Beyond the Pixels: Exploring the Effects of Bit-Level Network and File Corruptions on Video Model Robustness

1 INTRODUCTION . Video is becoming an increasingly common data modality , with applications in online conferencing ( Jansen et al. , 2018 ) , autonomous vehicles ( Chen et al. , 2018 ; Bojarski et al. , 2016 ) , action recognition ( Kuehne et al. , 2011 ; Soomro et al. , 2012 ; Carreira & Zisserman , 2017 ) , and event detection ( Fu et al. , 2019 ; Gaidon et al. , 2013 ) . Recent work in computer vision has studied the robustness of machine learning ( ML ) models to pixel-space corruptions such as adversarial examples ( Madry et al. , 2017 ; Carlini & Wagner , 2016 ; Goodfellow et al. , 2014 ; Moosavi-Dezfooli et al. , 2016 ; Szegedy et al. , 2013 ) . However , in the real world , videos are susceptible to corruptions beyond the pixels , such as bit-level network and file corruptions ( Fig . 1 ) . Bit-level corruptions are generally non-adversarial and arise in the real world from network congestion ( Mushtaq & Mellouk , 2017 ) , i.e. , transmission problems in video conferencing , or hardware errors during storage ( Sivathanu et al. , 2005 ; Zhang et al. , 2010 ) . These corruptions spuriously modify bits in a video file , leading to data loss or visual distortion ( e.g . object duplication , noisy patches , or freeze-frames ) . Although some previous work in computer vision robustness has been compresssion-aware , e.g . studying the effects of JPEG compression ( Aydemir et al. , 2018 ; Dziugaite et al. , 2016 ; Das et al. , 2018 ) or changing bitrates ( Guo et al. , 2017b ) , direct corruptions to the bit representations of videos remain underexplored . In this work , we take a first step in understanding video model robustness to naturally-occurring levels of network and file corruptions , and explore baseline defenses to these corruptions . To this end , we simulate a wide range of corruption severity levels consistent with empirical studies of real-world corruptions ( Schroeder et al. , 2016 ; Hu & Zhang , 2018 ) , and explore their effects on video artifacts and model performance . We evaluate model performance on two action recognition datasets ( Kuehne et al. , 2011 ; Soomro et al. , 2012 ) and one multi-object tracking dataset ( LealTaixé et al. , 2015 ) under simulated network packet loss and random bit-flip file corruptions . Our experiments demonstrate that model performance begins to degrade when packet loss rates exceed 1 % , or when the proportion of randomly-flipped bits in a file exceeds 10´6 , and ultimately drops by up to 77.1 % under the most severe corruption levels . We then focus on exploring two categories of defenses against network and file corruptions : corruption-agnostic methods without knowledge of bit-level corruptions , and corruption-aware methods that exploit knowledge of bit-level corruptions to enforce model invariance to network and file corruptions . For corruption-agnostic defenses , we evaluate out-of-distribution ( OOD ) detection ( Hendrycks & Gimpel , 2016 ; Liang et al. , 2018 ) and adversarial training ( Goodfellow et al. , 2014 ) as baselines . Our findings suggest that corruption-agnostic defenses have limited effectiveness , especially at low corruption levels ; for example , under adversarial training , model performance drops by up to 11.3 points on corrupted data , and 8.6 points on clean data , compared to the no-defense baseline . In response , we propose Bit-corruption Augmented Training ( BAT ) , a corruption-aware baseline . BAT augments data with corrupted video files from randomly chosen bit-level corruptions during training . Experiments show that BAT recovers up to 7.1 points over a no-defense baseline on highlycorrupted videos , while maintaining competitive performance on clean/near-clean data . This suggests that the noise structure of bit-level corruptions is fundamentally different from that of adversarial noise , and that incorporating knowledge of bit-level corruptions is crucial to model robustness against network and file corruptions . Lastly , to better understand the effect of augmenting with different corruptions , we explore variants of BAT that sample augmentations from different subsets of simulated corruptions . Interestingly , we find that augmenting with high levels of network and file corruption is key to improving model robustness , resulting in an accuracy gain of up to 10.1 points over the no-defense baseline . We conclude that BAT is a promising starting point for robustness to bit-level corruptions in video machine learning . Our results motivate future studies to understand and defend against bit-level corruption in ML robustness . 2 BIT-LEVEL VIDEO CORRUPTIONS . In this section , we first provide a brief overview on video encoding to provide intuition about the effects of network and file corruptions ( Section 2.1 ) , and then describe how we simulate a naturallyoccurring range of network and file corruptions ( Section 2.2 ) . 2.1 VIDEO ENCODING . We present a simplified explanation of video encoding , using the H.264 codec as an example ( Richardson , 2003 ) . Let X “ RHˆWˆCˆT be the space of possible videos . An uncompressed video x P X consists of a sequence of frames . These frames are often redundant ( i.e. , two neighboring frames in a video are likely to look similar ) , so the H.264 codec stores only a small fraction of frames ( known as I-frames ) and encodes the remaining frames as differences from I-frames . To further save space , the frames go through a series of compression steps like frequency space conversion , quantization , and entropy encoding , much like JPEG compression . We notate the encoding process as the function Encpxq , which is a mapping from pixel-space to bit-space . The corresponding decoding function is denoted as Decp¨q . The H.264 video codec is also equipped with error resilience and concealment techniques for repairing damaged data . For example , the codec might use uncorrupted portions of a frame to decode a corrupted frame ( Arbitrary Slice Order/Flexible Macroblock Order ) , or store redundant portions of a frame for the same purpose . However , bit-level network/file corruptions can destroy particular information such that these methods are insufficient to restore visual quality ; for example , I-frames are important references for decoding other frames , so corruptions to them often result in propagating noise patches or smearing artifacts throughout the video . 2.2 SIMULATING BIT-LEVEL CORRUPTIONS . Network corruptions . We simulate packet loss , a network corruption where data packets are permanently lost during transmission ( Fig . 2 ) , which can result in visual quality drops in video streaming applications ( Hu & Zhang , 2018 ; Adeyemi-Ejeye et al. , 2017 ) . We simulate packet loss by streaming videos using the Real-Time Streaming Protocol ( RTSP ) with UDP , dropping video packets randomly using the Mahimahi network emulator ( Netravali et al. , 2015 ) . This setup targets real-time applications like video-conferencing that use UDP due to latency requirements . File corruptions . We simulate random corruptions , a file corruption where random bits in a video file are erroneously flipped ( Fig . 2 ) . Such bit-flips occur as the result of hardware integrity issues like bus errors ( Zhang et al. , 2010 ) , malicious software ( Sivathanu et al. , 2005 ) , or cosmic rays ( O ’ Gorman et al. , 1996 ) . Despite redundancy mechanisms in modern file systems , many such corruptions are unrecoverable due to unsafe faulthandling , or can persist undetected ( Ganesan et al. , 2017 ) . In Appendix B , we additionally explore contiguous corruptions , another real-world bit-corruption pattern in which a contiguous segment of a file bitstream is replaced with random bits . Corruption Levels . Our primary interest is in simulating naturally-occurring levels of bit-level corruptions . Thus , we choose ranges for p based on real-world empirical studies of packet loss and file corruption . Notationally , we describe corruptions with a parameter p P r0 , 1s , the expected proportion of the video file corrupted . For packet loss , each packet is dropped with probability p. For random corruptions , we flip each bit with probability p. Real-world network traces have yielded packet loss rates from 0.31 % to 12.38 % ( Hu & Zhang , 2018 ) , so we simulate packet loss rates from 0.01 % ( p “ 10´4 ) up to 20 % ( p “ 0.2 ) . On the file corruptions side , studies of flash memory have found median bit-error rates ranging from 6.0ˆ 10´10 to 1.0ˆ 10´5 , with 99th percentile bit error rate up to 1.2 ˆ 10´4 ( Schroeder et al. , 2016 ) , so we simulate file corruption rates from p “ 10´8 up to p “ 10´4 . We provide more discussion of our chosen parameter settings in Appendix F . 3 BASELINE DEFENSES FOR BIT-LEVEL CORRUPTIONS . We explore three defenses as baselines for mitigating the impact of network and file corruptions . Broadly , these methods can be categorized as corruption-agnostic , which make no assumptions about network and file corruptions , or corruption-aware , which explicitly incorporate knowledge of network and file corruptions . As corruption-agnostic baselines , we evaluate out-of-distribution ( OOD ) detection and adversarial training ( AT ) . We propose bit-corruption augmented training ( BAT ) as a corruption-aware baseline . 3.1 CORRUPTION-AGNOSTIC DEFENSES . Network and file corruptions often result in severe visual artifacts ( see Section 4.2 for some examples ) . As a result , these corrupted videos can be viewed as out-of-distribution examples , particularly for large amounts of corruption . In such cases , a natural defense for pre-trained video models is OOD detection , a test-time technique that attempts to identify out-of-distribution videos and filters them out . This method requires no model retraining , and makes zero assumptions about the noise structure . As an overview of OOD detection , we consider a ML model fpx ; θq : RHˆWˆCˆT Ñ RK with parameters θ , which are optimized under categorical cross-entropy loss : min θ ÿ px , yq „ P ` pFθpxq , yq , where Fθpxq is the softmax output . We use ODIN ( Liang et al. , 2018 ) , a standard OOD detection method that uses calibrated softmax score Sθpxq as an indicator score for flagging OOD examples : Sθpxq “ max j efjpx ; θq { T ř i e fipx ; θq { T , where T is a temperature scaling parameter ( Guo et al. , 2017a ) , and fipx ; θq is the logit value for class i . The calibrated score Sθpxq is then compared against a preset threshold ( often 95 % TPR ) computed on in-distribution data ; x is flagged as OOD if it falls below the threshold and is marked as in-distribution otherwise . The idea is that corrupted videos yield lower average calibrated scores than clean videos . Adversarial Training ( AT ) . Adversarial training ( Goodfellow et al. , 2014 ) is a common technique that makes models robust to small adversarial perturbations . Adversarial training optimizes min θ ÿ px , yq „ P max ||δ||8ďε ` pFθpx ` δq , yq , where ε is the perturbation budget , or maximum permissible L8-norm of perturbation δ . We use the training scheme proposed in Wong et al . ( 2020 ) , where an initial δ is randomly chosen from the pL8 , εq-neighborhood of a video x . Then , the above objective is iteratively optimized for one step . This method requires model retraining , and assumes that the noise structure of test-time input is adversarial .

Summary: The authors evaluate the effect of bit-level corruption, including network packet losses and bit corruptions, on video models such as action recognition and multi-object tracking. They found that the model performances drop significantly under severe corruption levels. To overcome this issue, they propose a defense method named Bit-corruption Augmented Training (BAT) to enhance the robustness of the model by embedding corrupted video samples in the training process. Results show that BAT is able to improve the model robustness over other methods such as Out-Of-Distribution (OOD) detection and Adversarial Training (AT).