In brief
Recent advances in Image-to-Video generation allow a single image to be animated into a convincing video under text guidance, raising serious copyright and privacy risks. We propose Anti-Prompt, an image protection approach that injects imperceptible perturbations into an image, inducing visible inconsistencies and structural failures in text-guided I2V generation. Our method is motivated by a simple empirical observation: when text guidance is removed from modern I2V models, generation quality degrades markedly, not only in motion realism but also in subject preservation, structural coherence, and temporal consistency.
Building on this insight, Anti-Prompt attenuates text-conditioned interactions during denoising while strengthening visual-only pathways. To evaluate protection behavior, we also introduce a Video-LLM protocol that scores subject preservation, structural consistency, dynamic consistency, and artifact suppression using frame-grounded observations.
Why it works
Prompt-free generation degrades broadly, not only in motion realism, but also in subject preservation, scene structure, and temporal consistency.
The same pattern appears across CogVideoX, LTX-Video, and Wan: removing text destabilizes not only the requested motion, but also the identity and geometry inherited from the input image. This observation reveals that text acts as a broader stabilizing signal during I2V denoising.
Our approach
Anti-Prompt suppresses text-dependent pathways while amplifying visual-only interactions during denoising.
Rather than overfitting a perturbation to one malicious prompt, Anti-Prompt targets the architectural pathways through which text controls generation. This shifts denoising away from text guidance and encourages protection-induced failures that persist under unseen prompts.
In CogVideoX, video, image, and text tokens compete inside a shared attention operation. We suppress video-to-text interactions while strengthening video-to-video and video-to-image interactions, reducing the relative contribution of text under softmax normalization.
In LTX-Video, text enters through a dedicated cross-attention branch. We reduce the energy of this text-dependent residual while amplifying the visual self-attention residual, making visual-only updates dominate the denoising trajectory.
An encoder objective additionally moves the protected image representation toward an uninformative target. The three losses are optimized jointly under an ℓ∞ perturbation budget, keeping the shared image visually unchanged while weakening its utility for animation.
Qualitative results · Model 01
CogVideoX represents the full-attention setting, where image, video, and text tokens interact in a shared attention space. The comparisons below place generations from the clean image, I2VGuard, and Anti-Prompt side by side.
Use the carousel to inspect white-box protection, transfer from LTX-Video, and robustness after crop-and-resize, JPEG compression, and ADVClean. Across these settings, successful protection appears as subject drift, malformed structure, unstable motion, or conspicuous rendering artifacts.
Qualitative results · Model 02
LTX-Video provides the complementary cross-attention setting, in which text features enter the visual stream through a separate residual branch. Each slide uses the same source image and prompt across all three methods for direct comparison.
These examples cover direct white-box optimization, black-box transfer from CogVideoX, and the same purification defenses. Together with CogVideoX, they show that the protection principle is not tied to a single conditioning architecture.
Evaluation protocol
These examples motivate our Video-LLM protocol. In several cases, aggregate benchmark signals suggest that a video is still acceptable, while frame-level inspection reveals subject drift, structural collapse, temporal incoherence, or visible artifacts that make the generated result unsuitable for convincing reuse.
By scoring Subject Preservation, Structural Consistency, Dynamic Consistency, and Artifact Suppression with explicit visual evidence, our protocol captures protection failures that are easy to miss when only overall quality metrics are reported.
We uniformly sample frames at four frames per second, including the first and last frame. The evaluator must first report concrete observations grounded to frame indices and only then assign a discrete score from 1 to 5. Higher scores indicate faithful and coherent animation; lower scores indicate more severe failures and therefore stronger protection.
The protocol is not intended to replace VBench. VBench summarizes broad perceptual quality, whereas protection can succeed through one salient failure that makes a video unsuitable for convincing misuse. We therefore report both, validate the induced ranking against human judgments, and analyze repeatability and agreement across multiple Video-LLM evaluators. The examples below expose cases where the two perspectives disagree.
@inproceedings{song2026antiprompt,
title = {Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation},
author = {Song, Yeonghwan and Lee, Chanhui and Park, Jinsoo and Son, Jeany},
booktitle = {European Conference on Computer Vision (ECCV)},
year = {2026}
}