Variational Model Perturbation for Source-Free Domain Adaptation
Anonymous Author(s)
AfﬁliationAddress email
Abstract
We aim for source-free domain adaptation, where the task is to deploy a modelpre-trained on source domains to target domains.
The challenges stem from thedistribution shift from the source to the target domain, coupled with the unavailability of any source data and labeled target data for optimization.
Rather thanﬁne-tuning the model by updating the parameters, we propose to perturb the sourcemodel to achieve adaptation to target domains.
We introduce perturbations into themodel parameters by variational Bayesian inference in a probabilistic framework.
By doing so, we can effectively adapt the model to the target domain while largelypreserving the discriminative ability.
Importantly, we demonstrate the theoreticalconnection to learning Bayesian neural networks, which proves the generalizabilityof the perturbed model to target domains.
To enable more efﬁcient optimization,we further employ a parameter sharing strategy, which substantially reduces thelearnable parameters compared to a fully Bayesian neural network.
Our modelperturbation provides a new probabilistic way for domain adaptation which enablesefﬁcient adaptation to target domains while maximally preserving knowledge insource models.
Experiments on several source-free benchmarks under three different evaluation settings verify the effectiveness of the proposed variational modelperturbation for source-free domain adaptation.
Introduction
A well-trained neural network can achieve satisfactory performance on in-distribution tasks.
However,in real applications, a common situation is that the training set and the test set are from differentdistributions.
In this case, the performance of the models usually degrades signiﬁcantly due to domainshifts.
Domain adaptation (DA) [1, 2] is proposed to solve this problem by transferring knowledgefrom the labeled source domain (the training set) to the unlabeled target domain (the test set).
It isassumed that source data are still available when adapting to target data.
In this paper, we focus onthe more challenging scenario where source data are not accessible, which is known as source-freedomain adaptation (SFDA) [3, 4].
SFDA promises much wider ranges of applications than the vanilladomain adaptation in that it can circumvent the problem of not disclosing source data in order toprotect the privacy of individuals or the intellectual property of commercial entities.
To deal with domain shift, two popular techniques in the literature to adapt the SFDA model to thetarget domain are ﬁne-tuning (updating the whole parameters) and modulating (tuning the batchnormalization layers and freeze all the other parameters).
The former focuses on the differenceof domains, while the latter focuses on the relevance of domains.
For ﬁne-tuning methods, e.g.,
SHOT [5] and NRC [6], the parameters of the entire model are further updated by designingoptimization objectives.
For example, SHOT [5] calibrates the model predictions by informationmaximization and pseudo-labeled self-supervision, while NRC [6] exploits the nearest neighbor relationship between samples.
Though being empirically successful, both model ﬁne-tuning andbatch normalization modulation suffer from drawbacks.
Fine-tuning may cause some problems.
First, the model will deviate from the source data, leading to performance degradation on the sourcedomain, similar to catastrophic forgetting in continual learning [7, 8, 9, 10].
We care about theperformance on the source domain since in the more generalized SFDA scenario [11] we do notnecessarily have the target domain ID available, and therefore we would not know when to deploy thesource model.
Second, ﬁne-tuning could result in a model being biased to a speciﬁc target domain(overﬁtting), thus reducing the generalization of the model [12, 13, 14].
Third, since there are noregularizations from the labeled source data, e.g., cross entropy loss, errors may accumulate and theparameters of the model may be distorted, leading to low performance in Continual Online SFDA [15].
Batch normalization modulation approaches [16, 17, 18] keep weights of all convolutional and fullyconnected (FC) layers frozen, and only modulate the statistics in the batch normalization layers [19]to adapt to target data.
However, they tend to be less ﬂexible and would not continuously adapt totarget data with large domain shifts.
In addition, those are all deterministic approaches which sufferfrom lack of generalizability [20, 21, 22].
In this paper, we propose variational model perturbations, which ﬁxes the existing weights and slightlyperturbs them to encode the uncertainties according to the domain shifts.
We learn to perturb modelparameters to achieve domain adaptation by variational inference.
By variational perturbations, weintroduce uncertainties into the model.
As a result, we perturb a deterministic network into a Bayesianneural network (BNN), allowing the model to generalize to relevant domains.
We demonstrate thatby perturbing the model in a variational manner, we are equivalent to learning a special BNN witha ﬁxed mean and a learnable variance.
To achieve more efﬁcient perturbation, we further adopta parameter sharing strategy, which signiﬁcantly reduces the learnable parameters.
This enablesmore efﬁcient adaptation in contrast to learning a full BNN.
It is worth noting that the perturbationis naturally regularized due to the variational inference formulation, which prevents the perturbedweights from being distorted during the continuous unsupervised learning.
Our approach is easy toimplement, offers a plug-and-play module to adapt model parameters and works seamlessly withdifferent optimization objectives.
We conduct extensive experiments on ﬁve datasets with threedifferent evaluation settings.
The results consistently demonstrate the effectiveness of variationalmodel perturbation for source-free domain adaptation.
Methodology
We start from the vanilla unsupervised domain adaptation, based on which we formally introduce thesetting for source-free domain adaptation.
For the vanilla unsupervised domain adaptation setting,we are given a source domain D s = { ( x si , y si ) | x si ∈ X s , y si ∈ Y s } n s i =1 with n s labeled data and a targetdomain D t = { x tj | x tj ∈ X t } n t j =1 with n t unlabelled data under the condition that p ( X s ) (cid:54) = p ( X t ) wherep ( X s ) and p ( X t ) are the source and target data distributions.
The source and target domains share thesame label space, i.e., Y s = Y t .
The task is to learn a model f : X t → Y t that could predict the targetlabels.
In the source-free domain adaptation setting, we are only given the unlabeled target domaindata D t = { x t j } n t j =1 and the model trained on the source domain parameterized by w s .
Model Perturbation with Uncertainty From the probabilistic perspective, we deﬁne a modelp ( w s | D s ) to be trained on the source domain D s .
Then, the model parameters w s can be optimizedby maximum likelihood estimation under the i.i.d.
assumption:
[Equation]
Usually we could optimize Eq.
(1) through mini-batch based stochastic gradient descent [23] and theoptimum of w s is a point estimate of the model parameter.
Having a model pre-trained in Eq.
(1)on a source domain, we would like to deploy it on different target domains.
However, usually theperformance of the source model degrades signiﬁcantly on the target domains due to the domain shift.
Therefore, we propose to perturb the model parameters based on the point estimate w s in order tomake it generalizable to the target domain while maximally maintain the discriminative ability ofthe source model.
Denote the perturbed weights as w t , which is obtained by a simple perturbationoperation as follows:
[Equation]
where ∆ w is the perturbation for w s .
It is worth noting that we only perturb the weights of theconvolutional and FC layers in the network and we update the running mean and running variance inthe batch normalization layers through moving average.
In this paper, we formulate the perturbation as a variational inference problem in a probabilisticframework.
Given the target domain D t , we compute the posterior distribution of the perturbations by
Bayesian inference, i.e., p (∆ w | D t ) .
However, directly computing the expectations of the posteriordistribution is intractable, since it is equivalent to computing expectations of an uncountably inﬁniteset of neural networks [21, 24].
Therefore, as a more realistic alternative, we resort to computing theposterior distributions through variational inference.
Speciﬁcally, assume the perturbations are drawn from a zero-mean distribution, i.e., ∆ w ∼
N (0 , σ 2 I ) , where σ is the learnable standard deviation.
Then, our task reduces to solving theoptimization problem such that the variational posterior q (∆ w | 0 , σ ) can approach the true posteriorp (∆ w | D t ) .
We minimize the Kullback-Leibler (KL) divergence between them as follows:
[Equation]
where the ﬁrst term in Eq.
(3) is the KL divergence between the posterior and the prior, and the secondterm is the expectation likelihood.
The objective function of our method is Eq.
For the expectationlikelihood term, it has different implementations and we will discuss it later.
The speciﬁc forms ofthe objective function under different implementations are included in supplementary material.
Choosing zero as the mean of ∆ w is because we want to avoid the perturbed model deviating muchfrom the source model so that it can adapt to more general settings, i.e. Generalized SFDA [11] and Continual Online SFDA [15]. In this way, the weights of the perturbed model will vary around theweights of the source model while being generalizable due to the uncertainty induced by non-zerovariance. In essence, we expand the effective coverage of the source model to the target domain.
Connection to Learning a Bayesian Neural Network It has been proven that introducing uncertainty into weights can improve generalizability of neural networks [21, 22].
Actually, under mildconditions, our method is equivalently learning a BNN.
We demonstrate this as follows.
Assume that we would like to learn a neural network by variational Bayesian inference, where weplace a prior p ( w t ) over the weight.
We design the variational posterior as q ( w t | w s , σ ) .
Here weassume the mean w s to be a constant which is the point estimate of the model parameters, and thevariance σ 2 to be a learnable variable.
We minimize the KL divergence between the variationalposterior q ( w t | w s , σ ) and the true posterior p ( w t | D t ) : [Equation]
[Equation]
As we deﬁne w t =∆ w + w s , the posterior w t ∼ q ( w t | w s , σ 2 ) is transformed from ∆ w ∼q (∆ w | 0 , σ 2 ) .
By adopting the technique of change of variables to Eq.
(5), we arrive at:
[Equation]
Therefore, minimizing the KL divergence between q ( w t | w s , σ ) and p ( w t | D t ) is equivalent to minimizing the KL divergence between q (∆ w | 0 , σ ) and p (∆ w | D t ) .
Notably, in BNN, the prior is usually set to be noninformative normal Gaussian distribution [20,21, 25].
Here we just assume we adopt the same noninformative normal Gaussian prior, i.e., p ( w t )= p (∆ w ) .
For practical optimization, since the prior only serves as a regularizer in the KLdivergence term while our goal is to infer the posteriors, the two inferred posteriors do not necessarilyhave the same variance.
Even if the prior distributions are different, the conclusion that variationalmodel perturbation is equivalent to learning a BNN still holds.
Variational Posterior of Perturbations Following [21], we assume that the variational posteriordistribution is a diagonal Gaussian distribution.
Then we can obtain a sample of the perturbations∆ w by sampling the unit Gaussian and scaling it by the standard deviation σ .
To ensure that σ isnon-negative, in practical implementations σ is not calculated and updated directly. Speciﬁcally, σis calculated as σ = (cid:112) exp ( ρ ) , where ρ is the de facto variational posterior parameter which is thelogarithm of the variance.
Thus, a sample from the perturbed w t can be represented as:
[Equation]
where (cid:15) ∼ N (0 , I ) and ◦ denotes element-wise multiplication.
Prior of Perturbations Previous works have shown that the selection of different priors affects thegeneralization performance of the model [26, 20, 27].
Considering that weights of each layer havedifferent variations, it may be sub-optimal to use a uniform prior for the whole network.
Therefore,we propose to specify different priors for perturbations of each layer according to the statisticalproperties within the pre-trained model.
Speciﬁcally, each convolutional layer contains multipleconvolutional kernels.
Previous research [26] has found that weights in the same convolutional kernelhave strong correlations, while different convolutional kernels do not, even if they are in the samelayer.
In view of this, we propose an adaptive prior , which computes the standard deviation ofeach convolutional kernel in the pre-trained model as the prior of the perturbations of the wholeconvolutional kernel.
Then, the prior shared by the whole convolutional kernel is as follows:
[Equation]
where p (∆ w li ) represents the prior distribution for perturbations of the i -th convolution kernel in l -thconvolutional layer, and Var is the variance of the convolutional kernel in the pre-trained model w s .
λis a scale coefﬁcient.
We experimentally observed that λ
=1 . 0 can achieve satisfactory performance.
Likelihood Function
In general, variational model perturbation is independent of the likelihoodfunction.
In SFDA, the target data are unlabeled, the likelihood function can be implemented byoptimization with respect to unsupervised losses.
For example, we can minimize entropy loss [16]to encourage the model predictions to be close to one-hot encodings.
In addition, Liang et al.[5] highlight that ideal predictions should have enough category diversity, we can achieve this bymaximizing the mean of the entropy of predictions in a mini-batch.
All these objective functionscan be well integrated within our framework.
We report the results of our method under differentimplementations of the likelihood in the experimental section.
Parameter Sharing Strategy Since the parameters in the same convolutional kernel have strongcorrelations [26], it is a natural choice to adopt a parameter sharing strategy for the convolutionallayers so that we can further reduce the learnable parameters, i.e., all the weights in the convolutionalkernel share the same perturbations.
Thus, the number of learnable parameters for each convolutionallayer is equal to the number of output channels.
By doing so, we can largely reduce learnableparameters without signiﬁcantly degrading performance.
Through the parameter sharing strategy, we deconstruct the training process of SFDA into a staticinvariant part and a dynamic varying part : we can train a model with millions of parameters ( staticpart ) in the source domain, and then adapt it to different target domains by learning a small numberof perturbation parameters ( varying part ), which avoids training the parameters of the whole modelevery time, reduces the storage space and makes the process of domain adaptation more ﬂexible.
Related Works
Unsupervised Domain Adaptation Unsupervised domain adaptation (UDA) aims at transferringknowledge from the source domain to the unlabeled target domain in order to perform as well on thetarget domain.
According to Ben-David’s domain adaptation theory [28, 29], the expected error ofthe model on the target domain consists of three components:
[Equation]
[Table] This paper [Table] Here r S represents the expected error in the source domain, which can be minimized with a crossentropy loss.
d H ∆ H ( S , T ) is a measure of domain shifts.
λ is considered to be a sufﬁcientlysmall constant to represent the complexity of the hypothesis space [30, 31].
Therefore, most UDAmethods focus on the second term, i.e., the domain shift, to minimize the expected error on thetarget domain.
For example, methods based on adversarial generative networks [30, 1] learn domainindistinguishable features in an adversarial manner.
Statistical matching methods [32, 31, 33] try tomitigate domain shifts by aligning the ﬁrst- or second-order statistics between domains.
Source-Free Domain Adaptation Unsupervised domain adaptation assumes that source data isavailable when adapting to target domains, which would not always hold in real-world applicationsdue to issues of intellectual property, individual privacy, decentralisation, etc.
Therefore, Source-Free
Domain Adaptation (SFDA) is proposed to solve this problem [3, 4, 5, 6, 34, 35].
In this setting, onlythe pre-trained model in the source domain and the unlabeled target data are provided.
Kundu et al.[4] attempt to align the source and target domains using generative models.
Ishii and Sugiyama [35]reduce domain shifts by aligning the statistics stored in the batch normalization layers.
From aninformation-theoretic perspective, Liang et al.
[5] proposes SHOT to ﬁne-tune the source model usingtarget data by imposing entropy minimisation and diversity maximisation for predictions.
In addition, SHOT employs self-supervised learning using pseudo-labels.
Yang et al.
[6] exploit the intrinsicneighborhood structure to encourage label consistency among target data.
Huang et al. [34] maintainthe consistency of features between the historical model and adapted model through contrastivelearning.
Online Source-Free Domain Adaptation SFDA methods [5, 4, 6, 34] assume all target domaindata are available during training, and they also optimize dedicated objective functions through multiple iterations.
To be applicable to scenarios such as autonomous driving and real time object trackingonline SFDA, also known as test-time adaptation, has been explored.
For example, AdaBN [17]and Test-time BN [18] improve the performance of the model in the target domain by recalculatingthe Batch Normalization (BN) statistics in the test period instead of using ﬁxed BN statistics fromthe pre-trained model.
Tent [16] modulates the parameters in the BN layers through entropy minimization to adapt the test data in real time.
For stable and effective adaptation, Tent freezes all theparameters except the BN layers.
Test-Time-Training [36] introduces additional auxiliary tasks toimprove test-time performance.
CoTTA [15] adopts weight-averaging and augmentation-averagingto calibrate pseudo-labels to avoid error accumulation during continual test-time adaptation, thenthey use these reliable pseudo-labels for self-supervised regularization.
By contrast, our modelperturbation freezes all weights except the batch normalization parameters in the source model, whichavoids error accumulation and knowledge forgetting.
We provide a comparison between our method and related methods in Table 1.
Most existingapproaches are developed in a deterministic manner, without exploring the uncertainty.
Differently,in this work we address SFDA in a probabilistic framework by modelling weight uncertainty.
Bayesian Neural Networks Our work is also closely related to BNNs.
They combine neuralnetworks with Bayesian inference, which explain the uncertainties from the model and provides thedistributions over the weights and outputs.
Various techniques have been explored to learn BNNsincluding variational inference [38, 24], probabilistic backpropagation [39], Hamiltonian Monte Carlo [40] and the Laplace approximation [25].
Our variational model perturbation provides analternative way of implementing Bayesian inference for neural networks.
Compared to previousimplementations, our method is plug-and-play and more ﬂexible.
It provides an efﬁcient way toadapt a deterministic source model to a target domain by transforming into a probabilistic one whileavoiding re-training a full BNN.
Experiments
4.1 Datasets and Settings
Datasets.
We report our experiments on ﬁve datasets.
The Ofﬁce [41] dataset includes 3 domains.
All the images are categorized into 31 classes.
Ofﬁce-Home [42] consists of 4 domains.
Eachdomain contains 65 different classes.
Cifar10-C , Cifar100-C [43] and ImageNet-C [43] include15 different types of corruptions imposed on the original Cifar10, Cifar100 and ImageNet datasets,respectively.
Each corruption type contains 5 different corruption severities.
Each severity has 10,000images in Cifar10 and Cifar100, 5,000 images in ImageNet-C, respectively.
Evaluation Settings.
We test our method on three source-free domain adaptation settings.
For aclearer elaboration of the experimental details, we clarify SFDA consists of three phases, namely,source pre-training, target adaptation and testing.
Ofﬂine SFDA [4, 3]: In the target adaptation phase,we can access data of the entire target domain and optimize the objective functions with multipleiterations.
Generalized SFDA [11]: we split the source data into 80% and 20% parts. In the sourcepre-training phase, we use the labeled 80% part to pre-train the source model. In the target adaptationphase, we use all the unlabeled target data to adapt the model. In the testing phase, we predict theremaining 20% source data and all target data.
We compute the harmonic mean of the source andtarget accuracies: Harmonic = 2 ∗ Acc S ∗ Acc T Acc S + Acc T .
Continual Online SFDA [15]: the target domain phaseand the testing phase are carried out simultaneously. At each iteration, we can only access data in onebatch and data in the previous iteration cannot be accessed again.
We carry out this experiment in amore challenging setting where data of different domains are encountered continually.
The detailed training processes of our method under the three settings are in suplementary material.
4.2 Implementation Details
The objective function in Eq. 3 includes the KL divergence loss and the expectation likelihood loss. In the three settings, we adopt different implementations of the expectation likelihood loss. For Ofﬂine SFDA and Generalized SFDA, we employ the information loss and self-supervised loss asin SHOT [5] to optimize the expected likelihood loss.
For a fair comparison, we use ResNet-50 as thebackbone just as the previous methods [5, 1, 11, 34]. In the source-pretraining phase, this backbone istrained on the source domain to obtain the source pre-trained model.
As for the optimizer, following[5], we employ Stochastic Gradient Descent (SGD) with weight decay 1e-3 and momentum 0.9.
Asfor the learning rate, we set 2e-3 for the backbone model and 2e-2 for the bottleneck layer newlyadded in SHOT.
In addition, β is a hyper-parameter which balances the importance of informationloss and self-supervision loss in SHOT.
Since the parameters learned by model perturbation aredifferent from those of SHOT, the value of β used in SHOT may be sub-optimal.
Therefore, wesearch the optimal β ∗ in range of [0.1,2.0] for all the three datasets.
Then, β ∗ is set to 0.3 in both Ofﬁce and Ofﬁce-Home.
The batch size is 64.
For Continual Online SFDA, we use entropy loss as the likelihood function in Eq. 3.
In this way, theimplementation is equivalent to a perturbation of Tent [16].
We use the same network architectures asin [15] to make the results comparable.
In Cifar10-C, we employ WideResNet-28 [44] from Robust
Bench [45] as the source pre-trained model.
We used the Adam [46] optimizer with learning rate 5e-4.
In Cifar100-C tasks, we used ResNeXt-29 [47] from [48].
The optimizer settings are the same as thatin Cifar10-C except the learning rate is 7e-5.
In the ImageNet-C experiments, ResNet-50 pre-trainedon ImageNet is employed.
We adopt the SGD optimizer with learning rate 1e-4, momentum 0.9and weight decay 0.
We set the scale parameter λ of the prior to be 1 . 0 .
We discuss the impactof different choices of priors on performance in 4.3.
In the target adaptation phase, we sample theperturbations once for running efﬁciency.
In the testing phase, given a batch of target samples, weiterate the proposed method for only 1 epoch and make predictions immediately.
We sample theperturbations 10 times when predicting.
To reduce the sampling variance, we employ the localreparameterization trick [49].
The detailed optimization process with local reparameterization trick isin the supplementary material.
For the compared methods, we either report the results in the original papers or the best results wecan reproduce.
For the non-Bayesian methods, we run them 10 times with different random seedsand take the average of them to reduce randomness.
[Figure] [Figure] [Figure] " means we learn a different σ for each parameter in the convolutional kernel individually; (c) Impact of layers without perturbations where the results are based on Ofﬁce-Home dataset and the backbone is ResNet-50.
4.3 Effectiveness Analysis
[Figure] We make effectiveness analysis of our methodin Fig.
1, Fig. 2 and Fig.
Results of ofﬂinesetting and online setting are from implementations of model perturbation based on SHOT and Tent, respectively.
Quantiﬁcation of weight uncertainty.
In Fig.
1, we report the (cid:96) 1 -norm of the learnedσ in each layer.
We use it as a proxy of weightuncertainty.
We could make the following observations: (1) In the ﬁrst few layers of the network, the perturbations are small.
As the layersgo deep, the perturbations become larger.
Thisshows that the shallower layers of the neuralnetworks are more generalized, while the deeplayers are task-speciﬁc, which is consistent with the ﬁndings in the previous work [50, 31]; (2) The extent of the perturbation is task-dependent.
A larger domain shift of the task needs a largerperturbation, which demonstrates that model perturbation can effectively encode uncertainty into thenetwork, thus enhancing the generalization.
Adaptive prior.
In Fig.
2 (a), we report the impact of the variance scale factor of the prior onperformance.
Compared to the isotropic Gaussian prior, our adaptive prior has better performance and [Table] [Figure] [Table]
[Figure]
C and ImageNet-C are WideResNet-28, ResNeXt-29 and ResNet-50.
The corruption severity is 5. Our method achieves the best performance across all the tasks. smaller ﬂuctuations for different scale factors.
This indicates that it is reasonable to use an adaptiveprior as different weights may have different variation ranges when adaptation.
Our adaptive priorcan specify different prior distributions for different weights according to the statistical propertieswithin the convolutional kernels, leading to a better performance.
Parameter sharing strategy.
In Fig.
2 (b), we observe that the parameter sharing strategy achievesalmost exactly the same performance compared with the non-sharing strategy.
For ResNet-50 basedtasks, e.g., Ofﬁce and Ofﬁce-Home, the learnable parameters reduce from 24.03 million to 600thousand compared with the non-sharing strategy.
As for the WideResNet-28 based tasks, e.g., Cifar10-C, the learnable parameters reduce from 36.47 million to 30 thousand.
These results verifythe effectiveness of the parameter sharing strategy.
Which layers are crucial for perturbation?
We test the performance by keeping some of thenetwork layers not perturbed.
As shown in Fig.
2 (c), we observe that the performance of the modeldegrades signiﬁcantly when removing perturbations in the last few layers of the network, revealingthat perturbations for the last few layers are crucial, since these layers are often task-relevant.
Adaptation schemes.
In Fig.
3, we compare results of different updating schemes on Ofﬁce-Homeand Cifar100-C. BN modulation means only updating the statistics in batch normalization layers.
Fine-tuning represents updating all the weights in the model.
We observe that variational modelperturbations outperforms BN modulation and ﬁne-tuning in both the ofﬂine and online SFDA tasks.
Compared with BN modulation, variational model perturbation is more ﬂexible.
It can generalize themodel to more target domains through perturbations.
Compared with Fine-tuning, model perturbationavoids the distortion of weight in source model, which prevents the knowledge in source domainfrom being forgotten in continuous adaptation.
Therefore, variational model perturbation is the betterchoice in SFDA tasks.
4.4 Results
[Table]
[Table]
Ofﬂine SFDA
We report the results on Ofﬁceand Ofﬁce-home in Table 2.
All per domain results are provided in the supplementary material.
Notably, in one of the tasks, there are 5 methodsthat achieve the same best accuracy, so the totalwinners are 10 even though there are 6 tasks in
Ofﬁce. Our method achieves the best averageresults on Ofﬁce, showing the stronger general- ization performance of the perturbed model.
Moreover, our method achieves the best results on 4 outof 6 tasks.
Compared with SHOT, our method is improved by 1.4%, which is impressive.
A similartrend can be observed in the Ofﬁce-Home dataset, our model perturbation wins 9 taskes across all [-the 
 [Figure]-]the12 tasks.
In addition, our method outperforms SHOT by 1.0%, which proves that model perturbationcan consistently and clearly improve existing methods.
Continual Online SFDA
In Fig.
4, we report the test errors of different methods under the Continual Online SFDA, where all the methods continuously encounter 15 different types of corruption.
This experiment can not only test the real-time prediction performance of the compared methods,but also show the degree of knowledge forgetting.
Note that Tent [16] only updates the parametersin BN layers while Tent-FT implemented by us updates all the weights.
Similar to Tent, BACS(MAP) [37] also employ entropy minimization, with the difference that BACS (MAP) optimizes themodel through maximum-a-posteriori (MAP).
In Fig.
4 (a), both AdaBN and Tent have test errors larger than 20.0%, revealing that the inﬂexibilityof freezing the weights is the bottleneck for adapting to the continuously changing target domains.
Byunfreezing the parameter update of the convolutional and FC layers, Tent-FT improves Tent by 0 .
Compared to Tent and Tent-FT, the implementation of model perturbation based on Tent achievesperformance advantages of 2 . 8% and 1 . 9% , respectively, demonstrating that model perturbation isthe better choice for SFDA tasks.
The performance advantages stem from two aspects.
On one hand,model perturbation ﬁxes all the weights of convolutional and FC layers to avoid large distortion ofthe weights and forgetting knowledge on the source domain.
On the other hand, model perturbationintroduces uncertainty into the model by slightly disturbing the weights, allowing it to adapt tocontinuous distribution shifts.
Similar conclusions can be drawn on Cifar100-C and ImageNet-C.
Generalized SFDA
In Table 3, we report the results of model perturbation on Generalized SFDAtasks.
In this setting, we ﬁrst train the source model with 80% of the source data, and then adaptthe model to the target domain.
Finally, we evaluate the model on both the target domain and theremaining 20% of the source data. We observe that the performance of SHOT on the source domaindecreases by 11.9% compared to the source model, indicating that SHOT forgets the knowledgelearned in the source domain. Compared to SHOT, model perturbation maintains the performance onthe target domain while signiﬁcantly improving the performance on the source domain, revealing thatour model perturbation can maintain a good balance between adaptation and preserving knowledge.  Conclusion
In this paper, we address source-free domain adaptation in a probabilistic framework by variationalmodel perturbation.
Instead of updating the network parameters by further optimization, we introduceperturbations to the weights of a pre-trained model from source domains.
We learn these perturbationsthrough variational Bayesian inference.
Importantly, we prove the connection between variationalmodel perturbation and Bayesian learning of a neural networks, which provides a theoretical guaranteefor the generalization performance of model perturbation.
Moreover, with the parameter sharingstrategy, we substantially reduce the learnable parameters compared to a fully Bayesian neuralnetwork, making the model perturbation a ﬂexible and lightweight framework.
Our variational modelperturbation offers a new, probabilistic framework for source-free domain adaptation, which canachieve efﬁcient adaptation while largely preserving the discriminative ability of the source model.
The experimental results on ﬁve benchmark datasets under three different evaluation settings revealthat model perturbation offers an effective way for source-free domain adaptation and can boost theperformance considerably.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes]
(c) Did you discuss any potential negative societal impacts of your work?
[No]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[N/A]
(b) Did you include complete proofs of all theoretical results?
[N/A]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e.g., data splits, hyperparameters,
how they
were chosen)?
[Yes]
(c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[Yes](d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
[Yes]4.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[No]
(c) Did you include any new assets either in the supplemental material or as a URL?
[No]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[N/A]
(e) Did you discuss whether the data you are using/curating contains personally identiﬁable
information or offensive content?
[N/A]
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
[N/A]