Research map / Video / Video generation

I2VGuard: Safeguarding Images against Misuse in Diffusion-based Image-to-Video Models

CVPR 2025 · Video › Video generation · approach: Efficient video diffusion models · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes I2VGuard, an adversarial perturbation method that adds imperceptible noise to images so that diffusion image-to-video models (SVD, CogVideoX, ControlNeXt-SVD) generate degraded, temporally inconsistent videos.

Problem

Protecting images from misuse in diffusion-based image-to-video generation, where generated videos can depict people or animals in harmful or copyright-infringing ways; prior image protections target editing rather than temporal video generation.

Approach

Combines a spatial encoder attack (push VAE latents toward a black-image target), a temporal attack (push temporal self-attention maps away from original maps), and a contrastive diffusion attack (pull predicted frames toward black target frames and away from original frames) into a white-box adversarial perturbation optimized on the input image.

Key results

• On SVD, guarded images reduce subject consistency from 95.86% to 91.57% and aesthetic quality from 56.76% to 53.42%.
• On CogVideoX, guarded images reduce subject consistency from 97.02% to 93.50%, with CogVideoX showing more resistance than SVD.
• Guarded images achieve PSNR 31.83 and SSIM 0.868 versus 26.22 and 0.774 for random noise of comparable strength.

Measured effects reported in the paper

Surprising findings

• Random noise has little effect on generation because the VAE filters it out, while structured perturbations do degrade output.
• Pose control in ControlNeXt-SVD remains robust even when spatial appearance is distorted by the attack.

Limitations

• Evaluated only on white-box access to specific models; transferability is limited for stronger models like CogVideoX requiring larger noise.
• Small self-collected dataset of 300 images; no public benchmark.
• Protection time per image (minutes) and high GPU memory requirements.

Experimental setup

Datasets: 300-image dataset of people and animals with dynamic actions (self-collected)

Benchmarks: VBench

Metrics: PSNR SSIM FID Subject Consistency Motion Smoothness Aesthetic Quality Image Quality (MUSIQ)

Baselines: PhotoGuard Random Noise

Builds on: PhotoGuard Latent Diffusion Models Stable Video Diffusion

Closest papers by meaning

• DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.88)
• AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models (ICML 2025 · similarity 0.87)
• Identifying and Solving Conditional Image Leakage in Image-to-Video Diffusion Model (NeurIPS 2024 · similarity 0.87)
• Pixel Is Not a Barrier: An Effective Evasion Attack for Pixel-Domain Diffusion Models (AAAI 2025 · similarity 0.86)
• OSV: One Step is Enough for High-Quality Image to Video Generation (CVPR 2025 · similarity 0.86)
• AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption (ICLR 2025 · similarity 0.86)