PRIME: Protect Your Videos From Malicious Editing

## Abstract

Abstract With the development of generative models, the quality of generated content keeps increasing. Recently, open-source models have made it surprisingly easy to manipulate and edit photos and videos, with just a few simple prompts. While these cutting-edge technologies have gained popularity, they have also given rise to concerns regarding the privacy and portrait rights of individuals. Malicious users can exploit these tools for deceptive or illegal purposes. Although some previous works focus on protecting photos against generative models, we find there are still gaps between protecting videos and images in the aspects of efficiency and effectiveness. Therefore, we introduce our protection method, PRIME , to significantly reduce the time cost and improve the protection performance. Moreover, to evaluate our proposed protection method, we consider both objective metrics and human subjective metrics. Our evaluation results indicate that PRIME only costs 8.3% GPU hours of the cost of the previous state-of-the-art method and achieves better protection results on both human evaluation and objective metrics. Code can be found in https://github.com/GuanlinLee/prime .

## 1 Introduction

Recently, there has been a notable emergence of advanced generative models, including various diffusion models (Ho et al., ; Song et al., , ), which have become readily available on public platforms like Hugging Face () and Civitai ().
These models exhibit the capability to generate realistic photos when provided with specific conditions or prompts.
Beyond mere photo generation, there has been substantial research into the realm of photo editing, encompassing the addition of new elements or the alteration of styles. Notably, the latent diffusion model (LDM) (Rombach et al., ) has been instrumental in this pursuit.
Moreover, recent endeavors have turned to the domain of video editing (Khachatryan et al., ; Khandelwal, ; Qi et al., ), which can be viewed as a sequence of images arranged along the temporal dimension.
These works aim to ensure the coherence and consistency of these stacked images, employing techniques such as global attention constraints (Geyer et al., ) and latent feature constraints (Yang et al., ; Khachatryan et al., ).
Nevertheless, advanced video editing also opens the door to the potential creation of illegal or malicious videos. Therefore, it is critical to protect videos from malicious editing.

Several previous works have been proposed to safeguard images from unauthorized use or misuse
by introducing adversarial perturbation in advance.
One notable example is Photoguard (Salman et al., ), which effectively hinders the efforts of LDMs, compelling these models to generate poor editing outcomes for a given image.
Besides, some other research endeavors (Shan et al., ; Le et al., ; Rhodes et al., ; Zheng et al., ) have been directed towards protecting specific artistic styles or objects from being utilized in training generative models.
While these methods have proven effective in protecting static images, we have identified shortcomings in extending these protections to videos.
First, video editing methods can cooperate with various LDMs, which could be fine-tuned using images from diverse sources unrelated to the frames within the protected videos.
This invalidates previous protections (Le et al., ; Rhodes et al., ; Zheng et al., ) that add perturbation to the protected targets, i.e., videos, to against fine-tuning.
Second, previous methods of protecting images are time-consuming,
namely, adding perturbations to video frames would require hours for even brief video clips, making them impractical.
Third, the codec used in video coding will
assign different compression ratios to individual frames
to achieve the best trade-off between the video quality and the file size.
This dynamic compression applied to each frame will diminish the effect of perturbations applied to them, leading to failed protection.
The gaps mentioned above motivate us to explore and design new protection methods for videos.

To remedy gaps, we propose a novel protection method PRIME: PRotect vIdeos from Malicious Editing.
According to the above shortcomings, we point out our design goals, i.e., 1) zero-shot ability, 2) per-frame perturbing, and 3) anti dynamic compression.
Firstly, we shall guarantee zero-shot ability, because existing popular video editing methods directly can adopt various pre-trained models to launch the whole pipeline with arbitrary prompts. The protector has no information about the models, editing pipelines, and prompts. For this, PRIME protects videos based on the insight of the transferability (Papernot et al., ) of adversarial perturbation across various models and editing methods. To improve the transferability among different LDMs, we consider the latent features during the diffusion process and the final outputs.
Then, per-frame perturbing implies that every frame in the given video should be perturbed to ensure that the constraints, such as global attention, used in the video editing pipeline will not rectify the wrong features of the perturbed frames with the clean frames. Besides, per-frame perturbing will cost a lot of time and GPU resources. Therefore, we further propose two mechanisms, i.e., fast convergence searching and early stage stopping, to reduce consumption.
Finally, anti dynamic compression requires us to guarantee that the perturbation is robust to dynamic compression imposed by the video codec, making the generated protected videos inherit the properties of single frames. Usually, the compression algorithm is complex and lossy, making it impossible to maintain lossless perturbation after compression. Following an in-depth examination of existing video codec methods, we propose a straightforward yet highly effective approach to discretize perturbation within the pixel space, which can improve the robustness of perturbation during compression.

In the area of video editing, we observe that previous studies (Geyer et al., ; Yang et al., ; Wu et al., ) usually collect video clips sourced from the Internet to assess the effectiveness of their methods.
Similarly, we collect video clips to help us evaluate the performance of both video editing and protection techniques. To create malicious content, we propose two types of malicious editing tasks, i.e., the malicious NSFW (Not Safe For Work) editing task and the malicious swapping editing task.
Due to the lack of ground-truth references, it is difficult to make a comprehensive and reasonable evaluation of the edited video. To address this, we consider the evaluation methods used in previous works (Geyer et al., ; Yang et al., ; Wu et al., ), wherein we engage volunteers to participate in surveys gauging the quality and preferences of the video.
Based on the human evaluation, we prove that existing video editing pipelines can produce high-quality videos for these two tasks, and obtain 2.99 out of 5 and 3.17 out of 5 for the video quality scores, respectively. On the other hand, the results prove that PRIME can significantly reduce the generated videos’ quality (1.54 out of 5 and 2.44 out of 5 for two tasks, respectively).
Overall, our contributions can be summarized as follows:

- •
We propose a new black-box video protection method, PRIME, against malicious video editing. We improve the transferability of our protection by simultaneously considering both latent codings and generated images.
- •
PRIME is time-saving with our proposed fast convergence searching and early stage stopping mechanisms. PRIME only costs about 8.3% GPU hours of the cost of Photoguard on the same hardware platform under the same protection budgets.
- •
PRIME can combat dynamic compression from the lossy video codec with our proposed anti compression method. PRIME increases about 8% of the bitrate for protected videos, compared with protected videos from Photoguard.
- •
Our results prove that PRIME has better protection performance and transferability than Photoguard. Only 18% and 9% of people think that the edited videos have better quality under the protection of PRIME than under the protection of Photoguard for two editing tasks, respectively.

## 2 Related Works

### 2.1 Video Editing with LDMs

A growing number of work (Parmar et al., ; Wu & Torre, ; Lin et al., ) focuses on turning a latent diffusion model (LDM) (Rombach et al., ) into a zero-shot image editor, and great progress is made. Such progress inspires the video editing area. Video editing is a subtask in the video generation area (Blattmann et al., ; Chen et al., ; Ge et al., ). Different from the general video generation task, which usually only requires a conditional prompt to guide the generation process, video editing requires a source video and a guidance prompt as conditions. When editing a given video, it can be seen as a series of images stacked along the time dimension. However, making the frames of the edited video consistent is still an open problem. Directly editing each frame of the given video will probably lead to different backgrounds or different poses for the foreground objects, due to the lack of pixel-level constrain. The recently proposed video editing frameworks are based on various pre-trained LDMs (Rombach et al., ). To keep the consistency between frames, cross-frame global attention (Geyer et al., ; Yang et al., ; Wu et al., ) is widely used in these editing frameworks. On the other hand, some frameworks (Yang et al., ; Khachatryan et al., ) adopt other conditions, such as depth, pose, and edge, to better enhance consistency. Considering that more and more advanced methods are proposed to generate high-quality videos, we believe there exists a potential risk that users can adopt these editing frameworks to modify videos for malicious purposes, making the edited ones illegal, misleading, or harmful. Therefore, we conduct the first research work in this area.

### 2.2 Image Protection Against LDMs-based Misuse

Latent diffusion models (LDMs) can edit images based on conditional prompts, which can potentially be exploited to generate malicious content. To counter this threat, Photoguard (Salman et al., ) has been introduced as a protective measure for images, aiming to hinder the efforts of LDMs. This method incorporates adversarial perturbations into images, effectively perplexing LDMs and preventing unauthorized editing.
Furthermore, LDMs can quickly learn specific objects or artistic styles by personalized techniques like DreamBooth (Ruiz et al., ).
To protect intellectual property or portrait rights, some works (Shan et al., ; Le et al., ; Rhodes et al., ; Zheng et al., ) add perturbation into images before releasing them on the Internet. With such perturbed images, the fine-tuned LDMs are only capable of producing low-quality results.

In a nutshell, Photoguard focuses on protecting images from malicious editing in the inference stage of LDMs, while other techniques aim to impede the fine-tuning of LDMs. Considering that most video editing frameworks operate leveraging pre-trained models, we think that Photoguard stands as a baseline method for protecting videos similarly.

## 3 Preliminary

In this section, we aim to briefly introduce the LDMs and give an example to show how to edit photos with LDMs. Firstly, LDMs contain an image encoder $\mathcal{E}$, a U-Net $\mathcal{U}$, and an image decoder $\mathcal{D}$. The image encoder can project a given image $x$ to its latent code $f_{\mathcal{E}}=\mathcal{E}(x)$. The image decoder can project a latent code to an image $x=\mathcal{D}(\mathcal{E}(x))$. The U-Net $\mathcal{U}$ accepts the latent codes $f_{\mathcal{E}}$ and is related to a diffusion process, which contains a noise-adding forward process and a denoising sampling process. For the forward process, given a time series $t=[1,\dots,T]$, we have the following relation between clean $f_{\mathcal{E},0}$ and noisy $f^{d}_{\mathcal{E},t}$:

$q(f^{d}_{\mathcal{E},t}|f_{\mathcal{E},0})=\mathcal{N}(f^{d}_{\mathcal{E},t};\sqrt{\bar{a}_{t}}f_{\mathcal{E},0},(1-\bar{a}_{t})\mathbf{I}),t=[1,\dots,T]$,

where $\mathcal{N}$ stands for a Gaussian distribution, $\bar{a}_{t}$ is a hyperparameter related to the diffusion process, $f_{\mathcal{E},0}=\mathcal{E}(x)$ is the clean latent, and $f^{d}_{\mathcal{E},t}$ is the noisy latent at time step $t$. For the sampling process, $f^{s}_{\mathcal{E},t-1}$ can be predicted with $\mathcal{U}(f^{s}_{\mathcal{E},t},t,c_{p})$ under DDIM sampling (Song et al., ), where $c_{p}$ is a given condition based on a prompt and $f^{s}_{\mathcal{E},T}=f^{d}_{\mathcal{E},T}$ which is the boundary condition.
For example, if we want to swap the face of a photo $x$ of Joe Biden with Donald Trump, we can first obtain the latent code $f_{\mathcal{E},0}=\mathcal{E}(x)$. Then we add noise to $f_{\mathcal{E},0}$ and obtain $f^{d}_{\mathcal{E},T_{1}}$, where $T_{1}\leq T$. With the prompt $c_{p}$ of “a photo of Donald Trump”, we sample $f^{s}_{\mathcal{E},t-1}$ based on $\mathcal{U}(f^{s}_{\mathcal{E},t},t,c_{p})$ and $f^{s}_{\mathcal{E},T_{1}}=f^{d}_{\mathcal{E},T_{1}}$ step by step and get $f^{s}_{\mathcal{E},0}$, which is the clean latent for prompt $c_{p}$. Finally, we use $\mathcal{D}$ to convert $f^{s}_{\mathcal{E},0}$ to a photo $f_{\mathcal{D}}$, in which the edited face belongs to Donald Trump when $T_{1}$ is set properly.

## 4 Protect Videos from Malicious Editing

In this section, we first clarify our motivation and the threat model. Then, we introduce the proposed PRIME in detail.

### 4.1 Motivation

An increasing number of users are sharing their video content on the Internet through popular social applications such as TikTok and Instagram.
However, this widespread sharing presents a substantial risk to the public’s rights, as some users may exploit the capabilities of powerful LDMs for malicious purposes.
These malicious actions could include altering video content to make individuals appear unclothed or inserting weapons into the video, among other harmful editing.
Therefore, it is vital to explore how to protect videos from malicious editing effectively and efficiently.

### 4.2 Threat Model

Attacker’s Ability and Goal.
The malicious user can directly download a pre-trained model from the public platform and then conduct malicious video editing. In this paper, we study two types of malicious video editing. The first type, called malicious NSFW editing, incorporates “not safe for work (NSFW)” elements into a given video, such as blood, drugs, and explicit nudity.
The second type, termed malicious swap editing, centers around identity substitution within the given video, where one individual’s identity is replaced with that of another. For example, replacing Joe Biden with Donald Trump in a video of the oath of office of the president.

Protector’s Ability and Goal.
For the video protector, we assume a challenging black-box scenario, wherein the protector has no information about the editing models, the editing methods, and the attack types that will be used by the malicious user.
The video protector only has access to public pre-trained LDMs, which may not be the one that the malicious user uses, and adds perturbation to each frame before uploading the video to the Internet. The goal of the protector is to ensure that protected videos effectively thwart the efforts of malicious users, causing their results low-quality or preventing them from injecting NSFW content (such as scenes depicting violence or nudity) or engaging in identity swapping.

### 4.3 PRIME

As mentioned above, when
applying conventional image protection methods to safeguard videos, there are two weaknesses:
the excessive time required and the vulnerability to the compression mechanisms utilized by video codecs.
To address it, we propose PRIME, having zero-shot ability, to improve the previous methods from two parts, i.e., per-frame perturbing and anti dynamic compression. We will first give a detailed introduction about each of them. Then, we will show how PRIME combines them.

Zero-shot Ability. With a pre-trained LDM $\mathcal{F}$, consisting of several parts such as an encoder $\mathcal{E}$, a decoder $\mathcal{D}$, a U-Net $\mathcal{U}$, the protector aims to generate adversarial perturbation for a given frame to cause $\mathcal{F}$ giving low-quality results. As the protector has no information about the models and video editing pipelines used by the malicious users, the generated perturbation should be generalizable for other LDMs. Furthermore, considering that the malicious users will adopt various prompts to edit the videos, the perturbation should be able to invalidate as many prompts as possible.

To address such a challenge, we follow the previous method, Photoguard (Salman et al., ), to perform a diffusion attack, which means that PRIME considers not only $\mathcal{E}$, but also $\mathcal{U}$ and $\mathcal{D}$, i.e., the target is to find such a perturbation of the current frame, causing latent features disrupted and $\mathcal{D}(f^{s}_{\mathcal{E},0})$ close to a predefined target image.
Because the protector has no information about the specific editing pipeline employed by malicious users, we do not consider intricate technologies used in video editing methods, such as cross-frame attention and latent constraints, to make the protection more general. Similar to Photoguard, PRIME depends on the transferability of the perturbation and can be further cooperated with methods (Kurakin et al., ; Athalye et al., ; Song et al., ) to further improve the robustness of the perturbation.

Per-frame Perturbing. We find that in existing video editing pipelines (Geyer et al., ; Yang et al., ; Khachatryan et al., ; Wu et al., ), global attention constraints can rectify artifacts and
address imperfections in the structure level of videos. This correction is achieved by referencing information from other frames within the video.
Therefore, if not all frames are protected, the generated video will still be maintained at a desirable level.
Such observation requires the protector to add perturbation to every frame. However, unlike images, protecting videos containing many frames will take an extremely long time. To reduce time consumption, we introduce two mechanisms, i.e., fast convergence searching and early stage stopping.

In previous work, the perturbation $\delta$ is oriented to a fixed target image $\hat{x}$, which means the protector aims to make $\mathcal{F}$ generate a result closing to $\hat{x}$ for the protected image $x$, i.e., the optimization can be described as:

$\min_{\delta}d(\hat{x},\mathcal{F}(x+\delta)),$

where $d(\cdot,\cdot)$ gives the distance between inputs and $\mathcal{F}(\cdot)$ represents a complete diffusion process to generate images with $\mathcal{F}$. However, we observe that the convergence speed for a different clean image $x$ will be different when generating the perturbation. It will take more optimization steps to obtain perturbation for $x$ having a slow convergence speed. Therefore, we propose the fast convergence searching to find a better target image for each frame. Specifically, given a video $V$, which is constructed using a sequence of frames $V=[x_{1},x_{2},\dots,x_{n}]$, we maintain a queue of potential target images $Q=\{\hat{x}_{1},\hat{x}_{2},\dots,\hat{x}_{N}\}$(^1^11We use the validation set of ImageNet (Deng et al., ) in our experiments as $Q$.). For each $x_{i}$, we select a target image from $Q$ to have the lowest similarity score $s_{j}$ based on the equation:

$$ $s_{j}=\left\{\begin{aligned} &\mathrm{SIM}_{\mathcal{E}_{img}}(x_{i},\hat{x}_{j}),\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ i=1\\ &\mathrm{SIM}_{\mathcal{E}_{img}}(x_{i},\hat{x}_{j})+\mathrm{SIM}_{\mathcal{E}_{img}}(\hat{x}_{j_{i-1}},\hat{x}_{j}),\ i>1\end{aligned}\right.,$ (1) $$

and

$$ $\displaystyle\mathrm{SIM}_{\mathcal{E}}($ $\displaystyle x_{1},x_{2})=\frac{\mathcal{E}(x_{1})\otimes\mathcal{E}(x_{2})}{|\mathcal{E}(x_{1})|\cdot|\mathcal{E}(x_{2})|}$ $\displaystyle j_{i}$ $\displaystyle=\mathrm{argmin}_{j}s_{j},\hat{x}_{j}\in Q,$ (2) $$

where $\mathcal{E}_{\mathrm{img}}$ is the image encoder from the CLIP (Radford et al., ), $|\cdot|$ stands for the norm of the vector, $\otimes$ is the matrix multiplication, and $j_{i}$ is an index for images in $Q$. When $i=1$, $s_{j}$ only depends on the first term. Specifically, the second term is to ensure the perturbed continuous frames have different features, to better break the global attention constraints and increase flickers in the edited video. $\hat{x}_{j_{i-1}}$ is the target image for frame $x_{i-1}$. After selection, we obtain $\hat{x}_{j_{i}}$ for $x_{i}$. Because the target image and the corresponding frame are very different in the latent space, the convergence speed of the optimization process will be faster at the start.

Based on another observation that for a given perturbation budget $\epsilon$ under the $l_{p}$-norm, increasing the number of optimization iterations will only bring marginal improvement if the perturbation $\delta$ converges in several steps. It inspires us to introduce the early stage stopping to further decrease the total time consumption. Specifically, we monitor the similarity $c_{k}^{i}$ between the latent generated by $\mathcal{E}$ for the current frame $x_{i}$ and all previous perturbed frames, i.e.,

$$ $\displaystyle c_{k}^{i}=\max_{j}\mathrm{SIM}_{\mathcal{E}}(x_{i}+\delta_{k},x^{\prime}_{j}),$ (3) $$

where $\delta_{k}$ is the perturbation $\delta$ in the $k$-th optimization step, and $x^{\prime}_{j}$ is the perturbed frame of $x_{j}$. When $c_{k}^{i}$ does not decrease, we will stop the optimization process and use the perturbation $\delta_{k}$ for $x_{i}$. Combining fast convergence searching and early stage stopping, we significantly reduce more than 90% of the time cost, while keeping the performance of the protection.

Anti Dynamic Compression. Unlike saving images, saving videos requires a codec, which applies compression algorithms to balance the file size and the video quality.
When it comes to videos on the Internet, it’s often more suitable to utilize variable bitrate as opposed to constant bitrate. This is due to the fluctuation in available bandwidth and the diverse nature of video content, which demands a dynamic compression ratio applied to each frame to ensure optimal video streaming.
Therefore, it is essential to preserve the perturbation information $\delta$ throughout the dynamic compression process to guarantee the effectiveness of the protection.
For this, we introduce a simple solution to achieve anti-dynamic compression. Specifically, we transform the perturbation from the model input space $[-1,1]$, which is common in previous methods, to the pixel space $[-255,255]$, and further quantize the values of the perturbation to ensure they have shorter bits. Such operations are the approximated simulation of the compression from the codec. By adding such a simulation into the protecting process, we can make the perturbation more robust and less sensitive against compression. Through the experiments, we find that our method
does not introduce any significant time overhead while
increasing the video bitrate by about 8%, which means the video contains more information.

Figure: Algorithm 1 PRIME Algorithm

The Proposed PRIME.
As shown in Algorithm [1](#alg1), we first obtain the most suitable target image for the current frame $x_{i}$, based on our fast convergence search method. After obtaining the target image $\hat{x}_{j_{i}}$, we consider calculating the features $\hat{F}$ for it. In Photoguard (Salman et al., ), only the final outputs from $\mathcal{D}$ are considered as the features. However, we find that during the diffusion forward process and the sampling process, the intermediate results are equally important because we do not have information about the number of diffusion steps $T$ used by the attacker. Disrupting intermediate results can improve the transferability of the perturbation during the diffusion process. On the other hand, calculating the gradient on the intermediate results will not bring additional computing costs, which makes it practical during the protection. To make $\mathcal{U}$ have contributions in the forward process, we adopt the DDIM inversion method (Geyer et al., ) to predict the noise with $\mathcal{U}$ to replace the original forward process. Therefore, in PRIME, we consider four sources of the features, i.e., features $f_{\mathcal{E},0}$ from $\mathcal{E}$, features $f^{d}_{\mathcal{E},t}$ from the DDIM inversion at time step $t$, features $f^{s}_{\mathcal{E},t}$ from the sampling process at time step $t$, and outputs $f_{\mathcal{D}}$ from $\mathcal{D}$. Especially, in the diffusion process, the prompt condition $c_{p}$ is empty, as we have no information about the editing prompt used by the attackers. Therefore, $\hat{F}$ can be written as

$$ $\displaystyle\hat{F}=\{\hat{f}_{\mathcal{E},0},\hat{f}^{d}_{\mathcal{E},1},\dots,\hat{f}^{d}_{\mathcal{E},T},\hat{f}^{s}_{\mathcal{E},T},\dots,\hat{f}^{s}_{\mathcal{E},1},\hat{f}_{\mathcal{D}}\},$ $$

which is calculated on the target image $\hat{x}$. Specifically, when we use $T$ steps in the forward process and the sampling process, there will be $T$ features for $f^{d}_{\mathcal{E},t}$ and $f^{s}_{\mathcal{E},t}$, respectively. We consider all of them when computing the loss functions.

During the optimization process, we adopt the anti dynamic compression method to add the perturbation $\delta_{k}$ to the clean frame $x_{i}$, which is represented by $\prod_{\epsilon}(x_{i}+\delta_{k})$ under the budget $\epsilon$. Similarly, we compute the features $F$ for the perturbed input $\prod_{\epsilon}(x_{i}+\delta_{k})$. Then we compute the loss:

$$ $\displaystyle L$ $\displaystyle=|f_{\mathcal{E},0}-\hat{f}_{\mathcal{E},0}|_{1}+|f_{\mathcal{D}}-\hat{f}_{\mathcal{D}}|_{1}$ (4) $\displaystyle+\sum_{t=1}^{T}(|f^{d}_{\mathcal{E},t}-\hat{f}^{d}_{\mathcal{E},t}|_{1}+|f^{s}_{\mathcal{E},t}-\hat{f}^{s}_{\mathcal{E},t}|_{1}),$ $$

where $|\cdot|_{1}$ is the $L_{1}$-norm. To update the perturbation $\delta_{k}$, we minimize $L$, i.e., $\min_{\delta}L$, which gives results closer to the target image $\hat{x}_{j_{i}}$. After updating $\delta$, we examine the convergence of the optimization process, by computing $c^{i}_{k}$ (Eq.[3](#S4.E3)). If the optimization process is converged at step $k$, we will use $\prod_{\epsilon}(x_{i}+\delta_{k})$ as $x_{i}^{\prime}$ and start to optimize the next frame. Otherwise, we will continue to optimize the current frame till convergence or reaching the attack budget.

Overall, PRIME combines our new proposed mechanisms to accelerate the optimization process and restore more information for the compressed videos. Furthermore, these mechanisms are general and not tailor-made for PRIME, which means future works can directly adopt them to enhance their own performance.

## 5 Experiments

Table: Table 1: Details of VIOLENT. It contains 10 famous people and 35 video clips in total.

### 5.1 Data Collection

We notice that no public standard benchmark and dataset have been previously proposed for malicious purposes in the video editing task. To evaluate our protection method and compare it with baselines, we build a dataset, VIdeos fOr maLicious Editing aNd proTection, VIOLENT.

To simplify the data collection process and facilitate subsequent evaluation stages, we choose to collect videos of famous people, such as actors and politicians, from various sources on the Internet.
Initially, we conduct a manual assessment to identify celebrities and politicians who can be perfectly and realistically generated by the existing LDMs.
To ensure diversity in terms of gender, age, and race, we carefully select individuals.
After determining the list of celebrities and politicians, we proceed to acquire their videos from the Internet.
Most of these videos are sourced from official channels, while the remaining content is gathered from public channels.
Due to copyright issues, we are unable to make this collected dataset publicly available.

Upon obtaining the videos, we manually edit and cut them into scene-consistent video clips, each comprising tens to hundreds of frames.
We carefully filter out clips that contain transitions, illumination changes, or main object changes.
Subsequently, we create specific configurations for malicious editing for each clip. For each configuration, we tune the malicious prompts and adjust other hyperparameters used in the video editing pipelines for different LDMs. This entire process requires hundreds of GPU hours of effort.

We summarize the details of VIOLENT, in Table [1](#S5.T1). There are 10 identities in VIOLENT with 6 males and 4 females. They can be grouped into politicians (i.e., Donald Trump and Joe Biden), singers (i.e., Drake, Katy Perry, Rihanna, and Taylor Swift), actors (i.e., Robert Downey Jr., Ryan Gosling, and Scarlett Johansson), and athletes (i.e., Messi). Specifically, all original videos we collect are in resolution $1280\times 720$, which is the most popular format on the Internet.

To create prompts for malicious editing tasks, we follow a very simple and direct template: “[Someone] [Do Something] [Somewhere]”. We first create a description for each original video based on this template. For the malicious NSFW editing task, we keep the “[Someone]” part and change the “[Do Something]” and “[Somewhere]”. For example, if we want to generate a video in which the person is naked, we will replace “[Do Something]” with “is naked” or “is nude”. If we want to generate a bloody video, we will replace “[Somewhere]” with “in a bloody scene”. For the malicious swapping editing task, we only replace “[Someone]” with a new name. For example, if we want to generate a video of Donald Trump based on a video of Joe Biden, we will replace “Joe Biden” with “Donald Trump”. Furthermore, we adopt the prompt weighting method, Compel(^2^22https://github.com/damian0815/compel), to manually adjust different weights for “[Someone]”, “[Do Something]”, and “[Somewhere]” to obtain the best editing results. In total, we have designed 280 attacking configurations,
which will be used for evaluating the generated videos in subsequent experiments.

### 5.2 Experiment Settings

Editing Models. In our experiments, we consider public LDMs for high-quality and realistic video generation and editing. After evaluating accessible models on the Hugging Face, we manually select four different models, i.e., Stable Diffusion v1-5 (SD1.5)(^3^33https://huggingface.co/runwayml/stable-diffusion-v1-5), Dreamlike Photoreal 2.0 (DP)(^4^44https://huggingface.co/dreamlike-art/dreamlike-photoreal-2.0), HassanBlend1.4 (HB)(^5^55https://huggingface.co/hassanblend/hassanblend1.4), and RealisticVisionV3.0 (RV)(^6^66https://huggingface.co/SG161222/Realistic_Vision_V3.0_VAE). These four representative models have different advantages in generating realistic photos, under different conditions, such as various illumination and human poses. And our method can be generalized to other models as well.

Editing Pipelines. As we propose two types of malicious editing, we choose the most recent and representative open-source editing methods for them, respectively. Specifically, we experimentally find that TokenFlow (Geyer et al., ) is suitable for the malicious NSFW editing task, and Rerender A Video (Yang et al., ) is suitable for the malicious swap editing task. And our method can be generalized to other pipelines.

Protection Settings. In our threat model, the protectors have no information about the editing models and pipelines used by the malicious users. Therefore, we consider that the protectors generate perturbation based on a public model, and the performance of the perturbation is based on transferability. We adopt two public models, i.e., Stable Diffusion v1-5 (SD1.5) and Stable Diffusion v2-1 (SD2.1)(^7^77https://huggingface.co/stabilityai/stable-diffusion-2-1-base).

For the optimization details, we set the maximum number of optimization steps $K$ as 100, and the maximum perturbation size $\epsilon$ as 8 under $l_{\infty}$-norm for PRIME and Photoguard (Salman et al., ). On the other hand, we notice that Photoguard uses 4 steps in the diffusion sampling process. Therefore, to maintain the same computing budget, we use $T=2$ steps in the DDIM inversion and $T=2$ steps in the sampling process.

To form the queue of target images, we use the validation set of ImageNet (Deng et al., ) for PRIME. For Photoguard, we use its officially provided target image. The perturbed videos are saved using libx264 codec with variable bitrate and best quality preference. We resize the resolution of videos into $672\times 384$. For each video, we only use the first 40 frames to edit.

### 5.3 Metrics

Subjective Metrics. We consider six dimensions of human perception, i.e., Content Consistency, Prompt Matching, Naturalness, Frame Stability, Video Quality, and Personal Preference, which are aligned with a recent benchmark, VBench (Huang et al., ). Specifically, Content Consistency describes the extent to which the edited video maintains the same details as the original video, such as layout, style, movements, and expressions. Prompt Matching describes how well the edited video matches the theme of the given prompt, e.g., sex and blood. Naturalness describes how plausible the edited video looks. Frame Stability measures the temporal consistency of the edited video. Video Quality describes the overall quality of the edited video. All these metrics are normalized into the interval $[1,5]$. Higher scores mean better performance. For Personal Preference, we give interviewees several videos and ask them to pick the one they prefer.

Objective Metrics. For objective metrics, we consider peak signal-to-noise ratio (PSNR), structural similarity (SSIM), and VCLIPSim. Specifically, PSNR compares the noise ratio in the edited videos w/ and w/o protection. SSIM compares the perceived quality for the edited videos w/ and w/o protection. When computing PSNR and SSIM, we use the original unprotected videos to generate edited videos as references. VCLIPSim is supported by ViCLIP (Wang et al., ), which reflects the similarity between the video and the given prompt.

Table: Table 2: PSNR and SSIM under different protection methods. Bold for the best results and \ulunderline for the second-best results.

Table: Table 3: VCLIPSim under different protection methods. Bold for the best results and \ulunderline for the second-best results.

Figure: (a) Evaluation results for malicious NSFW editing.
Refer to caption: /html/2402.01239/assets/x1.png

Table: Table 4: Human preference study. A lower probability is better for the protection method. Bold for the best results. We provided respondents with three video clips protected by different methods and asked them to choose the clip that looks best. Photoguard* stands for the Encoder attack.

### 5.4 Protection Evaluation

Time Consumption and Bitrate Comparison.
We compare the time consumption and bitrate to intuitively validate the effectiveness of our proposed mechanisms in terms of time-saving and resistance to dynamic compression.
We record the time cost on one NVIDIA RTX A6000.
Notably, both Photoguard and PRIME have a maximum batch size limit of 1 due to GPU memory constraints.
For the average time consumption for protecting a video containing 40 frames, Photoguard will cost 20,500 seconds. PRIME will only cost 1,700 seconds, which is only 8.3% of the cost of Photoguard. For the GPU memory occupation, Photoguard takes about 17GB and PRIME takes about 20GB. The additional occupation is because of the CLIP model used in searching the target images. Overall, both methods can run on consumer-grade GPUs, such as the RTX 4090.
Furthermore, the saved protected videos from Photoguard have an average bitrate of 45021 kbps. These from PRIME have an average bitrate of 45776 kbps, which is 8% higher than those from Photoguard.
Overall, the results prove that our proposed methods collaborating with PRIME can significantly reduce the time consumption and improve the bitrate, keeping more information in the saved videos.

Based on Objective Metrics.
We adopt the generated videos based on videos without protection as references, and compute PSNR and SSIM for the generated videos based on videos with protection. In Table [2](#S5.T2), we show the protection results on different source models, i.e., SD1.5 and SD2.1, to compare the transferability of different protection methods. The results indicate that even though PRIME costs less time, it achieves better protection results on the pixel level. Furthermore, PRIME shows better transferability when we compare the results on different editing tasks and source models.

We compare the prompt consistency for edited videos in Table [3](#S5.T3). The results indicate that PRIME has better performance in breaking the connections between edited frames and the prompt and has better transferability between models and pipelines. We notice that although the ViCLIP is trained on a large video dataset, it may not be very suitable for evaluating malicious videos. The main reason is that the ViCLIP training set is filtered and contains only a small part of NSFW content and famous people. It will be more reasonable to adopt a fine-tuned ViCLIP for future work. But it is out of our paper’s scope. We appeal that we should use human evaluation as the primary evaluation reference.

Based on Subjective Metrics. We evaluate the edited videos based on subjective metrics because the generated videos mainly aim to mislead humans and cause negative impacts. To obtain the subjective metrics, we invited interviewees to complete questionnaires. We strictly protect the privacy of all interviewees, without collecting any of their personal information. Considering the cost of evaluating with human interviewees, we provide the quality results for PRIME and provide human preference results for Photoguard and PRIME. After collecting 140 results for each, we present the evaluation results in Figure [1](#S5.F1) and Table [4](#S5.T4).

Based on the quality results in Figure [1](#S5.F1), we have two conclusions: ❶ Existing video editing pipelines can successfully execute the malicious editing tasks and achieve high Prompt Matching scores (3.54 out of 5 and 3.85 out of 5) and high Video Quality scores (2.99 out of 5 and 3.17 out of 5); ❷ PRIME can effectively protect videos by decreasing Prompt Matching scores (1.73 out of 5 and 3.19 out of 5) and Video Quality scores (1.54 out of 5 and 2.44 out of 5).

With PRIME, human faces are disrupted, and edited frames are less affected by the given prompts. Therefore, Prompt Matching scores decrease in both tasks. On the other hand, the stability of the frame and the consistency of the video decrease. There are many flickers between frames, making the video less natural. We can obtain the aforementioned conclusion based on Content Consistency scores (from 3.38 to 2.05 and from 3.59 to 2.94), Frame Stability scores (from 3.06 to 1.68 and from 3.04 to 2.24), and Naturalness scores (from 2.95 to 1.56 and from 3.09 to 2.36).

On the other hand, for our proposed two types of malicious editing, we find that changing the identities of the original videos is easier than adding blood or naked bodies to the original videos, and protecting videos from NSFW editing is easier and more effective. The reasons are mainly from two aspects. First, the swap task is easier because it keeps the layout and other elements unchanged in the videos. The NSFW editing task requires changing the layout and pixel-level details, which is closely related to the capability of LDMs to understand the prompt correctly. Second, for the swap task, we adopt additional constraints in the pipeline, such as the optical flow model (Xu et al., ) and the canny edge model (Zhang et al., ), which enhance the stability and robustness of the edited videos. For NSFW editing, we only use global attention and cross-frame attention to keep the frame consistency because we find that the additional constraints mainly influence the layout and pixel-level details, which conflict with the target of the NSFW editing and makes the video editing pipeline give unchanged results for NSFW prompts.

Besides these subjective metrics, we ask the respondents to select videos with better quality among three edited videos, which are generated from videos protected by Photoguard*, Photoguard, and PRIME. The results in Table [4](#S5.T4) prove that PRIME will better decrease the quality of the generated videos. More than 80% of the interviewees think that the generated videos from videos protected by Photoguard have better quality. Therefore, PRIME is more effective in protecting videos from malicious editing.

Overall, PRIME achieves better protection performance than Photoguard and reduces the overall time cost. The visualization results can only be obtained by contacting us, due to the legal considerations.

## 6 Conclusion

In this paper, we study malicious editing tasks in the video area. Through the comprehensive exploration, we find it is a huge threat to the public, as malicious people can easily use video editing pipelines to conduct two types of malicious editing tasks. To better protect the videos from malicious editing, we propose a new method, PRIME, which can significantly reduce the time cost for video protection and improve the bitrate for the protected videos. Based on our evaluation, we prove the advantages of PRIME in protecting videos from editing. We believe that our work will promote future work in protecting videos and portrait rights.

## Social Impacts, Ethical and Legal Concerns

It has been a very long story to protect portrait rights and other intellectual property since the generative models became popular on the Internet. For example, a very recent case is the AI-generated Taylor Swift photos circulating on social networks, which raises the attention of many popular presses, such as BBC, and even the White House. Not just for famous people, advanced generative models can affect normal people’s photos as well, due to editing technologies and personalization technologies. Such powerful generative models can be used for illegal use. Therefore, adding watermarks into the generative models to detect AI-generated content, adding perturbation to images to immunize editing, and detecting illegal content before returning the results to users are three main solutions in addressing the ethical and legal concerns of using generative AIs.

Similar to generating images or editing images, generating videos and editing videos become possible with advanced generative AI models. Although it is still at the beginning phase, we find that the rising video editing pipelines equipped with advanced latent diffusion models are able to do some operations, such as swapping faces, adding naked bodies, and replacing backgrounds. This finding motivates us to study the risks for the public under the threat of such video editing operations.

First, at the forefront of these concerns is collecting other people’s selfie videos is easy. Sharing selfie videos to social applications, such as TikTok and Instagram, is very popular among Gen Z (people who are born between the mid-to-late 1990s and the early 2010s). People’s desire to share becomes an exact threat to themselves. Because others can easily download their videos from social applications and edit them. Based on this point, social applications should protect their users’ shared images and videos.

The second concern is from an ethical standpoint for these AI-generated videos and AI-edited videos, which pose a significant threat to the veracity of information and encourage the dissemination of misinformation, defamation, and deleterious content. These influences jeopardize the integrity of information dissemination, eroding the public’s trust in online platforms, such as the media and social applications, as reliable sources of information. Furthermore, malicious editing may contravene privacy statutes, transgress intellectual property safeguards, and incur charges of defamation. This complex legal terrain demands a nuanced examination of liability, accountability, and the potential gaps in existing legal frameworks that may be exploited by malicious actors. Especially, the existing legal system has not provided enough evidence and support for the judges to determine a potential crime.

The third concern is that platforms that host user-generated content can promote and encourage users to create these AI-generated videos and AI-edited videos. These platforms should provide users rights to generate and edit videos and supervise users’ activities to avoid providing potentially illegal or harmful videos. We find that some existing platforms, such as Gen-1 ([https://research.runwayml.com/gen1](https://research.runwayml.com/gen1)), provide a detection model to detect whether the generated video contains illegal or harmful content. However, other platforms, such as Pika ([https://pika.art/](https://pika.art/))(^8^88We tested the Beta test version.), do not detect the outputs, making it possible to generate videos containing naked bodies and blood.

In addition, the issues caused by the illegal and harmful videos generated by AI encompass broader societal implications due to the Internet. For example, the unchecked proliferation of illegal and harmful videos can sow discord, amplify existing divisions, and potentially incite harm between people. It is possible to create AI-generated videos, such as an imitation of the Murder of George Floyd, causing arguments on the Internet between different races.

Due to the flaws and imperfections in the current legal system and social framework, we call on users to protect their videos and legitimate rights and interests. We propose a protection method to help users who are willing to share their selfie videos on social media to protect these videos. With our protection, it will be easier for humans to recognize AI-edited videos. In this way, we hope that our approach can provide an interim solution until a full legal and regulatory system is proposed.

## Appendix A Hyperparameters

We introduce the hyperparameters used in the two video editing pipelines, i.e., Tokenflow and Rerender A Video, as well as the prompt weights. For Tokenflow, the number of DDIM inversion steps is 500, which is its default setting. The guidance scale is 7.5. Other parameters related to the injections are their default values without changing. For Rerender A Video, the interval is set to 1, due to the limited number of frames. The strength of the first frame is 0.8 and the strength of the ControlNet is 0.7. We manually search for these two parameters, which is better than other combinations. The ControlNet we use is the Canny Edge, which we find is better than HED Boundary and Depth. We also set the loose attention, considering the motions in the videos, to obtain a better result. Other hyperparameters are default. We use an additional prompt “RAW photo, subject, (high detailed skin:1.2), 8k uhd, dslr, soft lighting, high quality, film grain, Fujifilm XT3” as a supplement for the prompt.

For both pipelines, the negative prompt is set as “deformed iris, deformed pupils, semi-realistic, cgi, 3d, render, sketch, cartoon, drawing, anime, mutated hands and fingers, deformed, distorted, disfigured, poorly drawn, bad anatomy, wrong anatomy, extra limb, missing limb, floating limbs, disconnected limbs, mutation, mutated, ugly, disgusting, amputation”. For Tokenflow, the prompt weights are in the interval of $[1.0,1.61]$. For Rerender A Video, the prompt weights are in the interval of $[1.0,1.4]$.

## Appendix B Visualization Results

Sorry for the inconvenience that we cannot provide visualization results with a public link, due to the reasonable concern that the edited content could be leaked to the Internet and cause unnecessary harm to these innocent people. Therefore, the visualization results can only be obtained by contacting us, due to the legal considerations. To further promise that the edited content does not cause further negative impacts, we add visible watermarks and limit the visualization similarity of the faces.

## Appendix C Accessible Resources for VIOLENT

Although it could be illegal to release the whole dataset, we consider only providing the configuration files used in our experiments. These configurations can be obtained by contacting us. For each model we use in the experiments, we tune the prompts to achieve better editing results. Even though we cannot provide the source videos to the public, protecting these people’s rights, these configurations could be useful for future studies. We believe that the readers can obtain enough information about the source videos from these configurations because we describe each video clip we use. On the other hand, for other researchers, who are going to study in this area, we are willing to guide how to construct the dataset after signing a commitment. Note that in whatever case, we will not leak the source video clips and re-distribute them.

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 3
presentation: 3
questions: See in Weakness
soundness: 3
strengths: 1. The issue of protecting videos from malicious editing is of high significance. The paper highlights the limitations of applying image protection methods to videos and underscores the need for dedicated video protection strategies.
2. The experiments demonstrate that PRIME is better suited for video protection than image-based methods (PhotoGuard), offering lower computational costs and enhanced robustness.
summary: The paper focuses on creating adversarial perturbations for private videos to prevent malicious editing by open-source diffusion models.
The paper argues that existing image protection methods are ineffective for video protection due to their high computational costs and limited robustness.
To address this, the paper proposes a video protection framework named PRIME, which employs fast convergence searching and early stopping for efficiency, and an anti-dynamic compression strategy for robustness.
Experimental results indicate that PRIME provides more robust video protection with significantly lower computational costs compared to image-based protections like PhotoGuard.
weaknesses: 1. The paper lacks ablation studies. PRIME comprises various optimization strategies: attacking the entire diffusion process, employing fast convergence searching with early stopping, and utilizing anti-dynamic compression. However, the paper does not provide ablation studies to verify the necessity and effectiveness of these strategies. Given the marginal performance improvement of PRIME over PhotoGuard, as shown in Tables 2 and 3, conducting ablation studies is crucial to understand which strategies significantly enhance performance.
2. The paper provides insufficient details for some experiments. In Tables 5 and 6, the choice to experiment only on a subset of datasets, rather than all available datasets, is not well-explained. This issue is also apparent in Appendix Section E, where the authors casually mention evaluating PRIME on "more general videos" without specifying the models, datasets, or hyper-parameter settings used. A more detailed explanation of these choices would strengthen the paper.
3. It is advisable to include video-text alignment (VCLIPSim) as an evaluation metric in Tables 5 and 6. While poor generation quality does not necessarily indicate the absence of undesirable elements like NSFW content, comparing the performance of PRIME with PhotoGuard and ‘w/o protection’ could provide deeper insights into its efficacy.
4. The paper only compares PRIME to PhotoGuard, but other image protection methods like Anti-Dreambooth, AdvDM, and Mist have shown greater effectiveness in certain scenarios. It would be beneficial to explore whether PRIME could be integrated with these methods and if it offers any additional advantages over them.

- [1] Le et al. Anti-dreambooth: Protecting users from personalized text-to-image synthesis.
- [2] Liang et al. Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples.
- [3] Liang et al. Mist: Towards Improved Adversarial Examples for Diffusion Models.

---

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: No
soundness: 3
strengths: - The paper is well-written and easy to understand.
- It focuses on a critical problem, large generative models can be maliciously used to edit our videos without permission, we should act first and propose some protection before publishing our videos on the internet.
- The proposed method is effective according to the experimental results. Some novel attacking tricks are included e.g. early stopping, fast searching and anti-compression.
summary: This paper proposes a framework named PRIME that can inject adversarial noise into video frames, so that the video cannot be correctly edited by some video editing pipelines like TokenFlow and Render-A-Video. The authors propose some tricks to make the attack stronger and more effective, e.g. fast convergence searching and early stopping. The paper is well-written and easy to read, both the numeric results and visualizations in the supp material show effectiveness of the proposed algorithm.
weaknesses: ## Clarifications
- The black-box setting is not that convincing, because as far as i know, TokenFlow and Render-A-Video also use stable diffusion backbones (same visual encoder as the attacking pipelines).


## Methods 
- Eq (4) seems to be slow, can we just sample $t$ instead of summing up all the $T$.

## Experiments
- Photoguard can be a baseline, must there are many stronger protection baselines than PhotoGuard e.g. Mist [1] and SDS [2].
- No ablation studies are conducted to show that the proposed fast convergence and early stopping really matter.

## Others


The author should introduce more about the targeted editing pipeline like TokenFlow, since it is different from Image-to-Image editing pipelines.


[1] Mist: Towards improved adversarial examples for diffusion models

[2] Toward effective protection against diffusion-based mimicry through score distillation

---

confidence: 4
contribution: 1
initial_rating: 3
presentation: 2
questions: 1. How would the method perform against more advanced video editing architectures not tested in the paper?

1. Current perturbations are noticeable. What is the minimum perturbation required for effective protection? Is there a theoretical bound?

1. Can you provide more details about the human evaluation methodology? How were participants selected and potential biases controlled?
soundness: 2
strengths: This paper is addressing an important problem given that video editing technologies are advancing rapidly.
This paper is generally clear in its presentation.
summary: This paper presents a method to protect videos from malicious editing by injecting perturbations into video frames. It follows the approach in Photoguard, and proposes two techniques, fast convergence searching and early stage stopping, to improve the efficiency for videos. It evaluates the proposed method on a custom dataset of celebrity videos and shows improved efficiency and protection compared to prior work.
weaknesses: Limited technical novelty and trivial solution:
- The core method is largely an adaptation of Photoguard to videos. 
- The "fast convergence searching" is essentially just target image selection optimization. And it is not clear how to select the target image pool, and how different target image pools will influence the performance. In addition, this paper should compare with non-targeted optimization, i.e. add perturbation to maximize the distance between original frame and perturbed frame.
- Early stopping is a standard ML technique with no significant innovation.
- The anti-compression technique is a straightforward quantization approach.

Experimental concerns:
- The evaluation dataset is small (35 clips) and not publicly available. It only includes celebrity videos, which does not represent the broad distribution of videos in practice.
- It does not show protection against video editing techniques besides diffusion model based tools. There is no evidence that this method is still effective for more advanced and proprietary video editing models, like pika, runway gen-3, and sora.

Performance is not impressive:
- There are no qualitative results in paper but from the videos, we can see noticeable noise in the perturbed videos  in the supplementary. The authors should include qualitative results in the main paper for easier visual assessment. 
- Even for clean videos, the edited effect looks terrible. Making already bad performing video editing models perform worse is not impressive.

---

confidence: 4
contribution: 2
initial_rating: 5
presentation: 3
questions: See the Weakness.
soundness: 2
strengths: - The paper is easy to understand
- The experiments demonstrate the effectivenesss
summary: The authors propose a protection method for video editing, namely PRIME, which can reduce the timing cost for video protection and improve the bitrate for the protected videos. A user study is conducted.
weaknesses: - Technical novelty is limited. There is no detailed explanation of the difference between the proposed methods and the existing ones.
- Ablation studies are missing. There is no analysis of the strengths claimed in the method sections. For example, no computational time analysis on "EFFICIENT PER-FRAME PERTURBING".
- Explanation is needed for robustness study. I am not sure if the number in the table stands for the comparison between the original frame and the protected frame or the original frame and the edited frame. 
- The visualization is not satisfactory. The perturbation in the protected video is perceptible and the edited video is not totally destroyed.
- Comparison methods are lacking. Only PhotoGuard is compared.