A plain-English explanation of the "invisible layer" - what changes in your photo, why AI models react to it, and where it stops working.
Every photo is just numbers
A digital photo is a grid of pixels, and every pixel is three numbers: red, green and blue, from 0 to 255. People see shapes and faces. AI models see only those numbers, and they turn them into internal "features" that describe what is in the picture. AI editors, face-swap apps and image generators all start by reading those features.
Adversarial noise: tiny changes that confuse AI
Researchers discovered that changing many pixels by just a few steps out of 255 - far too little for you to notice - can make an AI model read a completely different picture. This is called an adversarial perturbation. Photo Shield computes one for your photo:
- It loads TAESD (about 10 MB, MIT licence) into your browser with TensorFlow.js. TAESD is a small encoder trained to read images the same way as the Stable Diffusion image encoder, which many AI photo editors use.
- It repeatedly nudges your pixels so the copy of your photo that the AI works from (encode, then decode) comes out as broken as possible - while keeping every change below what people can see. This is a PhotoGuard-style attack (MadryLab, MIT licence) that targets the encoder and decoder together.
- The finished layer is scaled to your photo's full resolution and added to it. You download the result as a PNG.
Our rule: the protected photo must look the same to people. So the layer only changes brightness (not colour), puts most of the change into busy areas like hair and fabric where eyes can't see it, and is trained to survive resizing. On a smooth studio portrait (the hardest case) the default setting stayed invisible at full size (PSNR 37.4 dB) with a protection score of 29/100. Busy photos (groups, outdoor scenes, patterned clothes) score higher. Stronger settings score more but can leave a visible pattern, so they are optional.
Where the idea comes from
Academic projects such as PhotoGuard (MIT, 2023) showed that perturbations aimed at the image encoder of diffusion models can make AI edits come out unrealistic. The original code needs the full Stable Diffusion model and a powerful GPU. Photo Shield runs the same encoder attack against TAESD so it works free in your browser (fastest on browsers with WebGPU, such as recent Chrome and Edge). Because TAESD is a stand-in for the real encoder, the effect is weaker than the research version.
Honest limits
- Not a guarantee. It makes misuse harder and less convincing; it cannot make a photo impossible to edit.
- Built for Stable-Diffusion-style editors. It does not reliably stop other AI tools (for example ChatGPT, Gemini or face-swap apps), and future models may ignore it. Face-detection apps can still find faces.
- Re-processing weakens it. Heavy JPEG compression, resizing, cropping, screenshots or filters can reduce the effect. Post the downloaded PNG directly where possible.
- Higher strength = stronger but more visible. The default ("invisible") keeps the photo looking the same; higher settings can show a pattern on smooth backgrounds.
Your privacy
All of this happens in your browser. The photo is never uploaded, and nothing is stored on any server.
🛡️ Protect a photo now - free, in your browser
Last updated: October 2026