💻 computer science

Anti-I2V: Safeguarding your photos from malicious image-to-video generation

Anti-I2V is a novel defense mechanism that protects personal photos from malicious image-to-video generation by applying adversarial perturbations in the $L*a*b*$ and frequency domains while targeting specific network layers to degrade temporal coherence and generation fidelity across diverse diffusion backbones, including Diffusion Transformers.

Original authors: Duc Vu, Anh Nguyen, Chi Tran, Anh Tran

Published 2026-03-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Duc Vu, Anh Nguyen, Chi Tran, Anh Tran

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a precious family photo. In the past, if someone wanted to make a fake video of you doing something silly or dangerous using just that one photo, they needed a lot of skill and time. But today, with new "Image-to-Video" AI tools, anyone can type a prompt like "make this person dance on a table," and the AI will instantly generate a realistic video of you doing exactly that. This is a huge privacy risk.

The paper "Anti-I2V" introduces a digital shield to stop this. Think of it as a digital "glitch" or "poison" that you add to your photo before you upload it. This glitch is invisible to the human eye, but it completely confuses the AI, making it unable to create a coherent video of you.

Here is a simple breakdown of how it works, using some creative analogies:

1. The Problem: The "Perfect Copycat"

Imagine an AI artist who is incredibly talented at copying your style. If you give them a photo of your face, they can imagine you running, jumping, or singing. The problem is, they are too good. They can create deepfakes that look real, which can be used to spread lies or harass people.

2. The Old Defense: "Painting Over the Canvas"

Previous attempts to stop this were like trying to protect a painting by splashing a tiny bit of invisible paint on it.

The Flaw: Most old methods tried to mess with the RGB colors (Red, Green, Blue) of the image.
The Result: It's like trying to hide a secret message by slightly changing the shade of blue in a sky. The AI is smart; it can easily "wash away" these small color changes during its creation process, just like rain washes away light dust. The AI still recognizes you and makes the video.

3. The New Defense: "Anti-I2V" (The Invisible Armor)

The authors of this paper realized they needed a smarter way to confuse the AI. They didn't just change the paint; they changed the structure of the canvas itself. They used two main tricks:

Trick A: Changing the "Soul" of the Color (Lab* Space)

Instead of messing with the standard Red/Green/Blue mix, they changed the photo into a different color language called Lab*.

The Analogy: Imagine you are describing a color to a friend.
- RGB is like saying, "Mix 50% Red, 50% Green."
- Lab* is like saying, "This is how bright it is, how much it leans toward red vs. green, and how much it leans toward blue vs. yellow."
The Magic: The Anti-I2V method messes with the "Red vs. Green" and "Blue vs. Yellow" parts. To your human eye, the photo looks exactly the same. But to the AI, it's like the photo is wearing a disguise. The AI gets confused about the "vibe" of the colors, making it hard to track your face.

Trick B: The "Low-Frequency" Sabotage (Frequency Domain)

Images are made of patterns. Some patterns are sharp edges (high frequency), and some are smooth, big shapes (low frequency).

The Analogy: Think of a song. The high notes are the cymbals and whistles (sharp details), but the bass line and the melody are the low frequencies (the core structure).
The Magic: The AI relies heavily on the "bass line" (low frequencies) to understand the overall shape of a face and how it should move. Anti-I2V injects a tiny bit of "static" into these low-frequency bass notes. It's like putting a slight hum in the background of a song. You might not notice it, but the AI's rhythm gets thrown off, and it can't keep the video smooth.

4. Breaking the AI's "Memory" (The Internal Layers)

AI models don't just look at a picture once; they look at it through many "layers" of understanding, like peeling an onion.

The Old Way: Attackers tried to confuse the AI only at the very end (the final output).
The Anti-I2V Way: This method attacks the AI while it is thinking.
- IRC (Internal Representation Collapse): Imagine the AI is trying to build a tower of blocks. Anti-I2V makes the AI forget what the top blocks look like and forces them to look like the bottom blocks. The tower collapses because the AI can't remember the details of your face as it builds the video frame by frame.
- IRA (Internal Representation Anchor): This is like telling the AI, "Don't look at this person; look at a random stranger instead." It forces the AI to mix up your features with someone else's, resulting in a video that looks like a blurry mess of a stranger, not you.

5. The Result: A "Broken" Video

When you use Anti-I2V on your photo and then try to generate a video:

Without the shield: The AI makes a perfect video of you dancing.
With the shield: The AI tries to make the video, but it fails. The result is a video where your face might melt, turn into a stranger, or the movement becomes jerky and unnatural. The "temporal coherence" (the smoothness of movement over time) is destroyed.

Summary

Anti-I2V is like putting a digital "glitch" in your DNA that only computers can see. It doesn't ruin your photo for humans, but it breaks the AI's ability to understand your face, ensuring that no one can use your photo to create fake, harmful videos of you. It works on the newest, most powerful AI models, making it a very strong shield for your digital privacy.

1. Problem Statement

The rapid advancement of Image-to-Video (I2V) diffusion models (e.g., CogVideoX, OpenSora, DynamiCrafter) allows users to generate realistic, temporally coherent videos from a single reference image and a text prompt. While impressive, this technology poses significant security risks, enabling the creation of deepfakes and unauthorized content using a person's photo.

Existing defense mechanisms (adversarial attacks) primarily target Text-to-Image (T2I) or Image-to-Image generation. They face critical limitations when applied to I2V:

Target Mismatch: Most methods focus on disrupting static image generation or VAE features, failing to address the core challenge of I2V: temporal consistency.
Architecture Gap: Many defenses are designed for UNet-based architectures and have not been validated against newer, more robust Diffusion Transformer (DiT) models which possess larger capacity and advanced attention mechanisms.
Optimization Space: Most methods optimize perturbations directly in the RGB space, which is easily neutralized by the iterative denoising and purification processes of modern video models.

2. Methodology: Anti-I2V

The authors propose Anti-I2V, a defense framework designed to generate imperceptible adversarial perturbations that degrade the quality and identity preservation of generated videos across diverse diffusion backbones. The method consists of three core innovations:

A. Dual-Space Perturbation (DSP)

Instead of optimizing noise solely in the RGB color space, Anti-I2V operates in two complementary domains to increase robustness against purification and denoising:

L*a*b* Color Space: Perturbations are applied specifically to the a* (green-red) and b* (blue-yellow) channels. These channels are perceptually decorrelated from luminance (brightness), making the noise less visible to humans while effectively misleading the model's color perception.
Frequency Domain (DCT): The method analyzes the Discrete Cosine Transform (DCT) of the image and injects noise into the low-frequency components (top-left coefficients). This targets the core structural and textural information of the image rather than superficial pixel values, making the perturbation harder to remove via standard blurring or compression.

B. Semantic Feature Disruption (Internal Representation Collapse & Anchor)

To disrupt the temporal coherence required for video generation, Anti-I2V targets the internal feature propagation within the denoising network (UNet or DiT) and the VAE.

Internal Representation Collapse (IRC): The method identifies layers where high-level semantic features emerge (e.g., layer 19+ in OpenSora) and forces them to collapse into the feature representations of early layers (e.g., layer 3), which contain only low-level structural information. This is achieved by minimizing the Euclidean distance between deep and shallow layer features.
Internal Representation Anchor (IRA): This loss minimizes the distance between the features of the perturbed image and a target image (or the original image in untargeted attacks) across all layers of both the VAE and the denoising module. This prevents the model from extracting consistent identity features throughout the generation process.

C. Final Objective Function

The total loss function combines the proposed losses with auxiliary constraints to ensure visual imperceptibility:
$L_{Anti-I2V} = L_{IRC} + L_{IRA} + L_{auxiliary} - L_{DM}$
Where $L_{auxiliary}$ includes CLIP feature loss and LPIPS (perceptual loss) to maintain image similarity, and $L_{DM}$ is the standard diffusion loss used to guide the optimization.

3. Key Contributions

First I2V-Specific Defense: Introduces the first comprehensive defense framework specifically targeting malicious image-to-video generation across diverse architectures (UNet, DiT, MMDiT).
Novel Optimization Space: Pioneers the use of L*a*b* color space combined with frequency domain (DCT) perturbation, demonstrating superior robustness compared to traditional RGB-based attacks.
Layer-Wise Semantic Disruption: Proposes IRC and IRA losses that disrupt feature propagation at intermediate layers, effectively breaking the temporal coherence and identity preservation of the generated video.
Comprehensive Evaluation: Validates the method on state-of-the-art models (CogVideoX-5B, OpenSora v1.2, DynamiCrafter) using both face-centric (CelebV-Text) and full-body action (UCF101) benchmarks.

4. Experimental Results

The authors evaluated Anti-I2V against baselines like SDS, AdvDM, MIST, and VGMShield.

Identity Degradation: Anti-I2V achieved the lowest Identity Score Matching (ISM) and CLIP-FIQA scores across all models.
- Example: On DynamiCrafter, Anti-I2V reduced ISM from 0.528 (clean) to 0.151, significantly outperforming the next best baseline (0.262).
Video Quality & Temporal Coherence: The method drastically reduced Q-Align scores (video quality metric) and DINO similarity, indicating severe degradation in frame-to-frame consistency and visual fidelity.
- Example: On UCF101, Anti-I2V reduced the Q-Align (Video) score from 0.562 to 0.084.
Robustness: The Dual-Space Perturbation (DSP) maintained effectiveness even after the images underwent JPEG compression, Gaussian blur, and purification attacks (DiffPure, GrIDPure), outperforming RGB-only perturbations.
Transferability: Perturbations optimized on one model (e.g., CogVideoX) successfully transferred to other architectures (OpenSora, DynamiCrafter), demonstrating strong generalization.

5. Significance

Anti-I2V addresses a critical gap in AI safety by providing a robust defense against the misuse of I2V models. Its significance lies in:

Scalability: It works effectively on both older UNet-based models and cutting-edge DiT-based architectures, which are currently the most powerful and difficult to defend against.
Efficiency: Unlike some prior works requiring high-end GPUs or pose guidance, Anti-I2V is computationally feasible and does not rely on specific pose inputs.
Privacy Protection: It offers a practical solution for individuals to protect their photos from being used to generate deepfakes or harmful content without needing to modify the generation models themselves.

In conclusion, Anti-I2V represents a state-of-the-art advancement in adversarial defense for video generation, utilizing multi-domain perturbation and deep semantic disruption to effectively neutralize the capabilities of malicious I2V models.