KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

Under ℓ∞≤16/255, make face videos difficult for unauthorized diffusion customization to reproduce identity.

• Scenario: The authors state that a few face clips or even a single portrait can synthesize videos of a person without consent, posing risks such as deepfakes. Customization can be fine-tuning or conditioning on a single frame at inference.
• Existing methods: The authors state that existing protections mainly target text-to-image, by maximizing denoising loss or separating VAE features, and mostly protect single images. They are hard to transfer to video models using 3D VAE and DiT; identity is distributed across multiple frames, and naive full-video perturbations are easily removed by frame averaging.
• Observation: Both phases are based on LETHE. The authors state that the diversity of the reference Value dominates how I2V reads the reference image; modifying only the initial VAE latent does not directly limit the information provided by the reference representation in subsequent self-attention.
• Approach: The submission is KVeil. Phase 1 uses Reference Capacity Collapse and Motion-Guided EOT to disrupt the known I2V's reading of reference frames. Phase 2 combines face-region structural perturbation and background-region white-box disruption into a single perturbation.
• Threat model:
  • Goal: After the protected video enters customization, the official protection score increases. The score is converted from measurements of identity, quality, prompt following, etc., to 0–100, higher means stronger protection.
  • Knowledge: The effect-track model is the known Wan2.2-TI2V-5B, with white-box access retained by the defender. Final prompts, reference sampling, evaluation, temporal attacks, and transfer models are hidden during evaluation; the transfer track targets unseen black-box video models.
  • Capability: The reference-based path can first apply undisclosed temporal processing or purification, then sample a frame and feed it with text into I2V. The fine-tuning-based path performs LoRA fine-tuning on the protected clips of that identity before generation. Budget is ℓ∞≤16/255.
  • Victim system: Face videos. Phase 1 is one 113-frame, 640×480 segment; Phase 2 is 10 segments of the same identity. Phase 1 only evaluates reference-based; Phase 2 evaluates both paths' effect, robustness, and transferability (Table 3).

Related work is organized by generative customization and proactive protection; the authors place this paper's difference on DiT video models and full portrait videos.

• Image generation and customization: Rombach et al. (2022)'s Stable Diffusion denoises in latent space with a UNet. Subject customization is mostly training-based, such as LoRA (Hu et al., 2021), binding the subject to a special token. Gal et al. (2022), Ruiz et al. (2023), Kumari et al. (2023) pursue subject fidelity with fewer reference images and lower training cost. The paper only describes these here, without comparing scores with KVeil.
• Video generation and customization: The authors state that modern video models first use a 3D VAE pretrained on large-scale data for spatiotemporal compression, then a DiT generates in latent space; attention layers repeatedly read frame features and text conditions. Besides fine-tuning, reference-based generation feeds only one frame at inference and has become a standard capability of several models and online services. The text names Wan, Kling, HunyuanVideo, LTX-2, etc.; this section has no protection scores.
• Protection against unauthorized customization: The image side is grouped into two lines: maximizing denoising loss on protected images to interfere with training (Liang et al., 2023; Van Le et al., 2023), or pushing VAE features away from the original image (Shan et al., 2023; Wu et al., 2025). Liu et al. (2024) and Wang et al. (2024) further optimize over diffusion timesteps, alternative training dynamics, and prompts. On the video side, the authors list methods that follow the above lines and target reference-based generation (Chowdhury et al., 2025; Gui et al., 2025; Guo et al., 2026; Pang et al., 2024; Vu et al., 2026). The authors state that most of them are effective on video models extended from the UNet era, and are quite limited on the latest DiT models: adversarial noise under a given budget can hardly substantially change 3D VAE features; reference-based generation does not update parameters, so the line of disrupting training objectives is even less applicable; multi-layer attention tends to discard perturbations as noise. The authors also state that existing I2V protections mostly protect a single reference image, and naive full-video perturbation is easily removed by frame averaging.
• Baselines and benchmarks: The paper does not reproduce the above protection methods as numerical baselines. The leaderboard comparisons are against other teams: Phase 1 is JLShen, Rover; Phase 2 is Pawn, Sprint (Tables 1–2). The authors' own tests compare against clean videos, as well as their own loss combinations and layer variants. The protocol is LifeGenIP (Table 3); input video specifications cite MEAD (Wang et al., 2020).

The authors position this report as an adaptation of LETHE to the challenge setting: Phase 1 instantiates its two complementary losses and adds motion-guided EOT; Phase 2 uses layered perturbation to handle both fine-tuning-based customization and unseen models. For theoretical analysis and more complete evaluation, the authors refer readers to the LETHE paper.

KVeil optimizes a shared perturbation on face videos before release: Phase 1 disrupts the known I2V's reading of reference frames, Phase 2 then stacks transferable face-structure perturbation and white-box background disruption within the same budget.

Challenge setup

• Input and budget: Phase 1 is one 113-frame, 640×480 face video; Phase 2 is 10 segments of the same identity. Both phases have ℓ∞≤16/255.
• Paths: Reference-based samples one frame from the protected clip and feeds it with text into I2V. Fine-tuning-based performs LoRA on the video diffusion model using that identity's clips, then generates from text.
• Visible information: The defender has white-box access to Wan2.2-TI2V-5B and uses it to guide optimization. Final prompts, reference sampling, evaluation, temporal attacks, and transfer models are hidden during evaluation.

Reference Capacity Collapse

In Wan2.2-TI2V-5B, the VAE-encoded reference image occupies the first temporal position of the video latent, the rest are noise-initialized, and after patchify they enter global self-attention. The authors state that perturbing only the initial VAE latent does not directly limit the information provided by the reference representation in subsequent spatiotemporal modeling.

• V-capacity collapse: Compresses the spatial diversity of the reference region's Value. For each attention head, compute normalized dispersion, then average over all heads. Minimize L_V=1/H∑_h(∑_i|v_0,i^h−v̄₀^h|₂²)/(∑_i|v_0,i^h|₂²+ξ), making fine-grained identity features more homogeneous.
• K-attract: Capacity collapse alone does not guarantee that the degraded reference continues to influence later frames. Average-pool the future frames' Query and the reference region's Key, minimize LK to pull the reference Key toward the current retrieval direction of the future Query; use stop-gradient on the Query side.
• Auxiliary terms: Appendix A has three additional terms. LVAE increases the latent MSE and structural difference between protected and clean references. Ltext makes cross-attention outputs of different tokens on target blocks more similar. LIQ suppresses the high-quality faces that the generation prior would fill in, based on MSCN neighborhood correlation of VAE reconstruction. The authors state that when the main loss and VAE terms are strong enough, the model may instead rely on text and prior, generating smooth faces unrelated to the original identity, thus still leaving high quality and prompt-following scores in Phase 1.

Motion-Guided EOT

• Shared perturbation: Not optimized per-frame independently. A video-level δ is learned, added to all frames and clipped, with infinity norm not exceeding ε. The authors state that per-frame independent perturbations are temporally inconsistent and easily removed by temporal processing.
• Representative frames: Use Farnebäck optical flow to estimate motion between adjacent frames, with the spatial average of flow magnitude as that frame's motion amount. Divide the video into K energy-balanced windows based on normalized cumulative motion, and take the frame with maximum motion in each window. K=5. The authors state that global Top-K may concentrate in the same motion segment.
• Randomization: EOT instances are ω=(x,τ,p,b). x is sampled from these 5 frames; τ includes identity, JPEG, Gaussian blur, Gaussian noise, random downsampling then upsampling; p is six semantically similar prompts; b is sampled from block set B={0,3,6}. Each step uses M samples to estimate the expectation of the total loss.
• Usage values in Appendix B: M=3, optimize 90 steps; δ initialized as U(−ε/4, ε/4); momentum sign update, step size η=ε/20, momentum coefficient β=0.9; λK=0.5. Denoising 25 steps, target fixed at the 5th denoising step. Text collapse, VAE MSE, VAE structural difference, and quality term weights are 1.0, 1.0, 1.0, 2.0. Unless otherwise specified, random seed is 0.

Phase 2 two-layer perturbation

The authors state that Phase 1 perturbations are mainly high-frequency, weakly related to face structure, easily weakened in black-box generation, and not easily learned as identity-related features during fine-tuning. Therefore, structure is introduced in the face region, while white-box disruption is retained in the background.

• Face layer: Use ChatGPT Image to generate synthetic faces with similar pose and imaging conditions to the anchor frame, different identity, and stable landmarks. The anchor frame is the first frame of each segment. Detect faces and extract 68-point landmarks, align with Umeyama similarity transform plus TPS, take appearance difference in CIELAB and subtract a Gaussian smoothing term, map residual back to RGB, multiply by a feathered face mask, take sign, with magnitude limited by ε. Then warp the perturbation and hard mask to each frame according to landmarks. Figure 2 marks several poses, e.g., t=6 yaw +8.6°, pitch −1.4°, t=108 yaw +5.0°, pitch −9.5°; the authors state the perturbation still falls in the corresponding face region. Figure 4 gives the generation prompt and six candidate images, whose wording constraints are not repeated here.
• Background layer: Non-face regions retain only V-capacity collapse, K-attract, and VAE latent disruption, removing the other Phase 1 auxiliary terms. Both VAE term weights are 1.0, optimize 200 steps. EOT additionally includes H.264 with CRF from [32, 35] and JPEG with quality from [35, 70]. Appendix B.2 also specifies CIELAB channel weights (1.2, 1.0, 1.0), smoothing standard deviation 6.0 pixels, residual scaling 20.0, TPS regularization 10^{-3}.
• Merging: Face first, then background. During white-box forward, the face perturbation is fixed, only optimizing the shared background perturbation in non-face regions, then adding and clipping with per-frame masks under the same budget. The process is in Algorithm 3.

Experimental setup

• Models: The effect and white-box surrogate model is Wan2.2-TI2V-5B. Transfer models in Table 3 are reference-based HunyuanVideo-1.5, Kling 3.0, and fine-tuning-based LTX-2, HunyuanVideo-1.5. The authors' self-tests specify running Wan2.2-TI2V-5B and HunyuanVideo-1.5. Synthetic target faces use ChatGPT Image.
• Data: Phase 1 uses one segment, Phase 2 uses ten, all 113 frames, 640×480, with specifications citing MEAD. Budget ℓ∞≤16/255.
• Baselines: Leaderboard compares against other teams. Author self-tests compare against clean videos, as well as V-capacity, K+V, full method, with/without face layer, and two background targets. The paper does not reproduce existing image or video protection methods as numerical baselines.
• Metrics: Invisibility measures similarity between original and protected videos, higher is more imperceptible. Eff., Rob., Trans. use FIP, which is a composite of face, quality, and prompt following. Self-tests additionally report Face, IQ, PF. The official evaluator converts measurements to a 0–100 protection score, higher means stronger protection; Face, IQ, PF in Table 4 and Figure 3 are also interpreted as higher means stronger disruption. The paper does not specify the evaluation model.
• Robustness: In Table 3, Phase 1 includes neighboring-frame interpolation, 7-frame temporal averaging, H.264 recompression. Phase 2 reference-based includes 7-frame averaging plus H.264, and VideoPure; fine-tuning-based includes 5-frame averaging plus temporal reversal, and H.264.
• Repetitions and steps: Appendix B states random seed 0 unless otherwise specified. The paper does not report the number of generated samples, repetitions, or variance for leaderboard or self-tests. LoRA self-test uses 1500 steps; Figure 5 saves checkpoints every 300 steps.

Main results

Swipe horizontally to read the table

Leaderboard item	KVeil	Second place	Third place
Phase 1 Final (Table 1)	77.72	71.63 (JLShen)	71.46 (Rover)
Phase 1 Eff. (Table 1)	80.03	82.69	74.74
Phase 1 Invis. (Table 1)	55.70	56.98	68.02
Phase 2 Final (Table 2)	38.88	37.77 (Pawn)	37.59 (Sprint)
Phase 2 reference-based Eff. (Table 2)	50.44	45.88	66.59

• The authors report rank 1 in both phases. Phase 1 Eff. and Invis. are not the highest among the three teams; Rob.3 not listed above is KVeil 82.85, JLShen 53.18, Rover 61.27 (Table 1).
• On Rob.1 and Rob.2 in Table 1, JLShen is higher: 84.29 and 85.55, while KVeil is 79.95 and 79.16. The paper does not specify which processing in Table 3 corresponds to Rob.1–3.
• Phase 2 Final is still first, but reference-based Eff. is not the highest. On fine-tuning-based Rob2 in Table 2, KVeil is 34.19, lower than Pawn's 43.83 and Sprint's 46.56. The authors do not explain these sub-metric shortfalls. The authors state that in Figure 1 the protected condition frame is still recognizable, but the generated subject shows distortion and temporal artifacts; the condition frame in that figure is r=24, not in the representative frame set S, nor the first frame, and the figure has no scores.

Phase 2 author self-tests

• What was tested: Reference-based uses random frames not involved in background optimization, reporting effect on Wan2.2-TI2V-5B and transfer on HunyuanVideo-1.5; fine-tuning-based performs LoRA on Wan2.2 over protected videos. Appendix C states Phase 2 experiments use the green prompt.
• Results: In Table 4, Wan2.2 I2V Face/IQ/PF change from 16.79/25.39/12.33 with clean reference frames to 82.66/27.59/35.51 with protected reference frames. HunyuanVideo-1.5 with protected reference frames is 34.40/26.08/26.53. Wan2.2 LoRA-1500 is 51.09/37.11/17.64.
• Authors' interpretation: The authors state that protected reference frames cause strong reference-based identity disruption for Wan2.2, and claim identity disruption under both customization paths. The abstract claims nearly perfect protection under white-box reference-based customization; this claim is not the same metric or setting as the leaderboard Eff. 80.03.

Reference capacity collapse ablation

• What was tested: Using prompts left out of EOT and the official Phase 1 evaluator released after the competition, comparing V-capacity only, adding K-attract, and the full method. Appendix C states this ablation uses the green prompt.
• Results: In Figure 3, clean face/iq/pf are 7.39/26.29/22.29; V-only is 79.83/71.82/42.14; K+V is 96.63/73.49/31.99; full method is 99.54/53.04/63.17.
• Authors' interpretation: The authors believe V-capacity and K-attract together form the core mechanism; the auxiliary term further raises Face Score to 99.54. The authors state that with V-only, the subject largely turns gray but retains recognizable outlines. The full method's IQ protection score is lower than K+V, and the paper does not explain this drop.

Target identity sensitivity

Six targets independently generated by ChatGPT Image are compared under the apple prompt for HunyuanVideo-1.5 reference-based transfer and Wan2.2-TI2V-5B 1500-step LoRA (Table 5, Appendix C).

Target	HunyuanVideo-1.5	Wan2.2 LoRA
T0 (used in main experiments)	66.86	93.12
T1	61.72	75.81
T2	60.56	87.27
T3	60.55	98.28
T4	62.49	83.60
T5	58.90	78.83

• The authors state T0 was selected according to development settings and used in all main experiments. The paper does not explain the score differences among the six targets.
• The 34.40 and 51.09 in Table 4 come from Phase 2 experiments; Appendix C states that experiment uses green, which is not the same prompt as apple in Table 5. The paper does not explain the numerical differences between the two tables.

Persistence against LoRA fine-tuning

• What was tested: Fine-tuning Wan2.2-TI2V-5B for 1500 steps on videos protected with different Phase 2 variants. Figure 5 plots Face Score over steps under the appear prompt; the text does not provide per-checkpoint readings.
• Authors' interpretation: The authors believe the variant with Prior-Aligned Face Protection is more persistent in later stages and higher at 1500 steps than the corresponding variant without the face layer. The authors state that the background variant using Phase 1 objectives has slightly higher Face Score, while this paper's white-box background causes stronger visual degradation, including subject blur and face out-of-frame; the latter sentence is the authors' description of the figure, and the visual is not visible in text conversion.
• Figure 6 Face Scores (1500 steps): phase2 background with face layer on green/appear/apple: 84.09/80.87/88.91; phase2 full-frame without face layer: 57.40/62.88/57.23; phase1 background with face layer: 86.88/89.01/92.03; phase1 full-frame without face layer: 65.09/70.11/67.49; clean video: 39.35/50.32/57.38. Corresponding IQ protection scores: phase2 background with face layer: 64.15/51.95/53.83; phase1 background with face layer: 43.41/42.08/38.62.

Other ablations and analyses

• Appendix B gives usage values but does not report baselines: Phase 1 uses 90 steps, M=3, K=5, λK=0.5; Phase 2 background layer uses 200 steps.
• Appendix C: at 600, 900, 1200 steps, models trained on unprotected videos often fail to generate detectable faces under green and apple; the authors therefore use appear for the checkpoint comparison in Figure 5.
• The paper does not report scores after removing a single auxiliary loss; Figure 3 only gives cumulative addition results.

Limitations and future directions noted by the authors

The paper does not specifically discuss limitations. The Conclusion only states the hope that this work provides a reference for practical video identity protection and inspires stronger subsequent defenses, without listing specific shortcomings or pending experiments.

Experimental coverage

• Challenge protocol is in Table 3. Phase 1 is reference-based, with effect model Wan2.2-TI2V-5B; robustness includes neighboring-frame interpolation, 7-frame temporal averaging, and H.264 recompression; this phase has no transferability column.
• Phase 2 includes both reference-based and LoRA fine-tuning. Transfer models are specified as HunyuanVideo-1.5, Kling 3.0, and LTX-2. Robustness includes 7-frame averaging plus H.264, VideoPure, 5-frame averaging plus temporal reversal, and H.264.
• The generation models used by the authors in Section 3.4 and Section 4 self-tests are Wan2.2-TI2V-5B and HunyuanVideo-1.5; LoRA is specified as 1500 steps. Synthetic target faces use ChatGPT Image, and six targets are compared (Table 5).
• Input is a 113-frame, 640×480 face video; Phase 2 uses 10 segments of the same identity, with budget ℓ∞≤16/255. The introduction states that theoretical analysis and more complete evaluation are in LETHE, and this report does not include those.
• The paper does not report the number of generated samples, repetitions, or official evaluator models for leaderboard and self-tests, nor does it specify the correspondence between the Rob./Trans. columns in Tables 1–2 and the settings in Table 3. Appendix B states that random seed 0 is used unless otherwise specified.

KVeil is a submission to the LifeGenIP unlearnable video challenge, adding ℓ∞≤16/255 perturbations to face videos before release to reduce the possibility of unauthorized customization reproducing identity.

• Problem: Phase 1 faces the known Wan2.2-TI2V-5B. An attacker can first apply hidden temporal processing, then sample unknown frames and unknown prompts for reference-based generation. Phase 2 additionally requires the same perturbation to handle LoRA fine-tuning and unseen black-box models.
• Method: The approach is based on LETHE. It reduces the spatial dispersion of the reference frame's Value and uses K-attract to make later frames continue retrieving this degraded condition. The shared perturbation is optimized via EOT over input transformations, prompts, and block depths, using 5 representative frames selected by motion-energy-based windowing. Phase 2 first writes structural residuals of a synthetic identity based on 68-point landmarks, then strengthens white-box disruption in non-face regions.
• Leaderboard: Tables 1–2 Final scores are 77.72 and 38.88, ranking 1st in both phases. Phase 1 Rob.3 is 82.85, while the other two teams are 53.18 and 61.27, but Invis. 55.70 and Eff. 80.03 are not the highest.
• Self-tests: Protected reference frames raise Wan2.2's Face Score from 16.79 to 82.66; HunyuanVideo-1.5 is 34.40; 1500-step LoRA is 51.09 (Table 4). In Figure 3, the full method's Face Score is 99.54, which is not the same metric as the leaderboard's FIP.
• Authors' conclusion: The authors state that such perturbations can reduce the ability to reproduce the original identity under various threats including reference-based and fine-tuning-based, and hope to provide a reference for subsequent video identity protection.