butterfly
Modern research today focusing on protecting artist content from AI systems stems as a by-product of trying to find the limitations of models, so that the models can become stronger and more robust. The 'AI Poisoning' tool 'Nightshade' was conceived in such a way.The tools exist because researchers studying how to break AI models realized those same weaknesses could be weaponized in defense of the people being exploited by them. The artist protection was a downstream application, not the original mission.
There are some projects out there that are focused on disrupting and poisoning models. Glaze, from the same SAND Lab, applies near-imperceptible perturbations to images that shift how AI models perceive artistic style — over 6 million downloads since March 2023. Mist and Anti-DreamBooth take similar adversarial approaches, targeting specific fine-tuning pipelines like DreamBooth and LoRA. PhotoGuard, developed at MIT by Salman et al., prevents AI-powered image editing by making perturbations that resist manipulation. Spawning.ai built Kudurru, which tracks AI scraper IP addresses and blocks them or feeds them garbage data, alongside a "Do Not Train" registry with over 1 billion images opted out. And then there's the Content Credentials Initiative (C2PA), backed by Adobe, Microsoft, and the BBC, which embeds cryptographic provenance metadata into images — a different angle entirely, proving who made something rather than poisoning whoever tries to steal it. In most, if not all, cases these projects are using covert methods to 'poison' data. These methods are looked upon as unethical by some, and maybe they are. Honestly, AI companies have no ground to stand on when it comes to ethics, it's the pot calling the kettle black in my opinion.
Still, while these poisoning methods may work today, it's likely AI systems will adapt to evade these covert poisoning methods. This means that the field will be a never-ending uphill battle. In July 2025, MIT Technology Review reported on "LightShed," a tool trained by researchers that can strip away Nightshade, Glaze, Mist, and similar protections. What's worse is the end result of all of these adversarial endeavors is improved fitness of AI systems. This is precisely what we as Artists and Creators do not want. It is my assessment, that because these adversarial techniques are operating incrementally in covert space, they can only help strengthen AI in the long term.
Online systems are not unlike systems in nature. They ultimately exist as a system of value creation and extraction. Some entities in the system are predatory, others are essentially like prey. Conceptually, I don't think many people think of it in this way. Like it or not, the content you post for the views and likes provides tremendous value... at your expense. It's the algorithms that control the signals, not you. In social media systems, which are heavily manipulated, a metaphor that matches the user is a zombie ant being controlled by a parasitic fungus.
Do you know why butterflies are painted in brightly colored hues? Is it purely so we can appreciate their beauty? While this is one aspect we appreciate, in nature their colors are an aposematic defense mechanism. It is a signal to any predator that they are toxic, or not good to eat. The same is true for a plethora of other animals in nature including: poison dart frogs, whose electric blues and reds correlate directly with toxicity level — the brighter the frog, the more lethal the skin. Monarch butterflies, whose orange-and-black wings signal the cardiac glycosides they accumulate from milkweed — a bird only has to eat one to learn that lesson. Wasps and bees, whose yellow-and-black banding is so universally feared that dozens of harmless species have evolved to mimic it. Coral snakes, whose red-and-yellow bands advertise neurotoxic venom. Even the humble skunk, whose black-and-white contrast is the mammalian equivalent of a neon warning sign. In every case, the signal is honest. The colors don't lie. They say: I am not worth the cost of consuming me.
We could create and adopt digital systems inspired by this concept. It's possible to scramble images so completely that it would be impossible for an AI to detect any pattern well enough to extract the original image. At the same time, the image could still maintain enough of a semblance of the original image, that we can discern what it portrays. This isn't really a high technology solution, it's actually just scrambling pixels as a form of overt encryption.
WARNING: Boring Encryption Stuff
You May want to check out now... if you're not into that sort of thing.
Now that only my die-hard encryption fans are still here... We are going to use a python package named 'aiposematic' to demonstrate an example of digital aposematism defense for images. Let's get into this concept a little further. You may or may not be familiar with Glitch Art — if not, here's the short version: Glitch Art is a genre of digital art that embraces the aesthetics of technological failure. It emerged from 1960s video art, when Nam June Paik was deliberately manipulating television signals to create distorted visuals. By the 1990s, artists were hex-editing image files and running photos through audio editors to produce corrupted, otherworldly imagery. Rosa Menkman's "The Glitch Moment(um)" (2011) is the foundational text — she frames glitches as moments that reveal the hidden processes underlying our supposedly seamless digital world. Today, r/glitch_art has over 250,000 subscribers, #glitchart on Instagram has over 2 million posts, and the aesthetic has penetrated fashion, album art, and advertising. It is a living, established art form. We are taking the general concept of Glitch Art, and applying it in a structured manner. So that we can scramble it to encrypt the image, and decrypt it back to the original. This package actually uses methodologies that rival, if not exceed, standard encryption.
How could it be stronger than encryption in theory? Well, in the case of the 'aiposematic' python package, it has customizable parameters that allow you to create customized encoding schemes. The package applies operations — add, XOR, rotate, S-box substitution, and channel operations — with parameters tied to encryption keys derived from Stellar Ed25519 keypairs via SHA-256 cryptographic key derivation. It operates in two modes: BUTTERFLY mode and QR mode, each producing different scrambling patterns. The output is a valid image file — you can share it on any social media platform, post it anywhere. But without the correct key, nobody is reconstructing the original. The scrambling parameters are unique to your key, which means the encoding scheme itself is unique to you. There is no universal "aiposematic format" to crack — every user produces a different scrambling pattern from a different key. Generally speaking, encryption formats are standards. Standards that have well-known and established attack vectors. In the realm of secret schemes, codes are superior to ciphers — and there's historical weight behind that claim. In classical cryptography, a "cipher" transforms text through a known algorithm with a secret key, while a "code" replaces words or phrases with arbitrary substitutes from a codebook. The critical difference: ciphers have mathematical structure that cryptanalysts can exploit. Codes with unknown codebooks have no structure to attack — you need the codebook itself or nothing. During the American Civil War, diplomatic communications were secured using codes precisely because cipher systems were considered too weak. The Navajo Code Talkers in World War II used a code — Navajo words substituted for military terms, layered with further encoding — that was never broken. Japan's own chief of intelligence admitted after the war it was the one code they could not crack, at a time when they were breaking every cipher the Allies used in the Pacific. The aiposematic package operates closer to the code paradigm than the cipher paradigm: the "codebook" is your unique, key-derived scrambling scheme, and without it, there's no algorithmic structure to exploit.
Aside from these technical aspects, Digital Aposematism as a concept for protecting digital media is an honest solution. It is signaling to predators in the online ecosystem that it isn't good to eat, and should be ignored... like the butterfly. It doesn't hide the original completely, so the spirit of the image is still visible. It doesn't contain a hidden threat meant to covertly disrupt AI training. This is just one example of how we could adopt and use new technologies to protect our content overtly and honestly.