Research map / Adversarial robustness and security / Attacks on text and graphs
MedBN: Robust Test-Time Adaptation against Malicious Test Samples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MedBN, which replaces mean with median for test-batch BN statistics, to make test-time adaptation robust to malicious test samples in a batch.
Problem
Test-time adaptation methods that use test batch statistics in batch normalization are vulnerable to data poisoning: a small fraction of malicious test samples in a batch can manipulate predictions on benign samples.
Approach
Estimate BN normalization statistics with the median instead of the mean (plus mean of squared deviations from the median), which theoretically bounds the effect of minority malicious samples; the method is algorithm-agnostic and plugs into existing BN-based TTA methods without extra training.
Key results
- Under targeted instant attack on CIFAR10-C, TeBN attack success rate drops from 83.91% (BatchNorm) to 19.16% with MedBN.
- On ImageNet-C targeted instant attack, MedBN reduces ASR from 97.78% to 0.36% for BatchNorm-based TeBN.
- MedBN keeps clean TeBN error rate nearly unchanged (CIFAR10-C 15.19% vs 14.92% baseline).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace mean batch statistics with median statistics in SoTTA | SoTTA · CIFAR10-C, instant targeted attack | ASR (%): 18.18 -> 8.67 | Helped |
| Replace mean batch statistics with median statistics in SoTTA | SoTTA · CIFAR100-C, instant targeted attack | ASR (%): 8.71 -> 1.60 | Helped |
| Replace mean batch statistics with median statistics in SoTTA | SoTTA · ImageNet-C, instant targeted attack | ASR (%): 11.02 -> 0.27 | Helped |
| Replace mean batch statistics with median statistics in SoTTA | SoTTA · CIFAR10-C, instant indiscriminate attack | ER (%): 20.40 -> 16.49 | Helped |
| Replace mean batch statistics with median statistics in sEMA | sEMA · CIFAR100-C, instant indiscriminate attack | ER (%): 46.89 -> 43.35 | Helped |
| Replace mean batch statistics with median statistics in SoTTA | SoTTA · ImageNet-C, instant indiscriminate attack | ER (%): 66.05 -> 64.22 | Helped |
| Replace mean batch statistics with median statistics in SAR | SAR · CIFAR10-C, cumulative targeted attack | ASR (%): 31.25 -> 8.76 | Helped |
| Replace mean batch statistics with median statistics in SoTTA | SoTTA · CIFAR10-C, cumulative indiscriminate attack | ER (%): 26.10 -> 22.52 | Helped |
| Replace the mean of squared deviations with median absolute deviation (MAD) for estimating batch variance (ablation) | MedBN · TTA benchmark experiments | model performance | Hurt |
Surprising findings
- Median absolute deviation for the scale estimate gives stronger defense but a substantial clean performance drop, so the mean of squared deviations from the median was chosen.
- Sharpness-aware learning (SAR) does not make models robust to malicious samples, as malicious samples have small gradient norms.
Limitations
- Median-based statistics cause some clean-performance degradation for certain methods (e.g., indiscriminate attack gains are modest on CIFAR100-C)
- Evaluated under a white-box adversary with full knowledge; milder adversary scenarios only in appendix
- Mean of squared deviations kept for scale rather than MAD, leaving robustness of scale estimate partially exposed
Experimental setup
Datasets: CIFAR10-C CIFAR100-C ImageNet-C Cityscapes SYNTHIA
Benchmarks: CIFAR10-C CIFAR100-C ImageNet-C Cityscapes-to-SYNTHIA segmentation
Metrics: attack success rate error rate mIoU
Baselines: TeBN TENT ETA SAR SoTTA sEMA mDIA EATA
Builds on: TeBN TENT EATA SAR SoTTA
Closest papers by meaning
- Unraveling Batch Normalization for Realistic Test-Time Adaptation (AAAI 2024 · similarity 0.87)
- On the Adversarial Risk of Test Time Adaptation: An Investigation into Realistic Test-Time Data Poisoning (ICLR 2025 · similarity 0.87)
- PTTA: Purifying Malicious Samples for Test-Time Model Adaptation (ICML 2025 · similarity 0.86)
- Buffer layers for Test-Time Adaptation (NeurIPS 2025 · similarity 0.86)
- SNAP: Low-Latency Test-Time Adaptation with Sparse Updates (NeurIPS 2025 · similarity 0.85)
- Towards Real-World Test-Time Adaptation: Tri-net Self-Training with Balanced Normalization (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.