1 Introduction↩︎

Diffusion models have rapidly advanced image synthesis [2]–[11] and video generation [1], [12]–[21], making it increasingly easy to animate a single photograph into a realistic short video. Modern Image-to-Video (I2V) models [21]–[25] can generate temporally coherent motion and high visual fidelity from one image, guided by a text prompt. These capabilities enable compelling content creation, but they also introduce a practical risk for publicly shared images [26]–[29]. Once an image is posted online, it becomes a reusable source that can be repeatedly animated under a wide range of prompts, without the owner’s intent. Compared to static misuse, video generation can be more persuasive because it adds actions, expressions, and temporal narratives, thereby amplifying privacy and copyright risks [26]. This motivates proactive image protection [30]–[34] tailored to diffusion-based I2V dynamics.

In this work, we study I2V image protection. Given an image intended for sharing, the owner adds an imperceptible perturbation so that attempts to animate the image are less likely to produce a coherent and image-faithful video. Here, image-faithful refers to preserving the input image’s subject identity and overall structure throughout the generated video. A successful protection, therefore, causes generated videos to exhibit noticeable inconsistencies or artifacts, making them unsuitable for convincing misuse. Figure 1 illustrates representative examples of such protected generations.

Our approach is motivated by a simple empirical observation. In several modern I2V models [1], [19], [20], removing the text prompt during generation causes severe degradation that extends beyond prompt-following. As illustrated in Figure 2, prompt-free generation often exhibits subject deformation, structural collapse, and temporal incoherence. These failures are broad in scope: they affect not only motion quality but also subject preservation and structural consistency. This behavior suggests that text guidance plays a broader role in stabilizing generation than typically assumed.

Based on this insight, we propose Anti-Prompt, an image protection method that weakens the influence of text during I2V denoising. Rather than targeting specific prompts, our method targets the architectural pathways through which text affects generation. Concretely, our objective suppresses text-conditioned interactions while reinforcing visual-only pathways, shifting the model’s updates away from text guidance. We instantiate this idea for two common I2V architectures: full-attention models, where video tokens jointly attend to video, image, and text tokens, and cross-attention models, where text influences the latent through a dedicated residual branch. Our optimization operates on intermediate attention statistics rather than generated videos, eliminating the need for expensive reference video generation and significantly improving efficiency compared with prior approaches [34].

Finally, we introduce an evaluation protocol tailored to I2V protection. Standard video benchmarks (, VBench [35]–[37]) measure overall video quality but provide limited insight into how generation degrades on protected images. In protection settings, success is inherently asymmetric: even a single salient error can render a generated video unsuitable for convincing misuse. To better capture such behaviors, we complement standard benchmarks with a Video-LLM–assisted evaluation protocol [38]–[42]. The protocol evaluates four interpretable dimensions, Subject Preservation, Structural Consistency, Dynamic Consistency, and Artifact Suppression, using structured outputs that cite frame-grounded observations before assigning discrete scores.

Our contributions are summarized as follows:

• We propose Anti-Prompt, an I2V image protection method that attenuates text-conditioned interactions during denoising while amplifying visual-only pathways, instantiated for both full-attention and cross-attention I2V architectures.

• We introduce a Video-LLM-assisted evaluation protocol that provides inspectable, frame-grounded diagnoses of protection-induced failures across four visual dimensions.

• Our method achieves effective disruption of plausible animation with improved efficiency and high imperceptibility across two representative I2V architectures under our evaluation suite.

2 Related Work↩︎

2.0.0.1 Image-to-Video Generative Models.

Modern image-to-video (I2V) synthesis is largely built by extending text-to-image diffusion backbones with temporal modules to synthesize temporally coherent frames from a single image. Early works such as Tune-A-Video [43] and AnimateDiff [44] demonstrated that injecting lightweight temporal components enables compelling image animation. Stable Video Diffusion [21] further scaled latent video diffusion and has served as a widely used open-source baseline. Recent models improve fidelity and controllability through stronger spatio-temporal architectures, including Lumiere [45] and large-scale diffusion transformers such as CogVideoX [1]. In parallel, LTX-Video [19] proposes efficiency-oriented designs and Wan [20] continues to reduce the barrier to high-quality I2V generation as a large-scale open source model. Community-driven efforts such as VideoCrafter2 [46] and Open-Sora [47] further broaden access to I2V capabilities. The increasing realism and accessibility of I2V generation have spurred interest in protecting images against video synthesis.

2.0.0.2 Image Protection against Generative Models.

Protective perturbations aim to reduce the utility of images for downstream generation or editing by disrupting key components such as latent encoders, denoising dynamics, or attention. PhotoGuard [30] introduced diffusion-targeted image immunization to prevent unauthorized edits, and Distraction [48] improved practicality by focusing on attention-level objectives with reduced memory cost. DiffusionGuard [32] strengthens robustness under challenging masked-editing settings, while AdvPaint [49] explicitly targets attention interactions to defend against inpainting manipulation. Beyond editing, Glaze [31] and AdvDM [50] protect against artistic style imitation, and PRIME [33] extends perturbation-based protection to video content. Most closely related to our setting, I2VGuard [34] studies safeguards against diffusion-based I2V generation by degrading spatio-temporal consistency, but its optimization can require generating auxiliary videos and additional model passes. These observations motivate more efficient I2V protection mechanisms that directly target text-dependent interactions to induce generation failures.

3 Background↩︎

3.0.0.1 Diffusion Models.

Diffusion models are trained to reverse a noise process that gradually corrupts data. A noisy latent \(z_t\) at the timestep \(t\) is expressed as: \[z_t = \sqrt{\bar{\alpha}_t}\, z_0 + \sqrt{1 - \bar{\alpha}_t}\, \epsilon,\quad \epsilon \sim \mathcal{N}(0, I),\] where \(z_0\) is the clean latent and \(\bar{\alpha}_t\) is the noise schedule. A denoising network \(\epsilon_\theta\) (, U-Net [51], DiT [4]) is trained to predict \(\epsilon\) from \(z_t\) at timestep \(t\), under conditioning input \(c\) (, text embeddings). In diffusion-based I2V systems, such conditioning is typically injected through attention mechanisms that control how signals from different modalities are combined [10], [52].

3.0.0.2 Conditioning Mechanisms in Diffusion Models.

We focus on two representative conditioning designs commonly used in diffusion-based I2V models: Full-Attention and Cross-Attention. To describe both architectures with a unified perspective, we distinguish text-dependent interactions that explicitly access text tokens, from visual-only interactions that operate on image and video tokens only.

3.0.0.3 Full-Attention.

In Full-Attention architectures (, CogVideoX [1]), video tokens jointly attend to video, image, and text tokens under shared softmax normalization. Under a shared softmax, modalities compete for attention mass [52], which directly determines their relative contribution to the latent update. \[\begin{gather} [\mathcal{A}_{z,z}, \mathcal{A}_{z,i}, \mathcal{A}_{z,\text{txt}}] = \text{softmax}([A_{z,z}, A_{z,i}, A_{z,\text{txt}}]) \\ z^{\ell}_{FA} = \mathcal{A}_{z,z}V_z^\ell + \mathcal{A}_{z,i}V_i^\ell + \mathcal{A}_{z,\text{txt}}V_\text{txt}^\ell, \end{gather}\] where \(\ell\) is the layer index. Here, \(A_{z,\cdot}\) denotes the pre-softmax attention logits grouped by modality, \(\mathcal{A}_{z,\cdot}\) the corresponding post-softmax weights, and \(V_\cdot^\ell\) the value projections. \(z^{\ell}_{FA}\) denotes the output of the full-attention block. Under our criterion, the term \(\mathcal{A}_{z,\text{txt}}V_{\text{txt}}^\ell\) is text-dependent, while \(\mathcal{A}_{z,z}V_z^\ell + \mathcal{A}_{z,i}V_i^\ell\) constitutes visual-only contributions.

3.0.0.4 Cross-Attention.

In Cross-Attention architectures (, LTX-Video [19]), text enters through a dedicated cross-attention residual, while self-attention operates on image and video tokens: \[\begin{align} z^{\ell}_{SA} &= SA^{\ell}([z^\ell_i, z^{\ell}]) \tag{1}\\ z^{\ell}_{CA} &= CA^{\ell}([z^\ell_i, z^{\ell}] + z^{\ell}_{SA}, c_\text{txt}) \tag{2}\\ [z_i^{\ell+1},z^{\ell+1}] &= [z^\ell_i, z^{\ell}] + z^{\ell}_{SA} + z^{\ell}_{CA}, \end{align}\] where \(z^{\ell}\) and \(z^{\ell}_i\) denote the video latent and the image-condition latent in the \(\ell\)-th layer, \(c_\text{txt}\) is the text condition, and \(SA\) and \(CA\) denote the self-attention and cross-attention modules, respectively. In this design, text affects the video latent only through the cross-attention residual \(z^{\ell}_{CA}\). Thus, \(z^{\ell}_{CA}\) is text-dependent, whereas \(z^{\ell}_{SA}\) and the image-conditioned pathway are visual-only.

4 Method↩︎

In this section, we describe our I2V image protection approach. Our method consists of (1) the proposed Anti-Prompt objective that attenuates text influence during denoising, (2) an encoder attack that further distorts image conditioning, and (3) the overall objective to optimize the perturbation.

4.1 Anti-Prompt Objective↩︎

The goal of I2V image protection is to induce salient failures in text-guided I2V generation from a protected image. As shown in Section 1, we observe that removing text prompts from I2V models produces broad generation failures not only in motion quality but also in subject preservation and structural coherence (Figure 2). Anti-Prompt exploits this sensitivity: it optimizes an adversarial perturbation that attenuates text-conditioned interactions during denoising, reproducing, and intensifying the failure patterns seen under prompt removal.

4.1.0.1 Text Suppression.

Text suppression denotes attenuating text-dependent interactions during denoising. Since text influence in diffusion models is mediated through attention interactions, these interactions provide a natural target for disruption. We suppress text influence by penalizing direct text-dependent interactions at each layer: \[\mathcal{L}_{\text{sup}} = \sum_{\ell=1}^{L} \tau^{\ell}. \label{eq:suppression}\tag{3}\] Here, \(\tau^\ell\) is a scalar that measures the strength of text-dependent pathways at layer \(\ell\). For Full-Attention, we set \(\tau^\ell=\mathbb{E}[A^{\ell}_{z,\text{txt}}]\), , the average pre-softmax attention logits from video to text tokens, where \(\mathbb{E}[\cdot]\) denotes averaging over all attention heads and the corresponding token pairs. We suppress the text-related logits \(A^{\ell}_{z,\text{txt}}\) to attenuate text-conditioned pathways. For Cross-Attention, we set \(\tau^\ell=\mathbb{E}[\|z^{\ell}_{CA}\|_2^2]\), , the energy of the cross-attention residual that injects text features into the video latent, thereby shrinking text-dependent residual updates.

4.1.0.2 Visual Dominance.

Text suppression directly weakens text-conditioned pathways, but its effect depends on the specific text tokens encountered during optimization and may transfer less reliably to unseen prompts. Visual dominance complements this by amplifying visual-only interactions regardless of prompt content, reducing the relative contribution of text guidance. By increasing the magnitude of activations that exclude text, we reduce textual influence through softmax competition in Full-Attention and residual dominance in Cross-Attention: \[\mathcal{L}_{\text{vis}} = -\sum_{\ell=1}^{L} \nu^{\ell}. \label{eq:dominance}\tag{4}\] Here, \(\nu^\ell\) is a scalar that measures the strength of visual-only pathways at layer \(\ell\). For Full-Attention, we set \(\nu^\ell=\mathbb{E}[A^{\ell}_{z,z}]+\mathbb{E}[A^{\ell}_{z,i}]\), , the average pre-softmax attention logits from video to video and image tokens. Since these modalities compete under the shared softmax, increasing \(\nu^\ell\) makes the visual terms more competitive and consequently decreases the relative contribution of text guidance. For Cross-Attention, we set \(\nu^\ell=\mathbb{E}[\|z^{\ell}_{SA}\|_2^2]\), , the energy of the self-attention residual, encouraging it to dominate residual updates and reducing the relative contribution of cross-attention text features.

These complementary strategies provide an intuitive realization of our protection objective. Although the formulation differs for Full-Attention and Cross-Attention, both are designed to attenuate text-guided control and drive denoising toward failures that persist across unseen prompts.

4.2 Encoder Attack↩︎

Following [34], we adopt an encoder attack [30] to further weaken image conditioning. Empirically, while prompt omission often yields unstable outputs, some generations can still retain partial coherence depending on the pipeline and scene. To further reduce such residual image-conditioned coherence, we drive the encoder representation toward an uninformative target. Specifically, we perturb the input so that \(\mathcal{E}(x+\delta)\) approaches \(\mathcal{E}(x_{\mathrm{tar}})\) (, a black image), suppressing usable visual cues for generation: \[\mathcal{L}_{\text{enc}} = \| \mathcal{E}(x+\delta) - \mathcal{E}(x_{\mathrm{tar}}) \|_2^2, \label{eq:objective95enc}\tag{5}\] where \(x\) is the input image, \(\delta\) the perturbation, \(\mathcal{E}\) the VAE encoder, and \(x_{\mathrm{tar}}\) the uninformative target.

4.3 Overall Loss↩︎

To create the final protected image, we obtain the optimal imperceptible perturbation \(\delta\) by jointly optimizing all three loss components. The final objective is formulated as: \[\begin{align} \min_{\delta} \mathcal{L} &= \mathcal{L}_{\text{sup}} + \lambda_1 \mathcal{L}_{\text{vis}} + \lambda_2 \mathcal{L}_{\text{enc}}, \label{eq:final} \\ &\text{s.t.} \quad \| \delta \|_{\infty} \leq \epsilon, \nonumber \end{align}\tag{6}\] where \(\lambda_1\) and \(\lambda_2\) are balancing hyperparameters, and the constraint ensures imperceptibility. By jointly optimizing these objectives, our method learns a perturbation that reduces text-conditioned influence and makes text-guided generation more likely to exhibit visible failures. An overview of the proposed Anti-Prompt framework and its detailed optimization procedure is illustrated in Figure 3.

5 Evaluation Protocol for Text-Guided I2V Protection↩︎

Evaluating I2V image protection is fundamentally different from evaluating video generation quality. Prior I2V protection work [34] evaluates performance using video generation benchmarks such as VBench I2V [35], [36] designed to assess how well a generated video satisfies multiple perceptual criteria. In contrast, the objective of protection is to break image-faithful animation of the protected input. Accordingly, protection effectiveness can often be established by identifying a single clear failure (, subject drift, structural breakdown, temporal instability, and prominent artifacts) rather than by exhaustively scoring fine-grained quality.

Motivated by this distinction, we introduce a failure-finding evaluation protocol that characterizes how generated videos depart from an image-faithful animation. Our protocol scores videos along four interpretable visual dimensions that capture common I2V failure patterns. Each dimension is rated on a discrete 1–5 scale, where higher scores indicate more stable, coherent generation and lower scores indicate more severe failures. Thus, lower scores correspond to stronger protection.

5.1 Evaluation Dimensions↩︎

We score the following dimensions because protection can disrupt I2V generation through distinct mechanisms, and mixing them obscures diagnosis. Each dimension is scored on a discrete 1–5 scale, where 5 indicates that the dimension is largely preserved and 1 indicates a severe failure. Accordingly, lower scores indicate stronger protection.

5.1.0.1 Subject Preservation.

We assess whether the main subject from the first frame remains present and recognizable across the video. This captures identity drift, disappearance, and replacement, which are often the most salient failures even when the overall rendering still looks plausible.

5.1.0.2 Structural Consistency.

We examine whether the subject’s geometry and boundaries remain stable across frames. This highlights warping, tearing, and part-level inconsistencies that can appear even when the subject is still identifiable.

5.1.0.3 Dynamic Consistency.

We check whether motion and state transitions remain temporally coherent and physically plausible. This targets flicker, abrupt jumps, and implausible dynamics that may occur without large appearance changes.

5.1.0.4 Artifact Suppression.

We assess how well visible artifacts are suppressed (, checkerboard patterns, banding, flickering textures, unnatural noise, or rendering glitches). Higher scores indicate minimal visible artifacts, whereas lower scores indicate severe and dominant artifacts.

5.2 Video-LLM scoring with Inspectable Evidence↩︎

For each generated video, we uniformly sample 4 frames per second, including the first and last. Given the sampled frames, a Video-LLM produces (1) a small set of concrete observations grounded to frame indices, and then (2) a 1–5 score for each dimension. Requiring observations before scoring makes the output more inspectable and reduces arbitrary ratings [53], [54].

To evaluate videos at scale under this protocol, we employ Video-LLMs [38]–[42] as evaluators that inspect sampled frames from each generated video and assign dimension-wise scores based on observable visual evidence. The prompt requests a structured output containing frame-grounded observations and per-dimension scores. We release the prompt template and parsing scripts to facilitate reproducibility. We report both the per-dimension scores and their average as a compact summary statistic.

Video-LLM–based evaluation is inherently imperfect and may exhibit model-specific biases or stochastic variability. We therefore complement it with standard VBench metrics and validate the reliability through a human study in Section 6. As shown in Table 4, the human judgments align well with our protocol-induced rankings, supporting its use as a scalable failure-finding evaluation. Additional evaluator repeatability and cross-evaluator consistency analyses are provided in the supplementary material.

6 Experiments↩︎

6.0.0.1 Implementation Details.

Following I2VGuard [34], we set the PGD hyperparameters to \(K=50\), \(\epsilon=8/255\), and \(\alpha=1/255\) for all experiments. We unroll \(T=10\) denoising steps during optimization. Unless specified otherwise, we set \(\lambda_1=1\) and \(\lambda_2=1\) for CogVideoX [1], and use \(\lambda_1=0.1\) and \(\lambda_2=0.01\) for LTX-Video [19] to account for objective scale differences across architectures. For video generation, we use \(720\times480\) resolution with 49 frames at 8 FPS for CogVideoX, and \(704\times480\) with 121 frames at 25 FPS for LTX-Video.

6.0.0.2 Experimental Setup.

We employ representative open-source image-to-video generators in our text-guided I2V setting. Specifically, we use CogVideoX-5B [1] (full-attention) and LTX-Video-2B [19] (cross-attention) as target models, as they cover the two common conditioning designs and remain feasible to run at scale under practical memory budgets.

6.0.0.3 Datasets and Metrics.

We evaluate on 355 images from the VBench Image-to-Video dataset [36], using the ground-truth text prompts paired with each image for consistent evaluation. We report VBench [35], [36] metrics and our proposed failure-finding scores computed with an open-source Video-LLM evaluator (Qwen3-VL-8B [41]). We follow the official VBench implementation for metric computation; our failure-oriented evaluation protocol is described in Section 5.

4pt

4pt

6.0.0.4 Baselines.

We compare our method with I2VGuard [34], which is designed to prevent unauthorized video generation. The original I2VGuard paper reports results on a non-public dataset, so exact numeric matching is not possible. We reproduce I2VGuard using the hyperparameters and design choices described in the paper, and evaluate all methods on the public VBench I2V benchmark under identical generation settings and perturbation budgets. In our setup, the reproduced I2VGuard achieves effectiveness broadly consistent with the reported results. For fair comparison, both methods use the encoder attack by default and share the same uninformative target (a black image).

6.0.0.5 Qualitative Results

We compare generations from the original image and protected images optimized by I2VGuard [34] and Ours. Figures 4 and 5 show that our method more reliably induces salient failures and temporally unstable dynamics than the baseline across both CogVideoX and LTX-Video. Overall, videos generated from our protected images become incoherent and inconsistent across frames, while the input perturbations remain imperceptible. These failures are consistent with the degradation patterns observed under prompt removal (Figure 2), further supporting our motivation of disrupting text-guided stabilization.

6.1 Quantitative Evaluation↩︎

We first evaluate on the standard VBench benchmark [35], [36]. Throughout this section, we use a unified convention: lower scores indicate more severe failures (stronger protection), since our metrics are formulated to quantify deviations from an image-faithful animation. As shown in Table 1, our approach improves protection effectiveness over I2VGuard across various I2V metrics. We further evaluate using our failure-finding protocol with an open-source Video-LLM evaluator (Qwen3-VL-8B [41] in our implementation). As shown in Table ¿tbl:tab:wb95cog?, our method achieves consistently lower scores across the four dimensions, indicating stronger disruption of image-faithful generation.

6.1.0.1 Robustness against Unseen Prompts.

In real-world scenarios, the defender has no access to the attacker’s prompt, making generalization to unseen prompts critical for dependable protection. Accordingly, we evaluate robustness under unseen generation prompts by using GPT-4 [55] to synthesize diverse, plausible video scenarios conditioned on each input image. We note that the generated unseen prompts are typically more informative and dynamic than the original VBench [35] prompts, making generation itself more challenging. As a result, absolute scores tend to degrade for all methods, and this effect is particularly pronounced for LTX-Video [19]. Nevertheless, our method maintains a clear advantage over I2VGuard [34] in this harder regime, indicating that the learned perturbations transfer robustly even when the prompt distribution shifts (Table 2 and ¿tbl:tab:wb95cog?). We use the same unseen prompts for all methods and clean generations. The unseen prompts are provided in the supplementary material.

6.1.0.2 Black-box Transferability.

We further conduct cross-architecture black-box experiments to assess protection transferability. As shown in Table 3, Anti-Prompt is generally favorable to I2VGuard [34] in black-box transfer. When optimized on LTX-Video [19], it outperforms I2VGuard across all reported VBench metrics, while the CogVideoX [1]-to-LTX setting shows a few exceptions on isolated dimensions but still favors Anti-Prompt overall. In Table ¿tbl:tab:blackbox95transfer?, Anti-Prompt exhibits a clearer and more consistent advantage under our evaluation protocol in Sec. 5. Taken together, these results indicate effective black-box transfer for Anti-Prompt, with its advantage appearing more consistently under the proposed failure-finding evaluation.

6.1.0.3 Human Study and Protocol Alignment.

To verify that the generated failures are perceptually meaningful, we conduct a blinded human study on generated video triplets. Participants compare the results from Clean, I2VGuard, and Ours for the same image and prompt, and select the best and worst videos based on consistency and plausibility. To reduce the cognitive burden of comparing video triplets, we ask participants to judge two higher-level criteria rather than all four protocol dimensions: consistency, which mainly reflects subject preservation and structural consistency, and plausibility, which mainly reflects dynamic consistency and artifact suppression. As shown in Table 4, generations from our protected images are most frequently selected as the worst, indicating stronger human-perceived degradation. The protocol-induced rankings also agree well with aggregated human preferences across overall, consistency, and plausibility criteria.

6.2 Analysis on Imperceptibility↩︎

Beyond protection effectiveness, practical protective perturbation should be visually imperceptible. We measure DISTS [56], LPIPS [57], PSNR, and SSIM [58], comparing our method with I2VGuard [34]. As shown in Table 5, our perturbations achieve consistently lower LPIPS and higher PSNR/SSIM across both models, indicating improved perceptual fidelity. DISTS is improved on CogVideoX and is slightly higher on LTX-Video.

6.3 Ablation Studies↩︎

6.3.0.1 Impact of Each Proposed Component.

We conduct ablation experiments to evaluate the contribution of our two objectives, \(\mathcal{L}_{\text{sup}}\) and \(\mathcal{L}_{\text{vis}}\), as shown in Table 6. In this analysis, the encoder attack (\(\mathcal{L}_\text{enc}\)) is used as a baseline component. We evaluate the protection efficacy when adding \(\mathcal{L}_{\text{sup}}\) only, \(\mathcal{L}_{\text{vis}}\) only, and both combined. All ablation experiments are conducted in the white-box setting on CogVideoX [1].

Adding \(\mathcal{L}_{\text{sup}}\) alone shows mixed effects on VBench metrics, where some scores slightly increase, but consistently improve the Video-LLM failure score. This suggests that text suppression induces failures that are visible to a Video-LLM evaluator inspecting individual frames but are not fully captured by the automated VBench pipeline. Adding \(\mathcal{L}_{\text{vis}}\) alone produces consistent improvements across both evaluation frameworks. Their combination achieves the lowest scores on both VBench and the Video-LLM protocol, confirming that text suppression and visual dominance are complementary.

6.3.0.2 Efficiency Analysis.

As shown in Table 7, our method significantly reduces runtime and memory consumption compared to I2VGuard [34]. This is because our losses operate on intermediate attention statistics within a single denoising pass, whereas I2VGuard requires generating a reference video as an additional forward pass. This reduced memory footprint makes the optimization feasible under practical GPU budgets and leaves headroom to scale to larger I2V models when more compute becomes available.

7 Conclusion↩︎

We introduced Anti-Prompt, an image protection strategy that aims to prevent unauthorized text-guided image-to-video generation from publicly shared images. Anti-Promptcombines text suppression to attenuate text-dependent interactions with a visual dominance loss that increases robustness to unseen prompts. We further propose a Video-LLM-based failure-finding evaluation protocol that exposes protection-induced breakdowns along four visual dimensions. Extensive experiments on VBench and our protocol across cross-attention and full-attention I2V models demonstrate strong protection with high imperceptibility and improved computational efficiency. Moreover, our method demonstrates generally stronger protection efficacy in unseen-prompt and model-shift evaluation settings.

Acknowledgement↩︎

This work was supported by the AI Graduate School Program at POSTECH (RS-2019-II191906 (5%)), the NRF grants (RS-2025-24535146 (10%), RS-2026-25491789 (40%)), the IITP grants (RS-2022-II220926 (25%)) funded by MSIT, and the KRIT grant (No. 21-107-E00-009-02 (20%)) funded by DAPA, Korea.

8 Efficiency Analysis↩︎

Our implementation is designed to minimize computational overhead during protection optimization. For CogVideoX [1], we apply the proposed losses only to the middle 50% of attention layers, which provides a favorable trade-off between computational cost and protection effectiveness. This configuration is used for all CogVideoX experiments reported in the main paper.

Although I2VGuard [34] applies its loss to a single middle attention layer, its computational cost remains substantially higher than ours (see Table 7 in the main manuscript). This is because I2VGuard requires generating a full target video and performing dual forward passes for each training sample.

For LTX-Video [19], both our method and I2VGuard operate on the full set of cross-attention layers. Nevertheless, our approach still achieves significantly lower optimization cost.

We additionally report the wall-clock time required to optimize the protection perturbation for a single image. All experiments are measured on a single NVIDIA A100 GPU.

Our method requires approximately 7 minutes for CogVideoX and 1.5 minutes for LTX-Video, while I2VGuard requires approximately 13 minutes and 3 minutes, respectively. These runtime measurements are consistent with the FLOPs analysis reported in the main paper and indicate that our approach substantially reduces the protection optimization cost.

9 A Unified Perspective on the Loss Design↩︎

Although our implementation differs between full-attention and cross-attention architectures, both variants are derived from the same protection objective: reducing the influence of text-conditioned signals so that visual-only pathways dominate the generation process. The specific loss forms differ because the two architectures combine text and visual information in structurally different ways. In this section, we show how both architectures can be interpreted through a common decomposition into text-dependent and visual-only components, and how our loss design naturally follows from this view.

9.0.0.1 Full-Attention.

In full-attention architectures, text-dependent and visual-only contributions are mixed within a single attention operation: \[\begin{align} z^{\ell+1} = z^{\ell} + W_o^{\ell} \left( \underbrace{\mathcal{A}_{z,z}V_z + \mathcal{A}_{z,i}V_i}_{\text{visual-only}} + \underbrace{\mathcal{A}_{z,t}V_t}_{\text{text-dependent}} \right), \end{align}\] where \(z^\ell\) denotes the video latent at layer \(\ell\), \(W_o^\ell\) is the output projection, \(\mathcal{A}_{z,\cdot}\) denotes the attention weights associated with video latent, and \(V_\cdot\) is the corresponding value vector for each modality.

The key property of full attention is that these contributions compete through softmax normalization: \[\begin{align} \mathcal{A}_{z,t} = \frac{\exp(A_{z,t})}{\exp(A_{z,z}) + \exp(A_{z,i}) + \exp(A_{z,t})}, \end{align}\] where \(A_{z,\cdot}\) denotes the corresponding pre-softmax attention logits. To make the text-dependent contribution \(\mathcal{A}_{z,t}V_t\) small, it is natural to reduce \(\mathcal{A}_{z,t}\) relative to the visual terms. This occurs when \[\begin{align} \exp(A_{z,z}) + \exp(A_{z,i}) \gg \exp(A_{z,t}). \end{align}\]

This decomposition directly motivates our loss design for full-attention models: we suppress the text-dependent score \(A_{z,t}\) while simultaneously increasing the visual-only scores \(A_{z,z}\) and \(A_{z,i}\). Under softmax competition, this reduces the effective contribution of text-conditioned signals and shifts attention toward visual-only pathways.

9.0.0.2 Cross-Attention.

In cross-attention architectures, text-dependent and visual-only operations are separated into different modules: \[\begin{align} z^{\ell+1} = z^{\ell} + \underbrace{z_{\text{SA}}^{\ell}}_{\text{visual-only}} + \underbrace{z_{\text{CA}}^{\ell}}_{\text{text-dependent}}, \end{align}\] where \(z_{\text{SA}}^{\ell}\) is produced by self-attention over visual tokens only, and \(z_{\text{CA}}^{\ell}\) is produced by cross-attention conditioned on the text input.

Unlike full attention, the two components are combined additively rather than through softmax competition. As a result, suppressing text influence amounts to reducing the relative contribution of the cross-attention term: \[\begin{align} \|z_{\text{CA}}^{\ell}\| \ll \|z_{\text{SA}}^{\ell}\|. \end{align}\] When the self-attention contribution dominates in magnitude, the influence of the text-conditioned branch becomes relatively small in the final representation.

This leads to the analogous design principle for cross-attention models: reduce the magnitude of the text-dependent term \(\|z_{\text{CA}}^{\ell}\|\) while enlarging the visual-only term \(\|z_{\text{SA}}^{\ell}\|\). Although the mechanism differs from full attention, the objective is the same: make the final representation rely more on visual-only pathways and less on the text-conditioned branch.

9.0.0.3 Unified Perspective.

The two architectures, therefore, differ mainly in how text and visual information are combined. In full attention, the competition is normalized through softmax, so relatively small changes in pre-softmax logits can be amplified into large changes in effective attention. In cross attention, the two branches are combined linearly, so dominance is governed more directly by the relative magnitudes of the self-attention and cross-attention outputs.

Despite this structural difference, both variants of our method follow the same underlying principle: weakening text-conditioned contributions while strengthening visual-only pathways. This unified view also helps explain the empirical trend in Table 1 of the main paper, where full-attention architectures tend to exhibit stronger protection effects. This behavior is consistent with the stronger competitive suppression induced by softmax-normalized attention.

10 Evaluation Protocol↩︎

10.1 Complementarity with Quality Benchmarks↩︎

We observe several mismatch cases between quality-oriented benchmarks and our Video-LLM-based failure-finding evaluation. These examples suggest that the two evaluation paradigms capture different aspects of generated videos.

First, we observe cases where highly dynamic yet semantically plausible videos receive relatively low scores from VBench metrics [35], [36], while the Video-LLM evaluator does not identify clear failures. In such examples, the generated video exhibits substantial temporal variation or rapid scene changes, which can lower quality-oriented scores even when the main subject identity and scene semantics remain largely consistent.

Conversely, we also observe cases where VBench metrics remain relatively favorable even though the generated video exhibits semantic inconsistencies, structural distortions, or physically implausible motion over time. This is plausible because VBench primarily measures perceptual quality and temporal continuity, whereas a Video-LLM is trained for video understanding and can better capture higher-level failure signals related to object identity, structure, action, and physical plausibility.

To illustrate these complementary behaviors, we provide representative mismatch examples on the project page. The visualization contains twelve cases, including both VBench-low/Qwen-high and VBench-high/Qwen-low examples.

For ease of interpretation, each video example reports both raw and normalized scores. The normalized score for each dimension is computed by percentile-based ranking over the full pool of generated videos used in our experiments, including both protected and unprotected samples across all evaluated settings. This allows each example to be interpreted relative to the broader evaluation distribution rather than only within the selected mismatch subset.

Each video example contains the following information. The left panel shows the video title (prompt), the average Qwen score (orange bar), and short textual descriptions from the Video-LLM evaluator. For Qwen-low cases, these descriptions highlight the failure dimensions identified by the evaluator, whereas for Qwen-high cases they provide concise summaries of the generated video content. The center panel shows the generated video itself. The right panel shows the normalized average VBench score and the three most influential VBench dimensions for that sample, including both raw metric values and percentile-normalized scores.

10.2 Human Study Alignment↩︎

Table 4 of the main paper reports the human preference results and their alignment with our evaluation protocol. Here, we provide additional details on the study design, including participant recruitment, triplet construction, blinding, randomization, and the mapping between our protocol dimensions and human evaluation criteria.

We conduct a user study to verify that the proposed evaluation protocol aligns with human judgment. Thirty participants are recruited from the computer vision community, and each participant evaluates 20 video triplets sampled from the full set of 355 generations. Each triplet contains three videos generated from the same input image and text prompt, corresponding to Clean, I2VGuard, and Ours. The study is fully blinded: method identities are hidden from participants, and the presentation order of the three videos is independently randomized for each triplet to mitigate position bias. For each triplet, participants select the best and worst results in terms of consistency and plausibility, following the provided instructions.

To reduce the cognitive burden of human evaluation, we do not ask participants to separately assess all four dimensions used in our protocol. Instead, we group them into two higher-level concepts that are more natural for human comparison. Specifically, consistency reflects whether the main subject and its structure remain faithful and stable throughout the video, and therefore primarily corresponds to subject preservation and structural consistency. In contrast, plausibility reflects whether the generated video appears temporally natural and visually coherent overall, and thus mainly relates to dynamic consistency and artifact suppression. This simplification is used only for the human study to obtain reliable comparative judgments across multiple videos, while our full protocol retains four interpretable dimensions for finer-grained failure analysis.

Due to the cognitive load of video comparison, each participant evaluates a representative subset of 20 triplets, focusing on dynamic scenes and human activities. Responses marked as No preference are excluded from the preference statistics.

10.3 Evaluator Consistency Analysis↩︎

While Section 5 introduces the failure-finding evaluation protocol, here we examine its empirical stability. Unlike conventional video quality grading, which often requires subtle perceptual judgments, the proposed protocol focuses on detecting clear failure evidence grounded in observable frames. This formulation makes the evaluation less sensitive to small variations in the evaluator’s output and reduces reliance on fine-grained subjective interpretation.

An additional practical advantage of our protocol is that it uses a unified evaluation query and rubric across all samples. Unlike QA-style benchmarks [37], [63] that often rely on sample-specific questions, our formulation evaluates every generated video using the same failure criteria, making the protocol easier to apply beyond a fixed benchmark.

Empirically, we observe that the evaluation outcomes remain highly stable across repeated runs. When running the same Video-LLM evaluator [41] multiple times on identical videos, the resulting scores exhibit very low variance, with standard deviations below 0.05 on a 5-point scale across all dimensions in Table 8. These results suggest that the proposed failure-finding formulation provides stable evaluation trends even under stochastic decoding.

In addition to score variance, we also examine whether the relative ranking of methods remains consistent across repeated runs. Despite stochastic decoding, the evaluator produces generally consistent method orderings across independent evaluations (Table 9), suggesting that the proposed protocol yields stable comparative trends.

10.4 Cross-Evaluator Consistency↩︎

We use Qwen3-VL-8B [41] as the primary evaluator. To assess robustness to evaluator choice, we additionally include VideoLLaMA3-7B [42] and InternVL3-9B [64] as open-source evaluators, and GPT-5-mini [65] as a commercial evaluator for cross-model validation.

The evaluation set is constructed from all 355 source images in the VBench Image-to-Video dataset. For each source image, we collect 20 generated videos covering clean generation as well as white-box protection, black-box protection, and purification-based pipelines for both Ours and I2VGuard.

All evaluators are applied to the same set of generated videos using the same evaluation prompt and rubric. As shown in Table 10, the evaluator-induced rankings exhibit high agreement across models. We also observe consistently high multiway agreement across evaluators and across individual dimensions (Table 11). These results suggest that the proposed failure-finding protocol yields stable comparative conclusions across different Video-LLM evaluators.

4pt

11 Additional Experiments↩︎

11.1 Robustness under Prompt-Free Settings↩︎

Given that our method aims to suppress text influence, an important question is whether the protection effect depends on the specific prompts used during perturbation generation. To investigate this, we conduct an ablation study in which perturbations are optimized using empty prompts, representing an extreme prompt-agnostic setting. We compare this with prior work and our full method with prompts in Table 12, and further report the results under our failure-finding evaluation protocol in Table ¿tbl:tab:prompt95ours95proto?.

Even without textual input during optimization, our method remains more effective than the baseline across both VBench metrics and our evaluation protocol. This suggests that the proposed objective does not rely heavily on the specific prompts used during perturbation generation. Instead, it appears to target architectural pathways through which text affects generation, allowing the protection effect to generalize beyond the prompts seen during optimization.

4pt

11.2 Robustness to Purification↩︎

To evaluate robustness under purification defenses, we apply post-processing techniques, including Crop-and-Resize [66], JPEG compression [66], and ADVClean [67] to protected images before video generation. We report the comparison under purification using both VBench metrics (Table ¿tbl:tab:purification?) and our failure-finding evaluation protocol (Table ¿tbl:tab:purification95ours95proto?).

We note that the purification settings used here are relatively aggressive. In particular, Crop-and-Resize keeps only 80% of the original width and height before resizing back, JPEG compression is applied with a quality factor of 60, and ADVClean also constitutes a strong purification setting. Accordingly, the absolute score drop under purification should be interpreted with this severity in mind.

Despite the overall degradation caused by purification, our method remains more effective than I2VGuard on most semantic, structural, and motion-related dimensions. At the same time, we observe that I2VGuard sometimes attains lower scores on artifact-sensitive dimensions such as Imaging Quality and Artifact Suppression, especially for CogVideoX.

A plausible explanation is that, for CogVideoX, I2VGuard starts from more perceptible perturbations, which is also consistent with the visibility metrics reported in Table 5 of the main paper (higher DISTS/LPIPS and lower PSNR/SSIM for CogVideoX). As a result, purification may still leave stronger residual high-frequency patterns for I2VGuard, which can be penalized heavily by dimensions such as Imaging Quality and Artifact Suppression.

12 Limitation↩︎

Our method has several limitations. First, although it is more efficient than I2VGuard, the proposed protection still relies on per-image optimization and therefore cannot provide instantaneous protection. Developing universal protection mechanisms [68], [69] remains an important direction for future work.

Second, the protection effect can be reduced in static or low-motion scenes. When the prompt induces minimal motion, the generated video may remain visually close to the input image, making it more difficult for protection signals to manifest as clear animation failures (Figure 6). This limitation is partly inherent to failure-based protection, since visible disruption is harder to expose when the desired animation itself is minimal.

Third, purification techniques such as JPEG compression or adversarial cleaning can partially weaken the protection effect (Table ¿tbl:tab:purification?). This highlights the difficulty of maintaining protection effectiveness under post-processing defenses. As shown in Figure 7, purification can also change the dominant failure mode: I2VGuard often leaves residual high-frequency noise, whereas our method more often induces structural collapse or abnormal motion. Recent image protection methods for editing and inpainting have explored purification-aware designs to improve robustness against post-processing defenses, and adapting similar ideas to text-guided image-to-video protection may be a promising direction for future work.

13 Discussion↩︎

Our evaluation adopts a failure-finding perspective rather than a traditional video quality benchmarking framework. Instead of measuring fine-grained perceptual quality, the goal is to identify clear signals that image-faithful animation has broken down.

Interpreting artifacts, therefore, requires some nuance. Mild artifacts, such as residual noise introduced by purification, may degrade perceptual quality without necessarily indicating a semantic failure of image-faithful animation. In contrast, severe artifacts that dominate the frame, occlude the subject, or disrupt scene structure typically correspond to clear generation breakdowns. Because failure can manifest in multiple ways, a single binary criterion does not always capture its full range.

Within this framework, the average of dimension scores serves as a practical summary of failure severity. Such averages can still reflect protection effectiveness reasonably well, but they should not be interpreted as a definitive definition of failure. Rather, they provide an operational summary of failure trends, while the broader question of what constitutes a clear failure in image-to-video generation remains open.

As an additional qualitative result, we examine protected images with an image editing model (FLUX.1 [9]). As shown in Figure 8, protected inputs can produce editing results that differ noticeably from the corresponding clean edits. Since this effect is not systematically evaluated in this work, we leave a more careful investigation to future work.

14 Broader Impact↩︎

This work is motivated by the growing risk of unintended reuse of publicly shared images in text-guided image-to-video generation systems. By weakening prompt-conditioned generation from a given image, our approach aims to help content owners better protect their images from producing misleading or undesired videos.

However, it operates by protecting the image itself rather than filtering prompts. As a result, it may also weaken benign or authorized prompt-conditioned uses of the same image. Developing more selective protection mechanisms that better distinguish malicious use from benign use remains an important direction for future work.

15 Reproducibility↩︎

To facilitate reproducibility, we provide the key components required to reproduce our experiments. Algorithm 9 describes the protection optimization procedure used to generate protected images. Table 13 presents representative examples of unseen prompt construction used in robustness evaluation. Figures 10–[fig:appendix95artifact95suppression] show the shared Video-LLM evaluation prompt template together with the dimension-specific scoring criteria.

The complete source code and evaluation pipeline are provided in the supplementary material package included with this submission. Hyperparameters for protection optimization and video generation are reported in the main paper.

4pt

References↩︎

---

1. Corresponding author.↩︎