Variational Model Perturbation for Source-Free Domain Adaptation
Authors: Mengmeng Jing
Xiantong Zhen
Jingjing Li
Cees G. M. Snoek
Venue: NeurIPS 2022 Accept (2022)
Keywords: transfer learning
domain adaptation
variational inference
model perturbation

Abstract: We aim for source-free domain adaptation, where the task is to deploy a model pre-trained on source domains to target domains. The challenges stem from the distribution shift from the source to the target domain, coupled with the unavailability of any source data and labeled target data for optimization. Rather than fine-tuning the model by updating the parameters, we propose to perturb the source model to achieve adaptation to target domains. We introduce perturbations into the model parameters by variational Bayesian inference in a probabilistic framework. By doing so, we can effectively adapt the model to the target domain while largely preserving the discriminative ability. Importantly, we demonstrate the theoretical connection to learning Bayesian neural networks, which proves the generalizability of the perturbed model to target domains. To enable more efficient optimization, we further employ a parameter sharing strategy, which substantially reduces the learnable parameters compared to a fully Bayesian neural network. 
Our model perturbation provides a new probabilistic way for domain adaptation which enables efficient adaptation to target domains while maximally preserving knowledge in source models. Experiments on several source-free benchmarks under three different evaluation settings verify the effectiveness of the proposed variational model perturbation for source-free domain adaptation.

Variational Model Perturbation for Source-Free Domain Adaptation
Mengmeng Jing Xiantong Zhen 2 1, Jingjing Li', Cees G. M. Snoek? University of Electronic Science and Technology of China University of Amsterdam
Abstract
We aim for source-free domain adaptation, where the task is to deploy a model pre-traines pre-trained on source domains to target domains. The challenges stem from the distribution shift from the source to the target domain, coupled with the unavail- ability of any source data and labeled target data for optimization. Rather than fine-tuning the model by updating the parameters, model to achieve adaptation to target domains. We introduce perturbations into the model parameters by variational Bayesian inference in a probabilistic framework. By doing so, we can effectively adapt the model to the target domain while largely preserving the discriminative ability. Importantly, we demonstrate the theoretical connection to learning Bayesian neural networks, which proves the generalizability of the perturbed model to target domains. To enable more efficient optimization, we further employ a parameter sharing strategy. which substantially reduces the learnable parameters compared perturbation provides new probabilistic way for domain adaptation which enables efficient adaptation target domains while maximally preserving knowledge in source models. Experiments on several source-free benchmarks under three differ- ent evaluation settings verify the effectiveness of the proposed variational model perturbation for source-free domain adaptation.
propose to perturb the source
fully Bayesian neural network. Our model
1 Introduction
A well-trained neural network can achieve satisfactory performance on in-distribution tasks. However, in real applications, a common situation that the training set and the test set are from different distributions. In this case, the performance of the models usually degrades significantly due to domain shifts. Domain adaptation (DA) [1, 2, 3, 4] proposed to solve this problem by transferring knowledge from the labeled source domain (the training set) to the unlabeled target domain (the test set). It is assumed that source data are still available when adapting target data. In this paper, we focus on the more challenging scenario where source data are not accessible, which is known as source-free domain adaptation (SFDA) [5, 6]. SFDA promises much wider ranges of applications than the vanilla domain adaptation in that can circumvent the problem of not disclosing source data order to protect the privacy of individuals or the intellectual property of commercial entities.
To deal with domain shift, two popular techniques in the literature to adapt the SFDA model to the target domain are fine-tuning (updating the whole parameters) and modulating (tuning the batch normalization layers and freeze all the other parameters). The former focuses on the difference of domains, while the latter focuses on the relevance of domains. For fine-tuning methods, e.g.. SHOT [7] and NRC [8], the parameters of the entire model are further updated by designing
"This work done when Mengmeng Jing visiting student at University of Amsterdam. Currently with United Imaging Healthcare, Co., Ltd., China.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

optimization objectives. For example, SHOT [7] calibrates the model predictions by information maximization and pseudo-labeled self-supervision. while NRC [8] exploits the nearest neighbor relationship between samples. Though being empirically successful, both model fine-tuning and batch normalization modulation suffer from drawbacks. Fine-tuning may cause some problems. First, the model will deviate from the source data, leading to performance degradation on the source domain, similar to catastrophic forgetting in continual learning [9. 10, 11, 12J. We care about the performance on the source domain since in the more generalized SFDA scenario [13] we do not necessarily have the target domain ID available, and therefore we would not know when to deploy the source model. Second, fine-tuning could result in model being biased to specific target domain (overfitting), thus reducing the generalization of the model [14, 15, 16]. Third, since there are no regularizations from the labeled source data, e.g., cross entropy loss, emrors may accumulate and the parameters of the model may be distorted, leading to low performance in Continual Online SFDA [17]. Batch normalization modulation approaches [18, 19, 20] keep weights of all convolutional and fully- connected (FC) layers frozen, and only modulate the statistics in the batch normalization layers [2i] to adapt to target data. However, they tend to be less flexible and would not continuously adapt to larget data with large domain shifts. In addition, those are all deterministic approaches which suffer from lack of generalizability [22, 23, 24].
In this paper, we propose variational model perturbations, which fixes the existing weights and slightly perturbs them to encode the uncertainties according to the domain shifts. We learn to perturb model parameters to achieve domain adaptation by variational inference. By variational perturbations, we introduce uncertainties into the model. As result, perturb deterministic network into Bayesian neural network (BNN), allowing the model to generalize to relevant domains. We demonstrate that by perturbing the model in variational manner, we are equivalent to learning special BNN with a fixed mean and a learnable variance. To achieve more efficient perturbation, we further adopt a parameter sharing strategy, which significantly reduces the learnable parameters. This enables more efficient adaptation in contrast to learning full BNN. It is worth noting that the perturbation is naturally regularized due the variational inference formulation, which prevents the perturbed weights from being distorted during the continuous unsupervised learning. Our approach is easy to implement, offers plug-and and--lay module to adapt model parameters and works seamlessly with different optimization objectives. We conduct extensive experiments on five datasets with three different evaluation settings. The results consistently demonstrate the effectiveness of variational model perturbation for source-free domain adaptation.
2 Methodology
We start from the vanilla unsupervised domain adaptation, based on which we formally introduce the setting for source-frec domain adaptation. For the vanilla unsupervised domain adaptation setting, we are given a source domain D.= (< x; E X2, y E V= with n, labeled data and a target x) with n, unlabelled data under the condition that p(X,) # p(X)) where p(X)) and p(X)) are the source and target data distributions. The source and target domains share the same label space, V.-V The task is to learn a model f X₁ -> 3/2 that could predict the target labels. In the source-free domain adaptation setting, are only given the unlabeled target domain data D, (a and the model trained on the source domain parameterized by W..
domain D, D==(z/jaff
Model Perturbation with Uncertainty From the probabilistic perspective, we define a model p(w,) to be trained the source domain D,. Then, the model parameters w, can be optimized by maximum likelihood estimation under the i.idd. assumption:
We arg max log logp(D,/us, arg max #i,
Σ logu(vi (xj, w.).
Usually we could optimize Eq. (1) through mini-batch based stochastic gradient descent [25] and the optimum of We is a point estimate of the model parameter. Having a model pre-trained in Eq. (1) on source domain, we would like deploy it different target domains. However, usually the performance of the source model degrades significantly on the target domains due to the domain shift.
Therefore, we propose to perturb the model parameters based on the point estimate w, in order to make it generalizable to the target domain while maximally maintain the discriminative ability of the source model. Denote the perturbed weights ws, which is obtained by simple perturbation

---

operation as follows:
(2) where Aw the perturbation for ws. It worth noting that we only perturb the weights of the convolutional and FC layers in the network and we update the running mean and running variance in the batch normalization layers through moving average.
Wy w, + Aw,
In this paper, we formulate the perturbation as a variational inference problem in a probabilistic framework. Given the target domain Dr. we compute the posterior distribution of the perturbations by Bayesian inference, i.e., p(Aw] However, directly computing the expectations of the posterior distribution is intractable, since is equivalent to computing expectations of uncountably infinite set of neural networks [23, 26]. Therefore, as a more realistic alternative, we resort to computing the posterior distributions through variational inference.
Specifically, assume the perturbations are drawn from a zero-mean distribution, i.c., Aw N o where is the learnable standard deviation. Then, our task reduces to solving the optimization problem such that the variational posterior q (Aw((0, o can approach the true posterior p(Aw| DD). We minimize the Kullback-Leibler (KL) divergence between them as follows:
o² arg min KL[g (ww [t)]
arg min / (A 0 log q ((Aw (0, o)
dAw
pl p(Aw] D+)
ạ( [Aw 00 σ)
arg min
((Aw) 0, log
p( De Aw p AA)))) dAw
arg min [L |p (ww) Ey Dr Aw),,
(3)
where the first term in Eq. (3) is the KL divergence between the posterior and the prior, and the second term is the expectation likelihood. The objective function of our method is Eq. (3). For the expectation likelihood term, it has different implementations and we will discuss it later. The specific forms of the objective function under different implementations are included in supplementary material.
Choosing zero as the mean of Au is because we want to avoid the perturbed model deviating much from the source model that can adapt more general settings, i.e. Generalized SFDA [13] and Continual Online SFDA [17]. In this way, the weights of the perturbed model will vary around the weights of the source model while being generalizable due to the uncertainty induced by non-zero variance. In essence, we expand the effective coverage of the source model to the target domain.
Connection to Learning Bayesian Neural Network It has been proven that introducing uncer- tainty into weights can improve generalizability of neural networks [23, 24). Actually, under mild conditions, our method is equivalently learning BNN. We demonstrate this as follows.
Assume that we would like to learn a neural network by variational Bayesian inference, where we place a prior (w))) over the weight. We design the variational posterior qww//,,, r). Here assume the mean w, to be a constant which is the point estimate of the model parameters, and the variance o² to be learnable variable. We minimize the KL divergence between the variational posterior (wy/ o) and the true posterior p(w,) Dz):
o² = arg min KL (g( w. a) ()l[pw, D:)]
(4)
arg min / a(w:/ww lw,, oog ((wrlwar σ)
dw,.
(5)
p(w,)p(DD ww))
As we define = + War the posterior wa ~ g(wy 0²) is transformed from Aw ~
((w o²). By adopting the technique of change of variables to Eq. (5), we arrive at:
arg arg min / q(Aw/) olog Aw) D, Aw)
q(Aw 0, σ) dAw
(6)
arg min KL (Awr D.)]-
Therefore, minimizing the KI. divergence between q( [., .r and p(w:] D.) equivalent to mini- mizing the KL divergence between (w σ) and p( Awl D.).
3

---

Notably, in BNN, the prior is usually set to be noninformative normal Gaussian distribution [22. 23, 27]. Here we just assume we adopt the same noninformative normal Gaussian prior, i.e.. p(w))=p(Aw) For practical optimization, since the prior only serves as regularizer in the KI. divergence term while our goal is infer the posteriors, the two inferred posteriors do not necessarily have the same variance. Even if the prior distributions are different, the conclusion that variational model perturbation is equivalent to learning a BNN still holds.
Variational Posterior of Perturbations Following [23], we assume that the variational posterior distribution a diagonal Gaussian distribution. Then we can obtain a sample of the perturbations Aw by sampling the unit Gaussian and scaling it by the standard deviation Ø. To ensure that o is non-negatee non-negative, in practical implementations calculated as o ex)(()) where p is the de facto variational posterior parameter which is the logarithm of the variance. Thus, sample from the perturbed can be represented as:
not calculated and updated directly. Specifically,
Wi = ws + exp(p),
where e I) and denotes element- wise wise multiplication.
Previous works have shown that the selection of different priors affects the generalization performance of the model [28, 22, 29]. Considering that weights of each layer have different variations, it may be sub-optimal to use a uniform prior for the whole network. Therefore, we propose to specify different priors for perturbations of each layer according the statistical properties within the pre-trained model. Specifically, each convolutional layer contains multiple convolutional kernels. Previous research [28] has found that weights in the same convolutional kernel have strong correlations, while different convolutional kernels do not, even if they are in the same layer. In view of this, we propose an adaptive prior, which computes the standard deviation of each convolutional kernel in the pre-trained model as the prior of the perturbations of the whole convolutional kernel. Then, the prior shared by the whole convolutional kernel follows:
Prior of Perturbations
p(Aw")) = (O, A Var(w=")
99)
where p( () represents the prior distribution for perturbations of the i-th convolution kernel in (-th convolutional layer, and Var the variance of the convolutional kernel in the pre-trained model wg. is a scale coefficient. We experimentally observed that X=1.0 can achieve satisfactory performance.
Likelihood Function In general, variational model perturbation is independent of the likelihood function. In SFDA, the target data are unlabeled, the likelihood function can be implemented by optimization with respect unsupervised losses. For example, can minimize entropy loss [18] to encourage the model predictions to be close to one-hot encodings. In addition, Liang et al. [7] highlight that ideal predictions should have enough category diversity, we can achieve this by maximizing the mean of the entropy of predictions in a mini-batch. All these objective functions can be well integrated within our framework. We report the results of our method under different implementations of the likelihood in the experimental section.
Parameter Sharing Strategy Since the parameters in the same convolutional kernel have strong correlations [28], it is a natural choice to adopt a parameter sharing strategy for the convolutional layers so that we further reduce the learnable parameters, i.e., all the weights in the convolutional kernel share the same perturbations. Thus, the number of learnable parameters for each convolutional layer is equal to the number of output channels. By doing so, we can largely reduce learnable parameters without significantly degrading performance.
Through the parameter sharing strategy, deconstruct the training process of SFDA into a static invariant part and a dynamic varying part: we can train a model with millions of parameters (static part) in the source domain, and then adapt it to different target domains by learning small number of perturbation parameters (varying part), which avoids training the parameters of the whole model every time, reduces the storage space and makes the process of domain adaptation more flexible.
3 Related Works
Unsupervised Domain Adaptation. Unsupervised domain adaptation [30, 31, 32, 33) aims at transferring knowledge from the source domain to the unlabeled target domain in order to perform

---

Table 1: Difference between our model perturbation and related methods. Model perturbation is the only source-free online domain adaptation method that introduce uncertainty the model without any extra requirement.
Source-Free Online
Uncertainty Adaptation Scheme
Extra Requirement
Tent [18]
SHOT [7]
V
Conv FC Conv + FC
TTT [42]
X
auxiliary task multiple models
BACS [43]
Conv + FC
This paper
V
Perturbations
X
as well on the target domain. Most methods minimize the expected error of the model on the target domain by reducing the domain shifts. For example, methods based on adversarial generative networks [34, 1, 35] learn nomain-indistingun
features in an adversarial manner. Statistical matching methods [36, 37, 38, 39] try to mitigate domain shifts by aligning the first- or second-order statistics between domains.
Source-Free Domain Adaptation. Unsupervised domain adaption assumes that source data is available when adapting to target domains, which would not always hold in real-world applications due to issues of intellectual property, individual privacy, decentralisation, etc. Therefore, Source-Fiin Free Domain Adaptation (SFDA) is proposed to solve this problem [5, 6, 7, 8, 40, 41]. In the setting of SFDA, only the pre-trained model in the source domain and the unlabeled target data are provided. Kundu et al. [6] align the source and target domains using generative models. Ishii and Sugiyama [41] reduce domain shifts by aligning the statistics stored the batch normalization layers. From an unformation-theoree
perspective, Liang et al. [7] proposes SHOT fine-tune the source model using target data by imposing entropy minimisation and diversity maximisation for predictions. In addition, SHOT employs self-supervised learning using pseudo-labels. Yang al. [8] exploit the intrinsic neighborhood structure to encourage label consistency among target data. Huang et al. [40] maintain the consistency of features between the historical model and adapted model through contrastive learning.
Online Source-Free Domain Adaptation. SFDA methods [7, 6, 8, 40] assume all target domain data are available during training, and they also optimize dedicated objective functions through multi- ple iterations. To be applicable scenarios such as autonomous driving and real time object tracking online SFDA, also known as test-time adaptation, has been explored. For example, AdaBN [19] and Test-time BN [20] improve the performance of the model in the target domain by recalculating the Batch Normalization (BN) statistics in the test period instead of using fixed BN statistics from the pre-trained model. Tent [18] modulates the parameters in the BN layers through entropy mini- mization to adapt the test data in real time. For stable and effective adaptation, Tent freezes all the parameters except the BN layers. Test-Time-Trainngg [42] introduces additional auxiliary tasks to improve test-time performance. Cotta [17] adopts weight-averaging and augmentation-avvraggnn calibrate pseudo-labels they use these reliable pseudo-labels for self-supervised regularization. By contrast, our model perturbation freezes all weights except the batch normalization parameters in the source model, which avoids error accumulation and knowledge forgetting.
avoid error accumulation during continual test-time adaptation, then
We provide comparison between the proposed model perturbation and related methods in Table 1. Most existing approaches are developed in a deterministic manner, without exploring the uncertainty. Differently, in this work we address source-free free domain adaption in probabilistic framework by modelling weight uncertainty.
Bayesian Neural Networks. Our work is also closely related to Bayesian neural networks. They combine neural networks with Bayesian inference, which explain the uncertainties from the model and provides the distributions over the weights and outputs. Various techniques have been explored to learn Bayesian neural networks including variational inference [44, 26], probabilistic backpropagation [45], Hamiltonian Monte Carlo [46] and the Laplace approximation [27]. Our variational model perturbation provides an alternative way of implementing Bayesian inference for neural networks. Compared to previous implementations, our method is plug-and ald--and-play and more flexible. It provides
5

---

an efficient way to adapt a deterministic source model to a target domain by transforming into probabilistic one while avoiding re-training a full Bayesian neural network.
Experiments
4.1 Datasets and Settings
Datasets. We report our experiments on five datasets. The Office [47] dataset includes 3 domains. All the images are categorized into 31 classes. Office-Home [48] consists of 4 domains. Each domain contains 65 different classes. CIFARIO-C. CIFAR100-C [49] and ImageNet-C [49] include 15 different types of corruptions imposed on the original CIFARIO, CIFAR100 and ImageNet datasets, respectively. Each corruption type contains 5 different corruption severities. Each severity has 10,000 images in PPPARI-C/CIIFARI0--- and 50,000 images in ImageNet-C, respectively.
Evaluation Settings. We test our method on three source-free domain adaptation settings. For clearer elaboration of the experimental details, we clarify SFDA consists of three phases, namely, source pre-training, target adaptation and testing. Offline SFIA [6, 5]: In the target adaptation phase, we can access data of the entire target domain and optimize the objective functions with multiple iterations. Generalized SFDA [13]: we split the source data into 80% and 20% parts. In the source tre-training phase, we use the labeled 80% part to pre-train the source model. In the target adaptation phase, we use all the unlabeled target data to adapt the model. In the testing phase, we predict the remaining 20% source data and all target data. We compute the harmonic mean of the source and AcCr target accuracies: Harmonic- Acc.+AACe Continual Online SFDA [17]: the target domain phase and the testing phase are carried out simultaneously. At each iteration, we can only access data in one batch and data in the previous iteration cannot be accessed again. We carry out this experiment in more challenging setting where data of different domains are encountered continually.
The detailed training processes of our method under the three settings are in suplementary material.
4.2 Implementation Details
The objective function in Eq. includes the KL divergence loss and the expectation likelihood loss. In the three settings, we adopt different implementations of the expectation likelihood loss.
For Offline SFDA and Generalized SFDA, we employ the information loss and self supervieed loss as in SHOT [7] to optimize the expected likelihood loss. For a fair comparison, we use ResNet-50 as the backbone just as the previous methods [7, 1, 13, 40]. In the source-pretraining phase, this backbone is trained on the source domain to obtain the source pre-trained model. As for the optimizer, following [7], we employ Stochastic Gradient Descent with weight decay le-3 and momentum 0.9, As for the learning rate, set 2c-3 for the backbone model and 2c-2 for the bottleneck layer newly added in SHOT. In addition, 33 is a hyper-paramett which balances the importance of information loss and self-supervision loss in SHOT. Since the parameters learned by model perturbations are different from those of SHOT, the value of 33 used SHOT may not be optimal. Therefore, we search the optimal value 8d in range of [0.1,2.0] for all the three datasets. Then, 8* is set to 0.3 in both Office and Office- Home. The batch size is 64.
For Continual Online SFDA, we use the entropy loss as the likelihood function in Eq. 3. In this way, the implementation equivalent to a perturbation of Tent [18]. We use the same network architectures as in [17] to make the results comparable. In CIFAR 10-C, we employ WideResNet-288 [50] from Robust Bench [51] as the backbone network. We used the Adam [52] optimizer with learning rate 5c-4. In CIFARI00
tasks, used ResNeXt-29 [53] from [54]. The optimizer settings are the same as that in CIFAR 10-C except the learning rate Is 7c-5. In the ImageNet-C experiments, a pre-trained ResNet-50 is employed. We adopt the Stochastic Gradient Descent optimizer with learning rate lc-4, momentum 0.9 and weight decay 0. In the testing phase, given a batch of target samples, we iterate the proposed method for only one epoch and make predictions immediately.
We set the scale parameter of the prior to be 1.0. We discuss the impact of different choices of priors on performance in Section 4.3. In the target adaptation phase, we sample the perturbations once for running efficiency, while the test phase, we sample the perturbations 10 times. To reduce the sampling variance, we employ the local reparameterization trick [55]. The detailed optimization

---

50
Wacamm-kmazonj--lssannccc
50
Art-+Cliprtt Lt-distance: 1.92)
Webcam-OSLR (4. Ai-distance: 1.09)
Art-Product LA-distance: 1.53)
MW
40
30
4x norm of
20
10
20
50
30
40
Layer
Layer
(a) Office-31
(b) Office-Home
Figure 1: We measure the weight uncertainty by an & norm of a per ResNet-50 layer. The for difficult task (e.g., W-+) has larger & norm than the easy task (e.g.. W-D), and correspondingly the perturbations vary over larger range, i.e., larger uncertainty. Therefore, the perturbations we learned can be regarded as a measure uncertainty, which reflects the distribution shifts between domains. Here means a larger domain gap.
the A-distance
indicator of the domain gaps, where larger A-distance
90
w/o share
80
w/ share
Office (isotropic prior)
60
86
Office (aduptive prior)
Accuracy
(isatropic prior)
70
84
CIFARID-C (adaptive prior)
20-
82
66
1-5
16:3
(a) Scale factor of prior
Parameter sharing
(c) Layers w/o perturbation
Figure 2: (a) Impact of different variance scale factors; (b) Comparison of performance with and without parameter sharing strategy. "w/o share" means learn different for each parameter in the convolutional kernel individually; (c) Impact of layers without perturbations where the results are based on Office-Home dataset and the backbone ResNet-50.
process with local reparameterization trick is in the supplementary material. We also diseuss the effect of different numbers of Monte Carlo samples on performance in the training phase in the supplementary material.
As for the compared methods, we either report the results in the original papers or the best results we reproduce. For the non-Bayesian methods, we them 10 times with different random seeds and take the average of them to reduce randomness. Apart from SHOT and Tent, we have also applied our variational model perturbation to other methods and report the results in the supplementary material.
Code is available https: / / thub.
Moode__erruurbttion
Effectiveness Analysis
We present effectiveness analysis of our method in Fig. 1, Fig. 2 and Fig. 3. Results of our method in the offline setting are from perturbed SHOT and in the online setting from peturbed Tent.
Quantification of Weight Uncertainty. In Fig. I report a proxy of the weight uncertainty using the f--nrmm of the learned per layer. We make the following observations: (1) In the first few layers of the network, the perturbations are small. As the layers go deeper, the perturbations become larger. This shows that the shallower layers of the neural networks are more generalized, while the deep layers are task-specific, which consistent with the findings previous work [56, 38]; (2) The extent of the perturbation is task-dependent. A larger domain shift of the task needs larger perturbation, which demonstrates that model perturbation effectively encodes uncertainty into the network, thus enhancing the generalization.
7

---

Table 2: Offline SFDA accuracy (%) on Office, where all methods use a ResNet-55 backbone. Our variational model perturbation performs best on the majority of target domains and results the best average accuracy.
Office
A-W
A-D
W-A
W-D
D-A
D-W
Mean
Source-use
DAN [38]
80.5
78.6
62.8
99.6
63.6
97.1
80.4
DANN [57]
82.6
81.5
67.5
99.3
68.4
96.9
82.7
MCD [34]
88.6
92.2
69.7
100.0
69.5
98.5
86.5
BNM [58]
91.5
90.3
71.6
100.0
70.9
98.5
87.1
SAFN [59]
90.1
90.7
70.2
99.8
73.0
98.6
87.1
CDAN+E [1]
94.1
92.9
69.3
100.0
71.0
98.6
87.7
MDD [60]
90.4
90.4
73.7
99.9
75.0
98.7
88.0
BDG [61]
93.6
93.6
72.0
100.0
73.2
99.0
88.5
Source-free
Source-only
76.9
80.8
63.6
98.7
60.3
95.3
79.3
SHOT [7]
90.1
94.0
74.3
99.9
74.7
98.4
88.6
This paper
93.3
96.2
76.9
100.0
75.4
98.6
90.0
In Fig. (a) we report the impact of the variance scale factor of the prior on performance. Compared to the isotropic Gaussian prior, our adaptive prior has better per- formance and smaller fluctuations for different scale factors. This indicates that it is reasonable to use an adaptive prior as different weights may have different variation ranges when adaptation. Our adaptive prior can specify different prior distributions for different weights according to the statistical properties within the convolutional kernels, leading better performance.
Adaptive Prior.
80
Source-only
Fine-tuning Model perturbation
BN modulation
Accuracy (%)
70
60
50
40
30
Office-Home
CIFAR100-C
Figure 3: Comparison of different adaptation schemes. Model perturbation outperforms BN modulation and fine-tuning on both offline tasks Office-Home) and online tasks (CIFAR100-C),
Parameter Sharing Strategy. In Fig. (b) we observe that the parameter sharing strategy achieves almost exactly the same performance compared with the non-sharing strategy. For ResNet-50 based tasks, e.g.. Office and Office- Home, the learnable parameters reduce from 24.03 million to 600 thousand compared with the non-sharing strategy. As for the WideResNet-228 based tasks, e.g., CIFARIO-C. the learnable parame- ters reduce from 36.47 million to 30 thousand. These results verify the effectiveness of the parameter sharing strategy.
Which Layers are Crucial for Perturbation? We test the performance by keeping some of the network layers unperturbed. As shown in Fig. (c), observe that the performance of the model degrades considerably when removing perturbations in the last few layers the network, revealing that perturbations for the last few layers crucial, since these layers are often task-relevant.
Adaptation Schemes. In Fig. 3, we compare results of different updating schemes on Office-Homm Home and CIFAR 100-C. BN modulation means only updating the statistics in the batch normalization layers. Fine-tuning represents updating all the weights in the model. We observe that model perturbations outperforms BN modulation and fine-tuning in both the offline and online SFDA tasks. Compared with BN modulation, model perturbation more flexible. It can generalize the model to more target domains through perturbations. Compared with Fine-tuning, model perturbation avoids the distortion of weight the source model, which prevents the knowledge the source domain from being forgotten in continuous adaptation. Therefore, model perturbation is the better choice in SFDA tasks.

---

Table 3: Offline SFDA accuracy (%) Office- where all methods ResNet-50 backbone. Our variational model perturbation performs best on the majority of target domains and results the best average accuracy.
Office-Home
Ar M-ICI Ar PPr Ar Rw CI
+Ar CI Pr CI RRw Pr Ar Pr-CI Pr PR Rw Ar Rw CI Rw Prr
Mean
Source-use
DAN [38]
43.6
57.0
67.9
45.8
56.5
60.4
44.0
43.6
67.7
63.1
51.5
74.3
$6.3
DANN [57]
45.6
59.3
70.1
47.0
58.5
60.9
46.1
43.7
68.5
63.2
51.8
76.8
57.6
MCD [34]
48.9
74.6
61.3
67.6
68.8
57.0
47.1
75.1
69.1
79.6
64.1
CDAN+E
50.7
70.6
76.0
57.6
70.0
70.0
57.4
50,9
77.3
70.9
56.7
81.6
65.8
SAFN [59]
52.0
71.7
76.3
64.2
69.9
71.9
63.7
51.4
77.1
70.9
57.1
81.5
67.3
BNM [58]
52.3
73.9
80.0
63.3
72.9
74,9
61.7
49.5
79.7
70.5
53.6
82.2
67.9
MDD [60]
54.9
73.7
77.8
60.0
71.4
71.8
61.2
53.6
78.1
72.5
60.2
82.3
68.1
BDG [6]]
51.5
78.7
65.3
71.5
73.7
65.1
49.7
81.1
74.6
84.8
68.7
Source-free
Source-only
44.6
67.3
74,8
$2.7
62.7
64.8
$3.0
40.6
73.2
65.3
45.4
78.0
60.2
SHOT [7]
57.1
78.1
81.5
68.0
78.2
78.1
67.4
54.9
82.2
73.3
58.8
84.3
71.8
This paper
57.9
82.5
79.4
80.6
68.4
55.6
83.1
75.2
84.7
72.8
Table Generalized SFDA accuracy (%) on Office-Home, where all the methods a ResNet-50 backbone. Our variational model perturbation effectively adapts to the target domain while still maintaining the discriminative ability the source domain. All per-domain results are provided in the supplementary material.
Office-
Source
Targel
Harmonic
Source-only
83.6
59.1
69.2
SHOT [7]
71.7
70.4
71.0
This paper
76.6
71.6
74.0
4.4 Results
In this section, we provide the experimental results on five datasets under three different evaluation settings. We also provide more detailed results in the supplemental material.
Offline SFDA. We report the comparison results on Office in Table 2 and Office-Home Table 3. From the results observe that the variational model perturbation achieves the best average results on Office, showing the stronger generalization performance of the perturbed model. Moreover, the variational model perturbation achieves the best results 4 out of 6 tasks. In particular, method has improved by 1.4% compared with unperturbed SHOT. A similar trend can be observed in the Office-Home dataset, the variational model perturbation wins taskes across all the 12 tasks. In addition, our method outperforms SHOT by 1.0%, which proves that the variational model perturbation can consistently and clearly improve existing methods.
Generalized SFDA. Table we report the results model perturbation on Generalized SFDA tasks. this setting, we first train the source model with 80% of the source data, and then adapt the model to the target domain. Finally, we evaluate the model on both the target domain and the remaining 20% of the source data. We observe that the performance of SHOT the source domain decreases by 1 11.9% compared to the source model, indicating that SHOT forgets the knowledge learned in the source domain. Compared to SHOT, model perturbation maintains the performance on the target domain while considerably improving the performance the source domain, revealing that our model perturbation can maintain good balance between adaptation and knowledge preservation.
Continual Online SFDA. In Fig. 4 we report the test errors of different methods under the continual online SFDA, where all the methods continuously encounter 15 different types of corruption. This experiment not only tests the real-time prediction performance of the compared methods, but also shows the degree of knowledge forgetting. Note that Tent [18] only updates the parameters in BN layers while Tent-FT (implemented by us) updates all the weights. Similar to Tent, BACS [43] also employs entropy minimization, with the difference that BACS optimizes the model through maximum-a sximmum-a-pssterion probability.

---

5o
10
725
700
20
075
Ter-
TAST (b) CIFARI00-C
Sarss Acd5
Tar-
BACS
(a) CIFARIO-C
(c) ImageNet-C
Figure 4: Test errors (%) under the continual online setting. The backbone of CIFARIO-C, CIFARI00- C and ImageNet-C are WideResNet-28, ResNeXt-29 and ResNet-50. The corruption severity 5, Model perturbations achieves the best performance across all tasks.
In Fig. 4 (a) both AdaBN and Tent have test errors larger than 20.0%, revealing that the inflexibility of freezing the weights is the bottleneck for adapting to the continuously changing target domains. By unfreezing the parameter update of the convolutional and FC layers, Tent-FT improves Tent by 0.9%. Compared to Tent and Tent-FT, the implementation of model perturbation based on Tent achieves performance advantages of 2.8% and 1.9%, respectively, demonstrating that model perturbation is the better choice for SFDA tasks. The performance advantages stem from two aspects. First, model perturbation fixes all the weights of the convolutional and FC layers avoid large distortion of the weights and forgetting knowledge on the source domain. Second, model perturbation introduces uncertainty into the model by slightly disturbing the weights, allowing to adapt continuous distribution shifts. Similar conclusions can be drawn on CIFAR and ImageNet-C.
5 Conclusion
In this paper, we address source-free domain adaptation a probabilistic framework by variational model perturbation. Instead of updating the network parameters by further optimization, introduce perturbations to the weights of a pre-trained model from source domains. We learn these perturbations through variational Bayesian inference. Importantly, we prove the connection between variational model perturbation and Bayesian learning of neural networks, which provides a theoretical guarantee for the generalization performance of model perturbation. Moreover, with the parameter sharing strategy, we substantially reduce the learnable parameters compared to a fully Bayesian neural network, making the model perturbation flexible and lightweight framework. Our variational model perturbation offers a new, probabilistic framework for source-free domain adaptation, which achieves efficient adaptation while largely preserving the discriminative ability of the source model. The experimental results on five benchmark datasets under three different evaluation settings reveal that model perturbation offers an effective way for source-free domain adaptation and boosts the performance considerably.
Acknowledgments and Disclosure of Funding
This work is financially supported by China Scholarship Council (CSC).
References
[1] Mingsheng Long, Zhangjic Cao, Jianmin Wang, and Michael Jordan. Conditional adversarial domain adaptation. In Advances in neural information processing systems, pages 1640-1650, 2018.
[2] Jaemin Na, Heechul Jung, Hyung Jin Chang, and Wonjun Hwang. Fixbi: Bridging domain spaces for unsupervised domain adaptation. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1094-1103, 2021.
[3] Jingjing Li, Erpeng Chen, Zhengming Ding, Lei Zhu, Ke Lu, and Heng Tao Shen. Maximum density divergence for domain adaptation. IEEE transactions on pattern analysis and machine intelligence, 2020.
10

---

[4] Mengmeng Jing, Jingjing Li, Lei Zhu, Zhengming Ding, Ke Lu, and Yang Yang. Balanced open set domain adaptation via centroid alignment. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 8013-8020, 2021.
[5] Rui Li, Qianfen Jiao, Wenming Cao, Hau-San Wong, and Si Wu. Model adaptation: Unsuper- vised domain adaptation without source data. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9641-9650, 2020.
[6] Jogendra Nath Kundu, Naveen Venkat, R Venkatesh Babu, et al. Universal source-free domain adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4544 4553, 2020.
[7] Jian Liang, Dapeng Hu, and Jiashi Feng. Do we really need to access the source data? source hypothesis transfer for unsupervised domain adaptation. In International Conference on Machine Learning, pages 6028-6039. PMLR, 2020.
[8] Shiqi Yang, Yaxing Wang, Joost van de Weijer, Luis Herranz, and Shangling Jui. Exploiting the intrinsic neighborhood structure for source-free domain adaptation. In Advances in Neural Information Processing Systems, volume 34, 2021.
[9] David Lopez-Paz and Marc' Aurelio Ranzato. Gradient episodic memory for continual learning. In Advances in neural information processing systems, volume 30, 2017.
[10] Ju Xu and Zhanxing Zhu. Reinforced continual learning. Advances in Neural Information Processing Systems, 31, 2018.
[11] Friedemann Zenke, Ben Poole, and Surya Ganguli. Continual learning through synaptic intelligence. In International Conference on Machine Learning, pages 3987-3995, PMLR, 2017.
[12] Cuong Nguyen, Yingzhen Li, Thang D Bui, and Richard E Turner. Variational continual learning. In International Conference on Learning Representations, 2018.
[13] Shiqi Yang. Yaxing Wang, Joost van de Weijer, Luis Herranz, and Shangling Jui. Generalized source-free domain adaptation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 9978-8987, 2021.
[14] Ananya Kumar, Aditi Raghunathan, Robbie Matthew Jones, Tengyu Ma, and Percy Liang. Fine- tuning can distort pretrained features and underperform out-of-distribution. In International Conference on Learning Representations, 2021.
[15] T Zhang and FJ Oles. A probability analysis on the value of unlabeled data for classification problems. In International Conference on Machine Learning. PMLR, 2000.
[16] Matthias Seeger. Input-dependent regularization of conditional density models. Technical report, 2000.
[17] Qin Wang, Olga Fink, Luc Van Gool, and Dengxin Dai. Continual test-time domain adaptation. In Proceedings of Conference on Computer Vision and Pattern Recognition, 2022.
[18] Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno Olshausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization. In International Conference on Learning Representations, 2020.
[19] Yanghao Li, Naiyan Wang, Jianping Shi, Jiaying Liu, and Xiaodi Hou. Revisiting batch normalization for practical domain adaptation. In International Conference on Learning Representations Workshop, 2017.
[20] Zachary Nado, Shreyas Padhy, D Sculley, Alexander D' A'mourr, Balaji Lakshminarayanan, and Jasper Snock. Evaluating prediction time batch normalization for robustness under covariate shift. arXiv preprint arXiv:20006 10963, 2020.
[21] Sergey loffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International Conference on Machine Learning, pages 448-456 PMLR, 2015.

---

[22] Andrew G Wilson and Pavel Izmailov. Bayesian deep learning and probabilistic perspective of generalization. In Advances in Neural Information Processing Systems, volume 33, pages 4697-4708, 2020.
[23] Charles Blundell, Julien Cornebise, Koray Kavukcuoglu, and Daan Wierstra. Weight uncertainty in neural network. In International conference on machine learning, pages 1613-1622 PMLR, 2015.
[24] Zehao Xiao, Jiayi Shen, Xiantong Zhen, Ling Shao, and Cees G M Snoek. A bit more bayesian: Domain-invariant learning with uncertainty. In International Conference on Machine Learning. PMLR, 2021.
[25] Léon Bottou. Large-scale machine learning with stochastic gradient descent. In Proceedings of COMPSTAT"2010, pages 177-186. Springer, 2010.
[26] Alex Graves. Practical variational inference for neural networks. In Advances in Neural Information Processing Systems, volume 24, 2011.
[27] David JC MacKay. A practical bayesian framework for backpropagation networks. Neural computation, 4(3):448 4424-422 1992.
[28] Vincent Fortuin, Adrià Garriga-Alonso Sebastian W. Ober, Florian Wenzel, Gunnar Ratsch, Richard E Turner, Mark van der Wilk, and Laurence Aitchison. Bayesian neural network priors revisited. In International Conference on Learning Representations, 2022.
[29] Daniele Silvestro and Tobias Andermann. Prior choice affects ability of bayesian neural networks to identify unknowns. arXiv preprint MiXiv:2005.0498: 2020.
[30] Sinno Jialin Pan and Qiang Yang. A survey transfer learning. IEEE Transactions knowledge and data engineering, 22(10): 2010.
[31] Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jen- nifer Wortman Vaughan. A theory of learning from different domains. Machine learning, 79(1-2):151-175. 2010.
[32] Mengmeng Jing, Jidong Zhao. Jingjing Li, Lei Zhu, Yang Yang, and Heng Tao Shen. Adaptive component embedding for domain adaptation. IEEE transactions on cybernetics, 2020.
[33] Jingjing Li, Mengmeng Jing, Ke Lu, Lei Zhu, and Heng Tao Shen. Locality preserving joint transfer for domain adaptation. IEEE Transactions on Image Processing, 28(12):6103-6115 2019.
[34] Kuniaki Saito, Kohei Watanabe, Yoshitaka Ushiku, and Tatsuya Harada. Maximum classifier discrepancy for unsupervised domain adaptation. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3723-3732, 2018
[35] Mengmeng Jing, Lichao Meng. Jingjing Li, Lei Zhu, and Heng Tao Shen. Adversarial mixup ratio confusion for unsupervised domain adaptation. IEEE Transactions on Multimedia, 2022.
[36] Mingsheng Long, Jianmin Wang, Guiguang Ding, Jiaguang Sun, and Philip Yu. Transfer feature learning with joint distribution adaptation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2200-2207, 2013.
[37] Jingjing Li, Ke Lu, Zi Huang, Lei Zhu, and Heng Tao Shen. Transfer independently together: A generalized framework for domain adaptation. IEEE transactions cybernetics, 49(6:2144 2155, 2018.
[38] Mingsheng Long, Yue Cao, Zhangjie Cao, Jianmin Wang, and Michael Jordan. Transferable representation learning with deep adaptation networks. IEEE transactions on pattern analysis and machine intelligence, 41(12):3071-300 1-3085, 2018.
[39] Xingchao Peng, Qinxun Bai, Xide Xia, Zijun Huang, Kate Saenko, and Bo Wang. Moment matching for multi-source domain adaptation. Proceedings of the IEFF/CVF international conference computer vision, pages 1406-1415, 2019.
12

---

[40] Jiaxing Huang, Dayan Guan, Aoran Xiao, and Shijian Lu. Model adaptation: Historical contrastive learning for unsupervised domain adaptation without source data. In Advances in Neural Information Processing Systems, volume 34, 2021.
[41] Masato Ishii and Masashi Sugiyama. Source-free domain adaptation via distributional alignment by matching batch normalization statistics. arXiv preprint arXiv:2101.10842 2021.
[42] Yu Sun, Xiaolong Wang, Zhuang Liu, John Miller, Alexei Efros, and Moritz Hardt. Test-time training with self-supervision for generalization under distribution shifts. In International Conference on Machine Learning, pages 9229-9248. PMLR, 2020.
[43] Aurick Zhou and Sergey Levine. Bayesian adaptation for covariate shift. In Advances in Neural Information Processing Systems, 2021.
[44] Geoffrey E. Hinton and Drew Van Camp. Keeping the neural networks simple by minimizing the description length of the weights. In Proceedings of the sixth annual conference Computational learning theory, pages 5-13, 1993.
[45] José Miguel Heránndez Lobato and Ryan Adams. Probabilistic backpropagation for scalable learning of bayesian neural networks. In International conference machine learning, pages 1861-1869. PMIR, 2015.
[46] Radford M Neal. Bayesian learning for neural networks, volume 118. Springer Science & Business Media, 2012.
[47] Kate Saenko, Brian Kulis, Mario Fritz, and Trevor Darrell. Adapting visual category models to new domains. In ECCV, pages 213-226. Springer, 2010.
[48] Hemanth Venkateswara, Jose Eusebio, Shayok Chakraborty, and Sethuraman Panchanathan. Deep hashing network for unsupervised domain adaptation. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages
2017.
[49] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustmess common corruptions and perturbations. In International Conference on Learning Representations, 2019.
[50] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In Edwin R. Hancock Richard C. Wilson and William A. Smith, editors, Proceedings of the British Machine Vision Conference (BMVC), pages 12. BMVA Press, September 2016.
[51] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. In Advances in Neural Information Processing Systems, 2021.
[52] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Interna- lional Conference on Learning Representations, 2015.
[53] Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1492-1500, 2017.
[54] Dan Hendrycks* Norman Mu*, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple method to improve robustness and uncertainty under data shift. In International Conference on Learning Representations, 2020.
[55] Durk P Kingma, Tim Salimans, and Max Welling. Variational dropout and the local reparame- terization trick. Advances in neural information processing systems, 28, 2015.
[56] Jason Yosinski. Jeff Clune, Yoshua Bengio, and Hod Lipson. How transferable are features in deep neural networks? In Advances in neural information processing systems, pages 3320-3328, 2014.
[57] Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In International conference machine learning, pages 1180-1189. PMLR, 2015.
13

---

[58] Shuhao Cui, Shuhui Wang, Junbao Zhuo, Liang Li, Qingming Huang, and Qi Tian. Towards dis- criminability and diversity: Batch nuclear norm maximization under label insufficient situations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3941-3950, 2020.
[59] Ruijia Xu, Guanbin Li, Jihan Yang, and Liang Lin. Larger norm more transferable: An adaptive feature norm approach for unsupervised domain adaptation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1426-1435, 2019.
[60] Yuchen Zhang, Tianle Liu, Mingsheng Long, and Michael Jordan. Bridging theory and algorithm for domain adaptation. In International Conference on Machine Learning, pages 7404-7413. PMLR, 2019.
[61] Guanglei Yang, Haifeng Xia, Mingli Ding, and Zhengming Ding. Bi-directional generation for unsupervised domain adaptation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 6615-6622, 2020.
14

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes]
(c) Did you discuss any potential negative societal impacts of your work? [No]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either the supplemental material or as URL)? [Yes]
(b) Did you specify all the training details (e.g., data splits. hyperparameters, how they were chosen)? [Yes]
(c) Did you report error bars (e.g.. with respect the random seed after running experi- ments multiple times)? [Yes]
(d) Did you include the total amount of compute and the type of resources used (c.g., type of GPUs, internal cluster, or cloud provider)? [Yes]
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [No]
(c) Did you include any new assets either the supplemental material or as URL? [No]
(d) Did you discuss whether and how consent was obtained from people whose data you're using/curating? [N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
15


Reviews:
[{"review_id": "tcXWd0ZSyZw", "reviewer": "Reviewer_ZFKC", "summary": "This paper proposes a novel model perturbation-based method for the source-free domain adaptation (SFDA) problem. Under the mild assumption, the authors connected their variational model perturbation with the bayesian neural network and proposed a perturbation parameters update method for source-free adaptation, avoiding changing the source domain model’s weight severely while improving the model’s generalizability. The experimental results on several domain adaptation benchmarks under three different settings(offline SFDA, Generalized SFDA, and continual SFDA) verify the effectiveness of the proposed method.", "questions": "Please refer to the questions in Weaknesses.", "limitations": "The authors discussed the limitations in section 2.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n\n1. As far as I am aware, this is the first time that the probabilistic model approach is introduced in the source-free domain adaptation. The proposed method is technically sound and novel in the SFDA problem. The intuition behind the variational model perturbation method in this paper fits well the SFDA setting, which can bring some novel insights to the community.\n2. The proposed method is efficient and can be combined with other SFDA methods.\n3. The experiments cover three different SFDA scenarios, and the results generally look promising. The analysis in section 4.3 is comprehensive and addresses some of my concerns during reviewing.\n\nWeaknesses\n\n1. The Methodology section lacks some necessary description of the proposed method and generated algorithm, which results in unclarity and ambiguity. For example: \n    1. What is the form of the specific objective function? （Under the assumption of prior and posterior distribution mentioned in the paper）Could the author further clarify the expression of the regularization term?\n    2. Is the main parameter \\sigma calculated and updated (if any) directly by the neural network？\n2. Some descriptions of the experimental section are confusing.\n    1. For example, in lines 218-225, while describing the offline SFDA, the paper utilizes the “training phase” represents the target training process; however, it is written “the model is first trained using 80% source data and then tested using the rest of the source data and all the target data” for Generalized SFDA setting. Then, in lines 245-247, it mentions only the training phase and the test phase. I suppose these two phrases are both noted for target training. Could the authors harmonize “source training” or “target training” to avoid ambiguity? Besides, could the source model generation process be introduced to make the experimental description more complete? Considering the particular setting of SFDA, I look forward to a clearer elaboration of the experimental details.\n3. The experimental results only mention the accuracy but do not include the variance part. As the proposed model perturbation method only optimized the perturbation’s variance and did not update the source model’s weight, I am curious about the stability of the proposed method.\n4. There are some unclear mathematical expressions. For example, in line 110-111, “Here we assume that we adopt the same prior, i.e., $p(w_t)=p(\\Delta w)$”, does it means that these two random variables have the same variance?\n5. In line 91, this paper directly assumes the zero-mean isotropic Gaussian distribution as the posterior distribution family. Could the authors explain more about such choices and assumptions?\n\n================================================ ================================================\n \nThanks for the effort from the authors, and the rebuttal has well addressed my concerns mentioned above. I would like to raise my score to 7.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "LwWVsY_U4Aa", "reviewer": "Reviewer_N4jQ", "summary": "The paper proposes a variational Bayesian inference framework to perturb source model parameters to address source-free domain adaptation.\n\nThe paper proposes framework simultaneously adapts the source model to the target domain and preserves the discriminability of the model and \n\nThe paper introduces a parameter sharing strategy to achieve more efficient adaptation.\n\nThe paper provides a theoretical connetion between Bayesain learning and the proposed method.\n\nThe paper conducts experiments on three source-free domain adaptation frameworks to verify the performance of the proposed method.", "questions": "As discussed in the weakness, the two limitations of fine-tuning may not be severe for the domain adaptation setting, could the authors discuss some main limitations of fine-tuning such as overfitting on the target data or limited to settings with target labeled data and cannot be applied to unsupervised domain adaptation?\n\nDoes the method only limited to the computer vision setting. In the paper, the authors only gives an instatiation of the cnovolutional layer.", "limitations": "The authors do not discuss the limitations of the method. Could the authors discuss this in the response or point out at which place in the paper the authors discuss this?", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n\nThe general idea is interesting. Prior works on fine-tuning also take techniques to reduce the divergence between the fine-tuned model and the original. This paper directly models the perturbation, which naturally limited the divergence between the tuned model and the original model, which can simultaneously avoids catestraphic forgetting and the enables adaptation.\n\nThe authors adaptively adjust the prior distribution for different convolution kernels, which avoids the influence of the variance in convolutional kernel parameters in the pretrained model.\n\nThe connection to Bayesian learning provides a theoretical basis for the proposed method.\n\nThe paper does not introduce too many extra parameters and could be trained efficiently.\n\nThe Quantification of weight uncertainty is interesting, which shows that different layers have different uncertainty on the parameters. The observation could guide following works on source-free domain adpatation.\n\n\nWeakness:\n\nOn line 3-4, source-free domain adaptation assumes that both source data and labeled target data are not available but not 'or'.\n\nOn line 38-40, the paper argus that the performance on the source domain will degrade. However, in many domain adaptation settings, only the performance in the target domain is important. For the source domain, we can directly use the model trained on the source domain to perform prediction. Thus, different from continual learning, degrading the source performance may not be a shortcoming of domain adaptation methods.\n\nOn line 40-42, the bias to a specific target domain may not be a problem for the domain adaptation to a single domain but a problem for multi-target domain adaptation. However, for multi-target domain adaptation, we can also merge all the domains and perform a single target domain adaptation. \n\nOn line 91-94, the authors defautly assume that \\Delta \\omega has a zero mean, which means that \\Delta \\omega has the highest density according to the property of the Gaussian distribution. However, \\Delta \\omega = 0 indicates that the source network should be directly applied to the target network, which is a clearly suboptimal solution for \\Delta \\omega. Why does the authors use a obviously suboptimal solution at the point of the highest density for \\Delta \\omega.\n\nThe parameter sharing strategy is natural and should not be considered as a significant contribution. The parameters in the same kernel has strong correlations and should not be treated separately. Thus, sharing the same perturbation is a natural choice but not a special strategy.\n\nIn section 4.3, what does parameter non-shareing mean in the paragraph 'Parameter sharing strategy'?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "4aeyTi9QNwW", "reviewer": "Reviewer_66qw", "summary": "The challenge of source-free domain adaptation (SFDA) is that the source data is inaccessible after the source model is trained. Two prevalent approaches to address the problem is fine-tuning the source model on target domain and incorporate the adapters into the source model and learn it with target data. However the fine-tuned model usually has poor generalization of the model since it tends to be biased to a specific target domain. The adapter/modulating method is unable to handle large domain shifts as all the convolutional layers and fully-connected layers are frozen. \n\nTo alleviate these problems, in this work, the authors proposed to perturb the parameters of the source model to achieve adaptation to target domain. The model perturbation approach learn domain-specific knowledge through variational Bayesian inference, allowing the model to generalize to relevant domains. This model-agnostic framework can efficiently adapt to target domain while largely preserving the discriminative ability of the source model. The method has been validated in various datasets and experiment settings.", "questions": "I only have some minor questions regrading the experiment details\n- For a fair comparison, the authors adopted the same network architecture and even the same hyper-parameters (if I am wrong, please correct me) with baseline methods. Did you consider/try to tune the hyper-parameters to fully release the power of the proposed method. It would be interesting to show the best performance after tuning. \n- Could you please elaborate more about why the perturbation method is able to preserve discriminative power of the source model? For instance, when the testing example comes from the source domain, how the model would perturb the model? \n- In Table 2, there are 6 tasks in total, why the total winers are 10? is it because the tie existing in some tasks?\n- In Table 3, the bold number in \"source\" column has special meaning?", "limitations": "I would recommend to add a pseudocode of the training algorithm in the main body or supplementary such that to help the readers to get a clear view of the model training workflow.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The work is well-motivated, the writing is easy to follow, and the framework is general and flexible\n- Provided a novel probabilistic framework for SFDA\n- Demonstrated the theoretical connection between their probabilistic framework and the Bayesian neural network\n- The theoretical analysis of the method is clear and sound \n- The empirical and comprehensive experiments validated the method in various settings\n\nWeaknesses:\n- To make it self-contain, a more detailed description of the model training or a pseudocode of the training algorithm is expected. For instance, in line 227 and 237, the authors only mentioned that the expected likelihood adopted the same losses used in reference papers. It would be better to include the loss function as supplementary. \n- Since the authors adopted the local reparameterization trick in line 247, it would be better to briefly explain how to optimize the objective function in eq(3) so that help the general audience understand why and how to apply the trick. In turns, it also help the audience get a better understanding of the training workflow.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "1fZfQl3kOz3", "reviewer": "Reviewer_Uyrb", "summary": "In this paper, the authors propose to solve the source-free domain adaptation problem by perturbing the source model to adapt it to the target domain. The perturbations for the source model are learned through variational Bayesian inference. The authors provide a parameter sharing strategy to significantly reduce the number of learnable perturbations. Therefore, the proposed method is a flexible and lightweight framework and can be integrated with existing methods. Extensive experiments on 5 datasets under 3 different SFDA settings demonstrate the superior performance of variational model perturbations.", "questions": "1. My major concern is why variational model perturbation is effective? Even though the learnable parameters are very few? Clear and detailed explanations are needed.\n2. In Fig. 1, using the classification accuracy as an indicator of domain shifts may be not appropriate. According to Ben-David's domain adaptation theory [7][8], it is better to use the A-distance as a proxy of the domain shifts.\n3. Does model perturbation depend on a specific architecture? In addition to CNNs, the effectiveness of model perturbation on other architectures, e.g., ViT, is of interest.\n4. The proposed method works under the assumption that the source data are not provided. Though I acknowledge the importance of this setting, in real-world applications it is possible to make use of some of the source data. In my opinion, model perturbation can be applied to the setting of standard source-needed domain adaptation, so could you provide results of other implementations based on the standard domain adaptation setting? (e.g., CDAN).\n5. Is it safe to adopt assumption of same prior p(wt) = p(Δw) in Eq. 7?\n6. I don't see the results of other implementations of model perturbations. Although these results appear in the supplementary material, I still suggest that these results are included in the main text.\n7. How does the number of sample points (size of the datasets) affect performance? How many target data points are sufficient for adaptation? Does the performance advantage relative to the baseline methods vary with the size of the datasets?\n\n\nReferences (including the reference from above section):\n[1] Liang J, Hu D, Feng J. Do we really need to access the source data? source hypothesis transfer for unsupervised domain adaptation[C]//International Conference on Machine Learning. PMLR, 2020: 6028-6039.\n[2] Yang S, van de Weijer J, Herranz L, et al. Exploiting the intrinsic neighborhood structure for source-free domain adaptation[J]. Advances in Neural Information Processing Systems, 2021, 34: 29393-29405.\n[3] Huang J, Guan D, Xiao A, et al. Model adaptation: Historical contrastive learning for unsupervised domain adaptation without source data[J]. Advances in Neural Information Processing Systems, 2021, 34: 3635-3649.\n[4] Wang D, Shelhamer E, Liu S, et al. Tent: Fully Test-Time Adaptation by Entropy Minimization[C]//International Conference on Learning Representations. 2020.\n[5] Zhou A, Levine S. Bayesian Adaptation for Covariate Shift[J]. Advances in Neural Information Processing Systems, 2021, 34: 914-927.\n[6] Wang Q, Fink O, Van Gool L, et al. Continual test-time domain adaptation[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022: 7201-7211.\n[7] Ben-David S, Blitzer J, Crammer K, et al. Analysis of representations for domain adaptation[J]. Advances in neural information processing systems, 2006, 19.\n[8] Ben-David S, Blitzer J, Crammer K, et al. A theory of learning from different domains[J]. Machine learning, 2010, 79(1): 151-175.", "limitations": "1. Line 170 and 199: typos \"adaption\".\n2. The upper case and lower case are not consistent: \"KL-divergence\" in line 95 and \"KL-Divergence\" in line 110, \"Adaptive prior\" in line 126 and \"adaptive prior\" in line 268.\n3. In Eq. 8, \"w\" appears for the first time. It should be \"wt\" according to Eq. 2.", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "1. A flexible and lightweight framework, easy to be integrated with previous methods.\n2. Very few learnable parameters.\n3. It decouples the process of domain adaptation into the invariant part (the static source model) and varying part (the learnble perturbations).\n4. The authors connected variational model perturbation with Bayesian neural networks, which provides a theoretical guarantee for the generalization performance of model perturbation.\n5. Most experimental details required for reproducing the results were given. Code was submitted as well, which is noteworthy.\n6. The performance is competitive. Variational model perturbation can achieve the best results in almost settings against the compared baselines.\n7. The experiments take into account both SFDA and test time adaptation settings, which seem very sufficient. Note that previous methods solved SFDA and test time adaptation independently, e.g., SHOT[1] (SFDA), NRC[2] (SFDA), HCL[3] (SFDA), TENT[4] (test-time adaptation), BACS[5] (test-time adaptation), CoTTA [6] (test-time adaptation). This paper essentially unifies the two settings into one framework.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept