Monitoring Risks in Test-Time Adaptation
Authors: Mona Schirmer
Metod Jazbec
Christian A. Naesseth
Eric Nalisnick
Venue: NeurIPS 2025 poster ()
Keywords: test-time adaptation
risk monitoring
sequential testing
Primary area: general_machine_learning

Abstract: Encountering shifted data at test time is a ubiquitous challenge when deploying predictive machine learning models. Test-time adaptation (TTA) methods aim to address this issue by continuously adapting a deployed model using only unlabeled test data. While TTA can help extend the model's deployment lifespan, there are scenarios where, despite adaptation, the drop in the model's performance remains significant enough to warrant taking the model offline and retraining. To detect such failure cases, we propose pairing TTA with risk monitoring frameworks that track predictive performance and raise alerts when predefined performance criteria are violated. Specifically, we extend existing monitoring tools based on sequential testing with confidence sequences to accommodate scenarios where the model is updated at test time and no test labels are available to estimate the performance metrics of interest. Our extensions unlock the application of rigorous statistical risk monitoring in TTA and we demonstrate applicability of our proposed TTA monitoring framework across a representative set of TTA methods, datasets and distribution shift types.

Monitoring Risks in Test- Time Adaptation
Mona Schirmer Metod Jazbec'
Christian A. Naesseth
Eric Nalisnick2
UUvA-Bosc Delta Lab, University of Amsterdam 2 Johns Hopkins University
Abstract
Encountering shifted data at test time is a ubiquitous challenge when deploying predictive models. Test-time adaptation (TTA) methods address this issue by continuously adapting a deployed model using only unlabeled test data. While only temporary solution. Eventually
TTA can extend the model's 's lifespan, the model might degrade to the point that it must be taken offline and retrained. To detect such points of ultimate failure, we propose pairing TTA with risk monitoring frameworks that track predictive performance and raise alerts when predefined performance criteria are violated. Specifically, we extend existing monitoring tools based sequential testing with confidence sequences accommodate scenarios in which the model is updated at test time and no test labels are available to estimate the performance metries of interest. Our extensions unlock the application of rigorous statistical risk monitoring to TTA, and we demonstrate the effectiveness of our proposed TTA monitoring framework across representative of datasets, distribution shift types, and TTA methods.
Introduction
Whenever test data is drawn from a different distribution than the one the model was trained on, performance might degrade, which can cause the model to 'expire.. Such drops in performance are especially concerning in safety-critical applications. For example, a medical device trained on patients from specific demographic group may produce poor predictions when, upon deployment, it encounters patients from a different subpopulation.
Test-time adaptation (TTA) [44] has proven to be a powerful paradigm for prolonging the life of a model subjected to distribution shift. TTA methods adapt model parameters online, using only test batches features and no labels. By leveraging unsupervised objectives such as test-time entropy [42] or pseudo-label losses [41], these methods effectively 'fine-tune' model parameters on unlabeled test data. Despite their stark potential to retain high performance under a variety of distribution shifts suffer performance drops under severe shifts after prolonged adaptation. The TTA literature has documented a range of persistent failure cases in which the model collapses entirely, resulting in near-zero accuracy [31]. Alarmingly, these failures often occur silently and prohibit TTA methods from safe deployment in practice.
[49], TTA methods
Timely detection of performance degradations- whether due harmful distribution shifts adap- tation collapse-is thus crucial for safe deployment. At the same time, however, falsely flagging that model should be taken offline and retrained can incur significant, avoidable costs given the size of modern predictive models. Recently, sequential testing has emerged as a promising statistical framework for monitoring model performance over time [30]. When predefined risk (or error) threshold is exceeded, the monitoring tool triggers an alarm. By employing time-uniform confidence sequences [13], such tools provide rigorous guarantees on the false alarm rate, thereby minimizing unnecessary retraining with high probability.
"Equal contribution. Corresponding authors: <m. c. schirmerQuva nl, m. jazbeceuva.ana. nl>
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

However, existing sequential risk monitors either require access to ground truth labels in production [30] or do not account for model adaptation [1]. In this paper, we extend sequential testing to the challenging setting of TTA. This enables us to track the risk of a continuously evolving model without ever observing test labels. Our main contributions are as follows:
In $ 3, we present general approach for risk monitoring of TTA models. Notably, our framework makes no assumptions about the distribution shift nor the TTA implementation.
In $ 3.2 and $ A.I, we extend prior work on unsupervised risk monitoring [1] to enable effective tracking of risks most commonly used in TTA, such classification error.
In $ 3.3 and 3.4, we present a concrete instantiation of our monitoring tool based model uncertainty, which importantly does not require fitting any additional model components.
In $ 5, we extensively study our monitoring tool and demonstrate that (i) it reliably detects risk violations and (ii) does not raise false alarms on a range of TTA methods, datasets and shift types.
2 Preliminaries
Setting We consider a standard multi-class classification setting, where the input space is denoted by X' C D and the label space by y = (l,...,C) C} for some finite number of classes C. Data points (z,y) are assumed to be realizations of random variables (x, y) drawn from an unknown joint distribution P over x y. The samples in train Dinin and calibration Deal sets are drawn i.i.d. from the source distribution (æ Vo) ~ Po. Test samples in D are assumed to arrive sequentially from a time-vane aarevvryingg and possibly shifting test distribution (Ik, yk) ~ Ps. k 2 1. We do not make any assumptions about the nature of the distribution shift. For the test stream, between two settings. In the "unsupervised" setting, only test features 2 ~ Px(x) are observed, yielding a sequence of unlabeled test datasets D 2 1. In the 'supervised" setting, the true labels yh (y x Fx) are revealed after predictions are made on the observed features at each time step k, resulting in sequence of labeled test datasets D h 2 1. Lastly, with p: X' + A C-11 we denote probabilistic classifier, where A C-1 is the probability simplex over C' classes.
distinguish
Losses and Risks It is crucial to monitor the deployed model on test data to detect potential performance degradations early. To formally capture the concept of error, a problem-specifet loss function, denoted as f O x y + E is first defined. The risk of a model on data drawn from distribution P& is then given as the expected loss R& (p) == F ( [[(xx) y)]. To ease notation, we denote the loss random variable on data from P& with Zς == ((p(x), y) henceforth. Ro(p) represents the source risk on data coming from the source distribution Po. We also define a ramning test risk as
1 Σ (p)
R2( =
km
which measures the model's 's running performance on data drawn from the (shifting) test distribution Pk. If, for some time index (", the running test risk starts to exceed the source risk, i.e., Re- (p) > (p(p), this may indicate that the data distribution has shifted in way that is harmful to the model's performance, suggesting that the model should potentially be taken offline and retrained. In practice, No
the 'true' risk is typically estimated using the empirical risk, defined as Ru D = N2 En 2k where the loss realizations žk,n based on i.idd. samples from D
Given our focus on classification, we consider two loss functions. The first is the 0-1 loss, max,p(x)) lo- (p(æ), y) == [[((x) /f y] where ((x) == arg max, p(x).. which means that the risk corresponds to classification error. We also consider a squared loss between labels and model confidences:
(n(p(x),)) = (p(x), -y=
=
c=
When averaged across samples, this squared loss corresponds to the Brier score, a strictly proper scoring rule [9]. Hence it captures not only the classifier's error but also its calibration. Due this connection, we refer to this second loss as the 'Brier loss' for short.
"The output space O may correspond either to the label space y or to the space of probability distributions over Vi depending on the loss type.

---

Supervised Risk Monitoring via Sequential Testing To track how well a deployed model is performing, Podkopaev and Ramdas [30] propose a risk monitoring framework based on sequential lesting [32]. The performance of model p, in the presence of labeled test stream, is tracked using the following sequential test:
Ho R. (p) Σ Ro(p) + Got, Vt 2
H : 2 R--(p) > Ro(p) + God
(3)
where Gol > O is tolerance level that quantifies the acceptable drop in a model's 's test performance relative to source performance.
To give the test anytime-valid properties (e.g. arbitrary stopping and restarting). Podkopaev and Ramdas [30] rely confidence sequences, which extend traditional confidence intervals to the sequential setting and offer time-uniform coverage guarantees [5, 13]. A sequence of model losses on test data is used to construct an anytime-valit valid lower bound L on the true running test risk Rg:
(p) Z Le (Z ...........................
2 1) 2 Otest
for miscoverage level Crest (0, 1). To get upper bound U the source risk, regular (static) confidence interval is computed using the loss on the source data:
IP (p(p) I U UZa) 2 1 Osecree
for another miscoverage level Ossurce (0, 1). Combining the two bounds, the following alarm function is proposed
$ (1,,.... 24) > U UZz) + cual
and used to reject the null hypothesis (Eq. 3) at fmin == inf{l 2 1 4, = 1}. See Fig. for an illustration. Note that in practice, the empirical bounds are computed using empirical risks:
1 -
Uo (p: Deal) + wo
L, -.
R (D
Diy)) Wt
where wa, Wt are finite-sample correction terms (see B.1 for concrete formulas). Owing to the power of confidence sequences, the alarm function o enjoys time-uniform guarantee on the control of the probability of the false alarm (PFA)
P PH, (3t 2 1, 2. = S Crest + C'surree
R
which ensures that performance degradations are not incorrectly detected, thereby avoiding unnecessary (and potentially costly) interventions on the model. Notably, this guarantee requires only that the loss function is bounded f [a. b). This minimal assumption makes the method broadly applicable, as it imposes no constraints on the data distributions, the predictive model, or the nature of distribution shift (beyond indepen- dence). To maintain minimal assumptions, it is necessary to rely on conjugate-mixte mixture empirical Bernstein bound [13] when constructing a lower confidence sequence for the test risk L, (see $ B.1 for more details),
Un
Ro
200 fmin
400
Time
Figure 1: Alarm C is
raised at min the lower bound T,e on the running test risk R, exceeds the upper bound Uo on the source risk Ro.
Test-time Adaptation (TTA). In test-time adaptation [42], the model parameters are updated online as the model observes batches of un- labeled test features. Specifically, given a sequence of unlabeled test batches DI,-. Dr the TTA method produces sequence of classifiers ........ Pe., where each Og adapted using Dd This stands in contrast to the static source model P0,, which is trained once on labeled training data Drain and remains fixed during deployment. For simplicity, refer to the source model as pa and the adapted models as Pl,..., Pr henceforth.
3 Sequential Testing for TTA Monitoring
We now detail our approach to risk monitoring for test-time adaptation (TTA) methods using sequen- tial testing. We begin by extending the risk monitoring framework of Podkopaev and Ramdas [30] to a deployment setting in which the model is continuously updated ($ 3.1). Next, inspired by Amoukou al. [1], we derive sequential test for the running test risk that does not require access to labels on the test data stream ($ 3.2) a key innovation that enables rigorous statistical testing in TTA settings where test labels are unavailable. We then propose a concrete instantiation of our unsupervised test based on model uncertainty ($ 3.3) and online calibration of thresholds ($ 3.4). Finally, we describe techniques to enhance the detection power of the proposed tests ($ A. Our approach to monitoring risks in TTA is summarized in Algo. 1.
3

---

3.1 Risk Monitoring under Model Adaptation
Unlike the static model setting considered by Podkopaev and Ramdas [30], we are interested in scenarios where classifier is being continuously updated using TTA method. Hence, we are interested in monitoring the risk not of a statie source model po. but rather of sequence of models Pi.t. To this end we define the hypotheses tested by our TTA risk tracker as:
H Re S Ro(Pu) + Gwl, Vt
H 36 2 1 Re (Pra) Ro(p)) + Gul (5)
where = on the (unlabeled) test stream X1:k- is included despite assuming an independent data stream, as becomes necessary when the model рæ is updated using test data, such as in TTA. To reduce notational
(px) and Ra == E,, ((px((x), y)
Note that conditioning
clutter, this conditioning is omitted hereafter unless explicitly required. We use z to denote the loss random variable of the model Pj on data from Pk-
(5) (pp (x)
To design the corresponding alarm function, we proceed similarly to the construction of Φ in Eq. 4, checking if the lower bound on the test risk exceeds the upper bound on the source risk. However, rather than relying on sequence of losses from the static source model, we instead use a sequence of losses from the continuously adapted models in the (lower) confidence sequence for test risk. This leads to the adapted alarm function:
5 == 1 [1
(1) > U(Z )) Gwl
(6)
which also enjoys strong PFA control guarantees when using conjugate-mixtun empirical Bernstein bounds [13]. Throughout the rest of this section, we abbreviate zk as and we shorten the sequence notation from Zi..... Ze to Zi: to ease the notational burden.
(k)
3.2 Unsupervised Risk Monitoring
While the adapted alarm function T (Eq. 6) monitors the performance of adapted models rather than a fixed static model-it it still depends on access to a labeled test stream to compute the adapted lower bound Lq. Consequently, it cannot be directly applied to track the performance of TTA methods where only an unlabeled test stream is available. To get around this, we propose to replace a sequence of supervised losses with sequence of loss proxies that be computed from unlabeled test streams. This allows us to derive an 'unsupervised" lower bound (Proposition 1) to the running test risk which we use to design an "unsupervised" alarm function (Eq. 7).
As a first step, we introduce the notion of a loss proxy and specify its desirable properties. For chosen proxy function g. a loss proxy of model p is defined as == g(x, p). Besides being "unsupervised" (i.e., it should depend only on features x), the proxy should be (at least partially) informative of the corresponding loss variable Before presenting our concrete choice of proxy function based on model uncertainty (see & 3.3), we formalize the notion of a proxy's informativeness with the following assumption.
Assumption 1. Given a sequence of losses Zoa, let the corresponding sequence of loss proxies Mozt and proxy thresholds So...., de E R, along with a loss threshold T E (0, M), be such that for all t 1, the following inequality holds:
Ppr (us > >E, 2u S TT S PA (uo Ao, 20 S ST) +
Pp. (ux S An, 2s > 7)
A=1
PFP2
PFP
PFNz
While Assumption may initially appear rather complicated, can be interpreted in terms of two intuitive desiderata for a valid (and effective) loss proxy. First, the proxy u should enable separation between low losses (z I 7) and high losses (z > 7) for fixed loss threshold 7. This ensures that the probabilities of both false positives (PFP;)) and false negatives (PFN,)) are small. Second, this separability should be robust across the time-varying test distributions Pt, ensuring that the false positive rate the test stream (PFP,)) remains comparable to that on the source distribution (PFP,). Below we formalize how a sequence of loss proxies can be used to derive an unsupervised lower bound on the true running test risk.

---

Proposition 1. Assume a non non-negative, bounded loss & E [0, M. M > O. Further, assume that for sequence of losses Zo:t, a sequence of loss proxies Un:t together with thresholds Ag...., de E R. E (0, M) satisfying Assumption I are available. Then the running test risk can be lower bounded as
Re(pia) 2T
Pr (up > Ab) - Pp.(uo > Ao 20 ST)
11
We defer the full proof to $ B.2. A similar bound was proposed by Amoukou et al. [1], though with some key differences, which we discuss in detail in A.1 and $ 4. Importantly, the bound B, from Proposition I depends only on the test loss proxies and the source loss, meaning its corresponding lower-bound confidence sequence I. can be evaluated using combination of unlabeled test data (D)) and labeled source data (Deal). This makes it suitable for our final proposed unsupervised alarm:
D :- 1 [L] (uor; Ao:t, Zo, 7) > U (2o) + fual
Uo:t:
(7)
In $ B.3, we prove that such an alarm has PFA control guarantee for the sequential test in Eq. 5.
3.3 Uncertainty as Loss Proxy
After introducing general loss proxy u in the previous section, we now present a concrete instan- tiation based on model uncertainty. Specifically, we define the proxy function using the maximum class probability as (x. := max, p(x).- We choose uncertainty, firstly, due to it being easy to implement: it requires no modifications to the underlying model and avoids the need for additional components, unlike alternative proxies based on model disagreement [33] or separate error estimators [1, 4]. Secondly, for 0-1 loss this score approximates the conditional risk, up to calibration error:
C
Ro-1 (p:x) = Σ P 10x(x) + cc Ex(x). l[0(x) + c = 1 max p(x)
Although the conditional risk approximation improves when p is well-calibrated, we do not need to assume the model's uncertainty is well-calibrated under model adaptation [48] nor under distribution shift [28], some previous work has required [16]. Returning to Assumption I, uncertainty is useful loss proxy when it separates high-loss and low-loss instances for a carefully chosen threshold a task known as failure prediction [4, 50J. Failure prediction boils down to the ability to rank the test instances according to their loss values, which is a much weaker requirement in comparison to calibration [1]]. Before demonstrating empirically in 5 that using model uncertainty in Proposition 1 yields valid and tight lower bounds when monitoring TTA performance, we describe our threshold selection mechanism below.
3.4 Online Threshold Calibration
We now describe our procedure for selecting the loss and proxy thresholds used in the lower bound from Proposition 1. This step is critical for the effectivennes of our risk monitoring tool: poorly chosen thresholds can yield bounds that are either invalid (i.e., violate Assumption 1) or vacuous (i.e., excessively loose). Since our goal is to simultancously minimize false positives and false negatives (cf. Assumption 1), we determine the loss threshold 7 E (0, M) and the source proxy threshold Ao E (0, by maximizing the Fl score based on the source model's 's proxy:
2TP
No f = arg max FI(A, Dent,Po): A,
FI(A, 2TP FN + FP
where TP = Nai [uo. A, 20,4 > r], FN = ENO [(uo.s < <, 20, > 7]. FP= 1 [ > X, z0,i S 7] and uo,i ug and 20,4 Zo are proxy and loss realizations of the source model po on samples in Deat, respectively. Similarly, to select test proxy thresholds A1 we maximize Fl score while keeping the loss threshold f fixed: Åλ : arg max, F1(A, Deat. where F1 is computed
(k) and loss 2(4²) z realizations of the adapted model pk on the (same) calibration dataset Dea (since no test labels are available). We emphasize that continuously adapting the proxy threshold is essential for preserving an effective bound B, under model adaptation. Using a static threshold throughout the test stream is insufficient, many TTA methods can affect the scale of the observed uncertainties. For example, TENT [42] tends to reduce uncertainty over time due to its entropy minimization objective. Our full threshold selection procedure is summarized in Algo. 2.
from proxy (A) up
5

---

4 Related Work
TTA [44, 20] aims to improve model performance under distribution shift by updating the model using unlabeled test data. Classic approaches include recomputing normalization statistics [36, 24], optimizing unsupervised objectives such as test entropy [42, 26, 27], energy [47], or pseudo-labels [17, 19), or adapting the last layer [15, 3, 35J. However, recent work has identified scenarios where TTA methods are ineffective [49, 35], and even harmful, degrading performance below that of the unadapted source model [3, 10, 46, 27, 6, 33, 43, 29]. While some studies propose heuristic indicators of TTA failure, such as high gradient norms [27], or estimate test accuracy directly [18, 31], there remains no principled framework for detecting risk violations of TTA methods with theoretical guarantees.
Risk monitoring via sequential testing has been proposed by Podkopaev and Ramdas [30], though in setting where test stream labels are available and the model remains static. Recent important extensions include [51]. which proposes supervised risk monitoring for the more challenging setting of instantancous risk control, and [52], which tackles the task using weighted-conformall conformal martingales. Most relevant to our work is that of Amoukou et al. [1]. who extend [30] to the test scenario without labels. We further build upon their framework by: ()) incorporating model adaptation ($ 3.1); (ii) deriving an unsupervised bound on the expected loss, rather than only a bound on the probability of high loss ($ 3.2); (iii) using model uncertainty proxy for loss instead of separate error estimator (S 3.3); (iv) proposing a simpler calibration method ($ 3.4) and showing it's effectiveness for 0-1 loss (S 5.1); and (v) providing theoretical insights into why effective monitoring of continuous losses necessitates a change in the tested hypothesis ($ A. I). Also related is work by Bar et al. [2], where a sequential test for TTA methods based on betting martingales [32] is proposed. However, their test is designed to detect changes in predictive entropy. which may or may not lead to a degradation in performance-un unlike our method, which directly tests for performance drops. We provide further related works in Appendix E.
5 Experiments
We empirically validate the effectiveness of our monitoring tool for range of TTA methods under different distribution shifts. In $ 5.1, we study the monitoring tool in comparison to several baseline alarm functions. $ 5.2 demonstrates the wide applicability of our monitoring tool across different TTA methods and datasets. In $ 5.3, we show that the tool can be employed to detect risk increase arising from failed model adaptation. Lastly, in $ 5.4, we show the generalizability of our statistical framework by going beyond uncertainty as loss proxy. Our code is available at: https: //gg higggth..u..... wwapsechhtttmmmttttt
Oracles and Baselines Our goal is to approximate, t (Px). the empirical estimate
of the true, unobservable, running test risk (p1a) as closely possible. Once Ri exceeds pre- defined risk threshold, we wish to raise an alarm as carly as possible. We compare our unsupervised alarm & (Eq. 7 and Eq. 8), to several baseline monitors. While all monitors use the same upper bound on the source risk Un. they differ in their choice of the test risk lower bound. We next present the alternatives to our proposed test risk lower bound L.:
Ls: the estimated confidence lower bound on the rumning test risk under model adaptation (see Eq. 6). This direct extension of Podkopacv and Ramdas [30] preserves false-alarm guarantees but observes labels each time point. While inapplicable in the unsupervised TTA setting, it serves as an oracle baseline. Since Lę 2 L (under Assumption 1) our alarm & can never trigger before this alarm, Dr and consequently we inherit its detection delay. The closer L is to Lç the smaller is the price pay for not observing test labels.
Lς: naive estimate of the running test risk, formed by substituting the supervised losses Ze:t with unsupervised proxies Ug:: in the alarm from Eq. 4 [30]. While it avoids using test labels, it lacks false alarm guarantees due to omitting the lower bounding step in Prop. 1.
ig. the estimated unsupervised lower bound on the running test risk of the static source model po as presented in [1]. While providing false alarm guarantees without access to labels, it uses a different calibration procedure and is not applicable to a time-iarying predictive model pk.

---

Risk Control Design We monitor test risk using 0-1 loss fo-1 and Brier loss fg (Eq. 2). If not specified otherwise, we use a tolerance threshold of Gnt 0.05 for 0-1 loss and Gul 0.01 for Brier loss. We set a Ossounce + Osest to 0.2 using most budget for controlling the test risk, i.e. Osest = 0.175 and O'uurce 0.025. For threshold selection ($ 3.4) we use Neat 1000 labeled samples from Po.
Datasets & Models We evaluate our monitoring approach on three datasets: synthetic corruptions from ImageNer-C [12], and real-world distribution shifts from Yearbook [8] and FMoW-Time [45]. For ImageNet-C, we use the pretrained ViT-Base model [7] from the Timm library [34], focusing on Gaussian noise (GN) corruptions. Ycarbook involves binary gender classification from portrait images, while FMoW-Time consists of satellite imagery with land use labels. Both datasets span multiple years; models are trained on data up to cutoff year and tested on future samples. For Yearbook and FMoW, we follow the protocol of Yao et al. [45], using their provided model weights: small CNN for Yearbook and DenseNet121 [14] for FMo..
5.1 Illustrative Example
Source
TENT
In the first experiment, we study the behavior of our alarm in comparison described baselines. We are notably interested how closely our unsupervised mon- itoring tool mimics the two oracle quantities having access to the ground truth test labels: empirical run-
0.5
ning test risk R₂ and i [30]. To simulate an in- creasing test risk, we construct a test stream from ImageNet-C by gradually increasing the severity level of Gaussian noise corruption from in-distribution (no shift) up to severity level 5. We track both the unadapted source model and TENT using 0-1 loss fo-1 and Brier loss f-- We also verify the validity of Assumption throughout adaptation by tracking A PFP + E sumption is met in practice when A/ 2 0 and vio- lated when A 0. A also reflects the tightness of Lf. so, ideally, it is also not too much above O. We proceed analogously for Assumption 4.1 in Amoukou et al. [1] and denote it with A/.
0.5
0.0
400
Time
Time
Og Eut
Assunpe vicloned
(Aoarmpp 1)
PFPk. The as-
Figure 2: Test risk of increasing severity on ImageNet-C (GN): Our unsupervised lower bound i.ç on the empirical test risk AG, closely follows the supervised lower bound Lç.
The results are shown in Fig. 2. As the severity of the distribution shift increases, the empirical running test risk Rg (-) increases as well, for both 0-1 loss fo.1 (top row) and Brier loss E (boltom row). As expected, the unadapted source model (left) exhibits a higher risk, while adaptation with TENT (right) postpones the point where the empirical risk crosses the specified performance requirement. However, as the distribution shift becomes increasingly severe, Ri eventually exceeds the upper bound on the source risk, Ü., plus the tolerance margin Gwl (--), despite model adaptation. From this time point ( D) we wish to trigger an alarm. As expected, the lower confidence sequence on the empirical test risk, ig (--), which leverages test labels, detects the risk violation first. Encouragingly, our proposed unsupervised lower bound f. (-) closely follows the supervised bound i.ş. This indicates that our bound is tight and the price for not seeing labels is relatively small. The naive plugin bound, ig (-), is not only void of theoretical guarantees but also exhibits low power empirically by not detecting the risk violation in all but one case. The unsupervised bound by Amoukou et al. [1], f.g (-), detects slightly later then L for Brier loss, but is extremely loose for 0-1 loss. Fig. 2 shows that our Assumption 1 (-..) is met throughout the distribution shift in all cases, while the assumption of Amoukou et al. [1] (...) is violated for (-1 loss. making their bound invalid for large t.
5.2 Generalization across Datasets, Shifts and TTA Methods
Next we evaluate the robustness of our monitoring tool by testing different TTA methods: TENT [42], CoTTA [41], SAR [27] and SHOT [19]. Please see D.2 for details. We study four test streams: In-distribution of ImageNet (no shift, alarm should remain silent), ImageNet-C Gaussian
7

---

ImageNet ID
ImageNet Severity 5
Yearbook
FMoW-Time
1.0
Source
0.5
0.0
1.0
TENT
0.5
0.0
1.0
SHOT
0.5
0.0
1.0
CoTTA
0.0
1.0
SAR
0.5
0.0
100
100
200
200
400
Time
Time
Time
Time
Eool
&
1b
(Assumpe. 1)
Assumpt. violated
Figure 3: Estimated test risk for different datasets and TTA methods: Our lower bound Ż consistently
exceeds the risk threshold Üp + esol when true risk violation occurs (ImageNet severity 5, Yearbook), while remaining below it on benign shifts (ImageNet ID,, FMoW-Timme) across all TTA methods.
noise (GN) severity level (strong shift), Yearbook (moderate shift) and FMoW (gradual shift). Since classification error is the most commonly used metric in TTA, we track risk increase for 0-1 loss.
Risk violation is detected reliably Fig. shows that the empirical running test risk R₁ (-) is closely mimicked by our L (-) across TTA methods, datasets and shifts. Our alarm function correctly remains silent on the ID stream (first column) of ImageNet, where test risk remains below also remains below the alarm threshold; this is accurately reflected in our monitoring, as LØ tightly tracks R, without triggering false alarms. For the immediate risk violation on ImageNet-C severity level 5 (second column), our test triggers an alarm after 25 steps for all TTA methods. Similar results are observed for Yearbook. We additionally provide a detailed comparison with other baselines across all TTA methods A.4.
the threshold (--). For FMoW, the risk increases steadily
Assumption holds after warm-up Importantly, we find that Assumption is generally satisfied in practice, with Å (...) remaining above zero for most time steps, when using model uncertainty (S 3.3) with online adaptation of proxy thresholds ($ 3.4). For some datasets, such as FMoW, we observe slight violations during the warm-up phase, i.e., for small f. Fortunately, the sinite-sampl penalty term wy in the confidence sequence is largest for small which may offset these minor violations and help prevent false alarms. The only instance where violations persist throughout the entire test stream is with the source model on ImageNet under severity shift. This is because proposed threshold calibration procedure ($ 3.4) keeps the proxy threshold fixed if the model

---

is not updated on the test stream, making Assumption 1 more difficult to satisfy. Since our focus is on adapted models, we leave the development of alternative calibration methods effective for static models to future work.
le
1e
5.3 Detecting TTA Collapse
Predicted Class
1000
Unlike static models, the risk of a TTA model can increase not only due to distribution shift but also because the model deteriorates during adaptation. An extreme, yet
500
well documented case of model failure in TTA is model collapse, where finally only a small subset or a single class
1.0
Monitor
is predicted [25, 39, 27, 22]. Alarmingly, these harmful collapses often occur silently [27]. We next ask whether detect risk increases caused by model failure. This is not a given, as the monitor relies on the model's own outputs (e-g.. predictive uncertainty), which may become unreliable when the model itself fails. To induce model collapse, with a high learning rate of v = Te-1 on the ImageNet-C (GN) corruption severity level 1. We set high Gol = 0.2 to disregard risk increase caused by distribution shift.
0.5
statistical framework
0.0
100
100
Time
Time
follow [3] and apply TENT
Ug
Fnå 1. (Assumpt.
Assumpt violated
1
Figure 4: Collapsed vs. non-collapsed model on ImageNet-C (GN): When col- lapsed (right), the model always predicts the same class, which our monitor flags.
Fig. 4 (left) displays predicted classes (first row) and es- timated test risk (second row) for an adaptation with a suitable learning rate. The predicted classes remain di- verse, and both the estimated test risk and our lower bound stay below the pre-defined risk threshold. This is in stark contrast adaptation with a high learning (right): after few adaptation steps, the model assigns all input samples to the same class. This leads to large increase in empirical test risk. Encouragingly, our bound ب tracks this rise and detects violation shortly after, demonstrating that our monitoring remains effective even when the underlying model collapses.
T3A
STAD
5.4 Alternative Loss Proxies
1.0
In $ 5.2, we demonstrated that using model uncer- tainty as a loss proxy yields valid (according to As- sumption 1) and, importantly, tight unsupervised lower bounds across representative set of TTA meth- ods and data shifts. Here, we supplement these results with case where relying solely on model uncertainty proves insufficient for effective detection. Specif- ically, when monitoring "last-layer" TTA methods [15, which adapt only the classification head W [wi...., wc] E x observed that our unsupervised bound becomes overly loose, caus- ing the alarm to fail under severe distribution shifts. We attribute this behavior to the normalization of each class prototype, i.e. w. |/w../i 112. at every adaptation step. This normalization leads to (much) reduced variability in uncertainty across samples at the start of adaptation, making the separation of high and low losses harder. To overcome this, propose using the distance to the closest prototype [40, 23], g(x p) = min. (x) - well.. where f denotes the feature extractor of model as an alternative loss proxy. Unlike uncertainty, this measure is less affected by the normalization of class prototypes. In Fig. 5, we show that this yields tighter lower bounds for T3A [15] and STAD [3t]-both last-layer TTA geehhods-undercoriiin the importance of aligning the proxy choice with the specifics of the given TTA approach. Lastly, in $ A.2 we show results when using energy score [21] or predictive entropy as a loss proxy proxy-finding that both yield looser bounds compared to model uncertainty.
0.5
1000
1.50
30
100
150
Time 1
Time 7
10
(Assamot
Spect,
Assamot, viclated
Figure 5: Comparison of loss proxies for last-layer TTA methods on ImageNet-C (GN) severity 5. Distance to class prototype is more effective than uncertainty for this TTA class.

---

Conclusion
We proposed risk monitoring tool for test-time adaptation (TTA) based on sequential testing. Crucially, our method is dasupervised-requiiie no access to test labels-and compatible with models undergoing continuous adaptation. We demonstrated its broad applicability across diverse set of TTA methods, by showing that it effectively detects performance degradations resulting from either harmful distribution shifts or adaptation collapse.
Limitations and Future Work While we have shown that our unsupervised alarm has detection delays not too much larger compared its supervised counterpart [30] (see Fig. 2), the observed delays might still be too big for applications where detecting late is (significantly) more costly compared to raising false alarms. For such settings, would be worth weakening the requirement on the probability of false alarm control under Ho in order to gain more power under H1. Perhaps this could be done by aiming for a weaker average run length control as is commonly done in the literature on change-point detection using confidence sequences [38, 37J. Moreover, although our proposed lower bound from Proposition can be computed without access to test labels, verifying Assumption for given loss proxy still requires labeled test stream. While we found empirically that this assumption holds nearly all evaluated cases (Fig. 3), developing unsupervised diagnostics to flag potential violations of the assumption remains important direction for future work.
Acknowledgments and Disclosure of Funding
We thank Alexander Timans, Rajeev Verma, and Dan Zhang for helpful discussions and clarifications. This project was generously supported by the Bosch Center for Artificial Intelligence. Eric Nalisnick did not utilize resources from Johns Hopkins University for this project.
References
[1] Salim Amoukou, Tom Bewley, Saumitra Mishra, Freddy Lecue, Daniele Magazzeni, and Manuela Veloso. Sequential harmful shift detection without labels. Advances in Neural Information Processing Systems, 37, 2024. 2, 3, 5, 6, 7, 24, 25, 29,29,2222 33
[2] Yarin Bar, Shalev Shaer, and Yaniv Romano. Protected test-time adaptation via online entropy matching: A betting approach. Advances in Neural Information Processing Systems, 37, 2024. 25
[3] Malik Boudiaf, Romain Mueller, Ismail Ben Ayed, and Luca Bertinetto. Parameter-free online test-time adaptation. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pages 3344-8353, 2022. 6, 9, 34
[4] Charles Corbière, Nicolas Thome, Avner Bar-Hen, Matthieu Cord, and Patrick Pérez. Ad- dressing failure prediction by learning model confidence. Advances Neural Information Processing Systems, 32, 2019. 5, 34
[5] Donald A Darling and Herbert Robbins. Confidence sequences for mean, variance, and median. Proceedings of the National Academy of Sciences, 58(1):66 68, 1967.
[6] Mario Döbler, Robert A Marsden, and Bin Yang. Robust mean teacher for continual and gradual test-time adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7704-7714, 2023. 6, 34
[7] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x 16 words: Transformers for image recognition at scale. International Conference on Learning Representations, 2021. 7
[8] Shiry Ginosar, Kate Rakelly, Sarah Sachs, Brian Yin, and Alexei A Efros. A century of portraits: visual historical record of american high school yearbooks. In Proceedings of the IEFE International Conference Computer Vision Workshops, pages 1-7, 2015. 7,
10

---

[9] Tilmann Gneiting and Adrian E Raftery. Strietly proper scoring rules, prediction, and estimation. Journal of the American statistical Association, 102(477):359-378 2007. 2
[10] Taesik Gong, Jongheon Jeong, Taewon Kim, Yewon Kim, Jinwoo Shin, and Sung-Ju Lee. Note: Robust continual test-time adaptation against temporal correlation. Advances Neural Information Processing Systems, 35, 2022. 6, 28, 34
[11] Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International Conference Machine Learning, pages 1321-1330. PMLR, 2017. 5
[12] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. International Conference on Learning Representations, 2019. 7,
33
[13] Steven R Howard, Aaditya Ramdas, Jon McAuliffe, and Jasject Sckhon. Time-uniform, nonparametric, nonasymptotic confidence sequences. The Annals of Statistics, 49(2):1055-1080, 2021. 1, 3, 4, 29, 33
[14] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattem Recognition, pages
2017. 7
[15] Yusuke Iwasawa and Yutaka Matsuo. Test-time classifier adjustment module for model-agnostic domain generalization. Advances in Neural Information Processing Systems, 34, 2021. 6, 9,
[16] Andreas Kirsch and Yarin Gal. A note on "assessing generalization of SGD via disagreement". Transactions Machine Learning Research, 2022. ISSN 2835-8856, 5, 34
[17] Dong-Hyun Lee et al. Pseudo-label: The simple and efficient semi-supervised learning method for deep neural networks. In Workshop challenges in representation learning. ICML, volume 3, page 896. Atlanta, 2013.
[18] Taeckyung Lee, Sorn Chottananurak, Taesik Gong, and Sung-Ju Lee. Aetta: Label-free accuracy estimation for test-time adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 28643-28652, 2024. 6, 34
[19] Jian Liang, Dapeng Hu, and Jiashi Feng. Do we really need to access the source data? source hypothesis transfer for unsupervised domain adaptation. In International Conference on Machine Learning, pages 6028-6039. PMLR, 2020. 6, 3,
[20] Jian Liang, Ran He, and Tieniu Tan. A comprehensive survey on test-time adaptation under distribution shifts. International Journal of Computer Vision, pages 1 1-34, 2024. 6
[21] Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy-based out-of-distribution detection. Advances in Neural Information Processing Systems, 33, 2020. 9, 24
[22] Robert A Marsden, Mario Döbler, and Bin Yang. Universal test-time adaptation through weight ensembling, diversity weighting, and prior correction. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 2555-25666 2024. 9, 34
[23] Yifei Ming, Yiyou Sun, Ousmane Dia, and Yixuan Li. How to exploit hyperspherical embed- dings for out-of-distribution detection? International Conference on Learning Representations, 2023. 9
[24] Zachary Nado, Shreyas Padhy, Sculley, Alexander D' Amour, Balaji Lakshminarayanan, and Jasper Snoek. Evaluating prediction-tine batch normalization for robustness under covariate shift. ICML. 2020 Workshop on Uncertainty and Robustness Deep Learning, 2020. 6
[25] A Tuan Nguyen, Thanh Nguyen-Tang, Ser-Nam Lim, and Philip HS Torr. Tipi: Test time adaptation with transformation invariance. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pages 24162-24171, 2023. 9
11

---

[26] Shuaicheng Niu. Jiaxiang Wu, Yifan Zhang, Yaofo Chen, Shijian Zheng, Peilin Zhao, and Mingkui Tan. Efficient test-time model adaptation without forgetting. In International Confer- ence on Machine Learning, pages (6888-16905. PMLR, 2022. 6, 34
[27] Shuaicheng Niu, Jiaxiang Wu, Yifan Zhang, Zhiquan Wen, Yaofo Chen, Peilin Zhao, and Mingkui Tan. Towards stable test-time adaptation in dynamic wild world. International Conference Learning Representations, 2023. 6, 7, 33, 34
[28] Yaniv Ovadia, Emily Fertig, Jie Ren, Zachary Nado, David Sculley, Sebastian Nowozin, Joshua Dillon, Balaji Lakshminarayanan, and Jasper Snoek. Can you trust your model's uncertainty? evaluating predictive uncertainty under dataset shift. Advances in Neural Information Processing Systems, 32, 2019. 5
[29] Hyejin Park, Jeongyeon Hwang, Sunung Mun, Sangdon Park, and Jungseul Ok. Medbn: Robust test-time adaptation against malicious test samples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5997-6007, 2024. 6, 34
[30] Aleksandr Podkopaev and Aaditya Ramdas. Tracking the risk of a deployed model and detecting harmful distribution shifts. International Conference on Learning Representations, 2022. 3, 4, 6, 7, 10, 25, 29, 30
[31] Ori Press, Ravid Shwartz-Ziv, Yann LeCun, and Matthias Bethge. The entropy enigma: success and failure of entropy minimization. Proceedings of the 41st International Conference on Machine Learning, pages 11064-10085 2024. 1, 6, 34
[32] Aaditya Ramdas, Peter Grünwald, Vladimir Vovk, and Glenn Shafer. Game-theoretic statistics and safe anytime-valid inference. Statistical Science, 3864):576-601, 2023. 3,
[33] Elan Rosenfeld and Saurabh Garg. (almost) provable error bounds under distribution shift via disagreement discrepancy. Advances in Neural Information Processing Systems, 36, 2023. 5, 34
[34] Ross Wightman. Pytorch image models.
httpps///githuub.comm///gg
mott--immmmmmmmmel.. 2019.
[35] Mona Schirmer. Dan Zhang, and Eric Nalisnick. Temporal test-time adaptation with state-space models. Transactions on Machine Learning Research, 2025. ISSN 2835-8856. 28, 33, 34
[36] Steffen Schneider, Evgenia Rusak, Luisa Eck, Oliver Bringmann, Wieland Brendel, and Matthias Bethge. Improving robustness against common corruptions by covariate shift adaptation. Advances in Neural Information Processing Systems, 33, 2020.
[37] Shubhanshu Shekhar and Aaditya Ramdas. Reducing sequential change detection to sequential estimation. In International Conference Machine Leurning, pages 44628 44642. PMLR, 2024.
[38] Shubhanshu Shekhar and Aaditya Ramdas. Sequential changepoint detection via backward confidence sequences. In International Conference on Machine Learning, pages 30908 30930. PMLR, 2023. 10
[39] Yi Su, Yixin Ji, Juntao Li, Hai Ye, and Min Zhang. Beware of model collapse! fast and stable test-time adaptation for robust question answering. In Proceedings of the 2023 Conference Empirical Methods in Natural Language Processing, pages 12998-13011, 2,233,,,,,..... 9
[40] Joost Van Amersfoort, Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation using single deep deterministic neural network. In International Conference on Machine Learning, pages 9690-9700. PMLR, 2020. 9
[41] Qin Wang, Olga Fink, Lue Van Gool, and Dengxin Dai. Continual test-time domain adaptation. In Proceedings of the IEEE/CV Conference on Computer Vision and Pattern Recognition, pages 7201-7211, 1, 2022. 1, 7, 25, 33, 34
[42] Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno A. Olshausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization. International Conference on Learning Representations, 2021. 1, 6, 7, 24,
12

---

[43] Tong Wu, Feiran Jia, Xiangyu Qi, Jiachen T Wang, Vikash Sehwag, Saeed Mahloujifar, and Prateek Mittal. Uncovering adversarial risks of test-time adaptation. In International Conference on Machine Learning, pages 37456-37499 PMLR, 2023. 6, 34
[44] Zehao Xiao and Cees GM Snoek. Beyond model adaptation at test time: A survey. arXiv preprint arXiv:241 1. 1.03687, 2024. 6
[45] Huaxiu Yao, Caroline Choi, Bochuan Cao, Yoonho Lee, Pang Wei W Koh, and Chelsea Finn. Wild-time: benchmark of in-the-will distribution shift over time. Advances in Neural Information Processing Systems, 35, 2022. 3.
[46] Longhui Yuan, Binhui Xie, and Shuang Li. Robust test-time adaptation in dynamic scenarios. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15922-15932, 2023. 6, 34
[47] Yige Yuan, Bingbing Xu, Liang Hou, Fei Sun, Huawei Shen, and Xueqi Cheng. Tea: Test-time energy adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 23901-23911 1, 2024.
[48] Qingyang Zhang, Yatao Bian, Xinke Kong, Peilin Zhao, and Changqing Zhang, Come: Test- time adaption by conservatively minimizing entropy. International Conference on Learning Representations, 2025. 5
[49] Hao Zhao, Yuejiang Liu, Alexandre Alahi, and Tao Lin. On pitfalls of test-time adaptation. In International Conference on Machine Learning, pages 42058-42080. PMLR, 2023. 1, 6
[50] Fei Zhu, Zhen Cheng, Yu-Yao Zhang, and Cheng-Lin Liu. Rethinking confidence calibration for failure prediction. In European Conference on Computer Vision, pages 518-536. Springer, 2022. 5
[51] Alexander Timans, Rajeev Verma, Eric Nalisnick, and Christian A. Naesseth. On continuous monitoring of risk violations under unknown shift. In The 41st Conference on Uncertainty in Artificial Intelligence, 2025. 6
[52] Drew Prinster, Xing Han, Anqi Liu, and Suchi Saria. WATCH: Adaptive monitoring for AI deployments via weighted-conforme martingales. In International Conference on Machine Learning, 2025. 6
[53] Junha Song. Jungsoo Lee, In So Kweon, and Sungha Choi. Ecotta: Memory-efficient continual test-time adaptation via self- regularization. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11920-11929, 2023. 25
[54] Hyesu Lim, Byeonggeun Kim, Jaegul Choo, and Sungha Choi. Tin: A domain-shift aware batch normalization test-time adaptation. International Conference on Learning Representations, 2023. 25, 34
[55] Sungha Choi, Seunghan Yang, Scokeon Choi, and Sungrack Yun. Improving test-time adaptation via shift-agnostic weight regularization and nearest source prototypes. In European Conference on Computer Vision, pages 440-458. Springer, 2022. 25
[56] Kazuki Adachi, Shin' Ya Yamaguchi. and Atsutoshi Kumagai. Covariance-aware feature align- ment with pre-computed source statistics for test-time adaptation to multiple image corruptions. In 2023 IEEE International Conference on Image Processing (ICIP), pages 800-804. IEEE, 2023. 25
[57] Sanghun Jung, Jungsoo Lee, Nanhee Kim, Amirreza Shaban, Byron Boots, and Jaegul Choo. Cafa: Class-aware feature alignment for test-time adaptation. In Proceedings of the IEFF/CVF International Conference on Computer Vision, pages 19060-19071, 2023. 25
[58] Taeyeop Lee, Jonathan Tremblay, Valts Blukis, Bowen Wen, Byeong-Uk Lee, Inkyu Shin, Stan Birchfield, In So Kweon, and Kuk-Jin Yoon. Tta-cope: Test-time adaptation for category-level object pose estimation. In Proceedings of the IEFF/CV Conference on Computer Vision and Pattern Recognition, pages 21285 22255222225,,00 2023.
13

---

[59] Daeun Lee, Jaehong Yoon, and Sung Ju Hwang. Becotta: Input-dependent online blending of experts for continual test-time adaptation. International Conference on Machine Learning. 2024. 25
[60] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248-255. leee, 2009. 33
[61] Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, et al. Wilds: A benchmark of wild distribution shifts. In International Conference on Machine Learning, pages 5637-5664. PMLR, 2021. 33
[62] Gordon Christie, Neil Fendley, James Wilson, and Ryan Mukherjee. Functional map of the world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6180, 2018. 33
[63] Steven R. Howard, Ian Waudby-Smin -mithh, and Aaditya Ramdas, ConfSeq: software for confidence sequences and uniform boundaries, 2021- URL https: ttttps://githin //githbb..ttttt// cowm conn/gostevehovard/ confeeq, 33
[64] Amartya Sanyal, Yaxi Hu, Yaodong Yu, Yian Ma, Yixin Wang, and Bernhard Schölkopf. Accuracy on the wrong line: On the pitfalls of noisy data for diitriiiiitiittoion generalisation. arXiv preprint arXiv:2406. 19049, 2024. 34
[65] John P Miller, Rohan Taori, Aditi Raghunathan, Shiori Sagawa, Pang Wei Koh, Vaishaal Shankar, Percy Liang, Yair Carmon, and Ludwig Schmidt. Accuracy on the line: on the strong correlation between out-of-distributiin and in-distribution generalization. In International Conference Machine Learning, pages 7721-7735. PMLR, 2021. 34
[66] Dan Hendrycks and Kevin Gimpel. baseline for detecting misclassified and out-o--distribution examples in neural networks. International Conference on Learning Representations, 2017. 34
[67] Saurabh Garg, Sivaraman Balakrishnan, Zachary Lipton, Behnam Neyshabur, and Hanie Sedghi. Leveraging unlabeled data to predict out-of-distribution performance. International Conference on Muchine Leurning, 2022. 34
[68] Yuzhe Lu, Zhenlin Wang, Runtian Zhai, Soheil Kolouri, Joseph Campbell, and Katia Sycara. Predicting out-of-distribution error with confidence optimal transport. Workshop on the pitjalls of limited data and computation for Trustworthy MI, ICLR, 2023.
[69] Devin Guillory, Vaishaal Shankar, Sayna Ebrahimi, Trevor Darrell, and Ludwig Schmidt. Pre- dicting with confidence unseen distributions. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1134-1144, 2021. 34
[70] Yiding Jiang, Vaishnavh Nagarajan, Christina Back, and J Zico Kolter. Assessing generalization of sgd via disagreement. International Conference on Learning Representations, 2022. 34
[71] Christina Back, Yiding Jiang, Aditi Raghunathan, and Zico Kolter. Agreement-on-thee Predicting the performance of neural networks under distribution shift. Advances in Neural Information Processing Systems, 35, 2022. 34
[72] Preetum Nakkiran and Yamini Bansal. Distributional generalization: A new kind of generaliza- tion. arXiv preprini arXiv:2009.08092, 2020. 34
[73] Donghwan Lee, Behrad Moniri, Xinmeng Huang, Edgar Dobriban, and Hamed Hassani. Demys- tifying disagreement-oon-th--liii in high dimensions. In International Conference on Machine Learning, pages 19053-19093. PMLR, 2023. 34
[74] Eungyeup Kim, Mingjie Sun, Christina Baek, Aditi Raghunathan, and J Zico Kolter. Test- time adaptation induces stronger accuracy and -ggreement-oo-tth-linee Advances in Neural Information Processing Systems, 37, 2024. 34
14

---

[75] Trung Hieu Hoang, MinhDuc Vo, and Minh Do. Persistent test time adaptation in recurring testing scenarios. Advances in Neural Information Processing Systems, 37, 2024. 34
[76] Yongyi Su, Xun Xu, and Kui Jia. Towards real-world test-time adaptation: Tri-net self-training with balanced normalization. In Proceedings of the AAAI Conference Artificial Intelligence, volume 38, pages 1126-15135, 2024. 34
[77] Yuejiang Liu, Parth Kothari, Bastien Van Delft, Baptiste Bellot-Gurlet, Taylor Mordan, and Alexandre Alahi. Ttt++: When does sulf--uper test-time training fail or thrive? Advances in Neural Information Processing Systems, 34, 2021. 34
[78] Ori Press, Steffen Schneider, Matthias Kümmerer, and Matthias Bethge. Rdumb: A simple approach that questions our progress in continual test-time adaptation. Advances in Neural Information Processing Systems, 37, 2024. 34
[79] Kentaro Hoffman, Stephen Salerno, Jeff Leek, and Tyler McCormick. Some models are useful, but for how long?: decision theoretic approach to choosing when refit large-scale prediction models, arXiv preprint arXiv:2405.13926, 2024. 34
15

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We provide all theoretical (see $ 3) and experimental results (see $ 5) back our claims.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We discuss limitations in & 6. We also discuss theoretical assumptions made in our work in 3.2 and discuss violations thereof in practice 5.2 and $ 5.4.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sellsspeciiiationn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
16

---

Answer: [Yes]
Justification: We list assumptions of our theoretical results $ 3.2 and provide full proofs in Appendix B.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: We describe our experiments in 5 and provide further implementation details in Appendix D.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
17

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: All datasets publicly available. The code is available htttts://ggthieii com com/monasch/tern ttabh/tta-aaeee ttt.ssiitottatmmtmo....... monitor.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cm aublic/guides//odeeee
wwwasssssllliiiso imPolic)) for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: / /ttpppccpppblliiipppp wwtpcccpppcc/ccccccccccccccccclt wttpc//gg//eeeeeeecceeeecesseees
ceabbbmmsssoonPoo ssininolicyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We describe the experimental setup and hyperparameters in $ and Ap- pendix D.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We report standard deviation over different random seeds in Fig. 2, Fig. 3, Fig. 4, Fig. 5.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
18

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We detail the computational resources used in Appendix D.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics http:////eeeeppppppppccee///e/ee
Answer: [Yes]
Justification: [NA]
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss broader impact in Appendix F.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
19

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: [NA]
Guidelines:
The answer NA means that the paper does use existing assets. The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms use in package should be provided. For popular datasets, paperswi twwode..ooo..... com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
20

---

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer:
[Yes]
Justification:
We plan to release well documented code base.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Bthies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such the institution conducting the review.
21

---

16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, originality of the research, declaration is not required.
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to L.M policy (https: httprripsscc//oofeeeeeeee/////// for what should or should not be described.
22

---

Appendix
The appendix is organized follows:
Appendix provides additional theoretical ($ A.I) and experimental results (?? A.4):
In $ A.I, describe how improve the reactivity of our proposed unsupervised alarm function & (Eq. 7).
In $ A.2, we perform an ablation for our choice of model uncertainty as a loss proxy. - Š A.3 contains results when using a smaller calibration set in our proposed online threshold calibration ($ 3.4).
We extend results from 5.2 with more baselines in $ A.4.
In A.5, conduct experiments on label shift.
Appendix B details our theoretical results.
- -In $ B, we describe our choice of confidence sequences.
- In $ B.2- $ B.5, we provide proofs for all our theoretical results.
Appendix contains algorithmic descriptions of our methods.
Appendix D lists experimental details.
Appendix contains extended related work (in addition to $ 4).
Appendix presents the impact statement.
A Additional Results
A.1 Improving Test Power
We have previously shown that our proposed unsupervised alarm (Eq. 7) provides strong false alarm control guarantees under Ho ( tha) is, the alarm is guaranteed not to trigger when no performance degradation occurs in practice, preventing taking the model 'offline' prematurely. However, for a monitoring tool to be truly useful, it must also be 'reactive' under Hi-that is, should raise an alarm when the model's performance degrades beyond an acceptable tolerance level (Ewl), and ideally, it should do so with minimal detection delay. Since our unsupervised alarm is based on lower-boundigg bounding the true running test risk twice -a lower-bound confidence sequence L to a lower bound B, is used-it is not too surprising that the procedure can sometimes exhibit overly conservative behavior under H1, We next discuss our strategies for addressing this issue by improving the power of our proposed unsupervised sequential test.
0-1 loss We first note that for the 0-1 loss, the loss threshold can be omitted from the lower bound B, in Proposition 1. This is a direct consequence of the binary nature of the 0-1 loss (see Corollary 1 in B.4 for the full derivation). Omitting this scaling for 0-1 loss yields tighter lower bound B,, which directly translates into a more reactive alarm function-while still maintaining false alarm guarantees. This is especially important when monitoring performance TTA, where 0-1 loss the one most widely used (as its risk corresponds to the classifier error).
For continuous losses such as Brier, which can take any value in [0. 1]. the lower bound must be scaled by a threshold - E (0. 1), resulting in looser bounds. 3 To recover some of the lost test power, propose also lower bounding the source risk Rg using the same threshold as in the test lower bound B, (Proposition 1):
Continuous Losses
Ro E[zo] 2 -P(zo > 7) =; Bo
which follows directly from Markov's inequality. Denoting the corresponding upper- bound of the confidence interval for Bo with Ub, we define the alarm function:
V : []
1 I. Ug:t Ao:t Zo, T)
U (Z0. (zo. 7) + Eua
(8)
T
For a loss bounded in Jo, .M] with M > 1. is theoretically possible that threshold calibration yields in which case scaling by 7 could produce a tighter lower bound. However, since all losses considered in this work are bounded above by 1, we leave this case for future work.
1.
23

---

where Ew := Sul and show its PFA guarantee for the following sequential test
Ho:
Pp (zz > & Pp, (zo > T) + Ewl: V4 2
(9)
H 38 1: 1 Σ >p) (zu > 5) + Eoo
The proof provided in $ B.5. Comparing the two sequential tests, we note that Eq. 9 tracks the probability of high loss, whereas Eq. 5 makes a statement about the expected loss (i.e., risk). While the test in Eq. 5 is arguably more interpretable- expecial considering that the loss threshold is not specified by the user but determined empirically through threshold calibration procedure (see Algo. 2)ethe advantage of the high-loss probability test in Eq. lies in its greater reactivity. Specifically, the lower bound L in the alarm function (Eq. 8) is no longer scaled by (due to the multiplication by }), resulting in a tighter bound that can recover some of the statistical power lost in the continuous loss setting, albeit at the cost of reduced interpretabilityy
We also note that the scaled alarm function (Eq. is closely related to the quantile detector proposed in Amoukou et al. [1]. Our work extends their approach in (at least) three main ways: first, by allowing for continuously evolving models, unlike [1] where a static model is assumed; second, by relaxing the assumption required for the loss proxy (see our Assumption versus their Assumption 4. 4.1); and third, by providing a theoretical justification for the increased reactivity of the high-probability test relative to the expected-loss test for continuous losses (via the cancellation of the loss threshold r). We elaborate further on these differences in $ 4.
A.2 Alternative Loss Proxies
Here, we compare our choice of using model uncertainty as a loss proxy ($ 3.3) with two alternatives: energy score and entropy. The energy score [21] is one of the most popular measures for detecting iitoof-distribution (OOD) samples: g(x. p) = log Σ em(()),, where m(x) E Rº is vector of logits for model p. The entropy of the predictive distribution is another common uncertainty-
based measure: g(x, p) - C p(c]x) log p(c])) x), where p(c) x) is the predicted class probability. Entropy widely used in TTA an unsupervised objective, e.g., in TENT [42], where models adapt by minimizing predictive entropy on unlabeled test data.
We present the corresponding results in Fig. 6. While using energy as loss proxies also yields valid lower bounds (as indicated by A > 0), the resulting bounds (-) are consistently looser compared to those obtained when using model uncertainty (-) across all TTA methods and distribution shifts. We attribute the underperformance of the energy score to its focus distinguishing in in-distribution versus OOD samples rather than separating correctly and incorrectly predicted instances. In contrast, useful loss proxy (see Assumption 1) should be able to differentiate between correctly predicted samples (i.e., low loss) and incorrectly predicted ones (i.e., high loss).
For entropy (-), detection delays are comparable to uncertainty as loss proxy. This confirms that our risk-monitoring mechanism remains valid and effective even when the same quantity is used both as the TTA objective and as the monitoring proxy. Indeed, our approach does not rely the raw proxy values but instead on the proportion of test points exceeding a calibrated threshold (see Assumption 1). If adaptation minimizes entropy, our online calibration procedure (see 3.4) dynamically adjusts this threshold, ensuring that the alarm remains reliable.
Although these findings further support our choice of model uncertainty suitable loss proxy. we believe that exploring alternative proxies that would lead to (even) tighter bounds remains an important direction for future work.
24

---

ImageNet ID
ImageNet Severity 5
ImageNet ID to Severity 5
1.0
Source
0.5
0.0
1.0
TENT
0.5
0.0
1.0
SHOT
0.5
0.0
1.0
SAR
0.5
50
100
0
50
100
150
0
200
400
Time
Time
Time
Üo
1 (uncertainty)
8/ (uncertainty)
R.
1 (energy)
8 Kenergy)
Assumpt. violated
L (cntropy)
3 (eutropy)
Figure Estimated test risk for ImageNet test streams: We compare uncertainty and energy-score as loss proxies. Uncertainty yields consistently tighter lower bounds on the test risk than the energy score.
A.3 Ablation on Calibration Set Size and Calibration Frequency
Our method requires small labeled calibration from the source distribution, which introduces additional computational overhead due to repeated evaluation of the adapted model on this set during adaptation. A small of (labeled) source samples is commonly used for initializing TTA methods [53, 54, 41, 55, 56, 2, 57-59], and is indispensable for risk control [30, I]. We next investigate whether the calibration set size can be reduced. addition to addressing the reliance on labeled data, smaller calibration set also reduces the runtime overhead of the online calibration procedure.
Fig. 7 shows the estimated upper bound on the source risk Un and our estimated lower bound on the
test risk L for the default calibration set size of Neal 1000 (-) and a reduced size of Neil 100
(-). We find that reducing the calibration set to Na.i 100 has minimal impact on both Uo and i.g. Only in the setting with gradually increasing distribution shift (right column) do we observe a slight
delay in risk detection compared to the default setup.
25

---

ImageNet ID
ImageNet Severity 5
ImageNet ID to Severity 5
1.0
Source
0.5
0.0
1.0
TENT
0.5
0.0
1.0
SAR
0.5
0.0
100
0
50
100
150
200
400
600
Time
Time
Time f
Do + Eool (Neal = 1000)
1/ (Nea 1000)
A (Meal 1000)
&
Co + (Meal 100)
1. (Nea 100)
1 (Nai 100)
Assumpt. violated
Figure 7: Estimated test risk for ImageNet test streams. We compare the default calibration size of Neal 1000 to a smaller set with Nai = 100. Reducing the calibration size leads to no or only small detection delays relative the larger calibration set.
Another way to reduce the computational overhead of the monitoring tool is to decrease the frequency of the online calibration procedure described in $ 3.4. Instead of evaluating the adapted model on the calibration set and selecting a new threshold A after every adaptation step k; one can perform this threshold selection only periodically, reusing the most recently calibrated threshold for the intermediate monitoring intervals. This reduces the number of calibration evaluations while maintaining continuous monitoring of the model's performance.
10
20
0.2
0.
200
400
200
400
200
400
200
400
200
400
Time 7
Timo
Time f
Time 1
Time 7
Figure 8: Estimated test risk of TENT ImageNet-C (ID Severity 5) when performing the online calibration step every 1, 2, 5, 10, 20 adaptation steps. Less frequent calibration results in only a small increase in detection delay, indicating a good trade-off between detection delay and computational overhead.
To assess the impact of such reduced calibration frequency, monitor TENT performance on the ImageNet-C test stream with different intervals performing calibration every 1,2, 5, 10, 20 adaptation steps. Fig. 8 shows that less frequent calibration leads to only small increase in detection delay. This suggests that our monitoring framework remains effective even when calibration performed at coarser temporal resolutions. Future work may further explore adaptive calibration strategies that trigger re-calibration only when significant increase estimated risk is detected, rather than at fixed time intervals.
26

---

A.4 Extended Comparison to Baselines
We next provide extended baseline comparison by evaluating the baselines from 5.1 the TTA methods and datasets studied in $ 5.2.
ImageNet ID
ImageNet Severity
Yearbook
FMoW-Time
Source
0
(1.1
11.0
0.5
TENT
0.0
0.0
0.5
0.5
SHOT
0.0
0.0
0.5
10.
CoTTA
0.5
0.5
SAR
50
100
200
200
Time
Time
Time
Time
On
1 (/cou))
(Assumpe. I)
Assumpt violated
Figure 9: Estimated test risk for different baselines, datasets and TTA methods.
Fig. displays the estimated risk across datasets and TTA methods. As expected, the oracle, supervised lower bound on the test risk, î.ş (--), reliably flags risk violations without causing false alarms across all datasets and TTA methods. In contrast, the naive plug-in bound Żद (-) triggers a false alarm the in-distribution ImageNet test stream for CoTTA, despite the test risk remaining below the alarm threshold. This is unsurprising, as i,द lacks formal guarantees the false alarm rate. While it yields reasonable risk estimates for the other TTA methods on ImageNet ID, as well ImageNet-C severity and FMoW-Time. fails detect risk violations on Yearbook across all TTA methods, Even though not originally proposed for TTA, we extend the unsupervised test risk lower bound by Amoukou et al. [1], L to the TTA setting to enable comparison on this plot. We note that it behaves poorly with TTA methods. Lę (-), also triggers fälse alarm ImageNet ID for COTTA. For other TTA methods, is largely unresponsive resulting
consistently loose lower bound the estimated true test risk RG (-). This looseness leads to missed alarms on the severe shift of ImageNet-C severity for out of 5 TTA methods. Furthermore, we observe that the required assumption of their method (...) is violated in nearly every practical setting.
In contrast, as shown in 5.2, our unsupervised test risk lower bound Ż (-) detects risk violations promptly (ImageNet-C severity 5, Yearbook), while remaining inactive when the risk threshold not breached (ImageNet ID, FMoW-Time).
27

---

A.5 Results under Label Shift
As our theoretical framework does not make any assumptions about the nature of the distribution shift (see 2), it naturally extends to scenarios with shifting label distributions. To explicitly validate this, we conducted additional experiments on the Yearbook dataset, where we induced controlled label shift by reordering test samples according to their class labels, following the setup of [10, 35).
Fig. 10 compares monitoring results for Yearbook with (righf) and without (left) label shift. Test-time adaptation methods perform worse under label shift, as reflected by the higher empirical risk Rg (-). Our method reliably detects this deterioration, triggering an earlier alarm across all TTA methods. While Assumption becomes slightly looser in this setting, the monitor still raises an alert, demonstrating that our framework effectively captures failures of TTA methods caused by label shift.
Yearbook
Yearbook (label shift)
Source
TENT
SHOT
CoTTA
SAR
100
300
200
Time /
Time
Pool Pool
ibb
A (Assumpt. 1)
Assumpt. violated
Figure 10: Estimated test risk on Yearbook. We compare test stream affected only by covariate shift (left) with one that additionally exhibits label shift (right). Under label shift, TTA methods show higher empirical risk, while our risk monitor detects the degradation earlier and raises an alarm accordingly.
28

---

B Theoretical Results
B.1 Choice of Confidence Sequences
For an introduction to confidence sequences, we refer the interested reader to Howard et al. [13] and Appendix E of Podkopaev and Ramdas [30]. Throughout this paper, interval to estimate the upper bound on the source risk. Accordingly, the samite-sample penalty term is given by wig = v log (w/uce)))) )/ /Naal- For the lower bound on the test risk, we use the conjugate-mixtung empirical Bernstein (CM-EB) confidence sequence proposed in Theorem 4 of Howard et al. [13], chosen for its minimal assumptions. To obtain the finite-sample terms w; for t 2 whwch depend Ones and the empirical variance of the observed sequence use the gamma-exponental mixture bound from Proposition 9 in Howard et al. [13].
a Hoeffding confidence
For the confidence sequence L used in proposed unsupervised alarms &6 (Eq. 7) and o (Eq. 8), apply CM-EB lower confidence sequence for E
1km1 Pr, (ug Ax.) with Quest and an upper Hoeffding confidence interval for I'P, (uo > λo zo T) with Clestz such that Chesn + Oresta Chest-
B.2 Unsupervised Lower Bound Derivation (Propositon 1)
Proposition 1. Assume a non-negative, bounded loss l [0, M,, O. Further, assume that for sequence of losses Zo:t. a sequence of loss proxies Uga logether with thresholds Ao...., d E IR, T E (0, M) satisfying Assumption I are available. Then the running test risk can be lower bounded
(e(a))) 2T
Σ Ppr (n Jmmm
Ax) Pro(us > Au Zu ST)
122 1.
Br
Proof. The proof technique is inspired by the derivation presented in Amoukou et al. [1]; see Eqs. (12)(15) in their paper. To derive a lower bound on the true running test risk, we first apply Markov's inequality and then invoke Assumption 1:
Markav's
1
R((Pia)
Ep.
2
F Ppr (Zk: > T) T
t
k=1
k=
Pr. (uk dk. 26 > 7) Pr, (ux S dx 2/ > >イ)
k=
Asc1
Σ Pp (uk
Ax) Pp. (uk
Ak. S + +PP (ux S AR. 2τ 21)
T
Ppr (ux > >xx) - Prr (mo > No 20 IT)
If the risk definition includes conditioning X1:k-1, i.e., Ra (px) Ey, [2e[xxa-1] the proof proceeds analogously, with the only change being the use of conditional Markov's inequality. In this case, the resulting bound holds almost surely.
B.3 PFA Control Guarantee
Proposition 2. The unsupervised alarm &e; (Eq. for the TTA sequential test (Eq. S) satisfies a probability of false alarm (PFA) control guarantee:
I Hoo (3t > 1, =1) S Oses + Qssouree
29

---

Proof. The proof closely follows the PFA proof for the supervised alarm from Podkopaev and Ramdas [30]. see Appendix D there. To show the PFA guarantee we proceed as:*
Pr. (31 2 1, D =) = Po (31 2 1, L; U > enol =
Pno (31 2 1 Rτ) - (U Ro) > 6tal (Re Ro)) 5
Pr. (31 2 (L. R₂) (U Ro) 0)
where the inequality follows from the fact that under Hy (Eq. 5), we have that coo 2 Rs - Ro- Since
Et 2 1, (L) R₂) (U Ro) implies that either öt 2 1, L RS > Oor Ro < 0.
use union bound to continue as:
Pr. (3 2 1, (4) R.) - (U Ro) > 0)
P( 2 1, - R 200) 0) + P(U - Ro < 0) S Ctest +
Ossource
where the last inequality follows from the fact that Lţ a lower bound confidence sequence for the lower bound B,, i..., P(B, 2 L3 Vt 2 1) 2 1 Cteat together with Proposition 1, which ensures
R₂ 2 Br Vt 2 1, and the fact that the upper bound the confidence interval for Rg.
B.4 Tighter Bound for 0-1 Loss
Corollary 1. For a 0-1 loss function, assume that for a sequence of losses Za,, sequence of loss proxies Uoat logether with thresholds .o...., de E R satisfying Assumption are available. Then the running test risk can be lower bounded as
(p(:)) Z "EP (u. > Ax) - Pro (wo > do, 2o = 0
Proof. This (tighter) bound follows from the fact that for 0-1 loss, Markov's inequality is unnecessary due the binary nature of the loss:
(p = Σ
Ep
[z]]
(0-1) I
Σ Pp 22 1]
k=1
k=1
The remainder of the proof then proceeds identically to that of Proposition
Observe how the lower bound for loss is the same as the lower bound for general (bounded, non-negative) loss in Proposition up to the loss threshold т. Additionally, we leave out the loss threshold 7 from Assumption i... we assume that the proxy sequence ug: is such that:
Pr [u
Ag. Z₁ = 0) < Pp, (uo
1 Au, Zo = 0) + t R=
Σ
Pp (us S Ak. Z4 = 1).
B.5 PFA for "Probability of High Loss" Test
Proposition 3. The unsupervised alarm &6 (Eq. for the 'probability of high loss" TTA sequential test (Eq. 9) satisfies PPA control guarantee:
PHo (3t 2 1, = < Otesst + Osounrce
Proof. To simplify notation, denote with R. = E Pr, (Zg > 7) and R = Ir, (zo > T). From the proof of Proposition 1, it follows that RØ 2 B, which, combined with the fact that L is lower bound confidence sequence for B, implies that TP R > LT VI 2 1) 2 Cres Similarly,
"To simplify notation, we omit all arguments of the relevant risks and confidence sequences in the proof (e.g.. abbreviate U (2o) U).
30

---

since U is an upper bound of the confidence interval for TR it follows that P 2 Rg) 2
1 Ossurce. The rest of the proof is then indentical to the proof of Proposition 2:
PHo (3t 2 1 = 1) = P Et 2 1, L Ub > Euo
PH. (3t 2 1, - R - U - Ri))
(Rg RRo) Ho
_
1
Ir. (31 2 1, (-1, | R2. - -- Rgy ) > 0) م
P(3 2 1, - R > 0) + P U - Rg < 0) S Osest + a'source
31

---

C
Algorithms
Algorithm 1: TTA with Risk Monitoring
Input :Calibration data Deal { (æ., M1 j with (æ;, Ms) Po. test data D { ) with 2; ~ Pk. loss function proxy function g, source model po, tolerance level Etols significance levels asource and Ques TTA method h (Pk-1 D Pk 1 Compute source losses 20, = (ppu(z;)
Compute source loss proxies u0, ( Po)
3 Find source thresholds λo F == arg maxx,7 FI(A, {(Fu,5) 1mm1)
Compute upper bound Ú using { (=0 ==
Not and Ossource
5 for k 2 1 do
Perform TTA update pk h(pk-1,
Compute losses of model pa Deat: 20,6 ((:)) yi)
(1k
(k)
Compute loss proxies of model pa on Deali uo g( pk
Update proxy threshold Åς arg max, F1 F; {= 1 j
(1)) (k) Not)
Compute loss proxies model pa on D uhst = g [2s pk) N;
10
Compute lower bound & using {"1,") (u -==11 { {20 6=1
Non
Pock &,, Arest
Compute alarm $ i Ú + eool
13
=1 then
Terminate TTA break
15
16
else
17
Predict using Pk: on D 0s arg max, (xx)) continue
18
Algorithm 2: Online Threshold Calibration
Input
:Calibration data Deat {(x;, N with (wi,0i) ~ Po. loss function é, proxy function 9. source model po. TTA models Pi....,PL
Output:loss threshold f, proxy thresholds do:
Compute source losses 20, (pp());) vi)
2 Compute source loss proxies up,i = g(I,, Po)
Find source thresholds λo f == arg max,,- FI(A, Ti ((20,1 (i11
for k 1 do
Compute losses of model pt on Deat: 20,1 E(p (z;),, y1)
(k)
Compute loss proxies model pk on Deal: u = g(x,, pr)
Update proxy threshold Åạ = arg max, F1(A, f; { (1(00) un Not)
return ł, Ao.
32

---

D Experimental Details
D.1 Datasets
ImageNet-C [12]: This dataset applies 15 types of algorithmic corruptions (c.g.. Gaussian noise, blur, weather effects, digital distortions) at five severity levels to the original ImageNet [60] validation set. The dataset preserves the original 1,000-class classification task, using the same labels and image resolutions. our setup, we focus on Gaussian noise corruption.
Yearbook [8]: This dataset contains portraits of American high school students taken eight decades, capturing changes in visual appearance due to evolving beauty standards, cultural norms, and demographics. We follow the Wild-Time preprocessing and evaluation protocol [45], resulting in 33,431 grayscale images (32x32 pixels) labeled with binary gender. Images from 1930-1969 are used for training, and those from 1970-2013 for testing.
FMoW-Time: The Functional Map of the World (FMoW) dataset [61] consists of 224x224 RGB satellite images categorized into 62 land-us use classes. Distribution shift arises from technological and economic changes that alter land usage over time. FMoW-Time Time [45] is temporal split of FMMo-WIILDS [61, 62], dividing 141, ,666 images into a training period (2002-2014) 4) and testing period (2015-2017).
D.2 TTA Methods
We evaluate our monitoring tool across several TTA methods, which differ the set of adapted parameters (e.g.. normalization layers, full model, classification head) and in their objective functions (e.g., entropy minimization, information maximization, log- likelihood maximization):
TTENT(42] updates normalization layers by minimizing test entropy.
SHOT [19] adapts normalization layers using information maximization and self-supervised pseudo-labeling to align target representations with frozen source classifier.
SAR [27] updates normalization layers via an entropy minimization objective. It filters out high-entropy samples and guides adaptation toward flatter minima.
CoTTA [41] updates all model parameters using student-teacher approach on augmentation averaged predictions. also employs stochastic weight restoration mitigate forgetting.
T3A [15] adjusts only the final linear classifier by computing class-wise pseudo-protee protooyppssss from confident, normalized representations.
STAD [35] updates only the last linear layer by tracking the evolution of feature representations with a probabilistic state-space model.
D.3
Implementation Details
All experiments are performed on NVIDIA RTX 6000 Ada with 48GB memory. We plot the mean and standard deviations over 20 runs. The variability across runs stems from calibration set sampling and test sample shuffling with different random seeds. For Fig. 5 and ?? we use 10 random seeds.
For each TTA method, we use the default hyperparameters proposed in the respective paper. We use a test batch size of 32 for ImageNet and 64 for Yearbook and TTime.
We use the confseq package [63] by [13] to compute the conjugate-mixxe mixture empirical Bernstein confidence lower bound on the target risk. This confidence sequence framework supports tuning for an intrinsic time tope. which we set by default to the first 25% of the sequence length for all experiments. To implement the bascline L from Amoukou et al. [1]. we the same loss proxy- moxy--mnertainty-- as in our method.
33

---

E Further Related Work
Error and aceuracy estimation aims to assess model performance on unlabeled test data, which is often subject to distribution shift [64, 65]. This is typically achieved via model uncertainty [66, 4, 67- 69] or model disagreement [70. 71, 16, 33, 18, 72, 73]. Uncertainty-base -bsed methods exploit the predictive distribution of the model- for example through the maximum class probability [66] or the true class probability [4]-and learn a threshold to distinguish correctly from incorrectly predicted samples [67-69]. Disagreement-basee error prediction methods leverage the theoretical equivalence between model disagreement and test error under calibration [70, 16]. However, these methods often require training multiple pondels-someting
even from different architectures [71, 70]. Closest to our work [18, 31, 74], estimate the accuracy of TTA methods based on disagreement. Notably, by exploiting theoretical results from [70], Lee al. [18] proposes an accuracy estimation method based on dropout disagreement. They differ from our work by (i) providing an estimator of test risk directly while are interested in signaling significant increase in test risk compared to the source risk; as such (ii) their method does not come with guarantees on the false alarm rate; and (iii) they require calibration (their Definition 3.3) to preserve theoretical validity of their risk estimator while we rely on separability of high and low error samples (Assumption 1).
TTA robustness Recent work has identified several scenarios where TTA methods tend to degrade. These include adaptation under non-stationary test distributions [41, 75, 46, 54, 6, 22, 76, 35], label shift [10, 26, 3, 46], mixed domains within test batch [27, 54, 22]. small test batch sizes [27, 54, 22, 6, 35], and adaptation in the presence of malicious samples [29, 43]. Most such work on TTA robustness has focused on proposing more robust TTA methods and developing evaluation benchmarks [10, 22, 46, 76]. Liu et al. [77] analyze failure cases of the related test-time training paradigm, which requires sulf--upe objective during training. They derive an upper bound on test risk dependent on the effectiveness of the supf-sueee loss. In contrast, our approach does not require any modification the training procedure and provides guarantees that hold regardless of the model's original training objective. Also related to our work is research on TTA model collapse--v -wheee models degenerate to trivial solutions during adaptation [31, 27, 18, 78] and efforts to identify optimal reset mechanisms that revert the model back to its source parameters during deployment [26, 18, 78]. In contrast, we propose general purpose monitoring tool that provides statistical guarantees on risk control for arbitrary TTA methods. Rather than focusing a specific mitigation strategy, our tool can inform a range of interventions-
general-purpose
as resetting the model to its source for continued adaptation or taking it offline entirely for retraining [79].
F Impact Statement
This work introduces a statistically grounded framework for detecting risk violations during TTA, key challenge for deploying machine learning models in dynamic, real-world environments. By enabling risk monitoring without access to labels, our approach promotes safer and more trustworthy use of TTA weethoss-particulle
in high-stakes domains such as healthcare, autonomous systems, and finance, where undetected model failure can have serious consequences. Our method comple- ments existing adaptation techniques by offering a safeguard against silent performance degradation and model collapse, helping practitioners determine when adaptation is no longer effective. In doing so, it supports more responsible and robust deployment of adaptive models. While the framework provides eigh-probability guarantees, misuse or overreliance could lead to overconfidence in model reliability. We therefore emphasize the importance of understanding its assumptions and limitations. Overall, this work contributes to the safe deployment of adaptive machine learning models under distribution shift.
34


Reviews:
[{"review_id": "E6eSNrj2TL", "reviewer": "Reviewer_RuQX", "summary": "This paper proposes a method for monitoring performance during test-time adaptation (TTA) without access to test labels. By extending sequential testing with confidence sequences, it develops unsupervised alarms based on loss proxies (specifically, model uncertainty), enabling reliable detection of performance degradation. The method is supported by theoretical analysis and is empirically validated across datasets, shift types, and TTA strategies.", "questions": "Questions \n- Is there a practical way to diagnose whether Assumption 1 holds at deployment time?\n- How sensitive is the method to hyperparameters (e.g., ϵ_tol, α, λ, τ)?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strenghts\n\n- Important Problem: The paper tackles a critical challenge in test-time adaptation, due to risks such as silent model collapse or performance degradation, which current TTA methods often fail to detect.\n\n- Practical Proxy: It leverages predictive uncertainty as a simple and efficient proxy for model error, requiring no auxiliary components. The use of online threshold calibration ensures effectiveness even under continuous adaptation.\n\n- Broad Applicability: The proposed method seems to generalize well across TTA methods, datasets, and types of distribution shift.\n\nWeakness:\n\n- Unverifiable Assumption: The method relies on Assumption 1 (proxy informativeness) for its guarantees, but this assumption cannot be verified without labels, limiting trust in fully unsupervised deployments.\n\n- Proxy Sensitivity: Performance depends on the choice of proxy and threshold calibration. For example, standard uncertainty fails for last-layer TTA methods under severe distribution shifts.\n\n- Hyperparameter Robustness: The method introduces several hyperparameters (ϵ_tol, α, λ, τ), but their sensitivity to different shifts is not analyzed. Given that TTA methods are known to be HP-sensitive [1,2], it's important to study how these choices affect risk detection.\n\n[1] Parameter-Free Online Test-Time Adaptation, CVPR 2022 \\\n[2] On Pitfalls of Test-Time Adaptation, ICML 2023", "was_revised": true, "final_justification": "This paper presents a sound, yet incremental, contribution to TTA. I am not opposed to accepting it, but I would not actively advocate for its acceptance either.", "rebuttal": "We thank you for your feedback. We address your questions below.\n\n> *Hyperparameter Robustness: The method introduces several hyperparameters (ϵ_tol, α, λ, τ), but their sensitivity to different shifts is not analyzed. Given that TTA methods are known to be HP-sensitive [1,2], it's important to study how these choices affect risk detection.*\n\n> *How sensitive is the method to hyperparameters (e.g., ϵ_tol, α, λ, τ)?*\n\nWe would like to clarify that the parameters mentioned ($\\epsilon\\_{\\text{tol}}$, $\\alpha$, $\\lambda$, $\\tau$) are not hyperparameters. Instead, they are either user-specified parameters that control the conservativeness of the statistical testing framework ($\\alpha$, $\\epsilon\\_{\\text{tol}}$), or thresholds that are *automatically tuned* by our proposed online calibration procedure ($\\lambda$, $\\tau$). Below, we summarize how each parameter is defined in the manuscript:\n\n- User-specificed parameters:\n\n    - $\\alpha$: This is the significance level used in the sequential test (Section 3.1). As with standard statistical tests, this parameter is chosen by the user based on task-specific requirements. A lower $\\alpha$ makes the test more conservative—prioritizing Type I error control (i.e., reducing false alarms) at the cost of reduced power (i.e., lower detection sensitivity).\n    - $\\epsilon\\_{\\text{tol}}$: This is a parameter that determines what constitutes the performance drop at test time that is still acceptable. For $\\epsilon\\_{\\text{tol}} = 0$, the user wants to trigger the alarm as soon as the performance on test data gets worse compared to the performance on the source data, whereas for $\\epsilon\\_{\\text{tol}} > 0$ the user allows for some ‘slack’ at test time.\n\nWe consider the ability to accommodate a range of values for $\\alpha$ and $\\epsilon\\_{\\text{tol}}$ a strength of our framework, as this means that our monitoring framework is applicable across various settings with different requirements on when to trigger the alarm.\n\n- Automatically estimated thresholds:\n\n    - $\\lambda\\_k$ and $\\tau$: As described in Section 3.2, $\\lambda\\_k$ is the loss proxy threshold at time step $k$, and $\\tau$ is the loss threshold. Both are estimated online using our calibration procedure (see Section 3.4). Hence, they are not fixed hyperparameters but ‘fitted’ parameters of our monitoring tool.\n\nImportantly, unlike prior threshold calibration approaches [1], which require manual hyperparameter tuning (e.g., an FDP cut-off in [1], see Section 4.1 there), our threshold finding procedure does not introduce any hyperparameters. **As such we find that our *hyperparameter-free* threshold calibration generalizes across a large set of TTA methods and shift types in our experiments (see Section 5.2).**\n\n> *Proxy Sensitivity: Performance depends on the choice of proxy and threshold calibration. For example, standard uncertainty fails for last-layer TTA methods under severe distribution shifts.*\n\nWe agree that selecting an appropriate loss proxy is crucial for the effectiveness of our proposed risk monitoring framework. However, we would like to emphasize that our choice of model uncertainty as a proxy has demonstrated robustness, generalizing well across five TTA methods and four types of distribution shifts (see Section 5.2). While it does indeed underperform for last-layer TTA methods—as we acknowledge ourselves in Section 5.4—this behavior is expected. As we explain there, last-layer TTA methods normalize the classification head, making uncertainty less informative of the true loss. To address this, we propose an alternative proxy based on the distance to class prototypes, which we found to be effective (see Figure 5). Our motivation for pointing out the failure of model uncertainty in the case of last-layer methods was to illustrate the flexibility of our risk monitoring framework to accommodate different loss proxies, and to highlight that the choice of the proxy should be informed by the characteristics of the given TTA method. \n\nRegarding the dependence on threshold calibration, we found that our proposed online calibration procedure (Section 3.4) generalizes well across all TTA/shift scenarios considered in our experiments—including last-layer methods. As such, we are unsure about the concern raised here. If you could elaborate further, we would be happy to provide additional clarification or conduct further experiments.\n\n> *Unverifiable Assumption: The method relies on Assumption 1 (proxy informativeness) for its guarantees, but this assumption cannot be verified without labels, limiting trust in fully unsupervised deployments.*\n\n> *Is there a practical way to diagnose whether Assumption 1 holds at deployment time?*\n\nWe agree that the unverifiability of Assumption 1 at deployment time—due to the lack of labels—is a limitation of our monitoring framework. We explicitly acknowledge this in Section 6, where we also highlight the development of unsupervised diagnostics for detecting potential violations of Assumption 1 as a important direction for future work.\n\nHowever, to the best of our knowledge, there is currently no method that can estimate test performance under unknown distribution shifts without labels *and* provide theoretical guarantees without relying on some form of assumption. As noted in [2]: *\"Bounding error under distribution shift is fundamentally impossible without assumptions.\"* As such, we believe the real question is not how to have an assumption-free monitoring tool, but rather what is the assumption that (i) is satisfied across most TTA scenarios and (ii) yields an effective monitoring signal. We believe our empirical results demonstrate that Assumption 1 successfully satisfies both of these desiderata.\n\nWe thank you again for reviewing our work. If you feel like we have sufficiently addressed your concerns, we would appreciate you raising your score. \n\n[1] Amoukou et al. Sequential Harmful Shift Detection Without Labels. NeurIPS 2024\n\n[2] Rosenfeld et al. (Almost) Provable Error Bounds Under Distribution Shift via Disagreement Discrepancy. NeurIPS 2023"}, {"review_id": "NHqp4TDnsY", "reviewer": "Reviewer_cUHi", "summary": "The paper proposes to detect the degradation in test time adaptation models over time. The core idea is to adapt the sequential testing technique for risk monitoring to the case of time-varying models and unlabeled data.", "questions": "None", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths:**\n- Previous risk monitoring techniques such as sequential testing was designed for static models on labeled data. The authors extend it to handle the test-time adaptation case. The key is to monitor the losses of a sequence of models updated during the adaptation, and to design proxy loss functions to eliminate the need for labels.\n- The proposed method is straight-forward and easy to implement.\n\n**Weaknesses:**\n- In the paper only the classification task is considered. It is unclear for other tasks whether we can find suitable loss proxies and whether this method is still effective.\n- This framework does not handle label distribution shift, where only the label distribution is changing over time, but not the input distribution.", "was_revised": true, "final_justification": "The rebuttal addresses my concern and I raise my rating to accept.", "rebuttal": "We thank you for your time and efforts. We address your points below. \n\n> *In the paper only the classification task is considered. It is unclear for other tasks whether we can find suitable loss proxies and whether this method is still effective.*\n\nTo the best of our knowledge, classification is (by far) the most studied task in the test-time adaptation literature [1], which is why we focused on it in our experiments. That said, our theoretical framework is general and should be readily extendable to other tasks such as regression by finding the suitable loss proxies. We view this as a highly promising direction for future work. If there are some specific tasks you have in mind, please let us know, and we would be happy to discuss how our framework could be adapted accordingly.\n\n> *This framework does not handle label distribution shift, where only the label distribution is changing over time, but not the input distribution.*\n\n**We would like to clarify that our theoretical framework does handle the case of a shifting label distribution** $P_k(y)$. As we write in Section 2 (lines 55-57), \n\n*Test samples in* $\\mathcal{D}_{\\textrm{test}}^k$ *are assumed to arrive sequentially from a time-varying and possibly shifting test distribution* $(x_k, y_k) \\sim P_k, k \\ge 1$. *We do not make any assumptions about the nature of the distribution shift.*\n\nDuring the rebuttal we experimentally validated our framework when the label distribution $P_k(y)$ is changing. For that, we order Yearbook test samples according to their class labels to induce label shift per batches, as in [2]. Due to our inability to attach plots, we summarize the results in the table format below. We report (i) average detection delay which is defined as the difference between the time at which our unsupervised lower bound crosses the performance threshold $\\hat{t}\\_{\\text{min}}^b$ and the time at which the “true” test risk does so $\\hat{t}_{\\text{min}}^a$, and (ii) the time-average of Assumption 1 delta (as defined in line 284 of the manuscript) which directly reflects the tightness and validity of our bound. **Results below show that our risk monitoring framework is also effective at detecting risk violation that arise due to the presence of label shift.** We will include those results to the camera-ready version and would like to thank you for this suggestion. \n\n### Yearbook (without label shift, Figure 3):\n\n|  | Avg detection delay $(\\downarrow)$ | Assumption 1 delta $(\\downarrow^+)$ |\n| --- | --- | --- |\n| SOURCE | 76 | 0.07 |\n| TENT | 84 | 0.07 |\n| SAR | 87 | 0.07 |\n| SHOT | 73 | 0.06 |\n| COTTA | 58 | 0.08 |\n\n### Yearbook (with label shift):\n\n|  | Avg detection delay $(\\downarrow)$ | Assumption 1 delta $(\\downarrow^+)$ |\n| --- | --- | --- |\n| SOURCE | 66 | 0.07 |\n| TENT | 68 | 0.17 |\n| SAR | 71 | 0.18 |\n| SHOT | 39 | 0.15 |\n| COTTA | 35 | 0.17 |\n\nIf we have clarified your concerns, we would appreciate your consideration in raising your score.\n\n[1] Xiao, Zehao, and Cees GM Snoek. Beyond model adaptation at test time: A survey. Arxiv 2024.\n\n[2] Gong, Taesik, et al. NOTE: Robust continual test-time adaptation against temporal correlation. NeurIPS 2022"}, {"review_id": "tNMXW3Ycwz", "reviewer": "Reviewer_PuqZ", "summary": "This paper proposes a risk monitoring method for TTA, aiming to address the challenge of detecting potential performance degradation during TTA when encountering distribution shifts. It extends sequential testing to the unsupervised TTA setting with no test labels used. Key components include a loss proxy using model uncertainty, online threshold calibration with labeled source subset, and theoretical analyses for false alarm control. It is validated across datasets and TTA methods, showing its effectiveness in detecting risk violations to prevent TTA collapse.", "questions": "1. How does the framework perform when Assumption 1 is persistently violated? Is there any failure case?\n2. Can the framework be tuned to prioritize early detection over false alarm rate control for safety-critical applications? How to deal with the trade-off.", "limitations": "1. Detection Delay: The approach introduces inevitable delay, which may may impact time-sensitive applications.\n2. Label Requirement: Verifying the key assumption (Assumption 1) needs labeled data.  Additionally, the requirements for D_cal from the source domain may violate the source-free principle to some extent.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "## Strengths\n1. **Novel Unsupervised Monitoring Approach**: TTA methods are proved to be vulnerable to some environments or shifts, knowing when TTA methods collapse or worse than source model is a critical task. The paper fills a significant gap by risk monitoring for TTA without test labels, leveraging model uncertainty as a proxy and extending sequential testing frameworks.\n2. **Theoretical Rigor**: The approach is grounded in confidence sequences, providing time-uniform guarantees, the authors derive false alarm control and validate assumptions both theoretically and empirically.\n3. **Practical Adaptability**: Online threshold calibration and alternative proxies enhance robustness to different TTA methods and different shifts without specific designs, which shows good potential to address real-world deployment challenges.\n\n## Weaknesses\n1. **Dynamic Environment Assumptions**: the framework assumes that the test domain is under stationary distributions. While more pratically it may not hold in scenarios with continual distribution shifts. In this more challenging setting, can risk monitoring also work well? It should handle the rapid distribution shift when facing domain change. Some theoretical anlayses and extensive experiments with continual TTA on the whole ImageNet-C with the CoTTA proposed setting may better prove its effectiveness.\n2. **Limited Collapse Prevention Comparisons**: While the framework detects collapse, It lacks of comparison with other collapse prevent methods. For example, some baseline methods like SAR’s resetting strategy, using $D_{cal}$ as a validation set for comparison between current model and source model.\n3. **Unquantified Computational Overhead**: The paper omits metrics (e.g., FLOPS, inference time) to characterize the monitoring framework’s computational cost, which is critical for resource-constrained deployments.", "was_revised": true, "final_justification": "I have read the authors' detailed response. It has successfully addressed several of my concerns, particularly regarding the framework's performance in dynamic environments and the overhead of the monitoring tool. The new experimental results on the continual ImageNet-C setting are a valuable addition that I believe should be included in the final version. While I still harbor some concerns regarding Assumption 1 and the reliance on labeled data, as these factors may restrict the real-world applicability. Given the improved clarity, I intend to maintain my borderline accept rating while increasing my confidence in this assessment.", "rebuttal": "We thank you for your reviewing efforts, it is much appreciated. We address your questions below.\n\n> Dynamic Environment Assumptions: the framework assumes that the test domain is under stationary distributions. [...]\n\nWe would like to clarify that we do not assume that \"*test domain is under stationary distribution*\". Instead, as we write in Section 2 (lines 55-57):\n\n*Test samples in $\\mathcal{D}_{\\text{test}}^k$ are assumed to arrive sequentially from a time-varying and possibly shifting test distribution $(\\boldsymbol{x}_k, y_k) \\sim P_k, k \\ge 1$. We do not make any assumptions about the nature of the distribution shift.*\n\nThe reason for the generality of our framework is our use of conjugate-mixture empirical Bernstein bound [1] when constructing the confidence sequence for the test risk (see Appendix B.1 in the paper for more details).\n\nIn our experiment, we report the results on time-varying shifts. For example, in Section 5.1 we report ImageNet-C results when the severity gradually increases from severity 0 to severity 5 across the test stream, whereas in Section 5.2 we report results for Yearbook and FMoW-Time datasets, both of which contain time-varying (i.e., non-stationary) shifts [4].\n\n> [...] whole ImageNet-C with the CoTTA proposed setting may better prove its effectiveness.\n\nHere we assume you are asking how our monitoring tool performs on a test stream where  different ImageNet-C corruptions are applied sequentially. If we have misunderstood your point, please kindly let us know.\n\n**During the rebuttal, we have tested our risk monitoring framework on a test stream where all ImageNet-C corruptions were sequentially appended at severity level 5. As seen in the results below, the effectiveness of our monitoring tool generalizes to this stream as well.** This is a direct consequence of the aforementioned generality of our theoretical framework where we do not make any assumptions on the nature of the distribution shift.\n\nNote that since we cannot attach figures to the rebuttal, the results are summarised using 2 quantitative metrics: (i) average detection delay and (ii) time-average of Assumption 1 delta (see line 284 in our manuscript for the exact definition).\n\n### ImageNet-C, Gaussian Noise→…→ JPEG, Severity 5\n\n|  | Avg detection delay ($\\downarrow$) | Assumption 1 delta ($\\downarrow^+$) |\n| --- | --- | --- |\n| SOURCE | 33 | 0.00 |\n| TENT | 108 | 0.08 |\n| SAR | 91 | 0.05 |\n| SHOT | 96 | 0.05 |\n| COTTA | 52 | 0.12 |\n\n### ImageNet-C, Gaussian Noise, Severity 0→5 (Figure 7)\n\n|  | Avg detection delay ($\\downarrow$) | Assumption 1 delta ($\\downarrow^+$) |\n| --- | --- | --- |\n| SOURCE | 297 | 0.05 |\n| TENT | 269 | 0.03 |\n| SAR | 424 | 0.04 |\n| SHOT | 237 | 0.04 |\n| COTTA | 241 | 0.04 |\n\n> Limited Collapse Prevention Comparisons:  [...]\n\nWe would like to clarify that the primary goal of our risk monitoring tool is to detect when the test risk (i.e., error) exceeds a predetermined performance threshold.  Wee see this is a distinct task from collapse *prevention*, which we interpret as either (i) some form of on-going regularization that prevents collapse, or (ii) a method that allows TTA to recover once collapse has already occurred.  In either case, our contribution is complementary since our method can detect when (i) fails to prevent collapse or, in the case of (ii), trigger an prevention strategy (e.g. rolling back to the non-collapsed model).\n\nMoreover, note that risk monitoring is a more general goal than collapse *detection*, as performance degradation can occur even in the absence of collapse (e.g., under harmful distribution shifts). As such, we found it more meaningful to compare our method with existing risk monitoring tools [5], and we presented an extended comparison to relevant baselines in Appendix A.5. It is true that in Section 5.3 we discuss model collapse in the context of TENT. However, this was not intended to frame our tool as a collapse detector. Rather, our aim was to demonstrate that our monitoring tool remains effective even when the underlying TTA method collapses—a non-trivial result given that our monitoring relies on the model’s own uncertainty estimates.\n\n> Unquantified Computational Overhead:  [...]\n\nWe agree that minimizing the computational overhead introduced by monitoring is important. To this end, we would like to highlight that our monitoring “wrapper” is lightweight. As shown in Algorithm 1 in Appendix C, the main additional cost of monitoring comes from threshold calibration (Algorithm 2) which involves running the adapted model on the calibration data—an operation that can typically be performed in a single forward pass thanks to the small size of the calibration set (see Appendix A.4)—followed by computing F1 scores over a fixed grid of candidate thresholds. As a result, the runtime of our monitoring component is small compared to the TTA block, which often requires a backward pass to update the model. We will include a more detailed discussion of the computational costs in the camera-ready version, along with precise timing measurements.\n\nAs part of the rebuttal, we also conducted an experiment where threshold calibration is performed not at every step (as in the main experiments reported in the paper), but only every $S>1$ steps, which naturally reduces the computational overhead. As shown in the table below, monitoring remains effective even for $S > 1$. We will add these results to Appendix A.4.\n\n### ImageNet-C Sev 0→5\n\n|  | Avg. detection delay ($\\downarrow$) | Assumption 1 delta ($\\downarrow^+$)  |\n| --- | --- | --- |\n| TENT (S=1) | 269 | 0.03 |\n| TENT (S=10) | 269 | 0.03 |\n| TENT (S=20) | 280 | 0.04 |\n\n> How does the framework perform when Assumption 1 is persistently violated? [...]\n\nThroughout our experiments, we have not encountered a scenario where Assumption 1 is persistently violated. According to our theoretical analysis (Section 3.2), if such a persistent violation were to occur, the lower bound would no longer be valid, and our monitoring tool could begin raising false alarms at a rate exceeding the guaranteed level $\\alpha$. As noted in Section 5.2, we have observed small violations of Assumption 1 for small values of $t$ on the FMoW-Time dataset. Fortunately, at small $t$, the finite-sample penalty term in the confidence sequence is largest, which may help compensate for these violations and reduce the risk of false alarms.\n\nOn the flip side, a more practical issue we have observed is that Assumption 1 can sometimes be satisfied “too much,” resulting in a lower bound that is overly loose. This occurs, for instance, when using model uncertainty as a loss proxy with last-layer TTA methods, due to the normalization applied to the classification head (see Section 5.4). To address this, we propose using the distance to the closest class prototype as a more suitable loss proxy for such methods, which leads to tighter and more informative bounds.\n\n> Can the framework be tuned to prioritize early detection over false alarm rate control […]\n\n> Detection Delay: […]\n\nWe agree that the detection delays introduced by our monitoring tool may be too large for scenarios where late detection is significantly more costly than false alarms, as we also note in the limitations section in Section 6. As discussed in Appendix A.1, such delays are to some extent unavoidable when aiming to guarantee a low probability of false alarm (PFA), as is the case in our work. That’s because a PFA guarantee necessitates working with the *lower* confidence sequence on the true test risk (error), which itself must be further lower-bounded in our unsupervised setting (see Proposition 1). This “double” lower-bounding results in a conservative behavior of the monitoring tool and can lead to increased detection delays.\n\nTo answer the question on prioritizing the early detection instead, we believe the most promising approach is to relax the PFA guarantee and instead adopt guarantees based on the average run length (ARL). In short, unlike PFA, which controls false alarm *with high probability*, ARL controls the false alarm *in expectation*. A successful example of relying on ARL guarantees (instead of PFA) to improve detection times can be found in the literature on change-point detection [2].  As we mention in Section 6, extending our proposed TTA monitoring framework to incorporate ARL-style guarantees is a highly promising direction for future work.\n\n> Label Requirement: [...] assumption (Assumption 1) needs labeled data.\n\nDue to character-limit for the rebuttal response, please see our response to RuQX.\n\n> requirements for D_cal from the source domain may violate the source-free principle to some extent.\n\nWe agree that our use of labeled calibration data from the source distribution for threshold calibration (Section 3.4) could be viewed as a minor deviation from the source-free principle. However, as demonstrated in Appendix A.4, effective risk monitoring can still be achieved with as few as 100 calibration samples. We believe this is a reasonable trade-off for the added safety afforded by rigorous performance monitoring enabled by our method. Crucially, our monitoring approach does not require any labels from the test data, maintaining full compatibility with the TTA paradigm.\n\nWe thank you again for your efforts in reviewing our work. If you feel like we have sufficiently addressed your concerns, we would appreciate you raising your score.\n\n[1] Howard et al. Time-uniform, nonparametric, nonasymptotic confidence sequences. The Annals of Statistics, 2021\n\n[2] Shekhar et al. Sequential changepoint detection via backward confidence sequences. ICML 2023\n\n[3] Rosenfeld et al. (Almost) Provable Error Bounds Under Distribution Shift via Disagreement Discrepancy. NeurIPS 2023\n\n[4] Yao, Huaxiu, et al. Wild-time: A benchmark of in-the-wild distribution shift over time. NeurIPS 2022\n\n[5] Amoukou et al. Sequential Harmful Shift Detection Without Labels. NeurIPS 2024"}, {"review_id": "9zeJZwyfCh", "reviewer": "Reviewer_d5NY", "summary": "This paper proposes a method for monitoring risks in test-time adaptation (TTA). Monitoring risk has been done before. But previous work usually only consider risk monitoring for fixed models after they are deployment. This paper is the first one (that I know of) that deals with the risk monitoring in the test-time adaptation (TTA), where the model can adapt itself after deployment. This paper proposes an algorithm based some theoretical results motivated by previous, especially [1] and [30]", "questions": "Please refer to \"weakness\" above", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength\n---------\n\nTest-time adaptation has become popular recently. Most TTA work focuses on developing new TTA algorithms that achieve higher accuracy. There is little work on studying the problem of detecting when the risk monitoring (i.e. the performance of the model degrades too much after adaptation for a long time, so the model needs to be retrained). I think this paper addresses a problem of practical importance in TTA.\n\nThe proposed method seems to be sound (although I am not an expert in theoretical machine learning, so I cannot comment on how novel or significant those theoretical results are). Apart from theoretical results, this paper also provides a concrete method that can be operationalized. The method is quite simple to implement in practice. \n\nWeakness\n------------\n\n1) From what I can understand, the key idea of the proposed method is to define a loss proxy u that does not require ground-truth labels. This paper chose a particular proxy in Sec 3.3 using some kind of uncertainty. But it is not clear to me whether this particular choice is somehow connected to the theoretical results in previous sections. There are many other ways of defining uncertainty (e.g. the entropy used in TENT). Would the method still work if you use other uncertainty metric? Is the particular uncertainty metric used in this paper better than other alternatives?\n\n2) For most TTA methods (e.g. TENT), they simply optimize some unlabeled loss function during adaptation. To me, the uncertainty measure in Sec 3.3 can also be used as the loss function in TTA. In other words, the TTA algorithm can directly try to optimize this risk during testing. Intuitively, the TTA method will \"overfit\" to this risk measure. I am interested in whether the proposed method still works in this case. \n\n3) The experiment compares different methods by showing some curves. I think it is important to define some numerical metric based on those curves (e.g. in other fields, people use AUC based on precision/recall curve). Otherwise, it is impossible for any follow-up work to directly compare with this paper.", "was_revised": true, "final_justification": "The rebuttal addressed most of my questions. I will maintain the positive rating.", "rebuttal": "We thank you for your reviewing efforts and feedback, it is much appreciated. We address your questions below.\n\n> *From what I can understand, the key idea of the proposed method is to define a loss proxy u that does not require ground-truth labels.* \n\nWhile coming up with a suitable loss proxy that doesn’t require labels is an important part of our method (as done in Section 3.3), we would like to clarify that it is not by itself our main contribution/idea. Instead our main focus is to extend the risk monitoring based on sequential testing to the setting of TTA, which additionally requires figuring out the necessary assumptions to preserve theoretical guarantees (Section 3.2) and tackling the challenge of online calibration to ensure that loss proxy remains informative under data shifts and model adaptation (Section 3.4).\n\n> *This paper chose a particular proxy in Sec 3.3 using some kind of uncertainty. But it is not clear to me whether this particular choice is somehow connected to the theoretical results in previous sections.* \n\nAccording to our theoretical results in Section 3.2, any loss proxy can be used within our risk monitoring framework, provided it satisfies Assumption 1 (which ensures that the lower bound on the test error from Proposition 1 remains valid). Therefore, our proposal to use model uncertainty in Section 3.3 is motivated by our empirical observation (Section 5.2) that it consistently yields valid and tight lower bounds across a diverse set of TTA methods and shift types. Moreover, unlike some previously proposed proxies (e.g., those based on separately fitted error estimators [1]), model uncertainty is particularly appealing due to its simplicity—it requires no additional model parameters or extra forward passes on the test data. In addition to these empirical motivations, we also present a small theoretical justification in Section 3.3, arguing that model uncertainty approximates the true conditional risk up to the calibration error.\n\nWe would like to thank you for raising this point. In the camera-ready, we will make sure to better explain the connection between the theory for general loss proxies in Section 3.2 and our concrete choice of model uncertainty in Section 3.3.\n\n> *There are many other ways of defining uncertainty (e.g. the entropy used in TENT). Would the method still work if you use other uncertainty metric? Is the particular uncertainty metric used in this paper better than other alternatives?*\n\nAs explained in our previous response, our monitoring method is compatible with a range of different loss proxies. However, in our experiments, we found that the proposed model uncertainty proxy (Section 3.3) leads to more effective detection than several other popular uncertainty measures. Specifically, in Appendix A.3, we compare model uncertainty against the energy score [2], a widely used OOD detection metric. As shown in Figure 7, the energy score underperforms relative to model uncertainty, yielding looser lower bounds on test error and consequently leading to greater detection delays. \n\nAdditionally, in Section 5.4 we further exemplify the flexibility of our framework to support various loss proxies, by explaining why model uncertainty is unsuitable for last-layer TTA methods  (due to the normalization applied to the classification head). In such cases, we propose using the distance to the closest class prototype as an alternative loss proxy.  Our findings in Section 5.4 highlight the importance of aligning the choice of loss proxy with the characteristics of the specific TTA approach.\n\n**Based on your suggestion we have also run the experiment with using entropy $g(\\textbf{x}, p) = - \\sum_{c=1}^C p(\\textbf{x})_c \\log p(\\textbf{x})_c$  instead of model uncertainty as a loss proxy.** The results—summarized in the tables below due to our inability to attach plots—show that entropy yields detection delays that are comparable to, or slightly worse than, those from model uncertainty, depending on the shift type. We will include these entropy results in our loss proxy ablation study in Appendix A.3 and would like to thank you for the suggestion.\n\n### Average Detection Delay ($\\downarrow$) on ImageNet-C Severity 0→5:\n|  | SOURCE | TENT | SAR | SHOT | CoTTA |\n| --- | --- | --- | --- | --- | --- |\n| Entropy | 371 | 361 | 456  | 302 | 311 |\n| Uncertainty | **297** | **269** | **424** | **237** | **241** |\n\n\n### Average Detection Delay ($\\downarrow$) on ImageNet-C Severity 5:\n\n|  | SOURCE | TENT | SAR | SHOT | CoTTA |\n| --- | --- | --- | --- | --- | --- |\n| Entropy | 9 | 13 | 15 | 13 | 7 |\n| Uncertainty | 10 | 14 | 17 | 13 | 7 |\n\n> *For most TTA methods (e.g. TENT), they simply optimize some unlabeled loss function during adaptation. To me, the uncertainty measure in Sec 3.3 can also be used as the loss function in TTA. In other words, the TTA algorithm can directly try to optimize this risk during testing. Intuitively, the TTA method will \"overfit\" to this risk measure. I am interested in whether the proposed method still works in this case.*\n\nThank you for raising this subtle point. **In short, yes—our risk monitoring remains valid and effective even when the same uncertainty measure is used both as the objective function in TTA adaptation and as a loss proxy in our monitoring tool, as demonstrated by the TENT results when entropy is used as a proxy** (see the tables in the previous answer)**.** This is because we do not use the raw loss proxy values directly in our alarm function. Doing so could indeed risk the type of “overfitting” you mention, where entropy minimization (as in TENT) reduces the proxy values on average, potentially causing the alarm to fail due to “overconfidence”.\n\nInstead, our alarm function relies on counting the number of test points whose loss proxy exceeds a carefully calibrated threshold (see Proposition 1). Therefore, if the loss proxy values decrease due to adaptation (e.g., entropy minimization), this effect is compensated by adjusting the threshold accordingly through our online calibration procedure (see Section 3.4), thus preserving the reliability of the alarm mechanism. Such adaptive thresholding is also the reason why our monitoring remains effective even when “overfitting” in TENT leads to the model collapse, as we show in Section 5.3.\n\n> *The experiment compares different methods by showing some curves. I think it is important to define some numerical metric based on those curves (e.g. in other fields, people use AUC based on precision/recall curve). Otherwise, it is impossible for any follow-up work to directly compare with this paper.*\n\nIn our experiments, we aimed to follow the experimental setup used in prior work on risk monitoring based on sequential testing [1, 3]. We also believe that presenting the results in their current visual format helps with better understanding of our method. That said, we agree that including quantitative metrics would be valuable for future benchmarking. As in the tables above, we will summarize the results using the average detection delay—defined as the difference between the time at which our unsupervised lower bound crosses the performance threshold $\\hat{t}\\_{\\text{min}}^b$ and the time at which the “true” test risk does so $\\hat{t}\\_{\\text{min}}^a$—in the camera-ready version. Additionally, we will report the average delta associated with Assumption 1  (as defined in line 284 of the manuscript), as this metric directly reflects both the validity and tightness of our estimated lower bounds on the test error. If you have any further suggestions in this regard, we would be happy to incorporate them.\n\nWe thank you again for your efforts in reviewing our work. If you feel like we have sufficiently addressed your concerns, we would appreciate you raising your score. \n\n[1] Amoukou et al. Sequential Harmful Shift Detection Without Labels. NeurIPS 2024\n\n[2] Liu et al. Energy-based out-of-distribution detection. NeurIPS 2020\n\n[3] Podkopaev et al. Tracking the risk of a deployed model and detecting harmful distribution shifts. ICLR 2022"}, {"review_id": "WQzwdmwI5Z", "reviewer": "Reviewer_LLXY", "summary": "This paper presents a novel unsupervised risk monitoring framework for test-time adaptation (TTA), addressing the critical challenge of detecting performance degradation in models undergoing continuous online adaptation. The authors systematically extend sequential testing frameworks to dynamic TTA scenarios, leveraging confidence sequences and loss proxies (e.g., model uncertainty) to enable rigorous risk tracking without labeled test data. The research is theoretically sound, experimentally comprehensive, and practically relevant, particularly for safety-critical application.", "questions": "I still hope that you can place more emphasis on the problem of how to select proxies based on real-world scenarios. Comparing the impacts of different proxy choices across a wider range of scenarios would likely contribute more than the current paper does.", "limitations": "Yes.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. I appreciate the theoretical rigor of this paper, which provides solid theoretical foundations for risk management in TTA. \n\n2. I also admire the writing style, which is remarkably clear and reader-friendly.\n\n3. I appreciate the sufficiently rigorous practice-based discussions in both the main text and the appendix.\n\nWeaknesses:\n\n1. I mainly worry that the practical value of this paper may be insufficient, as using proxy losses to judge model performance in unsupervised scenarios is already common knowledge, and I believe the contribution of proposing this approach might be very limited. In reality, the bigger challenge is that practitioners often do not know how to select appropriate proxies for specific scenarios, yet the paper provides minimal discussion on this critical aspect.\n\n2. My impression is that while the paper approaches the topic from a different perspective than previous work, there is little innovation in specific techniques. It still leverages model uncertainty (with a limited comparison to another metric) and sets thresholds for judgment—approaches that have become well-established in the field.", "was_revised": true, "final_justification": "Thank you for the authors’ response. I found some experimental improvements in this reply and in the responses to other reviewers, which align with my suggestion to explore richer proxy choices based on real-world scenarios. This has positively influenced my overall assessment of the paper.\n\nRegarding my concern that the technical contributions of the paper are limited, the authors acknowledge that the methods they actually use are ones that are already widely adopted in the field. Their response repeatedly emphasizes the contribution of bridging two research areas. However, I never denied this aspect, and my original score was given with this contribution already taken into account.\n\nTherefore, I will consider raising my score specifically in light of the broader set of proxy choices explored. However, this alone is not sufficient for me to raise my score from a 3 to a 4. After reviewing all the other reviewers’ comments, I feel even more confident that this is a borderline submission. I would have preferred to give a 3.5 if that were an option.\n\nTo encourage the authors to further explore richer and more novel technical contributions, I am increasing my score to a 4, while lowering my confidence accordingly.", "rebuttal": "We thank you for your feedback and reviewing efforts. We address your points below. \n\n> *In reality, the bigger challenge is that practitioners often do not know how to select appropriate proxies for specific scenarios, yet the paper provides minimal discussion on this critical aspect.*\n\n> *I still hope that you can place more emphasis on the problem of how to select proxies based on real-world scenarios. Comparing the impacts of different proxy choices across a wider range of scenarios would likely contribute more than the current paper does.*\n\nWe agree that the selection of appropriate loss proxy is crucial for the effectiveness of the monitoring tool. However, we are somewhat puzzled by the statement that “*the paper provides minimal discussion on this critical aspect.”* as we have dedicated a large part of our paper to this very topic. Specifically, in Section 3.3 we propose a concrete loss proxy based on model uncertainty (as well as a concrete online threshold calibration procedure in Section 3.4), and then later show in Sections 5.1 and 5.2 that our choices lead to effective monitoring in real TTA scenarios across five TTA methods and four types of distribution shifts. Moreover, in Section 5.4, we explain why the loss proxy should be chosen with the characteristics of the given TTA method in mind, by showing that model uncertainty is unsuitable for last-layer TTA methods due to the normalization of classification heads. To address this, we propose a different proxy based on distances to class prototypes, which proves effective for last-layer methods. Additionally, in Appendix A.3 we report results when using the energy score [1] as loss proxy, showing that it underperforms compared to our default choice of model uncertainty. During the rebuttal, we have also ran an additional ablation of using entropy as a loss proxy (see our response to d5NY) and will add it to our loss proxy ablation in Appendix A.3 in the camera-ready version.\n\nIf you still feel there is something we should discuss more when it comes to selecting the loss proxy for TTA monitoring, or if you have some concrete real-world scenarios in mind (besides the experiments reported in the paper), please let us know and we will be happy to provide further details or run additional experiments.\n\n> *I mainly worry that the practical value of this paper may be insufficient, as using proxy losses to judge model performance in unsupervised scenarios is already common knowledge, and I believe the contribution of proposing this approach might be very limited.*\n\n> *It still leverages model uncertainty (with a limited comparison to another metric) and sets thresholds for judgment—approaches that have become well-established in the field.*\n\nWe would like to clarify that our contribution goes beyond simply using raw loss proxies as a heuristic (e.g., model uncertainty) to “*judge model performance in an unsupervised scenario.*” **Rather, our main contribution is to extend the statistical framework of sequential risk monitoring [2] to the TTA setting**, which additionally requires figuring out the necessary assumptions to preserve theoretical guarantees (Section 3.2) and tackling the challenge of online calibration to ensure that loss proxy remains informative under data shifts and model adaptation (Section 3.4). This allows us to track test performance of TTA models without labels and without assumptions on the nature of the distribution shift. To the best of our knowledge, no existing work provides such an unsupervised monitoring tool tailored for TTA. If you have some concrete prior work in mind that we might have overlooked, we would appreciate if you could point it out to us.\n\nWe would also add that the importance/practical value of our work has been recognized by other reviewers. For example, reviewer d5NY noted that \"*this paper addresses a problem of practical importance in TTA*\" and “*shows good potential to address real-world deployment challenges*”, while reviewer PuqZ stated that \"*the paper fills a significant gap by risk monitoring for TTA without test labels.*\"  \n\nSince even you yourself wrote “*This paper presents a novel unsupervised risk monitoring framework for test-time adaptation (TTA), addressing the critical challenge of detecting performance degradation in models undergoing continuous online adaptation.”,* we are left wondering what exactly you mean when you later state *“that the practical value of this paper may be insufficient”*? If you could elaborate more on your concrete worries about the lack of practical value of our approach, we would be very happy to engage in further discussions.\n\n> *My impression is that while the paper approaches the topic from a different perspective than previous work, there is little innovation in specific techniques.*  \n\nAs mentioned earlier, to the best of our knowledge, our work is the first to extend risk monitoring tools [2] to the TTA setting. **We believe that bridging the gap between the test-time adaptation (TTA) and risk monitoring literatures is a valuable and timely contribution, as it enables the safer deployment of TTA methods in real-world applications.** To date, performance monitoring has largely been absent in TTA or has relied on heuristic measures. Our work addresses precisely this gap by introducing a more principled and rigorous monitoring approach.\n\nIf there are specific prior works you believe we have overlooked, we would greatly appreciate if you could share concrete references. As we discuss in the paper, the most relevant prior work in our opinion is [3]. However, we believe our contributions represent significant advances beyond the framework proposed in [3]. Notably [3] focuses on static models, whereas our work tackles the more complex and practically relevant setting of adapted models (TTA). We additionally introduce several theoretical extensions, the most important of which is arguably the support for monitoring the classification error as a risk measure which is the most standard performance measure in TTA applications (please refer to Appendix A.1 for a more detailed discussion on the differences of our work compared to [3]).\n\nIf you feel that we have addressed your concerns, we would appreciate it if you would consider updating your score.\n\n[1] Liu et al. Energy-based out-of-distribution detection. NeurIPS 2020\n\n[2] Podkopaev et al. Tracking the risk of a deployed model and detecting harmful distribution shifts. ICLR 2022\n\n[3] Amoukou et al. Sequential Harmful Shift Detection Without Labels. NeurIPS 2024"}]

Author rebuttal:

Meta-review: This paper proposes a sequential testing method for monitoring the risk of performance degradation in Test-Time Adaptation (TTA) models, assuming one has good proxies of the loss, but not necessarily assuming one has access to the ground truth labels themselves. Reviewers agreed that this paper addresses an important problem, appreciated the theory around the paper (though highlighted some concerns about its practicality), and applauded the comprehensive testing across a wide variety of datasets. The exploration and testing of different proxy measures are useful contributions to the AI monitoring field.

I recommend acceptance of the work but with three major requests for the authors. First, as pointed out by reviewers, Assumption 1 is very strong (must uniformly hold over time) and cannot be verified. The authors demonstrate that Assumption 1 approximately holds in semi-synthetic image datasets and two real-world image datasets, but it's difficult to know if this assumption would similarly hold in other datasets (e.g. tabular). I would suggest testing out the method and checking if Assumption 1 holds in other settings as well. Also, it would be important to provide some general guidance on when Assumption 1 can be expected to hold. Second, I suggest the authors discuss the relation of this work to other comparator methods (and include comparisons when appropriate). For instance, works such as monitoring AI algorithms under performativity also account for AI algorithms that learn over time (see e.g. Feng et al 2024 i AISTATS). Finally, comparators in the simulated section should also be included in the real-world datasets, because the real-world datasets used in these experiments also have true labels. This will help gauge how much slower the monitoring methods are due to the use of proxies.
Decision: Accept (poster)