{"id":"b421ea28-93e9-4914-b1a2-f38aa4d6fb99","arxiv_id":"2509.09785","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Removing tokens whose embeddings diverge most from a source or CLS-token prototype, selected by output entropy, improves 3D point cloud classification under distribution shift without backpropagation.","lead":"The paper proposes Purge-Gate, a backpropagation-free method that detects and removes corrupted tokens from 3D point cloud inputs before attention layers, improving test-time classification under distribution shift. The reported gains are large on corruption benchmarks, with faster inference and lower memory, which matters for real-time 3D perception systems.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attribution of the reported gains is unestablished: the paper's own BN-reset ablation shows the reset, not token purging, contributes the majority of the improvement.","rationale":"The reader's verdict was CONDITIONAL, and this assessment agrees that the paper should not be accepted without revision. The reader's weakest assumption focused on the theoretical gap between the attention-flattening propositions and the purging rule. That gap is real, but this review finds a more immediately load-bearing issue in the experimental attribution: the paper's own ablation shows that BatchNorm-stat resetting accounts for roughly three quarters of the improvement on ScanObjectNN-C, and that applying the same reset to the main baseline BFTT3D shrinks PG-SP's advantage from +16.13 to +3.37 points. Because the main tables compare against BFTT3D without this reset, the headline gains cannot be cleanly credited to token purging. The supplementary analysis of purge-size dynamics further shows that the fixed Lpg set used at test time is far from the optimum on severe corruptions, which is an internally stated limitation that the main text does not mention. These issues do not refute the method's potential, since the dense purge-size sweeps in the supplement do show real accuracy gains from token removal, but they mean the central claim needs additional experimental support: an explicit Lpg=0-with-reset control and a fair BN-reset-equipped baseline. Therefore the verdict remains CONDITIONAL, with the added condition that the authors isolate the effect of token purging from the effect of the BatchNorm reset.","tokens_in":17686,"tokens_out":6873,"duration_ms":59194,"concrete_test":"Run PG-SP on ScanObjectNN-C, ModelNet-C, and ShapeNet-C with the same BatchNorm reset but force Lpg=0 (no token purging), and run BFTT3D with the same BatchNorm reset. Compare the mean top-1 accuracy across all 15 corruptions, reporting variance over seeds. If the Lpg=0-with-reset condition matches PG-SP within a small margin, or if BFTT3D-with-reset comes within about 2 points of PG-SP, then the token-purging mechanism is not the main driver of the claimed gains and the central claim should be weakened.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that removing high-divergence tokens before attention, with no parameter update, is what drives the reported accuracy gains. However, the method in Section 3.3.2 always couples token purging with a BatchNorm-statistic reset, and the ablation in Fig. 4a shows that on ScanObjectNN-C this reset alone moves PG-SP from 39.86% to 49.13%, i.e., +9.27 of the +12.17 total gain over Source Only. The same reset raises BFTT3D from 33.00% to 45.76%, so a BN-reset-equipped backpropagation-free baseline is only 3.37 points below PG-SP, not the 16.13 points implied by Table 1, where BFTT3D is evaluated without the reset. No table reports the Lpg=0 (no purging) condition with BN reset, so the marginal contribution of purging itself is never isolated. The supplementary figures show large gains from purging on certain corruptions, but those gains require Lpg values roughly 64 to 112, which are outside the fixed set {0,2,4,8,16,32} used at test time; for Background severity 7, the best accuracy reachable in [0,32] is 16% versus 33% near Lpg=112. Thus the headline '+10.3% over state-of-the-art backpropagation-free methods' conflates at least two mechanisms and cannot, on the evidence presented, be attributed to token purging alone.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Purge-Gate (PG), a backpropagation-free test-time adaptation method for 3D point cloud classification. PG identifies tokens whose embeddings are most divergent from a source-domain or CLS-token prototype and removes them before they enter attention layers, with the purge size selected at test time by an unsupervised entropy criterion. Two variants are proposed: PG-SP, which uses source statistics, and PG-SF, which is source-free. The method is evaluated on ModelNet40-C, ShapeNet-C, and ScanObjectNN-C, and also on a Mamba backbone, reporting consistent accuracy gains over backpropagation-free baselines, plus large efficiency advantages (12.4x faster, 5.5x lower memory). The paper also provides a theoretical analysis of how noise flattens attention weights and positions the method as a token-level alternative to fine-tuning-based TTA.","tokens_in":17930,"tokens_out":5754,"duration_ms":49066,"significance":"If the central claim holds, token-level purging is a novel and practically attractive mechanism for backpropagation-free test-time adaptation: it requires no parameter updates, is architecture-agnostic (demonstrated on Transformer and Mamba), and shows substantial gains on several corruption benchmarks. The paper includes useful assets: code, reproduction of baseline methods, ablations of the purge-size schedule and BatchNorm reset, and results on real-world ScanObjectNN variants. However, the headline attribution of the gains to token purging is not currently supported by the evidence because the method always couples purging with a BatchNorm-statistics reset, and the only ablation shows that the reset alone accounts for most of the improvement. The paper also openly acknowledges in the supplementary that its fixed purge-size window is far from optimal for severe corruptions, which weakens the claim that entropy-based selection is a reliable test-time hyperparameter mechanism. The significance of the contribution is therefore contingent on an additional control experiment that isolates the marginal effect of purging.","major_comments":[{"comment":"The reported gains cannot be attributed to token purging because the method always couples purging with a BatchNorm-statistics reset, and the only provided ablation shows that the reset, not purging, drives most of the improvement. On ScanObjectNN-C, PG-SP with BN reset reaches 49.13% versus 39.86% without reset (+9.27), while the same reset moves BFTT3D from 33.00% to 45.76% (+12.76). Table 1 nevertheless compares PG-SP (which includes the reset) against BFTT3D (which does not include the reset), producing a misleading +16.13 point margin. No experiment reports the Lpg=0 condition with BN reset enabled, so the marginal contribution of token purging itself is never isolated. The authors should report (i) the Lpg=0 + BN-reset condition, (ii) BFTT3D with BN reset in all main tables, and (iii) for both methods, results with and without the reset in the same table.","section":"4.4 / Fig. 4a, Table 1"},{"comment":"The paper's own supplementary results show that the fixed candidate purge-size set Lpg={0,2,4,8,16,32} used in all experiments is far from optimal for severe corruptions. For Background corruption at severity 7, Fig. 6b reports that the best accuracy reachable within [0,32] is about 16%, while the true optimum near Lpg=112 reaches about 33%. The main text (Sec. 4.4) claims that the entropy-based selection 'achieves a close to perfect accuracy' and validates it on Background and Distortion, but Fig. 6b explicitly states that severe corruption demands far more aggressive purging than the conventional search window can capture. This is a self-acknowledged limitation of the hyperparameter selection mechanism, and it directly affects the reliability of the reported gains on high-severity corruptions. The authors should either make the candidate set adaptive, or clearly state in the main text that the entropy criterion is restricted to the fixed window and does not generalize to severe shifts.","section":"6.3 / Fig. 6b, Sec. 4.1"},{"comment":"The theoretical analysis does not establish the core mechanism. The propositions in Sec. 3.1 show that noise-dominant tokens push attention weights toward uniform (Eq. (9)), but they do not imply that (i) the tokens with largest divergence from the prototype are the ones causing the degradation, (ii) removing them restores informative attention, or (iii) the entropy of the classification logits is a valid proxy for accuracy when selecting Lpg. Equations (10)-(11), (15), and (19) implement exactly these heuristics, yet the connection to the propositions is not demonstrated. The paper should explicitly frame the divergence-based selection and the entropy criterion as empirical heuristics, and provide supporting evidence (e.g., a per-token attribution analysis) that the most divergent tokens are the harmful ones under common corruptions. As it stands, the method is presented as derived from the theory, which overstates the theoretical support.","section":"3.1-3.2, Eqs. (10)-(19)"},{"comment":"The layer at which purging is applied is ambiguous. The text says tokens are removed 'before they reach the attention layer' and Fig. 2 shows purging at the input of the attention layer, but transformer-based point cloud classifiers contain multiple attention layers. It is not specified whether PG is applied at the first layer only, at every layer, or at a chosen subset. This matters for reproducibility because the source-statistics prototype for PG-SP (Eq. (15)) must be collected from the layer where purging occurs, and the efficiency and accuracy results depend on this choice. The implementation details (Sec. 4.1) do not state the layer placement. Please specify the exact placement and justify it experimentally.","section":"3.2, Fig. 2, Sec. 4.1"}],"minor_comments":[{"comment":"In Eq. (13), the expression for σ_i uses µ^S, which is not defined at that point; it should presumably be µ_i, the per-sample mean from Eq. (12). Equation (14) also uses ϕ_i before defining ϕ.","section":"Eq. (13)"},{"comment":"In Eq. (20), L is used both as the purge-size variable and as the name of the candidate set Lpg, which is confusing. A different symbol (e.g., ℓ) should be used for the candidate values.","section":"Eq. (20)"},{"comment":"The phrase 'reset BatchNorm statistics before each forward pass' is ambiguous: it could mean resetting to stored source statistics or recomputing statistics from the current batch. The following sentence says 'ensuring that it utilizes the current batch statistics', which suggests recomputation, but this should be stated explicitly because it is essential to understanding the method.","section":"3.3.2"},{"comment":"The text says PG-SP surpasses BFTT3D by +16.13% on ScanObjectNN-C, but Fig. 4a shows that BFTT3D with BN reset reaches 45.76% versus PG-SP's 49.13%, a difference of only 3.37 points. The comparison should be presented with the reset condition clearly noted.","section":"4.3"},{"comment":"All results are reported from single runs without error bars or variance estimates. For small differences, such as the ShapeNet-C gains of +2.82 and +3.05, and the Mamba ShapeNet-C result of -0.26, it is unclear whether these are statistically meaningful.","section":"Tables 1-4"},{"comment":"In the paragraph introducing Table 4, 'Table table 4' should be 'Table 4'. Additionally, the description of how ScanObjectNN-C corruptions are generated cites only the ModelNet-C robustness paper; please clarify the specific corruption settings used for ScanObjectNN-C.","section":"4.2, Table 4"}],"recommendation":"major_revision","confidential_remarks":"The central issue is the missing control condition (Lpg=0 with BN reset) that isolates the effect of token purging. This is straightforward to add and, if the results still show a substantial purging-specific gain, the paper would be considerably stronger. The supplementary limitation about the fixed purge-size window is also important; the authors should address it by either expanding the candidate set or acknowledging the restriction in the main text. I recommend major revision rather than rejection because the proposed mechanism is novel and the empirical results, while currently confounded, suggest potential value."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The central claim that token purging drives the reported accuracy gains is not actually established, because Purge-Gate always couples purging with a BatchNorm-statistic reset, and the paper's own ablation shows the reset does most of the work. On ScanObjectNN-C, the reset alone takes PG-SP from 39.86% to 49.13% of the +12.17% total gain, and the same reset lifts the BFTT3D baseline from 33.00% to 45.76%. So when you give the alternative backpropagation-free method the same reset, the advantage of PG shrinks to about 3.4 points, not the 16+ implied by Table 1. No analysis isolates the Lpg=0 condition with reset, which is exactly what is needed to attribute the effect to purging.\n\nWhat is new and legitimately interesting: applying token pruning, previously an efficiency technique, to test-time adaptation is a fresh idea. The source-free variant using the CLS token as a prototype is reasonable, and the entropy-based selection of purge size is a simple practical trick. The experiments cover three corrupted benchmarks, real-world ScanObjectNN variants, and a Mamba backbone, with code; the efficiency numbers (12.4x faster, 5.5x lower memory) are believable.\n\nSoft spots, in proportion. The BN-reset confound is the biggest one. The theoretical propositions (Lipschitz LN, random directions in high dimension) are standard observation and do not justify the claim that the most divergent tokens are the ones to remove. The supplementary Figure 6b shows that on severe Background corruption, the best accuracy possible within the fixed Lpg set {0,2,4,8,16,32} is only 16%, versus 33% near Lpg=112, and this limitation is not flagged in the main text. The paper also reports single runs with no error bars, and the layer placement of the purging gate is under-specified.\n\nI would send this to a serious referee. The core mechanism is simple enough that the missing ablations are easy to write, and the claims are likely sharpenable. As it stands, the paper is a useful starting point for someone working on 3D TTA or token-efficiency tricks, but not a finished demonstration that token purging alone is what delivers the gains.","headline":"The purge idea is fresh and the paper is worth reading, but the reported accuracy gains are largely a batch-norm reset effect, not token purging alone.","tokens_in":18520,"tokens_out":5008,"would_cite":true,"duration_ms":411878,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that deleting the tokens whose embeddings diverge most from a reference prototype, before they enter attention layers, adapts a point-cloud classifier to test-time corruption with no gradient updates, and reports it…","keywords":["point cloud classification","test-time adaptation","token purging","backpropagation-free","domain shift","attention mechanism","transformer","source-free adaptation"],"falsifier":"Run Purge-Gate against a control that removes the same number of tokens at random on a corruption the method was not tuned for; if random removal matches or beats divergence-based purging, the central claim is false. A second test: attach the discriminative signal specifically to tokens with the largest deviation (for example, a rare geometric feature that also shifts statistics); if purging those tokens consistently hurts accuracy, divergence does not identify harmful tokens.","tokens_in":17435,"feed_emoji":"🧹","tokens_out":10038,"duration_ms":76108,"temperature":0.7,"pith_summary":"The paper tries to establish that a point-cloud classification transformer can be made resilient to test-time corruption without any gradient updates, by deleting the tokens whose embeddings lie farthest from a reference prototype before they reach the attention layers. The authors argue that corrupted tokens flatten attention weights toward a uniform distribution, so removing them restores the model's ability to aggregate informative features. They report that this 'token purging' outperforms existing backpropagation-free test-time adaptation methods by an average of 10.3 accuracy points on ModelNet40-C, ShapeNet-C, and ScanObjectNN-C, and that a fully source-free variant performs nearly as well. If correct, the result matters because it turns test-time adaptation into a single cheap forward pass, with no optimizer, no fine-tuning, and no source data, which is practical for real-time 3D perception.","feed_headline":"Token purging lifts shifted point-cloud accuracy 10.3 points","feed_subtitle":"A no-training gate deletes corrupted tokens before attention, beating gradient-free TTA with less memory.","key_machinery":"The purge gate is a parameter-free, per-layer filter that ranks tokens by a divergence measure $\\Delta(\\mathbf{X}^T_j, G)$ against a prototype $G$, discards the top $L_{\\mathrm{pg}}$ tokens before they enter self-attention, and keeps the rest. For PG-SP the prototype is the source embedding mean/variance pair and $\\Delta$ is the Mahalanobis distance; for PG-SF the prototype is the CLS token mapped through the query projection and $\\Delta$ is cosine distance in key space. The mechanism is motivated by two propositions: heavy noise makes per-token embeddings nearly orthogonal after LayerNorm, driving attention scores toward zero and softmax weights toward uniform, so attention stops concentrating on informative tokens. Because the gate is applied before attention, it repairs the input stream rather than updating weights. The only hyperparameter, the purge size $L_{\\mathrm{pg}}$, is chosen at test time by running the model for a small set of purge sizes and keeping the output with minimum entropy, and BatchNorm statistics are reset per forward pass.","core_discovery":"On the paper's terms, the central discovery is that domain shift in point cloud transformers can be countered at the token level: compute a per-token divergence from a prototype, delete the most divergent tokens at the input of each attention layer, and the model classifies corrupted point clouds more accurately. Two prototypes are proposed. PG-SP stores source-domain mean and variance statistics, gathered with Welford's online algorithm or inside a modified LayerNorm, and ranks tokens by Mahalanobis distance. PG-SF needs no source data: it uses the CLS token (projected to the query space) as the prototype and ranks tokens by cosine distance in the key space. The paper reports that PG-SP beats prior backpropagation-free TTA methods by an average of 10.3 accuracy points across three corrupted benchmarks, that PG-SF is the strongest source-free variant, and that both run 12.4 times faster and use 5.5 times less memory than the previous no-backprop baseline.","pith_inferences":["If the divergence-to-harm link is as general as the paper suggests, the same gate should transfer to 2D vision transformers under common corruptions, where a few background or texture patches play the role of corrupted tokens; the paper does not test this.","The supplementary sweeps reveal that for severe background corruption the optimal purge size lies near $L_{\\mathrm{pg}}\\approx112$, far outside the $\\{0,2,4,8,16,32\\}$ search window, so an adaptive or severity-aware purge size could extend the reported gains.","The theory predicts uniform attention under heavy noise; a direct test would be to measure attention entropy before and after purging and check that the restored non-uniformity tracks accuracy, which the paper does not report.","PG-SF's CLS-token prototype could be combined with per-class prototypes to handle partial domain shifts where the global prototype is skewed, an extension the paper leaves open."],"forward_implications":["Test-time adaptation for point cloud transformers reduces to a single forward pass with no parameter updates, so it is deployable in latency- and memory-constrained 3D perception systems.","The same purge gate transfers to state-space backbones (PointMamba), lifting mean accuracy on ScanObjectNN-C and ModelNet-C, so the mechanism is not tied to transformer attention itself.","Resetting BatchNorm statistics is part of the recipe: on ScanObjectNN-C, PG-SP's accuracy drops from 49.13% to 39.86% without the reset, so normalization statistics carry much of the adaptation signal.","An entropy-based selection over a sparse set of purge sizes $\\{0,2,4,8,16,32\\}$ is enough to approach the accuracy of an exhaustive purge-size search, avoiding per-corruption tuning.","The source-free variant PG-SF shows that a single CLS-token prototype can stand in for stored source statistics, removing the need for source data at test time."],"supporting_citations":[{"why":"Supplies the pretrained PointMAE model and the Masked-Autoencoder test-time-training baseline that Purge-Gate is compared against on the same corruptions.","marker":"Mirza et al. [2023]"},{"why":"The prior backpropagation-free TTA method whose accuracy, speed, and memory Purge-Gate claims to outperform.","marker":"Wang et al. [2024a]"},{"why":"Introduces token pruning for transformers, the efficiency idea Purge-Gate repurposes from 'uninformative tokens' to 'domain-shifted tokens'.","marker":"Kim et al. [2022]"},{"why":"Provides the PointMAE tokenization scheme and pretrained backbone used in all main experiments.","marker":"Pang et al. [2022]"},{"why":"Provides the PointMamba state-space backbone on which Purge-Gate shows transfer.","marker":"Liang et al. [2024]"},{"why":"Documents that the CLS token absorbs domain information, the premise behind the source-free PG-SF prototype.","marker":"Zou et al. [2024]"},{"why":"Defines BatchNorm, whose statistics reset is shown to be crucial for the reported gains.","marker":"Ioffe and Szegedy [2015]"},{"why":"Defines the ModelNet40-C corruption benchmark with 15 shift types used for evaluation.","marker":"Sun et al. [2022]"},{"why":"Provides ShapeNetCore-v2, the basis of the ShapeNet-C benchmark.","marker":"Chang et al. [2015]"},{"why":"Provides the real-world ScanObjectNN dataset and its corrupted ScanObjectNN-C variant.","marker":"Uy et al. [2019]"}],"fun_headline_variants":["No-backprop token purge lifts point cloud accuracy 10.3%","Purge-Gate: drop shifted tokens, boost TTA 10.3% and 12x speed","Token purging: backprop-free TTA, 5.5x less memory, +10.3%","Purge bad tokens: point cloud TTA gains 10.3 accuracy points"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method rests on the premise that the tokens whose embeddings are farthest from a source or CLS-token prototype are the very tokens whose removal improves accuracy under domain shift; the theory shows heavy noise flattens attention, but it does not prove that the most divergent tokens are the harmful ones, so the effectiveness of the purge is an empirical heuristic.","fun_headline_variants_meta":{"raw":{"variants":["No-backprop token purge lifts point cloud accuracy 10.3%","Purge-Gate: drop shifted tokens, boost TTA 10.3% and 12x speed","Token purging: backprop-free TTA, 5.5x less memory, +10.3%","Purge bad tokens: point cloud TTA gains 10.3 accuracy points"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000244,"raw_usage":{"total_tokens":1538,"prompt_tokens":959,"completion_tokens":579,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":575,"completion_tokens_details":{"reasoning_tokens":481}},"tokens_in":575,"tokens_out":579,"duration_ms":4646,"temperature":1.0,"reasoning_tokens":481,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:59:18.169041+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Purge-Gate against a control that removes the same number of tokens at random on a corruption the method was not tuned for; if random removal matches or beats divergence-based purging, the central claim is false. A second test: attach the discriminative signal specifically to tokens with the largest deviation (for example, a rare geometric feature that also shifts statistics); if purging those tokens consistently hurts accuracy, divergence does not identify harmful tokens.","supporting_citations":[],"review_version":2}