Paper deep dive
I2VShield: An Efficient Proactive Defense Framework against DiT-based Image-to-Video Models
Yimao Guo, Zuomin Qu, Wei Lu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/3/2026, 10:46:25 AM
Summary
The paper introduces I2VShield, a proactive defense framework designed to protect reference images from unauthorized use in Diffusion Transformer (DiT)-based Image-to-Video (I2V) models. Unlike traditional gradient-based adversarial attacks that require high computational resources and VRAM, I2VShield employs a generative adversarial approach. It utilizes a text-adaptive perturbation generator that creates imperceptible perturbations in a single forward pass, significantly reducing computational overhead. The framework incorporates a Multimodal Attention Disruption (MAD) attack to exploit vulnerabilities in DiT architectures by maximizing the deviation of internal attention features from their clean states, thereby disrupting spatiotemporal coherence in generated videos while maintaining visual fidelity through a discriminator-based regularization.
Entities (9)
Relation Signals (8)
I2VShield → uses → Multimodal Attention Disruption
confidence 95% · The proposed method primarily consists of two components: ... (2) an untargeted Multimodal Attention Disruption (MAD) attack
I2VShield → uses → Text-Adaptive Perturbation Generator
confidence 95% · a text-adaptive perturbation generation framework integrating adversarial learning
I2VShield → targets → Diffusion Transformer
confidence 94% · tailored to Diffusion Transformer (DiT)-based I2V models.
I2VShield → protectsagainst → Image-to-Video
confidence 93% · proactive defenses against I2V models remain underexplored... we propose I2VShield... tailored to Diffusion Transformer (DiT)-based I2V models.
Multimodal Attention Disruption → exploits → Diffusion Transformer
confidence 92% · MAD attack that exploits the inherent vulnerabilities of DiT-based I2V models
I2VShield → evaluatedon → UCF101
confidence 90% · We evaluate I2VShield on two datasets: UCF101
I2VShield → evaluatedon → CelebV-Text
confidence 90% · and CelebV-Text Yu et al. [2023] for facial portrait animation.
I2VShield → outperforms → PGD
confidence 88% · substantially reducing computational costs... compared to gradient-based defenses.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The rapid advancement of video generation models has led to the increasing misuse of image-to-video (I2V) models. Although substantial progress has been made in detecting AI-generated videos, proactive defenses against I2V models remain underexplored. In particular, current proactive defenses against I2V models predominantly rely on gradient-based adversarial attacks, which require defenders to possess GPUs with substantial memory resources (VRAM) to generate adversarial examples. To address this issue, we propose I2VShield, a privacy protection method based on generative adversarial attacks tailored to Diffusion Transformer (DiT)-based I2V models. The proposed method primarily consists of two components: (1) a text-adaptive perturbation generation framework integrating adversarial learning to mitigate computational overhead while maintaining visual imperceptibility; and (2) an untargeted Multimodal Attention Disruption (MAD) attack that exploits the inherent vulnerabilities of DiT-based I2V models, maximizing the deviation of the internal attention features from their clean states. Extensive experiments demonstrate that our approach achieves highly competitive protection performance across various datasets and mainstream DiT-based I2V models, particularly in disrupting spatiotemporal coherence, while substantially reducing computational costs.
Tags
Links
- Source: https://arxiv.org/abs/2607.25522v2
- Canonical: https://arxiv.org/abs/2607.25522v2
Trouble viewing inline? Open PDF directly →
Full Text
46,761 characters extracted from source content.
Expand or collapse full text
I2VShield: An Efficient Proactive Defense Framework against DiT-based Image-to-Video Models Yimao Guo 1 Zuomin Qu 2 Wei Lu 1 1 School of Computer Science and Engineering, Sun Yat-sen University Ministry of Education Key Laboratory of Information Technology Guangdong Province Key Laboratory of Information Security Technology Guangzhou 510006, China guoym39@mail2.sysu.edu.cn luwei3@mail.sysu.edu.cn 2 State Key Laboratory of HVDC, China Southern Power Grid Electric Power Research Institute quzuomin@csg.cn Abstract The rapid advancement of video generation models has led to the increasing misuse of image-to-video (I2V) models. Although substantial progress has been made in detecting AI-generated videos, proactive defenses against I2V models remain underexplored. In particular, current proactive defenses against I2V models predominantly rely on gradient-based adversarial attacks, which re- quire defenders to possess GPUs with substantial mem- ory resources (VRAM) to generate adversarial examples. To address this issue, we propose I2VShield, a privacy protection method based on generative adversarial at- tacks tailored to Diffusion Transformer (DiT)-based I2V models. The proposed method primarily consists of two components: (1) a text-adaptive perturbation generation framework integrating adversarial learning to mitigate computational overhead while maintaining visual imper- ceptibility; and (2) an untargeted Multimodal Attention Disruption (MAD) attack that exploits the inherent vul- nerabilities of DiT-based I2V models, maximizing the deviation of the internal attention features from their clean states. Extensive experiments demonstrate that our approach achieves highly competitive protection per- formance across various datasets and mainstream DiT- based I2V models, particularly in disrupting spatiotem- poral coherence, while substantially reducing computa- tional costs. Introduction The rapid evolution of generative artificial intelligence has catalyzed unprecedented advancements in image-to- video (I2V) generation. Driven by the recent paradigm shift toward Diffusion Transformers (DiT), modern I2V models exhibit remarkable capabilities in gener- ating temporally coherent and highly realistic video sequences from static reference images and textual prompts Hong et al. [2022]. However, the democratiza- tion and widespread availability of these powerful I2V tools have inevitably led to rampant abuse. Malicious actors frequently exploit these models to animate pri- vate portraits without authorization, generating deep- fakes and malicious content that pose serious threats to personal privacy and public safety. (1) Threat from Image-to-Video(l2V) Models (2) Traditional Gradient-based Adversarial Attack (3) Our Method: Generator-based Adversarial Attack I2V model Iter. 1 Gradient-based Adversarial Optimization (Iterative) ...... Iter. 2 Iter. n Init. Generator-based Adversarial Attack I2V model I2V model Generated Video Generated Video Malicious Use & Real-world Impact ManyIterations HighCompute Cost HighVRAM Requirement OneForward Pass LowVRAM Requirement LowCompute Cost UploadPropagationManipulationsocial harm Generated Video Input Clean Image Text Prompt “A young woman singing passionately into a microphone. “ Figure 1: Background and motivation for proactive de- fense. (1) The abuse of I2V models poses severe pri- vacy threats. (2) Traditional gradient-based adversarial attacks rely on expensive iterative processes, incurring high computational overhead and massive VRAM re- quirements. (3) Our proposed I2VShield utilizes an ef- ficient generative attack framework to achieve effective defense at a low computational cost. To mitigate the negative impacts of generative models, extensive research has been dedicated to AI-generated content (AIGC) forgery detection Rossler et al. [2019], Wang et al. [2020], Xu et al. [2025]. While these passive detection mechanisms have achieved notable progress, they are inherently reactive; they can only identify mali- cious content after it has been generated and potentially 1 arXiv:2607.25522v2 [cs.CV] 29 Jul 2026 disseminated. Consequently, there is an urgent need for proactive defense strategies that prevent the unautho- rized generation of videos from the outset. Adversarial perturbations have emerged as a promising proactive de- fense mechanism that protects users’ privacy by modify- ing personal images before they are shared online. When an I2V model attempts to process these protected im- ages, the perturbation disrupts the generative process, resulting in severe degradation or semantic collapse in the video. Despite the conceptual viability of proactive defenses, applying existing adversarial attack methods to modern DiT-based I2V models presents significant challenges. Current proactive defenses predominantly rely on itera- tive, gradient-based optimization techniques (e.g., PGD- based attacks) to craft adversarial examples Qu et al. [2026]. While effective for image-to-image tasks, extend- ing these gradient-based attacks to the video domain is highly problematic. Generating perturbations for I2V models requires backpropagating gradients through the complex diffusion process across multiple video frames. This optimization process demands prohibitive computa- tional resources and substantial GPU memory, rendering it impractical for everyday users or defenders with lim- ited hardware budgets. Furthermore, existing methods often fail to exploit the specific architectural vulnera- bilities inherent to Diffusion Transformers, resulting in limited protection effectiveness against state-of-the-art I2V models. To address these critical limitations, we propose I2VShield. To the best of our knowledge, this work intro- duces the first generative adversarial attack framework specifically tailored for DiT-based I2V models. Unlike prior instance-wise optimization methods, I2VShield em- ploys a text-adaptive perturbation generation network that predicts adversarial perturbations in a single for- ward pass. This design eliminates iterative gradient com- putation during deployment, substantially reducing com- putational requirements. Furthermore, to maximize the disruptive capability of the generated noise, we introduce an untargeted Multi- modal Attention Disruption (MAD) attack. By analyz- ing the conditioning mechanisms of DiT architectures, we find that cross-attention representations provide an effective optimization target for disrupting multimodal conditioning. Our attack explicitly targets these mul- timodal attention mechanisms within the latent space, maximizing the discrepancy between the original and ad- versarial features. The main contributions of this work are summarized as follows: • We formulate proactive privacy protection for DiT- based I2V generation and propose I2VShield, a gen- erative adversarial framework that protects refer- ence images before they are used for unauthorized video synthesis. • We develop a text-adaptive perturbation genera- tor together with an untargeted Multimodal Atten- tion Disruption (MAD) objective, enabling prompt- conditioned, ℓ ∞ -bounded perturbation generation in a single forward pass while directly disrupting the multimodal conditioning pathway of DiT-based I2V models. • We conduct extensive experiments on representative portrait and action-video benchmarks across mul- tiple DiT-based I2V models, demonstrating supe- rior protection effectiveness with substantially lower computational cost than gradient-based defenses. Related Work I2V Generation Models Early video generation methods mainly relied on Gen- erative Adversarial Networks (GANs) and autoregres- sive models, but often struggled with long-term temporal consistency and high-resolution synthesis Tulyakov et al. [2018], Yan et al. [2021]. Diffusion models (DMs) subse- quently improved generation quality and training stabil- ity Ho et al. [2020], Rombach et al. [2022]. Models such as Video LDM and AnimateDiff extended pretrained text- to-image U-Nets with temporal attention or convolution layers to promote frame-to-frame coherence Blattmann et al. [2023], Guo et al. [2023]. These architectures com- bine strong image-generation priors with explicit tempo- ral modeling. More recently, Diffusion Transformers (DiTs) have in- creasingly been adopted as scalable alternatives to U-Net backbones. DiT-based systems such as Sora and Latte achieve strong physical realism and temporal consistency Peebles and Xie [2023], Brooks et al. [2024], Ma et al. [2024]. Modern I2V models align text prompts with ref- erence images through latent self- and cross-attention. This dependence on multimodal feature alignment also creates a vulnerability: small disruptions to the condi- tioning pathway can substantially degrade the generated video, which motivates our approach. Proactive Defenses and Adversarial At- tacks Proactive defenses protect visual content from unautho- rized generative-AI processing by adding imperceptible adversarial perturbations. A series of studies focuse on preventing unauthorized customization. Glaze protects artistic styles from imitation, while Anti-DreamBooth disrupts subject-driven personalization of text-to-image models Shan et al. [2023], Van Le et al. [2023]. Another series of studies target unauthorized generative editing. PhotoGuard protects images against inpainting manip- ulation, and I2VGuard extends such protection to I2V 2 models by preventing reference images from being mali- ciously animated Salman et al. [2023], Gui et al. [2025]. These editing-oriented defenses typically rely on itera- tive, gradient-based methods such as PGD to optimize perturbations for each input image. For diffusion-based I2V models, repeatedly unrolling the denoising process and backpropagating across multiple video frames incur substantial computation and memory costs. They also require repeated access to the target model and its gra- dients during deployment. In contrast, I2VShield learns a text-adaptive pertur- bation generator that produces protected images in a single forward pass, avoiding instance-specific optimiza- tion at inference time. Once trained, it retains prompt awareness without repeatedly accessing the target I2V model. Preliminaries Threat Model Attacker’s Goal We consider a malicious attacker who exploits an I2V generation model F to synthesize unauthorized con- tent, such as deepfakes. Given a victim’s reference im- age x ∈ R H×W×3 and a text prompt c, the attacker generates a realistic and temporally coherent video v ∈ R F×H ′ ×W ′ ×3 , where F denotes the number of frames: v =F (x,c).(1) Defender’s Capabilities We assume that the defender has white-box access to the target DiT-based I2V model only during offline training. The defender uses its architecture, pretrained weights, and gradients to train the perturbation generator. Dur- ing online protection, the target I2V model and discrim- inator are no longer required; the defender encodes the prompt once and generates the protected image through a single forward pass of the perturbation generator, with- out accessing the target I2V model or computing its gra- dients. Defender’s Goal Before publishing an image, the defender injects an im- perceptible perturbation δ to obtain x adv = x + δ. When used as the visual condition of the I2V model, x adv should cause spatial degradation, temporal incon- sistency, or semantic collapse in the generated video v adv =F (x adv ,c). The objective is formulated as: max δ D F (x + δ,c),F (x,c) (2) s.t. ∥δ∥ ∞ ≤ ε, x + δ ∈ [0, 1] H×W×3 ,(3) where D measures the discrepancy between adversarial and clean generations, and the ℓ ∞ constraint limits the perturbation magnitude, and ε means the perturbation budget. Defense Methods Traditional Methods Existing proactive defenses commonly optimize δ through iterative gradient-based methods Kurakin et al. [2016], Madry et al. [2017]. For example, Iterative fast gradient sign method (I-FGSM) updates the adversarial image at step t as: x t+1 adv = Clip x,ε x t adv + α· sgn ∇ x D F (x t adv ,c),F (x,c) , (4) where α is the step size and Clip x,ε constrains the result within the ε-ball around x. For I2V models, computing the input gradient requires backpropagating through the diffusion denoising process over multiple frames, result- ing in prohibitive computation and GPU memory con- sumption. Generative Defense Methods To avoid instance-specific optimization at inference time, we introduce a parameterized perturbation generator G θ . Instead of directly optimizing δ for each input, the gen- erator parameters θ are learned over a training dataset: max θ E x,c D F (x + G θ (x,e c ),c),F (x,c) ,(5) where e c denotes the embedding of the text prompt c. After offline training, G θ produces an input-specific perturbation in a single forward pass. This transfers the computational cost to training and enables efficient O(1) protection at inference. The key challenge is therefore to design an effective perturbation generator and suitable training objectives, as discussed in the following section. Method Overview An overview of I2VShield is shown in Figure 2. Exist- ing proactive defenses iteratively optimize image-specific perturbations, incurring substantial computational over- head. Moreover, their image-only objectives overlook the joint visual-text conditioning of modern DiT-based I2V models, making prompt-agnostic perturbations poten- tially ineffective. I2VShield addresses these limitations by training a lightweight text-adaptive perturbation generator offline, enabling protection with a single forward pass. It com- bines an untargeted Multimodal Attention Disruption attack, which disrupts image-prompt interactions related 3 Multimodal Attention Disruption Attack Discriminator Loss Input output Input I2V Model Text-Adaptive Perturbation Generator Text Encoder Image tokens Text embed Adversarial noise + Text - Adaptive Perturbation Generator Dit-Based Denoiser Image encoder Visual feature Block I Text feature Extracted feature (a) Perturbation Generator (b) Training Process Text projection Position embed Transformer block1 Multi - head self attn Multi-head cross attn FNN Upsampling Decoder Resnet blocks Tanh Compute Q Compute KV Clean Extracted feature Visual feature Text featureText feature Adversarial Extracted feature Visual feature Transformer block2Transformer block2 Clean image Text prompt Text embed Image tokens protected image Generator Loss “The man in the video talks.“ Clean image 1 1 1 1 Adversarial Result Target Result patch Discriminator Adaptive pool Basic block Conv2d Leaky ReLU Conv2d Leaky ReLU For Generator For Discriminator Maximize distance Minimize distance Clean image Minimize distance 0 0 1 1 Target Result Clean Result Adversarial Result Adversarial Discriminator Loss LearnableFrozenForward passLoss computationAlternating training Figure 2: Illustration of the proposed I2VShield framework. (a) Perturbation generation pipeline, highlighting the architecture and key design of the Text-Adaptive Perturbation Generator. (b) Training pipeline of I2VShield, where the perturbation generator and discriminator are alternately optimized using the proposed loss functions. to subject identity, semantic alignment, and temporal co- herence, with discriminator-based regularization for vi- sual fidelity. During training, the frozen I2V model pro- cesses clean and protected image-prompt pairs, while the generator maximizes their internal multimodal fea- ture discrepancy under fidelity constraints. After train- ing, the I2V model and discriminator are discarded, re- taining only the perturbation generator and text encoder for online protection. Framework of I2VShield Existing proactive defenses typically rely on instance- wise iterative optimization, which incurs substantial computational and memory costs for I2V models with high-dimensional spatiotemporal latents. To improve de- ployment efficiency, I2VShield amortizes this process into a lightweight generator that produces adversarial perturbations in a single forward pass. The generator is additionally conditioned on the text prompt because different prompts may activate dis- tinct image–text interactions for the same reference im- age. Incorporating prompt embeddings therefore enables the generator to produce context-adaptive perturbations that more effectively disrupt prompt-specific generation. Let E txt denote the frozen text encoder associated with the target I2V model. For a prompt c, it produces e c = E txt (c), e c ∈ R L t ×d e ,(6) where L t is the number of text tokens and d e is the text- embedding dimension. At deployment time, given a clean reference image x and a text prompt c, the prompt is first encoded into a text embedding e c . The trained generator G θ then pre- dicts the perturbation and produces the protected image: δ = G θ (x,e c ), x adv = x + δ.(7) The generator contains three lightweight components: image tokenization, text conditioning, and multimodal fusion with perturbation decoding. Image tokenization The input image is divided into non-overlapping patches through a convolutional patch embedding layer Dosovit- skiy et al. [2020]: X 0 = PatchEmbed(x) + P pos , X 0 ∈ R N p ×d ,(8) where N p = (H/p)(W/p) is the number of patches, p is the patch size, d is the token dimension, and P pos is a learnable positional embedding. This tokenized repre- sentation allows the generator to model long-range visual dependencies while keeping the architecture compact. Text conditioning The prompt embedding is projected into the same latent dimension as the image tokens: T = MLP(e c ), T ∈ R L t ×d ,(9) 4 where L t denotes the number of text tokens, and MLP denotes the multilayer perceptron. This projection trans- forms the textual condition into a form that can be ef- fectively fused with visual tokens. Multimodal fusion and perturbation decoding The visual tokens are processed by a stack of lightweight transformer blocks. Within each block, self-attention first captures global visual context by enabling interac- tions between distant image regions. Cross-modal inter- action is then introduced by using the projected text tokens as semantic guidance, enabling the visual repre- sentation to adapt to the prompt-dependent generation scenario. Finally, feed-forward layers refine the fused rep- resentation and produce feature patterns that are effec- tive for disrupting the I2V model. After the final transformer block, the fused tokens are reshaped into a spatial feature map and passed through a cascaded upsampling decoder. The decoder predicts a dense perturbation map with the same spatial resolution as the input image. Because the entire process is feed- forward, I2VShield avoids iterative gradient computation during deployment and provides efficient proactive pro- tection. Multimodal Attention Disruption Attack DiT-based I2V models use multimodal attention to fuse reference-image identity and appearance with textual se- mantic and motion cues. As shown in Figure 3, we com- pare the attention maps of the I2V model for adversarial images generated by attacking the predicted noise and cross-attention features, respectively. The training ob- jective of attacking the predicted noise is to maximize ∥Denoiser(x adv ,c,τ,ξ)− Denoiser(x,c,τ,ξ)∥ 2 2 , where τ means the timestep and ξ means a noisy latent. At- tacking the predicted noise only slightly changes the at- tention distribution, whereas attacking cross-attention features substantially redistributes attention away from identity-relevant regions. This suggests that directly dis- rupting attention features destabilizes multimodal con- ditioning more effectively than perturbing noise predic- tion. Motivated by this observation, we propose the un- targeted Multimodal Attention Disruption (MAD) at- tack that maximizes the discrepancy between clean and adversarial cross-attention features. By corrupting cross-modal associations, MAD degrades subject fidelity, prompt alignment, and temporal coherence without re- quiring a predefined adversarial target concept or target video. Formally, let F denote the frozen DiT-based I2V model. During training, we sample a diffusion timestep τ ∼ U1,...,T d and construct the same noisy latent ξ ∼N (0,I) for the clean and adversarial branches. Given a selected set of transformer blocks B, we extract the Original ImagePredicted Noise AttackMAD Attack Input Heat Map Overlay Figure 3: Multimodal attention maps obtained from a clean image and images protected using the predicted noise attack and the Multimodal Attention Disruption (MAD) attack. multimodal attention features z l from each block. The clean and adversarial feature states are denoted as: z clean l = Φ l (x,c,τ,ξ), z adv l = Φ l (x adv ,c,τ,ξ), l∈B, (10) where Φ l (·) denotes the multimodal attention feature ex- tractor at the l-th block of F . Both branches share the same prompt c, timestep τ , and diffusion noise state ξ, ensuring that the measured discrepancy is caused by the injected perturbation rather than by stochastic varia- tion. To reduce the influence of layer-wise scale differences, we normalize the extracted features: ̄z b l = z b l ∥z b l ∥ 2 + η , b∈clean, adv,(11) where η is a small constant for numerical stability. The MAD loss is then defined as: L attn =− 1 |B| X l∈B ̄z adv l − sg ̄z clean l 2 2 ,(12) where sg(·) denotes the stop-gradient operation. Mini- mizingL attn maximizes the feature discrepancy between the clean and protected branches. Since the clean branch is detached, the generator is encouraged to move the adversarial representation away from the original mul- timodal attention state without altering the I2V model itself. This untargeted objective has two advantages. First, it does not require a target video or a predefined adver- sarial semantic concept, which makes the training pro- cess simple and broadly applicable. Second, it attacks the feature-level alignment mechanism that is essential for DiT-based I2V generation, thereby inducing degra- dation in subject consistency, prompt consistency, and temporal coherence simultaneously. Discriminator and Visual Fidelity Regu- larization Strong feature disruption may introduce structured or high-frequency artifacts that remain noticeable even un- 5 der an ℓ ∞ constraint, reducing the practical usability of protected images. We therefore introduce a PatchGAN- style discriminator D φ to regularize local texture pat- terns and encourage the protected images to remain per- ceptually natural Isola et al. [2017]. This adversarial regularization complements the norm constraint: the latter limits perturbation magnitude, while the discriminator constrains its spatial and percep- tual distribution, thereby balancing attack effectiveness and visual fidelity. We adopt the Least Squares GAN objective for stable optimization. The discriminator loss is defined as: L D = 1 2 E x h (D φ (x)− 1) 2 i + 1 2 E x adv D φ (x adv ) 2 . (13) The generator-side adversarial loss is: L adv = E x adv h (D φ (x adv )− 1) 2 i .(14) The final generator objective combines the MAD loss with the visual fidelity regularization: L G =L attn + λ adv L adv ,(15) where λ adv controls the trade-off between adversarial dis- ruption and visual fidelity. During training, D φ and G θ are optimized alternately. The discriminator learns to distinguish clean images from protected images, while the generator learns to both fool the discriminator and disrupt the multimodal at- tention features of the frozen I2V model. After training converges, the discriminator and target I2V model are removed, while the trained G θ and the frozen E txt are retained for online image protection. Experiments Experimental Setup Datasets We evaluate I2VShield on two datasets: UCF101 Soomro et al. [2012] for complex human action generation, and CelebV-Text Yu et al. [2023] for facial portrait anima- tion. For both datasets, we randomly sample 900, 100, and 50 instances for training, validation, and testing, re- spectively. Target Models and Baselines We assess the defensive capability of I2VShield against three state-of-the-art DiT-based I2V mod- els: CogVideoX-5B Hong et al. [2022], OpenSora-V2- 11B Zheng et al. [2024], and Wan2.1-14B Wan et al. [2025]. Consistent with our threat model, we assume a white-box setting strictly during the offline training phase. We compare I2VShield against three baselines: (1) Clean (original, unperturbed images); (2) Random Noise (uniformly distributed noise under the same ℓ ∞ budget); and (3) PhotoGuard, a representative gradient- based defense. Evaluation Metrics Because more effective protection should cause greater degradation in unauthorized generations, lower scores generally indicate stronger protection. We employ VBench Huang et al. [2024] to objectively assess spa- tial fidelity and temporal coherence (specifically sub- ject/background consistency, motion smoothness, and image quality); Q-Align Wu et al. [2023] for blind vi- sual quality assessment; and a Vision-Language Model (VLM) 1 to evaluate semantic dimensions, including prompt consistency, temporal consistency, motion plau- sibility, and frame quality. Main Results Quantitative Results As shown in Table 1, when averaged across CelebV-Text and UCF101, I2VShield provides highly competitive pro- tection across all evaluated DiT-based I2V models. Com- pared with PhotoGuard, I2VShield consistently achieves lower Subject Consistency, Background Consistency, and Motion Smoothness scores on CogVideoX-5B, Wan2.1- 14B, and OpenSora-V2-11B, demonstrating stronger dis- ruption of the generated videos’ spatiotemporal co- herence. The Gemini-based VLM evaluation reveals complementary, model-dependent effects: I2VShield ob- tains lower Prompt Consistency on CogVideoX-5B and OpenSora-V2-11B, while achieving lower Motion Plausi- bility on Wan2.1-14B and OpenSora-V2-11B. Moreover, I2VShield achieves these competitive protection effects with substantially lower VRAM consumption and com- putational cost than PhotoGuard across all three models, highlighting its efficiency and practical scalability. Figure 4 further compares the per-image online pro- tection costs and performance of I2VShield and Photo- Guard. The reported results exclude the offline train- ing cost of I2VShield. We train a separate perturba- tion generator for each target model to accommodate its input resolution and text-conditioning interface, re- sulting in different online costs across models. Photo- Guard requires iterative forward and backward passes through the target I2V model for every input image, whereas I2VShield requires only text encoding and a single forward pass through the corresponding pertur- bation generator. Consequently, I2VShield substantially reduces peak GPU memory consumption, floating-point operations, and protection time across the evaluated set- tings. These results demonstrate the deployment-time ef- ficiency of I2VShield after the perturbation generator has been trained. 1 We use Gemini-3.1-flash-lite as an automated judge for scal- able, zero-shot video assessment. 6 Table 1: Average comparative experimental results on CelebV-Text and UCF101. “-” denotes not applicable. MethodVRAM (GB)TFLOPs VBenchQ-AlignGemini-3.1-flash-lite Sub. Cons.Bg. Cons.Mot. SmoothImg. QualityVis. ScorePrompt Cons.Temp. Cons.Mot. Plaus.Frame Qual. CogVideoX-5B Clean--0.91050.93430.97860.49810.54094.94003.97004.80003.7800 Random Noise--0.90930.93290.97820.48850.52994.94003.93004.79003.7000 PhotoGuard22.421438.020.90160.92530.97780.48650.51714.89003.84004.69003.6400 I2VShield (Ours)9.492.230.89620.92480.97560.49780.52164.87003.92004.78003.7450 Wan2.1-14B Clean--0.87810.91950.96730.52240.51964.86003.93004.80003.6100 Random Noise--0.86530.91700.96830.52810.51864.94003.96004.87003.6500 PhotoGuard40.922133.510.83790.90130.96010.49570.43724.92003.86004.75003.5200 I2VShield (Ours)12.274.950.82920.89680.95560.48950.43044.93003.83004.68003.3600 OpenSora-V2-11B Clean--0.92370.94950.99050.54280.52424.88003.98004.86003.7400 Random Noise--0.92410.94980.98960.53960.52054.88003.96004.88003.7100 PhotoGuard34.73377.500.92670.94960.98880.53430.49014.90004.03004.85003.6700 I2VShield (Ours)9.7914.590.92090.94740.98830.54340.50334.85004.01004.80003.6700 CogVideoX- 5B Wan2.1- 14B OpenSora- V2-11B VRAM (GB) 0 10 20 30 40 50 26.00 40.97 32.89 9.49 12.29 9.79 PhotoGuard I2VShield -63.5% -70.0% -70.2% CogVideoX- 5B Wan2.1- 14B OpenSora- V2-11B TFLOPs 10 1 10 2 10 3 1,438 2,127 377.5 2.27 4.98 14.6 PhotoGuard I2VShield -99.8% -99.8% -96.1% CogVideoX- 5B Wan2.1- 14B OpenSora- V2-11B Time (s) 10 0 10 1 10 2 38.8 105.6 22.7 0.714 0.988 1.11 PhotoGuard I2VShield -98.2% -99.1% -95.1% CogVideoX- 5B Wan2.1- 14B OpenSora- V2-11B performance 0 1 2 3 4 5 0.823 0.799 0.850 0.824 0.793 0.850 0.517 0.437 0.490 0.522 0.430 0.503 4.265 4.263 4.362 4.329 4.200 4.332 VBench / PhotoGuard VBench / I2VShield Q-Align / PhotoGuard Q-Align / I2VShield Gemini / PhotoGuard Gemini / I2VShield +0.1% -0.7% +0.0% +0.9% -1.6% +2.7% +1.5% -1.5% -0.7% computational overhead Figure 4: Comparison of the computational overhead and performance of PhotoGuard and I2VShield. The proposed I2VShield significantly reduces computational overhead while achieving defense performance comparable to the base- line. Qualitative Results Figure 5 presents a qualitative comparison of videos gen- erated from clean reference images and images protected by PhotoGuard or I2VShield. When conditioned on clean images, all target I2V models consistently synthesize temporally coherent videos while preserving high sub- ject fidelity. Multimodal Attention Disruption (MAD), employed by I2VShield, disrupts frame-level appearance and the temporal propagation of identity- and prompt- relevant cues. Consequently, all three models exhibit subject degradation and temporal inconsistencies, al- though manifestations vary across architectures. For CogVideoX-5B, the sequence progressively deviates from the reference subject and drifts toward unrelated con- tent. For Wan2.1-14B, facial structures become distorted and color fidelity deteriorates across frames, accompa- nied by abrupt inter-frame variations. For OpenSora-V2- 11B, facial motion is markedly suppressed, resulting in repetitive frames with limited semantic progression. In comparison, PhotoGuard only partially disrupts the gen- erated content: although localized facial artifacts emerge, the identity, background, and motion trajectory remain recognizable in several cases. The consistent failure pat- Table 2: Ablation results of text-conditioned perturba- tion generation. Perturbation Generator InputVideo Quality Degradation (↓) Visual FeatureText EmbeddingVBench-IQQ-AlignGemini-MP ✓0.57550.55244.6600 ✓0.57460.55854.5200 terns induced by MAD across all three architectures demonstrate that it generalizes beyond model-specific ar- tifact patterns and provides similarly effective protection against the evaluated I2V models. Additional qualitative examples are provided in the supplementary material. Ablation Study We evaluate three key designs of I2VShield on CelebV- Text: (1) text-adaptive perturbation generation, which incorporates the text embedding as an additional input to the perturbation generator, (2) the optimization tar- get (our MAD attack vs. standard predicted noise at- tack), and (3) the PatchGAN discriminator (L adv ) for fidelity regularization. 7 CogVideoX-5BWan2.1-14BOpenSora-V2-11B Generated video Input image Generated video Input image Generated video Input image Original PhotoGuard I2Vsheild “A young woman with bright pink hair and a flower crown expresses shock while watching an animated scene.” Prompt “A man with a goatee wearing a red baseball cap talks while looking at the camera.” “A man wearing a red alien graphic tee makes an apology while sitting in his home office.” Figure 5: Qualitative comparison between the proposed method and the baseline. Our I2VShield produces more severe degradation in both visual appearance and temporal consistency. Table 3: Ablation results of attention disruption Attack Target Video Quality Degradation (↓) VBench-IQQ-AlignGemini-MP Predicted Noise0.57490.56774.5600 Attention Disruption0.57460.55854.5200 Table 4: Fidelity comparison of protected reference im- ages. Loss Function Image Fidelity Metrics LPIPS (↓)PSNR (↑)SSIM (↑) w/o L adv 0.327830.51590.6814 w/ L adv 0.319132.72290.7885 Effectiveness of Text-adaptive Perturbation Gen- eration As shown in Table 2, VBench-IQ and Q-Align mea- sure visual quality using VBench and Q-Align, re- spectively, while Gemini-MP evaluates motion smooth- ness with Gemini; lower scores indicate stronger degra- dation. Adding text embeddings reduces VBench-IQ and Gemini-MP, demonstrating improved degradation of both visual quality and motion smoothness. Although Q- Align slightly increases slightly, the two variants remain broadly comparable on this metric. Overall, text condi- tioning provides complementary semantic guidance for generating more effective prompt-aware perturbations. Effectiveness of MAD Attack As demonstrated in Table 3, targeting internal cross- attention features achieves more effective video degrada- tion than perturbing the predicted noise space. Our full framework consistently outperforms the predicted noise attack across all evaluation metrics, with a particularly notable improvement on Q-Align, whose visual-quality score decreases from 0.5677 to 0.5585. These results sug- gest that perturbing cross-attention features more effec- tively disrupts multimodal feature alignment, leading to accumulated distortions in both visual appearance and temporal consistency throughout the video generation process. Contribution of Discriminator Regularization Table 4 and Figure 6 illustrate the impact of the Patch- GAN discriminator. Without L adv , the MAD-only vari- ant introduces noticeable structural and high-frequency artifacts. Incorporating L adv improves PSNR by 7.2%, reduces the LPIPS score by 2.7%, and yields a more pro- nounced 15.7% gain in SSIM, indicating that the discrim- inator is particularly effective in preserving structural in- formation. These improvements suggest that adversarial supervision regularizes perturbation generation, encour- aging texture-adaptive perturbations that better align with the underlying image distribution while maintain- ing the protection capability. w/ discrimination w/o discrimination sampleperturbationsampleperturbationsampleperturbation Figure 6: Effect of discriminator regularization on pro- tected image fidelity. Conclusions We propose I2VShield, an efficient proactive pri- vacy defense against DiT-based I2V models. Unlike costly iterative gradient-based methods, I2VShield uses a lightweight generative framework to produce text- adaptive adversarial perturbations in a single forward pass. Its untargeted MAD attack maximizes feature 8 deviation within DiT cross-attention layers, weakening image-text conditioning. Experiments across multiple I2V models demonstrate competitive protection perfor- mance with substantially lower inference time and mem- ory consumption, supporting practical large-scale pro- tection. References Andreas Blattmann, Robin Rombach, Huan Ling, Tim Dockhorn, Seung Wook Kim, Sanja Fidler, and Karsten Kreis. Align your latents: High-resolution video synthesis with latent diffusion models. In Pro- ceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 22563–22575, 2023. Tim Brooks, Bill Peebles, Connor Holmes, Will DePue, Yufei Guo, Leo Jing, David Schnurr, Joe Taylor, Troy Luhman, Eric Luhman, et al. Video generation models as world simulators. OpenAI Blog, 1(8):1, 2024. Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020. Dongnan Gui, Xun Guo, Wengang Zhou, and Yan Lu. I2vguard: Safeguarding images against misuse in diffusion-based image-to-video models. In Proceedings of the Computer Vision and Pattern Recognition Con- ference, pages 12595–12604, 2025. Yuwei Guo, Ceyuan Yang, Anyi Rao, Zhengyang Liang, Yaohui Wang, Yu Qiao, Maneesh Agrawala, Dahua Lin, and Bo Dai. Animatediff: Animate your person- alized text-to-image diffusion models without specific tuning. arXiv preprint arXiv:2307.04725, 2023. Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural in- formation processing systems, 33:6840–6851, 2020. Wenyi Hong, Ming Ding, Wendi Zheng, Xinghan Liu, and Jie Tang.Cogvideo: Large-scale pretraining for text-to-video generation via transformers. arXiv preprint arXiv:2205.15868, 2022. Ziqi Huang, Yinan He, Jiashuo Yu, Fan Zhang, Chenyang Si, Yuming Jiang, Yuanhan Zhang, Tianxing Wu, Qingyang Jin, Nattapol Chanpaisit, et al. Vbench: Comprehensive benchmark suite for video generative models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 21807–21818, 2024. Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei A Efros. Image-to-image translation with conditional ad- versarial networks. In Proceedings of the IEEE confer- ence on computer vision and pattern recognition, pages 1125–1134, 2017. Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Ad- versarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016. Xin Ma, Yaohui Wang, Xinyuan Chen, Gengyun Jia, Zi- wei Liu, Yuan-Fang Li, Cunjian Chen, and Yu Qiao. Latte: Latent diffusion transformer for video genera- tion. arXiv preprint arXiv:2401.03048, 2024. AleksanderMadry,AleksandarMakelov,Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017. William Peebles and Saining Xie.Scalable diffusion models with transformers.In Proceedings of the IEEE/CVF international conference on computer vi- sion, pages 4195–4205, 2023. Zuomin Qu, Wei Lu, Xiangyang Luo, Qian Wang, and Xiaochun Cao. Id-guard: A universal framework for combating facial manipulation via breaking identifi- cation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 48(2):1720–1735, 2026. Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ̈orn Ommer. High-resolution im- age synthesis with latent diffusion models. In Proceed- ings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner. Faceforensics++: Learning to detect manipulated fa- cial images. In Proceedings of the IEEE/CVF inter- national conference on computer vision, pages 1–11, 2019. Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, An- drew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. arXiv preprint arXiv:2302.06588, 2023. Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by Text-to-Image mod- els. In 32nd USENIX Security Symposium (USENIX Security 23), pages 2187–2204, 2023. Khurram Soomro, Amir Roshan Zamir, and Mubarak Shah.Ucf101: A dataset of 101 human actions classes from videos in the wild. arXiv preprint arXiv:1212.0402, 2012. 9 Sergey Tulyakov, Ming-Yu Liu, Xiaodong Yang, and Jan Kautz. Mocogan: Decomposing motion and content for video generation. In Proceedings of the IEEE confer- ence on computer vision and pattern recognition, pages 1526–1535, 2018. Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti-dreambooth: Protecting users from personalized text-to-image syn- thesis.In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision, pages 2116– 2127, 2023. Team Wan, Ang Wang, Baole Ai, Bin Wen, Chaojie Mao, Chen-Wei Xie, Di Chen, Feiwu Yu, Haiming Zhao, Jianxiao Yang, et al. Wan: Open and advanced large-scale video generative models. arXiv preprint arXiv:2503.20314, 2025. Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8695–8704, 2020. Haoning Wu, Zicheng Zhang, Weixia Zhang, Chaofeng Chen, Liang Liao, Chunyi Li, Yixuan Gao, Annan Wang, Erli Zhang, Wenxiu Sun, et al. Q-align: Teach- ing lmms for visual scoring via discrete text-defined levels. arXiv preprint arXiv:2312.17090, 2023. Wenbo Xu, Junyan Wu, Wei Lu, Xiangyang Luo, and Qian Wang. A multimodal deviation perceiving frame- work for weakly-supervised temporal forgery localiza- tion. In Proceedings of the 33rd ACM International Conference on Multimedia, pages 11581–11589, 2025. Wilson Yan, Yunzhi Zhang, Pieter Abbeel, and Aravind Srinivas. Videogpt: Video generation using vq-vae and transformers. arXiv preprint arXiv:2104.10157, 2021. Jianhui Yu, Hao Zhu, Liming Jiang, Chen Change Loy, Weidong Cai, and Wayne Wu. Celebv-text: A large- scale facial text-video dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 14805–14814, 2023. Zangwei Zheng, Xiangyu Peng, Tianji Yang, Chen- hui Shen, Shenggui Li, Hongxin Liu, Yukun Zhou, Tianyi Li, and Yang You. Open-sora: Democratiz- ing efficient video production for all. arXiv preprint arXiv:2412.20404, 2024. 10 Supplementary Material A Quantitative Results Details The main paper reports the average quantitative results of the proposed I2VShield and the baseline method across the CelebV-Text and UCF101 datasets. Here, we further provide the quantitative results on each dataset separately for a more detailed comparison. Table 5: Comparative Experimental Results on CelebV-Text MethodVRAM(GB)TFLOPs VBenchQ-alignGemini-3.1-flash-lite Sub. Cons.Bg. Cons.Mot. SmoothImg. QualityVis. ScorePrompt Cons.Temp. Cons.Mot. Plaus.Frame Qual. CogVideoX-5B Clean--0.91950.93830.97670.60920.71184.88003.88004.66003.8200 Random Noise--0.91920.93570.97510.60420.70454.88003.86004.66003.8000 PhotoGuard26.001438.020.90600.92360.97500.58400.65904.78003.72004.44003.6600 I2VShield (Ours)9.492.270.90040.91820.97210.60920.65854.74003.82004.68003.7200 Wan2.1-14B Clean--0.88770.92020.97120.61630.69984.78003.88004.68003.8200 Random Noise--0.88610.92180.96950.62470.70894.88003.92004.76003.9400 PhotoGuard40.972127.090.84670.89620.96270.58340.57234.88003.72004.54003.6600 I2VShield (Ours)12.294.980.83030.88640.95940.57460.55854.86003.74004.52003.6000 OpenSora-V2-11B Clean--0.92660.95040.99130.59810.64124.82003.98004.78003.8800 Random Noise--0.92960.94930.99070.60020.63114.76003.90004.76003.8000 PhotoGuard32.89377.500.92970.94910.98950.59690.59464.80004.02004.72003.8400 I2VShield (Ours)9.7814.590.92230.94760.98940.60980.62874.70003.96004.70003.8800 Table 6: Comparative Experimental Results on UCF101 MethodVRAM(GB)TFLOPs VBenchQ-alignGemini-3.1-flash-lite Sub. Cons.Bg. Cons.Mot. SmoothImg. QualityVis. ScorePrompt Cons.Temp. Cons.Mot. Plaus.Frame Qual. CogVideoX-5B Clean--0.90140.93020.98050.38690.37005.00004.06004.94003.7400 Random Noise--0.89940.93000.98130.37280.35525.00004.00004.92003.6000 PhotoGuard18.851438.020.89720.92700.98050.38900.37525.00003.96004.94003.6200 I2VShield (Ours)9.492.190.89200.93140.97910.38640.38475.00004.02004.88003.7700 Wan2.1-14B Clean--0.86850.91880.96330.42840.33934.94003.98004.92003.4000 Random Noise--0.84440.91210.96700.43140.32835.00004.00004.98003.3600 PhotoGuard40.862139.920.82910.90640.95740.40790.30214.96004.00004.96003.3800 I2VShield (Ours)12.254.910.82810.90710.95180.40430.30225.00003.92004.84003.1200 OpenSora-V2-11B Clean--0.92080.94860.98960.48750.40714.94003.98004.94003.6000 Random Noise--0.91860.95020.98850.47890.40995.00004.02005.00003.6200 PhotoGuard36.56377.500.92360.95010.98800.47170.38555.00004.04004.98003.5000 I2VShield (Ours)9.7914.590.91950.94720.98710.47690.37785.00004.06004.90003.4600 B More Qualitative Results We provide additional qualitative comparisons between the proposed I2VShield and the baseline method for defending against CogVideoX-5B, Wan2.1-14B, and OpenSora-V2-11B, respectively. Please refer to Figure 7, 8, and 9. 11 Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A young woman with dark hair and wearing a black blazer expresses her deep regret for wasting time.” >_ Prompt Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A man discusses the medical risks and potential consequences of cardiac injuries in a video.” >_ Prompt Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A male swimmer performs a front crawl stroke in a pool.” >_ Prompt Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A skydiver and his tandem partner freefall against a beautiful blue sky over a scenic landscape.” >_ Prompt Figure 7: Qualitative comparison of I2VShield and baseline methods for protecting reference images against CogVideoX-5B. 12 Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A woman with dark hair and gold hoop earrings speaks about Jared Padalecki's roles in the TV shows.” >_ Prompt Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A man in a baseball cap stands on a street and talks about colonial Spanish architecture and history.” >_ Prompt Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A woman performs a squat exercise by lowering her body onto a block and then standing back up.” >_ Prompt Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A man is training in a home gym by hitting a large punching bag.” >_ Prompt Figure 8: Qualitative comparison of I2VShield and baseline methods for protecting reference images against Wan2.1- 14B. 13 Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A woman with a headband talks to the camera, emphasizing the importance of maintaining faith and continuing to pray.” >_ Prompt Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A Chinese weightlifter shows intense emotion and passion while celebrating a successful lift during a competition.” >_ Prompt Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A talented gymnast performs an impressive aerial maneuver on a blue mat, receiving enthusiastic applause from her audience.” >_ Prompt Generated videoInput image PhotoGuard I2Vsheild(Ours) Original “A man in a suit is playing the grand piano during a classical music performance.” >_ Prompt Figure 9: Qualitative comparison of I2VShield and baseline methods for protecting reference images against OpenSora-V2-11B. 14