I2V-DETACH: Source Grounding Detachment for Unauthorized Image-to-Video Generation

Chanhui Lee; Yeonghwan Song; Yewon Kang; Jeany Son

cs.CVOct 16, 2026

I2V-DETACH: Source Grounding Detachment for Unauthorized Image-to-Video Generation

Authors: Chanhui Lee, Yeonghwan Song, Yewon Kang, Jeany Son

Organizations: POSTECH · GIST

Abstract

Recent diffusion models have advanced image-conditioned video generation, but their accessibility raises risks of unauthorized manipulation. Image immunization has emerged as a promising defense for Image-to-Video (I2V) protection, yet existing methods often rely on degrading visual quality or temporal coherence. In this work, we revisit I2V immunization as reducing source-content preservation, shifting the focus from output degradation to weakening source-conditioned content propagation. To this end, we propose I2V-DETACH, an image immunization method that prevents unauthorized I2V generation through source grounding detachment. I2V models preserve source content by propagating source-image cues into video latents during denoising. Accordingly, I2V-DETACH disrupts this process in two complementary ways: it suppresses source-video grounding to reduce source cue propagation, and strengthens intra-video interactions to shift denoising toward video-side dynamics with reduced reliance on the source image. To obtain informative optimization signals, we initialize auxiliary video latents with source-oriented states that remain within the source-conditioned generation regime while deviating from source-preserving trajectories. Extensive experiments across diverse diffusion architectures show that I2V-DETACH substantially reduces source-content preservation, improves over prior immunization methods, and exhibits strong black-box transferability.

Figures & tables

Figure 1: Goal of I2V-Detach against diffusion-based I2V generation. Unlike prior baselines that often result in temporal degradation or fidelity reduction, source grounding detachment objective directly drives video generation that no longer faithfully preserves visual content of source-image.

Figure 2: Illustration of the framework of I2V-Detach . Source grounding detachment is achieved by two complementary losses; source-video decoupling and intra-video coupling . Jointly optimized with progressively source-divergent video frames, I2V-Detach drives denoising video latents away from source-bound constraints, disrupting source-content preservation in generated videos.

Figure 3: Frame- and token-level attention visualizations from a single denoising pass using video latents generated from the clean source image. In the frame-level attention maps, we highlight the most attended video tokens, with their corresponding spatial regions marked on the clean frame. (a) shows the result for the clean source image, while (b) shows the results for immunized images obtained by different methods.

Figure 4: Qualitative results for our method across diverse diffusion-based I2V architectures Yang et al. () ; HaCohen et al. (2024) ; Zheng et al. (2024) . Regardless of the underlying model, our method consistently produces visually detached videos.

Model			CogVideoX					LTX-Video					OpenSora 1.2
Method	Space	V/P	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	AQ	IQ	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	AQ	IQ	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	AQ	IQ
Clean	-	-	97.28	94.83	89.17	60.46	70.03	97.12	94.22	81.04	57.85	67.60	95.73	95.17	87.30	56.95	66.10
EditShield Chen et al. (2024b)	RGB	✗/ ✗	95.97	93.77	86.09	60.72	65.41	92.63	86.85	69.62	51.04	57.04	86.39	88.98	70.08	53.52	62.64
AdvPaint Jeon et al. (2025)	RGB	✗/ ✓	93.27	89.90	78.42	57.11	63.64	93.87	90.33	73.24	54.43	59.18	84.47	83.39	58.80	48.92	56.10
I2VGuard Gui et al. (2025)	RGB	✓/ ✓	94.39	92.52	82.99	58.65	63.39	94.10	89.67	73.37	54.47	61.08	92.20	92.68	77.68	56.10	62.19
Ours	RGB	✗/ ✗	86.39	80.63	65.54	57.87	66.76	89.85	81.98	60.88	50.35	58.51	79.62	73.92	52.10	48.95	52.38

Table 1: White-box performance on CogVideoX Yang et al. () , LTX-Video HaCohen et al. (2024) , and OpenSora 1.2 Zheng et al. (2024) . Space denotes the perturbation domain used for optimization. V/P denotes that methods require a pre-generated video and prompt during perturbation optimization, respectively. * refers to the variant that incorporates purification-aware optimization. The best score is shown in bold and the second-best is underlined .

Model	CogVideoX					LTX-Video					OpenSora 1.2
Method	ES	AP	IG	AI	Ours	ES	AP	IG	AI	Ours	ES	AP	IG	AI	Ours
Src. Ref. $\downarrow$	4.34	3.33	4.13	4.33	1.46	2.46	2.99	4.09	3.06	1.49	3.76	2.94	4.04	3.86	1.64
Pro. Ass. $\uparrow$	0.20	0.20	0.20	0.27	4.12	0.85	0.20	0.85	0.45	2.65	0.32	0.90	0.22	0.27	3.27
Ovr. Eff. $\downarrow$	4.10	2.50	3.05	4.00	1.35	2.25	3.30	4.45	3.60	1.40	4.00	2.10	3.95	3.55	1.40

Table 2: Human evaluation results. We evaluate each method in terms of Source Reflection (Src. Ref.), Protection Assessment (Pro. Ass.), and Overall Effectiveness (Ovr. Eff.). ES, AP, IG, and AI denote EditShield Chen et al. (2024b) , AdvPaint Jeon et al. (2025) , I2VGuard Gui et al. (2025) , and Anti-I2V Vu et al. (2026) , respectively.

Target Model	JPEG Guo et al. (2018)			Gaussian noise			Adverse Clean Diaz (2025)			GridPure Zhao et al. (2024b)
Method	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$
EditShield Chen et al. (2024b)	94.95	92.74	84.37	96.03	94.19	86.55	95.30	93.81	84.84	96.30	94.36	87.00
AdvPaint Jeon et al. (2025)	94.42	92.30	83.17	94.14	96.03	86.55	95.49	94.28	85.66	95.53	93.50	85.48
I2VGuard Gui et al. (2025)	93.69	92.29	82.38	94.19	92.72	82.85	94.66	93.10	83.26	94.55	93.12	83.27
Ours	90.21	86.11	74.26	87.57	81.85	67.54	90.31	86.09	73.62	91.18	86.12	74.81
Anti-I2V* Vu et al. (2026)	93.33	92.32	83.08	92.92	92.56	82.22	94.23	92.88	84.49	93.39	92.47	83.25

Table 3: Robustness evaluation against transformation and diffusion-based purification techniques. * refers to the variant that incorporates purification-aware optimization. The best score is shown in bold and the second-best is underlined .

Target Model	LTX-Video					OpenSora 1.2
Method	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	AQ	IQ	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	AQ	IQ
EditShield Chen et al. (2024b)	94.42	91.23	77.72	53.09	62.52	94.86	94.51	84.51	54.85	63.07
AdvPaint Jeon et al. (2025)	94.67	91.41	76.02	53.93	62.30	94.69	94.28	83.46	54.93	62.99
I2VGuard Gui et al. (2025)	93.82	91.29	76.36	53.35	61.95	93.26	94.08	81.02	54.80	61.84
Anti-I2V Vu et al. (2026)	92.57	90.21	74.25	54.17	62.97	93.74	94.55	82.33	58.63	63.44
Ours	92.06	88.26	72.30	51.23	60.28	92.62	93.58	79.07	54.56	59.35

Table 4: Transferability evaluation on LTX-Video HaCohen et al. (2024) and OpenSora 1.2 Zheng et al. (2024) . CogVideoX Yang et al. () is used for victim model. The best score is shown in bold and the second-best is underlined .

Model	CogVideoX Yang et al. ()				LTX-Video HaCohen et al. (2024)				OpenSora 1.2 Zheng et al. (2024)
Method	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	DISTS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	DISTS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	DISTS $\downarrow$
EditShield	31.54	0.779	0.174	0.210	31.55	0.786	0.388	0.181	31.43	0.778	0.400	0.232
AdvPaint	33.06	0.831	0.166	0.162	33.15	0.840	0.357	0.171	32.14	0.829	0.403	0.234
I2VGuard	30.72	0.743	0.229	0.172	29.99	0.723	0.340	0.146	30.36	0.744	0.388	0.193
Anti-I2V	28.66	0.727	0.237	0.207	32.55	0.843	0.387	0.171	25.14	0.628	0.387	0.191
Ours	33.49	0.848	0.155	0.139	33.48	0.853	0.320	0.145	32.61	0.837	0.397	0.214

Table 5: Imperceptibility comparison with baselines. The best score for each metric within each model is shown in bold .

Category	Metric	ES ( $8/255$ )	AP ( $6/255$ )	IG ( $8/255$ )	AI ( $8/255$ )	Ours ( $6/255$ )
Imperceptibility	LPIPS $\downarrow$	0.400	0.377	0.388	0.387	0.354
Imperceptibility	DISTS $\downarrow$	0.232	0.193	0.193	0.191	0.187
Performance	IS $\downarrow$	86.39	88.08	92.20	91.64	82.92
	SC $\downarrow$	88.98	86.03	92.68	91.97	77.62
	DS $\downarrow$	70.08	66.81	77.68	77.33	56.51

Table 6: Protection performance on OpenSora 1.2 under matched imperceptibility (DISTS

\approx

0.19). AdvPaint Jeon et al. (2025) and I2V-DETACH are re-optimized using a perturbation budget of

6/255

Method	Image-specific						UAP-variant
Method	Clean	ES Chen et al. (2024b)	AP Jeon et al. (2025)	IG Gui et al. (2025)	AI Vu et al. (2026)	Ours	ES Chen et al. (2024b)	AP Jeon et al. (2025)	IG Gui et al. (2025)	AI Vu et al. (2026)	Ours
IS $\downarrow$	97.28	95.97	93.27	94.39	93.13	86.39	96.32	95.58	95.37	95.08	93.31
SC $\downarrow$	94.83	93.77	89.90	92.52	92.42	80.63	94.45	94.01	92.74	93.87	91.74
DS $\downarrow$	89.17	86.09	78.42	82.99	82.34	65.54	87.57	85.73	86.43	85.77	83.54

Table 7: Protection performance of image-specific methods and their universal variants. Lower values indicate stronger protection. ES, AP, IG, and AI denote EditShield Chen et al. (2024b) , AdvPaint Jeon et al. (2025) , I2VGuard Gui et al. (2025) , and Anti-I2V Vu et al. (2026) , respectively.

Figure 5: Qualitative ablation for the proposed two loss functions on CogVideoX Yang et al. () .

Method	$\mathcal{L}_{\mathrm{svd}}$				$\mathcal{L}_{\mathrm{ivc}}$				$\mathcal{L}_{\mathrm{svd}}$ + $\mathcal{L}_{\mathrm{ivc}}$
Video	Unrelated		Related		Unrelated		Related		Unrelated		Related
Video	Rand	Black	Source	SDV	Rand	Black	Source	SDV	Rand	Black	Source	SDV
IS $\downarrow$	95.29	95.06	92.83	91.83	90.09	89.39	90.38	89.31	89.75	89.14	88.45	86.39
SC $\downarrow$	91.59	90.98	90.49	87.49	85.80	85.07	86.50	85.37	84.41	84.23	83.54	80.63
DS $\downarrow$	83.16	82.55	80.93	78.24	74.77	73.03	75.32	72.37	72.62	72.60	70.78	65.54

Table 8: Ablation studies for the losses and video frames. Black , Source , and Rand denote repeated black frames, repeated source frames, and random noisy latents at the corresponding timestep, respectively, while SDV denotes the proposed source-divergent video.

Appendix figures & tables19 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: Screenshots of the conducted human evaluation.

Attention	Clean	ES	AP	IG	AI	I2V-Detach
Source-video	0.087	0.085	0.090	0.080	0.063	0.015
video-video	0.666	0.671	0.637	0.679	0.660	0.710

Appendix

Table 9: Quantification of attention mass on CogVideoX ( Yang et al., ) . Source-video attention mass is measured between video queries and source keys, while video-video attention mass is measured among video-side tokens.

Attention	Clean	ES	AP	IG	AI	I2V-Detach
Source-video	0.083	0.073	0.076	0.081	0.075	0.051
video-video	0.917	0.927	0.924	0.919	0.925	0.949

Appendix

Table 10: Quantification of attention mass on LTX-Video ( HaCohen et al., 2024 ) .

Attention	Clean	ES	AP	IG	AI	I2V-Detach
Source-video	0.237	0.220	0.282	0.246	0.233	0.178
video-video	0.763	0.780	0.718	0.754	0.767	0.822

Appendix

Table 11: Quantification of attention mass on OpenSora 1.2 ( Zheng et al., 2024 ) .

Table 18

Method	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	Latency(sec)
Ours-P	88.72	83.42	70.73	475.94
Ours-I	86.30	80.18	64.65	1,344.50
Ours*	86.39	80.63	65.54	620.72

Appendix

Table 14: Ablation study on source-deviated video latent optimization strategies. Ours-P denotes pre-optimized source-divergent video latents, Ours-I optimizes all

F-1

tail latents independently, and Ours* optimizes a single source-deviated tail latent and replicates it across the remaining positions.

Figure 7: Ablation study on timestep sampling. As the sampled timestep range becomes larger, immunization performance degrades.

Videos	Source	Trans.	Gen.	Gen.+G.	SDV
IS $\downarrow$	88.45	88.12	87.49	87.96	86.39
SC $\downarrow$	83.54	83.07	82.54	82.56	80.63
DS $\downarrow$	70.78	70.09	67.43	67.30	65.54

Appendix

Table 15: Effect of video latent construction variations.

Surrogate Model	LTX-Video						OpenSora 1.2
Target Model	CogVideoX			OpenSora 1.2			CogVideoX			LTX-Video
Metric	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$
EditShield	95.02	93.31	85.22	93.78	93.29	81.82	94.52	94.31	84.29	93.32	90.73	75.52
AdvPaint	94.74	93.65	84.63	94.28	94.42	83.00	93.38	93.03	81.84	92.03	90.05	72.10
I2VGuard	96.64	94.21	88.13	95.61	95.18	87.06	94.31	93.27	83.20	92.93	91.19	75.34
Anti-I2V	96.68	94.52	88.24	95.44	94.84	85.95	92.69	91.83	82.03	92.11	90.73	74.48

Appendix

Table 16: Additional black-box transferability evaluation on LTX-Video HaCohen et al. (2024) and OpenSora 1.2 Zheng et al. (2024) .

Model	Luma Ray			Wan2.1-14B
Method	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$	IS $\downarrow$	SC $\downarrow$	DS $\downarrow$
Clean	95.52	94.72	83.55	97.28	96.20	92.37
EditShield	93.90	92.84	79.92	95.19	95.95	88.25
AdvPaint	94.39	93.52	81.60	95.39	96.19	88.70
I2VGuard	93.79	92.87	79.53	94.59	95.65	86.85
Anti-I2V	93.75	90.99	81.52	93.90	95.46	85.38

Appendix

Table 17: Transferability evaluation on commercial and large-scale models.

Panel of Figure 8 — Figure 8: Qualitative comparison with baselines on CogVideoX Yang et al. () .

Panel of Figure 9 — Figure 9: Qualitative comparison on LTX-Video HaCohen et al. (2024) .

Panel of Figure 10 — Figure 10: Qualitative comparison on OpenSora 1.2 Zheng et al. (2024) .

Panel of Figure 11 — Figure 11: Qualitative comparison with baselines on CogVideoX Yang et al. () .

Panel of Figure 12 — Figure 12: Qualitative comparison with baselines on LTX-Video HaCohen et al. (2024) .

Panel of Figure 13 — Figure 13: Qualitative comparison with baselines on OpenSora 1.2 Zheng et al. (2024) .

Panel of Figure 14 — Figure 14: Qualitative results for black-box scenario on LTX-Video HaCohen et al. (2024) . CogVideoX Yang et al. () is used for victim model.

Panel of Figure 15 — Figure 15: Qualitative results for black-box scenario on OpenSora 1.2 Zheng et al. (2024) . CogVideoX Yang et al. () is used for victim model.

Figure 16: Failure case visualization. Ours and Ours-R denote the proposed method without and with loss reweighting, respectively.

Image-to-Video Generation

Image-to-video generation creates coherent moving clips from still images, guided by learned models and controls such as motion, camera, or text.

See all 94 papers

Immune2V: Image Immunization Against Dual-Stream Image-to-Video Generation
Apr 12, 2026Zeqian Long, Ozgur Kara, Haotian Xue +2Image-to-Video Generation
University of Illinois Urbana-Champaign · Georgia Institute of Technology
Anti-I2V: Safeguarding your photos from malicious image-to-video generation
Mar 25, 2026Duc Vu, Anh Nguyen, Chi Tran +1Image-to-Video Generation Video Diffusion Models
Qualcomm AI Research†
LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Oct 9, 2026Boheng Li, Yueming Xing, Yiming Li +2Image-to-Video Generation Adversarial Examples
Nanyang Technological University · Wuhan University · SiliconProspect AI

Apr 12, 2026J/K move · Enter open · S save

Immune2V: Image Immunization Against Dual-Stream Image-to-Video Generation

Zeqian Long, Ozgur Kara, Haotian Xue, Yongxin Chen+1

University of Illinois Urbana-Champaign · Georgia Institute of Technology

Image-to-Video Generation

Open paper AskPDF arXiv

Image-to-video (I2V) generation has the potential for societal harm because it enables the unauthorized animation of static images to create realistic deepfakes. While existing defenses effectively protect against static image manipulation, extending these to I2V generation remains underexplored and non-trivial. In this paper, we systematically analyze why modern I2V models are highly robust against naive image-level adversarial attacks (i.e., immunization). We observe that the video encoding process rapidly dilutes the adversarial noise across future frames, and the continuous text-conditioned guidance actively overrides the intended disruptive effect of the immunization. Building on these findings, we propose the Immune2V framework which enforces temporally balanced latent divergence at the encoder level to prevent signal dilution, and aligns intermediate generative representations with a precomputed collapse-inducing trajectory to counteract the text-guidance override. Extensive experiments demonstrate that Immune2V produces substantially stronger and more persistent degradation than adapted image-level baselines under the same imperceptibility budget.

Abstract

Image-to-Video Generation

Explore similar work

Immune2V: Image Immunization Against Dual-Stream Image-to-Video Generation

Anti-I2V: Safeguarding your photos from malicious image-to-video generation

LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse