Private and Stable Test-time Adaptation with Differential Privacy

Test-time adaptation (TTA) can reduce error on new and different data by updating the model on these inputs during inference. However, these updates raise the issue of privacy w.r.t. the testing data, because the model parameters now depend on all past inputs. To control this privacy risk, we cast multiple popular TTA methods (Tent, EATA, SAR, DeYO, and COME) into differential privacy (DP) forms that apply per-sample gradient clipping and Gaussian noise for all updates. On ImageNet-C, our DP-TTA methods provide adequate privacy at small cost to accuracy, and in the low-privacy regime the clipping mechanism of DP can even improve the accuracy and stability of adaptation in the continual setting. These improvements to privacy and accuracy come at only modest computational overhead. These first results on private TTA raise awareness of the issue, inform the development of more private test-time updates, and identify per-sample clipping as an effective technique for improving the accuracy and stability of adaptation.

Machine learning models are often trained in clean and controlled settings. However, real-world deployment data is constantly changing. Test-time adaptation is a technique that allows models to adjust themselves after deployment, so they can better handle slightly different data, such as blurred, noised, or degraded inputs. However, this update process can be unstable because the model adapts using feedback from its own predictions rather than true answers. When the incoming data is highly corrupted, these signals can be misleading, causing the model to reinforce its own mistakes and suffer drops in performance. Test-time adaptation also creates privacy risks: adaptation changes embed information about test-time data into the model. This information could later be extracted by a malicious attacker. Our work studies how to make this adaptation process stable and privacy-preserving. We develop methods that combine test-time adaptation with differential privacy, a rigorous mathematical framework for limiting information leakage. By carefully controlling and perturbing model updates, we make models adapt to new data with high and stable predictive performance, while reducing the risk of revealing details about previously seen deployment data.