Image-to-video (I2V) diffusion models can animate a single reference image into high-quality, subject-consistent videos, posing threats of misuse as anyone can turn personal photos into fabricated videos without consent. A promising solution is to proactively add an adversarial perturbation to the image before release, such that videos generated from it would be unfaithful or visually corrupted. However, due to an insufficient understanding of what governs how subsequent frames read the reference image in modern I2V models, existing protections struggle to offer strong protection under common perturbation budgets. In this paper, we approach the problem by exploring this underlying reading mechanism. Through a convex geometric analysis, we theoretically identify the spread of the reference value vectors as a key factor governing this reading process, and empirically find that even a mild contraction of this spread can severely degrade the generated video, making it an efficient lever for protection. Guided by this insight, we propose LETHE, a novel protection method that directly disrupts this reading process. LETHE pairs two complementary objectives, where a value collapse objective drives the reference value vectors toward uniformity, while an attention attraction objective draws subsequent frames toward these collapsed tokens to amplify corruption. We further construct two human-centric I2V protection benchmarks and conduct extensive experiments with multiple modern I2V models, which demonstrate the state-of-the-art protection performance and versatility of LETHE.
Figures & tables
Figure 1: Frames sampled from videos generated from reference images protected by different methods. The perturbation budget is 16/255 and the model is Wan2.1-I2V-14B ( Wan et al., 2025 ) .
Figure 2: Effect of contracting the reference values toward their center by a ratio γ . Left : generated frames under different γ . Right : the ArcFace identity similarity (ISM-A) between generated frames and the reference, versus γ . A mild contraction already severely degrades the generated videos.
CelebV-Text
Kinetics-700
Model
Method
ISM-A ↓
ISM-F ↓
QAF ↓
QAV ↓
ISM-A ↓
ISM-F ↓
QAF ↓
QAV ↓
Wan2.1
Clean
0.8173
0.8725
0.9123
0.9462
0.7584
0.8242
0.7974
0.8381
AdvDM
0.6082
0.7470
0.6199
0.6866
0.5621
0.6914
0.5623
0.6176
SDS+
0.6758
0.8018
0.5894
0.6469
0.6119
0.7377
0.5449
0.5969
PhotoGuard
0.7344
0.8224
0.6368
0.6967
0.6945
0.7747
0.5824
0.6404
I2VGuard
0.5818
0.7263
0.6285
0.7045
0.5666
0.6952
0.5843
0.6497
Table 1: Main Results. White-box protection performance on Wan2.1 and CogVideoX on the CelebV-Text and Kinetics-700 datasets. All methods use an ℓ∞ budget of ϵ=16/255 .
Figure 3: Qualitative comparison between Lethe and baselines on Wan2.1 and CogVideoX.
Figure 4: MLLM-based evaluation on Wan2.1.
Figure 5: Transferability and robustness results. (a) Relative reduction of each metric w.r.t. clean images when the perturbations crafted on Wan2.1 are applied to four other I2V models. (b) Metric values on Wan2.1 (CelebV-Text) under different input transformations and generation conditions.
Advances in diffusion-based video generation models, while significantly improving human animation, poses threats of misuse through the creation of fake videos from a specific person's photo and text prompts. Recent efforts have focused on adversarial attacks that introduce crafted perturbations to protect images from diffusion-based models. However, most existing approaches target image generation, while relatively few explicitly address image-to-video diffusion models (VDMs), and most primarily focus on UNet-based architectures. Hence, their effectiveness against Diffusion Transformer (DiT) models remains largely under-explored, as these models demonstrate improved feature retention, and stronger temporal consistency due to larger capacity and advanced attention mechanisms. In this work, we introduce Anti-I2V, a novel defense against malicious human image-to-video generation, applicable across diverse diffusion backbones. Instead of restricting noise updates to the RGB space, Anti-I2V operates in both the Lab* and frequency domains, improving robustness and concentrating on salient pixels. We then identify the network layers that capture the most distinct semantic features during the denoising process to design appropriate training objectives that maximize degradation of temporal coherence and generation fidelity. Through extensive validation, Anti-I2V demonstrates state-of-the-art defense performance against diverse video diffusion models, offering an effective solution to the problem.
Recent advances in Image-to-Video generation allow a single image to be animated into a convincing video under text guidance, raising serious copyright and privacy risks. We propose Anti-Prompt, an image protection approach that injects imperceptible perturbations into an image, inducing visible inconsistencies and structural failures in text-guided I2V generation. Our method is motivated by a simple empirical observation. When text guidance is removed from modern I2V models, generation quality degrades markedly, not only in motion realism but also in subject preservation, structural coherence, and temporal consistency. Building on this insight, Anti-Prompt exploits the model reliance on textual guidance by attenuating text-conditioned interactions during denoising while strengthening visual-only pathways. To further systematically evaluate protection effectiveness, we introduce a Video-LLM-assisted evaluation protocol that provides interpretable, frame-grounded analyses of generation artifacts and inconsistencies. Experiments on two representative I2V architectures demonstrate that our method achieves strong protection performance while improving efficiency and cross-model transferability.
Image-to-video (I2V) generation models can be misused to animate a single image into a convincing fake video, motivating perturbation-based image protection methods that aim to disrupt such generation. Yet these methods remain difficult to compare: they are reported under inconsistent metrics and generation settings, are often validated only on the single generator they were optimized against, and are evaluated on narrow, single-domain image sets that do not reflect real misuse. To address these challenges, we introduce IPV-Bench (Image Protection against Video generation), the first systematic benchmark for image protection in I2V generation scenarios. IPV-Bench couples a unified protocol that jointly scores protection effectiveness, visual fidelity, and robustness to preprocessing attacks together with IPV-500, a prompt-paired dataset spanning five misuse-relevant domains. Based on this benchmark, we evaluate five representative protection methods across four I2V models covering distinct architectures and both open-source and commercial systems. Extensive experiments show a consistently sobering picture: image protection and video disruption trade off against each other, most methods fail to disrupt generation beyond noise, protection rarely transfers across generators, and the few effective cases are broken by simple preprocessing. We further find that image content governs the perceptual cost of protection but not its benefit: no image domain offers an easier target. Overall, IPV-Bench provides a rigorous, reproducible, and extensible foundation for developing protection methods that work in practice.
Xiaofeng Li, Leyi Sheng, Yifan Zhao +4
The Hong Kong University of Science and Technology (Guangzhou) · Wuhan University