LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

How to prevent modern attention-based I2V models from faithfully animating a reference image into a high-quality video under common ℓ∞ budgets.

• Scenario: The authors state that, given a reference image and text prompt, I2V diffusion models can generate videos where the subject's appearance is preserved and the action matches the prompt. Personal photos may therefore be turned into videos of fabricated statements or actions without consent; the authors state such videos have natural motion and are deceptive, raising privacy and reputation concerns, and have drawn public and legislative attention.
• Existing limitations: Protective perturbations add small adversarial perturbations before sharing, causing diffusion models to produce unfaithful or low-quality outputs. The authors state this line of work has shown success in image editing and customization, but remains early for I2V, especially DiT models; in Fig. 1 with ε=16/255 and Wan2.1-I2V-14B, existing methods often introduce only local artifacts or minor changes, and identity and appearance remain recognizable to some degree.
• Authors' observation: The authors believe how subsequent frames read the reference image remains unclear, so objectives fall on proxy quantities only indirectly related to the reading, and the budget may be spent on features that subsequent frames do not read. Convex geometry analysis sets the radius of the minimum enclosing sphere of reference value vectors as an upper bound on readout diversity; the authors state that even mildly shrinking this spread disrupts the generated video.
• Proposed approach: A protection method, LETHE, which directly disrupts this reading process with a pair of complementary objectives; and re-annotated CelebV-Text and Kinetics-700 as two human-centric I2V protection benchmarks.
• Threat model:
  • Defender's goal: The generated video can no longer faithfully reproduce the reference image xref at high quality.
  • What the defender does: Publishes x′=xref+δ, constrained to ∥δ∥∞≤ε as in prior work. The loss is defined on the surrogate model's layers, heads, and denoising steps.
  • What the attacker does: Can collect x′ from the web, may apply input transformations, and then feed it to an I2V model with an arbitrary prompt y and random noise zT.
  • Unspecified parts: The problem formulation does not state whether the attacker's knowledge of the weights is white-box, black-box, or gray-box. White-box and transfer are experimental settings later in the paper.

I2V diffusion models

• Early models such as SVD (Blattmann et al., 2023) are mostly extensions of text-to-image UNets. The authors state that limited by capacity and spatiotemporal modeling, fidelity and temporal consistency are limited.
• CogVideoX (Yang et al., 2025), Wan (Wan et al., 2025), and LTX-Video (HaCohen et al., 2024) have shifted to DiTs with full spatiotemporal attention. The reference image is encoded into latent tokens aligned with the first frame, and subsequent frames obtain visual information mainly through attention.
• Long-video methods by Liu et al. (2026) and Yi et al. (2025) keep first-frame tokens as attention anchors. The authors state this helps long-range subject consistency, and therefore believe this reading pathway can also serve as a protection lever.

Protective perturbations on image generation

• PhotoGuard (Salman et al., 2023) and AdvDM (Liang et al., 2023): the authors state these are earlier works protecting images from editing and customization, by perturbing VAE latents or maximizing denoising loss so that models such as Stable Diffusion cannot faithfully process protected images.
• Subsequent work includes improving efficiency (Xue et al., 2024) and specific scenarios (Li et al., 2025; Jia et al., 2026). The paper only surveys these here and does not compare them item by item with LETHE.

Protection for I2V

• Early work mainly targets UNet-style models, such as Pang et al. (2024), Zhou et al. (2025), and I2VGuard (Gui et al., 2025). The authors state these models heavily inherit image diffusion components, and methods often follow image protection designs, such as disrupting the encoder.
• After DiT became mainstream, Long et al. (2026) and Anti-Prompt (Song et al., 2026) place objectives on intermediate features or the denoising process. The authors believe that reference features are passed to subsequent frames through deep spatiotemporal attention, and which internal quantity determines how much of the reference is reproduced remains unclear; if objectives target indirect proxies, the budget may be spent on features that contribute little to the reading.

Baselines and benchmarks

• Experimental baselines are PhotoGuard, AdvDM, SDS+ (Xue et al., 2024), I2VGuard, and Anti-Prompt. The authors state Anti-Prompt is a recent 2026 work specifically disrupting I2V and represents the state of the art in that direction at the time.
• Evaluation uses the authors' re-annotated CelebV-Text (Yu et al., 2023) and Kinetics-700 (Carreira et al., 2019). The authors state existing I2V benchmarks (Huang et al., 2024) have few face and human samples, and the original annotations of human-centric datasets cannot be directly used as I2V prompts.

The authors describe the difference between this paper and these works as: examining how I2V reads the reference image, thereby concentrating the budget more directly on the reading process.

LETHE places the protective perturbation on the pathway through which subsequent frames read reference tokens: it first reduces the diversity of reference values, then pulls the attention of subsequent frames toward these flattened tokens.

Readout pathway

• Given xref and prompt y, models such as Wan 2.1 and CogVideoX iteratively denoise from Gaussian noise zT. The current latent is split into spatiotemporal patches and linearly projected into tokens. The visual content of the reference image is carried by N reference tokens, usually positioned at the first frame.
• MLP and normalization act per token, and attention is the main operator for passing information between tokens. The hidden state hi of a reference token is projected into a key and a value: the key is used for matching, and the value carries the appearance to be passed. Queries of subsequent-frame tokens match against keys and receive values according to the matching proportions.
• Equation (1) denotes the content read by the m-th subsequent-frame token from the reference tokens as om. The weights αmi are renormalized only over the N reference tokens, are nonnegative, and sum to 1.

Convex hull upper bound

• Therefore om lies in the convex hull of the reference values. Attention can only select points within this convex hull and cannot read content outside the span of these values. The authors use this to explain: faces and backgrounds can be reproduced separately because the convex hull is large enough for different queries to reach points expressing different visual features.
• Proposition 1 lets R(V) be the radius of the minimal enclosing sphere of these values; then for any number of frame tokens and any attention weights in the simplex, 1/M∑_m=1^M|o_m−ō|²≤ R(V)². This expression states that readout variance is bounded above by the spread of the values, independent of how attention is distributed across reference tokens. If all values coincide, every normalized reference readout in that head equals the same vector.

Direct intervention

• In real generation, the authors replace each reference value with a version contracted toward the center of the minimal enclosing sphere by a ratio γ∈[0,1], so that R(V) shrinks linearly with γ. γ=1 is the original model, and at γ=0 the convex hull degenerates to a point. The intervention is applied at every layer; queries, keys, text conditioning, and noise seeds are unchanged.
• The authors state that γ=0.8 (20% contraction) already produces visible artifacts on faces, and at γ=0.7 (30% contraction) videos largely degrade into color patches with no recognizable subject. The authors state that applying the intervention to only some layers and denoising steps is also sufficient to break the video at 30% contraction; random perturbations of the same magnitude do not cause comparable degradation. In Fig. 2, the right panel has ISM-A on the vertical axis and γ on the horizontal axis, with Wan2.1 and CogVideoX in the legend; the text does not give readings for each γ.

Two losses

• R(V) requires solving the minimal enclosing sphere at each forward pass, gradients are nonzero only on the few values on the boundary, and scales differ across layers and heads. The value collapse loss Lvc instead takes, over the layers and heads in set B and denoising steps t, the proportion of reference value energy not shared by all tokens, then takes an expectation over t. Minimizing it pushes energy onto the common mean, making reference tokens tend toward the same vector. When total energy is nonzero, each term is differentiable, lies in [0,1], and is invariant to a common nonzero scaling. The paper does not specify which layers and heads B contains.
• Actual attention is distributed over the whole sequence, not only the renormalized reference tokens in Equation (1). The attention attraction loss Laa increases the average attention logit between the mean query of subsequent frames and the mean reference key. The query mean is treated as a constant, because queries come from the attacker's generation process and the perturbation should act only through keys. The authors state that keys usually undergo QK normalization, so the term cannot be reduced by enlarging key norms.

Optimization and evaluation

• Minimize L_Lethe(δ)=L_vc(δ)+α L_aa(δ) under ∥δ∥∞≤ε. α balances the two terms; the paper gives no value. The authors' explanation is that the first term makes reference values deviate less from the mean, and the second term makes subsequent-frame readouts come more from these homogeneous tokens.
• In practice, MI-FGSM is used with 100 iterations. The paper does not report step size or momentum coefficient. Success is not judged by a single threshold: evaluation looks at identity cosine similarity and Q-Align quality scores, where lower means stronger protection, with an MLLM score as a supplement.

Experimental Setup

• Tested models: White-box are Wan2.1-I2V-14B and CogVideoX-5B-I2V, which the authors call mainstream DiT-style native I2V models. Transfer targets are LightX2V, AccVideo, SVD, LTX-Video; these perturbations are made on Wan2.1 and not further optimized.
• Data: Re-annotated CelebV-Text and Kinetics-700, corresponding to close-up faces and human actions in natural scenes, respectively. Each selects 350 videos of distinct identities, one frame per video with a visible face, paired with several human-verified action prompts. The authors plan to release the re-annotated data.
• Baselines: PhotoGuard, AdvDM, SDS+, I2VGuard, Anti-Prompt. The authors state they reproduce according to the original papers and official code (if open source) and recommended hyperparameters. All methods default to ε=16/255, with the same inference configuration.
• Metrics: ISM is the cosine similarity between the generated frame and the clean condition image's face embedding, averaged over frames. ISM-A uses ArcFace, ISM-F uses FaceNet. QAF, QAV are Q-Align's frame-level and video-level quality scores. All four are lower meaning stronger protection.
• Review: The supplementary protocol comes from Anti-Prompt, with the review model Qwen3-VL-8B-Instruct. Input is the generated video, the corresponding prompt, and the original input image, scoring Subject Preservation, Structural Consistency, Dynamic Consistency, Artifact Suppression, originally 1 to 5, which the authors reverse so higher scores mean stronger protection. The paper does not report agreement with human ratings.
• Optimization and repetition: MI-FGSM, 100 iterations. Table 2 and Fig. 6 use three random seeds. The paper does not report repetition counts for the main result table, nor α, step size, or momentum coefficient.

Main Results

The table below lists only LETHE. In white-box settings, the model used for optimization is the tested model in that row. Numbers come from Table 1, ε=16/255. Clean and the five baselines are not included in the table.

Swipe horizontally to read the table

White-box setting	ISM-A	ISM-F	QAF	QAV
Wan2.1-I2V-14B, CelebV-Text	0.4280	0.5308	0.3970	0.4976
Wan2.1-I2V-14B, Kinetics-700	0.4125	0.4957	0.3852	0.4745
CogVideoX-5B-I2V, CelebV-Text	0.2968	0.4895	0.4235	0.4946
CogVideoX-5B-I2V, Kinetics-700	0.2523	0.4299	0.4223	0.4828

• Position relative to baselines: The authors state that LETHE is best on all 16 settings across 2 models, 2 datasets, and 4 metrics. Checking Table 1, each setting's four metrics are lower than the other five methods. On Wan2.1, CelebV-Text, Clean's ISM-A/QAF are 0.8173/0.9123; in that cell, the next lowest ISM-A is Anti-Prompt's 0.5237, and the next lowest QAF is SDS+'s 0.5894.
• Identity and quality do not decline together: Anti-Prompt's ISM is often lower than other baselines, but QAF/QAV are higher. In the same cell, Anti-Prompt's QAF/QAV are 0.8447/0.8985, higher than AdvDM's 0.6199/0.6866. The authors do not explain this separately. On CogVideoX, CelebV-Text, the next lowest ISM-A is Anti-Prompt's 0.3424, and the next lowest QAF is SDS+'s 0.5050.
• Qualitative: The authors state that in Fig. 3, LETHE erases the subject on Wan2.1 and paints the subject into unrecognizable textures on CogVideoX. Fig. 1's budget and model are 16/255, Wan2.1-I2V-14B; the text alone cannot show the images.

MLLM Scores

• What was tested: Qwen3-VL-8B-Instruct rated generated videos on Wan2.1 for both datasets on the four aspects above (Fig. 4).
• Results: The authors state that LETHE has the highest scores on all four aspects for both datasets. Extracted from the figure are labels like 3.07, 2.76, 3.08, 3.00 and 3.27, 3.41, 3.69, 3.50, 3.47, but column alignment is unreliable, so they are not attributed to any method.
• Authors' interpretation: The authors state this further confirms stronger protection. The paper does not report agreement between the reviewer and humans.

Transfer

• What was tested: Perturbations made on Wan2.1 are applied directly to LightX2V, AccVideo, SVD, LTX-Video, and compared with Anti-Prompt (Fig. 5a). The metric is the reduction relative to clean images.
• Results: The authors state that on LightX2V and AccVideo, which are DiT like Wan2.1, LETHE still reduces each metric by about 40%; on SVD and LTX-Video, which differ more in architecture, ISM drops about 30%, and all four metrics are better than Anti-Prompt. The Target Avg. percentages in the text of Fig. 5a cannot be reliably attributed to a method, so they are not cited here.
• Authors' interpretation: The authors hypothesize that these models all use softmax attention to aggregate tokens carrying reference information, so the suppressed diversity of reference representations can go beyond the surrogate. They leave a more thorough investigation for future work.

Input Transformations, Purification, and Generation Conditions

• What was tested: Wan2.1, CelebV-Text. Transformations are JPEG (q=70), 3-bit quantization, Gaussian noise (σ=0.2), Gaussian blur (kernel size 7). Purifiers are Super-Res, DiffPure, IMPRESS, GrIDPure, each with recommended configurations. Additionally, 3 prompts, each with 3 random seeds.
• Results: The authors state that protection persists under these changes. The authors state that IMPRESS and GrIDPure only recover part of the gap, with ISM-A rising from 0.43 to about 0.56, while clean images are about 0.80. Across prompts and seeds, the authors state that each metric varies by no more than about 0.03. These are approximate numbers from the main text; in Table 1, the same setting has LETHE and Clean ISM-A of 0.4280 and 0.8173.
• Authors' interpretation: The authors believe the effect does not depend on specific generation conditions. The bar heights in Fig. 5b have no item-by-item readings in plain text.

Other Ablations and Analyses

• Table 2, Wan2.1, mean of three seeds: on CelebV-Text, only Lvc gives ISM-A/ISM-F/QAF/QAV of 0.5899/0.6827/0.5224/0.6009.
• In the same table, Kinetics-700 with only Lvc gives 0.5084/0.6127/0.4600/0.5324. Adding Laa gives the same values as the LETHE row in Table 1; the authors state that all four metrics decrease further.
• Fig. 6, Wan2.1, CelebV-Text: the authors state that all four metrics decrease monotonically with ε; at ε=8/255, for example, ISM-A is 0.58 and QAV is 0.69. The scale is 0, 4, 8, 16, 32 (×1/255), with shading as one standard deviation over three seeds.
• Sec. 3: The authors state that γ=0.8 already shows visible facial artifacts, and at γ=0.7 the video largely becomes degraded color blocks; random perturbations of the same magnitude do not cause comparable degradation. ISM-A readings for each γ are not given in the text.

Limitations and Future Directions Noted by the Authors

• The paper has no dedicated Limitations, Discussion, or Future Work sections, nor does it write any result as a limitation in the conclusion. Sec. 6 only expresses hope that LETHE, the analysis, and the dataset will deepen the community's understanding of this problem and inspire more effective image protection methods in the future.
• The Ethics Statement explains that the models used are publicly released, the evaluation sets come from CelebV-Text and Kinetics-700, re-annotation does not collect new personal data, and the plan is to release only text annotations along with video identifiers and frame indices. These are research practice statements, not limitations listed by the authors.

Experimental Coverage

• White-box tested models are Wan2.1-I2V-14B and CogVideoX-5B-I2V, with default budget ε=16/255 (Sec. 5.1–5.2, Table 1).
• Transfer applies perturbations made on Wan2.1 to LightX2V, AccVideo, SVD, LTX-Video (Sec. 5.3, Fig. 5a).
• Two re-annotated sets each have 350 videos of distinct identities, one frame per video with a visible face, paired with human-verified action prompts (abstract and Sec. 5.1).
• Robustness on Wan2.1, CelebV-Text includes JPEG (q=70), 3-bit quantization, Gaussian noise (σ=0.2), Gaussian blur (kernel size 7), and Super-Res, DiffPure, IMPRESS, GrIDPure, plus 3 prompts each with 3 random seeds (Sec. 5.3).
• The paper does not report α, set B, MI-FGSM step size, repetition counts for the main result table, or agreement between MLLM scores and human ratings; Table 2 and Fig. 6 state three random seeds. Fig. 4's MLLM results are given only for Wan2.1.

LETHE is a protective perturbation added to personal images before publication, intended to counter unauthorized image-to-video generation.

• Problem: I2V models encode the reference image into tokens, and subsequent frames mainly read appearance through attention. The authors state that under the common budget ε=16/255, existing protections often leave only local artifacts, and identity remains recognizable.
• Method: Proposition 1 expresses the radius of the minimal enclosing sphere of the reference values as an upper bound on readout diversity. LETHE uses value collapse to push the energy of these values toward a common component, then uses attention attraction to increase the average logit of subsequent-frame queries against reference keys, optimized with MI-FGSM for 100 iterations under an ℓ∞ ball constraint.
• White-box results: In Table 1, at ε=16/255, LETHE is lowest in all 16 cells across Wan2.1-I2V-14B and CogVideoX-5B-I2V, two re-annotated sets of 350 each, and four metrics. On Wan2.1 and CelebV-Text, ISM-A is 0.4280 and QAF is 0.3970; on CogVideoX and Kinetics-700, ISM-A is 0.2523. In the same table, Anti-Prompt's identity scores are often lower than other baselines, but its quality scores drop less.
• Transfer and robustness: The authors state that perturbations made on Wan2.1 drop about 40% on each metric when transferred to LightX2V and AccVideo, and ISM drops about 30% when transferred to SVD and LTX-Video. The authors state that protection persists under JPEG, quantization, noise, blur, and four purifiers; IMPRESS and GrIDPure only pull ISM-A back from 0.43 to about 0.56.
• Authors' conclusion: The authors state that constraining both the content and the source read by subsequent frames makes protected photos difficult to faithfully animate into high-quality videos, and they hope this analysis and dataset will advance future protection methods.