Anti-I2V disrupts deepfake image-to-video generation models
New research proposes Anti-I2V, an adversarial cloaking method to stop a single portrait photo being turned into a convincing video by diffusion-based image-to-video models. It perturbs colour and frequency domains and targets internal layers to break identity and temporal coherence. Results look strong, but some limits remain.
Deepfake video no longer needs much fuel. One photo plus a helpful text prompt is often enough for modern image-to-video systems to spin up a moving, lip-synced clip. The paper behind Anti-I2V takes aim at that pipeline by making the source photo a hostile surface. Rather than nudging RGB pixels, it perturbs colour and frequency information and messes with what the video model learns over time.
What it does
Anti-I2V applies small, crafted changes in two places that video diffusion models tend to rely on. First, it alters the a and b channels of the L a b colour space, which shifts chroma while leaving luminance alone. Second, it tweaks low-frequency coefficients in the Discrete Cosine Transform, which influence broad structure rather than fine detail. The intent is to look normal to people while starving the model of stable, identity-rich signals.
On top of that, the method targets how the denoiser represents the subject as it removes noise over time. The authors locate intermediate layers with high semantic content in both UNet and Diffusion Transformer backbones. They then optimise two losses: Internal Representation Collapse, which drags deep features toward low-level early features, and Internal Representation Anchor, which pushes features toward or away from those of an unrelated latent. Auxiliary perceptual losses are used to steady the optimisation.
In tests on CelebV-Text and UCF101 with models including CogVideoX-5B, OpenSora v1.2 and DynamiCrafter, the dual-space perturbation outperforms RGB-only updates. Reported identity and quality scores drop sharply. For DynamiCrafter, identity similarity falls to 0.151 with a Q-Align V of 0.047, compared to clean outputs at 0.528 and 0.794. On UCF101 the method reports 0.068 for identity and 0.084 for Q-Align V versus 0.384 and 0.562. The perturbations also remain more stable under JPEG compression, blur, Gaussian noise and several purification procedures. Transfer between diffusion transformer models holds up, and even cross-architecture transfer to UNet variants is described as competitive.
Where it falls short
There are caveats that matter for deployment. The optimisation uses 200 iterations and a perturbation budget of 16 over 255 in L a b. That is workable for a defender preparing a profile photo, but not cheap at scale. More importantly, the method computes gradients through a surrogate video diffusion model to place and shape the noise. The paper shows decent transfer between some models, but real attackers often use proprietary services. If your cloak is tuned on one open model and the adversary uses another with different preprocessing or a stronger face encoder, transfer could degrade.
The evaluation only feeds the first four frames into the optimisation to save memory. That is understandable, but it sidesteps the question of how protection holds as long videos accumulate evidence across dozens or hundreds of frames. The authors also note that some perceptual metrics understate how subtle the changes look, since colour-space edits inflate pixel-wise differences. On the flip side, platforms routinely resize, crop, convert colour spaces and strip metadata. The method survives several common distortions, but social platforms stack them, and face tracking can re-centre crops. The tests do not cover that full gauntlet.
Baselines are limited by available implementations, and adding RGB updates on top of the dual-space approach hurts performance because the small budget has to be split. That suggests the technique is sensitive to how the budget is allocated. A determined adversary will also try video-specific countermeasures, such as purification tuned for diffusion transformers, identity restoration, or fine-tuning with adversarial training against known cloaks.
Still, the core idea lands. Hitting colour and frequency where the model leans on stable identity cues, then corrupting internal representations that drive temporal coherence, is a defensible way to raise the cost of person-specific video generation. If you run media authentication or need to publish high-risk images, this is a promising layer. The open questions are about longevity under platform pipelines and future model hardening, not about whether the current results are real.
Additional analysis of the original ArXiv paper
