Noisy Test-Time Adaptation in Vision-Language Models

W3: Some recent test-time adaptation works are not compared in the experiments, such as TDA [3].

Reply: Thanks for your valuable feedback. We conducted comparisons with TDA, with results shown in Table B. Our experimental results demonstrate that TDA's performance is inferior to our approach. This indicates the necessity of training a noise detector to detect noisy samples in the ZS-NTTA setting. We have added this experiment to our revised paper in Appendix E.

Table B: Performance comparison with TDA using ImageNet as ID dataset. Results are averaged across four OOD datasets: iNaturalist, SUN, Texture, and Places.

Q1: As the authors analyze in Section 3.3, some inaccuracies during the early stages of TTA can gradually lead the model to overfit. I wonder whether the pseudo-labels in the early stages are accurate and the inaccuracies in the Noise Detector will accumulate

Reply: Thanks for your feedback. We would like to clarify that the pseudo-labels in both stages are generated by ZS-CLIP in our method. Therefore, the inaccuracies in pseudo-labels are similar between the first and second stages. We only use ZS-CLIP's outputs as final results in the early stages and switch to the noise detector's outputs in the second stage, considering that the Noise Detector may not be sufficiently trained initially.

Following your suggestion, we report the accuracy of pseudo-labels generated by ZS-CLIP in both the early stage and the second stage in Table C. Even with relatively low pseudo-label accuracy on ImageNet, our method achieves strong performance (a notable improvement of 8.32% in harmonic mean accuracy compared to ZS-CLIP).

Furthermore, we have discussed in Appendix F.4 (Table 24) why we use ZS-CLIP's outputs rather than the noise detector's outputs as pseudo-labels. Using noise detector's outputs as pseudo-labels could lead to cumulative errors, resulting in significant performance degradation on certain datasets. Therefore, using ZS-CLIP's outputs as pseudo-labels proves to be more robust. For detailed analysis and results, please refer to Appendix F.4 and Table 24.

Table C: Accuracy of pseudo-labels. ID dataset: ImageNet, OOD dataset: iNaturalist

We thank the reviewer SvHV for the valuable feedback. We addressed all the comments. Please find the point-to-point responses below. Any further comments and discussions are welcomed!

W1: Though Zero-shot Noisy TTA is a new task, the method of utilizing two stages and pseudo labels to train a noisy detector is not novel; the idea of using unlabel test data to train a more robust OOD classifier has been explored in other scenarios, such as [1] for zero-shot OOD detection.

Reply: Thanks for your feedback. We would like to clarify our method and contribution here:

• First, we introduced a practical and previously overlooked setting - Zero-shot Noisy TTA (ZS-NTTA). All Reviewers acknowledge this as a novel and important contribution. This is our paper's first key contribution to the field.
• Second, we comprehensively analyzed why existing TTA methods suffer from performance decline and underperform the model-frozen method in the ZS-NTTA setting (detailed in Section 3). These analyses, culminating in three novel and insightful observations, constitute our second major contribution. Reviewer JjFG also offered the following feedback:

The three observations are interesting and novel. They reveal the reasons why the ZS-NTTA is difficult and contributes to the community.

• Third, regarding methodology, we would like to emphasize that our primary contribution and novelty lies in the conceptual framework rather than specific implementation details. We identified limitations in existing TTA approaches through detailed analysis and proposed a simple yet effective decoupled framework - separating the classifier and detector while keeping the classifier frozen. This conceptual design prevents detrimental effects caused by the classifier adapting to noisy samples. While our current implementation uses a two-stage approach with pseudo labels, this is just one possible implementation within the framework. We believe this conceptual insight and framework design can inspire future research in this field. Reviewer JjFG also offered the following feedback:

The proposed method is reasonable and achieve good results in the experiment.

Reviewer GcDg also offered the following feedback:

Although the method of training an additional noise detector is simple, it proves to be quite effective according to the experimental results.

• Finally, our experimental results demonstrate substantial improvements over existing methods, validating the effectiveness of our approach.

We discuss and cite SAL [1] in related work (Appendix B) in our revised paper. While SAL [1] also leverages unlabeled test data to train a robust OOD classifier, our work differs in its focus and contribution. We primarily address the ZS-NTTA task, where our core contribution lies in proposing a conceptual framework that decouples the detector from the classifier. This decoupling prevents classifier degradation during noisy sample adaptation, with pseudo-label-based detector training serving merely as one implementation detail of our approach.

W2: It would be better to provide more experiments with more complex datasets, such as near ID/OOD datasets, for example, Imagenet and NINCO.

Reply: Thanks for your feedback. Following your suggestion, we conducted additional experiments on ImageNet and NINCO datasets, with results shown in Table A. The results demonstrate that our method can outperform all the baseline methods. What’s more, our method achieves the best ID classification accuracy $Acc_S$ among all approaches. We have added this experiment to our revised paper in Appendix E.

Table A: Experiments on more complex datasets, ID: ImageNet, OOD: NINCO

Note that ZS-NTTA is inherently more challenging than traditional OOD detection, as it requires simultaneous classification and detection capabilities under the noisy data stream. Specifically, ZS-NTTA requires online, real-time classification and detection results: for each input sample, the model must immediately determine whether it is ID/OOD, and if ID, perform classification. In contrast, existing OOD detection methods typically report ID classification accuracy under the assumption of a clean data stream.

Dear Reviewer SvHV,

Thank you again for your time and valuable comments.

In the rebuttal period, we have provided detailed responses to all your comments and questions point-by-point. Specifically, we

• clarify the novelty of our method lies in decoupling the classifier and detector according to our analysis (Weakness1);
• provide more experiments with more complex datasets (Weakness2);
• conduct comparisons with TDA (Weakness3);
• report the accuracy of pseudo-labels (Question1).

As the deadline for the paper discussion phase is approaching, would you mind checking our responses and confirming whether you have any further questions?

Any comments and discussions are welcome!

Thanks for your attention and best regards,
Authors of #7153

Below are the detailed results across all 15 corruption types.

Table 2.1: Experiments on CIFAR-10-C with 8 types of corruptions. The remaining 7 corruption types are shown in Table 2.2.

Table 2.2: Experiments on CIFAR-10-C with 7 types of corruptions. The remaining 8 corruption types are shown in Table 2.1.

Table 3.1: Experiments on CIFAR-100-C with 8 types of corruptions. The remaining 7 corruption types are shown in Table 3.2.

W3: TTA methods are generally sensitive to the ratio of clean to noise in samples, ranging from 1:1000 to 1000:1. Is the performance of this method stable across such variations?

Reply: Thanks for your feedback. In the noisy TTA setting, existing method [a] typically experiments with ID:OOD ratios ranging from 1:0.2 to 1:1. In the OOD detection literature [f, g, h], a balanced 1:1 ratio is commonly used as the standard evaluation setting.

In our paper, we have performed experiments with various noise ratios (0%, 25%, 50%, 75%; i.e., 1:0, 3:1, 1:1, 1:3) in the data stream. The results in Table 17 show that our method maintains excellent performance across data streams with the above different noise ratios.

Taking your suggestion, we additionally evaluated several practical settings with noise ratios ranging from 5:1 to 1:5. The results, presented in Table A, further demonstrate our method's stability across various noise ratios.

Table A: Different noise ratios in the data stream. Results are averaged across four OOD datasets: SVHN, LSUN, Texture, and Places. ID: CIFAR-10.

[f] Hendrycks, Dan, et al. "A baseline for detecting misclassified and out-of-distribution examples in neural networks." In ICLR 2017.

[g] Liu, Weitang, et al. "Energy-based out-of-distribution detection." In NeurIPS 2020.

[h] Ming, Yifei, et al. "Delving into out-of-distribution detection with vision-language representations." In NeurIPS 2022.

W4: Line 376 is ambiguous and could lead readers to misunderstand that the clean and noisy streams are known.

Reply: Thank you for your valuable feedback. You are correct in your understanding of our approach. We have revised Line 376 to avoid ambiguity and better reflect that the test stream is unknown during deployment. The revised text now reads: "During testing, we insert a Gaussian noise sample for every M input sample in the data stream, regardless of whether the stream is clean or noisy. Note that we don't have prior knowledge about whether the data stream is clean or noisy."

W2: There appears to be a mismatch between the methodology and the title of the paper. I suspect the improvement in classification accuracy reported in the paper's tables is due to successful OOD detection rather than enhancements to the classifier, correct?

Reply: Your understanding of the improved classification accuracy stemming from successful OOD detection is correct. However, this does not mean our method is a mismatch with the task. We would like to clarify this further.

First of all, it's crucial to distinguish between tasks and methods, as methods serve as a means to accomplish the task's goals. In the ZS-NTTA setting, our goal is to effectively perform both classification and detection in an online manner. After analyzing how mainstream TTA methods perform in the ZS-NTTA setting (detailed in Section 3), our analysis led us to decouple the classifier and detector, focusing on developing an individual detector while keeping the classifier frozen. This conceptual design prevents detrimental effects caused by the classifier adapting to noisy samples. Our experimental results demonstrate that this strategy successfully achieves both classification and detection objectives, aligning well with the task requirements.

Furthermore, we would like to emphasize that TTA does not necessarily require model adaptation. Several existing TTA works, such as [c], [d], and [e], have successfully achieved their objectives while maintaining fixed models. These approaches demonstrate that effective test-time adaptation can be achieved through various strategies beyond model updating.

In summary, our method was specifically designed to address the challenges of the ZS-NTTA task. Based on empirical observations and analysis, we developed an approach that strongly correlates with the ZS-NTTA’s goal, focusing on effective classification and OOD detection.

[c] Karmanov, Adilbek, et al. "Efficient Test-Time Adaptation of Vision-Language Models." In CVPR 2024.

[d] Zhang, Taolin, et al. "BoostAdapter: Improving Vision-Language Test-Time Adaptation via Regional Bootstrapping." In NeurIPS 2024.

[e] Han, Zongbo, et al. "DOTA: Distributional Test-Time Adaptation of Vision-Language Models." arXiv preprint arXiv:2409.19375 (2024).

We thank the reviewer GcDg for the valuable feedback. We addressed all the comments. Please find the point-to-point responses below. Any further comments and discussions are welcomed!

W1: The task might be more appropriately named something like "test-time OOD detection," as there are similar task definitions in academia, such as [1,2], which require discussion and comparison.

Reply: Thank you for your valuable feedback. While Test-time OOD detection and ZS-NTTA share some similarities, such as having both ID and OOD samples in the test data stream, they are fundamentally different tasks. We can summarize their differences in three key points:

• The first distinction lies in their objectives. ZS-NTTA simultaneously emphasizes both ID classification and OOD detection, with results presented using harmonic mean accuracy. In contrast, test-time OOD detection primarily focuses on detection, with results evaluated using the area under the ROC curve.
• Secondly, regarding ID classification, the test-time OOD detection task only requires evaluating ID classification under the assumption of a clean data stream. However, the ZS-NTTA task requires evaluating ID classification and OOD detection under the noisy data stream. From this perspective, ZS-NTTA is more challenging than Test-time OOD detection.
• Furthermore, ZS-NTTA requires online, real-time classification and detection results: for each input sample, the model must immediately determine whether it is ID/OOD, and if ID, perform classification. Existing OOD detection/test-time OOD detection methods are evaluated by processing the entire test set or batch, determining the optimal threshold based on ground truth.

Besides, the noisy TTA setting has gained recognition in academia (OWTTT [a], SoTTA [b]), and given our utilization of pretrained VLM's zero-shot capabilities, we refer to our setting as ZS-NTTA.

In terms of task definitions, a comprehensive comparison is further summarized in Table A. Based on the above analysis of the differences, we believe that we need a new name for the new setting.

Table A: Comparison between ZS-NTTA and test-time OOD detection setting[1, 2]

In addition to task definitions, we discuss and compare AdaND with [1, 2] (in terms of method) to further illustrate the distinctions.

• RTL [1]: RTL used linear regression to make a more precise OOD prediction. In other words, RTL leverages the TTA method to enhance OOD detection while fundamentally remaining an OOD detection task. However, our work fundamentally differs in its focus: we focus on the TTA setting itself, where test samples may contain noise, resulting in severe performance degradation of existing TTA methods.
• ATTA [2]: ATTA cannot be extended to the ZS-NTTA setting since it relies on measuring the distributional distance between test and training features in the normalization layers of the segmentation network. In the context of pretrained VLMs like CLIP, we don't have access to the training data, making ATTA's approach inapplicable to our setting.

We have added the above discussion and comparison to our paper in Appendix A.

[1] Fan, Ke, et al. "Test-Time Linear Out-of-Distribution Detection." In CVPR 2024.

[2] Gao, Zhitong, et al. "ATTA: Anomaly-aware Test-Time Adaptation for Out-of-Distribution Detection in Segmentation." In NeurIPS 2023.

[a] Li, Yushu, et al. "On the Robustness of Open-World Test-Time Training: Self-Training with Dynamic Prototype Expansion." In ICCV 2023.

[b] Gong, Taesik, et al. "SoTTA: Robust Test-Time Adaptation on Noisy Data Streams." In NeurIPS 2023.

W3: It is better to study how the portion of the noisy labels influences the performance.

Reply: We are uncertain whether "the portion of the noisy labels" referred to by the reviewer means the proportion of noisy samples in the test stream or the ratio of class numbers between noisy and clean datasets. Regarding the proportion of noisy samples in the test stream, we have already conducted ablation studies with various noise ratios (0%, 25%, 50%, 75%) to mimic real-world conditions. Our method demonstrates superior performance across different noise ratios. The detailed experimental results can be found in Table 17 of our paper, where we observe consistent performance improvements over baseline methods regardless of the noise ratio. For the ratio of class numbers between noisy and clean datasets, our experiments encompass 44 ID-OOD dataset pairs with diverse ratios of class numbers. The number of classes for each ID-OOD dataset pair is summarized in Table B below. Our method consistently performs best across all different ID-OOD class ratios. We have added the class ratio between noisy and clean datasets to our revised paper in Table 9.

Table B: Number of classes in ID and OOD datasets. Each row shows an ID-OOD dataset pair with their respective number of classes.

Note: To avoid label space overlap between ID and OOD datasets, the iNaturalist, SUN, and Places datasets used in our experiments are subsets constructed by [1].

[1] Huang, Rui, et al. "MOS: Towards Scaling Out-of-distribution Detection for Large Semantic Space" CVPR 2021

We thank the reviewer JjFG for the valuable feedback. We addressed all the comments. Please find the point-to-point responses below. Any further comments and discussions are welcomed!

W1: Why use the ranking distribution in Fig. 2 rather than using the absolute accuracy?

Reply: Thank you for your feedback. One important advantage of the violin ranking visualization is its ability to mitigate the impact of extreme cases. When using absolute accuracy, if a method performs particularly poorly on individual datasets, these extreme values significantly affect the average accuracy, leading to biased evaluation of the method's overall performance. For instance, on ImageNet-K/iNaturalist (ID/OOD), Tent achieves an $\text{Acc}_\text{H}$ of only 28.55%, while ZS-CLIP reaches 48.49%; however, on ImageNet-K/SUN, Tent achieves an Acc_H of 48.46%, while ZS-CLIP achieves 47.39%. Tent's extremely low value substantially reduces its average performance, overlooking its excellent performance on other datasets. In contrast, using ranking distribution visualization provides a more balanced evaluation perspective that doesn't overly amplify individual extreme cases. What’s more, we added the absolute accuracy for all methods across 44 ID-OOD dataset pairs (see Table A below). Our method still achieves the best performance, while most TTA methods perform worse than ZS-CLIP under the ZS-NTTA setting. Following your suggestion, we have added the absolute accuracy to our paper in Figure 7 in our revised paper

Table A: Average absolute accuracy for all methods across 44 ID-OOD dataset pairs

W2: How to inject the noise to the data is an important factor of the proposed method. Is there any theoretical analysis?

Reply: In fact, the main purpose of noise injection is to cover completely clean data streams. In our method, we have claimed that the injected noise should meet two conditions: 1) lying outside the ID label space and 2) being easily accessible without incurring extra costs for auxiliary data collection. More importantly, we conducted comprehensive ablation studies on different types of injected noise and noise injection frequencies. Our extensive experiments on 44 ID-OOD dataset pairs demonstrate the effectiveness of our strategy, which achieves strong performance while successfully handling completely clean test streams. Given that our noise injection strategy is designed to address the practical challenge of handling various test stream compositions and does not involve algorithm convergence or performance bounds derivation, we focus on empirical validation rather than theoretical analysis.

Dear Reviewer JjFG,

Thank you again for your time and valuable comments.

In the rebuttal period, we have provided detailed responses to all your comments and questions point-by-point. Specifically, we

• clarify why we use ranking distribution in Fig. 2 and add absolute accuracy to evaluate TTA methods (Weakness1);
• clarify the main purpose of our noise injection strategy (Weakness2);
• clarify how the portion of the noisy labels influences the performance (Weakness3).

As the deadline for the paper discussion phase is approaching, would you mind checking our responses and confirming whether you have any further questions?

Any comments and discussions are welcome!

Thanks for your attention and best regards,
Authors of #7153

Dear Reviewer JjFG,

We sincerely appreciate your valuable feedback.

As the deadline for the paper discussion phase is approaching, we would like to check if you have any other remaining concerns about our paper.

We sincerely thank you for your dedication and effort in evaluating our submission. Please do not hesitate to let us know if you need any clarification.

Thanks for your attention and best regards,

Authors of #7153