PaperlayerView exact revision on arXiv

Source-linked AI summary

Do Image Classifiers Generalize Across Time?

Vaishaal Shankar, Achal Dave, Rebecca Roelofs, Deva Ramanan, Benjamin Recht, Ludwig Schmidt

arXiv:1906.02168v3cs.LGcs.CVstat.ML

TL;DR

It remains unclear whether video perturbations challenge image classifiers because prior evaluations used limited evidence or lacked human review of frame similarity. The authors construct ImageNet-Vid-Robust and YTBB-Robust from human-reviewed, perceptually similar video frames and evaluate models with a natural-perturbation robustness metric. All evaluated models suffer substantial accuracy drops due to natural perturbations.

  • Problem

    It remains unclear whether video perturbations challenge image classifiers because prior evaluations used limited evidence or lacked human review of frame similarity.

    Source: §1 · p. 2

  • Method

    The authors construct ImageNet-Vid-Robust and YTBB-Robust from human-reviewed, perceptually similar video frames and evaluate models with a natural-perturbation robustness metric.

    Source: §1 · p. 2, §2.2 · p. 5

  • Results

    All evaluated models suffer substantial accuracy drops due to natural perturbations.

    Source: §5 · p. 11

  • Takeaways & Limitations

    Natural temporal perturbations are a significant robustness challenge for CNNs, motivating standardized evaluation and improved reliability in video-based deployments.

    Source: §1 · p. 3, §5 · p. 11

    The datasets are sourced from ImageNet-Vid and Youtube-BB, while additional supervision for robustness remains insufficiently investigated.

    Source: §3.1 · p. 8, §5 · p. 11

Abstract

from arXiv · show

We study the robustness of image classifiers to temporal perturbations derived from videos. As part of this study, we construct two datasets, ImageNet-Vid-Robust and YTBB-Robust , containing a total 57,897 images grouped into 3,139 sets of perceptually similar images. Our datasets were derived from ImageNet-Vid and Youtube-BB respectively and thoroughly re-annotated by human experts for image similarity. We evaluate a diverse array of classifiers pre-trained on ImageNet and show a median classification accuracy drop of 16 and 10 on our two datasets. Additionally, we evaluate three detection models and show that natural perturbations induce both classification as well as localization errors, leading to a median drop in detection mAP of 14 points. Our analysis demonstrates that perturbations occurring naturally in videos pose a substantial and realistic challenge to deploying convolutional neural networks in environments that require both reliable and low-latency predictions

1 Introduction

The paper investigates whether naturally occurring temporal changes in videos expose a substantial robustness weakness in image classifiers. It addresses this question with human-reviewed datasets of perceptually similar frames and broad evaluations of classification and detection models.

Motivation

  • Nearby video frames can look nearly identical to people while causing substantial changes in classifier confidence.Figure 1 illustrates this behavior for a ResNet-152 model fine-tuned on ImageNet-Vid.Source: Figure 1 · p. 2
  • The study targets a gap left by synthetic perturbations and prior video evaluations, whose changes may be unrealistic or insufficiently human-validated.Earlier work reported about a 3% accuracy loss for frames up to 0.3 seconds apart without human review, leaving the robustness challenge unclear.Source: §1 · pp. 1–2

Dataset construction

  • 3,139 sets containing 57,897 images were built from ImageNet-Vid and Youtube-BB, with expert screening to verify perceptual similarity.The review process addresses the problem that temporally adjacent frames can be dissimilar because of camera or object motion.Source: §1 · p. 2, Figure 2 · p. 3

Evaluation

  • The evaluation covers more than 45 classifiers across architectures and training methods, and also examines detection robustness.The study includes models using adversarial training and data augmentation, alongside detection analyses.Source: §1 · p. 2

Results

  • 16% and 10% median classification-accuracy drops occur on ImageNet-Vid-Robust and YTBB-Robust, respectively, with a 14-point median detection mAP drop.Even the best classification models lose 14% and 8% accuracy on the two datasets.Source: §1 · pp. 2–3

Implications

  • Reliable frame-by-frame predictions matter for deployments requiring both high accuracy and low latency, including autonomous vehicles.The authors identify natural-perturbation robustness as a significant challenge for current CNNs.Source: §1 · p. 3

2 Constructing a test set for robustness

The paper constructs human-reviewed datasets of naturally perturbed video frames and evaluates robustness using worst-case neighboring frames. It also defines corresponding classification and detection metrics for measuring performance on these perturbations.

2.1 Constructing ImageNet-Vid-Robust and YTBB-Robust

  • A naive temporal-neighboring strategy can produce substantially changed frames because fast camera or object motion violates the assumption of small perturbations.The authors therefore sample candidate frames and manually review each frame set rather than relying on temporal proximity alone.Source: §2.1 · p. 3
  • The construction process accounts for incomplete Youtube-BB labels by adding missing labels before propagating and verifying them on nearby frames.Labels were corrected for 834 frames, representing 41% of accepted anchors in Youtube-BB.Source: §2.1 · p. 4, Table 1 · p. 4
  • Human annotators verified class correctness and visual similarity for frame pairs, using strict-majority agreement after reviewing 71,660 pairs.Reviewers marked dissimilarity caused by motion, background change, blur change, or distinctive object features; uncertain and rejected cases received joint review.Source: §2.1 · p. 4
  • 3,139 anchor frames with a median of 20 similar frames each form the final datasets after dissimilar or incorrectly labeled frames were discarded.The datasets were sourced from ImageNet-Vid and Youtube-BB, with approximately 20 candidate frames sampled around each anchor and then manually reviewed.Source: §2.1 · pp. 3–4

2.2 The pm-k evaluation metric

  • The pm-k classification metric evaluates robustness by selecting the worst-performing similar frame for each valid anchor before computing accuracy.For each anchor ai, Nk(ai) contains similar frames among the 2k temporally adjacent frames, and the metric applies the 0-1 loss to the worst neighbor.Source: §2.2 · p. 5, Classification · p. 5

Detection.

  • The pm-k detection metric replaces each anchor with the neighboring frame that minimizes average precision and computes mAP on those worst-case frames.The metric is defined analogously to classification, using per-category average precision averaged over recall thresholds.Source: Detection · p. 5

3 Main results

The study evaluates classification and detection robustness to naturally occurring temporal perturbations using human-reviewed video-derived test sets. Across models, these perturbations cause substantial classification and detection degradation, while review confirms that errors are not explained solely by dissimilar frames.

3.1 Classification

  • Higher benign accuracy improves worst-case accuracy but does not eliminate the drop caused by natural perturbations.Across the classification testbed, benign and robust accuracies are approximately linearly related.Source: §3.1 · pp. 5–6
  • 15.0% and 13.2% median accuracy drops occur on ImageNet-Vid-Robust and YTBB-Robust, respectively, across ILSVRC-trained classifiers.The robustness metric compares anchor-frame accuracy with worst-frame accuracy within each similarity set.Source: §3.1 · p. 6, Table 2 · p. 7
  • Natural perturbations remain difficult after common robustness interventions: noise augmentation yields 15.6% and 16.6% median drops, while ℓ∞ robustness provides only a modest 3% gain.Noise schemes included Gaussian noise, blur, shot noise, contrast change, impulse noise, and JPEG compression.Source: §3.1 · pp. 6–7
  • Fine-tuning improves accuracy but leaves substantial temporal sensitivity, including a 9.4% drop on YTBB-Robust and nearly unchanged ImageNet-Vid-Robust degradation of 15.0% to 15.1%.For ResNet-50, fine-tuning improves accuracy by 13% on ImageNet-Vid-Robust and 34% on YTBB-Robust.Source: §3.1 · p. 7

3.2 Detection

  • 12 to 15 points of detection mAP are lost for Faster R-CNN and R-FCN, and localization remains less affected in absolute accuracy but not in perturbation-induced drop.For Faster R-CNN with ResNet-50, localization mAP is 76.6 versus 62.8 for detection, yet switching tasks does not improve the original-to-perturbed drop.Source: §3.2 · p. 8, Table 3 · p. 8

3.3 Impact of dataset review

  • Human review improves original accuracy by 3 to 4%, perturbed accuracy by 5 to 6%, and reduces the accuracy drop by 1.8% on ImageNet-Vid-Robust and 1.1% on YTBB-Robust.Review discards mislabeled or blurry anchors and dissimilar frame pairs.Source: §3.3 · pp. 8–9, Table 4 · p. 9

3.2 Detection

  • Detection failures combine classification and localization errors, as nearby frames can both change the predicted class and misplace the object box.The examples include a fox misclassified as a sheep and airplane or motorcycle detections with incorrect localization.Source: §3.2 · p. 8, Figure 4 · p. 9

3.3 Impact of dataset review

  • Larger temporal offsets produce more model errors, while review reduces errors across offsets, especially for frames farther from the anchor.The review therefore helps distinguish robustness failures from errors caused by substantial visual differences between frames.Source: §3.3 · p. 9, Figure 5 · p. 10

4 Related work

Prior robustness studies often use synthetic or adversarial image modifications, leaving unclear whether models handle naturally occurring temporal perturbations. This work instead studies perceptually similar video frames without synthetic modification and uses human review plus a stricter metric to quantify robustness.

  • Natural video perturbations avoid the synthetic image modifications used by rotations, color changes, and corruption benchmarks.Source: §4 · p. 10
  • Earlier video studies provided limited or potentially confounded evidence because they used few videos, less stringent metrics, or lacked human frame review.Source: §4 · p. 10
  • The proposed PM-k metric is inspired by worst-of-k robustness and is stricter than the metric used in concurrent video-based work.Source: §4 · p. 10
  • Unlike conventional distribution-shift test sets, the proposed failure cases involve perceptually similar images from neighboring video frames.Source: §4 · p. 10
  • The study documents failures in both classifiers and detectors when neighboring frames are imperceptibly different, extending beyond motion or occlusion scenarios.Source: §4 · p. 11

5 Conclusion

The study quantifies substantial sensitivity to naturally occurring temporal perturbations across image classification and detection. It provides standardized datasets and metrics for measuring natural robustness and motivates broader methods for collecting realistic perturbations.

  • Natural temporal perturbations cause significant accuracy drops across a wide range of models in both classification and detection.Source: §5 · p. 11

Building more robust models

  • ImageNet-Vid-Robust and YTBB-Robust provide standardized robustness evaluations for classification and detection models.Source: §5 · p. 11

Further natural perturbations

  • Video-based evaluation can be extended with near-duplicate images from different times, viewpoints, or cameras and with domain-specific natural perturbations in other modalities.Source: §5 · p. 11

A Source Dataset Overview

The source datasets provide large video-frame collections with object annotations, from which ImageNet-Vid-Robust is evaluated using many classification models. The resulting benchmark reports substantial accuracy degradation between original and perturbed frames.

A.1 ImageNet-Vid

  • ImageNet-Vid contains 1,181,113 training frames from 4,000 videos and 512,360 validation frames from 1,314 videos, with 30 annotated object classes.Source: §A.1 · p. 15

A.2 Youtube-BB

  • Youtube-BB contains 8,146,143 annotated training frames from 253,569 videos and 1,013,246 validation frames from 31,829 videos, covering 22 object classes.Source: §A.2 · p. 15

B.1 ImageNet-Vid-Robust

  • ImageNet-Vid-Robust model evaluations report substantial drops between original and perturbed-frame accuracy across the tested classifiers.The table includes models such as resnet152_finetuned, whose accuracy changes from 84.8 to 70.2, a 14.6-point drop.Source: §B.1 · p. 15, Table 5 · p. 16

B.2 YTBB-Robust

YTBB-Robust shows broad accuracy losses across classification models, while a shared static set of perturbed frames still produces a substantial, though smaller, cross-model drop. The benchmark therefore captures both model-specific and model-independent temporal sensitivity.

B.2 YTBB-Robust

  • YTBB-Robust classification accuracies fall substantially on perturbed images across the evaluated model set.Examples include resnet152_finetuned dropping from 92.9 to 84.7, an 8.2-point loss, and resnet50_imagenet_pretrained dropping from 57.0 to 43.8, a 13.2-point loss.Source: §B.2 · pp. 16–17, Table 6 · p. 18
  • The YTBB-Robust results cover fine-tuned, pretrained, and augmentation-trained models, with reported drops varying from 8.2 to 18.6 across listed architectures and training methods.Source: §B.2 · pp. 16–17

C Model independent distribution shift

D Per class analysis

Performance degradation is broadly distributed across classes rather than concentrated in a few difficult categories, with larger drops on ImageNet-Vid-Robust than YTBB-Robust.

D Per class analysis

  • The accuracy drop was spread across most classes, despite particularly difficult perturbed classes such as lion and monkey.Source: D Per class analysis · p. 18
  • 14.4% and 8.9% total accuracy drops occurred on ImageNet-Vid-Robust and YTBB-Robust, respectively.The corresponding median per-class drops were 14.0% and 6.7%.Source: D Per class analysis · p. 18
  • Figure 7 reports per-class original and perturbed accuracies for the fine-tuned ResNet-152 on both datasets.Source: Figure 7 · p. 19

E Per-frame conditional robustness metric introduced in [12]

The paper contrasts PM-k with a prior conditional robustness metric and examines how robustness varies with natural temporal and ℓ∞ perturbation distances.

E Per-frame conditional robustness metric introduced in [12]

F ℓ∞distance vs PM-k Accuracy

G.1 ImageNet-Vid-Robust

  • Figure 11 relates accpmk to perturbation distance, with the entire range corresponding to temporal separations of at most 0.3 seconds.Source: §G.1 · p. 21, Figure 11 · p. 21

H.1 ImageNet-Vid-Robust

Analyses of video encoding and frame rate indicate that the observed accuracy sensitivity is not substantially explained by compression quality or restricted frame-rate subsets.

H.1 ImageNet-Vid-Robust

  • Frame-type analysis suggests model sensitivity is not significantly due to video-compression differences in frame quality.The study compares subsets excluding i-frames, p-frames, or b-frames; p-frames reference previous frames, b-frames reference previous and future frames, and i-frames are stored without references.Source: §H.1 · p. 21, Table 7 · p. 22

I.1 ImageNet-Vid-Robust

  • Accuracy drops were similar across fixed-FPS subsets at 25, 29, and 30 fps and resembled the drop for the full dataset.These frame rates cover 89% of the dataset.Source: §I.1 · p. 22, Table 8 · p. 22

J ILSVRC training with ImageNet-Vid-Robust classes

Training a ResNet-50 from scratch on ILSVRC using the 30 ImageNet-Vid classes produced accuracy drops consistent with the paper's submitted models.

J ILSVRC training with ImageNet-Vid-Robust classes

  • Accuracy drops for the ResNet-50 trained from scratch on ILSVRC were consistent with those of the submission models.The training used the 30 ImageNet-Vid classes; the authors hypothesize that lower accuracy reflects coarser ILSVRC supervision.Source: J ILSVRC training with… · p. 22, Table 9 · p. 22

K Experimental Details & Hyperparameters

The experiments specify reproducible classification and detection settings, then define a pm-k detection metric that evaluates nearby frames under a worst-case perturbation.

K Experimental Details & Hyperparameters

L Detection pm-k

  • Detection uses pm-k by replacing each anchor frame with a nearby frame that minimizes per-image average precision.Because category-specific average precision is undefined when categories are absent, minimization uses categories present in each frame rather than mAP.Source: L Detection pm-k · p. 23
  • The standard mAP metric averages category-specific average precision values across categories after classifying predicted boxes using intersection over union.The pm-k variant changes the frame selection step while retaining the detection-evaluation basis.Source: L Detection pm-k · p. 23
Loading 1906.02168v3…