Image-to-video (I2V) generation models can be misused to animate a single image into a convincing fake video, motivating perturbation-based image protection methods that aim to disrupt such generation. Yet these methods remain difficult to compare: they are reported under inconsistent metrics and generation settings, are often validated only on the single generator they were optimized against, and are evaluated on narrow, single-domain image sets that do not reflect real misuse. To address these challenges, we introduce IPV-Bench (Image Protection against Video generation), the first systematic benchmark for image protection in I2V generation scenarios. IPV-Bench couples a unified protocol that jointly scores protection effectiveness, visual fidelity, and robustness to preprocessing attacks together with IPV-500, a prompt-paired dataset spanning five misuse-relevant domains. Based on this benchmark, we evaluate five representative protection methods across four I2V models covering distinct architectures and both open-source and commercial systems. Extensive experiments show a consistently sobering picture: image protection and video disruption trade off against each other, most methods fail to disrupt generation beyond noise, protection rarely transfers across generators, and the few effective cases are broken by simple preprocessing. We further find that image content governs the perceptual cost of protection but not its benefit: no image domain offers an easier target. Overall, IPV-Bench provides a rigorous, reproducible, and extensible foundation for developing protection methods that work in practice.
Figures & tables
Figure 1: Overview of IPV-Bench. The data-curation pipeline is expanded on the left part of the figure: each image passes a VLM quality-screening gate, is paired with a motion-oriented prompt from multiple VLMs, filtered by automatic quality gates, and finalized by human adjudication, yielding IPV-500. The right part shows the evaluation flow: a protection method perturbs each image, an adversary may preprocess it, and I2V models generate videos, which are scored on fidelity, effectiveness, and robustness.
Figure 2: The IPV-500 dataset. (a) Domain distribution across five misuse-relevant categories (100 images each): faces, artworks, natural scenes, objects, and animals. (b) Resolution distribution: 81% of images are square (448 × 448); the remainder are landscape or portrait, obtained by short-side resizing to preserve aspect ratio. (c) Prompt word-count distribution for the 500 motion-oriented video prompts: each image is captioned by three VLMs (Qwen3-VL-4B, Qwen2.5-VL-7B, InternVL2-4B) and the best-scoring candidate is selected via CLIP-alignment, coherence, and inter-prompt diversity scoring. Mean 36 words, range 22–65.
Method
PSNR ↑
SSIM ↑
LPIPS ↓
CLIP-I ↑
PhotoGuard
31.9
0.819
0.200
0.950
Mist
27.1
0.713
0.358
0.897
I2VGuard
35.1
0.929
0.093
0.967
VGMShield
31.8
0.812
0.243
0.929
EditShield
34.3
0.870
0.180
0.961
RandomNoise
28.9
0.688
0.196
0.963
Table 1: Image fidelity of protected images (model-independent). Arrows mark the imperceptible direction.
Wan
SkyReel
SVD
Seedance
Method
FVD ↑
VB ↑
CT ↑
FVD ↑
VB ↑
CT ↑
FVD ↑
VB ↑
CT ↑
FVD ↑
VB ↑
CT ↑
PhotoGuard
3.8
+0.67
− 0.4
4.9
+0.49
− 0.2
4.6
+0.94
+0.8
5.2
+0.56
− 0.5
Mist
8.5
+3.40
+0.4
5.9
+1.04
− 0.1
8.5
+2.14
+4.7
5.7
+1.26
− 1.0
I2VGuard
7.3
+2.61
+3.3
4.4
+0.21
− 0.1
4.3
+0.57
+1.1
5.2
+0.31
− 0.5
VGMShield
4.6
+0.71
− 0.3
5.2
+0.64
+0.2
5.6
+1.08
+2.1
5.3
+0.80
− 0.8
EditShield
3.2
+0.09
+0.1
4.6
+0.30
− 0.1
4.4
+0.52
+0.2
5.3
+0.50
− 0.7
Table 2: Protection effectiveness per I2V model under a unified L∞=16/255 budget. All three metrics are degradation rates where higher = stronger protection ( ↑ ): FVD; scale-normalized VBench degradation VB (std. units); CLIP-T degradation CT (%). A value ≤0 means no degradation. Bold marks entries above the corresponding reference: FVD above the per-model noise floor ( floor row, § 3.4 ); VB and CT above the RandomNoise baseline. Seedance is a commercial black-box API.
Figure 3: The fidelity–effectiveness trade-off. Methods that preserve the image barely disrupt generation, and the only disruptive method sacrifices fidelity.
Figure 4: Image content shapes the cost of protection, not its benefit. (a) Perturbation visibility (LPIPS, averaged over methods) rises from dense, high-frequency domains (artworks) to smooth, low-frequency ones (natural scenes), and every method follows the same ordering. (b) The three effectiveness metrics rank the five domains inconsistently (crossing lines): CLIP-T ranks faces first, VBench natural scenes, FVD objects. The per-domain FVD ordering is reproduced almost exactly by a null-protection method, so it tracks intrinsic domain diversity rather than protection. Effectiveness magnitudes are near-zero throughout (CLIP-T degradation ≤1% in every domain).
Figure 5: Protection does not generalize across generators. Effectiveness above the noise floor is a scattered, model-specific accident, uncorrelated with each method’s design target.
Figure 6: Effective protection is rare and brittle (high-motion subset, N=150 ). On Wan and SVD, the only two models where any method clears the noise floor (dashed line), Mist is the sole method with measurable clean-setting effect, and its protection on SVD collapses below the floor under all three preprocessing variants. I2VGuard on Wan is more resilient but still the exception rather than the rule.
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
Domain
Source corpus
Content
Aspect handling
Faces
FFHQ [ 16 ]
Human portraits
center-crop square
Artworks
[ 41 ]
Paintings, drawings
center-crop square
Natural scenes
LHQ [ 33 ]
Landscapes
short-side resize
Objects
MS-COCO [ 20 ]
Everyday object scenes
short-side resize
Animals
AFHQ-v2 [ 8 ]
Animal faces
center-crop square
Appendix
Table 3: Source corpora for the five IPV-500 domains. Each domain contributes exactly 100 images.
Table 4: Per-model I2V generation configuration. Duration is computed as frames / fps.
Method
Faces
Artworks
Nat. scenes
Objects
Animals
PSNR ↑
PhotoGuard
32.0
31.8
32.0
31.9
31.9
Mist
27.9
27.0
27.1
26.1
27.6
I2VGuard
36.6
34.3
34.6
33.8
36.0
VGMShield
32.0
31.8
32.1
31.1
31.9
EditShield
34.0
34.4
34.4
34.4
34.2
Appendix
Table 5: Per-domain image fidelity (model-independent, ϵ=16/255 ). Each block is one metric; columns are the five IPV-500 domains.
Method
Faces
Artworks
Nat. scenes
Objects
Animals
CLIP-T degradation rate (%)
PhotoGuard
+0.63
+0.05
-0.65
-0.58
+0.49
Mist
+1.22
+1.55
+1.77
+0.04
+1.17
I2VGuard
+1.39
+1.18
+0.85
+0.24
+1.39
VGMShield
+0.97
+0.53
+0.02
-0.43
+0.82
EditShield
+0.70
-0.55
-0.12
-0.54
-0.00
Appendix
Table 6: Per-domain protection effectiveness , averaged over the four I2V models. CLIP-T degradation rate (%, higher = stronger) uses the paper’s (Sorig−Sprot)/Sorig definition. FVD, being a distributional metric, does not aggregate to the 500-image FVD and is confounded by intrinsic domain diversity (§Finding 2); it is listed per domain for completeness only.
Domain
Subj. cons.
Bkg. cons.
Motion
Aesth.
Imaging
Temp. flk.
Faces
+2.93
+2.09
+0.28
+2.86
+5.30
+0.21
Artworks
+3.11
+1.52
+0.33
+6.96
+7.65
+0.27
Nat. scenes
+2.29
+1.55
+0.15
+9.56
+8.01
+0.02
Objects
+1.75
+1.73
+0.02
+4.27
+7.17
-0.02
Animals
+2.33
+1.49
+0.24
+3.60
+4.49
+0.16
Appendix
Table 7: Per-domain VBench degradation by dimension (%, higher = stronger protection), averaged over all methods and models. This is the dimension-level breakdown aggregated into the VB column of Table 2 .
Model
Method
Subj. cons.
Bkg. cons.
Motion
Aesth.
Imaging
Temp. flk.
Wan
PhotoGuard
+1.02
+0.36
+0.14
+7.05
+7.88
+0.06
Mist
+7.21
+3.60
+1.45
+17.53
+20.56
+2.20
I2VGuard
+4.36
+3.04
+1.18
+19.91
+7.79
+2.10
VGMShield
+0.88
+0.14
+0.10
+8.60
+9.65
+0.03
EditShield
-0.06
-0.17
-0.06
+3.30
+3.38
-0.25
SkyReel
PhotoGuard
+1.74
+1.89
-0.08
+2.00
+3.23
-0.29
Appendix
Table 8: VBench degradation by dimension, per method and model (%, higher = stronger protection; full 500-image set). This un-aggregates the scale-normalized VB column of Table 2 into its six raw VBench dimensions.
Asset
Type
License
FFHQ
Dataset
Creative Commons BY-NC-SA / public-domain subsets
WikiArt
Dataset
Research use (per-artwork terms)
LHQ
Dataset
Research use
MS-COCO
Dataset
Creative Commons BY 4.0
AFHQ-v2
Dataset
Creative Commons BY-NC 4.0
Qwen3-VL / Qwen2.5-VL
Model
Apache-2.0
Appendix
Table 9: Licenses of datasets, models, and method implementations used in IPV-Bench.
Image-to-video (I2V) diffusion models can animate a single reference image into high-quality, subject-consistent videos, posing threats of misuse as anyone can turn personal photos into fabricated videos without consent. A promising solution is to proactively add an adversarial perturbation to the image before release, such that videos generated from it would be unfaithful or visually corrupted. However, due to an insufficient understanding of what governs how subsequent frames read the reference image in modern I2V models, existing protections struggle to offer strong protection under common perturbation budgets. In this paper, we approach the problem by exploring this underlying reading mechanism. Through a convex geometric analysis, we theoretically identify the spread of the reference value vectors as a key factor governing this reading process, and empirically find that even a mild contraction of this spread can severely degrade the generated video, making it an efficient lever for protection. Guided by this insight, we propose LETHE, a novel protection method that directly disrupts this reading process. LETHE pairs two complementary objectives, where a value collapse objective drives the reference value vectors toward uniformity, while an attention attraction objective draws subsequent frames toward these collapsed tokens to amplify corruption. We further construct two human-centric I2V protection benchmarks and conduct extensive experiments with multiple modern I2V models, which demonstrate the state-of-the-art protection performance and versatility of LETHE.
Boheng Li, Yueming Xing, Yiming Li +2
Nanyang Technological University · Wuhan University · SiliconProspect AI
Recent advances in Image-to-Video generation allow a single image to be animated into a convincing video under text guidance, raising serious copyright and privacy risks. We propose Anti-Prompt, an image protection approach that injects imperceptible perturbations into an image, inducing visible inconsistencies and structural failures in text-guided I2V generation. Our method is motivated by a simple empirical observation. When text guidance is removed from modern I2V models, generation quality degrades markedly, not only in motion realism but also in subject preservation, structural coherence, and temporal consistency. Building on this insight, Anti-Prompt exploits the model reliance on textual guidance by attenuating text-conditioned interactions during denoising while strengthening visual-only pathways. To further systematically evaluate protection effectiveness, we introduce a Video-LLM-assisted evaluation protocol that provides interpretable, frame-grounded analyses of generation artifacts and inconsistencies. Experiments on two representative I2V architectures demonstrate that our method achieves strong protection performance while improving efficiency and cross-model transferability.
Recent advancements in Image-to-Video (I2V) generation have transformed input images from simple appearance references into interactive control interfaces where visual cues such as arrows, sketches, and emojis orchestrate complex video dynamics with unprecedented controllability. However, these seemingly innocuous static cues can be interpreted by models as executable temporal instructions, unfolding into harmful actions in the generated videos. Despite the severity of this threat, existing safety benchmarks remain predominantly focused on text-based and content-only image-based jailbreaks, leaving implicit visual prompt attacks insufficiently explored. To bridge this gap, we present VVA-Bench, the first systematic benchmark for evaluating video generation safety under categorized vision-centric prompt attacks. Extensive experiments on VVA-Bench demonstrate that state-of-the-art models are highly susceptible to such attacks, with Attack Success Rates (ASR) reaching 100.0% on Wan 2.7 and 74.8% on Veo 3.1. To mitigate these risks, we propose VPA-Guard, a retrieval-augmented and self-evolving defense framework. By leveraging few-shot reasoning to identify latent malicious intents, our method reduces the attack ASR by 44.2% and the harmfulness score by 73.4% on average, while maintaining the model's utility for legitimate user edits. Our work provides both a rigorous benchmark and an effective defense strategy to advance safe and socially responsible multimodal generation.
Yining Sun, Haoyu Kang, Jiajun Wu +7
1Tsinghua University · 3Central South University · 4South China Normal University +3