SlowGuess/NeurIPS_2023_OCR huggingface dataset:
We conducted experiments to understand the sensitivity of our two hyperparameters: confidence threshold  $(C_0)$  and BN momentum  $(m)$ . We varied  $C_0$  and  $m$  and reported the corresponding accuracy.
(a) Effect of hyperparameter  $C_0$
(b) Effect of hyperparameter  $m$
Figure 8: Effect of hyperparameters on the model accuracy on CIFAR10-C for 15 types of corruptions under five scenarios: Benign, Near, Far, Attack, and Noise. Averaged over three different random seeds.
**Confidence threshold.** Our result shows that the selection of  $C_0$  shows similar patterns across different scenarios (Benign  $\sim$  Noise). The result illustrates a tradeoff; a low  $C_0$  value does not effectively reject noisy samples, while a high  $C_0$  value filters benign data. We found a proper value of  $C_0$  (0.99) that generally works well across the scenarios. Also, we found that the optimal  $C_0$  depends primarily on in-distribution data. Our interpretation is that setting different  $C_0$  values for CIFAR10-C, CIFAR100-C, and ImageNet-C is straightforward as they have a different number of classes (10, 100, and 1,000), which leads to different ranges of the model's confidence.
BN momentum. Across the tested range, the variations in performance were found to be negligible. This finding indicates that choosing a low momentum value from within the specified range ([0.05, 0.3]) is adequate to maintain a favorable performance. Please note that setting a high momentum would corrupt the result, which is implicated by the algorithms directly utilizing test-time statistics (e.g., TENT) suffering from accuracy degradation with noisy data streams (e.g., TENT:  $81.0\% \rightarrow 52.1\%$  for Noise at Table 1).
D Further discussions
D.1 Theoretical explanation of the impact of noisy data streams
We provide a theoretical explanation of the impact of noisy data streams with a common entropy minimization as an example. With the Bayesian-learning-based frameworks [2, 7], we can express the posterior distribution  $p$  of the model in terms of training data  $D$  and benign test data  $B$  in test-time adaptation:
$$
\log p (\theta | D, B) = \log q (\theta) - \frac {\lambda_ {B}}{| B |} \sum_ {b = 1} ^ {| B |} H \left(y _ {b} \mid x _ {b}\right). \tag {7}
$$
The posterior distribution of model parameters depends on the prior distribution  $q$  and the average of entropy  $H$  of benign samples with a multiplier  $\lambda$ . Here, we incorporate the additional noisy data stream  $N$  into Equation 7 and introduce a new posterior distribution considering noisy streams:
$$
\log p (\theta | D, B, N) = \log q (\theta) - \frac {\lambda_ {B}}{| B |} \sum_ {b = 1} ^ {| B |} H \left(y _ {b} \mid x _ {b}\right) - \frac {\lambda_ {N}}{| N |} \sum_ {n = 1} ^ {| N |} H \left(y _ {n} \mid x _ {n}\right). \tag {8}
$$
Table 10: Average classification accuracy (%) and their corresponding standard deviations on ablation study of the effect of high-confidence uniform-class continual memory of SoTTA on CIFAR10-C. Bold numbers are the highest accuracy. Averaged over three different random seeds.
Benign	Near	Far	Attack	Noise	Avg
SoTTA (w/o High-confidence)	82.2 ± 0.2	78.0 ± 0.4	75.9 ± 0.5	84.3 ± 0.1	77.7 ± 0.7	79.6 ± 0.2
SoTTA (w/o Uniform-class)	82.3 ± 0.2	80.9 ± 0.6	74.9 ± 2.4	83.5 ± 0.2	68.7 ± 7.0	78.0 ± 2.0
SoTTA (w/o Continual)	81.0 ± 0.5	79.5 ± 0.3	75.5 ± 1.8	84.4 ± 0.2	65.7 ± 7.0	77.2 ± 1.8
SoTTA	82.2 ± 0.3	81.4 ± 0.5	81.6 ± 0.6	84.5 ± 0.2	80.0 ± 1.4	81.9 ± 0.5
With Equation 7 and Equation 8, we can now derive model parameter variations caused by noisy test samples:
$$
\log p (\theta | D, B) - \log p (\theta | D, B, N) = \frac {\lambda_ {N}}{| N |} \sum_ {n = 1} ^ {M} H \left(y _ {n} \mid x _ {n}\right). \tag {9}
$$
Equation 9 implies that the (1) model adapted only from benign data and (2) model adapted with both benign and noisy data differ by the amount of the average entropy of noisy samples. This also suggests that a high entropy from severe noisy samples would result in a significant model drift in adaptation (i.e., model corruption).
D.2 Comparison with previous TTA methods
D.2.1 EATA and SAR
While SoTTA, EATA [28], and SAR [29] all leverage sample filtering strategy, the key distinction of input-wise robustness of SoTTA and EATA/SAR lies in three aspects: (1) Our high-confidence sampling strategy in SoTTA aims to filter noisy samples by utilizing only the samples with high confidence, while both EATA and SAR use a different approach that excludes a few high-entropy samples, particularly during the early adaptation stage. In our preliminary study, we found that our method excludes  $99.98\%$  of the noisy samples, whereas EATA and SAR exclude  $33.55\%$  of such samples. (2) While EATA and SAR adapt to every incoming low-entropy sample, SoTTA leverages a uniform-class memory management approach to prevent overfitting. As shown in Figure 5b, noisy samples often lead to imbalanced class predictions, and these skewed distributions could lead to an undesirable bias in  $p(y)$  and thus might negatively impact TTA objectives, such as entropy minimization. The ablation study in Table 10 shows the effectiveness of uniform sampling with a  $3.9\%$  accuracy improvement. (3) EATA and SAR reset the memory buffer and restart the sample collection process for each adaptation. This strategy is susceptible to overfitting due to a smaller number of samples used for adaptation and the temporal distribution drift of the samples. In contrast, our continual memory management approach effectively mitigates this issue by retaining high-confidence uniform-class samples in the memory, as shown in Table 10.
We acknowledge that both SoTTA and SAR utilize sharpness-aware minimization proposed by Foret et al. [4]. However, we clarify that the motivation behind using SAM is different. While SAR intends to avoid model collapse when exposed to samples with large gradients, we aim to enhance the model's robustness to noisy samples with high confidence scores. As illustrated in Figure 6, we observed that entropy-sharpness minimization effectively prevents the model from overfitting to noisy samples. As a result, while our algorithm led to marginal performance degradation in noisy settings (82.2% → 80.0% for Noise), EATA and SAR showed significant degradation (EATA 82.4% → 36.0% for Noise; SAR 78.3% → 58.3% for Noise).
D.2.2 RoTTA
Regarding our high-confidence uniform sampling technique, RoTTA [44] could be compared. First of all, RoTTA's objective is different from ours; RoTTA focused on temporal distribution changes of test streams without considering noisy samples. Similar to SoTTA, RoTTA's memory bank maintains recent high-confidence samples. However, RoTTA has no filtering mechanism for low-confidence samples, which makes RoTTA fail to avoid noisy samples, especially in the early stage of TTA. In contrast, our confidence-based memory management scheme effectively rejects noisy samples, and
Table 11: Average classification accuracy (\%) of ODIN+TTA on CIFAR10-C. Bold numbers are the accuracy with improvement from normal TTAs. Averaged over three different random seeds.
Method	Benign	Near	Far	Attack	Noise
w/o ODIN	w/ ODIN	w/o ODIN	w/ ODIN	w/o ODIN	w/ ODIN	w/o ODIN	w/ ODIN	w/o ODIN	w/ ODIN
Source	57.7 ± 1.0	57.7 ± 1.0	57.7 ± 1.0	57.7 ± 1.0	57.7 ± 1.0	57.7 ± 1.0	57.7 ± 1.0	57.7 ± 1.0	57.7 ± 1.0	57.7 ± 1.0
BN stats [27]	78.2 ± 0.3	78.2 ± 0.3	76.5 ± 0.4	76.5 ± 0.4	75.4 ± 0.3	75.9 ± 0.4	55.8 ± 1.4	55.8 ± 1.4	55.9 ± 0.8	56.7 ± 0.9
PL [17]	78.4 ± 0.3	78.8 ± 0.5	73.1 ± 0.3	74.3 ± 0.6	71.3 ± 1.0	71.6 ± 0.8	66.5 ± 1.1	66.5 ± 1.1	52.1 ± 0.4	52.1 ± 0.4
TENT [38]	81.5 ± 1.0	81.5 ± 1.0	74.5 ± 0.8	76.1 ± 0.6	73.5 ± 1.1	74.7 ± 1.3	69.0 ± 0.9	69.1 ± 1.0	54.4 ± 0.3	56.2 ± 0.6
LAME [1]	56.1 ± 0.3	56.1 ± 0.3	56.7 ± 0.5	56.7 ± 0.5	55.7 ± 0.4	55.7 ± 0.4	56.2 ± 0.5	56.2 ± 0.5	54.9 ± 0.5	55.2 ± 0.7
CoTTA [39]	82.2 ± 0.3	82.2 ± 0.3	78.2 ± 0.3	78.2 ± 0.4	73.6 ± 0.9	73.6 ± 0.9	69.6 ± 1.3	69.6 ± 1.3	57.8 ± 0.8	62.0 ± 1.3
EATA [28]	82.4 ± 0.3	82.4 ± 0.3	63.9 ± 0.4	69.2 ± 0.4	56.3 ± 0.5	59.9 ± 0.6	70.9 ± 0.7	70.9 ± 0.7	36.0 ± 0.8	50.8 ± 1.1
SAR [29]	78.4 ± 0.7	78.4 ± 0.7	72.8 ± 8.2	72.8 ± 8.2	75.7 ± 3.1	76.0 ± 3.1	56.2 ± 1.8	56.2 ± 1.8	58.7 ± 0.3	58.7 ± 0.3
RoTTA [44]	75.3 ± 0.7	75.3 ± 0.7	77.5 ± 0.5	77.5 ± 0.5	77.0 ± 0.9	77.0 ± 0.9	78.4 ± 0.8	78.4 ± 0.8	73.5 ± 0.5	73.5 ± 0.5
SoTTA	82.1 ± 0.4	82.1 ± 0.4	81.6 ± 0.4	81.6 ± 0.4	81.7 ± 0.5	82.0 ± 0.8	84.5 ± 0.3	84.5 ± 0.3	81.5 ± 1.2	81.5 ± 1.2
Figure 9: Effect of OOD threshold  $\delta$  on classification accuracy (\%) of ODIN+TENT on CIFAR10-C. Averaged over three different random seeds.
thus it prevents potential model drift from the beginning of TTA scenarios. As a result, our approach outperforms RoTTA in noisy test streams (e.g.,  $5.4\%$  better than RoTTA on CIFAR10-C).
D.3 Comparison with out-of-distribution detection algorithms
We discussed the limitation of applying out-of-distribution detection to TTA in Section 5. Still, we are curious about the effect of applying out-of-distribution algorithms to our scenario. To this end, we conduct experiments using one of the out-of-distribution algorithms, ODIN [20], in our noisy data streams. Specifically, we filtered OOD samples detected by ODIN and performed TTA algorithms on the samples left.
Note that similar to prior studies on OOD, ODIN uses a thresholding approach to predict whether a sample is OOD. It thus requires validation data with binary labels indicating whether it is in-distribution or OOD to decide the best threshold  $\delta$ . However, in TTA scenarios, validation data is not provided, which makes it difficult to apply OOD algorithms directly in our scenario. We circumvented this problem using the labeled test batches to get the best threshold. Following the original paper, we searched for the best threshold from 0.1 to 0.12 with a step size of 0.000001, which took over 20,000 times longer than the original TTA algorithm.
Table 11 shows that the impact of discarding OOD samples with ODIN is negligible, yielding only a  $0.3\%$  p improvement in the average accuracy despite a huge computation cost. Also, Figure 9 shows the high sensitivity of ODIN with respect to threshold hyperparameter  $\delta$ , which implies that applying OOD in TTA is impractical.
We conclude the practical limitations of OOD detection algorithms for TTA as follows: (1) OOD methods assume that a model is fixed during test time, while a model changes continually in TTA. (2) As previously noted, most OOD algorithms require labels for validation data unavailable in TTA scenarios. Even using the same test dataset for selecting the threshold, the performance improvement was marginal. (3) Low performance possibly results from the fact that OOD detection studies are
built on the condition that training and test domains are the same, which differs from TTA's scenario. These collectively make it difficult to apply OOD detection studies directly to TTA scenarios.
D.4 Applying to other domains
While this study primarily focuses on classification tasks, there are other tasks where test-time adaptation would be useful. Here we discuss the applicability of SoTTA to (1) image segmentation and (2) object detection, which are crucial in autonomous driving scenarios.
For image segmentation, when noisy objects are present in the input, the model might produce noisy predictions on those pixels, leading to detrimental results. Extending SoTTA to operate at the pixel level would allow it to be compatible with the segmentation task while minimizing the negative influences of those noisy pixels on model predictions in test-time adaptation scenarios.
Similarly, SoTTA could be tailored to object detection's classification (recognition) task. For example, in the context of the YOLO framework [32], SoTTA could filter and store grids with high confidence for test-time adaptation, enhancing detection accuracy. However, our current approach must address the localization task (bounding box regression) during test-time adaptation. Implementing this feature is non-trivial and would require careful consideration and potential redesign of certain aspects of our methodology. Accurately localizing bounding boxes during test-time adaptation presents an exciting avenue for future research.
E License of assets
Datasets CIFAR10/CIFAR100 (MIT License), CIFAR10-C/CIFAR100-C (Creative Commons Attribution 4.0 International), ImageNet-C (Apache 2.0), and MNIST (CC-BY-NC-SA 3.0).
Codes Torchvision for ResNet18 (Apache 2.0), the official repository of CoTTA (MIT License), the official repository of TENT (MIT License), the official repository of LAME (CC BY-NC-SA 4.0), the official repository of EATA (MIT License), the official repository of SAR (BSD 3-Clause License), and the official repository of RoTTA (MIT License).