Image-to-video (I2V) generation has the potential for societal harm because it enables the unauthorized animation of static images to create realistic deepfakes. While existing defenses effectively protect against static image manipulation, extending these to I2V generation remains underexplored and non-trivial. In this paper, we systematically analyze why modern I2V models are highly robust against naive image-level adversarial attacks (i.e., immunization). We observe that the video encoding process rapidly dilutes the adversarial noise across future frames, and the continuous text-conditioned guidance actively overrides the intended disruptive effect of the immunization. Building on these findings, we propose the Immune2V framework which enforces temporally balanced latent divergence at the encoder level to prevent signal dilution, and aligns intermediate generative representations with a precomputed collapse-inducing trajectory to counteract the text-guidance override. Extensive experiments demonstrate that Immune2V produces substantially stronger and more persistent degradation than adapted image-level baselines under the same imperceptibility budget.
Figures & tables
Figure 2: Immunization on Dual-Stream I2V Architecture. A clean input image , guides the generation process through i) a spatial-temporal stream , where the image is processed through a video encoder to initialize the structural latent space, and ii) a semantic stream , where an image encoder extracts high-level embeddings for continuous semantic guidance. While these streams normally generate a realistic video conditioned on an input image, injecting an adversarial perturbation yields an immunized image that simultaneously disrupts both conditioning streams, forcing the generation process into structural collapse.
Figure 3: Temporal Attenuation. Standard image-level attacks fail because their influence vanishes rapidly across the zero-padded temporal segments during both forward and backward propagation. Our temporally-balanced approach overcomes this by actively enforcing persistent corruption across the entire temporal axis. Due to memory constraints, we compute the gradient for frames 0–12.
Figure 4: Semantic Conditioning Override. We analyze generative trajectories in the noise latent space by measuring semantic distance to a clean baseline ( Clean Image (Good Prompt) ) at each timestep. (a) A mismatched prompt ( Clean Image (Bad Prompt) ) naturally diverges from the baseline (positive slope). (b) An encoder-only spatial attack ( Enc.-Imm. Image (Good Prompt) ) is overridden by the continuous semantic guidance of a good prompt, rapidly pulling the trajectory back toward the clean state (steep negative slope). (c) Our joint approach ( Ours-Imm. Image (Good Prompt) ) actively counteracts the semantic guidance, maintaining a flatter slope and sustaining the disruption across the generative process.
Figure 5: Immune2V Framework. Our method simultaneously targets the spatial-temporal and semantic streams to ensure persistent disruption. The Spatial-Temporal Attack employs a balanced encoder loss and dense targets to recover vanishing optimization signals across temporal segments. The Semantic Attack hijacks DiT guidance by forcing intermediate representations to mimic a precomputed collapse trajectory, neutralizing the model’s iterative semantic correction. Together, these joint perturbations induce severe structural breakdown across the entire generated video.
Table 1: Quantitative comparison. All methods are evaluated under the same perturbation budget. Bold and underline denote the best and second-best results. PIC: Perceptual Image Consistency, TA: Text-Video Alignment, SC: Subject Consistency, MS: Motion Smoothness, AS: Aesthetic Score, FF: First Frame fidelity.
Figure 6: Qualitative Comparisons. A qualitative comparison across baselines, showing the input frame and subsequent video frames. See the Supplementary for full videos.
Figure 7: Additional Qualitative Results. Sampled frames from the generated videos are shown on the left, with zoomed comparisons against the corresponding clean video frames on the right. Full videos are available in Supplementary.
Configuration
Condition Preservation ↓
Video Structural Quality ↓
LST
LSem
ϵ
PIC (%)
Text Align.
Subject Cons. (%)
Motion Smooth. (%)
AS
Ablation on Loss Components (fixed ϵ=32/255 )
✓
✗
32/255
75.86 (+2.28)
29.74 (-0.10)
92.12 (+0.41)
94.04 (+0.62)
4.87 (+0.51)
✗
✓
32/255
82.34 (+8.76)
29.95 (+0.11)
93.68 (+1.97)
94.27 (+0.85)
5.02 (+0.66)
✓
✓
32/255
73.58
29.84
91.71
93.42
4.36
Ablation on Perturbation Budget (fixed LST+LSem )
Table 2: Ablation Study. We ablate individual loss components and noise budgets from our full model. LST : spatial-temporal loss, LSem : semantic loss. All metrics are ↓ (lower is better). Our full model is highlighted in gray and repeated per section. Deltas are relative to our full model: green = improved, red = degraded.
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
Attack Optimization
Generation
Resolution
Frames
PGD Iters
Budget ϵ
Step α
Traj. Length
DiT ( K )
λST
λSem
CFG Scale
Denoising Steps
480×832
17
500
32/255
0.005
25
3
1
0.125
{1,3,5}
25
Appendix
Table 3: Hyperparameters for Immune2V optimization and generation configuration.
Figure 8: Prompt templates used to generate good and bad prompts.
Figure 9: Prompt templates used by VLM Judge for automated pairwise evaluation of generated videos and first-frame image quality.
Figure 10: Clean and attacked video results on DynamiCrafter using Immune2V.
Figure 11: Clean and attacked video results on I2VGen-XL using Immune2V.
Advances in diffusion-based video generation models, while significantly improving human animation, poses threats of misuse through the creation of fake videos from a specific person's photo and text prompts. Recent efforts have focused on adversarial attacks that introduce crafted perturbations to protect images from diffusion-based models. However, most existing approaches target image generation, while relatively few explicitly address image-to-video diffusion models (VDMs), and most primarily focus on UNet-based architectures. Hence, their effectiveness against Diffusion Transformer (DiT) models remains largely under-explored, as these models demonstrate improved feature retention, and stronger temporal consistency due to larger capacity and advanced attention mechanisms. In this work, we introduce Anti-I2V, a novel defense against malicious human image-to-video generation, applicable across diverse diffusion backbones. Instead of restricting noise updates to the RGB space, Anti-I2V operates in both the Lab* and frequency domains, improving robustness and concentrating on salient pixels. We then identify the network layers that capture the most distinct semantic features during the denoising process to design appropriate training objectives that maximize degradation of temporal coherence and generation fidelity. Through extensive validation, Anti-I2V demonstrates state-of-the-art defense performance against diverse video diffusion models, offering an effective solution to the problem.
Recent diffusion models have advanced image-conditioned video generation, but their accessibility raises risks of unauthorized manipulation. Image immunization has emerged as a promising defense for Image-to-Video (I2V) protection, yet existing methods often rely on degrading visual quality or temporal coherence. In this work, we revisit I2V immunization as reducing source-content preservation, shifting the focus from output degradation to weakening source-conditioned content propagation. To this end, we propose I2V-DETACH, an image immunization method that prevents unauthorized I2V generation through source grounding detachment. I2V models preserve source content by propagating source-image cues into video latents during denoising. Accordingly, I2V-DETACH disrupts this process in two complementary ways: it suppresses source-video grounding to reduce source cue propagation, and strengthens intra-video interactions to shift denoising toward video-side dynamics with reduced reliance on the source image. To obtain informative optimization signals, we initialize auxiliary video latents with source-oriented states that remain within the source-conditioned generation regime while deviating from source-preserving trajectories. Extensive experiments across diverse diffusion architectures show that I2V-DETACH substantially reduces source-content preservation, improves over prior immunization methods, and exhibits strong black-box transferability.
Recent advances in Image-to-Video generation allow a single image to be animated into a convincing video under text guidance, raising serious copyright and privacy risks. We propose Anti-Prompt, an image protection approach that injects imperceptible perturbations into an image, inducing visible inconsistencies and structural failures in text-guided I2V generation. Our method is motivated by a simple empirical observation. When text guidance is removed from modern I2V models, generation quality degrades markedly, not only in motion realism but also in subject preservation, structural coherence, and temporal consistency. Building on this insight, Anti-Prompt exploits the model reliance on textual guidance by attenuating text-conditioned interactions during denoising while strengthening visual-only pathways. To further systematically evaluate protection effectiveness, we introduce a Video-LLM-assisted evaluation protocol that provides interpretable, frame-grounded analyses of generation artifacts and inconsistencies. Experiments on two representative I2V architectures demonstrate that our method achieves strong protection performance while improving efficiency and cross-model transferability.