List of Papers Browse by Subject Areas Author List
Abstract
Cross-center deployment of medical image segmentation models faces dual challenges: domain shifts from varying imaging protocols and strict clinical constraints on privacy, security, and trustworthiness. Most existing domain adaptation methods require access to source-domain data or model parameters, which may cause privacy leakage and model attacks in real clinical settings. To bridge this gap, we propose a general, privacy-preserving, and trustworthy online adaptation framework. Under a strictly black-box setting (no source data, no parameter access), yet it continuously improves segmentation performance on the target domain and quantifies reliable uncertainty. We reformulate adaptation as approximate Bayesian inference over input-space perturbations: (1) we replace parameter updates with function-space posterior sampling via frequency-domain amplitude perturbations that preserve anatomical structures through phase spectrum invariance; (2) predictive uncertainty from posterior ensembles guides source-consistent adaptation by filtering unreliable samples; (3) semantic anchors and a memory-based empirical prior jointly prevent error accumulation. Experiments on multiple public and private cross-center datasets demonstrate consistent out-of-domain performance gains and well-calibrated uncertainty estimates under strict black-box settings.
Links to Paper and Supplementary Materials
Main Paper (Open Access Version): https://papers.miccai.org/miccai-2026/paper/3550_paper.pdf
SharedIt Link: Not yet available
SpringerLink (DOI): Not yet available
Supplementary Material: Not Submitted
Link to the Code Repository
N/A
Link to the Dataset(s)
N/A
BibTex
@InProceedings{HanXia_Adapting_MICCAI2026,
author = { Han, Xiaoxiang AND Liu, Yiman AND Xu, Lixin AND Wang, Meng AND Xu, Xiang AND Wang, Yan AND Zhang, Yuqi AND Zhang, Qi},
title = { { Adapting Without Access: Black-Box Bayesian Adaptation for Trustworthy Cross-Center Medical Image Segmentation } },
booktitle = {Medical Image Computing and Computer Assisted Intervention -- MICCAI 2026},
year = {2026},
publisher = {Springer Nature Switzerland},
volume = {LNCS 16882},
month = {September},
page = {pending}
}
Reviews
Review #1
- Please describe the contribution of the paper
this paper proposes a Bayesian approximation over input space to address test-time domain adaptation problem. Under the blackbox setting, instead of doing model adaptation, it adapts target domain data. This solution is kind of novel.
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
The idea is to adapt target-domain data to source-domain data via multiple strategies, including closing the gap of phase spectrum between target data and pertubated ones, closing the uncertainty of predictings from the pertubations as well as closing the gap between the predictions of target data and its pertubations.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
The motivation for the methodologies is weak. For example, why does it need to be low uncertainty & high semantic similarity for predictions? Basically, the prediction for the target domain data still dominates the inference and thus the distribution of its associated pertubations. In this case, a strong performance improvement on target domain is not gauranteed, but it just adds a layer of uncertainty.
Any physical meaning coming out of the pertubation, such as imaging protocals, scanners, etc?
When it comes to experimental setting, the performance over test-time timestamps is not presented. For example, the impact of the memory bank is not examined.
- Please rate the clarity and organization of this paper
Good
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The authors claimed to release the source code and/or dataset upon acceptance of the submission.
- Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?
N/A
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html
N/A
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(3) Weak Reject — marginally below the acceptance threshold, but would not mind if accepted, dependent on rebuttal
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
Instead of improving models’ performance on target domain data, it actually focuses on shifting target domain data and do uncertainty estimation.
Besides, the motivation for several strategy designs should be clarified.
The performance improvement under ‘blackbox’ setting is actually trivial comparing to the other methods. The superiority needs to be further justified.
- Reviewer confidence
Confident but not absolutely certain (3)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
N/A
- [Post rebuttal] Please justify your final decision from above.
N/A
Review #2
- Please describe the contribution of the paper
This paper proposes a black-box online adaptation method for medical image segmentation. The main contribution lies in a Bayesian-inspired input modification strategy that enables adaptation without access to model gradients or source data. Specifically, the method assumes that cross-center domain shifts are primarily reflected in the amplitude component of images. Based on this assumption, the input is encoded into a latent space, and residual perturbations in the amplitude domain are generated to adjust the input, thereby facilitating domain adaptation.
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
1.The paper extends traditional Fourier-based adaptation from deterministic transformations to a stochastic, Bayesian-inspired formulation. By introducing distributional perturbations in the amplitude domain, the method enables more flexible adaptation while naturally supporting uncertainty estimation.
2.The work considers a challenging yet realistic scenario where neither source data nor model parameters are accessible. This black-box adaptation setting is of practical importance in medical applications with strict privacy and deployment constraints.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
1.Equation (5) optimizes a negative log-likelihood term (maximize log p(y|z,x)) using ground-truth labels, which requires backpropagation through the pretrained segmentation model. This appears inconsistent with the claimed black-box setting, where internal model access is assumed to be unavailable.
2.The method adopts a VAE-like formulation to generate amplitude-domain residuals from latent variables. This introduces a non-trivial mapping from image space to frequency-domain perturbations, whose validity and stability are not well justified. It is unclear whether such perturbations can reliably capture meaningful domain variations.
3.Comparing results across Table 2 and Table 3, applying Bayesian Perturbation (BP) alone does not consistently outperform the source model and may even degrade performance. This calls into question the effectiveness of the core mechanism.
4.Performance gains are achieved only after introducing additional modules (e.g., uncertainty-aware posterior), making it unclear whether improvements come from the proposed perturbation or auxiliary design choices.
5.Key analyses such as parameter sensitivity are missing. Important hyperparameters, including the number of samples and memory bank size, are not systematically evaluated.
- Please rate the clarity and organization of this paper
Satisfactory
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The authors claimed to release the source code and/or dataset upon acceptance of the submission.
- Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?
N/A
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html
N/A
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(4) Weak Accept — marginally above the acceptance threshold, but would not mind if rejected, dependent on rebuttal
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
The overall framework is coherent and offers a novel angle for tackling domain shift under strict constraints. However, there are several important concerns regarding both the methodology and experimental validation. In particular, the validity of the black-box assumption is unclear, and the effectiveness of the core Bayesian Perturbation component is not consistently supported by the empirical results. In addition, some key design choices, such as the perturbation formulation and its stability, are insufficiently justified. Despite these issues, I find the overall idea promising and believe it could be impactful if the above concerns are adequately addressed. Therefore, I lean towards a weak accept, while encouraging the authors to clarify the methodological assumptions and strengthen the empirical validation in the rebuttal.
- Reviewer confidence
Very confident (4)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
N/A
- [Post rebuttal] Please justify your final decision from above.
N/A
Review #3
- Please describe the contribution of the paper
This paper proposes a privacy-preserving, black-box online adaptation framework for cross-center medical image segmentation. It reformulates the adaptation task as approximate Bayesian inference over input-space perturbations. The approach achieves improved performance and provides reliable uncertainty estimation without requiring access to source data or model parameters.
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
1.The paper is well-structured and easy to follow. 2.The black-box setting is challenging, and reformulating adaptation as approximate Bayesian inference over input-space perturbations is novel and interesting. 3.The methodology is clearly described, with each component explained in a straightforward and understandable manner.
- The experimental results are clearly presented and provide strong support for the proposed contributions.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
1.It is interesting that, in some cases, the black-box setting achieves results comparable to or even better than those of white-box methods. Please provide more detailed analysis and discuss the possible reasons behind this observation. 2.For the fixed-size FIFO memory bank, additional details would be helpful, such as its length, the rationale behind this choice, and an analysis of how the memory size affects performance, either qualitatively or quantitatively.
- Please rate the clarity and organization of this paper
Good
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The authors claimed to release the source code and/or dataset upon acceptance of the submission.
- Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?
N/A
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html
N/A
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(4) Weak Accept — marginally above the acceptance threshold, but would not mind if rejected, dependent on rebuttal
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
The paper is well-structured, problem setting is challenging but interesting and describes the methodology in a clear and detailed manner. It also offers comprehensive quantitative analyses of the results.
- Reviewer confidence
Confident but not absolutely certain (3)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
Accept
- [Post rebuttal] Please justify your final decision from above.
Most of my concerns have been clarified through the rebuttal.
Review #4
- Please describe the contribution of the paper
This paper addresses a pressing clinical deployment scenario: online medical image segmentation under a strict black-box constraint, where neither source data nor model parameters/gradients are accessible. The main contribution is reformulating black-box domain adaptation as approximate Bayesian inference in function space. Rather than updating the model, the method learns a posterior distribution over input-space perturbations in the frequency domain, specifically by modulating the amplitude spectrum while preserving the phase to maintain anatomical structures. This Bayesian perturbation model naturally enables (1) continuous online adaptation via querying the frozen black-box segmenter on perturbed inputs, and (2) reliable predictive uncertainty quantification by sampling from the learned posterior. Additional technical contributions include an uncertainty-gated memory bank with temporal smoothing to prevent catastrophic forgetting in the streaming setting, and semantic anchoring via phase consistency, which together stabilize the online adaptation.
- Please list the major strengths of the paper: you should highlight a novel formulation, an original way to use data, demonstration of clinical feasibility, a novel application, a particularly strong evaluation, or anything else that is a strong aspect of this work. Please provide details, for instance, if a method is novel, explain what aspect is novel and why this is interesting.
1.Clinically Relevant and Demanding Setting. The paper tackles a highly realistic scenario: a pre-trained segmentation model is deployed as a black box (no source data, no parameter access, model-agnostic) in a new clinical site and must adapt to streaming target data while also quantifying uncertainty. This triplet of requirements is rarely addressed jointly and is strongly motivated by privacy, IP protection, and trustworthiness needs. 2.Anatomically Constrained Perturbation Design. The use of frequency-domain amplitude modulation with explicit phase preservation is well-grounded in the nature of cross-center medical image shifts (appearance changes) and ensures that adapted samples remain anatomically faithful. This domain-aware design is a key enabler. 3.Strong Performance and Orthogonal Gains. The method consistently improves over source-only baselines across multiple datasets and modalities (echo, CT). Importantly, the approach is shown to be complementary to existing white-box TTA methods, boosting their performance further.
- Please list the major weaknesses of the paper. Please provide details: for instance, if you state that a formulation, way of using data, demonstration of clinical feasibility, or application is not novel, then you must provide specific references to prior work.
1.Unfair or Incomplete Comparison. The proposed method’s core paradigm, which uses a learnable input perturbation policy guided by a feedback criterion to adapt a frozen black-box model, is conceptually very similar to a growing family of learnable test-time augmentation (TTAug) approaches. These methods, including OptTTA (MIDL 2022) and Greedy Policy Search (Nag et al., UAI 2022), train or search for an optimal augmentation policy on the fly by minimizing prediction inconsistency, entropy, or other criteria, operating solely with forward passes. All of these can be trivially adapted to a black-box setting (e.g., by removing any BN-statistics-based critic) and thus constitute the most direct and relevant baselines for this work. Remarkably, the paper omits them from the main SOTA comparison tables (Tables 1 and 2) entirely. Instead, it predominantly compares against white-box TTA methods that inherently have access to model internals, and then reports “Ours+TENT” and “Ours+TEGDA” as complementary gains. This creates an apparent comparison asymmetry: the proposed black-box method is never pitted head-to-head against equally black-box-capable, learnable augmentation strategies in a standalone fashion. The absence of such a direct, fair comparison makes it impossible to assess whether the Bayesian perturbation framework offers genuine advantages over simpler, policy-search-based augmentation methods under identical black-box constraints. 2.Computational and Latency Overhead. The method requires multiple forward passes and additional online optimization per test sample, which dramatically increases inference latency compared to static models or single-pass TTA methods. For time-sensitive clinical applications (e.g., real-time echocardiography), this overhead may be prohibitive, yet no analysis of the speed-accuracy trade-off is provided. 3.Limited Hyperparameter Analysis. The authors state that all hyperparameters are shared across datasets, but a sensitivity analysis for thresholds (memory bank size, EMA rate, uncertainty percentile, frequency band) is not presented. It remains unclear how tightly these parameters must be tuned for a new imaging modality or clinical site, which could hamper the claimed black-box, model-agnostic deployment.
- Please rate the clarity and organization of this paper
Good
- Please comment on the reproducibility of the paper. Please be aware that providing code and data is a plus, but not a requirement for acceptance.
The authors claimed to release the source code and/or dataset upon acceptance of the submission.
- Based on your review and your understanding of the MICCAI Scientific Code of Ethics, do you believe this submission may involve a potential ethics concern or violation?
N/A
- Optional: If you have any additional comments to share with the authors, please provide them here. Please also refer to our Reviewer’s guide on what makes a good review and pay specific attention to the different assessment criteria for the different paper categories: https://conferences.miccai.org/2026/en/REVIEWER-GUIDELINES.html
N/A
- Rate the paper on a scale of 1-6, 6 being the strongest (6-4: accept; 3-1: reject). Please use the entire range of the distribution. Spreading the score helps create a distribution for decision-making.
(3) Weak Reject — marginally below the acceptance threshold, but would not mind if accepted, dependent on rebuttal
- Please justify your recommendation. What were the major factors that led you to your overall score for this paper?
The primary weakness is the lack of a head-to-head comparison against black-box-capable learnable test-time augmentation baselines. I hope the authors will address this in rebuttal.
- Reviewer confidence
Confident but not absolutely certain (3)
- [Post rebuttal] After reading the authors’ rebuttal, please state your final opinion of the paper.
Accept
- [Post rebuttal] Please justify your final decision from above.
The rebuttal has addressed my main concern by comparison with TTAug methods. The results and clarifications on efficiency and sensitivity are satisfactory.
Author Feedback
We thank reviewers for recognizing our novelty and practical relevance. Key responses: 1.Clarification of the black-box setting (R2): Our method strictly adheres to the black-box constraint. The deployed model F is never updated, and no gradients or internal parameters are accessed. For Eq. (5), optimization does not require backpropagation through F. Instead, we only query F(g_ϕ(x, z)) and compute gradients w.r.t. the perturbation network g_ϕ. 2.Fair comparison under identical constraints (R4): We construct black-box TTA variants of GPS and OptTTA by removing components that rely on gradients, BN statistics, or labeled target data, following fair standard protocols. On C→A, GPS and OptTTA achieve DSC of 68.31 and 68.77, respectively, while ours reaches 70.05; combining ours with GPS and OptTTA further improves to 72.62 and 73.03.On BTCV→WORD, GPS and OptTTA obtain 73.54 and 73.96, ours achieves 75.28, and the combinations reach 77.91 and 78.24.Unlike policy-search TTA, our method models a distribution over perturbations, improving robustness via multiple plausible alignments. 3.Effectiveness of Bayesian Perturbation (BP) (R2): BP alone provides limited gains as it defines a hypothesis space rather than a selection mechanism. Without posterior regularization, this space includes both beneficial and harmful perturbations. UP/MB/SA impose selection and stabilization, separating exploration from convergence, which explains the combined improvement. 4.Motivation of uncertainty and semantic consistency (R1, R2): Under black-box constraints, we cannot directly access source-domain supervision, so we rely on observable signals to estimate which perturbations improve prediction. Specifically, uncertainty and semantic consistency are used to select and weight more reliable views, rather than merely adding an extra layer. Low uncertainty indicates stable predictions, while high semantic consistency ensures that perturbations preserve anatomical content instead of introducing distortion. As shown in Sec. 3.4, this joint criterion enables effective filtering and aggregation of views, leading to improved target-domain performance rather than degradation. 5.Computational overhead (R4): Our method uses K=6 forward queries per sample plus a lightweight perturbation network. On an RTX3090, average runtime was 0.18s/image for 2D echo and 1.42s/volume for 3D CT, compared with 0.04s and 0.31s for Source. This cost is reasonable under strict black-box constraints and remains practical beyond real-time settings. 6.Online behavior (R1): Timestamp analysis shows the performance improves over the first 30–50 samples and stabilizes. Removing the memory bank leads to oscillation. Memory size has mild impact: on C→A, 32/64/128/256 yield DSC of 69.42/69.81/70.05/69.98, and on BTCV→WORD, 74.61/75.02/75.28/75.21.7.Hyperparameter sensitivity and memory bank (R2, R3, R4): We varied posterior samples K={2,4,6,8}, obtaining C→A DSC of 69.21/69.74/70.05/70.08.Thus K=6 provides a good accuracy-cost trade-off. EMA rate α∈[0.03,0.10], uncertainty 20–40%, and low-frequency band 20–30% changed DSC by <0.5, indicating robustness. 8.Physical meaning of frequency perturbations (R1): Amplitude modulation reflects known cross-center variations (e.g., intensity, contrast, scanner characteristics), while phase preserves anatomical structure. This design is consistent with prior medical imaging literature (Chen et al., 2021) and is validated in Table 5.We will expand discussion. 9.Performance and trustworthy deployment (R1): Our method achieves statistically significant performance improvements on the target domain under strict black-box constraints, remaining competitive with existing approaches without requiring gradients or parameter updates. Consistent with the no free lunch principle, we further provide calibrated uncertainty for reliable deployment in OOD scenarios. Section 3.4 and Table 6 show that our uncertainty estimation outperforms existing methods.
Meta-Review
Meta-review #1
- Your recommendation
Invite for Rebuttal
- Please justify your decision. In case you deviate from the reviewers’ recommendations, explain in detail the reasons why. In case of an invitation for rebuttal, clarify which points are important to address in the rebuttal.
The paper proposes a novel black-box test-time adaptation method using Bayesian frequency-domain input perturbations. While the clinical setting is realistic and the formulation is clever, reviewers raised critical methodological and empirical concerns. Specifically:
-if compare under identical constraints (R4).
-Clarify how optimizing Eq. 5 adheres strictly to a black-box setting without requiring backpropagation through the pre-trained model (R2).
-standalone effectiveness of the core Bayesian Perturbation (BP) module, as current results indicate it may degrade performance without auxiliary components (R2).
-analysis of inference latency/computational overhead and hyperparameter sensitivity.
- After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.
Accept
- Please justify your recommendation.
This paper presents a novel and clinically relevant approximate Bayesian inference framework for black-box test-time adaptation in medical image segmentation. In the post-rebuttal phase, the authors successfully resolved the reviewers’ primary technical concerns by demonstrating that the optimization of Equation 5 strictly adheres to black-box constraints without backpropagation through the frozen model, and by providing comprehensive comparisons against relevant learnable test-time augmentation baselines. Given the clear post-rebuttal consensus shift, robust empirical performance, and valuable uncertainty quantification, this work is recommended for acceptance.
Meta-review #2
- After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.
Accept
- Please justify your recommendation.
I recommend accept: post-rebuttal R4 raised to Accept (TTAug comparison + efficiency/sensitivity addressed) and R3 maintained Accept (nominated for Highlighted Poster), with R1 and R2 not updating (3 accept and 1 reject). The Bayesian frequency-domain perturbation framework for black-box cross-center segmentation is clinically motivated, and the rebuttal addressed the primary AC’s requests on comparison fairness, BP standalone effectiveness, and efficiency.
Meta-review #3
- After you have reviewed the rebuttal and updated reviews, please provide your recommendation based on all reviews and the authors’ rebuttal.
Accept
- Please justify your recommendation.
The paper proposes a black-box online test-time adaptation framework for cross-center medical image segmentation. The rebuttal has addressed the concerns raised by reviewer #3 and #4, three out of four reviewers moved to or maintained accept post-rebuttal. The authors should prepare the final version to carefully clarify the motivation of strategy design and the performance improvement raised by review #1.