Anti-I2V: Protecting Photos from Malicious AI Video Generation

Paper: 2603.24570 Authors: Duc Vu, Anh Nguyen, Chi Tran, Anh Tran Categories: cs.CV, cs.AI

The Gap

Existing adversarial defenses against AI-generated content mostly target image generation models. When they do address video, they focus on UNet-based architectures. The problem: newer Diffusion Transformer (DiT) models have stronger feature retention and temporal consistency, making old attacks ineffective. Plus, image-to-video models are fundamentally different beasts—they need to maintain coherence across frames, not just corrupt a single image.

Problem: DiT-based I2V models create convincing fake videos
    |
    v
Gap: Existing defenses target UNet image generation
    |
    v
Assumption: Attacking temporal coherence > attacking single frames
    |
    v
Method: Multi-domain perturbations (L*a*b* + frequency) + layer-specific objectives
    |
    v
Evidence: SOTA defense across diverse VDM architectures
    |
    v
Conclusion: Domain-aware + layer-targeted = robust I2V defense

The Increment

One sentence: Before Anti-I2V, adversarial defenses couldn’t reliably break video generation from photos across different model architectures; after, there’s a unified approach that works on both UNet and DiT models by attacking color perception and temporal consistency simultaneously.

Core Mechanism

Anti-I2V operates in three stages. First, it converts the input image into Lab* color space and frequency domain representations—this gives two attack surfaces instead of just RGB pixels. Second, it identifies which layers in the diffusion model capture the most semantically distinct features during denoising. Third, it crafts perturbations that maximize two objectives: breaking temporal coherence between frames and degrading overall generation fidelity.

The perturbations are concentrated on salient pixels (the parts humans notice most) rather than spread uniformly. During training, the method feeds perturbed images through the target video diffusion model and measures how badly the output degrades. The optimization loop adjusts perturbations to maximize this degradation while keeping changes imperceptible to human eyes.

Input Photo
    |
    +---> RGB Space
    |         |
    +---> L*a*b* Space ----+
    |         |            |
    +---> Frequency Domain-+---> Perturbation Crafting
              |                        |
              v                        v
    Layer Feature Analysis      Optimization Loop
              |                        |
              +------------------------+
                        |
                        v
              Protected Image (looks normal to humans,
                              breaks video generation)

Think of it like sabotaging a film projector. A regular attack might scratch the film randomly—sometimes it works, sometimes not. Anti-I2V is more surgical: it identifies which sprocket holes (layers) are critical for smooth playback, then damages those specific points. It also works in the projector’s color filters (Lab*) and the film’s grain structure (frequency domain), not just the visible image. The projector (diffusion model) tries to play the film, but the frames won’t align properly, colors shift weirdly, and the motion looks janky—yet if you hold up a single frame to the light, it looks fine.

Key Concepts

• Lab Color Space**: Unlike RGB which mixes red/green/blue channels, L**ab separates lightness (L*) from color information (a* for green-red, b* for blue-yellow). This matches human perception better—we’re more sensitive to lightness changes than color shifts. Attacking in Lab* means you can hide perturbations in color channels where humans are less sensitive, while still breaking the model’s understanding. Example: slightly shifting a* values makes skin tones look “off” to AI but normal to humans.

• Frequency Domain Perturbations: Images can be decomposed into low frequencies (smooth gradients, overall shapes) and high frequencies (edges, textures). Video models rely heavily on low-frequency consistency for temporal coherence. By attacking frequency components directly via DCT or wavelet transforms, Anti-I2V can disrupt motion flow without creating visible artifacts. Example: corrupting low-frequency components makes the AI see a face as “shifting” between frames even though each frame looks stable.

• Layer-Specific Feature Targeting: Not all layers in a diffusion model matter equally. Early layers capture coarse structure, middle layers handle semantics (is this a face?), late layers refine details. Anti-I2V profiles which layers have the most distinct features during denoising, then designs loss functions that specifically corrupt those layers’ outputs. This is more efficient than attacking the entire model uniformly. Example: if layer 15 is where the model decides “this is a person walking,” corrupting layer 15’s features makes the walk cycle incoherent.

Framework Shift

Before (mainstream approach):        After (Anti-I2V):

RGB Perturbation                     Multi-Domain Attack
      |                                   |
      v                              +----+----+
  UNet Layers                        |    |    |
      |                             RGB  L*a*b* Freq
      v                              |    |    |
  Image Output                       v    v    v
  (single frame focus)          Layer Profiling
                                     |
                                     v
                                Temporal + Fidelity
                                     |
                                     v
                                Video Output
                                (frame sequence focus)

From attacking what the model sees (RGB pixels) to attacking how the model thinks (color perception + frequency structure + temporal reasoning), the core shift is from single-frame corruption to multi-frame incoherence.

Expert Assessment

Problem choice: Real and timely. Deepfake videos are a genuine threat, and the shift from UNet to DiT architectures is happening now. The gap is legitimate—existing defenses weren’t designed for video or transformers.

Method maturity: Solid engineering rather than breakthrough insight. The multi-domain approach is clever but not revolutionary—it’s combining known techniques (L**ab attacks, frequency perturbations, layer-specific targeting) in a sensible way. The layer profiling step is the most novel contribution, but it’s incremental. No simpler approach is obviously overlooked.

Experimental integrity: Baselines are fair, covering both UNet (AnimateDiff, MagicAnimate) and DiT (CogVideoX) models. The metrics (FID, temporal consistency, LPIPS) are appropriate. One concern: all experiments use the same dataset (VoxCeleb). Cross-dataset validation would strengthen claims. The ablation studies are thorough.

Writing quality: The method section is dense—too much notation upfront before intuition. The paper would benefit from moving Figure 2 (method overview) earlier and explaining the “why” before the “how.” The related work section undersells the novelty by listing too many tangentially related papers.

Verdict: weak accept — Addresses a real problem with a competent solution, but the contribution is more engineering than insight. Useful for practitioners, not paradigm-shifting.

Takeaways

The layer profiling technique is portable: instead of attacking a model uniformly, profile which layers capture the most task-relevant features, then concentrate your attack there. This applies beyond adversarial defenses—think model compression, interpretability, or transfer learning.

The multi-domain strategy (RGB + Lab* + frequency) is a template for robustness. If your attack fails in one representation, try others where the model might be more vulnerable. This generalizes to audio (time + frequency), text (token + embedding space), or multimodal models.

The temporal coherence objective is worth stealing for video quality metrics. Instead of evaluating frames independently, measure how features drift across time. This could improve video compression, frame interpolation, or motion prediction tasks.