Test-time adaptation (TTA) has emerged as a promising solution to address performance decay due to unforeseen distribution shifts between training and test data. While recent TTA methods excel in adapting to test data variations, such adaptability exposes a model to vulnerability against malicious examples, an aspect that has received limited attention. Previous studies have uncovered security vulnerabilities within TTA even when a small proportion of the test batch is maliciously manipulated. In response to the emerging threat, we propose median batch normalization (MedBN), leveraging the robustness of the median for statistics estimation within the batch normalization layer during test-time inference. Our method is algorithm-agnostic, thus allowing seamless integration with existing TTA frameworks. Our experimental results on benchmark datasets, including CIFAR10-C, CIFAR100-C and ImageNet-C, consistently demonstrate that MedBN outperforms existing approaches in maintaining robust performance across different attack scenarios, encompassing both instant and cumulative attacks. Through extensive experiments, we show that our approach sustains the performance even in the absence of attacks, achieving a practical balance between robustness and performance.

测试时间适应（TTA）已成为解决测试数据训练和测试之间意外分布变化导致性能下降的有希望的方法。本研究提出中位数批归一化（MedBN）来应对TTA中的恶意示例对模型造成的潜在威胁，通过在测试推理期间的批归一化层中利用中位数来进行统计估计。我们的实验结果表明，MedBN在维护不同攻击场景下的鲁棒性表现方面优于现有方法，且在无攻击情况下仍能保持良好的性能。

MedBN: 对恶意测试样本的鲁棒测试时适应性