Anti-I2V: Safeguarding your photos from malicious image-to-video generation

Duc Vu; Anh Nguyen; Chi Tran; Anh Tran

cs.CVMar 25, 2026

Anti-I2V: Safeguarding your photos from malicious image-to-video generation

Authors: Duc Vu, Anh Nguyen, Chi Tran, Anh Tran

Organizations: Qualcomm AI Research†

Abstract

Advances in diffusion-based video generation models, while significantly improving human animation, poses threats of misuse through the creation of fake videos from a specific person's photo and text prompts. Recent efforts have focused on adversarial attacks that introduce crafted perturbations to protect images from diffusion-based models. However, most existing approaches target image generation, while relatively few explicitly address image-to-video diffusion models (VDMs), and most primarily focus on UNet-based architectures. Hence, their effectiveness against Diffusion Transformer (DiT) models remains largely under-explored, as these models demonstrate improved feature retention, and stronger temporal consistency due to larger capacity and advanced attention mechanisms. In this work, we introduce Anti-I2V, a novel defense against malicious human image-to-video generation, applicable across diverse diffusion backbones. Instead of restricting noise updates to the RGB space, Anti-I2V operates in both the $L$ $a$ $b$ * and frequency domains, improving robustness and concentrating on salient pixels. We then identify the network layers that capture the most distinct semantic features during the denoising process to design appropriate training objectives that maximize degradation of temporal coherence and generation fidelity. Through extensive validation, Anti-I2V demonstrates state-of-the-art defense performance against diverse video diffusion models, offering an effective solution to the problem.

Figures & tables

Figure 1: Overall pipeline of Anti-I2V . We first generate a reference video input by captions from leverage LVLM [ 9 ] and user-provided image. Then we integrate the IRA and IRC losses with the vanilla training loss as the final objective. The noise is iteratively optimized through both $L^{*}a^{*}b^{*}$ and frequency space.

Figure 2: PCA visualization of features in each layer. Features from each block are visualized at timestep 500. The first row shows features from OpenSora [ 69 ] , while the second row shows features from CogVideoX [ 24 ] . For clarity, only selected layers are highlighted.

		CelebV-Text					UCF101
Model	Method	ISM $\downarrow$	C-FIQA $\downarrow$	Q-A(F) $\downarrow$	Q-A(V) $\downarrow$	DINO $\downarrow$	ISM $\downarrow$	C-FIQA $\downarrow$	Q-A(F) $\downarrow$	Q-A(V) $\downarrow$	DINO $\downarrow$
CogVideoX-5B	Clean	0.721	0.522	0.746	0.802	0.828	0.466	0.373	0.361	0.436	0.801
	SDS+ [ 63 ]	0.591	0.482	0.473	0.563	0.754	0.381	0.291	0.286	0.344	0.754
	SDS- [ 63 ]	0.607	0.497	0.511	0.594	0.747	0.386	0.298	0.313	0.393	0.760
	AdvDM [ 29 ]	0.583	0.473	0.463	0.543	0.748	0.370	0.292	0.271	0.342	0.753
	MIST [ 30 ]	0.561	0.463	0.476	0.577	0.750	0.355	0.290	0.262	0.340	0.751

Table 1: Quantitative comparison of Anti-I2V against baseline protections.

\downarrow

indicates that lower values correspond to poorer video quality and thus stronger protection. The best scores are highlighted in bold , while the second-best results are underlined .

Figure 3: Quanlitative comparison of Anti-I2V against baseline protections against different video generation models on UCF101. The columns present the generated outputs from the models under different adversarial attack methods.

	CogVideoX-5B [ 24 ] - OpenSora 1.2 [ 69 ]					CogVideoX-5B [ 24 ] - DynamiCrafter [ 61 ]
Method	ISM $\downarrow$	C-FIQA $\downarrow$	Q-A(F) $\downarrow$	Q-A(V) $\downarrow$	DINO $\downarrow$	ISM $\downarrow$	C-FIQA $\downarrow$	Q-A(F) $\downarrow$	Q-A(V) $\downarrow$	DINO $\downarrow$
SDS+ [ 63 ]	0.606	0.493	0.514	0.582	0.764	0.309	0.428	0.432	0.519	0.614
SDS- [ 63 ]	0.568	0.504	0.563	0.641	0.757	0.286	0.422	0.493	0.579	0.664
AdvDM [ 29 ]	0.608	0.491	0.506	0.593	0.754	0.337	0.428	0.389	0.511	0.631
MIST [ 30 ]	0.547	0.490	0.522	0.636	0.726	0.289	0.440	0.384	0.518	0.633
VGMShield [ 43 ]	0.566	0.503	0.548	0.632	0.751	0.322	0.462	0.387	0.504	0.688

Table 2: Quantitative comparison of Anti-I2V against baseline video protection methods. Lower values indicate stronger protection (poorer video quality). Best scores are bold , second-best are underlined .

Method	ISM $\downarrow$	Q-A (F) $\downarrow$	Q-A (V) $\downarrow$	DINO-SIM $\downarrow$
Ours (RGB)	0.55	0.50	0.58	0.76
+ DiffPure [ 39 ]	0.33 (-0.22)	0.49 (-0.01)	0.59 (+0.01)	0.74 (-0.02)
+ GrIDPure [ 68 ]	0.60 (+0.05)	0.70 (+0.20)	0.75 (+0.17)	0.84 (+0.08)
+ Impress [ 6 ]	0.58 (+0.03)	0.52 (+0.02)	0.61 (+0.03)	0.76 (-0.00)
+ JPEG Compression	0.57 (+0.02)	0.51 (+0.01)	0.58 (-0.00)	0.78 (+0.02)
+ Gaussian Blur	0.63 (+0.08)	0.43 (-0.07)	0.51 (-0.07)	0.80 (+0.04)

Table 3: Quantitative results against various transformations and purifications. Green indicates degrees of improvements, while Red indicates degrees of performance drop.

Method	ISM $\downarrow$	Q-A (F) $\downarrow$	Q-A (V) $\downarrow$	DINO-SIM $\downarrow$
RGB	0.582	0.624	0.692	0.788
$L^{}a^{}b^{*}$	0.672	0.707	0.765	0.833
Frequency	0.633	0.576	0.641	0.802
RGB + $L^{}a^{}b^{*}$	0.613	0.525	0.618	0.784
RGB + Frequency	0.587	0.567	0.645	0.796
$L^{}a^{}b^{*}$ + Frequency (DSP)	0.582	0.521	0.610	0.781

Table 4: Quantitative results of perturbation optimization spaces.

Budget	ISM $\downarrow$	C-FIQA $\downarrow$	Q-A (F) $\downarrow$	Q-A (V) $\downarrow$	DINO $\downarrow$
$8/255$	0.469	0.456	0.485	0.567	0.775
$16/255$	0.462	0.448	0.481	0.562	0.760
$32/255$	0.473	0.468	0.491	0.588	0.775

Table 5: Analysis of perturbation budget for

L^{*}a^{*}b^{*}

space.

	CogVideoX-5B - Wan2.2-TI2V-5B
Method	ISM $\downarrow$	C-FIQA $\downarrow$	Q-A(F) $\downarrow$	Q-A(V) $\downarrow$	DINO $\downarrow$
Clean	0.672	0.517	0.841	0.899	0.815
SDS+	0.538	0.478	0.512	0.622	0.741
SDS-	0.608	0.504	0.573	0.667	0.766
AdvDM	0.544	0.456	0.528	0.624	0.743
MIST	0.635	0.476	0.574	0.678	0.790

Table 6: Quantitative comparison of transferbility from CogVideoX-5B to Wan2.2-TI2V-5B.

Loss Type	ISM $\downarrow$	Q-A (F) $\downarrow$	Q-A (V) $\downarrow$	DINO $\downarrow$
[A1] : Denoising Loss	0.582	0.521	0.610	0.781
[A2] : [A1] + IRC	0.535	0.518	0.607	0.776
[A3] : [A1] + IRA-VAE (U)	0.514	0.507	0.583	0.774
[A4] : [A1] + IRA-VAE (T)	0.507	0.503	0.580	0.771
[A5] : [A1] + IRA-Denoiser (U)	0.507	0.486	0.572	0.775
[A6] : [A1] + IRA-Denoiser (T)	0.493	0.484	0.575	0.772

Table 7: Ablation Study of Loss Components : Comparison of different loss components on performance metrics. (U) denotes untargeted attack, while (T) denotes targeted attack.

Setting	ISM $\downarrow$	Q-A (F) $\downarrow$	Q-A (V) $\downarrow$	DINO $\downarrow$
Full (27+)	0.458	0.479	0.560	0.762
Last-3	0.462	0.481	0.562	0.760
Last-1	0.460	0.486	0.565	0.762
Last-2	0.460	0.487	0.568	0.767
Last-4	0.470	0.489	0.570	0.764

Table 8: Ablation on IRC Layer Selection . We compare applying IRC to different subsets of layers. Full applies IRC to all layers after the 27 th layer. Last-

k

applies IRC only to the final

k

layers. Bold indicates the best performance, and underline indicates the second best.

Method	Metric $\downarrow$	Clean	Anti-I2V
CogVideoX [ 24 ]	ISM	0.646	0.407
	C-FIQA	0.519	0.462
	Q-A (Frame)	0.771	0.474
	Q-A (Video)	0.825	0.553
	DINO	0.869	0.776
DynamiCrafter [ 61 ]	ISM	0.558	0.208

Table 9: Quantitative comparisons of protections with different set of prompts.

\downarrow

indicates that a lower value of the metric signifies poorer video quality and thus better protection.

Method	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$
SDS (+)	0.84	0.206	32.5
SDS (-)	0.86	0.192	33.7
AdvDM	0.84	0.205	32.6
MIST	0.82	0.271	31.4
VGMShield	0.84	0.191	33.2
Ours	0.80	0.200	32.2

Table 10: Ablation Study of Perturbation Visibility : Similarity metrics between perturbed images and their original images of different methods.

Figure 4: Qualitative comparison of adversarial attack methods against against CogVideoX [ 24 ] . The first column shows the reference frame. The remaining columns present the generated outputs from models.

Figure 5: Qualitative comparison of adversarial attack methods against against CogVideoX [ 24 ] . The first column shows the reference frame. The remaining columns present the generated outputs from models.

Figure 6: Qualitative comparison of adversarial attack methods against against DynamiCrafter [ 61 ] . The first column shows the reference frame. The remaining columns present the generated outputs from models.

Figure 7: Qualitative comparison of adversarial attack methods against against DynamiCrafter [ 61 ] . The first column shows the reference frame. The remaining columns present the generated outputs from models.

Image-to-Video Generation

Image-to-video generation creates coherent moving clips from still images, guided by learned models and controls such as motion, camera, or text.

See all 93 papers

I2VShield: An Efficient Proactive Defense Framework against DiT-based Image-to-Video Models
Jul 28, 2026Yimao Guo, Zuomin Qu, Wei LuImage-to-Video Generation Adversarial Attacks
School of Computer Science and Engineering, Sun Yat-sen University Ministry of Education Key Laboratory of Information Technology Guangdong Province Key Laboratory of Information Security Technology Guangzhou 510006, China · Guangdong Province Key Laboratory of Information Security Technology Guangzhou 510006, China · State Key Laboratory of HVDC, China Southern Power Grid Electric Power Research Institute
Immune2V: Image Immunization Against Dual-Stream Image-to-Video Generation
Apr 12, 2026Zeqian Long, Ozgur Kara, Haotian Xue +2Image-to-Video Generation
University of Illinois Urbana-Champaign · Georgia Institute of Technology
LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Oct 9, 2026Boheng Li, Yueming Xing, Yiming Li +2Image-to-Video Generation Adversarial Examples
Nanyang Technological University · Wuhan University · SiliconProspect AI

Jul 28, 2026J/K move · Enter open · S save

I2VShield: An Efficient Proactive Defense Framework against DiT-based Image-to-Video Models

Yimao Guo, Zuomin Qu, Wei Lu

School of Computer Science and Engineering, Sun Yat-sen University Ministry of Education Key Laboratory of Information Technology Guangdong Province Key Laboratory of Information Security Technology Guangzhou 510006, China · Guangdong Province Key Laboratory of Information Security Technology Guangzhou 510006, China · State Key Laboratory of HVDC, China Southern Power Grid Electric Power Research Institute

Image-to-Video Generation Adversarial Attacks Adversarial Examples Attention-Based Adversarial Attacks

Open paper AskPDF arXiv

The rapid advancement of video generation models has led to the increasing misuse of image-to-video (I2V) models. Although substantial progress has been made in detecting AI-generated videos, proactive defenses against I2V models remain underexplored. In particular, current proactive defenses against I2V models predominantly rely on gradient-based adversarial attacks, which require defenders to possess GPUs with substantial memory resources (VRAM) to generate adversarial examples. To address this issue, we propose I2VShield, a privacy protection method based on generative adversarial attacks tailored to Diffusion Transformer (DiT)-based I2V models. The proposed method primarily consists of two components: (1) a text-adaptive perturbation generation framework integrating adversarial learning to mitigate computational overhead while maintaining visual imperceptibility; and (2) an untargeted Multimodal Attention Disruption (MAD) attack that exploits the inherent vulnerabilities of DiT-based I2V models, maximizing the deviation of the internal attention features from their clean states. Extensive experiments demonstrate that our approach achieves highly competitive protection performance across various datasets and mainstream DiT-based I2V models, particularly in disrupting spatiotemporal coherence, while substantially reducing computational costs.

Abstract

Image-to-Video Generation

Explore similar work

I2VShield: An Efficient Proactive Defense Framework against DiT-based Image-to-Video Models

Immune2V: Image Immunization Against Dual-Stream Image-to-Video Generation

LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse