Pith. sign in

REVIEW 2 major objections 6 minor 56 references

R.I.P.: A Simple Black-box Attack on Continual Test-time Adaptation

T0 review · 2 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Continual TTA models can be collapsed by replaying their own misclassified samples, the paper claims.

desk verdict A simple, credible black-box degradation attack on continual TTA with solid ablations, but the 'collapse' claim outruns the reported metric. read the letter →

arxiv 2412.01154 v1 pith:ENRZWMDM submitted 2024-12-02 cs.LG cs.AI

Trung-Hieu Hoang , Duc Minh Vo , Minh N. Do This is my paper · ORCID
classification cs.LGcs.AI
keywords continualtest-timeadaptationblack-boxattackmodelcollapsedataaugmentationpseudo-labelmean-teacheradversarialGaussianmixture
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper's central claim is that a continual test-time adaptation (TTA) model can be degraded to the point of collapse by a simple black-box procedure: repeatedly feed back samples that the model previously misclassified, all from a single chosen victim class. Because modern TTA methods adapt by fitting pseudo-labels on randomly augmented test images, these replayed mistakes are treated as ground truth; with enough rounds the decision boundary shifts until the victim class receives almost no correct predictions. The paper first establishes this mechanism in a Gaussian mixture model with additive noise, then reports that it degrades several recent continual TTA methods across CIFAR-10-C, CIFAR-100-C, and ImageNet-C. If the claim is correct, any deployed TTA system that uses random augmentation is exposed to an attacker who needs only a small labeled dataset and no access to model parameters, gradients, or the ability to modify test images.

What carries the argument

The central object is the GMMC+AWGN model, a Gaussian Mixture Model Classifier in which the random augmentation operator is represented as additive white Gaussian noise; this toy model is where the paper derives the collapse condition. The key mechanism is the shifting-boundary effect: augmented variants of a misclassified sample pull the updated decision boundary toward that sample, and repeated reuse of such points from one victim class lets nearby classes penetrate the victim's region until predictions for that class vanish. The RIP algorithm operationalizes this by maintaining a buffer of the victim class's misclassified samples and inserting them into each new test batch, letting the TTA model's own pseudo-labels amplify the error. The paper also shows that student-model pseudo-labels, stronger augmentation, and faster EMA updates aggravate the effect.

What would settle it

Run RIP on CIFAR-10-C with a continual TTA method that uses random augmentation, and track the victim class's accuracy step by step with augmentation enabled versus disabled. The claimed mechanism predicts a collapse toward zero only in the augmentation-enabled run; if the victim class accuracy falls to zero in both runs, or stays bounded in the augmentation-enabled run, the two-condition story is not the whole truth.

Watch

Extended reading notes

Core claim

The discovery is a two-condition mechanism for TTA collapse. Using an extended Gaussian Mixture Model Classifier with additive white Gaussian noise (GMMC+AWGN) in place of a deep TTA model with stochastic augmentation, the paper identifies Incorrect Prediction Sampling (IPS): drawing only samples from a victim class that the current model predicts incorrectly. When IPS is combined with an augmentation operator, the decision boundary around the victim class is progressively invaded by neighboring classes because augmented variants of mispredicted samples receive erroneous pseudo-labels and the adaptation step makes the model more confident in those labels. Numerical simulation on GMMC shows collapse only when both conditions hold; removing either prevents it. The authors then propose RIP as the first black-box TTA attack: with a labeled attack dataset, keep the set of misclassified samples from one victim class and reuse them in each subsequent testing batch. Benchmarks on seven continual TTA methods show error increases on all studied corruption benchmarks, with augmentation-heavy methods suffering the most and the augmentation-free method (EATA) and teacher-pseudo-label method (CoTTA) showing the most resilience.

Load-bearing premise

The load-bearing premise is that the simplified probabilistic model with added white noise behaves like a real deep model that randomly perturbs images; if that analogy breaks, the claimed collapse conditions may not transfer to the systems the attack targets.

Editorial extensions

If this is right

  • Removing the augmentation operator removes the collapse condition, but the paper's ablations indicate that this also removes much of TTA's adaptation gain.
  • Slowing the teacher update rate reduces but does not eliminate RIP damage; among the defenses tested (source replay, contrastive loss, source ensemble) none fully removes the risk.
  • TTA methods that predict pseudo-labels from the teacher model, or that avoid augmented losses entirely, are markedly more resilient to RIP.
  • The vulnerability persists across CIFAR-10-C, CIFAR-100-C, and ImageNet-C and across different corruption types used as the attacker's labeled set, so it is not an artifact of one benchmark.
  • Because collapse is defined as an absorbing state in the paper's framework, a victim model does not recover on its own and must be reset to source parameters.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same self-reinforcing loop should transfer beyond images: any adaptation pipeline that trains on augmented versions of its own soft or hard labels may be collapsible by replaying inputs it already gets wrong, which is a testable extension the authors do not run.
  • A deployment-level countermeasure the paper does not consider is query deduplication: an API could detect that a submitted sample was already answered and exclude it from the adaptation stream, which would break the replay loop at the cost of some adaptation signal.
  • The ablation result that stronger augmentation leads to more damage suggests augmentation strength can be treated as a security parameter; choosing the strongest augmentation for accuracy may conflict with resilience, and a quantitative trade-off curve is not provided.
  • A natural relaxation, noted but not implemented in the paper, is a variant that uses model confidence rather than true labels to select replay samples; if it worked, the attack would not need any labeled dataset.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper introduces RIP, a black-box attack against continual test-time adaptation (TTA). It extends the GMMC model of [17] with additive white Gaussian noise (Eq. 11) and argues, through the Incorrect Prediction Sampling (IPS) mechanism, that reusing a victim class's misclassified samples under random augmentation shifts decision boundaries and can collapse the model. Algorithm 1 accumulates incorrectly predicted samples from a labeled auxiliary set Da and replays them in subsequent batches. The paper compares RIP with white-box TTA attacks, reports experiments on CIFAR-10-C, CIFAR-100-C, and ImageNet-C for seven TTA methods, and presents ablations on loss, augmentation level, pseudo-label generator, EMA rate, and two simple defenses.

Significance. If the collapse claim held, RIP would be a notable practical threat because it requires no model parameters, no sample modification, and no source data; the attack is simple enough to be deployed by a non-expert. The empirical scope is a strength: seven TTA methods with standard checkpoints and default hyperparameters, repeated over 10 trials with varied victim classes, and the ablations in Sec. 6 isolate augmentation, pseudo-label source, and EMA rate as relevant factors. However, the evidence currently supports a degradation attack rather than the Definition-1 collapse attack that the paper advertises, and the GMMC+AWGN bridge to deep image augmentation is only visual. With the requested direct measurements and a qualified statement of scope, the contribution would be solid; as written, the central claim outruns the reported metrics.

major comments (2)
  1. [Sec. 4.1, Definition 1; Sec. 5.2, Table 2; Fig. 6; Appendix B.1] The reported metrics do not measure the quantity that Definition 1 defines. Definition 1 concerns the marginal probability Pr(hat Y_t in tilde Y) converging to zero, whereas Table 2 reports average class-wise testing error and Fig. 6 reports, per its caption, the average of the worst category-wise testing error, i.e., a class-conditional recall. A class can have 100% testing error while still being predicted as a false positive on other inputs, so a high error does not imply Pr(hat Y_t in tilde Y) -> 0. The confusion matrices in Appendix B.1 are qualitative and are not evaluated against the Definition-1 threshold. Please plot Pr(hat Y_t = y_a) or the empirical label frequency of the victim class over test batches for the strongest attacked methods (e.g., PeTTA, ROID, TRIBE, and the baseline) and state whether it approaches zero; if it does not, revise "collapse" to "degradation" throughout.
  2. [Sec. 3.1, Eq. (11); Fig. 3; Sec. 3.2] The theoretical mechanism is established only in a GMMC toy model whose augmentation operator is AWGN, and the only support for transferring this to deep image classifiers is the t-SNE visual analogy in Fig. 3. The simulation in Fig. 5 demonstrates the IPS-plus-Aug collapse inside that toy model, but no quantitative comparison is provided between AWGN perturbations and image-augmentation perturbations in deep feature space (e.g., covariance or radius of the augmented set around a sample). As a result, the claim in Sec. 3.2 that "the collapse only happens when the two conditions are met" is not shown to apply to the deep TTA methods in Sec. 5. Please add such a quantitative comparison or explicitly present the GMMC analysis as an illustrative intuition rather than a predictive model.
minor comments (6)
  1. [Sec. 3.1, Fig. 3 caption] "2Dt-SNE" should read "2D t-SNE."
  2. [Algorithm 1, lines 4-5] It is introduced as a set of samples X_t^{(i)} while St contains labeled pairs; please make the notation uniform so that It also carries labels or St reuses the labels of the selected samples.
  3. [Appendix B.1, Fig. 8 caption] The phrase "the model increasingly tends to further misclassify this entry as the victim class" is confusing and appears to reverse the shifting-boundary description in the main text; rephrase to "the victim class is increasingly misclassified as the entry's class."
  4. [Table 2] Because 10 trials are averaged, standard deviations or confidence intervals should be reported; without them the small ImageNet-C increments (0-10%, EATA 0%) are hard to interpret.
  5. [Eq. (4)] The denominator sum in LSLR should be parenthesized to avoid ambiguity in the definition.
  6. [Sec. 6.3, Table 3] The augmentation-level sweep changes several operators at once, so the monotone trend in Fig. 6d could be driven by any single component; a one-dimensional sweep with a single operator scale would strengthen the causal claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the RIP attack is measured on independent TTA methods and standard checkpoints, and the GMMC self-citation is an illustrative toy model, not a fitted input.

full rationale

The derivation chain uses the GMMC from the authors' prior work [17] as a toy surrogate, extends it with AWGN (Eq. 11), and runs simulations showing that misprediction sampling plus augmentation collapses the toy classifier. That is not circular: the collapse is a numerical observation on a stated model, and no parameter is fitted to the later deep-network results and then renamed a prediction. The RIP attack itself (Alg. 1) uses only labels from an attack dataset and the victim model's output labels, and it is benchmarked on seven external continual TTA methods (CoTTA, EATA, RMT, RoTTA, ROID, TRIBE, PeTTA) using the authors' default hyper-parameters and standard RobustBench/torchvision checkpoints. The self-citation to [17] supplies the GMMC and Definition 1, but it does not forbid alternative explanations and is not used to define attack success; the reported quantity is average class-wise testing error, an externally defined benchmark metric. The main epistemic weaknesses are that the GMMC+AWGN surrogate is justified only by a t-SNE visual analogy (Fig. 3), and that average error does not directly measure the Definition 1 vanishing-probability collapse; however, these are validity and measurement concerns, not circular reductions of the conclusion to its assumptions. No equation in the paper is equivalent by construction to a claimed prediction, and the Sec. 6.1 baseline is the authors' own construction but is used only for ablations, not for the headline comparisons.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a toy-model surrogate (GMMC+AWGN), the standard covariate-shift setup, and a set of assumptions about the victim and the attacker that are mostly stated in the threat model. The free parameters are simulation and experiment settings; none are fitted to produce the headline results, but the GMMC parameters and augmentation level influence the demonstrated effect.

free parameters (6)
  • AWGN augmentation noise sigma in GMMC = 0.2
    Hand-set in Sec. C.2 to represent the augmentation operator Aug in the toy model; the collapse result in Fig. 5 depends on this choice.
  • GMMC class means mu0, mu1 = -1.0, 2.0
    Toy Gaussian mixture parameters in Sec. C.2 chosen by hand to produce separable classes; the shifting-boundary demonstration depends on this configuration.
  • EMA update rate alpha in GMMC and baseline = 0.9 (GMMC), 0.99 (baseline)
    Chosen to emulate common TTA settings; Fig. 5d and Fig. 6f show the attack is sensitive to alpha.
  • Data augmentation level = Level 5 of 5
    Used for main experiments as 'the typical level used in practice' (Sec. 6.3); vulnerability is shown to vary with this level.
  • Testing batch size B = 64
    Default from prior TTA studies; Fig. 9b shows attack effect varies with B.
  • Attack dataset corruption type = Impulse noise level 5
    Arbitrary choice for Da in main experiments; the paper tests four other corruptions in Fig. 9a.
assumptions (5)
  • domain assumption GMMC with AWGN is a faithful surrogate for deep continual TTA with stochastic image augmentation
    Sec. 3.1 and Fig. 3 justify this only by a t-SNE visual analogy; the entire theory of the shifting-boundary effect relies on this transfer.
  • domain assumption Covariate shift holds: Pt(y|x) is invariant across domains
    Sec. 2.1 states Pt(x) may change but Pt(y|x) is fixed; this is standard but central to the pseudo-labeling setup.
  • domain assumption The victim uses augmentation in its adaptation loss and pseudo-labels from the student model
    Sec. 2.2 and 2.4 note that most recent TTA methods (RMT, ROID, RoTTA, TRIBE) follow Eq. 10; the attack is designed for this family.
  • domain assumption The attacker can continuously inject samples into the victim's test stream for Ta=500 steps
    Alg. 1 assumes sustained access to the testing stream; the paper acknowledges this in its limitations (Sec. 7).
  • ad hoc to paper The attacker possesses a labeled dataset Da with distribution mismatch to the source
    Sec. 4.2 and Limitations state RIP needs a 'reasonably large' labeled dataset to find incorrect predictions; this is a strong, nonstandard black-box assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of R.I.P.: A Simple Black-box Attack on Continual Test-time Adaptation." pith.science (2026). https://pith.science/paper/ENRZWMDM

@misc{pith2026241201154,
  author       = {Pith},
  title        = {Pith review of: R.I.P.: A Simple Black-box Attack on Continual Test-time Adaptation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ENRZWMDM}},
  note         = {Machine review of arXiv:2412.01154}
}
read the original abstract

Test-time adaptation (TTA) has emerged as a promising solution to tackle the continual domain shift in machine learning by allowing model parameters to change at test time, via self-supervised learning on unlabeled testing data. At the same time, it unfortunately opens the door to unforeseen vulnerabilities for degradation over time. Through a simple theoretical continual TTA model, we successfully identify a risk in the sampling process of testing data that could easily degrade the performance of a continual TTA model. We name this risk as Reusing of Incorrect Prediction (RIP) that TTA attackers can employ or as a result of the unintended query from general TTA users. The risk posed by RIP is also highly realistic, as it does not require prior knowledge of model parameters or modification of testing samples. This simple requirement makes RIP as the first black-box TTA attack algorithm that stands out from existing white-box attempts. We extensively benchmark the performance of the most recent continual TTA approaches when facing the RIP attack, providing insights on its success, and laying out potential roadmaps that could enhance the resilience of future continual TTA systems.

Figures

Figures reproduced from arXiv: 2412.01154 by the authors.

Figure 1
Figure 1. An illustration of our Reusing of Incorrect Predictions (RIP) attack against a continual test-time adaptation (TTA) method. Here the attacker intentionally reuses samples that were incorrectly predicted in the subsequent rounds to make the model more confident in these erroneous predictions. RIP is the first black-box attack that can realistically collapse a TTA model. horizons [17, 40] or challenging testing stream… view at source ↗
Figure 2
Figure 2. The key operational steps of a continual TTA method. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. The similarity in the effect of random data augmentation on images of CIFAR-10-C [ [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: A step-by-step illustration of the shifting-boundary ef [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: Simulation results on the Gaussian Mixture Model Classifier (GMMC) representing the effect of Incorrect Prediction Sampling [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Average of the worst category-wise testing error in various CIFAR-10-C [ [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Average testing error of the baseline model (Sec. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Confusion matrices under RIP attack of the baseline continual TTA method (Sec. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Average testing error of the baseline model (Sec. [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]
Figure 10
Figure 10. Figure 10: An example of augmented images at five different data augmentation levels. [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 54 canonical work pages

  1. [17]

    Trung-Hieu Hoang, Duc Minh V o, and Minh N. Do. Per- sistent test-time adaptation in recurring testing scenarios. In 38th Annual Conference on Neural Information Processing Systems (NeurIPS), 2024. 1, 2, 3, 5, 6, 7, 12, 14

    work page 2024

  2. [1]

    Adversarial example detection for DNN models: a review and experimental comparison

    Ahmed Aldahdooh, Wassim Hamidouche, Sid Ahmed Fezza, and Olivier D´eforges. Adversarial example detection for DNN models: a review and experimental comparison. Artificial Intelligence Review, 55(6):4403–4462, 2022. 6

    work page 2022

  3. [2]

    T. Cong, X. He, Y . Shen, and Y . Zhang. Test-time poisoning attacks against test-time adaptation models. In IEEE Sympo- sium on Security and Privacy (SP), pages 75–75, 2024. 1, 2, 5, 6, 8, 12

    work page 2024

  4. [3]

    Robust- bench: a standardized adversarial robustness benchmark

    Francesco Croce, Maksym Andriushchenko, Vikash Se- hwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robust- bench: a standardized adversarial robustness benchmark. In 35th Conference on Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2021. 14

    work page 2021

  5. [4]

    Evaluat- ing the adversarial robustness of adaptive test-time defenses

    Francesco Croce, Sven Gowal, Thomas Brunner, Evan Shel- hamer, Matthias Hein, and Ali Taylan Cemgil. Evaluat- ing the adversarial robustness of adaptive test-time defenses. In Proceedings of the International Conference on Machine Learning (ICML), 2022. 12

    work page 2022

  6. [5]

    ImageNet: A large-scale hierarchical im- age database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hierarchical im- age database. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 248–255, 2009. 14

    work page 2009

  7. [6]

    Marsden, and Bin Yang

    Mario D ¨obler, Robert A. Marsden, and Bin Yang. Robust mean teacher for continual and gradual test-time adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 7704–7714,

    work page

  8. [7]

    Unsupervised do- main adaptation by backpropagation

    Yaroslav Ganin and Victor Lempitsky. Unsupervised do- main adaptation by backpropagation. In Proceedings of the 32nd International Conference on Machine Learning (ICML), pages 1180–1189, Lille, France, 2015. PMLR. 1

    work page 2015

Show all 56 references
  1. [8]

    NOTE: Robust continual test-time adaptation against temporal correlation

    Taesik Gong, Jongheon Jeong, Taewon Kim, Yewon Kim, Jinwoo Shin, and Sung-Ju Lee. NOTE: Robust continual test-time adaptation against temporal correlation. In Ad- vances in Neural Information Processing Systems (NeurIPS),

  2. [9]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. InProceed- ings of the 3rd International Conference on Learning Repre- sentations (ICLR), 2015. 1, 12

    2015

  3. [10]

    Improving ro- bustness using generated data

    Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Calian, and Timothy Mann. Improving ro- bustness using generated data. In 35th International Confer- ence on Neural Information Processing Systems (NeurIPS) ,

  4. [11]

    Semi-supervised learning by entropy minimization

    Yves Grandvalet and Yoshua Bengio. Semi-supervised learning by entropy minimization. In Advances in Neural Information Processing Systems, 2004. 3

    2004

  5. [12]

    Simple black-box adver- sarial attacks

    Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. Simple black-box adver- sarial attacks. In Proceedings of the 36th International Conference on Machine Learning (ICLR), pages 2484–2493. PMLR, 2019. 1

    2019

  6. [13]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. arXiv preprint arXiv:1512.03385, 2015. 14

    2015 arXiv

  7. [14]

    Benchmarking neu- ral network robustness to common corruptions and perturba- tions

    Dan Hendrycks and Thomas Dietterich. Benchmarking neu- ral network robustness to common corruptions and perturba- tions. Proceedings of the 7th International Conference on Learning Representations (ICLR), 2019. 3, 4, 6, 7, 8, 14

    2019

  8. [15]

    Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan

    Dan Hendrycks, Norman Mu, Ekin D. Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. AugMix: A simple data processing method to improve robustness and uncertainty. Proceedings of the International Conference on Learning Representations (ICLR), 2020. 14

    2020

  9. [16]

    The many faces of robustness: A critical analysis of out-of-distribution generalization

    Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kada- vath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. The many faces of robustness: A critical analysis of out-of-distribution generalization. InP...

    2021

  10. [18]

    Trung-Hieu Hoang, Mona Zehni, Huy Phan, Duc Minh V o, and Minh N. Do. Improving the robustness of 3D human pose estimation: A benchmark and learning from noisy in- put. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR) Workshops , pa...

    2024

  11. [19]

    Batch Normalization: Accelerating deep network training by reducing internal co- variate shift

    Sergey Ioffe and Christian Szegedy. Batch Normalization: Accelerating deep network training by reducing internal co- variate shift. In Proceedings of the 32nd International Con- ference on Machine Learning (ICML), pages 448–456, Lille, France, 2015. PMLR. 8, 12, 14

    2015

  12. [20]

    Contrastive adaptation network for unsupervised do- main adaptation

    Guoliang Kang, Lu Jiang, Yi Yang, and Alexander G Haupt- mann. Contrastive adaptation network for unsupervised do- main adaptation. In Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR) , pages 4893–4902, 2019. 8

    2019

  13. [21]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Proceedings of the 3rd Inter- national Conference on Learning Representations (ICLR) ,

  14. [22]

    Pseudo-label : The simple and efficient semi-supervised learning method for deep neural networks

    Dong-Hyun Lee. Pseudo-label : The simple and efficient semi-supervised learning method for deep neural networks. ICML 2013 Workshop : Challenges in Representation Learn- ing (WREPL), 2013. 2

    2013

  15. [23]

    Detecting adversarial image examples in deep neural networks with adaptive noise reduc- tion

    Bin Liang, Hongcheng Li, Miaoqiang Su, Xirong Li, Wen- chang Shi, and Xiaofeng Wang. Detecting adversarial image examples in deep neural networks with adaptive noise reduc- tion. IEEE Transactions on Dependable and Secure Comput- ing, 18(1):72–85, 2021. 6, 12

    2021

  16. [24]

    Do we really need to access the source data? Source hypothesis transfer for un- supervised domain adaptation

    Jian Liang, Dapeng Hu, and Jiashi Feng. Do we really need to access the source data? Source hypothesis transfer for un- supervised domain adaptation. In Proceedings of the 37th In- ternational Conference on Machine Learning (ICML), pages 6028–6039, 2020. 12 9

    2020

  17. [25]

    Self-improving reactive agents based on rein- forcement learning, planning and teaching

    Long-Ji Lin. Self-improving reactive agents based on rein- forcement learning, planning and teaching. Machine Learn- ing, 8(3–4):293–321, 1992. 8

    1992

  18. [26]

    TTT++: When does self-supervised test-time training fail or thrive? In Advances in Neural Information Processing Systems (NeurIPS), pages 21808–21820, 2021

    Yuejiang Liu, Parth Kothari, Bastien van Delft, Baptiste Bellot-Gurlet, Taylor Mordan, and Alexandre Alahi. TTT++: When does self-supervised test-time training fail or thrive? In Advances in Neural Information Processing Systems (NeurIPS), pages 21808–21820, 2021. 12

    2021

  19. [27]

    Greedy policy search: A simple baseline for learnable test-time augmenta- tion

    Alexander Lyzhov, Yuliya Molchanova, Arsenii Ashukha, Dmitry Molchanov, and Dmitry Vetrov. Greedy policy search: A simple baseline for learnable test-time augmenta- tion. In Proceedings of the 36th Conference on Uncertainty in Artificial Intelligence (UAI) , pages 1308–1317. PMLR,

  20. [28]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proceedings of the 6th International Conference on Learning Representations (ICLR), 2018. 3

    2018

  21. [29]

    Torchvision: Py- torch’s computer vision library.https://github.com/ pytorch/vision, 2016

    TorchVision maintainers and contributors. Torchvision: Py- torch’s computer vision library.https://github.com/ pytorch/vision, 2016. 14

    2016

  22. [30]

    Univer- sal test-time adaptation through weight ensembling, diver- sity weighting, and prior correction

    Robert A Marsden, Mario D ¨obler, and Bin Yang. Univer- sal test-time adaptation through weight ensembling, diver- sity weighting, and prior correction. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 2555–2565, 2024. 3, 6, 7, 12

    2024

  23. [31]

    Test-time adaptation to distribution shift by confidence maximization and input transformation

    Chaithanya Kumar Mummadi, Robin Hutmacher, Kilian Rambach, Evgeny Levinkov, Thomas Brox, and Jan Hen- drik Metzen. Test-time adaptation to distribution shift by confidence maximization and input transformation. ArXiv, abs/2106.14999, 2021. 3

    2021 arXiv

  24. [32]

    Deep neural networks are easily fooled: High confidence predictions for unrecognizable images

    Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 427–436, 2015. 12

    2015

  25. [33]

    Tuan Nguyen, Thanh Nguyen-Tang, Ser-Nam Lim, and Philip Torr

    A. Tuan Nguyen, Thanh Nguyen-Tang, Ser-Nam Lim, and Philip Torr. TIPI: Test time adaptation with transformation invariance. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023. 3, 12

    2023

  26. [34]

    Efficient test- time model adaptation without forgetting

    Shuaicheng Niu, Jiaxiang Wu, Yifan Zhang, Yaofo Chen, Shijian Zheng, Peilin Zhao, and Mingkui Tan. Efficient test- time model adaptation without forgetting. In Proceedings of the 39th Internetional Conference on Machine Learning (ICML), 2022. 2, 6, 7, 12

    2022

  27. [35]

    Towards stable test-time adaptation in dynamic wild world

    Shuaicheng Niu, Jiaxiang Wu, Yifan Zhang, Zhiquan Wen, Yaofo Chen, Peilin Zhao, and Mingkui Tan. Towards stable test-time adaptation in dynamic wild world. In Proceedings of the 17th International Conference on Learning Represen- tations (ICLR), 2023. 12

    2023

  28. [36]

    To- wards robust detection of adversarial examples

    Tianyu Pang, Chao Du, Yinpeng Dong, and Jun Zhu. To- wards robust detection of adversarial examples. In Advances in Neural Information Processing Systems (NeurIPS), 2018. 6, 12

    2018

  29. [37]

    Distillation as a Defense to Ad- versarial Perturbations Against Deep Neural Networks

    Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a Defense to Ad- versarial Perturbations Against Deep Neural Networks . In IEEE Symposium on Security and Privacy (SP) , pages 582– 597, 2016. 12

    2016

  30. [38]

    Berkay Celik, and Ananthram Swami

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. Prac- tical black-box attacks against machine learning. InProceed- ings of the 2017 ACM on Asia Conference on Computer and Communications Security , page 506–519, New York, NY...

    2017

  31. [39]

    MedBN: Robust test-time adap- tation against malicious test samples

    Hyejin Park, Jeongyeon Hwang, Sunung Mun, Sangdon Park, and Jungseul Ok. MedBN: Robust test-time adap- tation against malicious test samples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 5997–6007, 2024. 1, 2, 6, 8, 12

    2024

  32. [40]

    RDumb: A simple approach that questions our progress in continual test-time adaptation

    Ori Press, Steffen Schneider, Matthias Kuemmerer, and Matthias Bethge. RDumb: A simple approach that questions our progress in continual test-time adaptation. In 37th An- nual Conference on Neural Information Processing Systems (NeurIPS), 2023. 1, 12

    2023

  33. [41]

    Lawrence

    Joaquin Quionero-Candela, Masashi Sugiyama, Anton Schwaighofer, and Neil D. Lawrence. Dataset Shift in Ma- chine Learning. The MIT Press, 2009. 1, 2, 12

    2009

  34. [42]

    A survey on image data augmentation for deep learning

    Connor Shorten and Taghi M Khoshgoftaar. A survey on image data augmentation for deep learning. Journal of Big Data, 6(1):1–48, 2019. 2

    2019

  35. [43]

    Towards real-world test- time adaptation: Tri-Net self-training with balanced normal- ization

    Yongyi Su, Xun Xu, and Kui Jia. Towards real-world test- time adaptation: Tri-Net self-training with balanced normal- ization. In AAAI Conference on Artificial Intelligence, 2023. 1, 3, 6, 7

    2023

  36. [44]

    Test-time training with self- supervision for generalization under distribution shifts

    Yu Sun, Xiaolong Wang, Zhuang Liu, John Miller, Alexei Efros, and Moritz Hardt. Test-time training with self- supervision for generalization under distribution shifts. In Proceedings of the 37th International Conference on Ma- chine Learning (ICML), pages 9229–9248. PMLR, 2020. 12

    2020

  37. [45]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Proceedings of the 2nd International Conference on Learning Representa- tions (ICLR), 2014. 1, 12

    2014

  38. [46]

    Mean teachers are bet- ter role models: Weight-averaged consistency targets im- prove semi-supervised deep learning results

    Antti Tarvainen and Harri Valpola. Mean teachers are bet- ter role models: Weight-averaged consistency targets im- prove semi-supervised deep learning results. In 31st Inter- national Conference on Neural Information Processing Sys- tems (NeurIPS), page 1195–1204, 2017. 3, 8, 12

    2017

  39. [47]

    Visualizing data using t-SNE

    Laurens van der Maaten and Geoffrey Hinton. Visualizing data using t-SNE. Journal of Machine Learning Research (JMLR), 9(86):2579–2605, 2008. 3, 4

    2008

  40. [48]

    Tent: Fully test-time adaptation by entropy minimization

    Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno Ol- shausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization. In Proceedings of the 9th Inter- national Conference on Learning Representations (ICLR) ,

  41. [49]

    Continual test-time domain adaptation

    Qin Wang, Olga Fink, Luc Van Gool, and Dengxin Dai. Continual test-time domain adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7201–7211, 2022. 1, 2, 3, 6, 7, 8, 12, 14 10

    2022

  42. [50]

    Vincent Poor

    Yulong Wang, Tong Sun, Shenghong Li, Xin Yuan, Wei Ni, Ekram Hossain, and H. Vincent Poor. Adversarial attacks and defenses in machine learning-empowered communica- tion systems and networks: A contemporary survey. IEEE Communications Surveys and Tutorials , 25(4):2245–2298,

  43. [51]

    Wang, Vikash Sehwag, Saeed Mahloujifar, and Prateek Mittal

    Tong Wu, Feiran Jia, Xiangyu Qi, Jiachen T. Wang, Vikash Sehwag, Saeed Mahloujifar, and Prateek Mittal. Uncover- ing adversarial risks of test-time adaptation. In Proceedings of the 40th International Conference on Machine Learning (ICML). JMLR.org, 2023. 1, 2, 5, 6, 8, 12

    2023

  44. [52]

    Grey-box adversarial attack and defence for sentiment classification

    Ying Xu, Xu Zhong, Antonio Jimeno Yepes, and Jey Han Lau. Grey-box adversarial attack and defence for sentiment classification. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computa- tional Linguistics: Human Language Technologies ,...

    2021

  45. [53]

    Robust test- time adaptation in dynamic scenarios

    Longhui Yuan, Binhui Xie, and Shuang Li. Robust test- time adaptation in dynamic scenarios. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 15922–15932, 2023. 1, 2, 3, 6, 7, 12, 14

    2023

  46. [54]

    Dauphin, and David Lopez-Paz

    Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimiza- tion. In Proceedings of the 6th International Conference on Learning Representations (ICLR), 2018. 3

    2018

  47. [55]

    MEMO: Test time robustness via adaptation and augmentation

    Marvin Zhang, Sergey Levine, and Chelsea Finn. MEMO: Test time robustness via adaptation and augmentation. In 36th Annual Conference on Neural Information Processing Systems (NeurIPS), pages 38629–38642, 2022. 2

    2022

  48. [56]

    shifting boundary effect

    Kaiyang Zhou, Ziwei Liu, Yu Qiao, Tao Xiang, and Chen Change Loy. Domain generalization: A survey. IEEE Transaction on Pattern Analysis and Machine Intelligence (TPAMI), 45(4):4396–4415, 2023. 12 11 R.I.P. : A Simple Black-box Attack on Continual Test-time Adaptation Supplemen...

    2023

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.