SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Yang Yang $^{1}$ , Yuxuan Zhang $^{1}$ , Xin Song $^{2}$ , Yi Xu $^{3*}$
$^{1}$ Nanjing University of Science and Technology
$^{2}$ Baidu Talent Intelligence Center, Baidu Inc
$^{3}$ Dalian University of Technology
{yyang, xuan_zhang} @njust.edu.cn, songxin06@baidu.com, yxu@dlut.edu.cn
Active learning (AL) methods have been proven to be an effective way to reduce the labeling effort by intelligently selecting valuable instances for annotation. Despite their great success with in-distribution (ID) scenarios, AL methods suffer from performance degradation in many real-world applications because out-of-distribution (OOD) instances are always inevitably contained in unlabeled data, which may lead to inefficient sampling. Therefore, several attempts have been explored open-set AL by strategically selecting pure ID instances while filtering OOD instances. However, concentrating solely on selecting pseudo-ID instances may cause the training constraint of the ID classifier and OOD detector. To address this issue, we propose a simple yet effective sampling scheme, Progressive Active Learning (PAL), which employs a progressive sampling mechanism to leverage the active selection of valuable OOD instances. The proposed PAL measures unlabeled instances by synergistically evaluating instances' informativeness and representativeness, and thus it can balance the pseudo-ID and pseudo-OOD instances in each round to enhance both the capacity of the ID classifier and the OOD detector. Extensive experiments on various open-set AL scenarios demonstrate the effectiveness of the proposed PAL, compared with the state-of-the-art methods. The code is available at https://github.com/njustkmg/PAL.
Deep learning has achieved great success in many tasks such as image classification [14], article prediction [35], and graph classification [32]. The main factor underlying its excellent performance lies in the availability of an extensive dataset with manual annotations, which can be costly in real-world applications [16]. To reduce the high labeling cost, active learning is an effective approach that involves iteratively selecting valuable instances from the unlabeled data pool and querying their labels for model retraining [4].
The basic assumption shared by various existing active learning methods is that all unlabeled instances are collected from the ID domain [1, 28], showing that the labeled and unlabeled instances share the same distribution. However, this assumption is unrealistic in real-world scenarios as unlabeled instances are primarily gathered from the open world, where massive instances belong to the OOD domain. Taking the image classification task as an example, the goal is to classify mammals, but a considerable proportion of the unlabeled instances consists of unknown classes (i.e., OOD domain), such as bees, apples, and tables. Once these images are selected for labeling, it would be a waste of the annotation budget since they are not used for training the ID classifier. Therefore, it is important
to detect ID and OOD instances before the annotation in open-set AL, which is not applicable in traditional active learning methods. Consequently, the main challenge in open-set AL revolves around effectively selecting valuable ID instances for training classifier and distinguishing the OOD instances.
(a) The power of OOD instances.
(b) The proposed PAL process
Figure 1: (a) the effectiveness of actively querying valuable pseudo-OOD instances. ID Selection Recall (higher is better): the ratio of selected ID instances to the total number of ID instances. Acc: testing accuracy; w:/ with; w/o: without. Experiments are conducted on CIFAR-100 using the first 20 classes as seen classes. We employ (1) the traditional active learning method Coreset; (2) the existing open-set AL approach LfOSA that only selects pseudo-ID instances; and (3) the proposed PAL that actively queries pseudo-OOD instances to enhance the training of the detector and classifier. (b) the distinction between the proposed PAL process and the traditional open-set AL process (in the dashed rectangle). The proposed PAL includes an additional module (the process in red) that carefully leverages detected OOD instances during the model training progress.
To address the challenges of open-set AL, a few studies have proposed [12, 22, 23], which commonly attempt to effectively filter the OOD instances in the unlabeled pool by adopting an extra OOD detector, thus increasing the ID purity of instances in the query set. Their goal is to optimize the selection of ID instances while eliminating OOD instances during each query round, aiming to exclusively add ID instances for model training. In other words, these methods mainly focus on learning the ID classifier, consequently restraining the resolution of the OOD detector. In contrast, we believe that not all OOD instances are harmful, and valuable OOD instances are also significant for both the classifier and detector training. For example, as shown in Figure 1 (a), we observe that actively selecting OOD instances based on their importance (i.e., PAL method) can achieve higher classification accuracy and selection recall, which is attributed to the promotion of ID purity and OOD filtering. Therefore, valuable OOD instances can promptly strengthen the boundary between ID and OOD instances, and further improve the ID purity for classifier retraining.
To this end, we propose a simple yet effective Progressive Active Learning (PAL) scheme that strategically introduces valuable pseudo-ID and pseudo-OOD instances for enhancing both the ID classifier and OOD detector. Different from existing open-set AL methods that solely focus on selecting pseudo-ID instances, our approach goes a step further by actively incorporating valuable pseudo-OOD instances, which allows us to explicitly retrain the OOD detector in conjunction with ID instances, resulting in a mutual promotion of the detector and classifier. The proposed PAL process is illustrated in Figure 1(b). Besides, to comprehensively measure the unlabeled instances, we propose to estimate the informativeness of instances by calculating entropy using the predictions from one-vs-all (OVA) classifiers, while evaluating the representativeness of instances with the automatically learned meta-weights.
Active Learning. Active Learning aims to train a classifier by querying labels of the most valuable instances in the unlabeled data, which can greatly reduce the manual labeling cost [7]. The core idea of existing active learning approaches is to ensure that selected instances can significantly improve model performance, and various effective sampling strategies are designed [9, 24, 31, 37]. The initial sampling criteria is uncertainty-based sampling [4], which prefers to select instances that maximally reduce the model uncertainty. For example, [9] proposed an uncertainty measure that generalizes margin-based uncertainty; [37] employed the pairwise gradient length as a metric of informativeness.
Furthermore, various representativeness-based methods are proposed, which prefer to select instances that match the data distribution. For example, [24] estimated the expected reduction in error that directly optimizes expected future error; [1] designed batch active learning with diverse gradient embeddings, which sampled groups of instances that are disparate and high magnitude. However, this family of approaches usually assumes in-distribution settings that the unlabeled instances are drawn from the same distribution of labeled examples, which is not suitable for effectively filtering OOD instances during the query round.
Several recent approaches have attempted to carry out the open-set AL [3, 12, 22, 23]. [3] introduced a contrastive AL framework to learn two contrastive coding models for calculating informativeness and representativeness of an example; [22] introduced an auxiliary network to model the per-example max activation value distribution with a gaussian mixture model, which can dynamically select the instances with the highest probability from known classes in the unlabeled set; [23] employed the meta-learning technique to find the best trade-off between purity and informativeness; [12] selected a set that maximize the distance on entire unlabeled data while minimizing the distance to the identified OOD instances. However, we find that these attempts are limited in filtering OOD instances, as they usually assign greater weight to maintain ID purity, thus causing the learning constraint of the ID classifier and OOD detector. Consequently, it is vital to develop effective approaches that achieve a comprehensive balance between the ID classifier and the OOD detector.
Out-of-distribution Detection. OOD detection aims to identify instances outside the target domain [27, 30, 39], i.e., ID domain, which is vital for securing the model's safety and interpretability [15, 34]. Existing methods always calculate instances' confidence scores based on the predictions of the classifier trained on ID instances such as the entropy of the prediction distribution [2, 18, 33]. For example, [18] detected OOD instances with softmax score by considering temperature scaling and input pre-processing; [2] introduced a new model layer OpenMax, which used activation vectors to estimate the probability of deep network failure. To build a more robust detector, several approaches attempted to utilize the generative adversarial network to generate pseudo-OOD instances for assisting learning. For example, [11] proposed task-aware variation adversarial AL that considered data distribution of both label and unlabeled pools; [8] confirmed that generative model accuracy may not always be positively correlated with OOD detection performance. Nonetheless, the advantage of open-set AL lies in the existence of OOD instances within the unlabeled pool, making the fine-grained usage of OOD instances possible.
Figure 2: Framework of the proposed Progressive Active Learning (PAL). We initialized the ID classifier and OOD detector with the ID labeled data. During the query rounds, we explicitly query both pseudo-ID and pseudo-OOD instances with the designed sampling criterion to enhance the ID classifier and OOD detector.
Problem Setting. We denote by the labeled data  $\mathcal{D}_l = \{(\mathbf{x}_i^l,\mathbf{y}_i^l)\}_{i = 1}^{N_l}$ , where each  $\mathbf{x}_i^l$  belongs to the  $C$  known labels  $\mathbf{y}_i^l\in \mathbf{R}^C$  and the unlabeled data  $\mathcal{D}_u = \{\mathbf{x}_j^u\}_{j = 1}^{N_u} = \{\mathcal{D}_u^{ID},\mathcal{D}_u^{OOD}\}$ , where  $\mathcal{D}_u^{ID}$  denotes the ID unlabeled data and  $\mathcal{D}_u^{OOD}$  represents the OOD unlabeled data,  $\mathcal{D}_u^{ID}\cap \mathcal{D}_u^{OOD} = \emptyset$ . In other words, an unlabeled instance  $\mathbf{x}_j^u$  may belong to an unknown class. In active learning, a human oracle is requested to label query set  $\mathcal{D}_{query}^t$  at  $t$ -th query round, which consists of OOD query set  $\mathcal{D}_{query}^{OOD_t}$  and ID query set  $\mathcal{D}_{query}^{ID_t}$  (i.e.,  $\mathcal{D}_{query}^t = \mathcal{D}_{query}^{OOD_t}\cup \mathcal{D}_{query}^{ID_t}$ ). Considering the restrictions on the annotation budget, the task of traditional open-set AL is to construct the query set that contains more ID instances for assisting ID classifier building.
Approach Overview. The framework of the proposed PAL is illustrated in Figure 2, including two key components: 1) importance score considering both informativeness and representativeness; 2) progressive sampling mechanism that precisely manages the ID and OOD instances within the query set. Diverging from traditional open-set AL attempts, we adopt a strategy of actively selecting the valuable pseudo-ID and pseudo-OOD instances to enhance the capacities of the classifier and detector simultaneously. In the following subsections, we first introduce the calculations of the importance score and then give the details of progressive sampling. Finally, we present a theoretical understanding of using OOD instances.
3.1 Sampling Criteria
Uncertainty weight. To investigate the informativeness, we employ the one-vs-all (OVA) classifiers [26] to learn a boundary between ID and OOD instances. In detail, OVA classifiers include  $C$  sub-classifiers, each one is to distinguish whether the instance belongs to the corresponding class or not, e.g., the prediction of  $c$ -th sub-classifier can be denoted as  $\mathbf{p}^c (\mathbf{x}^l) = f^c (g(\mathbf{x}^l))\in \mathbf{R}^2$ , where  $g$  represents the feature encoder,  $f^{c}$  denotes the  $c$ -th classifier. That is to say,  $\mathbf{p}^c (\mathbf{x}^l)\coloneqq (\mathbf{p}^c (p = 1|\mathbf{x}^l),\mathbf{p}^c (p = 0|\mathbf{x}^l))$ , where  $\mathbf{p}^c (p = 1|\mathbf{x}^l)$  and  $\mathbf{p}^c (p = 0|\mathbf{x}^l)$  denotes the probability of instance being an ID and an OOD respectively for class  $c$ . The overall loss of the OVA classifiers can be formulated as:
$$
\ell_ {O V A} = - \sum_ {i = 1} ^ {N _ {l}} \left(\log \mathbf {p} ^ {y _ {\mathbf {x} _ {i} ^ {l}}} (p = 1 | \mathbf {x} _ {i} ^ {l}) + \min  _ {c \neq y _ {\mathbf {x} _ {i} ^ {l}}} \log \mathbf {p} ^ {c} (p = 0 | \mathbf {x} _ {i} ^ {l})\right), \tag {1}
$$
where  $y_{\mathbf{x}_i^l}$  denotes the class of instance  $\mathbf{x}_i^l$ . Following [26], we adopt the hard-negative sampling technique for sub-classifiers. The core idea of OVA classifiers is that each sub-classifier outputs a distance representing how far the input is from the corresponding class [26]. Therefore, the sub-classifiers are effective in identifying OOD instances. To be specific, the probability of instance  $\mathbf{x}^u$  to be an ID can be calculated by  $s^{ID} = 1 + \mathbf{p}^{\hat{c}}(p = 1|\mathbf{x}^u)\log \mathbf{p}^{\hat{c}}(p = 1|\mathbf{x}^u)$ , where  $\hat{c} = \arg \max_c\mathbf{p}^c (p = 1|\mathbf{x}^u)$ . Actually,  $s^{ID}$  can express the informativeness of a given unlabeled instance, and larger  $s^{ID}$  represents more likely the instance to be an ID instance.
Meta-weight. In addition to  $s^{ID}$ , we design a representativeness criterion by learning the meta-weight of each unlabeled instance. Since the OOD instance in unlabeled set leads to a distribution mismatch, inspired by [5], we aim to automatically learn the weight of each unlabeled instance via tracking the effect of the supervised learning model to prevent OOD instances, which can be formulated as the following bi-level optimization problem:
$$
\min  _ {\omega} \sum_ {i = 1} ^ {N _ {l}} \ell_ {s u p} \left(\mathbf {x} _ {i} ^ {l}, \mathbf {y} _ {i} ^ {l}, \hat {\Theta} (\omega)\right), \tag {2}
$$
$$
s. t. \quad \hat {\Theta} (\omega) = \arg \min  _ {\Theta} \sum_ {i = 1} ^ {N _ {l}} \ell_ {s u p} \left(\mathbf {x} _ {i} ^ {l}, \mathbf {y} _ {i} ^ {l}, \Theta\right) + \sum_ {j = 1} ^ {N _ {u}} \omega_ {j} \ell_ {u n} \left(\mathbf {x} _ {j} ^ {u}, \Theta\right),
$$
where  $\Theta = (\Theta_{1},\Theta_{2})$ $\ell_{sup}(\mathbf{x}_i^l,\mathbf{y}_i^l,\Theta) = -\sum_{c = 1}^{C}\mathbf{y}_i^l\log f_{\Theta_1}^{o,c}(g_{\Theta_2}(\mathbf{x}_i^l))$  is the supervised loss,  $\ell_{un}(\mathbf{x}_j^u,\Theta) = -\sum_{c = 1}^{C}f_{\Theta_1}^{o,c}(g_{\Theta_2}(\mathbf{x}_j^u))\log f_{\Theta_1}^{o,c}(g_{\Theta_2}(\mathbf{x}_j^u))$  is the unsupervised loss, and  $f^o$  denotes the ID classifier. The problem (2) captures the process of learning the optimal model parameter  $\hat{\Theta} (\omega)$
through empirical risk minimization using labeled and weighted unlabeled instances, the model is then evaluated on  $\mathcal{D}_l$  to optimize the weights, aiming to enhance the reliable performance. Thus, the learned  $\omega$  is considered as the measurement of representativeness, with higher values indicating that ID instances are more representative.
3.2 Progressive Sampling
Open-set AL aims to precisely select as many ID instances as possible from the unlabeled pool. With the  $s^{ID}$  and  $\omega$ , we select the first  $b$  instances with the highest probability as the query set:
$$
u n \left(\mathbf {x} ^ {u}\right) = \omega + \mu s ^ {I D} \tag {3}
$$
where  $\mu$  is the hyper-parameter. However, unlike existing open-set AL attempts that only concern ID selection, we empirically find that valuable OOD can enhance the detector and further boost ID selection. Therefore, we propose a simple yet effective progressive sampling. To be specific, in each round, we actively select  $b$  instances including  $N_{query}^{ID}$  pseudo-ID instances and  $N_{query}^{OOD}$  pseudo-OOD instances, noting that we select OOD instances with the lowest  $un(\mathbf{x}_j^u)$ . At the first query, we set  $N_{query}^{OOD} \gg N_{query}^{ID}$ . After that, the OVA classifiers are extended to  $C + 1$  classifiers, and the  $un(\mathbf{x}^u)$  is given by
$$
u n \left(\mathbf {x} ^ {u}\right) = \left\{ \begin{array}{l l} \omega + \mu \left(1 - s ^ {I D}\right), & \text {i f} \hat {c} = C + 1 \\ \omega + \mu s ^ {I D}, & \text {o t h e r w i s e} \end{array} \right. \tag {4}
$$
3.3 Classifier Training
Based on the newly labeled data  $\mathcal{D}_{query}^{t}$ , we retrain both the ID classifier and OOD detector. In detail, the current ID labeled data can be represented as  $\mathcal{D}_l^t = \mathcal{D}_l^{t - 1}\cup \mathcal{D}_{query}^{ID_t}$ , where  $\mathcal{D}_l^{t - 1}$  denotes the accumulated ID labeled data,  $\mathcal{D}_{query}^{ID_t}$  denotes the ID labeled data from the detected ID data. The ID classifier  $f^o$  is learned by minimizing the supervised loss  $\sum_{i = 1}^{|\mathcal{D}_l^t|}\ell_{sup}(\mathbf{x}_i^l,\mathbf{y}_i^l,\Theta)$ . On the other hand, the current ID and OOD data for training OVA classifiers can be denoted as  $\mathcal{D}_{l_{all}}^{t} = \mathcal{D}_{l_{all}}^{t - 1}\cup \mathcal{D}_{query}^{t}$ , where  $\mathcal{D}_{l_{all}}^{t - 1}$  denotes the accumulated ID and OOD labeled data. Notably, in the first round, the number of classes for detector  $f^c$  is  $C$ , and we train  $f^c$  with the initial  $D_l$ . In the subsequent rounds, the number of classes for detector  $f^c$  is expanded to  $C + 1$  by actively adding the OOD data. In each round, we retrain the  $f^c$  according to loss  $\ell_{ova}$ . The final target of open-set AL is the ID classification, and thereby we can adopt the  $f^o$ .
3.4 Theoretical Understanding
To theoretically understand the use of detected OOD instances in the OOD detector, we first give the following notations. Suppose that the samples  $(\mathbf{x},y)\in (\mathcal{X},\mathcal{Y})$  follows a unknown distribution  $\mathcal{P}$ , where  $\mathcal{X} = \mathbf{R}^d$  is input space and  $\mathcal{Y} = \{0,1\}$  is output space. The label of ID instance is  $y = 0$  and the label of OOD instance is  $y = 1$ . Let  $\ell :\mathbf{R}\times \mathcal{Y}\longrightarrow \mathbf{R}^{+}$  be the loss of interest. With the input  $\mathbf{x}$  and its corresponding label  $y$ , the expected loss is  $\mathcal{L}(f) = \mathbb{E}_{\mathcal{P}}[\ell (f(\mathbf{x}),y)]$ . Suppose we have a training dataset  $\{(x_{1},y_1),\ldots ,(x_{n},y_n)\}$  drawn from distribution  $\mathcal{P}$ , then the empirical loss is  $\widehat{\mathcal{L}} (f) = \frac{1}{n}\sum_{i = 1}^{n}\ell (f(\mathbf{x}_i),y_i)$ . Let  $C(\mathcal{F})$  be some proper complexity measure of the family of hypothesis class  $\mathcal{F}$ . We assume that the loss is Lipschitz with constant  $L$  and the Rademacher complexity  $\Re_n(\mathcal{F})\leq \sqrt{\frac{C(\mathcal{F})}{n}}$  [10]. To simplify the analysis, we assume the distribution of ID and OOD samples is balanced and the number of OOD samples is the same as the number of ID samples in the training set. We suppose that the number of detected ID instances is  $m$  while the number of detected OOD instances is  $n - m$  where  $m < n$ , and among the detected ID instances, the number of real ID instances is  $m_0\coloneqq \alpha m$  while the number of real OOD instance is  $m_{1}\coloneqq (1 - \alpha)m$  with  $0 < \alpha < 1$ . Then we present the following theorem, whose proof can be found in the supplementary material.
Theorem 1 For a Lipschitz loss  $\ell$  bounded by  $c$ , we have the following results with probability at least  $1 - \delta$  simultaneously. For the proposed PAL method, the generalization error bound is
$$
\mathcal {L} \left(f _ {P A L}\right) - \widehat {\mathcal {L}} \left(f _ {P A L}\right) \leq 2 L \sqrt {\frac {C (\mathcal {F})}{n}} + c \sqrt {\frac {\log (1 / \delta)}{2 n}} \leq O \left(\frac {1}{\sqrt {n}}\right). \tag {5}
$$
For the standard AL method, the generalization error bound is
$$
\begin{array}{l} \mathcal {L} (f _ {A L}) - \widehat {\mathcal {L}} (f _ {A L}) \leq L \sqrt {\frac {C (\mathcal {F})}{\alpha m}} + L \sqrt {\frac {C (\mathcal {F})}{(1 - \alpha) m}} + \frac {c}{2} \sqrt {\frac {\log (2 / \delta)}{2 \alpha m}} + \frac {c}{2} \sqrt {\frac {\log (2 / \delta)}{2 (1 - \alpha) m}} \\ \leq O \left(\frac {1}{\sqrt {\alpha m}} + \frac {1}{\sqrt {(1 - \alpha) m}}\right). \tag {6} \\ \end{array}
$$
Remark. Since  $0 < \alpha < 1$  and  $n < m$ , we know  $\frac{1}{\sqrt{n}} \leq \frac{1}{\sqrt{\alpha m}} + \frac{1}{\sqrt{(1 - \alpha)m}}$ , showing that the generalization error bound for PAL method is better than the bound for standard AL method. That is to say, the use of detected OOD instances can improve the effectiveness of the OOD detector.
In this section, we aim to demonstrate the effectiveness of the proposed PAL. Due to the page limitation, more experimental results and details can be found in the supplementary material.
Datasets. We evaluate the efficiency of PAL on several image classification benchmarks, i.e., CIFAR-10, CIFAR-100 [13] and Tiny-Imagenet [36] datasets following standard open-set AL methods [12, 22]. The CIFAR-10 dataset consists of 50,000 training images and 10,000 test images, with 10 classes and 5,000 images per class in the training set. The CIFAR-100 dataset has 100 classes and 50,000 training images and 5,000 test images, with 500 images per class in the training set. The Tiny-Imagenet dataset consists of 100,000 training images and 10,000 validation images, with 200 classes and 500 images per class in the training set. To construct the open-set ALscenarios, following [22], we set the proportion of ID classes as  $20\%$ ,  $30\%$ , and  $40\%$  in experiments. For example, when the proportion is set as  $20\%$  on CIFAR-10, CIFAR-100, and Tiny-Imagenet, the first 2, 20, and 40 classes are considered as ID classes and the last 8, 80, and 160 classes are considered as OOD classes.
Table 1: Comparison of testing accuracy (\%) on CIFAR-10, CIFAR-100, and Tiny-Imagenet datasets with an ID proportion of  $20\%$ . The best results are highlighted in bold, and the second-best results are underlined.
Datasets	CIFAR-10	CIFAR-100	Tiny-Imagenet
Rounds	1	3	5	7	9	1	3	5	7	9	1	3	5	7	9
Label Only	78.6	42.5	21.4
Random	88.1	93.1	95.9	96.9	97.4	44.6	49.2	52.2	54.5	56.7	22.9	26.8	32.7	37.8	39.2
Uncertainty	88.2	93.0	96.1	97.2	97.5	44.4	49.4	49.7	54.8	55.3	21.6	28.5	35.6	37.6	41.1
Certainty	88.1	90.8	91.6	92.4	93.0	45.0	50.7	53.1	54.4	54.9	21.7	27.9	35.4	39.8	44.7
Coreset	86.5	94.7	95.8	96.7	96.8	43.6	49.5	51.9	55.0	57.0	23.1	26.3	33.0	39.9	43.3
BALD	84.6	93.1	94.3	96.4	96.7	42.9	48.1	52.3	54.4	56.2	22.9	26.8	32.9	38.1	39.2
OpenMax	81.3	85.8	86.6	87.0	90.7	45.0	47.3	50.1	53.9	56.0	22.0	26.1	32.2	36.9	41.9
CCAL	88.9	94.3	96.2	97.4	97.7	45.1	50.9	53.4	57.2	60.4	23.2	28.5	35.6	40.6	44.9
MQnet	88.8	94.9	96.8	97.4	97.8	45.3	51.1	57.9	59.1	61.3	23.8	28.6	35.7	42.0	45.8
LfOSA	84.2	95.4	97.1	97.5	98.3	45.6	52.2	59.0	62.5	66.1	22.6	28.8	36.4	43.7	47.9
PAL	91.1	95.6	97.6	98.5	98.7	45.6	53.0	60.0	65.6	69.4	24.3	33.4	43.9	47.6	52.1
Baselines and Performance criteria. We compare PAL with three different types of methods: 1) supervised method, i.e., Label Only. 2) traditional AL methods, i.e., Random, Uncertainty [17], Certainty [20], Coreset [28], Openmax [2], and BALD [29]. 3) open-set AL methods, i.e., CCAL [3], LfOSA [22] and MQnet [23]. We consider performance from two aspects: 1) ID classification, i.e., classification accuracy. 2) OOD detection during query round, i.e., precision and recall [22].