IPV-Bench: Benchmarking Image Protection Methods under Diverse Image-to-Video Generation Scenarios

Xiaofeng Li; Leyi Sheng; Yifan Zhao; Zhen Sun; Zongmin Zhang; Jiaheng Wei; Xinlei He

cs.CVMar 27, 2026

IPV-Bench: Benchmarking Image Protection Methods under Diverse Image-to-Video Generation Scenarios

Authors: Xiaofeng Li, Leyi Sheng, Yifan Zhao, Zhen Sun, Zongmin Zhang, Jiaheng Wei, Xinlei He

Organizations: The Hong Kong University of Science and Technology (Guangzhou) · Wuhan University

Abstract

Image-to-video (I2V) generation models can be misused to animate a single image into a convincing fake video, motivating perturbation-based image protection methods that aim to disrupt such generation. Yet these methods remain difficult to compare: they are reported under inconsistent metrics and generation settings, are often validated only on the single generator they were optimized against, and are evaluated on narrow, single-domain image sets that do not reflect real misuse. To address these challenges, we introduce IPV-Bench (Image Protection against Video generation), the first systematic benchmark for image protection in I2V generation scenarios. IPV-Bench couples a unified protocol that jointly scores protection effectiveness, visual fidelity, and robustness to preprocessing attacks together with IPV-500, a prompt-paired dataset spanning five misuse-relevant domains. Based on this benchmark, we evaluate five representative protection methods across four I2V models covering distinct architectures and both open-source and commercial systems. Extensive experiments show a consistently sobering picture: image protection and video disruption trade off against each other, most methods fail to disrupt generation beyond noise, protection rarely transfers across generators, and the few effective cases are broken by simple preprocessing. We further find that image content governs the perceptual cost of protection but not its benefit: no image domain offers an easier target. Overall, IPV-Bench provides a rigorous, reproducible, and extensible foundation for developing protection methods that work in practice.

Figures & tables

Figure 1: Overview of IPV-Bench. The data-curation pipeline is expanded on the left part of the figure: each image passes a VLM quality-screening gate, is paired with a motion-oriented prompt from multiple VLMs, filtered by automatic quality gates, and finalized by human adjudication, yielding IPV-500. The right part shows the evaluation flow: a protection method perturbs each image, an adversary may preprocess it, and I2V models generate videos, which are scored on fidelity, effectiveness, and robustness.

Figure 2: The IPV-500 dataset. (a) Domain distribution across five misuse-relevant categories (100 images each): faces, artworks, natural scenes, objects, and animals. (b) Resolution distribution: 81% of images are square (448 $\times$ 448); the remainder are landscape or portrait, obtained by short-side resizing to preserve aspect ratio. (c) Prompt word-count distribution for the 500 motion-oriented video prompts: each image is captioned by three VLMs (Qwen3-VL-4B, Qwen2.5-VL-7B, InternVL2-4B) and the best-scoring candidate is selected via CLIP-alignment, coherence, and inter-prompt diversity scoring. Mean 36 words, range 22–65.

Method	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	CLIP-I $\uparrow$
PhotoGuard	31.9	0.819	0.200	0.950
Mist	27.1	0.713	0.358	0.897
I2VGuard	35.1	0.929	0.093	0.967
VGMShield	31.8	0.812	0.243	0.929
EditShield	34.3	0.870	0.180	0.961
RandomNoise	28.9	0.688	0.196	0.963

Table 1: Image fidelity of protected images (model-independent). Arrows mark the imperceptible direction.

	Wan			SkyReel			SVD			Seedance
Method	FVD $\uparrow$	VB $\uparrow$	CT $\uparrow$	FVD $\uparrow$	VB $\uparrow$	CT $\uparrow$	FVD $\uparrow$	VB $\uparrow$	CT $\uparrow$	FVD $\uparrow$	VB $\uparrow$	CT $\uparrow$
PhotoGuard	3.8	+0.67	$-$ 0.4	4.9	+0.49	$-$ 0.2	4.6	+0.94	+0.8	5.2	+0.56	$-$ 0.5
Mist	8.5	+3.40	+0.4	5.9	+1.04	$-$ 0.1	8.5	+2.14	+4.7	5.7	+1.26	$-$ 1.0
I2VGuard	7.3	+2.61	+3.3	4.4	+0.21	$-$ 0.1	4.3	+0.57	+1.1	5.2	+0.31	$-$ 0.5
VGMShield	4.6	+0.71	$-$ 0.3	5.2	+0.64	+0.2	5.6	+1.08	+2.1	5.3	+0.80	$-$ 0.8
EditShield	3.2	+0.09	+0.1	4.6	+0.30	$-$ 0.1	4.4	+0.52	+0.2	5.3	+0.50	$-$ 0.7

Table 2: Protection effectiveness per I2V model under a unified

L_{\infty}=16/255

budget. All three metrics are degradation rates where higher

=

stronger protection (

\uparrow

): FVD; scale-normalized VBench degradation VB (std. units); CLIP-T degradation CT (%). A value

{\leq}0

means no degradation. Bold marks entries above the corresponding reference: FVD above the per-model noise floor ( floor row, § 3.4 ); VB and CT above the RandomNoise baseline. Seedance is a commercial black-box API.

Figure 3: The fidelity–effectiveness trade-off. Methods that preserve the image barely disrupt generation, and the only disruptive method sacrifices fidelity.

Figure 4: Image content shapes the cost of protection, not its benefit. (a) Perturbation visibility (LPIPS, averaged over methods) rises from dense, high-frequency domains (artworks) to smooth, low-frequency ones (natural scenes), and every method follows the same ordering. (b) The three effectiveness metrics rank the five domains inconsistently (crossing lines): CLIP-T ranks faces first, VBench natural scenes, FVD objects. The per-domain FVD ordering is reproduced almost exactly by a null-protection method, so it tracks intrinsic domain diversity rather than protection. Effectiveness magnitudes are near-zero throughout (CLIP-T degradation

\leq 1\%

in every domain).

Figure 5: Protection does not generalize across generators. Effectiveness above the noise floor is a scattered, model-specific accident, uncorrelated with each method’s design target.

Figure 6: Effective protection is rare and brittle (high-motion subset,

N{=}150

). On Wan and SVD, the only two models where any method clears the noise floor (dashed line), Mist is the sole method with measurable clean-setting effect, and its protection on SVD collapses below the floor under all three preprocessing variants. I2VGuard on Wan is more resilient but still the exception rather than the rule.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Domain	Source corpus	Content	Aspect handling
Faces	FFHQ [ 16 ]	Human portraits	center-crop square
Artworks	[ 41 ]	Paintings, drawings	center-crop square
Natural scenes	LHQ [ 33 ]	Landscapes	short-side resize
Objects	MS-COCO [ 20 ]	Everyday object scenes	short-side resize
Animals	AFHQ-v2 [ 8 ]	Animal faces	center-crop square

Appendix

Table 3: Source corpora for the five IPV-500 domains. Each domain contributes exactly 100 images.

Panel of Figure 7 — Figure 7: Representative IPV-500 image–prompt pairs (image left, model-generated prompt right). Prompts emphasize motion and environment dynamics, modeling a misuse-minded I2V user.

Model	Checkpoint	Frames	Resolution	Steps	CFG	FPS	Duration	Access
Wan2.2-TI2V-5B	Wan2.2-TI2V-5B	41	$704{\times}1280$	30	5.0	16	2.6 s	open
SkyReels-V2-I2V	SkyReels-V2-I2V-1.3B-540P	49	$544{\times}960$	30	6.0	8	6.1 s	open
SVD-XT	stable-video-diffusion-img2vid-xt	25	$576{\times}1024$	30	1.0	8	3.1 s	open
Seedance 1.5 Pro	doubao-seedance-1-5-pro (API)	97	$480{\times}848$	–	–	24	4.0 s	black-box

Appendix

Table 4: Per-model I2V generation configuration. Duration is computed as frames / fps.

PSNR $\uparrow$
Method	Faces	Artworks	Nat. scenes	Objects	Animals
PhotoGuard	32.0	31.8	32.0	31.9	31.9
Mist	27.9	27.0	27.1	26.1	27.6
I2VGuard	36.6	34.3	34.6	33.8	36.0
VGMShield	32.0	31.8	32.1	31.1	31.9
EditShield	34.0	34.4	34.4	34.4	34.2

Appendix

Table 5: Per-domain image fidelity (model-independent,

\epsilon{=}16/255

). Each block is one metric; columns are the five IPV-500 domains.

CLIP-T degradation rate (%)
Method	Faces	Artworks	Nat. scenes	Objects	Animals
PhotoGuard	+0.63	+0.05	-0.65	-0.58	+0.49
Mist	+1.22	+1.55	+1.77	+0.04	+1.17
I2VGuard	+1.39	+1.18	+0.85	+0.24	+1.39
VGMShield	+0.97	+0.53	+0.02	-0.43	+0.82
EditShield	+0.70	-0.55	-0.12	-0.54	-0.00

Appendix

Table 6: Per-domain protection effectiveness , averaged over the four I2V models. CLIP-T degradation rate (%, higher

=

stronger) uses the paper’s

(S_{\text{orig}}-S_{\text{prot}})/S_{\text{orig}}

definition. FVD, being a distributional metric, does not aggregate to the 500-image FVD and is confounded by intrinsic domain diversity (§Finding 2); it is listed per domain for completeness only.

Domain	Subj. cons.	Bkg. cons.	Motion	Aesth.	Imaging	Temp. flk.
Faces	+2.93	+2.09	+0.28	+2.86	+5.30	+0.21
Artworks	+3.11	+1.52	+0.33	+6.96	+7.65	+0.27
Nat. scenes	+2.29	+1.55	+0.15	+9.56	+8.01	+0.02
Objects	+1.75	+1.73	+0.02	+4.27	+7.17	-0.02
Animals	+2.33	+1.49	+0.24	+3.60	+4.49	+0.16

Appendix

Table 7: Per-domain VBench degradation by dimension (%, higher

=

stronger protection), averaged over all methods and models. This is the dimension-level breakdown aggregated into the VB column of Table 2 .

Model	Method	Subj. cons.	Bkg. cons.	Motion	Aesth.	Imaging	Temp. flk.
Wan	PhotoGuard	+1.02	+0.36	+0.14	+7.05	+7.88	+0.06
	Mist	+7.21	+3.60	+1.45	+17.53	+20.56	+2.20
	I2VGuard	+4.36	+3.04	+1.18	+19.91	+7.79	+2.10
	VGMShield	+0.88	+0.14	+0.10	+8.60	+9.65	+0.03
	EditShield	-0.06	-0.17	-0.06	+3.30	+3.38	-0.25
SkyReel	PhotoGuard	+1.74	+1.89	-0.08	+2.00	+3.23	-0.29

Appendix

Table 8: VBench degradation by dimension, per method and model (%, higher

=

stronger protection; full 500-image set). This un-aggregates the scale-normalized VB column of Table 2 into its six raw VBench dimensions.

Asset	Type	License
FFHQ	Dataset	Creative Commons BY-NC-SA / public-domain subsets
WikiArt	Dataset	Research use (per-artwork terms)
LHQ	Dataset	Research use
MS-COCO	Dataset	Creative Commons BY 4.0
AFHQ-v2	Dataset	Creative Commons BY-NC 4.0
Qwen3-VL / Qwen2.5-VL	Model	Apache-2.0

Appendix

Table 9: Licenses of datasets, models, and method implementations used in IPV-Bench.

Adversarial Examples

Adversarial examples are inputs crafted to cause machine-learning models to misclassify, misperceive, or generate unsafe outputs.

See all 76 papers

LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Oct 9, 2026Boheng Li, Yueming Xing, Yiming Li +2Image-to-Video Generation Adversarial Examples
Nanyang Technological University · Wuhan University · SiliconProspect AI
Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation
Jul 1, 2026Yeonghwan Song, Chanhui Lee, Jinsoo Park +1Image-to-Video Generation Adversarial Examples
GIST · POSTECH
VPA-Guard: Defending and Benchmarking Image-to-Video Generation Against Visual Prompt Attacks
Jun 24, 2026Yining Sun, Haoyu Kang, Jiajun Wu +7Image-to-Video Generation Video Generation
1Tsinghua University · 3Central South University · 4South China Normal University +3

Oct 9, 2026J/K move · Enter open · S save

LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse

Boheng Li, Yueming Xing, Yiming Li, Jie Zhang+1

Nanyang Technological University · Wuhan University · SiliconProspect AI

Image-to-Video Generation Adversarial Examples Video Diffusion Models

Open paper AskPDF arXiv

Image-to-video (I2V) diffusion models can animate a single reference image into high-quality, subject-consistent videos, posing threats of misuse as anyone can turn personal photos into fabricated videos without consent. A promising solution is to proactively add an adversarial perturbation to the image before release, such that videos generated from it would be unfaithful or visually corrupted. However, due to an insufficient understanding of what governs how subsequent frames read the reference image in modern I2V models, existing protections struggle to offer strong protection under common perturbation budgets. In this paper, we approach the problem by exploring this underlying reading mechanism. Through a convex geometric analysis, we theoretically identify the spread of the reference value vectors as a key factor governing this reading process, and empirically find that even a mild contraction of this spread can severely degrade the generated video, making it an efficient lever for protection. Guided by this insight, we propose LETHE, a novel protection method that directly disrupts this reading process. LETHE pairs two complementary objectives, where a value collapse objective drives the reference value vectors toward uniformity, while an attention attraction objective draws subsequent frames toward these collapsed tokens to amplify corruption. We further construct two human-centric I2V protection benchmarks and conduct extensive experiments with multiple modern I2V models, which demonstrate the state-of-the-art protection performance and versatility of LETHE.

Abstract

Adversarial Examples

Explore similar work

LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse

Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation

VPA-Guard: Defending and Benchmarking Image-to-Video Generation Against Visual Prompt Attacks