Detect Any Corruption (DAC) Overview

• Detect Any Corruption (DAC) is a multidisciplinary concept focused on identifying integrity violations in data, multimedia, and systems using domain-specific invariants.
• DAC employs methods such as loss-space separation, response inconsistency under perturbations, and execution state equivalence to isolate and mitigate corruption effects.
• Recent implementations demonstrate improved recovery metrics in video restoration, multimodal retrieval, and system reliability, showcasing actionable performance gains.

Detect Any Corruption (DAC) denotes a research objective centered on identifying integrity violations before they silently propagate through a model, a program, a multimedia pipeline, or a distributed system. In current literature the phrase is used explicitly as the name of a visual foundation model-driven corruption localizer for blind bitstream-corrupted video recovery (Liu et al., 30 Jul 2025). Elsewhere, the same expression is best understood as a broader design goal rather than a single standardized framework: corrupted supervision in 2D–3D retrieval, trigger-bearing inputs in backdoored models, corrupted image regions, tampered WebAssembly memory, defective database replicas, and silicon-induced silent data corruptions are all treated as objects whose abnormal behavior must be surfaced, localized, and either corrected or quarantined (Gan et al., 2024, Liu et al., 2023, Mitra et al., 3 Aug 2025).

1. Terminology and scope

The term corruption is domain-dependent. In supervised 2D–3D retrieval, it means a class label that differs from the true semantic class of the object, so that some 2D–3D pairs are mismatched in label space (Gan et al., 2024). In backdoor detection, it denotes a trigger sample that causes a model to emit an attacker-chosen target label at inference time (Liu et al., 2023). In multimedia restoration, it refers to bitstream-domain corruption such as packet loss, syntax corruption, or wrong motion information that produces large irregular pixel-domain artifacts (Liu et al., 30 Jul 2025). In systems work, it often means silent data corruption: incorrect computation or incorrect state without an accompanying crash, exception, or error log (Mitra et al., 3 Aug 2025).

The acronym itself is not semantically uniform. In "DAC: 2D-3D Retrieval with Noisy Labels via Divide-and-Conquer Alignment and Correction" it expands to Divide-and-conquer 2D–3D cross-modal Alignment and Correction, not Detect Any Corruption, although the framework does explicitly detect low-credibility samples and then treat them differently during training (Gan et al., 2024). By contrast, the bitstream-corrupted video paper introduces a model literally named Detect Any Corruption as the detection front-end of a blind recovery pipeline (Liu et al., 30 Jul 2025).

Domain	What counts as corruption	Representative formulation
2D–3D retrieval	Wrong class assignment in multimodal tuples	Credibility modeling over multimodal loss (Gan et al., 2024)
Backdoor detection	Trigger sample at inference time	Corruption robustness consistency under 15 corruptions (Liu et al., 2023)
Image/video restoration	Corrupted spatial regions or bitstream artifacts	Blind mask prediction and corruption embeddings (Feng et al., 2023, Liu et al., 30 Jul 2025)
Compute infrastructure	Silent incorrect computation from defective silicon	In-field testing, diagnosis, and fleet monitoring (Mitra et al., 3 Aug 2025)
Program/database integrity	Tampered memory or divergent replica state	Trace attestation, Merkle roots, replica comparison (Yrievich, 12 May 2026, Utgikar et al., 12 May 2026)
WebAssembly runtime	Corrupted or host-tampered linear memory	CNN classification of memory snapshots (Draissi et al., 25 Mar 2026)

This breadth suggests that DAC is less a single algorithmic family than a recurrent integrity pattern: define a trusted observable, characterize corruption as a deviation in that observable, and then attach mitigation or recovery to the detection result.

2. Recurrent detection primitives

Across the literature, corruption is rarely observed directly. It is inferred from a statistic or invariant that should remain stable for benign executions. One class of methods uses distributional separation. In noisy-label 2D–3D retrieval, Multimodal Dynamic Division constructs a multimodal loss $l_i$, fits a two-component Gaussian Mixture Model, and defines sample credibility as the posterior of the lower-loss component:

$$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$

Samples with $\gamma_i > \alpha$ form a clean set and the rest a noisy set, with $\alpha$ typically set to $0.5$ (Gan et al., 2024).

A second class uses response inconsistency under controlled perturbations. TeCo observes that clean inputs in a backdoored model exhibit similar robustness across corruption types, whereas trigger samples do not. For an input $x$, it records the first corruption severity $L_k(x)$ that flips the hard-label prediction for each corruption type $k$, then uses the dispersion of these severities as an anomaly score:

$$S(x) = \sqrt{\frac{1}{K}\sum_{k=1}^K \big(L_k(x) - \mu(x)\big)^2}, \qquad \mu(x)=\frac{1}{K}\sum_{k=1}^K L_k(x),$$

with $K=15$ corruption types and $$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$0 severity levels (Liu et al., 2023).

A third class uses execution or state equivalence. DME compares canonical instruction traces from independently diversified replicas and treats semantic equality plus structural address-space decorrelation as the correctness criterion. For multi-step masking events, the residual undetected probability is bounded by

$$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$1

while fully correlated program-counter perturbations are deterministically detected when $$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$2 under the paper’s NOP-padding construction (Yrievich, 12 May 2026). In replicated databases, the trusted observable is a Merkleized state commitment rather than an instruction trace; in low-end MCUs it is a PoX-protected output range containing control-flow and data-input logs (Utgikar et al., 12 May 2026, Nunes et al., 2021).

This suggests a general taxonomy of DAC observables: loss-space posteriors, perturbation-response signatures, contrastive embeddings, attested traces, Merkle roots, and replicated values. What changes across domains is not the detection objective but the choice of invariant.

3. Visual and multimedia formulations

In computer vision, DAC is closely tied to corruption localization. The most explicit instance is the blind bitstream-corrupted video recovery framework whose front-end is a Detect Any Corruption model derived from SAM2.1 (Liu et al., 30 Jul 2025). DAC takes corrupted frames $$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$3, motion-vector maps $$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$4, prediction-mode vectors $$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$5, and bitstream cues, and produces both corruption masks

$$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$6

and multi-scale corruption embeddings

$$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$7

The architecture uses a Hiera encoder from SAM2.1, DINOv2 to encode motion-vector maps, token-dictionary cross attention to fuse multi-domain prompts, and downstream Corruption-aware Feature Completion with a mixture-of-residual-experts coordinated by CLIP-derived corruption tokens. On BSCV, the full system improves PSNR from 30.71 to 31.60 on YouTube-VOS and from 26.41 to 28.14 on DAVIS relative to the best non-blind baseline combination reported in the paper; DAC itself reaches mean IoU $$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$8, mean Dice $$\gamma_i = \frac{\pi_1 \mathcal{N}\left(l_i \mid \mu_1, \Sigma_1\right)}{\sum_{t=1}^2 \pi_t \mathcal{N}\left(l_i \mid \mu_t, \Sigma_t\right)}.$$9, mean Accuracy $\gamma_i > \alpha$0, and mean Recall $\gamma_i > \alpha$1 in the best prompt configuration (Liu et al., 30 Jul 2025).

A related but distinct line treats corruption detection as pattern-generalizable segmentation rather than codec-aware prompting. Hierarchical Contrastive Learning first predicts a coarse mask in low-resolution feature space, then refines uncertain regions at higher resolution. Pixel embeddings are clustered by K-means with $\gamma_i > \alpha$2, and the model is trained to separate corrupted and uncorrupted regions by supervised contrastive loss rather than by memorizing corruption textures (Feng et al., 2023). The paper reports strong generalization to unseen corruption patterns such as random constant corruption and CelebA-HQ overlays; on FFHQ with mask ratio $\gamma_i > \alpha$3, it reaches Accuracy $\gamma_i > \alpha$4, F1 $\gamma_i > \alpha$5, and IoU $\gamma_i > \alpha$6, outperforming VCNet (Feng et al., 2023).

The central distinction between these two vision formulations is methodological. The video DAC model uses foundation-model prompting plus bitstream semantics to localize corruption and feed a recovery network. The hierarchical contrastive model uses coarse-to-fine embedding separation to infer corruption masks with no bitstream prior. Both, however, treat corruption as a spatially localized deviation whose mask can be operationalized by restoration.

4. Learning under corrupted supervision and corrupted inputs

In multimodal learning, DAC often means sample credibility estimation plus selective training. The 2D–3D retrieval framework with the DAC acronym divides the problem into Multimodal Dynamic Division and Adaptive Alignment and Correction (Gan et al., 2024). MDD constructs a multimodal loss by combining a fused multimodal classifier with unimodal classification losses, then fits a two-component GMM to estimate credibility. AAC applies contrastive center loss and instance-level alignment differently on the clean and noisy subsets, and uses EMA-smoothed self-correction for the noisy set. The method is evaluated on the new Objaverse-N200 benchmark, which contains about 194,800 3D objects, 1,156 classes, and an estimated realistic noise ratio of about $\gamma_i > \alpha$7. On Objaverse-N200, DAC reaches Img$\gamma_i > \alpha$8Pnt $\gamma_i > \alpha$9 and Pnt$\alpha$0Img $\alpha$1, compared with RONO’s $\alpha$2; under $\alpha$3 symmetric noise on ModelNet40 Img$\alpha$4Pnt it reports $\alpha$5 versus RONO’s $\alpha$6, and under $\alpha$7 symmetric noise $\alpha$8 versus $\alpha$9 (Gan et al., 2024).

A different learning-time formulation is task-driven data verification. CDGD introduces inclusion variables $0.5$0 for each training sample, optimizes them by bilevel gradient descent against a small clean validation set, and treats low-$0.5$1 samples as likely corrupt (Golkar et al., 2019). The outer objective minimizes validation loss after training on weighted noisy data, and the method yields both direct thresholding on $0.5$2 and a retrained classifier variant, CDGD-T. On CIFAR-10 with $0.5$3 label noise, CDGD-T gives about $0.5$4 relative improvement in F1 over the best baseline reported by the paper (Golkar et al., 2019).

At inference time, the emphasis shifts from noisy supervision to corrupted inputs. TeCo operates in the strict black-box, hard-label-only setting and requires neither logits nor extra clean data. It evaluates prediction transition severities under 15 image corruptions and 5 severity levels, then flags inputs with high corruption-robustness inconsistency. Averaged across 5 datasets, 4 architectures, and 7 backdoor attacks, it reports AUROC about $0.5$5 and best F1 about $0.5$6, with a much smaller standard deviation across attacks than STRIP or FreqDetector (Liu et al., 2023).

A more structured decision-theoretic example appears in corrupt-reward reinforcement learning. Spiky CRMDPs assume that the true reward is 1-Lipschitz under a metric $0.5$7, while corrupt states have larger Lipschitz-violation scores than any non-corrupt state. Under that assumption, Algorithm 1 exactly identifies the corrupt set, and learning with the lower reward bound $0.5$8 can recover an optimal policy if an optimal trajectory avoids corrupt states (Mancuso et al., 2019). This is not a general solution to reward corruption, but it shows that DAC becomes tractable once corruption is converted into a separable regularity violation.

5. Systems, hardware, and execution integrity

In systems research, DAC is tightly linked to silent data corruption, state attestation, and replicated comparison. One cross-layer study of compute-chip test escapes estimates around 5,000 defective parts per million over lifetime and about 1,000 DPM for SDC-causing escapes, compared with industrial targets of 100–500 DPM. For one server platform, only $0.5$9 of defective machines are caught in pre-deployment testing; $x$0 are found by post-deployment online or offline testing, $x$1 by system health and forensics, and $x$2 by user-level detection. The same work argues that traditional stuck-at fault models are “grossly inaccurate” for real manufacturing defects and highlights CASP-style in-field scan testing with about $x$3 area, $x$4 power, and $x$5 performance overhead when online testing is enabled (Mitra et al., 3 Aug 2025).

At the database layer, PROTECT-DB uses deterministic PostgreSQL replicas, a shared log, and per-relation Merkle tree indexes to detect and repair state corruption (Utgikar et al., 12 May 2026). Clients compare transaction results by majority, and an explicit compareStates transaction snapshots replicas and groups them by Merkle-root equality. Divergent replicas are repaired by recursive Merkle comparison and row-level delta transfer, then replay the log tail and rejoin the cluster. The paper reports peak throughput around 5,000 YCSB tps on a single node and about 2,500 tps with 4 replicas plus 1 Kafka broker, while recovery on a 1M-row database is measured in seconds rather than full-database copy times (Utgikar et al., 12 May 2026).

At the execution layer, DME uses diversified binaries and canonical instruction traces to detect control- and data-corrupting faults, including fully correlated program-counter or pointer faults that defeat traditional lockstep redundancy (Yrievich, 12 May 2026). DIALED, by contrast, targets low-end MCUs: it logs control-flow plus every non-stack data input to a PoX-protected output range so that the verifier can abstractly replay the operation and detect data-only attacks. On openMSP430, the combined APEX + Tiny-CFA + DIALED design adds 302 LUTs and 44 registers over the baseline core, while DIALED’s incremental software overhead over Tiny-CFA is reported as $x$6 (Nunes et al., 2021, Yrievich, 12 May 2026).

At the application and runtime layers, several works adopt state-centric corruption detection. Walma treats WebAssembly linear memory as an attestation object and classifies snapshots with CNNs; on structured workloads it reaches $x$7 verdict accuracy on flac and pal2rgb, while the coarse-grained Import policy incurs only $x$8 overhead and more frequent monitoring produces $x$9 overhead under the reported configurations (Draissi et al., 25 Mar 2026). In scientific computing, Selective Particle Replication detects DRAM-induced silent data corruptions in Smoothed Particle Hydrodynamics by replicating a dominating set of particles; it reports $L_k(x)$0 detection, no false positives, and $L_k(x)$1 overhead (Cavelan et al., 2019). In binary analysis, UbSym isolates function-level test units and symbolically derives path and vulnerability constraints for heap overflow, stack overflow, use-after-free, and double-free; on the SARD benchmark it reports accuracy, precision, and recall of $L_k(x)$2 across the four targeted classes (Baradaran et al., 2022).

6. Limitations, assumptions, and research trajectory

A persistent misconception is that DAC methods are universal by construction. In practice, most are assumption-heavy. Multimodal noisy-label DAC relies on loss bimodality or at least separable loss statistics; the authors explicitly note that the GMM-based division can break down when noise dominates or is adversarially structured (Gan et al., 2024). CDGD requires a small trusted validation set (Golkar et al., 2019). Spiky CRMDPs require a metric $L_k(x)$3, a 1-Lipschitz true reward, and corruption that manifests as a strong violation outlier (Mancuso et al., 2019). Walma’s accuracy is high only when linear memory has sufficiently structured patterns (Draissi et al., 25 Mar 2026). HCL needs supervised corruption masks during training, even though its inference objective is pattern-generalizable (Feng et al., 2023).

A second limitation concerns trust boundaries. Replicated databases and fleet-scale silicon detection assume that a majority of replicas or machines behave correctly; PROTECT-DB explicitly requires an honest majority, and the test-escape study stresses that most defective machines are discovered only after deployment through system-level observation rather than by any single pre-deployment oracle (Utgikar et al., 12 May 2026, Mitra et al., 3 Aug 2025). Attestation systems such as DIALED assume the hardware root of trust remains uncompromised (Nunes et al., 2021). DME narrows the residual fault class dramatically, but it still cannot detect faults that preserve canonical semantic equivalence across all diversified replicas (Yrievich, 12 May 2026).

A third limitation is semantic ambiguity in the object being protected. TeCo detects trigger samples rather than backdoored models per se; Walma detects anomalous memory states rather than proving which bug caused them; video DAC localizes corruption and improves restoration, but it does not by itself certify the codec semantics of every bitstream artifact. This suggests that DAC is usually a detection-and-localization layer, not a complete proof system.

The research trajectory points toward broader cross-pollination. The bitstream-corrupted video framework already combines SAM2.1, DINOv2, and CLIP in a single corruption-aware pipeline (Liu et al., 30 Jul 2025). The compute-fleet study calls for new test experiments, more principled metrics, and in-field diagnosis directly from incorrect system behavior (Mitra et al., 3 Aug 2025). Walma points toward temporal models over memory snapshots rather than single-snapshot classification (Draissi et al., 25 Mar 2026). Taken together, these works suggest that future DAC systems will likely be hybrid: statistical detectors, explicit structural invariants, replica comparison, and recovery logic coexisting within the same integrity architecture.