PhaseBreak: Proactive Temporal Protection against Unauthorized Image-to-Video Animation

1 Introduction

• I2V can turn a shared portrait into customized motion without the subject’s authorization, leaving image owners little control over later animation.The protection goal is to preserve ordinary sharing while resisting unauthorized animation.Source: §1 · p. 1
• Prior proactive protections target appearance or identity in text-to-image systems, whereas I2V protection must disrupt ordered video dynamics from a single conditioning frame.Pixel-space adversarial objectives do not explicitly model temporal behavior and may be absorbed by denoising or appear as superficial artifacts.Source: §1 · p. 1
• Global spectral attenuation can reduce pronounced motion but offers little control over when fine-grained events occur and may erase weak or localized temporal content.This motivates an objective that disrupts motion customization without uniform temporal suppression.Source: §1 · p. 1
• PhaseBreak matches intermediate denoiser features to a constrained temporal reordering of clean features, preserving feature content while shifting event order.The method preserves the architecture’s true temporal axis, combines time-domain retiming with spectral phase matching, and uses a subject-aware mask for the bounded perturbation.Source: §1 · p. 1
• The evaluation uses 355 VBench-I2V examples on Stable Video Diffusion and DynamiCrafter, measuring motion variation and temporal regularity.These are the two evaluated models and the complementary measurements identified for cross-model evaluation.Source: §1 · p. 2

2 Related Work

• Video diffusion models extend denoising to spatio-temporal data, while systems including SVD and DynamiCrafter provide general image-to-video backbones.These models propagate image conditioning through features that jointly encode spatial content and temporal evolution.Source: §2 · p. 2
• Prior proactive defenses target editing, customization, or identity-preserving generation, while I2VGuard, Vid-Freeze, and MEDUSA address conditioning-image misuse or temporal generation [3].MFA provides a complementary diffusion attack based on timestep vulnerability and mean fluctuation.Source: §2 · p. 2
• MEDUSA globally attenuates temporal response, whereas PhaseBreak retimes intermediate temporal events and confines its perturbation to the intended subject.The related-work discussion identifies global suppression as less suited to localized, fine-grained motion because it does not specify when local events should occur.Source: §2 · p. 2

3.1 Image-to-Video Diffusion and Temporal Attention

• I2V diffusion generates a video by conditioning iterative denoising on a reference image and, when supported, a text prompt.Repeated denoising and latent decoding produce the video.Source: §3.1 · p. 2
• Intermediate activations expose a temporal axis, and selected layers and diffusion steps provide features that encode spatial content and temporal evolution.The feature tensor has temporal length, spatial tokens per frame, and channels; both evaluated architectures retain a dedicated temporal dimension, though its tensor index differs.Source: §3.1 · p. 2

3.2 Motivation and Problem Formulation

• Locally permuting a clean feature sequence preserves its vectors but changes adjacent differences and generally its Fourier phase.This observation separates temporal order from global feature strength and motivates matching a nearby retiming of the clean representation.Source: §3.2 · p. 2
• A constrained permutation preserves a feature sequence’s temporal mean and energy while providing a controllable retimed target.When the protected feature approximates that target, the corresponding first-order dynamic error is bounded.Source: §3.2 · pp. 2–3
• PhaseBreak uses time-domain retiming and spectral phase matching to align protected features with the same retimed clean target.The method matches phase because temporal order is also expressed by Fourier phase.Source: §3.2 · p. 3
• The protection setting assumes white-box access to the anticipated I2V generator and releases the perturbed image without changing the downstream model or sampler.Clean and protected branches share the prompt and sampling randomness during optimization.Source: §3.2 · p. 3
• The image perturbation is bounded and subject-masked, and its feature objective compares protected and clean intermediate representations without requiring a target video or frame-level motion annotation.The clean representation is fixed, with gradients passing only through the protected branch.Source: §3.2 · p. 3

4.1 Overview

• The pipeline builds a constrained retimed clean target, matches protected features with temporal and spectral losses, and applies masked projected updates.Auxiliary dynamics terms strengthen short-lived changes; Algorithm 1 gives the complete optimization.Source: §4.1 · p. 3

4.2 Subject-Localization Mask

• The subject mask confines image perturbations and their gradients to the localized region, while temporal supervision remains defined on the full intermediate activation.The mask also applies after image-range projection; without a supplied mask, the projection becomes standard image-space projection.Source: §4.2 · pp. 3–4

4.3 Architecture-Specific Temporal Axis

• PhaseBreak identifies each architecture’s temporal axis and applies FFT, retiming, and first and second differences only along that axis.Other feature dimensions are reduced only when forming scalar losses.Source: §4.3 · p. 4

4.4 Constrained Temporal Retiming

• A bijective schedule reorders existing temporal positions under bounds on moved positions and total displacement, without duplicating or deleting positions.The time-domain loss aligns centered activations to the retimed target, while the spectral branch matches its timing phase.Source: §4.4 · p. 4
• Four auxiliary differentiable terms supplement the retiming target, including a twitch term that minimizes cosine similarity between consecutive feature differences.The high-frequency term is the negative fraction of nonzero spectral energy at or above a cutoff; motion and acceleration branches maximize normalized first- and second-difference energy.Source: §4.4 · p. 4

4.5 Masked Projected Optimization

• For each selected layer and timestep, PhaseBreak combines phase, retiming, twitch, and high-frequency losses and updates the perturbation with projected gradient descent.Clean and protected branches share the prompt, latent noise, and evaluated diffusion steps; only the protected branch contributes gradients.Source: §4.5 · pp. 4–5
• Table 1 reports protected adversarial means and their relative changes from the shared clean mean, with arrows indicating stronger disruption.Figure 2 places clean sequences above PhaseBreak sequences for each reference example.Source: Table 1 · p. 5, Figure 2 · p. 5

5.1 Experimental Setup

• The evaluation uses 355 VBench-I2V examples with SVD and DynamiCrafter, which generate 14 and 16 frames, respectively.SVD uses 16:9 crops and image conditioning; DynamiCrafter uses 1:1 crops and associated English prompts. Each image receives 250 masked PGD iterations under an ℓ∞ budget of 16/255; retiming uses adjacent swaps with r = 1 and a fixed seed.Source: §5.1 · p. 5

5.2 Evaluation Metrics

• Five optical-flow-based measurements capture short-term motion variation, direction inconsistency, frame alignment error, and motion regularity.Higher flow acceleration and jerk indicate stronger short-term variation; higher direction inconsistency and warping error indicate degraded consistency, while lower motion smoothness indicates stronger disruption.Source: §5.2 · p. 5

5.4 Transferability

• All five metrics move in the effective direction in both cross-model transfer settings.The reported results support bidirectional generalization across the two I2V architectures.Source: Table 2 · p. 6, §5.4 · p. 6

5.5 Perturbation Budget

• PhaseBreak disrupts temporal dynamics at all evaluated perturbation budgets, with particularly strong effects from the larger budget on DynamiCrafter.BudgetSwap is evaluated at ε values of 4, 8, and 12/255.Source: Table 3 · p. 6, §5.5 · p. 6

5.3 Main Results

• PhaseBreak moves all five temporal metrics in the effective direction and provides the strongest overall disruption across SVD and DynamiCrafter.It is compared with PhotoGuard, MFA, I2VGuard, Vid-Freeze, and MEDUSA.Source: §5.3 · p. 6

5.6 Ablation Study

• The full objective gives the strongest and most balanced temporal disruption, while retiming and auxiliary dynamics terms provide complementary supervision.The ablation removes evaluated terms while keeping Lphase active.Source: Table 4 · p. 6, §5.6 · p. 6

5.7 Additional Experiments

• Additional experiments report loss-weight sensitivity and visual quality evaluations of protected input images.The sensitivity experiments are provided in Appendix A and visual quality evaluations in Appendix B.Source: §5.7 · p. 6

• Evaluation on 14- or 16-frame VBench-I2V videos does not establish whether retiming remains effective for long-horizon generation.PhaseBreak also assumes white-box access to intermediate features and gradients, limiting direct application to accessible models rather than API-only services.Source: §6 · p. 6
• Offline, per-image optimization before release excludes already-distributed images and applications requiring immediate protection without that optimization.Source: §6 · p. 6

• PhaseBreak matches intermediate denoiser features to constrained temporal rearrangements, confines perturbations to the depicted subject, and disrupts stable motion customization across two evaluated models.The reported effects include increased short-term motion variation, reduced temporal regularity, and effective bidirectional cross-model transfer.Source: §7 · p. 6

• Each sensitivity subplot varies one loss weight with the others fixed at default values, and marks the selected value and its corresponding attack effects.The analysis reports normalized attack effects for Stable Video Diffusion and DynamiCrafter.Source: Figure 3 · p. 8, A Loss-Weight Sensitivity · p. 8

B Protected Input Image Quality

• Under both target models, PhaseBreak maintains high pixel- and structure-level similarity to the corresponding clean images while keeping perceptual distances low.Table 5 evaluates visual fidelity using PSNR, SSIM, and LPIPS.Source: B Protected Input Image Quality · p. 8
• The reported fidelity comparison covers protected images and their corresponding clean images under both target models.The passage reports the comparison qualitatively, without metric values.Source: B Protected Input Image Quality · p. 8
• Table 5 uses PSNR, SSIM, and LPIPS to evaluate the visual quality of protected input images.Higher PSNR and SSIM and lower LPIPS indicate better preservation of the clean input.Source: Table 5 · p. 8