Immune2V: Image Immunization Against Dual-Stream Image-to-Video Generation

Zeqian Long; Ozgur Kara; Haotian Xue; Yongxin Chen; James M. Rehg

cs.CVApr 12, 2026

Immune2V: Image Immunization Against Dual-Stream Image-to-Video Generation

Authors: Zeqian Long, Ozgur Kara, Haotian Xue, Yongxin Chen, James M. Rehg

Organizations: University of Illinois Urbana-Champaign · Georgia Institute of Technology

Abstract

Image-to-video (I2V) generation has the potential for societal harm because it enables the unauthorized animation of static images to create realistic deepfakes. While existing defenses effectively protect against static image manipulation, extending these to I2V generation remains underexplored and non-trivial. In this paper, we systematically analyze why modern I2V models are highly robust against naive image-level adversarial attacks (i.e., immunization). We observe that the video encoding process rapidly dilutes the adversarial noise across future frames, and the continuous text-conditioned guidance actively overrides the intended disruptive effect of the immunization. Building on these findings, we propose the Immune2V framework which enforces temporally balanced latent divergence at the encoder level to prevent signal dilution, and aligns intermediate generative representations with a precomputed collapse-inducing trajectory to counteract the text-guidance override. Extensive experiments demonstrate that Immune2V produces substantially stronger and more persistent degradation than adapted image-level baselines under the same imperceptibility budget.

Figures & tables

Figure 2: Immunization on Dual-Stream I2V Architecture. A clean input image , guides the generation process through i) a spatial-temporal stream , where the image is processed through a video encoder to initialize the structural latent space, and ii) a semantic stream , where an image encoder extracts high-level embeddings for continuous semantic guidance. While these streams normally generate a realistic video conditioned on an input image, injecting an adversarial perturbation yields an immunized image that simultaneously disrupts both conditioning streams, forcing the generation process into structural collapse.

Panel of Figure 3 — Figure 3: Temporal Attenuation. Standard image-level attacks fail because their influence vanishes rapidly across the zero-padded temporal segments during both forward and backward propagation. Our temporally-balanced approach overcomes this by actively enforcing persistent corruption across the entire temporal axis. Due to memory constraints, we compute the gradient for frames 0–12.

Figure 4: Semantic Conditioning Override. We analyze generative trajectories in the noise latent space by measuring semantic distance to a clean baseline ( Clean Image (Good Prompt) ) at each timestep. (a) A mismatched prompt ( Clean Image (Bad Prompt) ) naturally diverges from the baseline (positive slope). (b) An encoder-only spatial attack ( Enc.-Imm. Image (Good Prompt) ) is overridden by the continuous semantic guidance of a good prompt, rapidly pulling the trajectory back toward the clean state (steep negative slope). (c) Our joint approach ( Ours-Imm. Image (Good Prompt) ) actively counteracts the semantic guidance, maintaining a flatter slope and sustaining the disruption across the generative process.

Figure 5: Immune2V Framework. Our method simultaneously targets the spatial-temporal and semantic streams to ensure persistent disruption. The Spatial-Temporal Attack employs a balanced encoder loss and dense targets to recover vanishing optimization signals across temporal segments. The Semantic Attack hijacks DiT guidance by forcing intermediate representations to mimic a precomputed collapse trajectory, neutralizing the model’s iterative semantic correction. Together, these joint perturbations induce severe structural breakdown across the entire generated video.

Table 1: Quantitative comparison. All methods are evaluated under the same perturbation budget. Bold and underline denote the best and second-best results. PIC: Perceptual Image Consistency, TA: Text-Video Alignment, SC: Subject Consistency, MS: Motion Smoothness, AS: Aesthetic Score, FF: First Frame fidelity.

Figure 6: Qualitative Comparisons. A qualitative comparison across baselines, showing the input frame and subsequent video frames. See the Supplementary for full videos.

Figure 7: Additional Qualitative Results. Sampled frames from the generated videos are shown on the left, with zoomed comparisons against the corresponding clean video frames on the right. Full videos are available in Supplementary.

Configuration			Condition Preservation $\downarrow$		Video Structural Quality $\downarrow$
$\mathcal{L}_{\text{ST}}$	$\mathcal{L}_{\text{Sem}}$	$\epsilon$	PIC (%)	Text Align.	Subject Cons. (%)	Motion Smooth. (%)	AS
Ablation on Loss Components (fixed $\epsilon=32/255$ )
✓	✗	32/255	75.86 (+2.28)	29.74 (-0.10)	92.12 (+0.41)	94.04 (+0.62)	4.87 (+0.51)
✗	✓	32/255	82.34 (+8.76)	29.95 (+0.11)	93.68 (+1.97)	94.27 (+0.85)	5.02 (+0.66)
✓	✓	32/255	73.58	29.84	91.71	93.42	4.36
Ablation on Perturbation Budget (fixed $\mathcal{L}_{\text{ST}}+\mathcal{L}_{\text{Sem}}$ )

Table 2: Ablation Study. We ablate individual loss components and noise budgets from our full model.

\mathcal{L}_{\text{ST}}

: spatial-temporal loss,

\mathcal{L}_{\text{Sem}}

: semantic loss. All metrics are

\downarrow

(lower is better). Our full model is highlighted in gray and repeated per section. Deltas are relative to our full model: green = improved, red = degraded.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Attack Optimization									Generation
Resolution	Frames	PGD Iters	Budget $\epsilon$	Step $\alpha$	Traj. Length	DiT ( $K$ )	$\bm{\lambda_{ST}}$	$\bm{\lambda_{Sem}}$	CFG Scale	Denoising Steps
$480\times 832$	17	500	$32/255$	0.005	25	3	1	0.125	$\{1,3,5\}$	25

Appendix

Table 3: Hyperparameters for Immune2V optimization and generation configuration.

Panel of Figure 8 — Figure 8: Prompt templates used to generate good and bad prompts.

Panel of Figure 9 — Figure 9: Prompt templates used by VLM Judge for automated pairwise evaluation of generated videos and first-frame image quality.

Figure 10: Clean and attacked video results on DynamiCrafter using Immune2V.

Figure 11: Clean and attacked video results on I2VGen-XL using Immune2V.

Image-to-Video Generation

Image-to-video generation creates coherent moving clips from still images, guided by learned models and controls such as motion, camera, or text.

See all 94 papers

Anti-I2V: Safeguarding your photos from malicious image-to-video generation
Mar 25, 2026Duc Vu, Anh Nguyen, Chi Tran +1Image-to-Video Generation Video Diffusion Models
Qualcomm AI Research†
I2V-DETACH: Source Grounding Detachment for Unauthorized Image-to-Video Generation
Oct 16, 2026Chanhui Lee, Yeonghwan Song, Yewon Kang +1Image-to-Video Generation Video Diffusion Models
POSTECH · GIST
Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation
Jul 1, 2026Yeonghwan Song, Chanhui Lee, Jinsoo Park +1Image-to-Video Generation Adversarial Examples
GIST · POSTECH

Mar 25, 2026J/K move · Enter open · S save

Anti-I2V: Safeguarding your photos from malicious image-to-video generation

Duc Vu, Anh Nguyen, Chi Tran, Anh Tran

Qualcomm AI Research†

Image-to-Video Generation Video Diffusion Models

Open paper AskPDF arXiv

Advances in diffusion-based video generation models, while significantly improving human animation, poses threats of misuse through the creation of fake videos from a specific person's photo and text prompts. Recent efforts have focused on adversarial attacks that introduce crafted perturbations to protect images from diffusion-based models. However, most existing approaches target image generation, while relatively few explicitly address image-to-video diffusion models (VDMs), and most primarily focus on UNet-based architectures. Hence, their effectiveness against Diffusion Transformer (DiT) models remains largely under-explored, as these models demonstrate improved feature retention, and stronger temporal consistency due to larger capacity and advanced attention mechanisms. In this work, we introduce Anti-I2V, a novel defense against malicious human image-to-video generation, applicable across diverse diffusion backbones. Instead of restricting noise updates to the RGB space, Anti-I2V operates in both the

L

$a$

b

* and frequency domains, improving robustness and concentrating on salient pixels. We then identify the network layers that capture the most distinct semantic features during the denoising process to design appropriate training objectives that maximize degradation of temporal coherence and generation fidelity. Through extensive validation, Anti-I2V demonstrates state-of-the-art defense performance against diverse video diffusion models, offering an effective solution to the problem.

Abstract

Image-to-Video Generation

Explore similar work

Anti-I2V: Safeguarding your photos from malicious image-to-video generation

I2V-DETACH: Source Grounding Detachment for Unauthorized Image-to-Video Generation

Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation