{"id":"f9660630-e676-4a9e-bdce-ceb7e60bc3d1","arxiv_id":"2607.13336","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"TC-UAP learns a shared multi-frame adversarial perturbation that protects videos of the same identity from both fine-tuning-based and reference-based video customization, remaining effective on unseen clips and under temporal attacks.","lead":"The paper presents TC-UAP, a method that adds imperceptible, temporally consistent noise to videos so that AI video-generation tools cannot use them to reproduce a specific person's identity. It is designed to work against both fine-tuning-based and image-to-video-based customization, and the authors show it survives several temporal attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Temporal length/crop generalization and non-low-pass temporal attacks are claimed but never tested; all clips are fixed at 121 frames, so 'unseen videos of varying lengths' and 'robust to unseen temporal attacks' rest on unverified extrapolation.","rationale":"The reader's weakest assumption—that maximizing VAE latent distance transfers to blocking identity preservation—is partially answered by the paper itself: Tables 1 and 3 evaluate actual tuning- and reference-based pipelines, not just VAE reconstruction. So the more salient gap is the claimed generality of the temporal design. The method's universality rests on repeating a fixed-length UAP across arbitrary video lengths and on surviving temporal attacks; but the evaluation uses only fixed 121-frame clips and only three low-pass filters. This is a concrete, testable missing support rather than an internal contradiction. It does not overturn the reader's CONDITIONAL verdict; it reinforces it by adding a specific condition (length/crop/attack-type generality) that must be verified before the headline claim can be accepted at face value. I therefore recommend no verdict change.","tokens_in":26049,"tokens_out":7660,"duration_ms":80118,"concrete_test":"Use a trained TC-UAP (N=9, η=0.1) on one TalkVid identity and measure ISM1/FDFR under both customization pipelines for test videos of lengths 25, 49, 73, 97, 121 frames and for 121-frame clips trimmed to start at offsets 0, 20, 40, 60 (same prompts). If ISM1 rises above ~0.3 or FDFR drops toward baseline on short/cropped clips, the varying-length/temporal-editing claim fails. In the same run, apply the DROP-30% and DOWN-2× attacks from Table 5 to full-length protected videos; if ISM1 returns to near clean levels, the 'unseen temporal attacks' claim is overbroad.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central contribution is a reusable perturbation: Eq. (10) repeats/crops δy to protect videos of arbitrary length, and Section 5.1 claims sliding-window optimization makes protection survive temporal edits (cropping/offset). Yet every evaluation clip is fixed at 121 frames (Appendix B.1), and test clips are only used at that length. No experiment varies T, changes the start offset, or verifies that the periodic UAP stays aligned with the VAE's causal temporal receptive field after cropping. The abstract/conclusion also claim robustness to 'unseen temporal attacks'; Table 3 tests only three low-pass filters (box, Gaussian, LPF) whose behavior is similar to the frame-averaging surrogate, while Table 5 defines discrete attacks (DROP-30%, DOWN-2×) that are never tested. Because the temporal-repetition design is what makes TC-UAP 'universal' and because robustness is one of the three stated challenges, these omissions are load-bearing: if short clips/crops or discrete temporal operations erase the UAP, the method reduces to a full-length, low-pass-specific protector and the headline claim is overstated. Note that the reader's VAE-surrogate concern is partly mitigated by the full-pipeline evaluations in Tables 1 and 3; the unverified extrapolation to temporal lengths and non-low-pass attacks is the sharper gap.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TC-UAP, a unified adversarial protection method for videos against both tuning-based (LoRA fine-tuning) and reference-based (image-to-video) customization. The method learns an identity-level multi-frame universal adversarial perturbation, optimized with a sliding-window latent-disruption objective against a 3D video VAE, and augmented with an intrinsic temporal-consistency reparameterization and a surrogate temporal-attack loss. The authors identify three temporal challenges (compression, overfitting, inconsistency) and provide comparisons on HDTF, CelebV-HQ, and TalkVid against PhotoGuard, Mist, and IDProtector, claiming the strongest identity protection and robustness to unseen temporal attacks.","tokens_in":26389,"tokens_out":4578,"duration_ms":43310,"significance":"If the central claims hold, TC-UAP is a meaningful contribution: it is the first video-level protection method targeting both reference- and tuning-based customization, the optimization is clearly specified (Eqs. 13–16, Algorithm 1), and the fixed-length experiments show large improvements over image-level baselines across three datasets and two video-diffusion backbones. The promise of a reproducible evaluation suite is also valuable. The main reservations concern untested temporal-length/crop generalization and the narrow set of temporal attacks used to support the robustness claim; these are load-bearing for the paper's headline claims.","major_comments":[{"comment":"The paper repeatedly claims that repeating/cropping the UAP protects 'unseen videos of varying lengths' and survives temporal editing, but every clip in the evaluation is fixed at 121 frames. No experiment varies T, changes the start offset, or crops the protected video. The 'temporal overfitting' challenge illustrated in Fig. 4 is therefore never directly tested for TC-UAP. Please add experiments applying the learned UAP to clips of different lengths and starting positions and report the protection metrics; otherwise the universality claim in the abstract and Section 5.1 is unsupported.","section":"§5.1, Eq. (10); Appendix B.1"},{"comment":"Robustness to 'unseen temporal attacks' is evaluated only with three low-pass filters (box, Gaussian, LPF), which are smoothing operations similar to the frame-averaging surrogate used in training. The discrete temporal attacks defined in Table 5 (DROP-30%, DOWN-2×) are never tested. These operations can break the periodicity of the repeated UAP and are qualitatively different from low-pass filtering. Please evaluate these attacks or substantially qualify the robustness claim in the abstract and conclusion.","section":"§6.3, Table 3 vs Table 5"},{"comment":"All quantitative results appear to be single-run; no error bars, confidence intervals, or significance tests are reported. Because diffusion fine-tuning and generation are stochastic, the 'strongest identity protection' claims require at least multiple seeds with variance reported. This is particularly relevant where differences are small (e.g., Table 1, TalkVid reference-based ISM1: 0.275 vs 0.286).","section":"§6.2–6.4, Tables 1, 3, 4"}],"minor_comments":[{"comment":"The sign convention is inconsistent: Eq. (7) and Eq. (8) define a maximization of latent distance, while Eq. (11) and Eq. (13) minimize a negative expectation. Please harmonize the notation to avoid confusion.","section":"§3.1, Eqs. (7)–(11)"},{"comment":"The x-axis 'Temporal Consistency' is not defined in the caption. Specify how the cosine similarity between adjacent frames is computed and aggregated, and how 'attack-strength retention' is averaged across videos.","section":"Figure 5"},{"comment":"The DROP-30% attack is stochastic. If it is used in any analysis, report the number of trials and the variance; if it is never used, state that explicitly.","section":"Table 5"},{"comment":"State the exact procedure used to obtain 30 clips per identity (e.g., temporal sampling, filtering) and the resolution/duration after preprocessing, so that the 'varying lengths' claim can be assessed.","section":"Appendix B.1"},{"comment":"The reparameterization averages all previous frames, which gives exponentially decaying influence for early frames but can be memory-intensive for long N. Clarify whether N=9 was chosen for this reason and whether the ablation includes sensitivity to N.","section":"Section 5.2, Eq. (15)"}],"recommendation":"major_revision","confidential_remarks":"The core fixed-length result appears sound and the paper is well structured. However, the two headline generalizations—robustness to temporal edits/varying lengths and robustness to unseen temporal attacks—are not backed by experiments for exactly the settings they claim to cover. These are fixable within the manuscript's scope by adding the missing experiments or by narrowing the claims. The lack of error bars is also fixable. I recommend major revision rather than rejection because the central methodology is clearly specified and the main comparisons are credible for the fixed-length setting."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a real first step toward protecting videos against both tuning- and reference-based customization. The authors identify three temporal failure modes, back them up with clean diagnostics — especially the temporal-receptive-field analysis — and propose a multi-frame UAP with sliding-window optimization that beats per-frame image baselines. The evaluation is more serious than most in this area: actual LoRA fine-tuning and I2V inference on two backbones and three datasets, with identity metrics rather than only pixel-level distance.\n\nThe main soft spot is that the claims outrun the experiments in two specific ways. First, “unseen videos of varying lengths” is never tested. Every clip is fixed at 121 frames (Appendix B.1). The whole point of the repeat-and-crop construction is that the UAP generalizes across lengths and start offsets, yet no experiment varies T, crops a protected video, or shifts the phase. Second, “robust to unseen temporal attacks” is tested only against three low-pass filters — box, Gaussian, and LPF — which are all in the same family as the frame-averaging surrogate used in training. The discrete attacks defined in Table 5 (frame dropping, down/up-sampling) are never evaluated. So the robustness result is real for temporal filters, but the claim of robustness to unseen attacks is too strong as stated.\n\nTwo smaller issues. There are no error bars or significance tests anywhere; the numbers in Tables 1, 3, 4 appear to be single-run. And the Table 4 ablation shows the full method is noticeably weaker on original tuning-based videos than the variant without intrinsic temporal modeling (ISM1 0.160 vs 0.010), with robustness carrying the load. That trade-off is plausible, but it makes the still-unverified robustness the central pillar. Code is promised but not shipped, so independent verification isn’t possible yet.\n\nNone of this kills the paper. The core idea is sound, and the gaps are addressable with additional experiments: vary video length, crop at different offsets, test the discrete attacks, and report variance. I’d send it to review; the referees should push for exactly those experiments.","headline":"A genuinely new problem formulation and a plausible method for video-level protection against both tuning- and reference-based customization, but the universality and robustness claims go beyond what the fixed-length, low-pass-only experiments support.","tokens_in":26900,"tokens_out":4044,"would_cite":true,"duration_ms":43067,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a single reusable, imperceptible, temporally consistent perturbation applied to a person's videos can prevent both reference-based and fine-tuning-based video customization from reproducing that person's identity.","keywords":["video protection","universal adversarial perturbation","video customization","image-to-video generation","fine-tuning","temporal robustness","VAE latent","identity protection"],"falsifier":"A concrete falsifying test: take a protected video whose VAE latents are strongly disrupted (low reconstruction PSNR) and fine-tune a video diffusion model that either bypasses the same VAE or uses a stronger denoiser; if the generated videos still preserve the target identity, the central claim that VAE-latent disruption is the right surrogate fails. Additionally, if an attacker designs a learnable temporal filter (not among the paper's test attacks) that removes the perturbation and restores customization success, the robustness claim would be falsified.","tokens_in":25921,"feed_emoji":"🛡️","tokens_out":10431,"duration_ms":86395,"temperature":0.7,"pith_summary":"The paper sets out to protect videos, not just images, from being used to clone a person's identity through diffusion-based video customization. It identifies three reasons why naive protection fails: the 3D video VAE's temporal compression washes out frame-level perturbations, full-video perturbations overfit to one clip, and temporally inconsistent perturbations are erased by simple temporal filters. The proposed TC-UAP is an identity-level multi-frame universal adversarial perturbation, optimized on sliding windows from several videos, with a reparameterization that forces temporal consistency and a surrogate temporal-attack loss for robustness. If the central claim is correct, a user can post a video that looks unchanged but cannot be used for either fine-tuning-based or reference-based customization. The paper reports that this is the first method to address both customization routes at the video level.","feed_headline":"One reusable perturbation blocks both video-customization attacks","feed_subtitle":"TC-UAP keeps posted videos looking normal while blocking both fine-tuning and image-to-video identity cloning.","key_machinery":"The central object is the identity-level multi-frame universal adversarial perturbation (TC-UAP), a set of nine perturbation frames bounded by an ℓ∞ budget of 0.1 that is temporally repeated and cropped to protect videos of arbitrary length. It is optimized to maximize the L2 distance between clean and protected latents of the 3D video VAE over randomly sampled sliding windows, with two temporal-consistency mechanisms: a reparameterization where each perturbation frame equals the average of all previous frames plus a learnable residual, and a surrogate temporal-attack loss that keeps the latent disruption effective after frame averaging. The sliding window is chosen to cover the dominant tem","core_discovery":"The core claim is that the 3D video VAE is a common bottleneck shared by reference-based and tuning-based video customization, and that disrupting its latent representation is sufficient to break identity preservation in both pipelines. The paper demonstrates this by analyzing the temporal receptive field of causal video VAEs and showing that image-level perturbations decay in later frames, that per-video perturbations overfit, and that temporally inconsistent perturbations have near-zero retention under temporal attacks. TC-UAP therefore learns a fixed-length set of perturbation frames per identity, repeats it across videos of any length, optimizes it with a sliding-window latent-distance o","pith_inferences":["The paper's reliance on the VAE as the shared bottleneck implies that a customization pipeline that operates in pixel space, or that uses a different encoder, might evade the protection; this boundary is not tested in the paper.","The authors explicitly acknowledge that audio identity is unprotected, so a complete defense against identity cloning would need to also disrupt audio encoders.","The cumulative-average reparameterization for temporal consistency could be reused as a general design for any video adversarial perturbation, not just identity protection.","A testable extension would be to check whether the learned UAP transfers across identities or to non-face video content, since current experiments cover only talking-head footage."],"forward_implications":["A single learned perturbation can be reused across all videos of the same identity, eliminating per-video optimization cost.","Protected videos remain perceptually close to the originals (high VMAF), so the defense does not demand a visible watermark or degradation.","Both customization routes—LoRA-style fine-tuning and image-to-video conditioning—fail to preserve the target identity when TC-UAP is applied.","The protection survives common temporal attacks such as frame averaging, box/Gaussian filtering and low-pass filtering, which would erase naive frame-level perturbations."],"fun_headline_variants":["A single perturbation shields videos from cloning attacks","Temporal-consistent UAP blocks both video-customization routes","One UAP defeats fine-tuning and image-to-video cloning","Reusable perturbation protects any video from identity theft","Fix the video VAE: TC-UAP blocks two cloning pipelines"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that maximizing the distance between clean and protected latents in the 3D video VAE encoder is sufficient to corrupt identity information for the downstream customization pipelines; this is an assumption because the VAE is only one stage and the paper demonstrates transfer only on the two specific video-diffusion backbones used in its experiments.","fun_headline_variants_meta":{"raw":{"variants":["A single perturbation shields videos from cloning attacks","Temporal-consistent UAP blocks both video-customization routes","One UAP defeats fine-tuning and image-to-video cloning","Reusable perturbation protects any video from identity theft","Fix the video VAE: TC-UAP blocks two cloning pipelines"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000165,"raw_usage":{"total_tokens":1113,"prompt_tokens":800,"completion_tokens":313,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":544,"completion_tokens_details":{"reasoning_tokens":232}},"tokens_in":544,"tokens_out":313,"duration_ms":4417,"temperature":1.0,"reasoning_tokens":232,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T05:27:26.712845+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete falsifying test: take a protected video whose VAE latents are strongly disrupted (low reconstruction PSNR) and fine-tune a video diffusion model that either bypasses the same VAE or uses a stronger denoiser; if the generated videos still preserve the target identity, the central claim that VAE-latent disruption is the right surrogate fails. Additionally, if an attacker designs a learnable temporal filter (not among the paper's test attacks) that removes the perturbation and restores customization success, the robustness claim would be falsified.","supporting_citations":[],"review_version":1}