R.I.P.：一种针对持续测试时适应的简单黑盒攻击
R.I.P.: A Simple Black-box Attack on Continual Test-time Adaptation
AI总结：
本文提出无需模型参数知识或样本修改的黑盒攻击 RIP，利用错误预测复用风险使持续 TTA 性能退化，并通过广泛基准评估揭示其威胁与防御方向。
摘要：
测试时适应（TTA）已成为应对机器学习中持续领域漂移的一种有前景的解决方案，它允许模型参数在测试阶段通过对无标签测试数据进行自监督学习而发生改变。但与此同时，这也不幸为随时间推移而出现的性能退化打开了通向未知漏洞的大门。通过一个简单的理论持续 TTA 模型，我们成功识别出测试数据采样过程中的一种风险，该风险可能轻易降低持续 TTA 模型的性能。我们将这种风险命名为错误预测复用（Reusing of Incorrect Prediction，RIP）；TTA 攻击者可以利用它，它也可能由普通 TTA 用户的非预期查询所导致。RIP 带来的风险还具有很强的现实性，因为它既不需要预先掌握模型参数，也不需要修改测试样本。这种简单的要求使 RIP 成为首个黑盒 TTA 攻击算法，从而区别于现有白盒尝试。我们对最新持续 TTA 方法在面临 RIP 攻击时的性能进行了广泛基准测试，提供了关于其攻击成功原因的洞见，并规划了可增强未来持续 TTA 系统韧性的潜在路线图。
英文摘要：
Test-time adaptation (TTA) has emerged as a promising solution to tackle the continual domain shift in machine learning by allowing model parameters to change at test time, via self-supervised learning on unlabeled testing data. At the same time, it unfortunately opens the door to unforeseen vulnerabilities for degradation over time. Through a simple theoretical continual TTA model, we successfully identify a risk in the sampling process of testing data that could easily degrade the performance of a continual TTA model. We name this risk as Reusing of Incorrect Prediction (RIP) that TTA attackers can employ or as a result of the unintended query from general TTA users. The risk posed by RIP is also highly realistic, as it does not require prior knowledge of model parameters or modification of testing samples. This simple requirement makes RIP as the first black-box TTA attack algorithm that stands out from existing white-box attempts. We extensively benchmark the performance of the most recent continual TTA approaches when facing the RIP attack, providing insights on its success, and laying out potential roadmaps that could enhance the resilience of future continual TTA systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
