Beyond the Pixels: Exploring the Effects of Bit-Level Network and File Corruptions on Video Model Robustness

1 INTRODUCTION . Video is becoming an increasingly common data modality , with applications in online conferencing ( Jansen et al. , 2018 ) , autonomous vehicles ( Chen et al. , 2018 ; Bojarski et al. , 2016 ) , action recognition ( Kuehne et al. , 2011 ; Soomro et al. , 2012 ; Carreira & Zisserman , 2017 ) , and event detection ( Fu et al. , 2019 ; Gaidon et al. , 2013 ) . Recent work in computer vision has studied the robustness of machine learning ( ML ) models to pixel-space corruptions such as adversarial examples ( Madry et al. , 2017 ; Carlini & Wagner , 2016 ; Goodfellow et al. , 2014 ; Moosavi-Dezfooli et al. , 2016 ; Szegedy et al. , 2013 ) . However , in the real world , videos are susceptible to corruptions beyond the pixels , such as bit-level network and file corruptions ( Fig . 1 ) . Bit-level corruptions are generally non-adversarial and arise in the real world from network congestion ( Mushtaq & Mellouk , 2017 ) , i.e. , transmission problems in video conferencing , or hardware errors during storage ( Sivathanu et al. , 2005 ; Zhang et al. , 2010 ) . These corruptions spuriously modify bits in a video file , leading to data loss or visual distortion ( e.g . object duplication , noisy patches , or freeze-frames ) . Although some previous work in computer vision robustness has been compresssion-aware , e.g . studying the effects of JPEG compression ( Aydemir et al. , 2018 ; Dziugaite et al. , 2016 ; Das et al. , 2018 ) or changing bitrates ( Guo et al. , 2017b ) , direct corruptions to the bit representations of videos remain underexplored . In this work , we take a first step in understanding video model robustness to naturally-occurring levels of network and file corruptions , and explore baseline defenses to these corruptions . To this end , we simulate a wide range of corruption severity levels consistent with empirical studies of real-world corruptions ( Schroeder et al. , 2016 ; Hu & Zhang , 2018 ) , and explore their effects on video artifacts and model performance . We evaluate model performance on two action recognition datasets ( Kuehne et al. , 2011 ; Soomro et al. , 2012 ) and one multi-object tracking dataset ( LealTaixé et al. , 2015 ) under simulated network packet loss and random bit-flip file corruptions . Our experiments demonstrate that model performance begins to degrade when packet loss rates exceed 1 % , or when the proportion of randomly-flipped bits in a file exceeds 10´6 , and ultimately drops by up to 77.1 % under the most severe corruption levels . We then focus on exploring two categories of defenses against network and file corruptions : corruption-agnostic methods without knowledge of bit-level corruptions , and corruption-aware methods that exploit knowledge of bit-level corruptions to enforce model invariance to network and file corruptions . For corruption-agnostic defenses , we evaluate out-of-distribution ( OOD ) detection ( Hendrycks & Gimpel , 2016 ; Liang et al. , 2018 ) and adversarial training ( Goodfellow et al. , 2014 ) as baselines . Our findings suggest that corruption-agnostic defenses have limited effectiveness , especially at low corruption levels ; for example , under adversarial training , model performance drops by up to 11.3 points on corrupted data , and 8.6 points on clean data , compared to the no-defense baseline . In response , we propose Bit-corruption Augmented Training ( BAT ) , a corruption-aware baseline . BAT augments data with corrupted video files from randomly chosen bit-level corruptions during training . Experiments show that BAT recovers up to 7.1 points over a no-defense baseline on highlycorrupted videos , while maintaining competitive performance on clean/near-clean data . This suggests that the noise structure of bit-level corruptions is fundamentally different from that of adversarial noise , and that incorporating knowledge of bit-level corruptions is crucial to model robustness against network and file corruptions . Lastly , to better understand the effect of augmenting with different corruptions , we explore variants of BAT that sample augmentations from different subsets of simulated corruptions . Interestingly , we find that augmenting with high levels of network and file corruption is key to improving model robustness , resulting in an accuracy gain of up to 10.1 points over the no-defense baseline . We conclude that BAT is a promising starting point for robustness to bit-level corruptions in video machine learning . Our results motivate future studies to understand and defend against bit-level corruption in ML robustness . 2 BIT-LEVEL VIDEO CORRUPTIONS . In this section , we first provide a brief overview on video encoding to provide intuition about the effects of network and file corruptions ( Section 2.1 ) , and then describe how we simulate a naturallyoccurring range of network and file corruptions ( Section 2.2 ) . 2.1 VIDEO ENCODING . We present a simplified explanation of video encoding , using the H.264 codec as an example ( Richardson , 2003 ) . Let X “ RHˆWˆCˆT be the space of possible videos . An uncompressed video x P X consists of a sequence of frames . These frames are often redundant ( i.e. , two neighboring frames in a video are likely to look similar ) , so the H.264 codec stores only a small fraction of frames ( known as I-frames ) and encodes the remaining frames as differences from I-frames . To further save space , the frames go through a series of compression steps like frequency space conversion , quantization , and entropy encoding , much like JPEG compression . We notate the encoding process as the function Encpxq , which is a mapping from pixel-space to bit-space . The corresponding decoding function is denoted as Decp¨q . The H.264 video codec is also equipped with error resilience and concealment techniques for repairing damaged data . For example , the codec might use uncorrupted portions of a frame to decode a corrupted frame ( Arbitrary Slice Order/Flexible Macroblock Order ) , or store redundant portions of a frame for the same purpose . However , bit-level network/file corruptions can destroy particular information such that these methods are insufficient to restore visual quality ; for example , I-frames are important references for decoding other frames , so corruptions to them often result in propagating noise patches or smearing artifacts throughout the video . 2.2 SIMULATING BIT-LEVEL CORRUPTIONS . Network corruptions . We simulate packet loss , a network corruption where data packets are permanently lost during transmission ( Fig . 2 ) , which can result in visual quality drops in video streaming applications ( Hu & Zhang , 2018 ; Adeyemi-Ejeye et al. , 2017 ) . We simulate packet loss by streaming videos using the Real-Time Streaming Protocol ( RTSP ) with UDP , dropping video packets randomly using the Mahimahi network emulator ( Netravali et al. , 2015 ) . This setup targets real-time applications like video-conferencing that use UDP due to latency requirements . File corruptions . We simulate random corruptions , a file corruption where random bits in a video file are erroneously flipped ( Fig . 2 ) . Such bit-flips occur as the result of hardware integrity issues like bus errors ( Zhang et al. , 2010 ) , malicious software ( Sivathanu et al. , 2005 ) , or cosmic rays ( O ’ Gorman et al. , 1996 ) . Despite redundancy mechanisms in modern file systems , many such corruptions are unrecoverable due to unsafe faulthandling , or can persist undetected ( Ganesan et al. , 2017 ) . In Appendix B , we additionally explore contiguous corruptions , another real-world bit-corruption pattern in which a contiguous segment of a file bitstream is replaced with random bits . Corruption Levels . Our primary interest is in simulating naturally-occurring levels of bit-level corruptions . Thus , we choose ranges for p based on real-world empirical studies of packet loss and file corruption . Notationally , we describe corruptions with a parameter p P r0 , 1s , the expected proportion of the video file corrupted . For packet loss , each packet is dropped with probability p. For random corruptions , we flip each bit with probability p. Real-world network traces have yielded packet loss rates from 0.31 % to 12.38 % ( Hu & Zhang , 2018 ) , so we simulate packet loss rates from 0.01 % ( p “ 10´4 ) up to 20 % ( p “ 0.2 ) . On the file corruptions side , studies of flash memory have found median bit-error rates ranging from 6.0ˆ 10´10 to 1.0ˆ 10´5 , with 99th percentile bit error rate up to 1.2 ˆ 10´4 ( Schroeder et al. , 2016 ) , so we simulate file corruption rates from p “ 10´8 up to p “ 10´4 . We provide more discussion of our chosen parameter settings in Appendix F . 3 BASELINE DEFENSES FOR BIT-LEVEL CORRUPTIONS . We explore three defenses as baselines for mitigating the impact of network and file corruptions . Broadly , these methods can be categorized as corruption-agnostic , which make no assumptions about network and file corruptions , or corruption-aware , which explicitly incorporate knowledge of network and file corruptions . As corruption-agnostic baselines , we evaluate out-of-distribution ( OOD ) detection and adversarial training ( AT ) . We propose bit-corruption augmented training ( BAT ) as a corruption-aware baseline . 3.1 CORRUPTION-AGNOSTIC DEFENSES . Network and file corruptions often result in severe visual artifacts ( see Section 4.2 for some examples ) . As a result , these corrupted videos can be viewed as out-of-distribution examples , particularly for large amounts of corruption . In such cases , a natural defense for pre-trained video models is OOD detection , a test-time technique that attempts to identify out-of-distribution videos and filters them out . This method requires no model retraining , and makes zero assumptions about the noise structure . As an overview of OOD detection , we consider a ML model fpx ; θq : RHˆWˆCˆT Ñ RK with parameters θ , which are optimized under categorical cross-entropy loss : min θ ÿ px , yq „ P ` pFθpxq , yq , where Fθpxq is the softmax output . We use ODIN ( Liang et al. , 2018 ) , a standard OOD detection method that uses calibrated softmax score Sθpxq as an indicator score for flagging OOD examples : Sθpxq “ max j efjpx ; θq { T ř i e fipx ; θq { T , where T is a temperature scaling parameter ( Guo et al. , 2017a ) , and fipx ; θq is the logit value for class i . The calibrated score Sθpxq is then compared against a preset threshold ( often 95 % TPR ) computed on in-distribution data ; x is flagged as OOD if it falls below the threshold and is marked as in-distribution otherwise . The idea is that corrupted videos yield lower average calibrated scores than clean videos . Adversarial Training ( AT ) . Adversarial training ( Goodfellow et al. , 2014 ) is a common technique that makes models robust to small adversarial perturbations . Adversarial training optimizes min θ ÿ px , yq „ P max ||δ||8ďε ` pFθpx ` δq , yq , where ε is the perturbation budget , or maximum permissible L8-norm of perturbation δ . We use the training scheme proposed in Wong et al . ( 2020 ) , where an initial δ is randomly chosen from the pL8 , εq-neighborhood of a video x . Then , the above objective is iteratively optimized for one step . This method requires model retraining , and assumes that the noise structure of test-time input is adversarial .

Summary: The authors explored the robustness of video machine learning models to bit-level corruption. They investigated previous methods such as Out-Of-Distribution (OOD) detection and adversarial training and found that they are not effective enough to defense against the bit-level corruption.  Accordingly, this paper proposed a new framework, Bit-corruption Augmented Training (BAT), which utilizes the knowledge about corruption by bit-level data augmentation at the training stage. Also, the authors argue that the proposed method outperforms the previous methods in handling the bit-level corrupted dataset.