Test-Time Privacy in Deployment

• Test-Time Privacy is a deployment-time design space focused on minimizing sensitive data disclosure during model inference, adaptation, and auditing.
• It encompasses regimes like data minimization, adaptive inference, and post-deployment assurance to mitigate leakage from model updates and side channels.
• Techniques such as personalized feature release, modality suppression, federated adaptation, and differential privacy provide formal guarantees and robust deployment protocols.

Searching arXiv for recent work on test-time privacy and adjacent concepts. Test-time privacy denotes a family of privacy objectives that arise during model deployment, when a system is queried, adapted, or audited on inference-time inputs rather than on its training set. Across recent literature, the phrase appears in several related senses: minimizing how much sensitive information an individual must disclose for prediction (Tran et al., 2023); preventing test-time adaptation procedures from leaking information because model parameters become dependent on past inputs (Li et al., 1 Jun 2026); ensuring that models no longer emit confident predictions on protected instances even after unlearning (Ashiq et al., 15 Sep 2025); and structuring inference pipelines so that privacy-sensitive modalities, user data, or source-domain statistics are not exposed at deployment (Ramazanova et al., 2024, Valanarasu et al., 2022, Shao et al., 2021). This breadth suggests that test-time privacy is best understood not as a single formalism, but as a deployment-time design space spanning data minimization, adaptation control, side-channel resistance, and post-deployment auditing.

1. Conceptual scope

Recent work separates test-time privacy into several operational regimes. One regime concerns feature disclosure: the central question is whether a model truly needs all sensitive attributes at inference time, or whether accurate prediction can be obtained from a personalized subset (Tran et al., 2023). A second regime concerns adaptive inference: test-time adaptation can improve robustness under distribution shift, but once the model is updated on test samples, its parameters may encode information about those samples (Li et al., 1 Jun 2026). A third regime concerns protected-instance behavior: after unlearning, a model may still output the same prediction on the removed instance with high confidence, which is precisely the behavior that the notion of test-time privacy in that setting seeks to eliminate (Ashiq et al., 15 Sep 2025).

A further regime concerns privacy-constrained inputs and architectures. In egocentric video, privacy requirements can remove audio or video modalities at deployment (Ramazanova et al., 2024). In medical segmentation, privacy and deployment constraints motivate per-image, zero-shot adaptation without back-propagation or target-set aggregation (Valanarasu et al., 2022). In 3D scene understanding, RGB may be excluded entirely, so depth-only geometry becomes the privacy-preserving sensing substrate (Huang et al., 1 Jul 2026).

Regime	Core question	Representative work
Data minimization	How little input must be revealed at inference?	(Tran et al., 2023, Ramazanova et al., 2024, Huang et al., 1 Jul 2026)
Private adaptation	How can robustness improve without exposing test data?	(Valanarasu et al., 2022, Shao et al., 2021, Rajib et al., 19 May 2025, You et al., 1 May 2025, Li et al., 1 Jun 2026)
Post-deployment assurance	How are leakage, side channels, and protected-instance behavior controlled or audited?	(Ashiq et al., 15 Sep 2025, Ratliff et al., 2024, Ge et al., 14 May 2026, Gong, 2020, Plein et al., 5 Feb 2026)

2. Threat models and leakage channels

The threat models associated with test-time privacy are correspondingly heterogeneous. In the unlearning setting, the adversary is explicitly white-box: it has access to model weights, architecture, parameters, and outputs, knows the protected set, and seeks a confident prediction on protected instances. Under this model, naive output masking is insufficient because the adversary can bypass it; the defense must perturb model parameters so that confident prediction becomes impossible on the forget set (Ashiq et al., 15 Sep 2025).

For adaptive inference, the privacy issue is structural: once TTA updates the model on test inputs, the adapted parameters depend on past inputs. The differential privacy treatment of TTA makes this dependence explicit and frames the resulting risks in terms of membership inference and gradient inversion, while noting that popular TTA methods were not originally designed with these risks in view (Li et al., 1 Jun 2026).

In federated settings, the leakage channel can be neither raw data nor final predictions, but intermediate statistics. Prior FL-TTA methods that share feature statistics or embeddings expose a privacy surface because such statistics can be vulnerable to data reconstruction attacks or membership inference. FedCTTA is motivated precisely by replacing this exchange with model outputs on randomly generated noise (Rajib et al., 19 May 2025).

Additional leakage channels arise outside standard input-output analysis. Timing side channels allow an adversary to observe runtime jointly with output, motivating the formal notion of timing privacy for programs that are otherwise differentially private in the classical sense (Ratliff et al., 2024). In code LLMs, privacy leakage can be elicited indirectly through developer-like workflows: unit-test generation can operate as a covert channel that surfaces memorized personally identifiable information even when direct requests are filtered (Ge et al., 14 May 2026).

A common misconception is that “no raw test data sharing” is itself sufficient. The literature indicates otherwise: privacy can fail through adapted parameters, transmitted feature summaries, runtime distributions, or confident outputs on protected instances. This suggests that test-time privacy must be analyzed at the level of the whole deployment protocol, not merely at the level of input transport.

3. Data minimization and privacy-preserving inputs

One line of work treats test-time privacy as a personalized data minimization problem. The personalized feature release algorithm selects sensitive features sequentially and stops when a core feature set has been revealed, meaning that the model output is fixed, with high probability, regardless of the unrevealed features. Empirically, individuals may be able to report as little as 10% of their information while preserving the same level of model accuracy as full-feature inference (Tran et al., 2023). Formally, a core feature set for individual $x$ is characterized by

$$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$

A second form of data minimization appears as privacy-motivated modality suppression. In egocentric video understanding, privacy, legal compliance, user choice, efficiency, or hardware issues can remove audio or video at test time. MiDl reframes missing-modality robustness as a test-time adaptation problem and adapts pretrained multimodal systems online using only unlabeled test data, without retraining or access to original training data (Ramazanova et al., 2024). In this framing, the privacy constraint is operationalized as restricted modality availability.

A third form replaces the sensing channel itself. For open-vocabulary 3D semantic segmentation, RGB is treated as privacy-sensitive because it may reveal faces, documents, screens, or belongings. UTTO therefore uses only depth-derived geometry at inference time and never uses real RGB images, colors, textures, or image features from test scenes. The trade-off is a loss of appearance-based semantic cues, which UTTO addresses through uncertainty-guided optimization and foundation-model priors (Huang et al., 1 Jul 2026).

Medical imaging provides an even stricter formulation. The on-the-fly adaptation setting is zero-shot, episodic, and stateless: the model adapts to a single image at a time, performs no back-propagation during test time, does not accumulate patient data, and returns to the same state for each new image. The motivation is explicitly privacy-preserving clinical deployment, where target distributions are not centrally assembled and computational resources may be limited (Valanarasu et al., 2022).

4. Adaptation mechanisms under privacy constraints

Test-time privacy has driven a shift from generic adaptation objectives toward mechanisms whose update rules are structurally aligned with privacy constraints. In MiDl, the pretrained classifier $f_\theta$ is adapted online with

$$\theta_{t+1} = \theta_t - \gamma \nabla_\theta \mathcal{L}_\text{MiDl}(\theta_t), \qquad \mathcal{L}_\text{MiDl} = \mathcal{L}_\text{MI} + \mathcal{L}_\text{KL},$$

where

$$\mathcal{L}_\text{MI} = \mathbb{E}_{m}\left[ H(f_\theta(x; m)) \right] - H\left( \mathbb{E}_{m} [f_\theta(x; m)] \right)$$

encourages prediction invariance to the available modality, and

$$\mathcal{L}_\text{KL} = \mathrm{KL}(f_\theta(x; M=AV) \| f_{\theta_0}(x; M=AV))$$

retains full-modality behavior. Updates are performed only when complete modalities are present, because both loss terms require them. On Epic-Kitchens, representative gains include 46.8% to 52.1% at a 50% missing rate and 37.9% to 44.9% at a 75% missing rate; with long-term adaptation, additional gains of 4–11% are reported at high missing rates (Ramazanova et al., 2024).

Adaptive UNet eliminates test-time back-propagation altogether. Each convolutional block uses an adaptive batch normalization layer controlled by a domain code generated from the current image by a pre-trained encoder. The adaptation is implemented in the forward pass via

$$z = \gamma \left(\sigma(Y) \left(\frac{X - \mu(X)}{\sigma(X)}\right) + \mu(Y)\right) + \beta ,$$

with frozen model weights during deployment. This mechanism yields better performance than prior TTA methods on both 2D fundus and 3D MRI distribution shifts while avoiding batch aggregation and model-state updates on patient data (Valanarasu et al., 2022).

Test-time Correlation Alignment addresses a different privacy constraint: source data are unavailable at deployment. Instead of source covariance, LinearTCA constructs a pseudo-source from high-certainty test instances and solves

$$\min_W \| W^T \Sigma_t W - \Sigma_{ps} \|_F^2, \qquad W = U_{ps} \Lambda_{ps}^{1/2} U_t^T \Lambda_t^{-1/2},$$

followed by mean alignment

$Z_t' = (Z_t - \mu_t) W + \mu_{ps}.$

Because the method requires no back-propagation-based parameter updates, it avoids forgetting and reports higher accuracy with only 4% GPU memory and 0.6% computation time compared to the best TTA baseline; on CLIP it outperforms existing methods by over 1.86% (You et al., 1 May 2025).

UTTO similarly avoids retraining. Reliability is estimated from label-preserving augmentations: $$\rho_v = \frac{1}{M} \max_c \sum_{m=1}^M \mathbf{1}[\hat{y}^{(m)}_v = c],$$ with uncertainty $$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$0. Refinement then minimizes a reliability-weighted objective with geometric and semantic regularizers: $$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$1 On ScanNet20, ScanNet40, and ScanNet200, UTTO consistently improves depth-only open-vocabulary segmentation under privacy-preserving conditions (Huang et al., 1 Jul 2026).

5. Federated and differentially private test-time adaptation

In federated environments, test-time privacy interacts with communication efficiency and heterogeneity. FedCTTA avoids sharing feature means or embeddings and instead computes collaboration weights from client model outputs on randomly generated noise. For client $$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$2,

$$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$3

followed by

$$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$4

Negative Euclidean distance performed best among the tested similarity metrics. The framework eliminates server-side training during adaptation and keeps constant memory. On CIFAR10-C/NIID/TTA-bn, FedCTTA reaches 66.50% versus 66.19% for FedTSA; on CIFAR100-C/NIID/TTA-grad, it improves 58.03% to 64.81% (Rajib et al., 19 May 2025).

A related dual-phase design appears in federated face presentation attack detection. Training-phase privacy is provided by federated averaging,

$$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$5

while test-time privacy is provided by on-device entropy minimization over the user’s unlabeled data through updates to BatchNorm affine parameters only. On unseen-domain evaluation, the dual-phase method reports HTER 14.70% versus 41.29% for single-center training, 19.45% for FedPAD, and 21.80% for non-private centralized training in the cited comparison (Shao et al., 2021).

Differential privacy provides a formal control on test-time updates themselves. DP-TTA casts Tent, EATA, SAR, DeYO, and COME into DP variants using per-sample gradient clipping and Gaussian noise: $$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$6

$$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$7

In the streaming regime, where each test sample is processed only once, the privacy cost does not accumulate with model updates. On ImageNet-C, clipping alone improves some base methods by 0.1–4.1%; DP-TTA at $$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$8 reaches 62.9% for Tent versus 60.8% non-private, while at $$\Pr(f_\theta(X_U, X_R = x_R) = \tilde{y}) \geq 1-\delta .$$9 Tent reaches 58.5%. Runtime overhead ranges from 1.08x to 1.28x depending on the method (Li et al., 1 Jun 2026).

These results clarify a recurring point of confusion: federated inference, on-device adaptation, and differential privacy solve different parts of the test-time privacy problem. Federated aggregation avoids raw-data centralization; on-device TTA avoids test-sample upload; DP constrains the influence of any individual test sample on the adapted model state.

6. Formal guarantees, auditing, and privacy assurance after deployment

Several works move beyond architectural heuristics toward explicit guarantees and audit mechanisms. In the post-unlearning setting, test-time privacy is defined as maximal uncertainty on protected instances. The core objective is the Pareto trade-off

$f_\theta$0

with a bound

$f_\theta$1

The certified approximation algorithm attains $f_\theta$2 guarantees without convexity assumptions, and empirically the method yields more than $f_\theta$3 stronger uncertainty than pretraining with less than 0.2% drops in accuracy on image recognition benchmarks (Ashiq et al., 15 Sep 2025).

Formal privacy at deployment also includes transparency. Differential privacy is distinctive because the privatization mechanism and its parameters can be made public without sabotaging the guarantee: $f_\theta$4 The analysis of transparent privacy argues that principled inference from privatized data requires knowing the correct mechanism, with the observed-data likelihood written as

$f_\theta$5

This is directly relevant to deployment-time privacy because opaque mechanisms can produce biased or inconsistent inference, whereas transparent mechanisms permit valid uncertainty quantification (Gong, 2020).

Runtime is another output channel that requires explicit treatment. Timing privacy extends DP to adversaries who observe both program output and runtime, and the framework shows how timing-stable components can be chained with a random delay to obtain DP programs that achieve timing privacy. The framework is instantiated in RAM and Word RAM models and implemented through an extension of OpenDP (Ratliff et al., 2024).

Auditing reveals that deployment-time privacy failures can remain latent even when training-time safeguards exist. A scenario-grounded, test-driven pipeline for LLM code generation uses automatically constructed privacy feature libraries and unit-test generation to surface memorized PII, yielding a 2.56 times increase in detected leakage over prior baselines across five widely used LLMs (Ge et al., 14 May 2026). A different assurance strategy replaces sensitive test data entirely: synthetic test datasets can be generated by a grammar-based fuzzer guided indirectly by a discriminator, with the generator never accessing the original data. The reported system is evaluated on four datasets, checks that no generated sample is present in the original dataset, and characterizes resemblance using Wasserstein Distance, but does not provide explicit $f_\theta$6-DP guarantees (Plein et al., 5 Feb 2026).

Taken together, these results indicate that test-time privacy is no longer reducible to a single question of whether raw inference data are transmitted. The current literature treats it as a multilayer property of deployment: what inputs are requested, what modalities are enabled, whether and how the model is adapted, what auxiliary statistics are communicated, what side channels exist, how privatization mechanisms are disclosed, and whether protected instances can still trigger confident outputs.