Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation¶

Conference: ECCV 2026
Paper: Official paper page · Paper PDF
Project: Anti-Prompt
Area: AI Safety
Keywords: Image protection, image-to-video generation, text suppression, visual dominance, failure evaluation

TL;DR¶

Anti-Prompt protects an owner's images with small perturbations that weaken text conditioning, increase the relative dominance of visual pathways, and disrupt image encoding; on white-box CogVideoX evaluation, its video assessment average is 3.25 versus 3.92 for reproduced I2VGuard, where lower scores indicate stronger protection.

Background & Motivation¶

Text-guided image-to-video generation does more than add movement to a photograph: text can also influence whether the subject, geometry, and temporal evolution remain coherent. Once an image is publicly shared, its owner generally cannot control subsequent prompts or modify the generation service that receives it. Protective perturbations address this asymmetry by trying to preserve the image's ordinary viewing value while reducing its usefulness as a condition for unauthorized generation. The closest baseline, I2VGuard, targets spatiotemporal consistency but incurs additional work involving auxiliary video generation, which is costly for large video models.

The paper starts from a concrete observation: omitting text from CogVideoX, LTX-Video, and Wan can cause subject deformation, structural failures, and temporal incoherence, not merely a loss of instruction following. Text therefore appears to act as a stabilizing condition in these systems. An image owner cannot require a later user to remove their prompt, but can change the image that influences intermediate model representations. This motivates indirect interference with text-dependent updates through a protected input image; it is an empirical premise, not a theorem about every image-to-video generator.

Optimizing only against a known prompt may produce prompt-specific protection, while ignoring the image condition can leave sufficient visual information for coherent generation. Anti-Prompt consequently considers text pathways, visual pathways, and image encoding together, and complements general video-quality metrics with an assessment focused on identifiable failures. Core idea: rather than predict a future user's exact prompt, exploit the generator's dependence on text by changing the relative influence of its conditioning pathways while reducing useful information in the image encoding.

Method¶

Overall Architecture¶

The input is an image its owner intends to share; the output is a protected image that should remain visually close to the original, not an updated generation model. Protection is a per-image optimization process with access to a surrogate generator's internal representations and fixed model parameters. Text suppression and visual dominance use intermediate attention statistics during denoising, while encoder disruption acts on the image-condition representation. These objectives jointly influence the same perturbation rather than forming three sequential image editors. After protection, a generator receives the image and text normally; the separate failure evaluator assesses resulting videos and does not supply the protection optimization objective.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Owner's image"] --> B["Surrogate representations"]
    B --> C["Text suppression"]
    B --> D["Visual dominance"]
    B --> E["Encoder disruption"]
    C --> F["Jointly optimize protected image"]
    D --> F
    E --> F
    F --> G["Generate evaluation videos"]
    G --> H["Evidence-first evaluation"]

Key Designs¶

1. Text suppression: target the actual route through which text affects denoising

The relevant measurement depends on how the generator incorporates text. In full-attention architectures represented by CogVideoX, video queries attend to video, image, and text tokens under shared softmax normalization. Anti-Prompt measures average pre-softmax video-to-text logits over attention heads and the relevant token pairs, encouraging weaker text-related interactions. These logits should not be described as text-attention probabilities: normalized probabilities also depend on competition with other modalities.

In cross-attention architectures represented by LTX-Video, text enters through a dedicated cross-attention residual, separate from the visual self-attention residual. The paper therefore measures the squared-norm energy of the text-dependent residual rather than transferring the full-attention statistic unchanged. Reducing this energy reduces the direct contribution of text to the representation update. The two implementations share an objective—weakening text-dependent updates—but do not assume that the underlying computation graphs are identical. This distinction explains how the same protection principle is instantiated across architectures.

2. Visual dominance: reduce dependence on the particular prompt used during protection

Suppressing interactions with the current text may produce effects tied to those particular tokens. Visual dominance instead strengthens pathways that do not directly access text, making their influence relatively larger when the prompt changes. For full attention, the method increases average video-to-video and video-to-image logits; shared normalization then makes the visual terms more competitive relative to text. For cross attention, it increases the energy of the visual self-attention residual relative to the text cross-attention residual.

“Visual dominance” does not mean better visual quality or more faithful reconstruction of the original image. It describes the relative sources of internal updates, exploiting the empirical observation that losing text-mediated stabilization can make generation unreliable. A visual-only interaction here means that the current pathway does not directly read text tokens; its inputs may still have been influenced by text in earlier layers. The objective is therefore an architecture-dependent proxy, not an exact decomposition of the entire generator into independent visual and language systems.

3. Encoder disruption: weaken the remaining image-conditioned support for coherent generation

Removing text does not guarantee failure: some scenes retain partial coherence from their image condition alone. The paper adopts an existing encoder-level protection objective that brings the protected image's VAE representation closer to an uninformative target representation, using a black image as the shared target in the experiments. This operates in latent space; it does not mean making the published image black, since the visible perturbation remains constrained. Encoder disruption and visual dominance are not contradictory: the former reduces useful conditioning information, while the latter increases the relative influence of visual pathways carrying that information. Together they can make faithful animation less reliable.

The encoder objective is inherited rather than an independent novelty of Anti-Prompt. I2VGuard receives the same encoder target in the comparison, helping isolate the contribution of the proposed conditioning objectives. Only the image perturbation changes; there is no newly trained video-generation backbone or amortized protection network that replaces per-image optimization. The cached extraction visibly corrupts equations from Eq. (7) through the joint objective, so this note explains their roles from the readable Section 4 prose without reconstructing unverifiable loss formulas, symbols, or update details.

4. Evidence-first evaluation: describe the failure before assigning its score

General video benchmarks assess generation quality, but one conspicuous subject or structural error can already undermine the credibility of an unauthorized animation. The proposed independent protocol samples four frames per second, includes the first and last frames, and requests frame-indexed observations before dimension-wise ratings. The experiments use Qwen3-VL-8B to assess subject preservation, structural consistency, dynamic consistency, and artifact suppression. Subject preservation concerns whether the original subject remains recognizable; structural consistency concerns geometry and part boundaries; dynamic consistency concerns motion and state transitions; artifact suppression concerns rendering defects and anomalous textures.

Each dimension uses a 1–5 scale: 5 means that the relevant quality is largely preserved, while 1 indicates severe failure. The compact summary is the arithmetic mean of the four dimension scores, followed by dataset-level aggregation. Lower scores therefore mean worse generated videos and stronger protection, not a less capable evaluator; they are not protection-success percentages. Although the motivation emphasizes individual salient failures, averaging can still dilute an extreme failure in one dimension, making dimension-level evidence important. Requiring evidence improves inspectability but does not eliminate evaluator bias, so the paper also reports VBench and human preferences.

Key Experimental Results¶

Main Results¶

Evaluation uses 355 images from VBench I2V and their paired prompts, with CogVideoX-5B and LTX-Video-2B as target generators. This is a protection evaluation, not predictive accuracy on a newly trained model's test set. I2VGuard is reproduced on the public dataset because its original dataset is non-public; methods share generation settings, perturbation budgets, and encoder targets within each generator. The perturbation budget is \(8/255\), while resolution, frame count, and frame rate differ between generators, so comparisons should remain within each model. The selected columns below come from Table 1, for VBench subject consistency, and Table 4, for the proposed protocol average. All arrows follow the protection objective: lower video quality means stronger protection. “Seen/unseen” refers to prompts encountered during protection optimization, not a training/test split of images.

Model	Input or method	Subject consistency ↓, seen	Protocol average ↓, seen	Protocol average ↓, unseen
CogVideoX	Clean	95.06	4.58	4.38
CogVideoX	I2VGuard	93.32	3.92	3.86
CogVideoX	Anti-Prompt	87.54	3.25	2.99
LTX-Video	Clean	95.09	4.13	3.13
LTX-Video	I2VGuard	90.25	3.28	2.46
LTX-Video	Anti-Prompt	89.36	3.12	2.38

GPT-4 generates the unseen prompts from the input images, producing scenarios that are generally more informative and dynamic than the original prompts. All methods and clean inputs use the same unseen prompts. Clean LTX-Video's average also falls from 4.13 to 3.13, showing that prompt difficulty contributes to degradation; the seen-to-unseen drop cannot be attributed entirely to stronger protection. Within matched prompt conditions, the advantage over I2VGuard is larger for CogVideoX and more modest for LTX-Video.

Ablation Study¶

The following selection from Table 8 uses white-box CogVideoX and the same VBench I2V evaluation, with encoder disruption as the common starting point. \(L_{\mathrm{sup}}\), \(L_{\mathrm{vis}}\), and \(L_{\mathrm{enc}}\) denote text suppression, visual dominance, and encoder disruption respectively. The VBench columns are video-quality scores, not error rates; lower is preferable only under the protection objective.

Configuration	Subject consistency ↓	Imaging quality ↓	Protocol average ↓
\(L_{\mathrm{enc}}\) only	91.96	64.22	4.11
\(L_{\mathrm{enc}}+L_{\mathrm{sup}}\)	92.94	66.55	3.92
\(L_{\mathrm{enc}}+L_{\mathrm{vis}}\)	90.53	66.95	3.59
Full Anti-Prompt	87.54	63.71	3.25

Adding text suppression improves the protocol average but raises subject consistency and imaging quality, revealing different sensitivities across evaluation systems. Visual dominance alone produces a larger reduction in the protocol average, yet does not improve every VBench metric: imaging quality rises from 64.22 to 66.95. Consequently, the broad wording about consistent improvements in Section 6.3 should not override the counterexample in the table. The combined objective is best across the selected columns.

Key Findings¶

Lower computation does not mean optimization-free protection. Table 9 reduces CogVideoX total computation from 54.25 to 26.82 PFLOPs and peak memory from 51.56 to 48.98 GB. Removing auxiliary video generation still leaves substantial protection-time cost.
Transfer depends on direction and metric. For CogVideoX-to-LTX-Video transfer in Table 3, imaging quality is 62.63 for Anti-Prompt versus 61.42 for I2VGuard. This metric does not favor Anti-Prompt under the protection objective.
Human judgments support degradation, not a deployment guarantee. In Table 6, Anti-Prompt videos are selected as worst in 79.1% of comparisons versus 10.9% for I2VGuard; overall protocol–human ranking agreement has Spearman correlation 0.84.
Image fidelity also has an exception. Table 7 reports LTX-Video DISTS of 0.138 versus 0.130 for I2VGuard, which is worse. The authors explicitly distinguish improvements in LPIPS, PSNR, and SSIM from uniform improvement across all perceptual measures.

Highlights & Insights¶

Condition dependence becomes a protection target. Text can stabilize structure and temporal evolution, not merely specify semantics. The paper turns this observation into objectives on identifiable internal pathways rather than relying only on final-video pixel differences.
A shared principle need not have an identical implementation. Competition under a shared softmax differs from relative residual energy. Explicitly handling that distinction makes the approach more interpretable than a generic claim of attention suppression.
Protection should be evaluated at both ends. Fidelity of the published image and failure of subsequent animation are separate outcomes. Measuring both prevents visibly damaging the source image from being mistaken for practical protection.

Limitations & Future Work¶

Acknowledged by the authors: Video-language-model evaluation can exhibit evaluator-specific bias and stochastic variability. VBench and human assessment are complementary checks, not optional substitutes for a supposedly objective judge.
Evidence boundary: The local full text includes the main method and experiments but not the separately referenced supplement. The complete unseen-prompt list, cross-evaluator consistency, and repeatability details cannot be verified from this cache.
Reader assessment: Results on two open-source architectures do not establish protection against all closed services, image-only generators, or future models. Wan supports the motivating observation, not a third full protection benchmark.
Reader assessment: The main text does not provide a systematic basis for claims about survival under compression, resizing, or re-encoding, nor a long-term public-distribution guarantee. These remain evaluation boundaries rather than demonstrated capabilities.
Reader assessment: The main description of Table 6 does not adequately specify participant count, video sample size, or confidence intervals. Table 9 measures computation and memory rather than complete wall-clock latency, further limiting extrapolation.

vs I2VGuard: Both protect images against unauthorized image-to-video use and share encoder-level protection in this comparison. Anti-Prompt instead targets text-dependent pathways directly and reduces work involving auxiliary videos.
vs PhotoGuard and Distraction: PhotoGuard supplies encoder/diffusion-level protection precedents, while Distraction emphasizes efficient attention-level objectives. Anti-Prompt addresses text conditioning in temporal generation rather than simply reusing an image-editing evaluation.
vs VBench: Standardized quality scores provide a common reference, while evidence-first evaluation supplies failure-specific explanations. Disagreement in the ablations argues for complementary assessment rather than replacing all usability judgments with one average.

Rating¶

Novelty: 4/5. The dual-pathway objectives have a clear rationale based on text-mediated stabilization, while encoder disruption is inherited.
Experimental Thoroughness: 3/5. Two architectures, unseen prompts, transfer, ablations, and human assessment provide useful coverage, but deployment robustness and statistical details remain limited.
Writing Quality: 3/5. Architectural distinctions are clear, although some ablation claims are broader than the table evidence and corrupted cached equations limit verification.
Value: 4/5. A useful, interpretable direction for owner-controlled image protection, not an assurance of absolute prevention.