arXiv CSopen access

Delving into the Temporal Challenges of Unified Video Protection Against Image-to-Video and Fine-Tuning-based Customization

D ELVING INTO THE T EMPORAL C HALLENGES OF U NIFIED V IDEO P ROTECTION AGAINST I MAGE - TO -V IDEO AND F INE -T UNING - BASED C USTOMIZATION A P REPRINT Yuxin Huang1

Ziming Hong1 Mingming Gong2,5 Wanyu Wang3 Jing Zhang4 Tongliang Liu1,5 Sydney AI Centre, The University of Sydney 2 University of Melbourne 3 City University of Hong Kong 4 Wuhan University 5 Mohamed bin Zayed University of Artificial Intelligence

arXiv:2607.13336v1 [cs.CV] 14 Jul 2026

1

w/o Protection

w/ Protection

Tuningbased

Tuningbased Privacy Breached

My Video Stays Mine

Referencebased

Referencebased

protected videos (posted online)

original videos

TC-UAP

Figure 1: Protecting personal videos against unauthorized video customization. Once posted online, a user’s videos may be collected and exploited by either tuning-based or reference-based customization. Our TC-UAP proactively protects the videos by applying imperceptible temporally consistent perturbations, making both customization methods fail to generate usable results. The code, evaluation suite and additional results will be available on our project page.

A BSTRACT Recent diffusion-based video generation models have enabled high-quality personalized video customization through both tuning-based pipelines, which fine-tune a video diffusion model, and reference-based pipelines such as image-to-video generation. However, these capabilities raise serious concerns about personal privacy, identity ownership and intellectual property protection. Existing anti-customization works focus on protecting images, while protection for videos against both reference- and tuning-based customization remains largely underexplored. Protecting videos in this setting raises three challenges: (i) Image-level perturbations, optimized frame by frame, cannot survive temporal compression by 3D video VAE. (ii) A video-level perturbation optimized on a single video is vulnerable to temporal editing and fails to protect unseen videos. (iii) Temporally inconsistent perturbations are not robust to temporal attacks. To address these challenges, we propose Temporally Consistent Universal Adversarial Perturbations (TC-UAP), the first protection method against both reference- and tuning-based video customization. TC-UAP optimizes an identity-level multi-frame UAP over sliding windows from multiple videos, accounting for local temporal dependencies induced by temporal compression in video VAE and enabling a single perturbation to protect unseen videos of varying lengths. Moreover, we introduce intrinsic temporal modeling and an extrinsic surrogate temporal-attack loss, which make the perturbation temporally consistent and robust to unseen temporal attacks. Empirically, quantitative and qualitative results show that TC-UAP achieves the strongest identity protection compared with existing methods under both reference- and tuning-based video customization, and remains robust under multiple unseen temporal attacks.

1

Introduction

Recent advances in diffusion models have revolutionized video creation, enabling the generation of high-quality videos. Both open-source [24, 67, 55, 14] and commercial models [47, 75] have shown increasingly impressive results. These

A P REPRINT

models enable users to specify the subject of the generated video, a capability commonly known as video customization. Such customization typically follows two approaches. Tuning-based methods [1] fine-tune a video diffusion model on a small set of video clips, for example, using Low-Rank Adaptation (LoRA) [20], and can then generate diverse new videos. Reference-based methods [7, 13, 16, 68], such as image-to-video (I2V) models, take a reference image and a text prompt as input, offering pixel-level control. However, these models raise serious concerns about personal privacy, identity ownership and intellectual property protection [23, 29, 28, 71, 19, 11, 59] in video content. From public video clips of a target person, a malicious user can exploit current models to generate misleading or harmful content [39, 66, 73, 37, 32] about that person through either approach: finetuning a video diffusion model on the whole set through tuning-based customization, or extracting a single frame from any of these videos as the reference image for reference-based customization. These threats may lead to fake news and violations of portrait rights. Protecting video content from being misused for unauthorized customization thus becomes a pressing concern. Existing anti-customization works have mostly focused on adversarial perturbation-based image-level protection. Early efforts mainly protect images against tuning-based customization of text-to-image (T2I) models [31, 48, 53, 30, 35, 58, 65, 72, 52, 21] and reference-based image-to-image (I2I) editing [46, 2, 49, 25]. More recent works have further extended image protection to video generation scenarios, where the protected content is still a reference image used by image-to-video (I2V) pipelines [42, 12, 54, 8, 36]. In contrast, protecting videos has received much less attention, despite the growing prevalence of video-based content across online platforms. This limitation is particularly concerning because publicly available videos can be exploited as both references or training data for the two kinds of unauthorized customization. However, protecting videos against both reference- and tuning-based customization remains largely unexplored, highlighting the need for a unified video protection method against both types of threats. To this end, we explore protecting videos from reference- and tuning-based customization, and identify three temporal challenges1 , namely, (i) temporal compression, (ii) temporal overfitting, and (iii) temporal inconsistency: • (i) Image-level perturbations, optimized frame by frame, cannot survive temporal compression in 3D video VAE. Image-level protection can be applied to videos by optimizing perturbations frame by frame. While such perturbations remain applicable to reference-based I2V customization, they are insufficient for tuning-based video customization, where a 3D causal video VAE encodes the entire video into compact latent representations [67, 24, 55, 14]. This temporal compression substantially weakens frame-wise perturbations, causing them to fail after video encoding, as illustrated in Fig. 2. Therefore, protecting videos against both threats requires a video-level perturbation design. • (ii) A perturbation optimized on a single video is vulnerable to temporal editing and fails to generalize to unseen videos. Optimizing a perturbation for a single video tends to overfit to the original temporal sequence. When the protected video undergoes temporal editing (e.g., trimming into a shorter clip), the protection may significantly degrade, as shown in Fig. 4. Moreover, such a video-specific perturbation cannot be directly transferred to unseen videos. These limitations pose challenges to temporal flexibility, identity-level generalization, and protection efficiency. • (iii) Temporally inconsistent perturbations are not robust to malicious temporal attacks. An attacker can exploit cross-frame redundancy across video frames to perform temporal attacks (e.g., frame interpolation and temporal averaging), which can substantially attenuate temporally inconsistent perturbations, as shown in Fig. 5. This highlights the necessity of modeling temporal consistency of perturbations to ensure robust protection against temporal attacks. To address these challenges, we propose Temporally Consistent Universal Adversarial Perturbations (dubbed TC-UAP), the first video protection method against both reference- and tuning-based video customization, as shown in Fig. 1. Specifically, we model the protection signal as an identity-level multi-frame UAP comprising multiple temporally indexed perturbation frames, thereby providing greater temporal expressiveness for disrupting the video VAE latent representations shared by both customization pipelines. Such a multi-frame UAP can be temporally repeated and applied to videos of different lengths, enabling it to be reused across clips without per-video optimization. Moreover, to make the perturbation survive the temporal compression of 3D video VAEs while avoiding temporal overfitting, we adopt a sliding-window optimization strategy over multiple videos of the same identity. The window length is chosen to cover the dominant portion of the temporal receptive field, allowing each window to capture sufficient temporal dependencies induced by temporal compression. By sampling windows from different videos and temporal positions, this strategy exposes the UAP to diverse temporal contexts and prevents it from becoming tied to the complete temporal sequence of any training video. In addition, although the multi-frame formulation improves temporal expressiveness, it does not by itself guarantee temporal consistency. We therefore introduce intrinsic temporal modeling and an extrinsic surrogate temporal-attack loss to regularize cross-frame consistency and preserve protection effectiveness under temporal attacks. As a result, once optimized, the same UAP can be efficiently reused to protect unseen videos of the same identity while remaining robust against unseen temporal attacks. 1

The complete analysis and additional evidence for the three temporal challenges are provided in Section 4.

2

A P REPRINT

Empirically, we conduct extensive experiments to evaluate TC-UAP. Both the quantitative and qualitative results show that our method achieves the strongest identity protection compared with existing methods under both reference- and tuning-based video customization, and remains robust under diverse unseen temporal attacks. Our contributions are summarized as follows: • We are the first to formulate and study the problem of unified video protection against both reference- and tuningbased customization. We identify three key temporal challenges and provide empirical evidence of their impact on protection effectiveness: (i) temporal compression, (ii) temporal overfitting, and (iii) temporal inconsistency. • We propose TC-UAP, a unified video protection method that models the protection signal as an identity-level multiframe UAP, thereby enhancing temporal expressiveness and enabling efficient reuse across videos of different lengths. We adopt a sliding-window optimization strategy to mitigate temporal overfitting, while intrinsic temporal modeling and a surrogate temporal-attack loss improve robustness against unseen temporal attacks. • Extensive quantitative and qualitative experiments demonstrate that TC-UAP provides effective identity protection against both reference- and tuning-based video customization, generalizes to unseen videos of the same identity, and remains robust against a range of unseen temporal attacks. • We also establish and release a unified evaluation suite for video protection against both reference- and tuning-based customization, covering imperceptibility, protection effectiveness, transferability, and robustness. The suite provides standardized evaluation protocols and implementations for reproducible comparison of future methods.

2

Related Work

Image protection against generative models. Existing image protection methods mainly aim to protect images from two types of unauthorized use. For tuning-based customization, where malicious attackers collect multiple images to fine-tune a text-to-image model via DreamBooth [45] or LoRA [20], existing defenses typically add imperceptible adversarial perturbations to the images, making the fine-tuned model fail to capture the identity or artistic style [31, 48, 30, 53, 35, 58, 65, 72, 52]. For reference-based customization, existing defenses mainly protect images which can be used as reference images for image-to-image (I2I) editing [4, 57, 56] and image-to-video (I2V) generation. Specifically, imperceptible adversarial perturbations are added to the reference image, leading to distorted editing results in I2I editing [46, 63, 2, 25, 49, 51, 18] and low-quality videos or unstable motion in I2V generation [42, 12, 54, 8, 36]. Recent work further introduces a benchmark for evaluating image protection methods in I2V generation [27]. However, existing works focus on protecting images, leaving video-level protection against both reference- and tuning-based customization unexplored. Video protection against unauthorized usage. Recent works have explored video protection under different unauthorized scenarios, including object tracking [64], malicious video editing [26, 5], and style mimicry on video imagery [43]. However, these video protection methods do not address unauthorized personalized customization using video diffusion models. Notably, although Gimbal [43] targets video content, it still performs image-level protection by protecting extracted video frames from being used to fine-tune text-to-image (T2I) diffusion models. Customizable video generation models. Recent video generation models [24, 67, 55, 14, 61, 60, 74] enable the same two types of customization discussed in image-protection works above. For tuning-based customization, open-source models such as LTX-Video [14], Wan [55], CogVideoX [67], and HunyuanVideo [24] allow users to train LoRA adapters [20] on a few videos and then generate new videos from text prompts. For reference-based customization, a pretrained image-to-video (I2V) model is conditioned on a single reference image. Open I2V pipelines include LTX-2.3 I2V [15], Wan2.2-5B TI2V [55], CogVideoX-5b-I2V [67], Stable Video Diffusion [3]. Together, these tools make video customization broadly accessible and raise concerns about identity misuse, highlighting the need for video protection against diffusion-based customization.

3

Preliminaries

3.1

Problem Formulation

t Ti −1 Ti ×C×H×W Consider a set of M videos Vy = {Vi }M , i=1 of an identity y. Each video is denoted as Vi = {vi }t=0 ∈ R where Ti is the number of frames, and C, H, and W denote the channel, height, and width of each frame vit .

An attacker may use these videos for either tuning-based or reference-based customization, which we introduce in Section 3.2. In both cases, the attacker aims to synthesize new videos that reproduce the target identity y. The goal of the protector is to construct protected videos that remain nearly indistinguishable from the originals, while preventing both reference- and tuning-based customization from generating usable videos that faithfully preserve 3

A P REPRINT

the target identity y. Specifically, successful protection should induce customization failure in the generated videos, reflected by degraded identity preservation, weakened prompt alignment, and reduced visual quality. Following the common perturbation-based protection paradigm [31, 48, 53, 42, 12, 54, 8, 36], the protection goal can ′ ′ M be formulated as adding imperceptible perturbations δ = {δi }M i=1 to Vy to obtain a protected video set Vy = {Vi }i=1 . For each video Vi , the protector generates a perturbation δi and obtains: Vi′ = Vi + δi ,

s.t.

||δi ||∞ ≤ η,

(1)

where η denotes the perturbation budget. The perturbation optimization objective is defined as: δ ⋆ = arg min Lid (Vy , δ), ||δ||∞ ≤η

(2)

where Lid is a surrogate objective, and minimizing it induces the customization failure defined above. 3.2

Video Customization

Diffusion Models. Diffusion Models (DMs) are generative models [50, 17, 34, 33] that learn √ a target√data distribution. Given a clean sample z0 , the forward process produces a noisy sample at step τ as zτ = ᾱτ z0 + 1 − ᾱτ ϵ, ϵ ∼ N (0, I), where {ᾱτ } is a fixed noise schedule. A denoising network ϵω is trained to predict ϵ from zτ under a conditioning signal c (e.g., text, image, etc.) encoded by a corresponding encoder Etext :  2 LDM (ω) = Ez0 , τ, ϵ, c ϵ − ϵω (zτ , τ, Etext (c)) 2 . (3) Video VAE. Latent diffusion models (LDMs) [44] operate in a compressed latent space encoded by an encoder E. For video diffusion, it is instantiated as a video VAE that operates along the spatial and temporal dimensions. Given a video Vi ∈ RTi ×C×H×W , the encoder produces a latent: zi = E(Vi ) ∈ RṼi ×C̃×H̃×W̃ ,

+ 1, H̃ = rHh , W̃ = rWw , Ṽi = Tir−1 t

(4)

which is downsampled by factors rh and rw along the spatial dimension and rt along the temporal dimension, with C̃ latent channels. We use t ∈ {0, . . . , Ti − 1} as the frame index in the input video, and p ∈ {0, . . . , Ṽi − 1} as the temporal position in the latent space. The decoder D reconstructs V̂i = D(zi ).

Tuning-based Video Customization. Tuning-based methods fine-tune a pretrained denoising network ϵω on a set of video-text pairs {(Vi , ci )} with the latents zi = E(Vi ). A lightweight adapter (e.g., LoRA [20]) parameterized by ∆ω is optimized with the denoising objective:  2 Ltune (∆ω) = E(Vi ,ci )∼{(Vi ,ci )}, τ, ϵ ϵ − ϵω+∆ω (zi,τ , τ, Etext (ci )) 2 , (5)

where zi,τ is the noisy latent at step τ . Given the adapted model ϵω+∆ω and a new prompt c⋆ , a new video is generated by iterative denoising in the latent space, followed by VAE decoding.

Reference-based Video Customization. Reference-based methods take a reference image Iref and a prompt c, and generate a video through a pretrained image-to-video (I2V) model gϕ . The reference is first encoded as zref = E(Iref ) and injected into the denoising trajectory in one of two common ways: ϵϕ (zτ , τ, Etext (c), A(zref ))

or

ϵϕ ([ zτ ∥ zref ], τ, Etext (c)) ,

(6)

where A(·) denotes a cross-attention branch and [ · ∥ · ] denotes channel-wise concatenation. The denoised latent is finally decoded back to a video via VAE decoding.

4

Rethinking Video Protection

In this section, we rethink video protection from the perspective of video temporal structure. We first consider a general protection objective against both reference- and tuning-based customization, and then show that naively transferring image protection methods to videos leads to several failure modes. These observations reveal three video-specific temporal challenges that motivate our method design. 4.1

Video VAE as the Shared Vulnerability

Diffusion-based video customization typically starts by encoding videos or images into latent representations using a 3D video VAE, which compresses high-dimensional data (e.g., raw pixels) into compact latents for computational 4

A P REPRINT

Video

VAE Reconstruction

Input

Image

(a) Clean Image

f0

f24

f48

f0

f0

f24

f48

f0

(b) Protected Image

(c) Clean Video

f24

f48

f24

f48

(d) Per-frame Protected Video

Figure 2: Image-level protection under video VAE reconstruction. (a) Clean image. (b) Protected image. (c) Clean video, where the numbers indicate frame indices. (d) Protected video obtained by applying image protection to each frame. Images are treated as single-frame videos, and all inputs are reconstructed by the same video VAE. The top row shows the inputs to the video VAE, and the bottom row shows the corresponding VAE reconstructions. Single-white-frame video at index 𝒕

All-black video

0

···

1

𝑡

··· 𝑇−2 𝑇−1

0

3D Causal Video VAE Encoder

𝑡

··· 𝑇−2 𝑇−1

3D Causal Video VAE Encoder

Latent

Latent

0

···

1

···

"! −# $

" ··· 𝑇−1

||

"! −# $

0

−

"! −# $

···

"! −# $

" ··· 𝑇−1

||2

Latent distance

(a) Latent Distance Computation

(b) Temporal Receptive Field

Figure 3: Temporal receptive-field analysis of 3D causal video VAEs. (a) Latent distance computation. We encode an all-black video and a single-white-frame video, in which only the t-th frame is changed to white, and compute their latent distance at the middle temporal position. The middle latent position is defined as the rounded-down midpoint of the latent temporal positions. (b) Temporal receptive fields of LTX-2.3 [15] and Wan-2.2 [55] VAEs. The x-axis denotes the white-frame index t, and the y-axis shows the corresponding latent distance computed in (a). The left and right columns show the original causal and modified non-causal versions. Larger latent distance indicates stronger influence.

efficiency. Reference-based methods [15, 55, 3] encode the reference image before generation, while tuning-based methods [1, 20] encode training videos before fine-tuning. This makes the VAE latent a shared representation in both customization pipelines. We thus optimize the protective perturbation to disrupt the VAE latent, so that identity information is corrupted before being used by downstream customization. To analyze the protection effectiveness and identify video-specific challenges, we use the VAE reconstruction result in this section. An accurate reconstruction indicates that the latent still contains usable information, and a corrupted one indicates that this information has been disrupted. All experiments in this section are conducted using the 3D causal video VAEs of LTX-2.3 [15] and Wan2.2 [55]. 4.2

Temporal Challenges in Video Protection

Unlike existing image protection methods for T2I and I2I generation, and even I2V generation where protection is usually applied to a single image reference, protecting complete videos requires addressing additional challenges arising from temporal structure. We identify three key temporal challenges that hinder effective full-video protection: temporal compression, temporal overfitting, and temporal inconsistency. Temporal compression: image-level perturbations cannot survive temporal compression in 3D video VAE. A straightforward way to protect videos is to extend image-level protection in a frame-wise manner, i.e., by optimizing 5

Input

A P REPRINT

VAE Reconstruction

f0

f0

f12

f24

f16

f20

f24

f0

f12

f24

f16

f20

f24

f0

(a) Protected Video (25f)

(b) Temporal Crop of Protected Video (Last 9f)

f12

f24

f12

f24

(c) Apply Protection to Unseen Video (25f)

Figure 4: Per-video perturbations overfit to the optimized video. (a) A perturbation optimized on a 25-frame video provides strong protection for the original video. (b) When the protected video is temporally cropped to its last 9 frames, the protection largely disappears. (c) Applying the same perturbation to an unseen 25-frame video fails to protect it. an image-level perturbation against video-based customization independently for each frame. We first consider this frame-wise image-level setting. Given a frame image v, an image-level perturbation ξ can be optimized by maximizing the distance between the VAE latent representations of the clean and perturbed inputs: ξ ⋆ = arg max

∥ξ∥∞ ≤η

2

E(v + ξ) − E(v) 2 ,

(7)

where E is the encoder of the 3D causal video VAE. As shown in Fig. 2(a-b), the clean image is accurately reconstructed, whereas the protected image is reconstructed as a near-black image, indicating that single-image protection is effective. However, this effectiveness does not carry over to videos. From the comparison between Fig. 2(c-d), when the same image-level objective is optimized and applied frame by frame for the video, although the reconstructed video is initially disrupted, the reconstruction gradually recovers in later frames. We attribute this phenomenon to the temporal compression mechanism of 3D causal video VAEs: • Temporal compression weakens image-level perturbations. The video VAE encoder compresses information from multiple frames into each temporal latent position. Since image-level perturbations are optimized independently for each frame, even if they effectively disrupt the corresponding single-frame latent representation, their effect can be weakened after being aggregated with temporally compressed information from neighboring frames. In other words, a perturbation that enlarges the latent distance for an individual frame does not necessarily enlarge the distance between the temporally compressed latent representations of the clean and protected videos2 . • Causal temporal modeling makes the degradation more severe in later frames. Due to causal temporal modeling, such as causal temporal convolution [55, 15], the latent representation at each temporal position can only aggregate information from the current and previous frames, while future frames are inaccessible3 . As a result, later frames aggregate temporally compressed information from more previous frames, leading to stronger perturbation degradation. In contrast, earlier frames involve a shorter temporal history and are therefore less affected4 . This suggests that effective video protection should optimize perturbations over multiple frames jointly, so as to account for temporal dependencies introduced by temporal compression and causal temporal modeling. Temporal overfitting: a perturbation optimized on a single video is vulnerable to temporal editing and fails to generalize to unseen videos. A natural next step is therefore to optimize perturbations at the video level. However, simply moving from image-level perturbations in a frame-wise manner to video-level perturbations for the full video is not enough. Specifically, a full video-level perturbation can easily become temporally inflexible: it may be vulnerable to temporal edits such as trimming or length changes, fail to generalize across different clips, and incur optimization costs that scale with the full video length. To examine this, we consider a straightforward video-level baseline that applies Projected Gradient Descent (PGD) [38] by directly optimizing a video-level perturbation ξ ∈ RT ×C×H×W 2

This temporal compression is different from directly removing perturbations via pixel-space or spatial denoising. We verify this with two variants: (i) the static-video setting in Fig. 8; and (ii) image-level Universal Adversarial Perturbations (UAPs) in Fig. 9. 3 We analyze the temporal receptive field of the 3D causal video VAE. As illustrated in Fig. 3(a), we measure the influence of each frame index t by comparing the middle-position latent of an all-black video and a single-white-frame video. Fig. 3(b) (left column) shows that earlier frames can still affect the middle temporal position, indicating that each latent is obtained through temporal compression and information aggregation over previous frames. The influence decays with temporal distance from the middle latent position, showing that temporally distant previous frames contribute less. 4 Notably, if we close the causal mechanism in 3D video VAE, earlier frames also lose protection effectiveness (Fig. 10). This is because the non-causal temporal receptive field also aggregates information from later frames, as shown in Fig. 3(b) (right column).

6

avg-2 skip avg-5 gauss lpf down-2×

drop-30%

<.01 <.01 <.01 <.01 <.01 <.01 <.01

.58 .04 <.01 <.01 <.01 .05 .06

Temporally inconsistent

.73 .07 .05 .01 .01 .29 .33

.87 .07 .11 .10 .10 .42 .35

Temporal Consistency

1.00 .98 1.00 1.00 1.00 .99 1.00

1.00 0.75 0.50 0.25 0.00

Attack-strength retention

A P REPRINT

Temporally consistent

Figure 5: Attack-strength retention under 7 temporal attacks (named in the left column, formulations in Appendix A.1.2). Temporal consistency is evaluated by cosine similarity between adjacent frames. with the same shape as the input video: ξ ⋆ = arg max

∥ξ∥∞ ≤η

E(V + ξ) − E(V )

2 . 2

(8)

As shown in Fig. 4(a), this baseline provides strong protection across all frames, showing that video-level optimization can disrupt video VAE reconstruction. However, the optimized perturbation overfits to the specific temporal sequence of the video used for optimization, leading to poor generalizable protection in two aspects: • Vulnerability to temporal editing of the same video. When the protected video is temporally cropped (e.g., to its last 9 frames), the protection largely disappears, as shown in Fig. 4(b). This failure indicates that optimizing a perturbation over the complete video can cause temporal overfitting to the specific temporal sequence, making the protection sensitive to even common temporal edits such as changing the temporal span or starting position. • Failure to generalize to unseen videos. Applying the same perturbation to an unseen 25-frame video also fails to disrupt the reconstruction, as shown in Fig. 4(c). This indicates that per-video PGD is not reusable across different video content, and a new perturbation must be optimized for each video. These results suggest that effective video protection should avoid overfitting to a specific temporal sequence, thereby remaining robust to temporal cropping or length changes. Ideally, it should also generalize to unseen clips, reducing the need to optimize a new perturbation for every full video and thus enabling practical deployment. Temporal inconsistency: temporally inconsistent perturbations are not robust to temporal attacks. Before using a protected video for customization, an attacker can apply temporal attacks, such as frame interpolation and frame averaging, to weaken the protection by attenuating the perturbation in pixel space before it is encoded by the video VAE. We observe that when each frame of the video perturbation is optimized independently, the perturbation becomes highly vulnerable to such temporal attacks. We refer to such a perturbation as temporally inconsistent. To quantify how well a perturbation survives a temporal attack T , we measure the attack-strength retention. As shown in Fig. 5, a temporally inconsistent perturbation, which sits at the left end of the consistency axis, is almost completely erased by every attack, as its retention drops to nearly zero. The reason is that per-frame independent perturbations are temporally uncorrelated. Frame-averaging operations act as low-pass filters along the temporal dimension, attenuating the adversarial perturbation in pixel space. This suggests that δy is encouraged to be temporally consistent to be robust against such attacks. More details on the definition of temporal attacks and experiments are provided in Appendix A.1.2.

5

TC-UAP: Temporally Consistent Universal Adversarial Perturbations

In this section, we propose TC-UAP, an identity-level Temporally Consistent Universal Adversarial Perturbation for video protection against both tuning-based and reference-based customization. 5.1

Identity-Level Multi-Frame UAP

Identity-level multi-frame formulation. To enable practical and efficient protection, we seek to generate adversarial perturbations that can accommodate videos of varying lengths and generalize to unseen videos of the same identity without requiring per-video optimization. Accordingly, we model the protection signal as an identity-level universal 7

A P REPRINT

Tr adversarial perturbation (UAP). For identity y, given a training video set VyTr = {Vi }M i=1 ⊆ Vy , we learn a UAP δy shared across videos of that identity. To provide sufficient temporal expressiveness beyond conventional one-frame UAPs5 [40], we instantiate δy as a multi-frame UAP comprising N temporally indexed perturbation frames:

δy ∈ RN ×C×H×W ,

∥δy ∥∞ ≤ η,

(9)

where η is the perturbation budget and we use δyn to denote its n-th perturbation frame. To protect a video Vi of length Ti , we repeat δy along the temporal dimension until it covers all Ti frames:  (10) δTi = RepeatTi (δy ) = δy1 , . . . , δyN , δy1 , . . . , δyN , δy1 , . . . , {z } | repeated and cropped to Ti frames

and obtain the protected video as Vi′ = Vi + δTi . This construction allows the fixed-length multi-frame UAP to be applied to videos of varying lengths. Video-level latent disruption objective. To provide unified protection against both customization pipelines, we target video VAE latent representations, which constitute a common intermediate representation in reference- and tuning-based customization. To mitigate the weakening effect of temporal compression in 3D video VAEs, we optimize the perturbation jointly at the video level rather than frame by frame. Therefore, an ideal full-video latent-disruption objective can be formulated as:
2 Lfull (11) lat (δy ) = − EVi ∼VyTr E Vi + RepeatTi (δy ) − E(Vi ) 2 , where E denotes the video VAE encoder. Minimizing this objective encourages the multi-frame UAP to induce a large distance between the latent representations of the clean and protected videos. However, directly optimizing Eq. (11) over full-length videos incurs substantial memory overhead and may cause the learned perturbation to overfit to the temporal sequences of the training videos, including their full durations, fixed sequence boundaries, and fixed alignment between the causal sequence boundary and the starting phase of the repeated multi-frame UAP. Temporal edits such as starting-point shifts, cropping, and length variations alter these properties and may therefore weaken the protection. Sliding-window proxy. We therefore use sliding windows as a proxy for the full-video objective. As shown in Fig. 3(b) left column, under causal temporal modeling, each temporal latent position primarily depends on a local span of the current and preceding input frames. Accordingly, different latent positions within a window involve different effective history lengths, which gradually increase until the temporal receptive field is largely saturated. Motivated by this observation, we choose the window length L to cover at least the dominant portion of the temporal receptive field of the 3D causal video VAE. Although shorter than the full video, each L-length window captures sufficient temporal dependencies to account for the effects of temporal compression. Formally, for a training video Vi ∈ VyTr of length Ti and its protected version Vi′ = Vi + RepeatTi (δy ), we sample a starting temporal position k ∈ {0, . . . , Ti − L} and extract: X ′ = {vi′j }k+L−1 . j=k

X = {vij }k+L−1 , j=k

(12)

The practical latent-disruption objective is then defined as: 2

Llat (δy ) = − EVi ∼VyTr , k ∥E(X ′ ) − E(X)∥2 .

(13)

Intuitively, this sliding-window objective serves as an effective proxy for the full-video objective. For a video longer than the optimization window, each latent position still depends primarily on a local temporal context whose dominant receptive field can be covered by the L-length window. When the multi-frame UAP is temporally repeated across such a video, latent features at later temporal positions remain influenced by the adversarial perturbations within their corresponding receptive fields, similarly to how latent features are perturbed during window-based optimization. Consequently, perturbation patterns learned within fixed-length windows can be extended to longer videos through temporal repetition while remaining effective under longer-sequence encoding. Taken together, window-based optimization not only reduces the substantial memory overhead of full-video optimization but also enables the multi-frame UAP to maintain its protection effectiveness under temporal edits. 5

Empirically, we find that a one-frame UAP, when repeated across video frames, fails to provide sufficiently strong video-level protection under the video VAE latent-disruption objective. Detailed results are provided in Fig. 11.

8

A P REPRINT

Algorithm 1 Training the identity-level multi-frame UAP δy Tr Require: training videos for an identity y: VyTr = {Vi }M i=1 , multi-frame UAP length N , window length L, budget η, surrogate temporal attack T , surrogate-loss weight λ, learning rate γ, epochs E, and R from Eq. (15). 1: Initialize θy ∼ Uniform(−0.01, 0.01) 2: for e = 1 to E do 3: for each Vi ∈ VyTr do 4: δy ← R(θy ) ▷ Eq. (15) 5: δTi ← RepeatTi (δy ) ▷ Eq. (10) 6: Vi′ ← Vi + δTi 7: for each window position k sampled from Vi do 8: X ← Vi [k : k + L − 1], X ′ ← Vi′ [k : k + L − 1] ▷ clean / protected window 9: z ← E(X), z ′ ← E(X ′ ) 10: Llat ← − ∥z ′ − z∥22 11: z̃ ← E(T (X)), z̃ ′ ← E(T (X ′ )) 12: Ltemporal ← − ∥z̃ ′ − z̃∥22 13: Lid ← Llat + λ · Ltemporal
▷ overall objective 14: θy ← Adam θy , ∇θy Lid , γ ▷ update θy 15: δy ← R(θy ) ▷ ℓ∞ projection in δy -space 16: δy ← clip(δy , [−η, η]) ; θy ← R−1 (δy ) 17: end for 18: end for 19: end for 20: return δy ← R(θy )

5.2

Temporal Consistency Design

Although the multi-frame formulation provides greater temporal expressiveness, a multi-frame UAP is not necessarily temporally consistent when its frames are independently parameterized, leaving the resulting perturbation vulnerable to temporal attacks. To address this issue, we improve temporal robustness from two complementary aspects: an extrinsic surrogate temporal-attack loss and intrinsic temporal consistency modeling. Extrinsic surrogate temporal-attack loss. We first introduce a surrogate temporal-attack loss that directly optimizes the multi-frame UAP to remain effective after temporal attack: Ltemporal (δy ) = − EX, X ′ E(T (X ′ )) − E(T (X))

2 , 2

(14)

where T is a surrogate temporal attack, such as frame averaging, which averages each pair of adjacent frames with weights 0.5/0.5. Specifically, this objective encourages the multi-frame UAP to still preserve a large VAE latent distance after the surrogate temporal attack, thus explicitly enhancing its robustness. However, such attack-aware optimization may become tied to the specific surrogate attack and fail to generalize to unseen temporal attacks. Intrinsic temporal consistency modeling. As illustrated in Fig. 5, perturbations with stronger temporal consistency retain their attack strength more effectively across different temporal attacks. Motivated by this observation, we introduce an attack-agnostic temporal-consistency prior into the multi-frame UAP parameterization to improve generalization to unseen temporal attacks. The parameterization is designed to balance temporal consistency with perturbation expressiveness, as overly strong temporal constraints may limit the expressiveness required for video protection, whereas weak temporal correlation may leave different frames nearly independent, making stable temporal consistency difficult to achieve. Based on this trade-off, we use a reparameterization based on the average of previous frames. Specifically, we introduce a parameter θy ∈ RN ×C×H×W and define the reparameterization δy = R(θy ) as: δy1 = θy1 ,

δyn =

n−1 1 X i δ + θyn , n − 1 i=1 y

for n ≥ 2,

(15)

with inverse θy = R−1 (δy ), where δyn and θyn denote the n-th frame of δy and θy , respectively. In this formulation, each UAP frame consists of two terms: the average of all previous UAP frames and a learnable frame-specific term. The first term makes δyn depend on perturbations at earlier temporal indices, thereby introducing temporal correlation across perturbation frames. The second term θyn retains a learnable component specific to the n-th frame, thereby preserving the expressiveness of the multi-frame UAP. This attack-agnostic temporal structure complements the surrogate temporal-attack loss and improves robustness against unseen temporal attacks. 9

A P REPRINT

5.3

Optimization for TC-UAP

Overall objective. Combining the untargeted latent distance loss in Eq. (13) with the surrogate temporal attack loss in Eq. (14), the total training objective is: Lid (δy ) = Llat (δy ) + λ Ltemporal (δy ),

δy = R(θy ),

(16)

where λ controls the contribution of the surrogate temporal-attack loss. Minimizing Lid encourages the multi-frame UAP to induce a large VAE latent distance both before and after the surrogate temporal attack, thereby jointly optimizing protection effectiveness and temporal robustness. Sliding-window-based Projected Gradient Descent. For each identity y, the UAP is optimized over a training video Tr Tr set VyTr = {Vi }M i=1 . At each training step, we sample a video Vi ∈ Vy with length Ti , and construct the corresponding ′ protected video Vi = Vi + RepeatTi (δy ) according to Eq. (10). We then uniformly sample a starting frame index k ∈ {0, . . . , Ti − L}, and extract the clean and protected windows from the same temporal position via Eq. (12), i.e., X = {vij }k+L−1 and X ′ = {vi′j }k+L−1 . The total loss is then computed according to Eq. (16). We optimize θy by j=k j=k back-propagating gradients through δy = R(θy ). After each update, the UAP δy = R(θy ) is projected in δy -space to satisfy the ℓ∞ budget:
δy ← Π∥δy ∥∞ ≤η R(θy ) , θy ← R−1 (δy ), (17) where Π∥δy ∥∞ ≤η denotes the element-wise projection onto the ℓ∞ ball of radius η, implemented by clamping each perturbation value to [−η, η]. The complete optimization procedure is summarized in Algorithm 1. Applying the learned UAP to unseen videos. After optimization, given a new video V with length T , the protected video V ′ can be obtained by repeating δy along the temporal dimension until it covers all frames, and cropping it to length T : V ′ = V + RepeatT (δy ), (18) where additional optimization for each new video is not required. Therefore, the identity-level multi-frame UAP provides generalizable and efficient protection, as it can be reused across unseen videos of the same identity.

6

Experiments

6.1

Experimental Setup

Datasets. To the best of our knowledge, there is no existing benchmark for protecting videos against diffusion-based customization. Therefore, we adapt three human-centered video datasets and evaluate on them: HDTF [70], CelebVHQ [76] and TalkVid [6]. For each dataset, we select 20 identities and split videos of each identity into 15 training clips for UAP optimization and 15 test clips for evaluating protection effectiveness. More dataset details and identity selection criteria are provided in Appendix B.1.

Text Prompt: The p3r5on takes a bite from a slice of pizza they are holding, chews slowly, and looks back at the camera.

Tuning-based Result

Reference-based Result

Ours IDProtector Mist PhotoGuard Clean

Protected Video

F0

F60

F120

F0

F24

F48

F72

F96

F120

F0

F24

F48

F72

Figure 6: Qualitative comparison of reference- and tuning-based customization results. 10

F96

F120

A P REPRINT

Table 1: Results of protection quality evaluated under tuning-based and reference-based settings. Bold indicates the best result and underline the second-best. On the Ours row, green percentages report the relative improvement of our method against the strongest baseline. Tuning-based Dataset

Methods

VAE Reconstruction

Reference-based

Identity Preservation

VAE Reconstruction

Identity Preservation

PSNR↓ SSIM↓ LPIPS↑ FDFR↑ ISM1↓ ISM2↓ PSNR↓ SSIM↓ LPIPS↑ FDFR↑ ISM1↓ ISM2↓

HDTF

Clean PhotoGuard Mist IDProtector Ours

Clean PhotoGuard Mist CelebV-HQ IDProtector Ours

TalkVid

Clean PhotoGuard Mist IDProtector Ours

39.64 29.44 31.54 29.15 13.86

0.973 0.618 0.770 0.757 0.368

0.016 0.590 0.347 0.397 0.657

0.000 0.000 0.000 0.000 0.027

0.598 0.572 0.544 0.430 0.077

0.609 0.585 0.557 0.459 0.080

41.69 30.64 31.25 29.33 10.08

0.979 0.688 0.743 0.763 0.153

0.011 0.451 0.374 0.401 0.736

0.017 0.020 0.003 0.003 0.321

0.607 0.556 0.527 0.179 0.129

0.624 0.573 0.544 0.191 0.141

↑52.45%

↑40.45%

↑11.36%

–

↑82.09%

↑82.57%

↑65.63%

↑77.76%

↑63.19%

↑1505.00%

↑27.93%

↑26.18%

39.47 29.26 31.35 29.16 12.91

0.972 0.617 0.767 0.757 0.374

0.019 0.600 0.378 0.413 0.645

0.000 0.000 0.000 0.000 0.006

0.630 0.599 0.554 0.446 0.113

0.650 0.617 0.579 0.475 0.125

42.27 30.59 31.23 29.43 8.84

0.981 0.695 0.743 0.764 0.171

0.011 0.464 0.398 0.418 0.708

0.013 0.017 0.009 0.013 0.225

0.611 0.543 0.501 0.232 0.139

0.637 0.571 0.525 0.250 0.140

↑55.73%

↑39.38%

↑7.50%

–

↑74.66%

↑73.68%

↑69.96%

↑75.40%

↑52.59%

↑1223.53%

↑40.09%

↑44.00%

36.94 28.51 30.44 28.69 12.17

0.960 0.602 0.761 0.751 0.381

0.018 0.567 0.349 0.395 0.637

0.000 0.000 0.000 0.000 0.013

0.623 0.585 0.551 0.431 0.160

0.636 0.598 0.568 0.463 0.164

39.19 29.97 30.24 29.10 8.00

0.971 0.691 0.734 0.765 0.187

0.013 0.438 0.380 0.403 0.709

0.000 0.001 0.001 0.001 0.146

0.628 0.572 0.527 0.310 0.275

0.650 0.595 0.545 0.327 0.286

↑57.31%

↑36.71%

↑12.35%

–

↑62.88%

↑64.58%

↑72.51%

↑72.94%

↑61.87%

–

↑11.29%

↑12.54%

Evaluation metrics. Our method is evaluated from two perspectives: protection effectiveness and invisibility. For protection effectiveness, we report VAE reconstruction metrics including PSNR, SSIM [62] and LPIPS [69]; and identity preservation metrics, including Face Detection Failure Rate (FDFR) [10] and identity similarity measured by ArcFace [9] (ISM1) and CurricularFace [22] (ISM2). For invisibility, we report Video Multi-Method Assessment Fusion (VMAF) [41]. Higher VMAF indicates better perceptual quality and less visible perturbation. Detailed definitions are provided in Appendix B.2. Implementation. Following prior image protection works against diffusion-based customization [46, 58, 53, 30, 31], we adopt a white-box setting in which the protector has access to the VAE encoder. For each identity, we set the UAP length to 9 frames and optimize it on 15 training clips with perturbation budget η = 0.1. Following Eq. (10), the learned UAP is temporally repeated and added to each test clip to obtain the protected test set, which consists of 15 test clips. For tuning-based evaluation, we fine-tune LoRA adapters for LTX-2.3 [15] and Wan2.2-5B [55] on the protected test set. For reference-based evaluation, the official LTX-2.3 and Wan2.2-5B TI2V pipelines are used, each conditioned on an extracted frame of a protected video. The surrogate temporal attack T is implemented as frame averaging, in which adjacent frames are averaged with weights 0.5/0.5. More details are deferred to Appendix B.3. Baselines. We consider three baseline image protection methods: PhotoGuard [46], Mist [30], IDProtector [51]. We apply each baseline to every frame of the test videos and adopt the same perturbation budget η = 0.1. 6.2

Main Results

Table 2: Invisibility of the perturbation (VMAF↑).

We compare our method against the baselines across three datasets on LTX-2.3 [15] under both the referenceand tuning-based customization pipelines. Quantitative results are reported in Table 1. Across all datasets, our method achieves the lowest ISM and the highest FDFR, indicating that the generated identity differs most from the target identity and is even undetectable as a face in many frames. Besides, as shown in Table 2, our method achieves the highest VMAF, indicating that our protection is the most imperceptible.

Method

HDTF

CelebV-HQ

TalkVid

Clean Random (ε = 0.1)

99.17 92.65

100.64 93.87

100.14 94.01

80.86 74.63 52.53 82.76 (+1.90)

82.76 76.76 54.94 84.60 (+1.84)

81.93 75.49 56.50 84.81 (+2.88)

PhotoGuard Mist IDProtector Ours

11

A P REPRINT

Tuning-based

Reference-based

VAE Reconstruction

VAE Reconstruction 0.788

R

R

FDF

0.446

0.416

0.046

0.410

PhotoGuard

ISM1

0.022

FDF

R

PSN

0.769

R

PSN

33

0.4

PS

2

Clean

SSIM

0.479

Identity Preservation

72 0.4 1 0.37 0.388

LPI

PS ISM1

54 31.0 29.79 7

ISM

LPI

2

0.409

SSIM

24

ISM

28.92

0.772 0.713

0.749 0.664 29.

29.

68 0.4 2 0.36 77 0.3

Identity Preservation

Mist

IDProtector

Ours

Figure 7: Protection quality on the TalkVid dataset using the Wan2.2 video diffusion model [55].

We also analyze VAE reconstruction to verify whether the input latent is effectively disrupted, as shown in Table 1. Since the two customization pipelines take different forms of input, we evaluate reconstruction in two settings. For tuning-based customization, the input is a set of videos, so we measure video-level VAE reconstruction. For referencebased customization, the input is a reference image, so we measure image-level VAE reconstruction. Compared with the strongest baseline, our method reduces reconstruction PSNR by 15.96 dB in the video-level setting and 20.31 dB in the image-level setting. The corresponding SSIM drops are 0.24 and 0.52, respectively. These results show that our method strongly disrupts the VAE latent, which is consistent with its strong ability to reduce identity preservation in customization. We also present qualitative results in Fig. 6. Under our method, the generated faces no longer look like the target person, while most baselines still produce faces that clearly look like the target. Among them, IDProtector shows some degree of protection in reference-based customization results. However, IDProtector adds visible patterns at fixed facial regions, which are clearly visible. More qualitative comparisons are shown in Appendix C. In addition, we evaluate our method on the Wan2.2 video diffusion model [55] using the TalkVid dataset. Results are shown in Fig. 7. Under both customization pipelines, our method again achieves the lowest VAE reconstruction quality and the lowest ISM scores overall. Under the reference-based pipeline, PhotoGuard achieves slightly higher LPIPS and FDFR than our method. However, on the identity-preservation metrics, our method still outperforms.

6.3

Robustness evaluation against temporal attacks

We further evaluate the robustness of our method against temporal attacks. We test three unseen temporal attacks on the protected videos: box filter, Gaussian filter, and low-pass filter. The details of the three temporal attacks are shown in Appendix B.2. We compare our method with a PGD baseline that directly optimizes a per-video perturbation for each video against the VAE encoder, without any temporal-consistency design, as in Eq. (8). This gives strong protection on each individual video. Results are shown in Table 3. On the original protected videos, the PGD baseline achieves the strongest protection against tuning-based customization. However, once any attack is applied, the PGD baseline loses most of its protection. PSNR rises by more than 20 dB after each attack, and ISM1 rises from 0.001 to around 0.5, meaning the protection is fully erased. In contrast, our method changes slightly after each filter. The tuning-based PSNR rises by less than 3 dB, and ISM1 stays around 0.10. The reference-based metrics follow the same trend. These results demonstrate that our method is robust to unseen temporal attacks. This confirms that our temporal-consistency design provides robustness, rather than resistance to only the specific attack seen during training. 12

A P REPRINT

Table 3: Robustness results under different unseen temporal attacks on the TalkVid dataset. Tuning-based Operation

Methods

VAE Reconstruction

Reference-based

Identity Preservation

VAE Reconstruction

Identity Preservation

PSNR↓ SSIM↓ LPIPS↑ FDFR↑ ISM1↓ ISM2↓ PSNR↓ SSIM↓ LPIPS↑ FDFR↑ ISM1↓ ISM2↓ Original

PGD Ours

6.19 12.17

0.096 0.381

0.857 0.637

0.169 0.013

0.001 0.160

0.006 0.164

24.43 8.00

0.638 0.187

0.446 0.709

0.001 0.146

0.534 0.275

0.551 0.286

Box Filter

PGD Ours

26.21 14.66

0.741 0.443

0.351 0.647

0.000 0.001

0.463 0.136

0.481 0.141

34.43 8.92

0.849 0.223

0.282 0.708

0.004 0.168

0.550 0.151

0.576 0.156

Gaussian Filter

PGD Ours

32.82 14.49

0.803 0.432

0.356 0.681

0.000 0.013

0.469 0.111

0.491 0.117

32.37 8.91

0.806 0.217

0.342 0.715

0.002 0.165

0.540 0.164

0.561 0.171

Low-pass Filter

PGD Ours

34.66 14.23

0.861 0.426

0.280 0.685

0.000 0.017

0.503 0.097

0.523 0.107

36.64 8.57

0.905 0.197

0.216 0.754

0.002 0.220

0.361 0.077

0.389 0.071

Table 4: Ablation study on TalkVid dataset. ITM: Intrinsic Temporal Modeling reparameterization (Eq. 15); STA: Surrogate Temporal-Attack loss (Eq. 14). ✓/✗ indicates whether the corresponding module is enabled. Tuning-based Operation

ITM STA

VAE Reconstruction

Reference-based

Identity Preservation

VAE Reconstruction

Identity Preservation

PSNR↓ SSIM↓ LPIPS↑ FDFR↑ ISM1↓ ISM2↓ PSNR↓ SSIM↓ LPIPS↑ FDFR↑ ISM1↓ ISM2↓ Original

✓ ✗ ✓

✗ ✓ ✓

11.46 6.47 12.17

0.318 0.082 0.381

0.682 0.826 0.637

0.003 0.000 0.013

0.061 0.010 0.160

0.071 0.017 0.164

8.08 14.08 8.00

0.191 0.358 0.187

0.708 0.609 0.709

0.084 0.008 0.146

0.232 0.415 0.275

0.240 0.425 0.286

Box Filter

✓ ✗ ✓

✗ ✓ ✓

15.30 18.50 14.66

0.444 0.501 0.443

0.639 0.574 0.647

0.013 0.000 0.001

0.173 0.224 0.136

0.182 0.239 0.141

9.18 14.93 8.92

0.224 0.415 0.223

0.688 0.607 0.708

0.111 0.056 0.168

0.162 0.320 0.151

0.173 0.333 0.156

Gaussian Filter

✓ ✗ ✓

✗ ✓ ✓

15.36 20.96 14.49

0.437 0.599 0.432

0.656 0.524 0.681

0.013 0.000 0.013

0.167 0.313 0.111

0.181 0.327 0.117

9.17 15.59 8.91

0.221 0.434 0.217

0.687 0.599 0.715

0.105 0.050 0.165

0.152 0.358 0.164

0.167 0.372 0.171

Low-pass Filter

✓ ✗ ✓

✗ ✓ ✓

15.05 21.35 14.23

0.436 0.600 0.426

0.657 0.553 0.685

0.006 0.000 0.017

0.165 0.300 0.097

0.177 0.314 0.107

8.95 15.29 8.57

0.201 0.426 0.197

0.731 0.628 0.754

0.201 0.060 0.220

0.093 0.217 0.077

0.099 0.237 0.071

6.4

Ablation Study

We conduct ablation studies on the two temporal designs: the intrinsic temporal modeling (ITM) and the surrogate temporal-attack loss (STA). Results are shown in Table 4. Tuning-based pipeline. Removing the intrinsic consistency design lifts the constraint on the temporal shape of δy , so on the original protected videos this variant achieves the strongest protection (PSNR 6.47 vs. ours 12.17, ISM1 0.010 vs. ours 0.160). However, once any temporal filter is applied, the protection collapses, with ISM1 rising to 0.224, 0.313, and 0.300 under the three filters, far higher than ours (0.136, 0.111, 0.097). Removing the surrogate loss also has an effect: protection on the original videos is stronger than ours, but under filters our full method consistently wins. The two ablations together show that each design trades a small amount of protection strength for a substantial gain in robustness. Reference-based pipeline. The reference-based pipeline shows a different pattern: our full method is the strongest on both the original protected videos and under filters. The reason is that the reference-based pipeline only consumes a single frame extracted from the protected video, so what matters is per-frame attack strength. Our temporal-consistency designs spread the perturbation evenly along time, so any extracted frame carries a strong attack. Without intrinsic consistency, the perturbation concentrates on a few frames and the extracted one may not be among them; this hurts even the original protection (PSNR 14.08 vs. ours 8.00, ISM1 0.415 vs. ours 0.275) and degrades further under filters. Without the surrogate loss, performance is close to ours under most settings, with the surrogate giving a clear advantage on the low-pass filter (ISM1 0.077 vs. 0.093). Consequently, our temporal-consistency designs add robustness without sacrificing per-frame attack strength. 13

A P REPRINT

7

Conclusion

In this work, we study video protection against unauthorized reference- and tuning-based customization, and identify three key temporal challenges: temporal compression, temporal overfitting, and temporal inconsistency. We propose TC-UAP, the first video-level protection method against both customization threats. By learning an identity-level multi-frame UAP from multiple videos of the same identity, TC-UAP generalizes to unseen videos and clips with different lengths, while intrinsic temporal modeling and an extrinsic surrogate temporal-attack loss improve robustness against temporal attacks. Extensive experiments across datasets and diffusion backbones show that TC-UAP achieves imperceptible, generalizable, and robust protection, taking a step toward securing video content against unauthorized customization.

14

A P REPRINT

References [1] Rameen Abdal, Or Patashnik, Ivan Skorokhodov, Willi Menapace, Aliaksandr Siarohin, Sergey Tulyakov, Daniel Cohen-Or, and Kfir Aberman. Dynamic concepts personalization from single videos. In Proceedings of the Special Interest Group on Computer Graphics and Interactive Techniques Conference Conference Papers, pages 1–9, 2025. [2] Aniruddha Bala, Rohit Chowdhury, Rohan Jaiswal, and Siddharth Roheda. Dct-shield: A robust frequency-domain defense against malicious image editing. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2025. [3] Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets. arXiv preprint arXiv:2311.15127, 2023. [4] Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning to follow image editing instructions. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 18392–18402, 2023. [5] Junjie Cao, Kaizhou Li, Xinchun Yu, Hongxiang Li, and Xiaoping Zhang. Videoguard: Protecting video content from unauthorized editing. arXiv preprint arXiv:2508.03480, 2025. [6] Shunian Chen, Hejin Huang, Yexin Liu, Zihan Ye, Pengcheng Chen, Chenghao Zhu, Michael Guan, Rongsheng Wang, Junying Chen, Guanbin Li, et al. Talkvid: A large-scale diversified dataset for audio-driven talking head synthesis. arXiv preprint arXiv:2508.13618, 2025. [7] Yingjie Chen, Shilun Lin, Cai Xing, Qixin Yan, Wenjing Wang, Dingming Liu, Hao Liu, Chen Li, and Jing Lyu. Identity as presence: Towards appearance and voice personalized joint audio-video generation. arXiv preprint arXiv:2603.17889, 2026. [8] Rohit Chowdhury, Aniruddha Bala, Rohan Jaiswal, and Siddharth Roheda. Vid-freeze: Protecting images from malicious image-to-video generation via temporal freezing. arXiv preprint arXiv:2509.23279, 2025. [9] Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. Arcface: Additive angular margin loss for deep face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, June 2019. [10] Jiankang Deng, Jia Guo, Evangelos Ververas, Irene Kotsia, and Stefanos Zafeiriou. Retinaface: Single-shot multi-level face localisation in the wild. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, June 2020. [11] Weitao Feng, Lixu Wang, Peizhuo Lv, Tianyi Wei, Jie Zhang, Chongyang Gao, Sinong Zhan, and Wei Dong. Token buncher: Shielding llms from harmful reinforcement learning fine-tuning. arXiv preprint arXiv:2508.20697, 2025. [12] Dongnan Gui, Xun Guo, Wengang Zhou, and Yan Lu. I2vguard: Safeguarding images against misuse in diffusionbased image-to-video models. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 12595–12604, 2025. [13] Xu Guo, Fulong Ye, Qichao Sun, Liyang Chen, Bingchuan Li, Pengze Zhang, Jiawei Liu, Songtao Zhao, Qian He, and Xiangwang Hou. Dreamid-omni: Unified framework for controllable human-centric audio-video generation. arXiv preprint arXiv:2602.12160, 2026. [14] Yoav HaCohen, Nisan Chiprut, Benny Brazowski, Daniel Shalem, Dudu Moshe, Eitan Richardson, Eran Levin, Guy Shiran, Nir Zabari, Ori Gordon, Poriya Panet, Sapir Weissbuch, Victor Kulikov, Yaki Bitterman, Zeev Melumian, and Ofir Bibi. Ltx-video: Realtime video latent diffusion. arXiv preprint arXiv:2501.00103, 2024. [15] Yoav HaCohen, Benny Brazowski, Nisan Chiprut, Yaki Bitterman, Andrew Kvochko, Avishai Berkowitz, Daniel Shalem, Daphna Lifschitz, Dudu Moshe, Eitan Porat, et al. Ltx-2: Efficient joint audio-visual foundation model. arXiv preprint arXiv:2601.03233, 2026. [16] Xuanhua He, Quande Liu, Shengju Qian, Xin Wang, Tao Hu, Ke Cao, Keyu Yan, and Jie Zhang. Id-animator: Zero-shot identity-preserving human video generation. arXiv preprint arXiv:2404.15275, 2024. [17] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020. [18] Ziming Hong, Tianyu Huang, Runnan Chen, Shanshan Ye, Mingming Gong, Bo Han, and Tongliang Liu. Adlift: Lifting adversarial perturbations to safeguard 3d gaussian splatting assets against instruction-driven editing. arXiv preprint arXiv:2512.07247, 2025. 15

A P REPRINT

[19] Ziming Hong, Yongli Xiang, and Tongliang Liu. Toward robust non-transferable learning: A survey and benchmark. arXiv preprint arXiv:2502.13593, 2025. [20] Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=nZeVKeeFYf9. [21] Mingwang Hu, Yi Tu, Dandan Tu, and Lanjun Wang. Targeted ensemble defense against unauthorized text-toimage identity customization. Information Fusion, page 103696, 2025. [22] Yuge Huang, Yuhan Wang, Ying Tai, Xiaoming Liu, Pengcheng Shen, Shaoxin Li, Jilin Li, and Feiyue Huang. Curricularface: Adaptive curriculum learning loss for deep face recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5901–5910, June 2020. doi:10.1109/CVPR42600.2020.00594. [23] Felix Juefei-Xu, Run Wang, Yihao Huang, Qing Guo, Lei Ma, and Yang Liu. Countering malicious deepfakes: Survey, battleground, and horizon. International journal of computer vision, 130(7):1678–1734, 2022. [24] Weijie Kong, Qi Tian, Zijian Zhang, Rox Min, Zuozhuo Dai, Jin Zhou, Jiangfeng Xiong, Xin Li, Bo Wu, Jianwei Zhang, et al. Hunyuanvideo: A systematic framework for large video generative models. arXiv preprint arXiv:2412.03603, 2024. [25] Chanhui Lee, Donggyu Choi, Seunghyun Shin, Hae-gon Jeon, and Jeany Son. Universal image immunization against diffusion-based image editing via semantic injection. In European Conference on Computer Vision (ECCV), 2026. [26] Guanlin Li, Shuai Yang, Jie Zhang, and Tianwei Zhang. Prime: Protect your videos from malicious editing. arXiv preprint arXiv:2402.01239, 2024. [27] Xiaofeng Li, Leyi Sheng, Zhen Sun, Zongmin Zhang, Jiaheng Wei, and Xinlei He. Ip-bench: Benchmark for image protection methods in image-to-video generation scenarios. arXiv preprint arXiv:2603.26154, 2026. [28] Xinfeng Li, Tianze Qiu, Yingbin Jin, Lixu Wang, Hanqing Guo, Xiaojun Jia, Xiaofeng Wang, and Wei Dong. Webcloak: Characterizing and mitigating threats from llm-driven web agents as intelligent scrapers. In Proceedings of the 2026 IEEE Symposium on Security and Privacy (SP), 2026. [29] Yiming Li, Shuo Shao, Yu He, Junfeng Guo, Tianwei Zhang, Zhan Qin, Pin-Yu Chen, Michael Backes, Philip Torr, Dacheng Tao, et al. Rethinking data protection in the (generative) artificial intelligence era. arXiv preprint arXiv:2507.03034, 2025. [30] Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion models. arXiv preprint arXiv:2305.12683, 2023. [31] Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. arXiv preprint arXiv:2302.04578, 2023. [32] Runqi Lin, Alasdair Paren, Suqin Yuan, Muyang Li, Philip Torr, Adel Bibi, and Tongliang Liu. Force: Transferable visual jailbreaking attacks via feature over-reliance correction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8610–8620, 2026. [33] Yexiong Lin, Jia Shi, Shanshan Ye, Wanyu Wang, Yu Yao, and Tongliang Liu. Subflow: Sub-mode conditioned flow matching for diverse one-step generation. arXiv preprint arXiv:2604.12273, 2026. [34] Yexiong Lin, Yu Yao, Yang Zhou, and Tongliang Liu. Beyond optimal transport: Model-aligned coupling for flow matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Findings, pages 3955–3964, June 2026. [35] Yixin Liu, Chenrui Fan, Yutong Dai, Xun Chen, Pan Zhou, and Lichao Sun. Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24219–24228, 2024. [36] Zeqian Long, Ozgur Kara, Haotian Xue, Yongxin Chen, and James M Rehg. Immune2v: Image immunization against dual-stream image-to-video generation. arXiv preprint arXiv:2604.10837, 2026. [37] Yingzi Ma, Xiaogeng Liu, Yawen Zheng, and Chaowei Xiao. Safegen-bench: Benchmarking safety in imageconditioned text-to-video generation. arXiv preprint arXiv:2606.01481, 2026. [38] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017. 16

A P REPRINT

[39] Yibo Miao, Yifan Zhu, Lijia Yu, Jun Zhu, Xiao-Shan Gao, and Yinpeng Dong. T2vsafetybench: Evaluating the safety of text-to-video generative models. Advances in Neural Information Processing Systems, 37:63858–63872, 2024. [40] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1765– 1773, 2017. [41] Netflix. VMAF: Video multi-method assessment fusion. https://github.com/Netflix/vmaf. [42] Yan Pang, Baicheng Chen, Yang Zhang, and Tianhao Wang. Vgmshield: Mitigating misuse of video generative models. arXiv preprint arXiv:2402.13126, 2024. [43] Josephine Passananti, Stanley Wu, Shawn Shan, Haitao Zheng, and Ben Y Zhao. Disrupting style mimicry attacks on video imagery. arXiv preprint arXiv:2405.06865, 2024. [44] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. [45] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 22500–22510, 2023. [46] Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious AI-powered image editing. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors, Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pages 29894–29918. PMLR, 23–29 Jul 2023. URL https://proceedings.mlr.press/v202/salman23a.html. [47] Team Seedance, De Chen, Liyang Chen, Xin Chen, Ying Chen, Zhuo Chen, Zhuowei Chen, Feng Cheng, Tianheng Cheng, Yufeng Cheng, et al. Seedance 2.0: Advancing video generation for world complexity. arXiv preprint arXiv:2604.14148, 2026. [48] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by Text-to-Image models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 2187–2204, 2023. [49] Mingwen Shao, Lingzhuang Meng, Xiang Lv, Mengyao Wu, Xinyuan Chen, Qiao Zhang, Chang Liu, Yuanjian Qiao, and Chao Dong. Unidef: Universal defense against unauthorized image manipulation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8631–8640, 2026. [50] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020. [51] Yiren Song, Pei Yang, Hai Ci, and Mike Zheng Shou. Idprotector: An adversarial noise encoder to protect against id-preserving image generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3019–3028, 2025. [52] Qianrui Teng, Xing Cui, Xuannan Liu, Peipei Li, Zekun Li, Huaibo Huang, and Ran He. Id-cloak: Crafting identity-specific cloaks against personalized text-to-image generation. arXiv preprint arXiv:2502.08097, 2025. [53] Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2116–2127, 2023. [54] Duc Vu, Anh Nguyen, Chi Tran, and Anh Tran. Anti-i2v: Safeguarding your photos from malicious image-to-video generation. arXiv preprint arXiv:2603.24570, 2026. [55] Team Wan, Ang Wang, Baole Ai, Bin Wen, Chaojie Mao, Chen-Wei Xie, Di Chen, Feiwu Yu, Haiming Zhao, Jianxiao Yang, et al. Wan: Open and advanced large-scale video generative models. arXiv preprint arXiv:2503.20314, 2025. [56] Zhenchen Wan, Yanwu Xu, Dongting Hu, Weilun Cheng, Tianxi Chen, Zhaoqing Wang, Feng Liu, Tongliang Liu, and Mingming Gong. Mft-viton: High-fidelity virtual try-on with minimal input via a mask-free transformerdiffusion model. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1985–1994, 2025. [57] Zhenchen Wan, Ce Chen, Runqi Lin, Jiaxin Huang, Tianxi Chen, Yanwu Xu, Tongliang Liu, and Mingming Gong. Mobile-vton: High-fidelity on-device virtual try-on. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 38081–38090, 2026. 17

A P REPRINT

[58] Feifei Wang, Zhentao Tan, Tianyi Wei, Yue Wu, and Qidong Huang. Simac: A simple anti-customization method for protecting face privacy against text-to-image synthesis of diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12047–12056, 2024. [59] Lixu Wang, Shichao Xu, Ruiqi Xu, Xiao Wang, and Qi Zhu. Non-transferable learning: A new approach for model ownership verification and applicability authorization. arXiv preprint arXiv:2106.06916, 2021. [60] Zhaoqing Wang, Xiaobo Xia, Zhuolin Bie, Jinlin Liu, Dongdong Yu, Jia-Wang Bian, and Changhu Wang. Taming camera-controlled video generation with verifiable geometry reward. arXiv preprint arXiv:2512.02870, 2025. [61] Zhaoqing Wang, Xiaobo Xia, Runnan Chen, Dongdong Yu, Changhu Wang, Mingming Gong, and Tongliang Liu. Lavin-dit: Large vision diffusion transformer. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 20060–20070, 2025. [62] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4):600–612, 2004. [63] Zihao Wang, Yuxiang Wei, Fan Li, Renjing Pei, Hang Xu, and Wangmeng Zuo. Ace: Anti-editing concept erasure in text-to-image models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 23505–23515, 2025. [64] Qiangqiang Wu, Yi Yu, Chenqi Kong, Ziquan Liu, Jia Wan, Haoliang Li, Alex C Kot, and Antoni B Chan. Temporal unlearnable examples: Preventing personal video data from unauthorized exploitation by object tracking. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 11110–11121, 2025. [65] Zhihao Wu, Yushi Cheng, Tianyang Sun, Xiaoyu Ji, and Wenyuan Xu. Myopia: Protecting face privacy from malicious personalized text-to-image synthesis via unlearnable examples. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 905–913, 2025. [66] Yongli Xiang, Ziming Hong, Zhaoqing Wang, Xiangyu Zhao, Bo Han, and Tongliang Liu. When safety collides: Resolving multi-category harmful conflicts in text-to-image diffusion via adaptive safety guidance. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14746–14755, 2026. [67] Zhuoyi Yang, Jiayan Teng, Wendi Zheng, Ming Ding, Shiyu Huang, Jiazheng Xu, Yuanming Yang, Wenyi Hong, Xiaohan Zhang, Guanyu Feng, et al. Cogvideox: Text-to-video diffusion models with an expert transformer. arXiv preprint arXiv:2408.06072, 2024. [68] Shenghai Yuan, Jinfa Huang, Xianyi He, Yunyang Ge, Yujun Shi, Liuhan Chen, Jiebo Luo, and Li Yuan. Identitypreserving text-to-video generation by frequency decomposition. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 12978–12988, 2025. [69] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018. [70] Zhimeng Zhang, Lincheng Li, Yu Ding, and Changjie Fan. Flow-guided one-shot talking face generation with a high-resolution audio-visual dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3661–3670, 2021. [71] Longjie Zhao, Ziming Hong, Jiaxin Huang, Runnan Chen, Mingming Gong, and Tongliang Liu. Intellectual property protection for 3d gaussian splatting assets: A survey. arXiv preprint arXiv:2602.03878, 2026. [72] Zhengyue Zhao, Jinhao Duan, Xing Hu, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du, Qi Guo, and Yunji Chen. Unlearnable examples for diffusion models: Protect data from unauthorized exploitation. In ICLR 2024 Workshop on Reliable and Responsible Foundation Models, 2024. URL https://openreview.net/forum? id=CHTRtLPYNF. [73] Bowen Zheng, Yongli Xiang, Ziming Hong, Zerong Lin, Chaojian Yu, Tongliang Liu, and Xinge You. Vii: Visual instruction injection for jailbreaking image-to-video generation models. arXiv preprint arXiv:2602.20999, 2026. [74] Jiyang Zheng, Siqi Pan, Yu Yao, Zhaoqing Wang, Dadong Wang, and Tongliang Liu. Aligning what matters: Masked latent adaptation for text-to-audio-video generation. Advances in Neural Information Processing Systems, 38:173244–173272, 2026. [75] Zangwei Zheng, Xiangyu Peng, Yuxuan Lou, Chenhui Shen, Tom Young, Xinying Guo, Binluo Wang, Hang Xu, Hongxin Liu, Mingyan Jiang, et al. Open-sora 2.0: Training a commercial-level video generation model in 200k. arXiv preprint arXiv:2503.09642, 2025. [76] Hao Zhu, Wayne Wu, Wentao Zhu, Liming Jiang, Siwei Tang, Li Zhang, Ziwei Liu, and Chen Change Loy. CelebV-HQ: A large-scale video facial attributes dataset. In European Conference on Computer Vision, 2022.

18

A P REPRINT

Appendices A Extended Methodology

20

A.1 Analysis of Video Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

A.2 Analysis of UAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

B Extended Experimental Setup

22

B.1 Data Preparation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

22

B.2 Evaluation Metrics and Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

24

B.3 Implementation Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

25

C Additional Experimental Results

26

D Limitations and Broader Impacts

30

19

A P REPRINT

A

Extended Methodology

A.1

Analysis of Video Protection

A.1.1

Failure of Image-Level Protection on Videos

Static-content video and universal perturbations. We further evaluate a static-video setting, where all frames are constructed by repeating the first protected frame (the same content and perturbations across frames), and a universal adversarial perturbation (UAP) setting, where the same perturbation is applied to all frames (different content but same perturbations across frames). As shown in Fig. 8 and Fig. 9, the reconstructed video for static video remains near-black but the reconstructed video for image-level UAP still recovers in later frames just like the naive image-level perturbation. This suggests that the recovery observed in Fig. 2(d) does not come from the video VAE simply removing image-level perturbations from a single protected frame. Instead, the recovery relies on temporal compression over different frames in the video, where information from previous frames can help restore the visual content.

Input

These additional results further support that frame-wise image perturbations cannot protect videos because they do not consider the temporal compression in 3D video VAEs.

VAE Reconstruction

f0

f0

f24

f48

f0

f24

f48

f0

(a) Static Video (Clean)

f24

f48

f24

f48

(b) Static Video (Protected)

Figure 8: VAE reconstruction under the static video setting. (a) Clean static video. (b) Protected static video obtained by applying the same image protection to all frames. Video

Input

Image

VAE Reconstruction

f0

f0

f24

f48

f0

f24

f48

f0

(a) Per-frame Reconstruction

f24

f48

f24

f48

(b) Video Reconstruction

Figure 9: VAE reconstruction under the image-level UAP setting. (a) Protected frame reconstruction, where frames are extracted and reconstructed independently. (b) Video reconstruction. Non-causal video VAE. We provide additional results to further analyze the observation shown in Fig. 2(d). In the original LTX-2.3 VAE [15], the encoder is causal along the temporal dimension, meaning that each latent position only compresses information from the current and previous frames without accessing future frames. We modify the encoder into a non-causal version by allowing temporal convolution to also use future frames. Since the VAE was originally trained with a causal encoder structure, this modification introduces some reconstruction mismatch. Therefore, we first evaluate clean video reconstruction under the non-causal encoder as a reference. As shown in Fig. 10(a), the reconstructed clean video brings some distortion, but the main visual content remains recognizable. We then use the same non-causal encoder to encode the per-frame protected video. As shown in Fig. 10(b), the reconstruction recovers all content in the video, instead of only recovering in later frames as observed in Fig. 2(d). This indicates that the gradual recovery is related to the causal temporal structure of the video VAE. With non-causal 20

A P REPRINT

Input

encoding, earlier latent positions can also use information from later frames. Therefore, the temporal information used for reconstruction is no longer limited to previous frames, and the recovery is observed across all frames.

VAE Reconstruction

f0

f0

f24

f48

f0

f24

f48

f0

(a) Non-causal (Clean)

f24

f48

f24

f48

(b) Non-causal (Protected)

Figure 10: VAE reconstruction with a modified non-causal VAE encoder. (a) Clean video. (b) Per-frame protected video. A.1.2

Vulnerability to Temporal Attacks

We define the retention rate ρ as the ratio of latent disruption after and before applying a temporal attack: ρ(T , δy ) =

E(T (V ′ )) − E(T (V )) E(V ′ ) − E(V )

2 2

2 2

.

(19)

A value of ρ → 0 indicates the perturbation is erased by T , while ρ → 1 indicates the perturbation remains effective.

Temporal attacks. We evaluate seven temporal attacks used in Fig. 5. Each attack is applied independently to every spatial-channel location (c, h, w) along the temporal axis of V ∈ RT ×C×H×W . For clarity, the operations in Table 5 omit the (c, h, w) subscripts, and indices outside [0, T − 1] are clamped to the nearest valid frame. Table 5: Temporal attacks used in the retention analysis. Attack

Operation

AVG -2 S KIP AVG -5 G AUSS LPF

T (V )t = 0.5 Vt + 0.5 Vt+1 T (V )t = 0.5PVt−1 + 0.5 Vt+1 T (V )t = 15 2i=−2 Vt+i P T (V )t = ri=−r gi Vt+i , where gi ∝ exp(−i2 /(2σ 2 )), r = ⌈3σ⌉, and σ = 2 T (V ) = Ft−1 (Mk ⊙ Ft (V )), where Mk (ω) = 1 if min(ω, T − ω) < k and 0 otherwise, with k = 8 T (V ) = Up2× (Down2× (V )) Randomly drop frames with mt ∼ Bern(1 − p), p = 0.3, and fill each dropped position with its nearest kept frame

D OWN -2× D ROP -30%

A.2

Analysis of UAP

One-frame UAP does not provide sufficient temporal expressiveness for video protection. One-frame UAP optimizes a single-frame perturbation and repeats it across all video frames. We analyze this design to test whether a one-frame UAP is sufficient for video protection. We optimize the one-frame UAP with the same loss Llat in Eq. (13), which maximizes the VAE latent distance between clean and protected videos. As shown in Fig. 11(a) and (c), earlier temporal latent positions reach much lower losses, and the protection mainly appears in earlier frames, while later frames remain recognizable. To examine whether this failure is caused by optimization imbalance, we reweight the per-position losses by assigning each position a normalized weight inversely proportional to its loss magnitude. As shown in Fig. 11(b) and (d), reweighting makes the loss more balanced across different positions and extends the disruption to later frames. However, the reconstructed video still contains recognizable content. 21

A P REPRINT

Input

This indicates that the limitation of one-frame UAP is not only an optimization imbalance across temporal latent positions. It has limited temporal expressiveness to provide full-video protection.

VAE Reconstruction

f0

f0

f27

f53

f80

f0

f27

f53

f80

f0

f27

f53

f80

f27

f53

f80

(a) Video Reconstruction (w/o reweight)

(b) Video Reconstruction (w/ reweight)

(c) Loss Curve (w/o reweight)

(d) Loss Curve (w/ reweight)

Figure 11: Analysis of one-frame UAP, where a single-frame UAP is shared across all frames and optimized against the video VAE. (a) Video reconstruction without reweight. (b) Video reconstruction with reweight. (c) Loss curves for different temporal latent positions without reweight. (d) Loss curves for different temporal latent positions with reweight.

B

Extended Experimental Setup

This section provides additional details for the experimental setup, including dataset construction, evaluation protocols, prompts, implementation settings, and baseline configurations. B.1

Data Preparation

To evaluate video protection against diffusion-based customization, we construct an evaluation set from three humancentered video datasets: HDTF [70], CelebV-HQ [76], and TalkVid [6]. These datasets are selected because they contain identity-centric videos, provide sufficient video samples per identity, and cover medium- to high-resolution human facial videos. HDTF. HDTF [70] is a large-scale, in-the-wild talking-face dataset collected from YouTube. It contains videos of 362 identities with a total duration of approximately 16 hours. The videos are provided at 720p or 1080p resolution and mainly contain frontal or near-frontal talking-head footage. Due to its relatively clean identity structure and high visual quality, HDTF is suitable for evaluating identity-level protection in talking-face videos. CelebV-HQ. CelebV-HQ [76] is a large-scale high-quality celebrity video dataset designed for face video generation and facial attribute analysis. It contains 35,666 video clips from 15,653 identities. Compared with HDTF, CelebV-HQ contains more diverse appearance attributes, head poses, expressions, and visual conditions, making it useful for evaluating whether a protection method can generalize across more diverse facial videos. TalkVid. TalkVid [6] is a large-scale talking-head video dataset containing 7,729 unique speakers and more than 1,244 hours of HD and 4K footage. It covers 15 languages and a broad age range. Compared with HDTF and CelebV-HQ, TalkVid provides more diverse talking-head videos in terms of speaker demographics, language, and recording scenarios. Identity selection and preprocessing. For each dataset, we select 20 identities. When metadata is available, such as in CelebV-HQ and TalkVid, we prioritize diversity in gender, race, and age group. We also prefer identities whose video clips cover multiple scenes, lighting conditions, and head poses. For datasets with limited metadata, we manually inspect 22

A P REPRINT

(a) HDTF [70]

(b) CelebV-HQ [76]

(c) TalkVid [6]

Figure 12: Visualization of selected identities from the three datasets. One representative frame is shown for each identity.

23

A P REPRINT

candidate identities and select identities with clear facial visibility and sufficient video quality. Some visualization examples are shown in Fig. 12. For each selected identity, we uniformly sample 30 video clips. Each clip is center-cropped around the face region and resized to 640 × 480. Each video clip contains 121 frames at 24 fps. We split the 30 clips of each identity into 15 training clips and 15 test clips. The training clips are used only for optimizing the identity-level universal adversarial perturbation (UAP), while the test clips are used for all downstream evaluations. After the UAP is trained, it is applied to the test clips to obtain the protected test set. All datasets are used for non-commercial research purposes only and in accordance with their respective terms of use. Table 6: Datasets used in this work and their public sources.

B.2

Dataset

Source URL

License / Terms of Use

HDTF [70] CelebV-HQ [76] TalkVid [6]

https://github.com/MRzzm/HDTF https://github.com/CelebV-HQ/CelebV-HQ https://github.com/FreedomIntelligence/TalkVid

CC BY 4.0 – CC BY-NC 4.0

Evaluation Metrics and Protocols

We evaluate our method from two perspectives: protection capability and imperceptibility. For protection capability, we report VAE reconstruction metrics and identity preservation metrics. For imperceptibility, we report invisibility metrics. VAE reconstruction metrics. Since our method targets the video VAE encoder, we need to evaluate how much the protected videos disrupt VAE reconstruction. Given a clean video V and its protected version V ′ , we encode and decode the protected video using the VAE: V̂ ′ = D(E(V ′ )). (20) We then compare the reconstructed result V̂ ′ against the clean input V using PSNR, SSIM [62], and LPIPS [69]. PSNR measures pixel-level reconstruction fidelity: PSNR(V, V̂ ′ ) = 10 log10

MAX2 MSE(V, V̂ ′ )

! ,

(21)

where MAX is the maximum possible pixel value and MSE is the mean squared error between the clean and reconstructed videos. Lower PSNR indicates stronger VAE disruption. SSIM measures structural similarity between the clean and reconstructed contents. Lower SSIM indicates that the reconstructed structure deviates more from the clean input. LPIPS measures perceptual distance using deep visual features; higher LPIPS indicates stronger perceptual distortion. We report both video-level and image-level VAE reconstruction metrics. Video-level metrics are computed by reconstructing the protected video through the video VAE and are mainly associated with the tuning-based customization setting. Image-level metrics are computed on the conditioning frame used by the reference-based image-to-video pipeline. Identity preservation metrics. For generated videos, we also need to measure whether the identity in the generated video still matches the target identity. Hence, we report Face Detection Failure Rate (FDFR) and Identity Score Matching (ISM). For each generated frame, we first use RetinaFace [10] to detect the face. If no face is detected, the frame is counted as a face detection failure. Given a generated video with M frames, the Face Detection Failure Rate is defined as: FDFR =

Mfail , M

(22)

where Mfail is the number of frames where no face is detected. A higher FDFR indicates stronger protection, since the generated face becomes harder to detect. For frames where a face is successfully detected, we compute face embeddings using two face recognition models: ArcFace [9] and CurricularFace [22]. We report the corresponding identity similarity scores as ISM-ArcFace (ISM1) and 24

A P REPRINT

ISM-Cur (ISM2). Given a generated frame embedding f (Iˆm ) and a reference identity embedding ey , the frame-level identity similarity is computed by cosine similarity: sm =

f (Iˆm )⊤ ey . ∥f (Iˆm )∥2 ∥ey ∥2

(23)

The video-level ISM is then averaged over all frames with successfully detected faces: ISM =

1 X sm , |Ω|

(24)

m∈Ω

where Ω denotes the set of generated frames with detected faces. Lower ISM indicates stronger identity protection. For the tuning-based customization setting, the reference identity embedding ey is built from the clean video set of the same identity. Specifically, we uniformly sample 16 frames from the clean videos, detect the face in each frame, extract the face embeddings, and average them to obtain the identity reference. For the reference-based customization setting, the reference identity embedding is computed from the conditioning frame used by the image-to-video pipeline. Invisibility metrics. To evaluate whether the perturbation remains visually imperceptible, we measure the perceptual quality of the protected video V ′ with respect to the clean video V using Video Multi-Method Assessment Fusion (VMAF) [41]. VMAF is a full-reference video quality assessment metric that predicts human-perceived video quality by fusing multiple objective quality measurements, including detail loss, structural similarity, and motion-related features. Given a clean video V and its protected counterpart V ′ , we compute VMAF(V, V ′ ). A higher VMAF score indicates that the protected video is perceptually closer to the clean video, and therefore that the perturbation is less visible. In our evaluation, VMAF is used as the primary invisibility metric because it is designed for video-level perceptual quality assessment and accounts for temporal video characteristics beyond frame-wise image similarity. Evaluation prompts. For both tuning- and reference-based evaluations, we use the same set of five prompts to generate videos, as listed in Table 7. The token “p3r5on” is used as the trigger token for the target identity in tuning-based customization. Table 7: Text prompts used in the experiments. ID

Prompt

P1 P2 P3 P4 P5

The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera. The p3r5on takes a bite from a slice of pizza they are holding, chews slowly, and looks back at the camera. The p3r5on raises a coffee mug to their lips, takes a sip, sets it down, and continues facing the camera. The p3r5on opens a small notebook, glances at a page briefly, then closes it and looks at the camera. The p3r5on lifts a water bottle, takes a few sips, lowers it, and continues facing the camera.

Temporal attacks. For robustness evaluation, we use three unseen temporal attacks selected from the retention analysis in Table 5: AVG -5, which denotes box filtering with a temporal window size of 5; G AUSS, which denotes Gaussian filtering with σ = 2; and LPF, which denotes low-pass filtering with k = 8. These attacks are not used in the surrogate temporal-attack loss during optimization. B.3

Implementation Details

UAP optimization. For each identity, we optimize an identity-level universal adversarial perturbation (UAP) on the 15 training clips. The UAP has a temporal length of 9 frames and is repeated along the temporal dimension to protect videos of arbitrary length. The perturbation is constrained by an ℓ∞ budget of η = 0.1. We optimize the UAP against the video VAE encoder. The λ in Eq. (16) is set to 1.0. The learning rate is set to 4 × 10−3 , and the UAP is optimized for one epoch over the training clips. After each optimization step, the perturbation is projected back to the ℓ∞ ball. Tuning-based customization. For tuning-based evaluation, we fine-tune LoRA adapters on the protected test videos of each identity. The training caption uses the trigger token “p3r5on”. We use AdamW as the optimizer with learning rate 1 × 10−4 and batch size 1. For LTX-2.3 [15], LoRA fine-tuning is performed for 1,500 steps. For Wan2.2-5B [55], LoRA fine-tuning is performed for 2,000 steps. 25

A P REPRINT

After fine-tuning, we generate videos using the evaluation prompts described in Appendix B.2. The generated videos are evaluated using identity preservation metrics, including FDFR, ISM-ArcFace, and ISM-Cur. Reference-based customization. For reference-based evaluation, we use the official image-to-video pipelines of LTX-2.3 and Wan2.2-5B. Each generated video is conditioned on one frame extracted from a protected test video. The same evaluation prompts are used as in the tuning-based setting. Since the reference-based pipeline directly consumes a protected frame, we additionally report image-level VAE reconstruction metrics on the conditioning frame. Hardware. UAP optimization is conducted on a single NVIDIA RTX 4090 GPU (24G). LoRA fine-tuning and video generation are performed on a single NVIDIA RTX Pro 6000 GPU (96G).

C

Additional Experimental Results

Fig. 13 and Fig. 14 provide additional qualitative comparisons on LTX-2.3 [15] and Wan2.2-5B [55]. These results further demonstrate that TC-UAP provides effective protection under both tuning- and reference-based customization pipelines. Text Prompt: The p3r5on raises a coffee mug to their lips, takes a sip, sets it down, and continues facing the camera.

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

f48

f72

Figure 13: Qualitative comparison of customization results on the Wan2.2-5B model [55].

26

f96

f120

A P REPRINT

Text Prompt: "The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera."

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

f48

f72

f96

f120

f96

f120

f96

f120

(a)

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

Text Prompt: "The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera."

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

f48

f72

(b)

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

Text Prompt: "The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera."

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

(c)

Figure 14: Qualitative comparison on CelebV-HQ Dataset.

27

f48

f72

A P REPRINT

Text Prompt: "The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera."

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

f48

f72

f96

f120

f96

f120

f96

f120

(a)

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

Text Prompt: "The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera."

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

f48

f72

(b)

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

Text Prompt: "The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera."

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

(c)

Figure 15: Qualitative comparison on HDTF Dataset.

28

f48

f72

A P REPRINT

Text Prompt: "The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera."

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

f48

f72

f96

f120

f96

f120

f96

f120

(a)

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

Text Prompt: "The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera."

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

f48

f72

(b)

Tuning-based Result

Reference-based Result

Ours IDProtector

Mist PhotoGuard Clean

Protected Video

Text Prompt: "The p3r5on is licking an ice-cream cone, smiling between licks while facing the camera."

f0

f60

f120

f0

f24

f48

f72

f96

f120

f0

f24

(c)

Figure 16: Qualitative comparison on TalkVid Dataset.

29

f48

f72

A P REPRINT

D

Limitations and Broader Impacts

Limitations. While TC-UAP provides strong protection against unauthorized identity customization in diffusion-based video generation, it primarily targets the visual VAE latent space. However, a person’s identity in video content also includes acoustic characteristics (e.g., voice and speech patterns). As a result, our current method does not prevent attackers from extracting or cloning the audio track of a protected video. Developing joint audio-visual protection that disrupts both the visual VAE and the audio tokenizer or encoder is a promising direction for future work. Broader impacts. Personal videos posted online can be collected without the subject’s authorization and used to fine-tune diffusion models or to condition image-to-video pipelines, producing customized content the subject never agreed to. TC-UAP gives individual users a practical tool to limit this: applying an imperceptible perturbation to a video before release leaves it visually unchanged for human viewers but renders it ineffective as training material for tuning-based customization or as a reference for I2V generation. The default thus shifts from “any uploaded video can be reused for identity-preserving generation” to “the uploader decides whether their identity can be replicated downstream.” Content creators, journalists, and ordinary users can then share footage on public platforms while retaining control over how their face and likeness are reused. At the policy level, opt-out clauses in current data-use regulations depend on data collectors voluntarily honoring them and are easily bypassed by automated scraping. TC-UAP complements such policies with a technical enforcement layer that does not require collector cooperation: even when a protected video is scraped, it provides no usable signal for downstream customization. This raises the cost of unauthorized identity replication and reduces the effective supply of clean training material for non-consensual deepfakes. We note two limitations of this perspective. First, protection applies only to videos released after the tool is adopted; previously released material cannot be retroactively shielded. Second, as with any defensive technique, TC-UAP may be evaded by future attackers with stronger temporal models or by collectors who obtain data from offline sources, so it should be viewed as one component of a broader set of privacy measures rather than a complete solution.

30