pith. sign in

arxiv: 2606.21791 · v1 · pith:7Q4GJCCHnew · submitted 2026-06-19 · 💻 cs.GR · cs.DC

Single-Event Upsets in 3D Gaussian Splatting Rendering: Bit-Level Criticality, Spatial Extent, and a Parallel Support Guard

Faruk Alpay , Baris Basaran This is my paper

Pith reviewed 2026-06-26 12:16 UTC · model grok-4.3

classification 💻 cs.GR cs.DC
keywords single-event upsetsGaussian splattingfault injectionGPU renderingbit flipsradiation hardening3D reconstruction
0
0 comments X

The pith

A per-primitive clamp prevents bit flips in 3D Gaussian splatting from expanding primitives to cover most of a frame.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper examines the impact of single-event upsets, or single bit flips, on the floating-point parameters of trained 3D Gaussian splatting models used for real-time rendering. Experiments with millions of controlled bit flips across multiple scenes and numeric formats show that effects are highly concentrated, with most upsets causing no perceptible change but certain high-order bits able to enlarge one primitive to cover 75.7 percent of the frame. The authors derive a closed-form bound predicting this sensitivity and introduce a support guard that clamps parameters to their training ranges. This low-cost guard limits the maximum corruption to 11.68 percent of the frame, preserves correct renderings, and maintains better image quality under thousands of simultaneous upsets.

Core claim

The support guard restricts the corruption footprint of bit upsets in Gaussian splatting renderers. By clamping each parameter to the coordinate box observed during training, the guard ensures that no single upset can cause a primitive to cover more than 11.68% of the frame, while leaving fault-free renderings identical to the unguarded case. Under an accumulated dose of 20,000 simultaneous upsets, the guarded renderer achieves 21.8 dB PSNR compared to 10.6 dB without the guard.

What carries the argument

The support guard, a per-primitive clamp of each Gaussian parameter to the coordinate box observed during training, which bounds the spatial extent of any corrupted primitive.

If this is right

  • The guard prevents frame-covering corruption from bit upsets.
  • The maximum corruption footprint is reduced to 11.68% of the frame.
  • Under 20,000 simultaneous upsets, PSNR remains at 21.8 dB instead of degrading to 10.6 dB.
  • The guard adds only 76 microseconds per frame and works across fp32, fp16, and bf16 formats.
  • In distributed renderers, the per-node guard contains contamination to fewer tile and compositing nodes.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Similar clamping strategies might protect other neural scene representations against memory faults.
  • The identified bit criticality ordering could guide selective error correction or hardening of specific parameters.
  • Deployments in radiation-prone environments like space could use this guard to extend hardware lifetime without full radiation hardening.

Load-bearing premise

Clamping parameters to the training coordinate box is sufficient to prevent large primitive expansions from bit upsets without causing artifacts in normal operation.

What would settle it

A test rendering a model with a guarded bit flip in the sign bit of a scale parameter that still expands a primitive beyond the clamped box would falsify the guard's effectiveness.

Figures

Figures reproduced from arXiv: 2606.21791 by Baris Basaran, Faruk Alpay.

Figure 1
Figure 1. Figure 1: Mean corruption footprint (fraction of pixels changed by more than one 8-bit level, [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Effect of one bit. From left: the clean render; a single scale sign-bit upset on one primitive, [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: (a) Measured peak image error versus mantissa bit index for the scale field ( [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: (a) Global render quality versus the number of simultaneous single-bit upsets: thin [PITH_FULL_IMAGE:figures/full_fig_p011_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Redundancy budget (left axis, simultaneous upsets to reach [PITH_FULL_IMAGE:figures/full_fig_p012_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: A single scale sign-bit upset on the real-world Tanks-and-Temples [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Sort-first distributed rendering with the node-local support guard. The guard (Algorithm 1) [PITH_FULL_IMAGE:figures/full_fig_p014_7.png] view at source ↗
read the original abstract

Three-dimensional Gaussian splatting is a standard real-time scene representation increasingly deployed on hardware exposed to transient faults, such as spaceborne processors and robotic edge devices where silent data corruption occurs. A trained model is a large array of floating-point parameters in GPU memory, where a single-event upset corresponds to a single flipped bit. This paper measures these effects and constructs a defense. A GPU-resident parallel fault-injection engine applies over 3.8 million controlled single-bit upsets across four scenes, six fields, all bit positions, and three numeric formats (fp32, fp16, bf16), using 5.3 GPU-hours. The effect is highly concentrated: most upsets leave the image perceptually unchanged due to high redundancy, but a small set of high-order bits principally the logarithmic scale's sign bit enlarge a single primitive to cover up to 75.7% of the frame. A closed-form perturbation bound derived from the IEEE-754 layout and pipeline activations predicts this per-bit ordering. This concentration motivates a support guard: a per-primitive clamp of each parameter to the coordinate box observed during training, costing 76 us per frame. Over 768,000 guarded upsets, the worst corruption footprint is restricted to 11.68% of the frame. We prove the guard leaves clean models unchanged and prevents frame-covering corruption. Under an accumulated dose of 20,000 simultaneous upsets, the unguarded renderer degrades to 10.6 dB, whereas the guarded renderer remains at 21.8 dB. The corruption footprint also dictates the number of tile/compositing nodes contaminated in distributed renderers, where the per-node guard contains it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper examines the effects of single-event upsets on 3D Gaussian Splatting renderers via large-scale GPU fault injection (3.8M upsets, 5.3 GPU-hours across four scenes, six fields, fp32/fp16/bf16). It reports that most bit flips have negligible perceptual impact due to redundancy, but high-order bits (especially the sign bit of the logarithmic scale) can expand a single primitive to cover up to 75.7% of the frame. A closed-form bound derived from IEEE-754 layout predicts the per-bit criticality ordering. The authors propose a support guard (per-primitive clamp of parameters to the training-observed coordinate box, 76 µs/frame overhead) and prove that it leaves clean models unchanged while restricting worst-case corruption to 11.68% of the frame. Under 20k simultaneous upsets the guarded renderer maintains 21.8 dB PSNR versus 10.6 dB unguarded; the guard also limits contamination in distributed tile/compositing pipelines.

Significance. If the guard proof holds, the work supplies a practical, low-cost defense for deploying Gaussian splatting on radiation-exposed or edge hardware. The scale of the fault-injection campaign, the closed-form perturbation bound, and the explicit proof of the guard's no-op and bounding properties are concrete strengths that would be valuable to the graphics and reliable-computing communities.

major comments (2)
  1. [Proof of guard correctness / Abstract] The proof that the support guard 'leaves clean models unchanged' (Abstract and the dedicated proof section) rests on the clamp to the training coordinate box being the identity operation on every original parameter. The manuscript does not specify whether the box is the axis-aligned min/max over all scene means or computed per-primitive, nor its exact relationship to the covariance-to-scale conversion step. If any training mean lies exactly on a box boundary, or if the box is scene-wide rather than per-primitive, a bit flip in the exponent or sign can still produce an expansion while violating the no-op property required by the proof.
  2. [Experimental results / Guard evaluation] The claim that the guard restricts the worst corruption footprint to 11.68% of the frame (Abstract, results on 768k guarded upsets) is load-bearing for the practical defense argument. The text does not report the distribution of footprint sizes, the precise definition of 'frame-covering corruption,' or how many upsets were excluded from the 'perceptually unchanged' category; without these, it is impossible to verify that the bound is tight enough to prevent the 75.7% expansions observed in the unguarded case.
minor comments (2)
  1. [Abstract] The abstract states a 'closed-form perturbation bound' but does not cross-reference the specific equation or derivation section; adding the reference would improve traceability.
  2. [Implementation / Performance] The reported 76 µs per-frame overhead for the guard should include a breakdown of memory-access cost versus arithmetic cost on the target GPU to allow readers to assess portability.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the detailed and constructive comments. We address each major comment point-by-point below with clarifications based on the manuscript and indicate revisions to improve clarity and verifiability.

read point-by-point responses

  1. Referee: [Proof of guard correctness / Abstract] The proof that the support guard 'leaves clean models unchanged' (Abstract and the dedicated proof section) rests on the clamp to the training coordinate box being the identity operation on every original parameter. The manuscript does not specify whether the box is the axis-aligned min/max over all scene means or computed per-primitive, nor its exact relationship to the covariance-to-scale conversion step. If any training mean lies exactly on a box boundary, or if the box is scene-wide rather than per-primitive, a bit flip in the exponent or sign can still produce an expansion while violating the no-op property required by the proof.

    Authors: The coordinate box is the scene-wide axis-aligned bounding box computed from the min/max of all training means and applied per-primitive to clamp each Gaussian's parameters (including the logarithmic scales). By construction, every original training parameter lies inside or on the boundary of this box, so the clamp is exactly the identity operation on clean models; values exactly on the boundary are unchanged. The guard is applied to the stored parameters before the covariance-to-scale conversion in the rendering pipeline, and the dedicated proof section explicitly uses this ordering. We will revise the manuscript to state these details explicitly, including boundary handling, to remove any ambiguity. revision: yes

  2. Referee: [Experimental results / Guard evaluation] The claim that the guard restricts the worst corruption footprint to 11.68% of the frame (Abstract, results on 768k guarded upsets) is load-bearing for the practical defense argument. The text does not report the distribution of footprint sizes, the precise definition of 'frame-covering corruption,' or how many upsets were excluded from the 'perceptually unchanged' category; without these, it is impossible to verify that the bound is tight enough to prevent the 75.7% expansions observed in the unguarded case.

    Authors: We agree that additional statistics would strengthen verifiability of the 11.68% maximum. This value is the largest footprint observed across the full set of 768,000 guarded upsets. We will revise the results section and add supplementary material with (1) the distribution (histogram and CDF) of all footprint sizes under the guard, (2) the precise definition of frame-covering corruption used (pixels whose rendered color deviates by more than a fixed perceptual threshold from the clean image), and (3) the count of upsets classified as perceptually unchanged. These data will confirm that the guard eliminates the large expansions seen in the unguarded experiments. revision: yes

Circularity Check

1 steps flagged

Guard 'leaves clean models unchanged' holds by definition of training-box clamp; experiments otherwise independent

specific steps
  1. self definitional [Abstract]
    "We prove the guard leaves clean models unchanged and prevents frame-covering corruption."

    The guard is defined earlier in the same paragraph as 'a per-primitive clamp of each parameter to the coordinate box observed during training'. Because the box is constructed from the training observations themselves, every original parameter is inside the box by definition; the 'leaves clean models unchanged' property therefore follows immediately from the definition of the clamp without further derivation or external justification.

full rationale

The paper's central proof claim reduces in part to a definitional property of the guard. The support guard is introduced as a per-primitive clamp to the coordinate box observed during training; therefore any original training parameter lies inside the box by construction and the clamp is a no-op on clean models. This satisfies the self-definitional pattern for the 'leaves clean models unchanged' half of the proof. The remainder of the work (3.8 M fault injections, closed-form IEEE-754 bound, measured 11.68 % footprint under guard, PSNR numbers) consists of direct experimental measurements that do not reduce to the same definition. No self-citations, fitted predictions, or ansatz smuggling appear in the provided text. The circularity is therefore limited to one load-bearing definitional step inside an otherwise empirical derivation chain.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

Based solely on abstract; the perturbation bound relies on standard IEEE-754 representation, and the support guard is introduced as a new construct without independent evidence beyond the paper's claims.

axioms (1)
  • standard math IEEE-754 floating point bit layout determines perturbation effects
    Invoked for the closed-form bound predicting per-bit ordering.
invented entities (1)
  • support guard no independent evidence
    purpose: Per-primitive clamp to training coordinate box to limit bit-upset corruption
    New mechanism proposed and claimed to be proven effective in the abstract.

pith-pipeline@v0.9.1-grok · 5851 in / 1552 out tokens · 36202 ms · 2026-06-26T12:16:59.621741+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

24 extracted references

  1. [1]

    Radiation-induced soft errors in advanced semiconductor technologies

    Robert C Baumann. Radiation-induced soft errors in advanced semiconductor technologies. IEEE Transactions on Device and Materials Reliability, 5(3):305–316, 2005

    2005

  2. [2]

    Silent data corruptions at scale.arXiv preprint arXiv:2102.11245, 2021

    Harish Dattatraya Dixit, Sneha Pendharkar, Matt Beadon, Chris Mason, Tejasvi Chakravarthy, Bharath Muthiah, and Sriram Sankar. Silent data corruptions at scale.arXiv preprint arXiv:2102.11245, 2021

    arXiv 2021

  3. [3]

    Code-dependent and architecture-dependent reliability behaviors

    Vinicius Fratin, Daniel Oliveira, Caio Lunardi, Fernando Santos, Gennaro Rodrigues, and Paolo Rech. Code-dependent and architecture-dependent reliability behaviors. InIEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2018

    2018

  4. [4]

    Towards a safety case for hardware fault tolerance in convolutional neural networks using activation range supervision.arXiv preprint arXiv:2108.07019, 2021

    Florian Geissler, Syed Qutub, Sumanta Roychowdhury, Ali Asgari, Yang Peng, Akash Dhamasia, Ralf Graefe, Karthik Pattabiraman, and Michael Paulitsch. Towards a safety case for hardware fault tolerance in convolutional neural networks using activation range supervision.arXiv preprint arXiv:2108.07019, 2021

    arXiv 2021

  5. [5]

    SASSIFI: An architecture-level fault injection tool for GPU application resilience evaluation

    Siva Kumar Sastry Hari, Timothy Tsai, Mark Stephenson, Stephen W Keckler, and Joel Emer. SASSIFI: An architecture-level fault injection tool for GPU application resilience evaluation. In IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS), 2017

    2017

  6. [6]

    Cores that don’t count

    Peter H Hochschild, Paul Turner, Jeffrey C Mogul, Rama Govindaraju, Parthasarathy Ran- ganathan, David E Culler, and Amin Vahdat. Cores that don’t count. InWorkshop on Hot Topics in Operating Systems (HotOS), 2021

    2021

  7. [7]

    Algorithm-basedfaulttoleranceformatrixoperations

    Kuang-HuaHuangandJacobAAbraham. Algorithm-basedfaulttoleranceformatrixoperations. IEEE Transactions on Computers, C-33(6):518–528, 1984

    1984

  8. [8]

    IEEE standard for floating-point arithmetic.IEEE Std 754-2019, 2019

    IEEE. IEEE standard for floating-point arithmetic.IEEE Std 754-2019, 2019

    2019

  9. [9]

    3d gaussian splatting for real-time radiance field rendering.ACM Transactions on Graphics, 42(4), 2023

    Bernhard Kerbl, Georgios Kopanas, Thomas Leimkühler, and George Drettakis. 3d gaussian splatting for real-time radiance field rendering.ACM Transactions on Graphics, 42(4), 2023

    2023

  10. [10]

    Understanding error propagation in deep learning neural network (DNN) accelerators and applications

    Guanpeng Li, Siva Kumar Sastry Hari, Michael Sullivan, Timothy Tsai, Karthik Pattabiraman, Joel Emer, and Stephen W Keckler. Understanding error propagation in deep learning neural network (DNN) accelerators and applications. InInt. Conference for High Performance Computing, Networking, Storage and Analysis (SC), 2017. 18

    2017

  11. [11]

    Fault injection attack on deep neural network

    Yannan Liu, Lingxiao Wei, Bo Luo, and Qiang Xu. Fault injection attack on deep neural network. InIEEE/ACM International Conference on Computer-Aided Design (ICCAD), 2017

    2017

  12. [12]

    PyTorchFI: A runtime perturbation tool for DNNs

    Abdulrahman Mahmoud, Neeraj Aggarwal, Alex Nobbe, Jose Rodrigo Sanchez Vicarte, Sarita V Adve, Christopher W Fletcher, Iuri Frosio, and Siva Kumar Sastry Hari. PyTorchFI: A runtime perturbation tool for DNNs. InIEEE/IFIP Int. Conf. on Dependable Systems and Networks Workshops (DSN-W), 2020

    2020

  13. [13]

    Gaussian splatting SLAM

    Hidenobu Matsuki, Riku Murai, Paul H J Kelly, and Andrew J Davison. Gaussian splatting SLAM. InIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024

    2024

  14. [14]

    NeRF: Representing scenes as neural radiance fields for view synthesis

    Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. NeRF: Representing scenes as neural radiance fields for view synthesis. In European Conference on Computer Vision (ECCV), 2020

    2020

  15. [15]

    A sorting classification of parallel rendering.IEEE Computer Graphics and Applications, 14(4):23–32, 1994

    Steven Molnar, Michael Cox, David Ellsworth, and Henry Fuchs. A sorting classification of parallel rendering.IEEE Computer Graphics and Applications, 14(4):23–32, 1994

    1994

  16. [16]

    Morgan Kaufmann, 2008

    Shubu Mukherjee.Architecture Design for Soft Errors. Morgan Kaufmann, 2008

    2008

  17. [17]

    Single event upset at ground level.IEEE Transactions on Nuclear Science, 43(6):2742–2750, 1996

    Eugene Normand. Single event upset at ground level.IEEE Transactions on Nuclear Science, 43(6):2742–2750, 1996

    1996

  18. [18]

    Evaluation and mitigation of radiation-induced soft errors in graphics processing units.IEEE Transactions on Computers, 65(3):791–804, 2016

    Daniel A G de Oliveira, Laercio L Pilla, Thiago Santini, and Paolo Rech. Evaluation and mitigation of radiation-induced soft errors in graphics processing units.IEEE Transactions on Computers, 65(3):791–804, 2016

    2016

  19. [19]

    Bit-flip attack: Crushing neural network with progressive bit search

    Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Bit-flip attack: Crushing neural network with progressive bit search. InIEEE/CVF International Conference on Computer Vision (ICCV), 2019

    2019

  20. [20]

    Ares: A framework for quantifying the resilience of deep neural networks

    Brandon Reagen, Udit Gupta, Lillian Pentecost, Paul Whatmough, Sae Kyu Lee, Niamh Mulholland, David Brooks, and Gu-Yeon Wei. Ares: A framework for quantifying the resilience of deep neural networks. InDesign Automation Conference (DAC), 2018

    2018

  21. [21]

    NVBitFI: Dynamic fault injection for GPUs

    Timothy Tsai, Siva Kumar Sastry Hari, Michael Sullivan, Xinghua Li, and Stephen W Keckler. NVBitFI: Dynamic fault injection for GPUs. InIEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2021

    2021

  22. [22]

    Image quality assessment: From error visibility to structural similarity.IEEE Transactions on Image Processing, 13(4):600– 612, 2004

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: From error visibility to structural similarity.IEEE Transactions on Image Processing, 13(4):600– 612, 2004

    2004

  23. [23]

    gsplat: An open-source library for Gaussian splatting.arXiv preprint arXiv:2409.06765, 2024

    Vickie Ye, Ruilong Li, Justin Kerr, Matias Turkulainen, Brent Yi, Zhuoyang Pan, Otto Seiskari, Jianbo Ye, Jeffrey Hu, Matthew Tancik, and Angjoo Kanazawa. gsplat: An open-source library for Gaussian splatting.arXiv preprint arXiv:2409.06765, 2024

    arXiv 2024

  24. [24]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. InIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2018. 19 A Proofs Proof of Lemma 1.Write a normal value asθ= (−1)ϵ2e(1+m)with m =∑p k=1mk2−k,mk∈{0, 1}, and exponent fieldE = e + bias...

    2018