PhaseBreak: Proactive Temporal Protection against Unauthorized Image-to-Video Animation

Jiashu Zhang; Xuanyou Li; Qixin Zhang

cs.CVOct 20, 2026

PhaseBreak: Proactive Temporal Protection against Unauthorized Image-to-Video Animation

Authors: Jiashu Zhang, Xuanyou Li, Qixin Zhang

Organizations: Jilin University, Changchun, China · Wuhan University, Wuhan, China

Abstract

Image-to-Video (I2V) diffusion models can animate a single portrait or photograph, enabling shared images to be repurposed for motion synthesis without the subject's authorization. We study proactive visual protection against such use: before an image is released, its owner applies a bounded perturbation that preserves the sharing workflow but disrupts downstream motion generation. Existing spectral disruption objectives globally attenuate temporal representations and therefore provide limited control over subtle or spatially localized motion. Our key idea is that generated dynamics depend not only on temporal feature strength, but also on the order in which feature events occur. We propose PhaseBreak, a white-box spectral retiming protection method that matches intermediate denoiser features to a constrained temporal rearrangement of their clean counterparts. PhaseBreak operates along the true temporal axis and uses a subject-aware mask to confine the protective perturbation to the depicted subject. Evaluations on Stable Video Diffusion and DynamiCrafter show that protected images induce greater short-term motion variation and lower temporal regularity, impeding stable motion customization from the released image.

Figures & tables

Figure 1. Overview of PhaseBreak. Frozen I2V backbones extract clean and protected features, while a subject mask constrains the perturbation. Temporal and spectral objectives match the protected features to a locally retimed clean target. Overview of the PhaseBreak pipeline. The diagram contains four connected stages: subject-masked input protection, clean and adversarial feature extraction with frozen image-to-video backbones, construction of a local temporal-retiming target with temporal and spectral objectives, and a masked projected-gradient optimization loop.

Model	Method	Acc. $\uparrow$	Dir. $\uparrow$	Jerk $\uparrow$	Warp. $\uparrow$	Smooth. $\downarrow$
SVD	Clean	$0.001\,462$	$0.019\,978$	$0.002\,270$	$0.022\,405$	$0.981\,167$
	PhotoGuard	$0.001\,976$ ( $+35.16$ %)	$0.070\,912$ ( $+254.95$ %)	$0.002\,585$ ( $+13.88$ %)	$0.021\,762$ ( $-2.87$ %)	$0.981\,725$ ( $+0.06$ %)
	MFA	$0.001\,583$ ( $+8.28$ %)	$0.114\,267$ ( $+471.96$ %)	$0.002\,472$ ( $+8.90$ %)	$0.022\,020$ ( $-1.72$ %)	$0.976\,059$ ( $-0.52$ %)
	I2VGuard	$0.001\,513$ ( $+3.49$ %)	$0.110\,851$ ( $+454.87$ %)	$0.003\,748$ ( $+65.11$ %)	$0.023\,346$ ( $+4.20$ %)	$0.987\,498$ ( $+0.65$ %)
	Vid-Freeze	$0.001\,483$ ( $+1.44$ %)	$0.102\,103$ ( $+411.08$ %)	$0.002\,418$ ( $+6.52$ %)	$0.023\,700$ ( $+5.78$ %)	$0.980\,561$ ( $-0.06$ %)
	MEDUSA	$0.000\,250$ ( $-82.90$ %)	$0.127\,252$ ( $+536.96$ %)	$0.000\,424$ ( $-81.32$ %)	$0.009\,559$ ( $-57.34$ %)	$0.992\,043$ ( $+1.11$ %)

Table 1. Main comparison with protection baselines. Each protected cell reports the adversarial mean followed by its relative change from the shared clean mean in parentheses. Arrows indicate stronger disruption.

Panel of Figure 2 — Figure 2. Qualitative comparison of clean and protected generation. Each column shows one reference example, with the clean sequence on top and the PhaseBreak sequence below. Two qualitative examples arranged in two columns. Each column compares four clean generated frames on top with four PhaseBreak-protected frames below. The protected sequences exhibit increasing deformation of the animated animal subject.

Training	Inference	Acc. $\uparrow$	Dir. $\uparrow$	Jerk $\uparrow$	Warp. $\uparrow$	Smooth. $\downarrow$
SVD	DC	$+28.75$ %	$+2.29$ %	$+36.50$ %	$+31.92$ %	$-0.97$ %
DC	SVD	$+143.71$ %	$+237.43$ %	$+159.23$ %	$+30.62$ %	$-0.44$ %

Table 2. Bidirectional transferability. Relative changes when protections optimized on the training model are evaluated with the inference model. DC denotes DynamiCrafter.

Model	$\varepsilon$	Acc. $\uparrow$	Dir. $\uparrow$	Jerk $\uparrow$	Warp. $\uparrow$	Smth. $\downarrow$
SVD	$4/255$	$+38.72$ %	$+209.31$ %	$+36.80$ %	$+12.39$ %	$-0.31$ %
	$8/255$	$+14.48$ %	$+304.27$ %	$+15.65$ %	$+17.60$ %	$-0.39$ %
	$12/255$	$+20.12$ %	$+480.10$ %	$+22.17$ %	$+20.48$ %	$-0.43$ %
DC	$4/255$	$+461.30$ %	$+31.83$ %	$+546.24$ %	$+88.76$ %	$-2.55$ %
	$8/255$	$+286.52$ %	$+41.51$ %	$+343.62$ %	$+83.84$ %	$-2.41$ %
	$12/255$	$+547.85$ %	$+51.65$ %	$+615.22$ %	$+108.56$ %	$-3.21$ %

Table 3. BudgetSwap. Relative changes under three

\ell_{\infty}

perturbation budgets. DC denotes DynamiCrafter.

Model	Variant	Acc. $\uparrow$	Dir. $\uparrow$	Jerk $\uparrow$	Warp. $\uparrow$	Smth. $\downarrow$
SVD	w/o $\mathcal{L}_{\mathrm{retime}}$	$+42.74$ %	$+421.28$ %	$+41.68$ %	$+23.29$ %	$-0.57$ %
	w/o $\mathcal{L}_{\mathrm{twitch}}$	$+53.84$ %	$+452.70$ %	$+57.22$ %	$+22.93$ %	$-0.52$ %
	w/o $\mathcal{L}_{\mathrm{high}}$	$+54.70$ %	$+443.12$ %	$+66.56$ %	$+24.00$ %	$-0.54$ %
	w/o $\mathcal{L}_{\mathrm{mot+}}$	$+56.22$ %	$+391.63$ %	$+65.40$ %	$+27.61$ %	$-0.58$ %
	w/o $\mathcal{L}_{\mathrm{acc+}}$	$+25.80$ %	$+450.71$ %	$+25.00$ %	$+29.64$ %	$-0.59$ %
	Full (Ours)	$+59.10$ %	$+461.45$ %	$+70.62$ %	$+31.74$ %	$-0.62$ %

Table 4. Loss ablation. Relative changes after removing one evaluated PhaseBreak objective term;

\mathcal{L}_{\mathrm{phase}}

remains active in every variant.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 3. Sensitivity analysis of the six loss weights on SVD and DynamiCrafter. Each subplot varies one weight while holding the others at their default values. The dashed vertical line denotes the selected value, and stars mark the corresponding attack effects. Six line plots show loss-weight sensitivity on Stable Video Diffusion and DynamiCrafter. Each plot varies one loss weight and reports normalized attack effect. Dashed vertical lines and star markers identify the selected weight and its corresponding effects.

Target Model	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Stable Video Diffusion	37.5089	0.9290	0.0678
DynamiCrafter	38.0340	0.9385	0.0507

Appendix

Table 5. Visual quality of protected input images. Higher PSNR and SSIM and lower LPIPS indicate better preservation of the clean input.

Adversarial Attacks on Diffusion Models

See all 17 papers

LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Oct 9, 2026Boheng Li, Yueming Xing, Yiming Li +2Image-to-Video Generation Adversarial Examples
Nanyang Technological University · Wuhan University · SiliconProspect AI
I2V-DETACH: Source Grounding Detachment for Unauthorized Image-to-Video Generation
Oct 16, 2026Chanhui Lee, Yeonghwan Song, Yewon Kang +1Image-to-Video Generation Video Diffusion Models
POSTECH · GIST
Anti-I2V: Safeguarding your photos from malicious image-to-video generation
Mar 25, 2026Duc Vu, Anh Nguyen, Chi Tran +1Image-to-Video Generation Video Diffusion Models
Qualcomm AI Research†

Oct 9, 2026J/K move · Enter open · S save

LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse

Boheng Li, Yueming Xing, Yiming Li, Jie Zhang+1

Nanyang Technological University · Wuhan University · SiliconProspect AI

Image-to-Video Generation Adversarial Examples Video Diffusion Models

Open paper AskPDF arXiv

Image-to-video (I2V) diffusion models can animate a single reference image into high-quality, subject-consistent videos, posing threats of misuse as anyone can turn personal photos into fabricated videos without consent. A promising solution is to proactively add an adversarial perturbation to the image before release, such that videos generated from it would be unfaithful or visually corrupted. However, due to an insufficient understanding of what governs how subsequent frames read the reference image in modern I2V models, existing protections struggle to offer strong protection under common perturbation budgets. In this paper, we approach the problem by exploring this underlying reading mechanism. Through a convex geometric analysis, we theoretically identify the spread of the reference value vectors as a key factor governing this reading process, and empirically find that even a mild contraction of this spread can severely degrade the generated video, making it an efficient lever for protection. Guided by this insight, we propose LETHE, a novel protection method that directly disrupts this reading process. LETHE pairs two complementary objectives, where a value collapse objective drives the reference value vectors toward uniformity, while an attention attraction objective draws subsequent frames toward these collapsed tokens to amplify corruption. We further construct two human-centric I2V protection benchmarks and conduct extensive experiments with multiple modern I2V models, which demonstrate the state-of-the-art protection performance and versatility of LETHE.

Abstract

Adversarial Attacks on Diffusion Models

Explore similar work

LETHE: Defending against Unauthorized Image-to-Video Generation via Value Diversity Collapse

I2V-DETACH: Source Grounding Detachment for Unauthorized Image-to-Video Generation

Anti-I2V: Safeguarding your photos from malicious image-to-video generation