Title: Convolutional Visual Prompt for Robust Visual Perception
Venue: NeurIPS 2023
Accepted: yes
Keywords: self-supervised learning

representation learning

visual prompts

domain generalization

input adaptation
Abstract: Vision models are often vulnerable to out-of-distribution (OOD) samples without adapting. While visual prompts offer a lightweight method of input-space adaptation for large-scale vision models, they rely on a high-dimensional additive vector and labeled data. This leads to overfitting when adapting models in a self-supervised test-time setting without labels. We introduce convolutional visual prompts (CVP) for label-free test-time adaptation for robust visual perception. The structured nature of CVP demands fewer trainable parameters, less than 1\% compared to standard visual prompts, combating overfitting. Extensive experiments and analysis on a wide variety of OOD visual perception tasks show that our approach is effective, improving robustness by up to 5.87\% over several large-scale models.

Convolutional Visual Prompt for Robust Visual Perception

Abstract

Vision models are often vulnerable to out-of-distribution (OOD) samples, which often need adaptation to fix them. While visual prompts offer a lightweight method of input-space adaptation for large-scale vision models, they rely on a high-dimensional additive vector and labeled data. This leads to overfitting when adapting models in a self-supervised test-time setting without labels. We introduce convolutional visual prompts ( CVP ) for label-free test-time adaptation for robust visual perception. The structured nature of CVP demands fewer trainable parameters, less than 1% compared to standard visual prompts, combating overfitting. Extensive experiments and analysis on a wide variety of OOD visual perception tasks show that our approach is effective, improving robustness by up to 5.87% over several large-scale models.

1 Introduction

Deep models surpass humans when tested on in-distribution data, yet their performance plummets when encountering unforeseen out-of-distribution (OOD) data at test time, such as unexpected corruptions and shiftings [20, 22, 21, 18, 44]. This vulnerability raises serious risks when these models are deployed, especially in safety-critical applications and high-stakes tasks [49]. Prior works have studied how to improve generalization to OOD data at training time [54, 38, 56, 12, 36, 35, 39, 31], yet little work has been done to adapt the model to OOD at test time, and most of them require to modify model weights [59, 71, 55, 33].

Visual prompting emerges as an efficient and lightweight method to adapt the model at test time without modifying the model [11, 60, 1] (previously also called adversarial reprogramming ). In contrast to finetuning the whole model weights, prompting can modify the original task of the model by providing context in the input space. It requires fewer OOD samples and simplifies model version management for practical applications. However, the OOD samples must be labeled, preventing these methods from combating unforeseen distribution shifts.

Recent work [40] defends against unseen attacks at test time by repairing the adversarial inputs with "reversal vectors" - high-dimensional prompt vectors directly added to inputs. It generates the prompts by minimizing a self-supervised loss, requiring no prior labeled OOD samples. Unlike adversarial attacks that damage arbitrary pixels by arbitrary amounts (within a given bound), however, structured changes known as visual distribution shifts are not effectively addressed by unstructured high dimensional vector prompts. Given that a self-supervised objective often has a shortcut and trivial solutions [13], we empirically find prompts without the right structures often improve performance minimally. (Sec. 5.2).

This paper presents Convolutional Visual Prompt (CVP) , which uses the convolutional structure as an inductive bias for adapting to visual OOD samples at test time. Prior work has demonstrated

CleanImage

Self-Supervised

ConvolutionalPrompt

STOF

D

WAY

the Law)

Zi

*

STO

STO

AVM

Contrastive

Embeddings

CorruptedImage

Corrupted Image

that convolutional operations are effective for handling structured data with local motifs [30, 64]. Inspired by this, CVPs are convolutional kernels with only a small number of tunable parameters less than 1% of the number of tunable parameters in typical unstructured visual prompts (see Figure 1 for illustration), making CVP extremely lightweight and efficient to adapt.

Our experiments show the importance of structured inductive bias for self-supervised adaptation: compared to high-dimensional free-form visual prompts, standard low-rank structured prompts improve robustness by 3.38%, and convolutional structure in prompts is significantly better than low-rank prompts by 2.94% on CIFAR-10-C. On ImageNet-Rendition, ImageNet-Sketch, and 15 types of unforeseen corruptions for both CIFAR-10 and ImageNet at five different severity levels, CVP improves robustness by 5.87% for popular large-scale visual models, including ResNet50, WideResNet18, and the state-of-the-art vision-language model CLIP [51]. Since our method modifies the input space, it complements established test-time model weight adaptation methods (e.g., TENT [62], BN [55], and MEMO [71]) and can be generalized to multiple self-supervised objectives, such as contrastive learning [4], rotation [14], and masked autoencoder (MAE) [15].

2 Related Work

Domain Generalization. OOD data can lead to a severe drop in performance for machine learning models [20, 18, 53, 44, 39, 42]. Domain generalization (DG) aims at adapting the model with OOD samples without knowing the target domain data during training time. Adapting the model on OOD data [74, 10, 32, 73, 71, 55, 39, 42, 62, 59] also improves robustness.

Test-time adaptation is a new paradigm for robustness against distribution shift [40, 59, 71], mostly updating the weights of deep models. BN [55, 33] updates the model using batch normalization statistics, TENT [59] adapts the model weight by minimizing the conditional entropy on every batch. TTT [59] attempts to train the model with an auxiliary self-supervision model for rotation prediction and utilize the SSL loss to adapt the model. MEMO [71] augments a single sample and adapts the model with the marginal entropy of the augmented samples. Test time transformation ensembling (TTE) [50] proposes to augment the image with a fixed set of transformations and ensembles the outputs through averaging. The only two works that do not update the models is [40, 45], which modifies the pixels of adversarial, not OOD, samples to minimize the self-supervised objective.

Visual Prompting. Prompting was proposed in the natural language processing field to provide context to adapt the model for specific tasks [2]. Leveraging this idea, visual prompts [68, 26] adapt the model with a small number of trainable parameters in input space for vision tasks [9, 43] and foundation models [51]. Others proposed to prompt the samples with adversarial perturbations to repurpose the model for target classification tasks, known as adversarial reprogramming [11, 27, 60, 66], sharing the same idea with Visual Prompting. Black-box adversarial reprogramming [60] reprograms a black-box model for downstream classification tasks with limited data. V2S [66] reprograms speech recognition model for time-series data classification tasks. Robust visual prompts [41] are tuned at training time to improve the adversarial robustness of the model under attack. However, this work has not yet been applied to domain generalization where distribution is naturally shifted.

Self-supervised learning (SSL). SSL can learn effective representations from images without annotations [7, 6, 3, 22]. Prior works have shown that representations learned from different pretext tasks

GaussianNoise

DefocusBlur

Snow

Contrast

Original.

120

Corrupted. Severity:1

80

100

80

Batch

100

Corrupted.Severity:3

Corrupted.Severity:5

60

80

60

80

60

Number

60

40

40

40

40

20

20

20

20

0

0

1

2

3

4

0

0

1

2

3

4

0

0

1

2

3

4

0

0

1

2

3

4

ContrastiveLoss

ContrastiveLoss

Contrastive Loss

ContrastiveLoss

(jigsaw puzzles [47], rotation prediction [14], image colorization [29] and deep clustering [25], etc.) can be leveraged for several downstream tasks such as image classification [4], object detection [8] and test-time domain adaptation [58]. Another well-known branch of SSL is contrastive learning, which aims at grouping associated features for a transformation of samples and distancing from other samples with dissimilar features in the dataset [5, 16, 48]. Some of the methods [22, 57, 70] use SSL for outlier detection, which aims to learn generalizable out-of-distribution features and rejects them during the testing time. In contrast to these methods which require information from the targeted domain distribution during the training phase for adaptation, our method can adapt the model without requiring any information on unforeseen domains during the testing phase.

3 Test-Time Convolutional Visual Prompting

3.1 Learning Intrinsic Structure with Self-Supervision Task

Standard ways to improve model robustness on OOD data is through making the training robust, where the training algorithm anticipates possible corruptions and distribution shifts at inference time and trains on them [18]. However, anticipating the test-time shifting is a strong assumption which is often unrealistic in the real world. Therefore, we improve robustness at test time by dynamically adapting to unforeseen corruptions and unknown shifts.

The ideal case of adapting the model at inference time is to know the ground truth label for the target task, yet this is impossible given that the test data is not labeled. To significantly improve performance on the downstream classification tasks for unlabeled data, we must choose the right self-supervision task that shares rich information with the target classification task.

There is a large body of work on good self-supervision tasks for representation learning at training time. For example, jigsaw puzzles [47], rotation prediction [14], image colorization [29] and deep clustering [25] can be applied to several downstream tasks such as image classification [4], object detection [8] and test-time domain adaptation [58].

For visual recognition, a popular self-supervised objective is contrastive learning, which learns a representation that maps the feature of the transformations of the same image into a nearby place. This is formally defined as:

where z are the contrastive features of x extracted from pre-trained backbone. y s i,j is a 0-1 vector for indicating the positive pairs and negative pairs. If y s i,j is 1, the i -th feature z i and j -th feature z j are both from the x sample. Otherwise, they are from different x . We denote cos( · , · ) the cosine similarity, τ as temperature scaling value. We optimize the model parameters for SSL model C by using the contrastive loss. The objective function for training is defined as min θ C E ( x ) ∼X s [ L s ( · ) ] , where X s is the source domain data for training. We train only on the clean samples drawn from the non-corrupted dataset. We compare this task to other self-supervision tasks in our ablation study.

Since we need to train the self-supervised task at training time, the self-supervised task will perform high on the test data that is the same distribution as the training one. Our results find that the

performance of the self-supervised task drops largely when the distribution is shifted at test time. See Figure 2. This suggests that the information that is useful for the self-supervised task is collaterally corrupted in addition to the classification performance drop.

Prior work demonstrated significant mutual information between self-supervised tasks and perception tasks, where pretraining with the self-supervised task improves the perception tasks' performance [7, 6, 3, 22]. We propose to adapt the model to minimize the self-supervised loss at inference time, where self-supervised task is a proxy that captures a large portion of information from the perception task. In recovering the information of the self-supervised tasks, we could recover the information of perception tasks that was corrupted due to distribution shifts.

3.2 Test-time Adaptation for Vision Models

Inference time adaptation allows the model to adapt to the unique characteristics of the new distribution online. However, the key challenge is that the SSL objective we use to adapt the model is a proxy, where there is often a trivial solution that reduces the loss but adapts the model in the wrong way. Several established methods exist to adapt the vision models, including foundation models.

Finetuning (FT) is a standard way to adapt the deep model. It often optimizes all the parameters of the deep models or partially, which is often heavy and requires large space to save the copy of the model to re-initialize and update. Prior work shows that this method is effective when it is finetuned on supervised tasks, yet adapting with the self-supervised task on a few examples remains under-explored. We discuss the finetuning method using the self-supervised task.

Partial Finetuning (PFT) is another way to adapt the model at inference time by only changing the statistics of the batch-normalization layer. This method assumes that the distribution drifts in the mean and standard deviation of the test data and can be recovered through test-time adaptation. The closest existing works are BN [55], Tent [62] and MEMO [71]. Tent updates the BN statistics but needs to continue training on the same distribution. MEMO only requires a single test data point, yet the algorithm is slow due to the whole model update and heavy augmentations. Here, we adapt batch normalization through our proposed contrastive learning-based self-supervised loss.

Visual Prompts (VP) have emerged as a lightweight way to adapt pre-trained models. There are two major ways to apply visual prompts to the vision model. Let the image be x , it adds a vector v to the input image: x = x + v . For low-rank visual prompts [24, 67], we use a low-rank matrix in v during optimization. Most visual prompts are studied in training setup, yet they are under-explored at inference time. [40, 45] optimize an additive visual prompt on the image to repair the adversarial perturbation and improve the model robustness.

3.3 Adapting via Convolutional Visual Prompts

Adding the right structure is an effective way to avoid trivial solution to the self-supervised objective. We now introduce the convolution visual prompts (CVP), which instruct the deep model to adapt to the test distribution through convolution. Convolution has been proved to be a successful inductive bias for visual tasks [28], which is more sample efficient [34]. Our assumption is that a large family of distribution shifts in the image data are visually structured, which can be modeled by convolution. Our prompt is simple and is defined as:

One major advantage of the convolution prompt is that the number of parameters in the prompt is significantly lower (1%) than other conventional prompts (e.g., patch prompt and padding prompt). Compared to adapting the whole model weights, our method is light weight and is fast by exploiting the structure of visual distribution shifts In Appendix 7.2, we show the detailed algorithm of CVP. Our lightweight adjustment allows the model to quickly update to the novel data points without too much computation and memory overhead. As vision models are continuously deployed in edge devices, this is extremely important, given the limited computational resources.

4 Experiment

This section demonstrates the detail of experiment settings and evaluates the performance of our method CVP, compared with conventional Visual Prompts (VP) and existing test-time approaches.

More analysis are shown in Section 5 and Appendix. We do a comprehensive study on the CVP, including different prompts design, kernel v.s. structure analysis, multiple SSL tasks, sensitivity analysis on the batch size and adapt iterations, GradCam visualization, and optimization cost of CVP.

4.1 Experiment Setting

Dataset. We evaluate our method on five kinds of OOD datasets, including CIFAR-10-C [21], ImageNet-C [46], ImageNet-R [19], ImageNet-Sketch [65], and ImageNet-A [23]. The following describes the details of all datasets.

· Synthetic OOD Data. The corruption data are synthesized with different types of transformations (e.g., snow, brightness, contrast) to simulate real-world corruption. The dataset contains CIFAR-10-C and ImageNet-C. Both of them are the corrupted versions of their original dataset, including 15 corruption types and 5 severity levels. A larger severity level means more corruption is added to the data. To well evaluate our method, We generate the corruption samples with five severities based on the official GitHub code * for each 15 corruption types.

· Natural OOD Data. The ImageNet-Rendition [18] contains 30000 images collected from Flickr with specific types of ImageNet's 200 object classes. ImageNet-Sketch [65] data set consists of 50000 sketch images. The ImageNet-Adversarial [23] is a natural adversarial shifting dataset contains 7500 images collected from the natural world.

Model. The backbone model architecture is pretrained on WideResNet18 [69] and ResNet26 [17] for CIFAR-10-C, ResNet50 [17] for ImageNet-C, Rendition, and Sketch. We extract the logit features before the fully connected layer of the backbone model for training the SSL model. The SSL model is a simple MLP with the final layer outputting the one-dimensional features for the contrastive learning task. We further extend our prompt method to the foundation model CLIP [51], where we only prompt the vision encoder.

Baseline Details We compare several test-time adaptation benchmarks with CVP.

· Standard : The baseline uses the pre-trained model without adaptation. For CIFAR-10-C, the standard is trained with 50000 clean CIFAR-10 train dataset on WideResNet18 and ResNet. For ImageNet1K-C, the standard is trained with ∼ 1.2M clean ImageNet train dataset on ResNet50.

· Finetune (FT) : We adjust the whole model weight for every upcoming batch during the inference time with the self-supervised loss. In our experiments, after one-batch fine-tuning, the model will be restored to the initial weight status and receive a new type of corrupted samples.

· Partial Finetune (PFT) : The partial fine-tune adapts batches of the samples to the model by only adjusting the batch normalization layers with self-supervised loss at every inference time. Same as Finetune baseline, the model will be restored to the initial weight status after the one-batch adaptation.

· SVP [40] : The prompting method to reverse the adversarial attacks by modifying adversarial samples with ℓ p -norm perturbations, where the perturbations are also optimized via contrastive loss. We extend this method with two different prompt settings: patch and padding. For the patch setup, we directly add a full-size patch of perturbation into the input. For the padding setup, we embed a frame of the perturbation outside the input. More baseline detailed are shown in the Appendix 7.3

Design of Convolutional Visual Prompts (CVP) We prompt the input samples by adding the convolutional kernels. Our kernels can be optimized under several different settings, including 1.) fixed or random kernel initialization 2.) 3*3 or 5*5 kernel sizes. We show a detailed evaluation of all kernel setups in the experimental results. For initialization, we can either random initialize the kernel size k in a uniform distribution or initialize with fixed values. For fixed initialization, we empirically found that starting from a sharpness kernel is effective. We optimize the kernel with 1 to 5 iterations of projected gradient descent. To preserve the original structure, we combine the residual of input and convolved output with learnable parameters λ . We jointly optimize the convolutional kernel k and λ with the self-supervised loss L s . The range of λ is predefined and empirically set up in a fixed

range. For CIFAR-10-C, we set up the range as [0.5, 3], and for ImageNet-C is set up as [0.5, 1]. We describe the detailed parameter settings and different prompt designs in the Appendix 7.4 7.7.

4.2 Experimental Results

Table 1 presents the evaluation results of CVP on CIFAR-10-C. We compare CVP with five different baselines, including standard, VP (patch/padding), fine-tune (FT), and partially fine-tune (PFT) with SSL loss, using two model architectures. We also explore different kernel settings of CVP, including fixed/random initialization and different kernel size. Results show that for WideResNet18, CVP achieves the highest reduction in average error rate by 5.87% when updating the 3*3 kernel with random initialization. For ResNet-26, CVP consistently reduces the error rate by 2.8%.

Table 2 displays the results for ImageNet-C, Rendition, Sketch, and Adversarial. The standard baseline is pre-trained on ResNet50 [17]. For ImageNet-C, we report the mean corruption error (mCE), calculated with the performance rates on ResNet50 and standard AlexNet following the benchmark [21]. Due to the larger dimension of the ImageNet dataset (224), a larger kernel size effectively captures more information from the input. Thus, we set the kernel size as 3*3 and 5*5. Our findings indicate that CVP achieves the highest error rate reduction for ImageNet-R and A by 0.77% and 1.6%, respectively, when updating with a 5*5 kernel using random initialization. CVP consistently outperforms all baselines for ImageNet-C and Sketch. We observe that VP (patch) and VP (padding) degrade performance on most datasets, suggesting that unstructured perturbations with more trainable parameters are ineffective in adapting to natural OOD data with general shifts.

In Table 3, we further evaluate the performance of CVP on the large-scale foundation model, CLIP [52]. Compared to the baselines VP (padding) and VP (patch), CVP achieves the best performance on all datasets when updating under random initialization with 5*5 kernel size.

CVP Complements Other Test-Time Adaptation Methods Since our method modifies the input space and aligns the representation of adapted samples to the original manifold, it also complements established test-time adaptation approaches which adjusts the model weights. Thus, we combine the CVP with several existing methods, including MEMO [71], BN [55], and TENT [62]. For a fair comparison, we set up the batch size as 16 for all experiments. for the parameter settings, we set the kernel size for CIFAR-10-C as 3x3 and ImageNet-C, R, S, and A as 5x5. The adaptation iterations

are all set as 5. In Table 4, we show the results on five benchmarks. For CIFAR-10-C, CVP improves 1.83 points on top of TENT and reduces the error rate by 21.55% compared with the standard one. For the other datasets, CVP achieves the lowest error rate on top of the TENT method. However, the BN method degrades the performance under the small batch setting. Due to the page limit, in Appendix 7.5, we show more evaluations on other benchmark, such as the Cutout-and-Paste data [61] and other baseline Test Time Training (TTT) [59].

5 Ablation Study

Low-Rank Structure to Avoid Shortcut in SSL Objective. Since SSL objective is a proxy for our visual recognition task, sole minimizing SSL objective can produce a overfitted prompt without much improvement in visual recognition. A typical way to avoid this suboptimal solution is by adding the right inductive bias. For the highly structured visual data, we study the best inductive bias we can add to prevent the shortcut during adaptation.

In addition to convolution, we also investigated the popular low-rank structure [24, 67]. We create visual prompts with low-rank structure (LVP) via singular value decomposition (SVD), and optimize the low-rank matrices using our algorithm (shown in Appendix 7.2). We compare the effectiveness of low-dimensional prompts and convolution on their ability to reverse natural corruptions. In Table 6 and Figure 3, for both LVP and CVP, increasing the prompt's rank leads to degraded performance in reverse the corruption to produce clean images, where the ℓ 2 norm distance between real shifting and the approximated shifting increase.

Table 5: Analysis on the shortcut of SSL. We compare the performance of SSL and supervised learning on VP and CVP for four benchmarks

2.90

3.69

3.40

3.30

2.80

3.69

6

Conv.

3.20

3.30

I

2.70

Low Rank

3.68

3.10

2.60

3.67

3.20

3.00

3.67

3

7

111519232731

3

7

1115192327 31

3

7

111519232731

3

7

111519232731

Rank Value

Rank Value

Rank Value

Rank Value

gaussian_noise

defocus_blur

snow

contrast

(a)

(b)

100

Finetune

60

CVP(ours)

3.5

CVP (ours)

80

VP (patch)

CVP (ours)

55

VP (bounded)

VP

LoSS

3.0

VP

VP (bounded)

60

50

Contrastive

2.5

40

45

2.0

20

40

1.5

0

2

4

8

16

32

35

0

5

10

20

30

0

5

10

20

30

BatchSize

NumberofIteration

NumberofIteration

CVP in Supervised Learning. CVP is necessary for our test-time adaptation because SSL is a proxy for our final task. There are solutions where SSL is minimized, but the final task performs suboptimal. We investigate the necessity of using CVP when optimized for objectives other than SSL, such as the supervised loss, where the training and evaluation objective matches. Hence, in Table 5, we show the VP and CVP under the supervised learning setting (Sup-VP and Sup-CVP) and SSL setting (SSL-VP and SSL-CVP). For all experiments, we use the same optimization setting and parameter settings as Table 4. We apply the prompts on every batch for the supervised setting and update them with ground truth. Due to training on the ground-truth label, both VP and CVP achieve higher accuracy than SSL, VP performs higher than CVP. The results demonstrate that convolution inductive bias is not necessary when ground truth is available. However, without the label, the structured convolutional prompt is necessary for improving performance.

Generalize CVP to other SSL tasks. We further show the CVP can be generalized to other selfsupervision tasks. In Table 7, we compare three SSL tasks, including contrastive learning, rotation prediction and masked autoencoder (MAE) [15]. We show our CVP is effective under all SSL tasks. On ImageNet-C, CVP improves robust accuracy for every severity level (from s1 to s5) when optimized for all three SSL tasks. We find contrastive learning can perform better than rotation prediction, and MAE has the best performance.

The Effect of Batch Size and Number of Iteration for Adaptation. In Figure 4a, we empirically demonstrate that the batch size affects the performance of different prompt methods. We set up the batch sizes from 2,4,8,16 to 32 and compared the accuracy of CVP with Finetune, VP (padding), and VP (patch). When batch size is set as 2, the performance of fine-tune is only 36.95%, which is worse than CVP (71.53%). When increasing the batch size to 4 and 8, the performance of fine-tune, VP slightly improves, yet still worse than CVP. Overall, CVP has an advantage in adaptation under the

Original

Shifted

Ours

Original

Shifted

Ours

Original

Shifted

Ours

Image

Saliency

small batch setting. In Figure 4b, we show the performance on different numbers of iterations for adaption. We empirically found that when increasing the iterations, CVP has a lower risk to overfit on the self-supervised objective. More ablation studies, such as different prompt designs can be found in Appendix 7.7

Visualization of Saliency Map To better understand how CVP adapts to the corrupted inputs, we visualize the saliency map of different types of corruption. As Figure 5 shows, from left to right, the first row is the original, corrupted, and adapted samples; the second row shows their corresponding Grad-CAM with respect to the predicted labels. The red region in Grad-CAM highlights where the model focuses on target input. We empirically discover the heap map defocuses on the target object for corrupted samples. After CVP, the red region of the adapted sample's heap map is re-targeted on a similar part as the original image, demonstrating that the self-supervised visual prompts indeed improve the input adaptation and make the model refocus back on the correct areas. We provide more visualization in Appendix 7.10.

Training Cost v.s. Different Kernel Size In Table 8, we evaluate different kernel sizes for CVP and empirically discover that increasing the kernel to a proper size can improve the performance slightly. We choose one corruption-type impulse noise and show the results. When increasing the kernel size, the optimization cost increases. For impulse noise, kernel size 7*7 achieves the best robust accuracy, yet the optimization cost is much higher.

Training Time v.s. Number of Adapt Iteration In Figure 4(b), we have shown the CVP trained under different adapt iterations v.s. their performance. When increasing the number of adapt iterations, the training time increases. The following Table 9 shows the result of CIFAR-10-C on gaussian noise type with severity 1. We compare the accuracy and per batch training time on several numbers of

adapt iters (from 0 to 20). We empirically found that CVP has a larger performance gain than VP while adapting with a few epochs (epoch number 1).

Does CVP Reverse Corrupted Images Back to Normal One? We do the quantitative measurement on the distribution distance via Sliced Wasserstein Distance (SWD) and structural similarity index measure (SSIM). We measure the distance between two input distributions: source domain distribution and target domain distribution (before/after CVP adaptation). To calculate the distance between two input distributions via the Sliced Wasserstein Distance, we first obtain a group of marginal distributions from a high dimensional probability distribution via the linear projection, then calculate the p -Wasserstein Distance for those marginal distributions. Table 10 and Figure 6 shows the result of SWDon CIFAR-10-C with severity 1. On average, CVP achieves lower SWD after adaptation, which means the target distribution is closer to the source one after adaptation. The average SWD reduce by 0.7% after prompting. In Appendix Table 18 and Figure 9, we show the more detailed analysis.

(a) Noise Group

(b) Blur Group

BeforeCVP

AfterCVP

BeforeCVP

AfterCVP

8.0

16.0

16.0

SWD (scale=102)

8.0

7.0

SWD (scale=102)

14.0

14.0

7.0

12.0

12.0

6.0

6.0

5.0

10.0

8.0

10.0

8.0

5.0

4.0

6.0

6.0

4.0

3.0

4.0

4.0

2.0

gaussian_noise

shot_noise

gaussian_noise

impulse_noise

shot_noise

glass_blur

defocus_blur

motion_blur

glass_blur

defocus_blur

6 Conclusion

Self-supervised convolutional visual prompt (CVP) is a novel method for test-time adaptation of OOD samples. In contrast to prior works training the visual prompts with the label, CVP is labelfree and lightweight. It reduces the trainable parameters to less than 1% parameters of previous visual prompts and avoids the risk of overfitting when adapting for self-supervised objectives at test time. Results on five state-of-the-art benchmarks show that CVP improves model robustness by 5.87% and complements existing weight-adaptation methods. Extensive ablation studies suggest that distribution shifts are actually structured; therefore, CVP can capture the structures better than VP during the adaptation, which provides new insight into the frontier of visual prompting techniques and test-time adaptation. Future work includes interpreting convolutional prompts and prompting with multi-modality in large-scale foundation models.

References

Hyojin Bahng, Ali Jahanian, Swami Sankaranarayanan, and Phillip Isola. Visual prompting: Modifying pixel space to adapt pre-trained models. arXiv preprint arXiv:2203.17274 , 2022.

Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems , 33:1877-1901, 2020.

Mathilde Caron, Ishan Misra, Julien Mairal, Priya Goyal, Piotr Bojanowski, and Armand Joulin. Unsupervised learning of visual features by contrasting cluster assignments. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems , volume 33, pages 9912-9924. Curran Associates, Inc., 2020.

Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning , pages 1597-1607. PMLR, 2020.

Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey Hinton. Big selfsupervised models are strong semi-supervised learners. arXiv preprint arXiv:2006.10029 , 2020.

Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He. Improved baselines with momentum contrastive learning. arXiv preprint arXiv:2003.04297 , 2020.

Virginia R de Sa. Learning classification with unlabeled data. Advances in neural information processing systems , pages 112-112, 1994.

Carl Doersch, Abhinav Gupta, and Alexei A Efros. Unsupervised visual representation learning by context prediction. In Proceedings of the IEEE international conference on computer vision , pages 1422-1430, 2015.

Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 , 2020.

Qi Dou, Daniel Coelho de Castro, Konstantinos Kamnitsas, and Ben Glocker. Domain generalization via model-agnostic learning of semantic features. Advances in Neural Information Processing Systems , 32, 2019.

Gamaleldin F Elsayed, Ian Goodfellow, and Jascha Sohl-Dickstein. Adversarial reprogramming of neural networks. arXiv preprint arXiv:1806.11146 , 2018.

Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In International conference on machine learning , pages 1180-1189. PMLR, 2015.

Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence , 2(11):665-673, 2020.

Spyros Gidaris, Praveer Singh, and Nikos Komodakis. Unsupervised representation learning by predicting image rotations. arXiv preprint arXiv:1803.07728 , 2018.

Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. arXiv:2111.06377 , 2021.

Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 9729-9738, 2020.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770-778, 2016.

Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, et al. The many faces of robustness: A critical analysis of out-of-distribution generalization. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 8340-8349, 2021.

Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. The many faces of robustness: A critical analysis of out-of-distribution generalization. 2021 IEEE/CVF International Conference on Computer Vision (ICCV) , Oct 2021.

Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint arXiv:1903.12261 , 2019.

Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. Proceedings of the International Conference on Learning Representations , 2019.

Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. Advances in Neural Information Processing Systems , 32, 2019.

Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. CVPR , 2021.

Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685 , 2021.

Xu Ji, Joao F Henriques, and Andrea Vedaldi. Invariant information clustering for unsupervised image classification and segmentation. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 9865-9874, 2019.

Menglin Jia, Luming Tang, Bor-Chun Chen, Claire Cardie, Serge Belongie, Bharath Hariharan, and Ser-Nam Lim. Visual prompt tuning. arXiv preprint arXiv:2203.12119 , 2022.

Eliska Kloberdanz, Jin Tian, and Wei Le. An improved (adversarial) reprogramming technique for neural networks. In Igor Farka v s, Paolo Masulli, Sebastian Otte, and Stefan Wermter, editors, Artificial Neural Networks and Machine Learning - ICANN 2021 , pages 3-15, Cham, 2021. Springer International Publishing.

Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Communications of the ACM , 60(6):84-90, 2017.

Gustav Larsson, Michael Maire, and Gregory Shakhnarovich. Learning representations for automatic colorization. In European conference on computer vision , pages 577-593. Springer, 2016.

Yann LeCun, Koray Kavukcuoglu, and Clément Farabet. Convolutional networks and applications in vision. In Proceedings of 2010 IEEE international symposium on circuits and systems , pages 253-256. IEEE, 2010.

Bo Li, Yezhen Wang, Shanghang Zhang, Dongsheng Li, Kurt Keutzer, Trevor Darrell, and Han Zhao. Learning invariant representations and risks for semi-supervised domain adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1104-1113, 2021.

Da Li, Yongxin Yang, Yi-Zhe Song, and Timothy M Hospedales. Learning to generalize: Meta-learning for domain generalization. In Thirty-Second AAAI Conference on Artificial Intelligence , 2018.

Yanghao Li, Naiyan Wang, Jianping Shi, Jiaying Liu, and Xiaodi Hou. Revisiting batch normalization for practical domain adaptation, 2016.

Zhiyuan Li, Yi Zhang, and Sanjeev Arora. Why are convolutional nets more sample-efficient than fully-connected nets? arXiv preprint arXiv:2010.08515 , 2020.

Ziwei Liu, Zhongqi Miao, Xingang Pan, Xiaohang Zhan, Dahua Lin, Stella X Yu, and Boqing Gong. Open compound domain adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 12406-12415, 2020.

Mingsheng Long, Yue Cao, Jianmin Wang, and Michael Jordan. Learning transferable features with deep adaptation networks. In International conference on machine learning , pages 97-105. PMLR, 2015.

Ilya Loshchilov and Frank Hutter. SGDR: Stochastic gradient descent with warm restarts. In International Conference on Learning Representations , 2017.

Zhihe Lu, Yongxin Yang, Xiatian Zhu, Cong Liu, Yi-Zhe Song, and Tao Xiang. Stochastic classifiers for unsupervised domain adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 9111-9120, 2020.

Chengzhi Mao, Augustine Cha, Amogh Gupta, Hao Wang, Junfeng Yang, and Carl Vondrick. Generative interventions for causal learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 3947-3956, 2021.

Chengzhi Mao, Mia Chiquier, Hao Wang, Junfeng Yang, and Carl Vondrick. Adversarial attacks are reversible with natural supervision. arXiv preprint arXiv:2103.14222 , 2021.

Chengzhi Mao, Scott Geng, Junfeng Yang, Xin Wang, and Carl Vondrick. Understanding zero-shot adversarial robustness for large-scale models. arXiv preprint arXiv:2212.07016 , 2022.

Chengzhi Mao, Lu Jiang, Mostafa Dehghani, Carl Vondrick, Rahul Sukthankar, and Irfan Essa. Discrete representations strengthen vision transformer robustness. arXiv preprint arXiv:2111.10493 , 2021.

Chengzhi Mao, Revant Teotia, Amrutha Sundar, Sachit Menon, Junfeng Yang, Xin Wang, and Carl Vondrick. Doubly right object recognition: A why prompt for visual rationales. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 2722-2732, June 2023.

Chengzhi Mao, Kevin Xia, James Wang, Hao Wang, Junfeng Yang, Elias Bareinboim, and Carl Vondrick. Causal transportability for visual recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 7521-7531, 2022.

Chengzhi Mao, Lingyu Zhang, Abhishek Joshi, Junfeng Yang, Hao Wang, and Carl Vondrick. Robust perception through equivariance. arXiv preprint arXiv:2212.06079 , 2022.

Claudio Michaelis, Benjamin Mitzkus, Robert Geirhos, Evgenia Rusak, Oliver Bringmann, Alexander S. Ecker, Matthias Bethge, and Wieland Brendel. Benchmarking robustness in object detection: Autonomous driving when winter is coming. arXiv preprint arXiv:1907.07484 , 2019.

Mehdi Noroozi and Paolo Favaro. Unsupervised learning of visual representations by solving jigsaw puzzles. In European conference on computer vision , pages 69-84. Springer, 2016.

Taesung Park, Alexei A Efros, Richard Zhang, and Jun-Yan Zhu. Contrastive learning for unpaired image-to-image translation. In European Conference on Computer Vision , pages 319-345. Springer, 2020.

Kexin Pei, Yinzhi Cao, Junfeng Yang, and Suman Jana. Deepxplore: Automated whitebox testing of deep learning systems. In proceedings of the 26th Symposium on Operating Systems Principles , pages 1-18, 2017.

Juan C Pérez, Motasem Alfarra, Guillaume Jeanneret, Laura Rueda, Ali Thabet, Bernard Ghanem, and Pablo Arbeláez. Enhancing adversarial robustness via test-time transformation ensembling. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 81-91, 2021.

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning , pages 8748-8763. PMLR, 2021.

Alec Radford, Karthik Narasimhan, Tim Salimans, Ilya Sutskever, et al. Improving language understanding by generative pre-training. 2018.

Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? In International Conference on Machine Learning , pages 5389-5400. PMLR, 2019.

Kate Saenko, Brian Kulis, Mario Fritz, and Trevor Darrell. Adapting visual category models to new domains. In European conference on computer vision , pages 213-226. Springer, 2010.

Shiori Sagawa, Pang Wei Koh, Tatsunori B. Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generalization, 2019.

Kuniaki Saito, Kohei Watanabe, Yoshitaka Ushiku, and Tatsuya Harada. Maximum classifier discrepancy for unsupervised domain adaptation. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 3723-3732, 2018.

Vikash Sehwag, Mung Chiang, and Prateek Mittal. Ssd: A unified framework for self-supervised outlier detection. arXiv preprint arXiv:2103.12051 , 2021.

Yu Sun, Xiaolong Wang, Zhuang Liu, John Miller, Alexei Efros, and Moritz Hardt. Test-time training with self-supervision for generalization under distribution shifts. In Hal Daumé III and Aarti Singh, editors, Proceedings of the 37th International Conference on Machine Learning , volume 119 of Proceedings of Machine Learning Research , pages 9229-9248. PMLR, 13-18 Jul 2020.

Yu Sun, Xiaolong Wang, Zhuang Liu, John Miller, Alexei A. Efros, and Moritz Hardt. Test-time training with self-supervision for generalization under distribution shifts, 2019.

Yun-Yun Tsai, Pin-Yu Chen, and Tsung-Yi Ho. Transfer learning without knowing: Reprogramming black-box machine learning models with scarce data and limited resources. In International Conference on Machine Learning , pages 9614-9624. PMLR, 2020.

Catherine Wah, Steve Branson, Peter Welinder, Pietro Perona, and Serge Belongie. The caltech-ucsd birds-200-2011 dataset. 2011.

Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno Olshausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization, 2020.

Dequan Wang, Evan Shelhamer, Shaoteng Liu, Bruno Olshausen, and Trevor Darrell. Tent: Fully test-time adaptation by entropy minimization. In International Conference on Learning Representations , 2021.

Haohan Wang, Songwei Ge, Zachary Lipton, and Eric P Xing. Learning robust global representations by penalizing local predictive power. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems , volume 32. Curran Associates, Inc., 2019.

Haohan Wang, Songwei Ge, Zachary Lipton, and Eric P Xing. Learning robust global representations by penalizing local predictive power. In Advances in Neural Information Processing Systems , pages 10506-10518, 2019.

Chao-Han Huck Yang, Yun-Yun Tsai, and Pin-Yu Chen. Voice2series: Reprogramming acoustic models for time series classification, 2021.

Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. Me-net: Towards effective adversarial robustness with matrix estimation. arXiv preprint arXiv:1905.11971 , 2019.

Yuan Yao, Ao Zhang, Zhengyan Zhang, Zhiyuan Liu, Tat-Seng Chua, and Maosong Sun. Cpt: Colorful prompt tuning for pre-trained vision-language models. arXiv preprint arXiv:2109.11797 , 2021.

Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07146 , 2016.

Zhiyuan Zeng, Keqing He, Yuanmeng Yan, Hong Xu, and Weiran Xu. Adversarial self-supervised learning for out-of-domain detection. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies , pages 5631-5639, 2021.

M. Zhang, S. Levine, and C. Finn. MEMO: Test time robustness via adaptation and augmentation. 2021.

Bolei Zhou, Àgata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence , PP:1-1, 07 2017.

Kaiyang Zhou, Yongxin Yang, Timothy Hospedales, and Tao Xiang. Deep domain-adversarial image generation for domain generalisation. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 34, pages 13025-13032, 2020.

Kaiyang Zhou, Yongxin Yang, Yu Qiao, and Tao Xiang. Domain generalization with mixstyle. arXiv preprint arXiv:2104.02008 , 2021.

7 Appendix

7.1 Flow of CVP

We illustrate the whole flow of CVP in Figure 7. There are two phases in our proposed method: (1.) Offline one-time training on SSL model: The SSL is a simple MLP model, where it takes the logit features from pre-trained backbone as input and trains the model with contrastive learning task. (2.) CVP adaptation for any OOD benchmark during test time: We leverage the SSL loss from well-trained SSL model to optimize the convolutional kernel prompts for every upcoming OOD sample.

TestingPhase

BeforePrompting

Corrupted

Image

TrainingPhase

Feature

Predicted Class:

Extractor

Classifier

Freeze

CleanImage

Trainable

Ground Truth:

SSL

Contrastive

Model

Loss

Extractor

Feature

Classifier

Classification

Score

Prompting with CVP

SSL

Model

Corrupted

Image

CVP

Predicted Class:

Contrastive learning

田

Extractor

Feature

Classifier

Ground Truth:

SSL

Contrastive

LoSS

Model

Optimized theparametersof CVP

7.2 Algorithm

7.3 Baseline Details

Here, we show the detail of the baselines that we compare with.

Standard : The baseline uses pre-trained model without adaptation. For CIFAR-10-C, the standard is trained with 50000 clean CIFAR-10 train dataset on WideResNet18 and ResNet. For ImageNet1KC, the standard is trained with ∼ 1.2M clean ImageNet train dataset on ResNet50.

SVP : The self-supervised visual prompts attempt to reverse the adversarial attacks by modifying the input pixels with ℓ p -norm perturbations, where the perturbations are optimized via contrastive loss [40]. For the patch setting, we setup the shape of VP as 32*32*3 for CIFAR-C and 224*224*3 for all ImageNet OOD datasets. For the padding setting, we set the padding size as 1 for CIFAR-10-C and 15 for ImageNet OOD dataset. Take CIFAR data as example, we first initialize a mask with all zeros value with the shape 30*30*3 and set the pad value as 1 with padding size 1 so that the mask after padding is as the same shape of CIFAR data (32*32*3). Then, we multiply the mask with the VP to preserve only the VP located at the position we just pad with 1 value. We can further optimize the VP with mask by adding it with the corrupted samples.

BN[55] : The model adaptation method aims to adjust the BN statistics for every input batch during the test-time. It requires to adapt with single corruption type in every batch.

TTT [59] : The test-time training trains the model with an auxiliary SSL rotation task and leverages the rotation loss for model adaptation during the testing time. In TTT method, instead of adapting the whole model, they only adapt the last few layers of the model and freeze the parameters in the front layers.

MEMO : The model adaptation method proposed in [71] alters a single data point with different augmentations (ie., rotation, cropping, and color jitter,...etc), and the model parameters are adapted by minimizing the entropy of the model's marginal output distribution across those augmented samples.

Algorithm 1: Convolutional Visual Prompt Input: Pretrained classifier F ( · ) , OOD images x , Self-supervised objective function L s ( · ) , Convolutional operator Conv ( · ) , Convolutional kernel k , Learning rate η , Number of iteration T Output: Class prediction ˆ y for adapted sample of x 1 Inference 2 # Initialize the kernel parameters 3 k 0 ∼ U{ ( α, β ) 4 # Calculate initial SSL loss 5 loss 0 = L s ( x ) 6 for t ∈ { 1 , ..., T } do 7 # Generate adapted samples 8 x t = x + λ ∗ Conv ( x, k t ) 9 # Calculate SSL loss with adapted samples loss t = L s ( x t ) # Update kernel parameters k t +1 = k t + η ∂loss t ∂k t # Get optimal kernel parameters k ⋆ ← k T if loss T > loss 0 then # Use the initial kernel parameters k ⋆ ← k 0 ; # Get final adapted samples x ⋆ = x + λ ∗ Conv ( x, k ⋆ ) return ˆ y ←F ( x ⋆ )

Algorithm 2: Low-Rank Visual Prompt

TENT [63] : The method adapts the model by minimizing the conditional entropy on batches. In our experiment, we evaluate TENT in episodic mode, which means the model parameter is reset to the initial state after every batch adaptation.

7.4 Implementation details

For the training part of SSL model, we set the training parameters with batch size as 64, training epoch as 200, and the learning rate ( lr ) as 0.001. The lr is decayed with a cosine annealing for each batch [37]. The transformations for contrastive learning are predefined. We augment the inputs with random resize crop, random flip, and random rotation in degree [-90, 90] for positive/negative pairs generation in every batch. The number of transformations for one sample is set as 3.

For the test-time adaptation part, we set the range of parameter δ for VP. For the ℓ 2 -norm perturbations, the ϵ is [-8/255,8/255] and the step size is 2/255. We set the iteration number i either as 1 or 5, which means each component has 1 or 5 steps during PGD. For the update iterations, as the Table 17. show a larger number of iterations has better performance. However, the training cost becomes higher.

· The choice of hyper-parameter setting on λ ranges and kernel

For the λ parameter, it controls the magnitude of convolved output when combined with the residual input. We set the range to be [0.5, 3] and run test-time optimization to automatically find the optimal solution, which does not require a validation set.

Weuse 3x3 for cifar-10 and 5x5 for ImageNet. In general, small kernel size is used to avoid overfitting. We increase the kernel size for large images, such as ImageNet.

When adapting, the kernel should be initialized with fix/random initialization. We use a sharpness kernel as an initial point for the fixed initialization setting, which is a n*n matrix. It starts from specific values, which can control the edge enhancement effect by extracting the frequency information of inputs with a high pass filter. When the kernel size is 3, we set up the sharpness kernel as [[0,-1, 0], [-1, 5, -1], [0, -1, 0]] Similar to the convolutional kernel prompt, sharpness transforms an image using a convolutional 2D filter. It simultaneously enlarges the high-frequency part of images and then filters the low frequencies part.

Number of Trainable Parameters : We compare the trainable parameters v.s. accuracy for different prompting methods. As Figure 8 shows, CVP contains less than 0.2% number of trainable parameters, compared to VP(patch).

50.0

CVP (ours)

47.5

VP (padding)

VP (patch)

45.0

PartialFinetune

42.5

Finetune

2

40.0

pi

C

u

37.5

C

A

35.0

32.5

30.0

0.009

0.373.07 17.9

36500

7.5 More Evaluation

We show more detailed results for CIFAR-10-C in Table 12 and 13.

More evaluation on ViT-Base model architecture. As Table 14 shows, we evaluate on 15 types of corruption under severity level 1 for CIFAR-10-C. The test accuracy of ViT-Base clean CIFAR-10 is 96.42%. Compared to the accuracy (%) before adaptation (standard) and using VP to do the adaptation, the CVP achieves better performance by up to 2 points.

We show the detailed results for each corruption on ImageNet-C dataset in Table 15.

In Table 16, we further compare with TTT [59], which is a test-time method with CVP. We combine our CVP on top of TTT, where the model weight will first adapt based on the rotation loss, and then the input will adapt by convolutional visual prompt.

· Generalize to Cutout-and-Paste samples To justify that our method can be generalized to non-structured OOD, we do more experiments on other types of OOD samples, such as the Cutoutand-Paste samples. Here, we launch the experiment on the Waterbirds dataset, which is constructed by cropping out birds from images with "water" backgrounds in the Caltech-UCSD Birds-200-2011 (CUB) dataset [61] and transferring them onto backgrounds from the Places dataset [72]. We follow the GitHub repo * and choose the "Forest" as our new background to generate the samples. The training of SSL is based on the pre-trained ResNet34 backbone model for the original CUB dataset. The original CUB (200 classes) accuracy for the backbone ResNet34 is 75.34%. We compare our CVP with self-supervised VP and demonstrate that CVP is more effective on the Cutouted-CUB dataset. The following table shows our results. Our CVP improves the result upon Standard by 1.61 points and VP by 1.3 points.

7.6 Distance measurement with SWD and SSIM

As the main paper mentioned, we measure the SWD and SSID on two input distributions: source domain distribution and target domain distribution (before/after adaptation). In Table 18 and Figure 9, we show the detailed result of SWD on every corruption type in CIFAR-10-C under severity 1. On average, CVP achieves lower SWD after adaptation, which means the target distribution is closer to the source one after adaptation. The average SWD reduced by 0.7% after prompting.

snow

(a) Noise Group

(b) Blur Group

(c) Weather Group

(d) Digital Group

BeforeCVP

AfterCVP

BeforeCVP

AfterCVP

8.0

16.0

16.0

7.0

SWD (scale=102)

14.0

14.0

12.0

6.0

10.0

5.0

8.0

4.0-

6.0

4.0 L

3.0

4.0-

4.0-

2.0

aslouuessne6

aslou'asindu!!

aslou'uessn

aslourasinum

motion_blur

niqssl6s

defocus_blur

BeforeCVP

AfterCVP

BeforeCVP

AfterCVP

17.5

17.5

15.0

20.0

17.5

15.0

20.0

12.5

12.5

100-

10.0

10.0

7.5

5.0

7.5

5.0

2.5

2.5

2.5

snow

frost

fog

fog

contrast

pixelate

contrast

brightness

brightness

jpeg_compression

jpeg_compression

· Distribution changes after applying the proposed CVP

In the main paper, Figure 2, we show the distribution changes in different corruption types and severity. Here, in Table 19, we show the distribution shifts after applying our CVP by calculating the average loss. In general, the distribution moves back to the original distribution. We show the SSL average loss (before adapt/after CVP adapt) for four corruption types on severity 1,3,5 for CIFAR10-C. The average SSL loss for the original CIFAR10 is 1.26. For every corruption we show here, the average SSL loss after adaptation is lower than the loss before adaptation.

7.7 The Effect of Different Prompt Designs

We do analysis on different prompting methods, including original visual prompts with different norm-bound ( ℓ 2 , ℓ ∞ ), convolutional prompts, and their combinations ( ℓ 2 + conv. , ℓ ∞ + conv. ). We show the error rate on different numbers of adapt iters for every prompting method from 0, 1, 5, to 10. To compare the results, we set up other parameters such as the epsilon ϵ as 8 / 255 for ℓ ∞ , 1 for ℓ 2 . As Figure 10 shows the error rate for different prompting methods, the convolutional prompt conv. and its combination with ℓ 2 reduce the error rate, and the former one reduces more from 40.32% to 36.08% when increasing the adapt iters. However, other prompting methods increase the error rate after prompting. To understand the risk of over-fitting for different prompting methods, Figure 4b shows the SSL loss curve v.s. performance on different prompting methods.

50

Patch (12)

48

Patch (linf)

Patch (I2)+ Conv.

46

Patch (linf)+ Conv.

44

Conv.

Error

42

E

40

38

36

0

1

5

10

Adapt Iters

7.8 Analysis on CVP and low-rank prompts

In Table 20, we show the detailed results of low-rank prompt (LVP) on different severity (from 1 to 5) for CIFAR-10-C. We set up the same rank as 3 for LVP and CVP. Our results show that the CVP is more effective than LVP when reversing natural corruption. In Figure 11, we further plot the averaged contrastive loss on different rank sizes for both LVP and CVP. On every corruption type, while increasing the rank size from 3 to 31, the loss curves of LVP consistently drop, which demonstrates the LVP is much more easier to overfit the contrastive loss.

(a)

(b)

2.90

3.69

3.40

3.30

2.80

3.69

6

Conv.

3.20

3.30

2.70

Low Rank

3.68

3.10

2.60

3.67

3.20

3

7111519232731

3.00

3

7111519232731

3.67

3

1115192327 31

3

7111519232731

Rank Value

RankValue

Rank Value

Rank Value

gaussian_noise

defocus_blur

snow

contrast

0.75

1.00

0.80

0.50

0.50

ContrastiveL

0.80

Conv.

0.60

0.25

0.25

0.60

Low Rank

0.40

0.00

0.00

0.40

0.20

-0.25

0.25

3

711 15192327 31

3

7

1115192327 31

3

7111519232731

3

7111519232731

gaussian_noise

defocus_blur

snow

contrast

7.9 t-SNE analysis on different adaptation methods.

In addition to performing analysis on single sample, we further conduct the t-SNE visualization for whole sample distribution on different baseline. For each type of corruption data, we extract the 1-dimensional logit features in the last layer of model and calculate the distance between them with respect to the predicted class labels. We compare our method with standard, MEMO, and MEMO+Ours. As Figure 12 shows, the original feature embedding shows low separability between different classes. On the other hand, our approach clearly discriminates the embedding feature, which demonstrates its robustness against distribution shifts.

original

ours

memo-only

10

0.0

1.0

2.0

3.0

4.0

Q

5.0

6.0

7.0

8.0

9.0

-10

-10

-5

0

5

10

-10

-5

0

5

10

-10

5

0

5

10

-10

-5

0

5

10

original

ours

memo-only

memo+ours

10

0.0

1.0

5

2.0

3.0

0

5.0

4.0

6.0

-5

8.0

7.0

9.0

10

10

5

0

5

10-10

-5

0

5

10

10

-5

0

5

10

10

-5

0

5

10

(b) Impulse Noise

7.10 Saliency map analysis on different corruption types

To better understand how self-supervised visual prompts adapt to the corrupted inputs, we visualize the saliency map of different types of corruption. As Figure 13 shows, from left to right, the first row is the original, corrupted, and adapted samples; the second row shows their corresponding Grad-CAM with respect to the predicted labels. The red region in Grad-CAM shows where the model focuses on for target input. We empirically discover the heap map defocus on the target object for corrupted samples. However, after prompting, the red region of the adapted sample's heap map is re-target on the similar region as original image, which demonstrates that the self-supervised visual prompts indeed improve the input adaptation and make the model refocus back on the correct regions.

(a) Contrast

(c) Fog

(d) Impulse noise

(e) Brightness

(f) Pixelate

Original

Corrupted

Adapted

Original

Corrupted

Adapted

Input

andui

Grad-CAM

Grad-CAM

Original

Corrupted

Adapted

Original

Corrupted

Adapted

andui

Input

Grad-CAM

Grad-CAM

Original

Corrupted

Adapted

Original

Corrupted

Adapted

Input

Input

Grad-CAM

Grad-CAM

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper addresses test time adaptation by employing learnable convolution operation named CVP on out-of-distribution (OOD) images. The motivation is to take advantage of the inductive bias imparted by convolution operations with the added advantage of learning fewer parameters compared to existing approaches. CVP in conjunction with other sota approaches improve the performance on benchmark datasets.\n\nSTRENGTHS:\n1. Using small convolution operations at the start for OOD test time adaptation to take advantage of inherent inductive bias seems to be new.\n2. The combination of selfsupervision and convolution makes it both parameter as well as label efficient.\n3. Main and ablation experiments are largescale\n\nWEAKNESSES:\n1. Eqn. (1): When $y_{i,j}^s$ is 0, $i$ and $j$ are from different samples (negative pair). So, in the loss calculation negative pairs are not considered. Then how is it a contrastive formulation?\n2. Line 111: It is said that $\\mathcal{X}_s$ is the source domain data for training. If source domain data is used then it is not a test time adaptation framework and comparing it with such works would not be fair.\n3. Line 150: One of the important assumptions made in this paper tells the distribution shift in images is often visually structured. Why is this assumption right? What tells that the distribution shift is 'visually structured'?\n4. Line 180+: When describing the proposed model, it is told that the logits before the fully connected layer of the backbone model are extracted for training the SSL model. This is making me confused. Does it mean the conv operation is applied on the logits and not on the image? I think having a figure describing the proposed approach would have been useful here. I don’t see such a figure and thus I have to presume things. Also, it is said that a MLP gets trained in addition. Is it used during inference? Also, is this taken into account in the learnable parameter count, especially when compared with other related approaches like TENT or other traditional prompting methods? In this regard, the figure 6 in the supplementary is incomplete. What is the unit in x-axis? Millions, billions, K?\n5. Line 184: When extending the proposed approach to CLIP, why only vision encoder is used for prompting? Why not text encoder only? Is there any ablation that is done?\n6. Section 4.1: FT and PFT Baseline: Why is this restoring to initial weights required? Is it standard in literature? Any reference?\n7. Line 206: What is a sharpness kernel?\n8. Section 4.2, CVP Complements Other Test-Time Adaptation Methods: More details are required on what is meant by 'combining' CVP with these methods. Also, the results of this experiment (Table 4) are not convincing. Improvement is very marginal compared to TENT, in all three imagenet variants. Compared to standalone CVP, CVP+x provides huge error rate drop - then this means the major workforce behind the performance is x and not CVP.\n9. Ablation study – Low rank structure: More details are needed on how the low rank prompts are created? Are they directly applied on the input? According to the original LoRA paper [24], low rank adaptation is shown to be effective in transformer architectures. How is it adapted to convolutional architectures? As two low rank matrices are involved (I'm supposing so, as details are missing), this evidently involves more learnable parameters and thus susceptible to overfitting. So, the comparison to conv kernels is not fair. The corresponding figure in Appendix (Fig. 9), does not have any descriptive captions. It’s better not to give such figures if everything about the figure has to be inferred by the reader.\n10. Line 266-271 and Table 7: What is 'standard' SSL task? Is it employing eqn. (1)? Its difference with 'contrastive' variation needs to be detailed. While rotation or MAE were shown to perform worse compared to the standard SSL task (in Table 7), there is no detail of these two other SSL approaches. How many variations of rotation prediction were used? How much percentage of the images were masked in MAE? Is there any study by varying the mask percentage? How long are these other SSL tasks trained? Generally Contrastive and MAE tasks require a long training for better learning. Was this good practice followed?\n\nQUESTIONS:\nQuestions are all detailed with the associated weaknesses raised above (in ‘weaknesses’ section). Here, in addition, some minor typos are mentioned.\n- Line 156: Between ‘shifts’ and ‘In’, a stop is missing.\n- Line 174: ‘… method, We …’ -> ‘method, we’\n- Line 175: Appendix number is missing\n- Line 178: ‘contains’ -> ‘containing’\n- Line 200: ‘More baseline detailed are shown’ -> ‘More details about the baselines are provided’\n- Line 204-205: ‘random initialize the kernel size k’ -> ‘randomly initialize the kernel of size k’\n\nLIMITATIONS:\nLimitations are not explicitly described. It may be useful to discuss the scope of the claims regarding the convolution operation in CVP handling structural bias in OOD.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-06-22"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel label-free approach CVP for test-time adaptation on out-of-distribution data. The main idea is to use a convolutional kernal as the visual prompt. It captures the structure of data distribution shift, and reduces the trainable parameters. Experiments show that CVP improves model robustness and complements existing weight-adaptation methods.\n\nSTRENGTHS:\n1. Prompt tuning has become an important technique to adapt large visual models. This paper provides a simple solution and may be useful in various applications.\n\n2. The paper is well motivated. Using convolutional structure to inject the inductive bias is simple yet effective. It reduces the required parameters, and shows significant better performances than low-rank prompts.\n\n3. The method does not require labeled data.\n\n4. The method can be combined with other weight adaptation methods. It can also be generalized to multiple self-supervised objectives. The authors provide corresponding experiments with encouraging results. \n\n5. The paper is well structured and nicely written. Empirical results are quite extensive. The attention visualization provides a clear insight.\n\nWEAKNESSES:\n1. The corruption types considered in this paper seem to be restricted to low-level transformations. This explains why the convolutional kernel is suitable. I wonder if CVP would still work well for high-level distribution shift, such as style changes? \n\n\nTypo:\nReference missing in Ln 175.\n\nQUESTIONS:\n1. In Ln 206, \"starting from a sharpness kernel is effective\". Could the authors elaborate on what 'sharpness kernel' is and why it is effective?\n\n2. The convolutional kernel applies on the whole image. Sometimes, the corruption may happen in some local regions, e.g., motion blur on foreground objects only. How do the authors comment on such situations?\n\nLIMITATIONS:\nThe authors have not discussed limitations. But I feel that the method is simple, and experimental analyze are extensive enough.\n\nIt is helpful to discuss the effectiveness under other OOD types like open-class data, high-level style changes.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\n.The paper proposes a new method for test-time adaptation (TTA) to structured distribution shifts. The proposed method learns convolutional visual prompts to prevent the model from overfitting to SSL objectives due to high dimensional prompts. The results show that the proposed approach consistently results in performance improvements for TTA to OOD variants of CIFAR-10 and ImageNet.\n\nSTRENGTHS:\n- The idea of using convolutional prompts to avoid SSL overfitting is novel and well-motivated (Table 5 shows how SSL results in overfitting and Figure 3 shows the need for some form of inductive bias).\n- The results indicate consistent results when CVP are added to baselines and other prior TTA works.\n- The method tunes very few parameters. The parameter efficiency allows it to be adopted in edge computing devices working with low memory and compute.\n\nWEAKNESSES:\n1. The paper compares their method with only two types of visual prompts (patch and padding based [40]). The paper does report results with CLIP ViT-B (Table 3), but does not compare to other prompts used for adapting ViTs [26] and text-only prompts for CLIP-pretrained ViTs. [A]\n2. The paper mentions on L63: “The only one that does not update the model (for Test time adaptation) is proposed by [40]”. However the following uncited works do not update the model as well [A, B].\n3. The paper does not show results with unimodal ViT architectures (eg. pretrained models from TIMM). Similar gains over the baselines (and [26]) in the context of ViTs can boost the applicability of the approach.\n4. The paper sets different hyperparameters for different datasets (range of $\\lambda$, kernel sizes), without providing guidelines on how these are to be determined for a new dataset (or corruption type).\n5. Missing details on evaluation and implementation (covered under Questions). Minor writing: $\\lambda$ is introduced much later in text, while being introduced in 3.3.\n\n[A] Test-Time Prompt Tuning for Zero-Shot Generalization in Vision-Language Models. Shu et al.\n\n[B] Test-Time Training with Masked Autoencoders. Yossi et al.\n\n[C] Dual Modality Prompt Tuning for Vision-Language Pre-Trained Model. Xing et al.\n\nQUESTIONS:\nI am happy to update my rating if the concerns around comparisons to prior work and hyperparameter selection are adequately addressed. But I request the authors to provide the missing details.\n\n1. In Table 8, multiple choices are provided for kernel size and update iters, how are the chosen hyperparameters validated?\n2. What are the hyperparameters used in Table 4/5/7, where the kernel size is not specified?\n3. How is CVP applied to CLIP-ViTs? Is the image first convolved and then tokenized?\n4. Which CLIP-ViT/32 model and can was used for the results in Table 3? [A] does report numbers on CLIP-ViT-base/16.\n5. What architecture is used for the results in Table 7? \n6. For the MAE baseline in Table 7: is the contrastive objective of CVP directly replaced by MAE objective? But this introduces additional decoder parameters as well right? It would be good to see a comparison of the number of parameters that are optimized in different SSL methods.\n7. L9: “1% when compared to standard visual prompts”. How does this compare to the shallow prompts used in [26].\n8. Tables 9 and 12 show that CVP does not outperform baselines for fog/frost/snow corruptions. Also, Figure 3 shows CVP does not outperform low-rank prompts for snow corruption. Any intuition on why CVP does not perform well when weather conditions are changed?\n9. In Table 15, are the reported losses on samples that were used to tune prompts? Reporting the loss on unseen samples may give a better idea of the extent of overfitting.\n10. Since [A] is a prior TTA work for CLIP, would there be any benefits of dual text-visual prompt tuning (like [C]) with: CVP (your method) + [A] (NeurIPS’22)? \n\n\n[A] Test-Time Prompt Tuning for Zero-Shot Generalization in Vision-Language Models. Shu et al. (NeurIPS'22)\n\n[B] Test-Time Training with Masked Autoencoders. Yossi et al. (NeurIPS'22)\n\n[C] Dual Modality Prompt Tuning for Vision-Language Pre-Trained Model. Xing et al.\n\nLIMITATIONS:\nThe paper may need to add a limitation (and future work) section if the above concerns (applicability to uni-modal ViTs and hyperparameter tuning) can not be addressed in the current submission.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-08"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a variant of Visual Prompt Tuning (VPT) where the prompt is applied to a penultimate layer of the encoder network and is a result of a convolution with a 3x3 or 5x5 kernel (essentially it is an added residual block or residual adapter if you will). The added adapter is trained at test time by applying a contrastive loss on a test batch (so, in fact, it seems to be a variant of transductive learning, requiring a batch of test images - to form a negative set for the contrastive loss, so not truly online and does not seem to be able to operate on a single test sample). The authors test their approach on a collection of OOD benchmarks, some synthetic, and some real - these ones are in fact UDA / UDG benchmarks, however, UDG baselines are not compared. Small improvements are observed over naive baselines, though prior methods like [53] and [60] seem to deliver much better performance (Table 4) and the authors only show the benefit of their approach via ensembling / combining with the other methods.\n\nSTRENGTHS:\n- test time adaptation, VPT, and handling domain shifts are important topics\n- some improvement is observed over simple baselines\n\nWEAKNESSES:\n- novelty: adding a convolutional residual adapter + contrastive loss for transductive learning (test time adaptation on a batch) is hardly novel\n- comparisons to prior works:\n* table 4 shows [53] and [60] attain significantly better results than the proposed approach\n* relevant baselines / benchmarks seem to be missing (e.g. https://arxiv.org/pdf/2210.04831.pdf reports better results on ImageNet-C + DomainNet benchmark could be added)\n* I would expect comparison to / on top of UDG baselines that solve the same problem\n* combining methods as in table 4 is fine, but other methods could also be combined, would it yield even higher results?\n- Supervised variant of the approach explored in the ablation needs to be compared to few-shot and in particular transductive few-shot methods, expecting much higher results there.\n- what about the online test-time tuning (from one sample) seems not possible due to the use of the contrastive loss?\n\nQUESTIONS:\n- PromptTuning is a weaker variant of the broader family of PEFT methods, usually applied on the input level (penultimate layer in this case) it does not have enough representation power to model more complex deviations, as opposed to more popular LoRA or prefix tuning methods. Would the authors' approach be applicable to the more powerful PEFT methods?\n\nLIMITATIONS:\nlimitations not discussed", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\n- The paper introduces Convolutional Visual Prompts (CVP), a novel methodology designed to increase the model robustness when faced with Out-of-Distribution (OOD) data during test time.\n- The primary innovation of CVP is the use of convolutional structures as inductive biases for adapting to visual OOD instances during test time.\n- The experimental results show that these convolutional structures are efficient and effective at dealing with OOD corruptions.\n\nSTRENGTHS:\n- *Originality*: The paper proposes a novel method, the use of convolutional structures as inductive biases for visual prompt tuning to OOD data. This work would interests the visual prompt community.\n- *Quality*: Extensive experiments have been conducted across a variety of OOD recognition tasks, providing empirical support for the effectiveness of CVP.\n- *Clarity*: The paper is well-written and comprehensible, offering clear explanations of the problem, the proposed solution, and the obtained results.\n\nWEAKNESSES:\nThe major concern of this work is its Motivation behind the choice of convolutional structures: The paper does not provide a clear motivation or justification for choosing convolutional structures as the basis for the Convolutional Visual Prompts (CVP). While the paper mentions the effectiveness of convolutional operations for handling structured data with local motifs, a more explicit link between this principle and the task of OOD adaptation would be beneficial. For instance, the authors could hypothesize that the learned convolutional kernel might act as the de-corruption operator for specific corruptions, offering a possible reason for their choice (the point was raised by the visual evidence like Figure 11, which seems indicate the reason behind why CVP works).\n\nQUESTIONS:\n- What motivated the choice of convolutional structures over other possible structures for the CVP?\n- Could you discuss the wider usage of CVP when applied to settings other than test-time adaptation?\n- Could you also discuss the extendability of CVP model, like the possibility/effectiveness of adding more kernels? I am not saying to develop a new variant during the rebuttal, but to indicate how the followers can use the method to the best extend would enhance the significance of the work.\n\nLIMITATIONS:\nThe paper seems not discuss the limitations, but when the authors try to answer the weakness and questions above, they might come up with more discussion on the limitation of the work.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-31"}