ML Security PapersVideoGuard: Protecting Video Content from Unauthorized Editing
Junjie Cao 1,2, Kaizhou Li 1,2, Xinchun Yu 1,2, Hongxiang Li , Xiaoping Zhang 1,2
Published on arXiv
2508.03480
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
VideoGuard's protection performance exceeds all baseline methods on video editing models including Tune-A-Video, Fate-Zero, and Video-P2P across both objective and subjective metrics.
VideoGuard
Novel technique introduced
With the rapid development of generative technology, current generative models can generate high-fidelity digital content and edit it in a controlled manner. However, there is a risk that malicious individuals might misuse these capabilities for misleading activities. Although existing research has attempted to shield photographic images from being manipulated by generative models, there remains a significant disparity in the protection offered to video content editing. To bridge the gap, we propose a protection method named VideoGuard, which can effectively protect videos from unauthorized malicious editing. This protection is achieved through the subtle introduction of nearly unnoticeable perturbations that interfere with the functioning of the intended generative diffusion models. Due to the redundancy between video frames, and inter-frame attention mechanism in video diffusion models, simply applying image-based protection methods separately to every video frame can not shield video from unauthorized editing. To tackle the above challenge, we adopt joint frame optimization, treating all video frames as an optimization entity. Furthermore, we extract video motion information and fuse it into optimization objectives. Thus, these alterations can effectively force the models to produce outputs that are implausible and inconsistent. We provide a pipeline to optimize this perturbation. Finally, we use both objective metrics and subjective metrics to demonstrate the efficacy of our method, and the results show that the protection performance of VideoGuard is superior to all the baseline methods.
Key Contributions
- Joint frame optimization treating all video frames as a unified perturbation entity, explicitly accounting for inter-frame temporal consistency and 3D attention mechanisms in video diffusion models
- Motion information extraction and fusion into the optimization objective to disrupt temporal consistency when the protected video is fed into an editing model
- Two-stage pipeline combining projection gradient descent for inversion latent optimization (Stage 1) and Particle Swarm Optimization for pixel-space perturbation search (Stage 2), reducing computational overhead
🛡️ Threat Analysis
VideoGuard creates adversarial perturbations embedded in video content to prevent unauthorized AI-based editing — directly analogous to anti-deepfake perturbations and style-transfer protections listed under ML09. The paper defends video content integrity from generative model manipulation, which is a content protection/output integrity concern.