Turning the Curse of Heterogeneity in Federated Learning into a Blessing for Out-of-Distribution Detection
Authors: Shuyang Yu
Junyuan Hong
Haotao Wang
Zhangyang Wang
Jiayu Zhou
Venue: ICLR 2023 notable top 25% (2023)
Keywords: out-of-distribution detection
federated learning
heterogeneity

Abstract: Deep neural networks have witnessed huge successes in many challenging prediction tasks and yet they often suffer from out-of-distribution (OoD) samples, misclassifying them with high confidence. Recent advances show promising OoD detection performance for centralized training, and however, OoD detection in federated learning (FL) is largely overlooked, even though many security sensitive applications such as autonomous driving and voice recognition authorization are commonly trained using FL for data privacy concerns. The main challenge that prevents previous state-of-the-art OoD detection methods from being incorporated to FL is that they require large amount of real OoD samples. However, in real-world scenarios, such large-scale OoD training data can be costly or even infeasible to obtain, especially for resource-limited local devices. On the other hand, a notorious challenge in FL is data heterogeneity where each client collects non-identically and independently distributed (non-iid) data. We propose to take advantage of such heterogeneity and turn the curse into a blessing that facilitates OoD detection in FL. The key is that for each client, non-iid data from other clients (unseen external classes) can serve as an alternative to real OoD samples. Specifically, we propose a novel Federated Out-of-Distribution Synthesizer (FOSTER), which learns a class-conditional generator to synthesize virtual external-class OoD samples, and maintains data confidentiality and communication efficiency required by FL. Experimental results show that our method outperforms the state-of-the-art by 2.49%, 2.88%, 1.42% AUROC, and 0.01%, 0.89%, 1.74% ID accuracy, on CIFAR-10, CIFAR-100, and STL10, respectively.

Published as a conference paper at ICLR 2023
TURNING THE CURSE OF HETEROGENEITY IN FED- ERATED LEARNING INTO A BLESSING FOR OUT-OF- DISTRIBUTION DETECTION
Shuyang Yu', Junyuan Hong', Haotao Wang", Zhangyang Wang² and Jiayu Zhou'
DDeparmment of Computer Science and Engineering. Michigan State University *Department of Electrical and Computer Engineering. University of Texas at Austin (yushuyan, hong jul jiayuz) @msu. edu, (htwang, at atlaswnng y @utexas. edu
ABSTRACT
Deep neural networks have witnessed huge successes in many challenging pre- diction lasks and yet they often suffer from out-of-distribttion (OoD) samples, misclassifying them with high confidence. Recent advances show promising OoD detection performance for centralized training, and however, OoD detection federated learning (FL) is largely overlooked, even though many security sensitive applications such as autonomous driving and voice recognition authorization are commonly trained using FL for data privacy concerns. The main challenge that prevents previous state-of-the-ar art OoD detection methods from being incorporated to FL is that they require large amount of real OoD samples. However, in real-world scenarios, such large-scale OoD training data can be costly or even infeasible to obtain, especially for resource- limited local devices. On the other hand, notorious challenge in FL is data heterogeneity where each client collects non-identically and independently distributed (non-iid) data. We propose to take advantage of such heterogeneity and turn the curse into a blessing that facilitates OoD detection in FL. The key that for each client, non-iid data from other clients (unseen alternative to real OoD samples. Specifically, Synthesizer (FOSTER), which
external classes) can serve nut-of-Distributinn we propose novel Federated learns class-conditional generator to synthesize virtual external-class Ool) sam- ples, and maintains data confidentiality and communication efficiency required by FL. Experimental results show that method outperforms the state-of-the-att for OoD tasks by 2.49% 2.88%, 1 1.42% AUROC, and 0.01 %, 0.89%, 1.74% ID accuracy, on CIFAR-10, CIFAR-100 and STL10, respectively. Codes available: https://githuue com wwwiiinnnnnllnn ab/SOTRR..
INTRODUCTION
Deep neural networks (DNNs) have demonstrated exciting predictive performance in many challeng- ing machine learning tasks and have transformed various industries through their powerful prediction capability. However, is well-known that DNNs tend to make overconfident predictions about what they do know. Given an -idt----iitiittiinn (OoD) test sample that does not belong to any training classes, DNNs may predict it one of the training classes with high confidence, which is doomed to be wrong (Hendrycks Gimpel, 2016; Hendrycks et al., 2018; Hein et al., 2019).
To alleviate the overconfidence issue, various approaches are proposed to learn OoD awareness which facilitates the test-time detection of such OoD samples during training. Recent approaches are mostly achieved by regularizing the learning process via OoD samples. Depending on the sources of such samples, the approaches can be classified into two categories: 1) the real-data approaches rely on a large volume of real outliers for model regularization (Hendrycks al., 2018; Mohseni al., 2020; Zhang et al., 2021); 2) the synthetic approaches use ID data to synthesize OoD samples, in which a representative approach is the virtual outlier synthesis (VOS) (Du et al., 2022).
While both approaches are shown effective in centralized training, they cannot be easily incorporated into federated learning, where multiple local clients cooperatively train high-quality centralized

---

Published as a conference paper at ICLR 2023
model without sharing their raw data (Konečný al., 2016), shown by experimental results in Section 5.2. On the one hand, the real-data approaches require substantial real outliers, which can be costly even infeasible to obtain, given the limited resources of local clients. On the other hand, the limited amount of data available in local devices is usually far from being sufficient for synthetic approaches to generate effective virtual OoD samples.
Practical federated learning approaches often suffer from the curse of heterogeneous data in clients, where non-iid (Li et al., 2020b) collaborators cause huge pain in both the learning process and model performance in FL (Li et al., 2020a). Our key intuition is to turn the curse of data heterogeneity into a blessing for OoD detection: The heterogeneous training data distribution in FL may provide a unique opportunity for the clients to communicate knowledge outside their training distributions and learn OoD awareness. A major obstacle to achieving this goal, however, the stringent privacy requirement of FL.. FI. clients cannot directly share their data with collaborators. This motivates the key research question: How to learn Ool awareness from non-iid federated collaborators while maintaining the data confidentiality requirements in federated learning?
In this paper, we tackle this challenge and propose Federated Out-of-distributtio SynThesizER (FOSTER) to facilitate OoD learning in FL. The proposed approach leverages non-iid data from clients to synthesize virtual OoD samples in a the common learning setting of class non-iid (Li et al., 2020b), and each client extracts the external class knowledge from other non-iid clients. The server first learns a virtual OoD sample synthesizer utilizing the global classifier, which is then broadcast to local clients generate their own virtual Ool) samples. The proposed FOSTER promotes diversity of the generated OoD samples by incorporating Gaussian noise, and ensures their hardness by sampling from the low-likelihood region of the class-conditional distribution estimated. Extensive empirical results show that by extracting only external-clat knowledge, FOSTER outperforms the state-of-our of-out for OoD benchmark detection tasks.
manner. Specifically, we consider
The main contributions of our work can be summarized as follows:
We propose a novel federated OoD synthesizer to take advantage of data heterogeneity to facilitate Ool) detection in FL., allowing client to learn external class knowledge from other non-iid federated collaborators in a privacy-aware manner. Our work bridges a critical research gap since OoD detection for FL is currently not yet well-studied in literature. To our knowledge, the proposed FOSTER is the first OoD learning method for FL that does not require real OoD samples.
The proposed FOSTER achieves the -ar performance using only limited ID data stored in each local device, as compared to existing approaches that demand large volume of OoD samples.
The design of FOSTER considers both the diversity and hardness of virtual OoD samples, making them closely resemble real OoD samples from other non-iid collaborators.
As a general OoD detection framework for FI., the proposed FOSTER remains effective more challenging FL. settings, where the entire parameter sharing process is prohibited due to privacy or communication concerns. This is because that FOSTER only used the classifier head for extracting external data knowledge.
RELATED WORK
OoD detection. Existing OoD detection methods are mainly from two complementary perspectives. The first perspective focused on post hoc. Specifically, Hendrycks & Gimpel (2016) first introduced a baseline utilizing maximum softmax distribution probabilities (MSP). Based in this work, many improvements have been made by follow-up works in recent years, such as the calibrated softmax score (ODIN) (Liang et al., 2017 7), Mahalanobis distance (Leee et al., 2018), energy score (Liu et al., 2020), Likelihood Regret (Xiao et al., 2020), Confusion Log Probability (CLP) score (Winkens et al., 2020), adjusted energy score Lin et al. (2021), k-th nearest neighbor (KNN) (Sun et al., 2022), and Virtual-logit Matching (ViM) (Wang et al., 2022). Compared with post hoc methods, FOSTER can dynamically shape the uncertainty surface between ID and OoD samples. Different post hoc methods also applied in our experiment section baselines.
Another perspective tends to detect OoD samples by regularization during training, in which OoD samples are essential. The OoD samples used for regularization can be either real OoD samples or
2

---

Published as a conference paper at ICLR 2023
virtual synthetic OoD samples. Real OoD samples are usually natural auxiliary datasets (Hendrycks et al., 2018; Mohseni et al., 2020; Zhang et al., 2021). However, real OoD samples are usually costly to collect or infeasible to obtain, especially for terminals with limited sources. Regularization method utilizing virtual synthetic OoD samples do not rely on real outliers. Grcić et al. (2020) trained generative model to obtain the synthetic OoD samples. Jung et al. (2021) detect samples with different distributions by standardizing the max logits without utilizing any external datasets. Tack al. (2020); Schwag et al. (2021) proposed contrastive learning methods that also does not rely on real OoD samples. Du et al. (2022) proposed VOS to synthesize virtual OoD samples based on the low- lwwliiklihood region of the class-conditional Gaussian distribution. Current state-of-the -frt virtual OoD methods are usually thirsty for ID data, which is not sufficient enough for local clients. Compared with these existing methods, the proposed FOSTER can detect OoD samples with limited ID data stored in each local device, without relying any auxiliary OoD datasets.
Federated Learning. Federated learning (FL. an effective machine learning setting that enables multiple local clients to cooperatively train a high-quality centralized mode (Konečný et al., 2016). FedAvg (McMahan et al., 2017), as a classical FL model, performs model averaging of distributed local models for each client. It shows an excellent effect reducing the communication cost. Based on FedAvg, many variants (Wang& & Joshi, 2018; Basu et al., 2019) have been proposed to solve the problems arising in FedAvg, such convergence analysis (Kairouz et al., 2021; Qu et al., 2020), heterogeneity (Li et al., 2020a; Hsu et al., 2019; Karimireddy et al., 2020; Zhu et al., 2021), communication efficiency (Reddi et al., 2020). Among these problems, although heterogeneity of data will make the performance of ID data worse, it will give us a great chance to learn from the external data from other non-iid collaborators. Even though FOSTER is used the FedAvg framework. as general OoD detection method for FL., FOSTER can also be applied to other variants of FedAvg.
3 PROBLEM FORMULATION
In this paper, we consider classification tasks in heterogeneous FL settings, where non-iid clients have their own label set for training and testing samples. Our goal is to achieve OOD-awareness on each client in this setting.
OoD training. The OoD detection problem roots in general supervised learning, where we learn classifier mapping from the instance space X' to the label space y. Formally, we define a learning
task by the composition of data distribution 'D C X' and ground-truth labeling oracle c* : X -> y Then any x ~ 'D is denoted as in-distribution (ID) data, and otherwise, x Q C X')D as out- of-distribution data. Hence, an ideal OoD detection oracle can be formulated as binary classifier (x()) I(x ~ D), where Il is an indication function yielding 1 for ID samples and -1 for OoD samples. With these notations, we define the OoD learning task as
(D, 2,,
To parameterize the labeling and OoD oracles, we use a neural network consisting of two stacked components: a feature extractor f : X + Z governed by 05, and a classifier / Z + y governed by e", where Z is the latent feature space. For the ease of notation, let h2(2) denote the predicted logit for class 1.....c c on extracted feature: 2 ~ Z. We unify the parameters of the classifier as (0', )²). ). We then formulate the OoD training as minimizing the following loss on the task T:
(0) = Ea-D [ee (M([(x; 0²); (0), cx)) + A Ex [CoR (I(r' ( )²)
where lcE the cross-entropy loss for supervised learning and foR is for OoD regularization. We use E[-] to denote the expectation estimated by the empirical average samples in practice. The non-negative peper-parameter trade off the OoD sensitivity in training. We follow the classic OoD training method, Outlier Exposure (Hendrycks et al., 2018), to define the OoD regularization for classification problem as
loE(='; 0h) E(=':0))
E hz(2';0"), 1
(I)
where E(2);0')= -TTlg Ei Aut='-0"//T is the energy function, given the temperature parameter T > 0. At test time, we approximate the OoD oracle 9" by the MSP score (Hendrycks & Gimpel, 2016).
Heterogeneous federated learning (FL) is a distributed learning framework involving multiple clients with non-iid data. There are different non-iid settings (Li et al., 2020b; 2021), and in this paper,
3

---

Published as a conference paper at ICLR 2023
follow popular setting that the non-iid property is only concerned with the classes (Li et al., 2020b). Given K clients, we define the corresponding set of tasks {Tx where Tx = (Dx, Qx og) and of X + ykc are non-identical for different & resulting non-identical DR. Each ) is a subset of the global label set y. Since the heterogeneity is known to harm the convergence and performance of FL (Yu et al., 2020), we adopt a simple personalized FL solution to mitigate the negative impact, where each client uses personalized classifier head h2 upon a global feature extractor (Arivazhagan et al., 2019). This gives the general objective of FL: ming 1 Σx= JT. (0). The optimization problem can be solved alternatively by two steps: 1) local minimization of the objective on local data and 2) aggregation by averaging client models. In this paper, we assume that each client only learns classes they see locally during training, because updating classifier parameters for unseen classes has no data support and doing so will almost certainly harm the performance FL. To see this, Diao et al. showed that masking out unseen classes in the cross-entropy loss can merit the FL training (Diao et al., 2020).
Challenges. When we formulate the OoD training in FL, the major challenge is defining the OoD dataset 2x. which does not come for free. The centralized OoD detection of VOS assumes 2* is the tail of estimated Gaussian distribution of Dx (Du et al., 2022), which requires enormous examples from Dr for an accurate estimation of parameters. However, such a requirement is usually not feasible for client per se, and the construction of Q remains challenging question.
METHOD
In this section, we first introduce the intuition of our proposed FOSTER, then elaborate on how to synthesize virtual external class data and avoid the hardness fading of the virtual Ool) samples. The proposed framework is illustrated in Fig. 1.
Step 1: Train Generator
Step 2: Train Local Model
N(O.
N(O.))
Arbitrary External label set
Generator
Local Data
y
Gy
Generator
Arbitrary label set
D2
Fealure Extractor
Gw
y
6
Global classifier
x- D
G-G
= fx: o
| Sampling
Cross-entrogy-
classifier
((w)
Virtual outliers
Figure 1: The framework FOSTER. In step 1, to extract external class knowledge from local clients, the server first trains generator utilizing the global classifier based cross-entropy objective function J (w) (Eq. (2)). In step 2, each local client utilizes the generator received to generate their own external class data To preserve the hardness of the virtual OoD samples, we also sample virtual outliers Va from the low-likelihood region of the consiiooniiional distribution estimated for the generated OoD samples. The virtual OoD samples V& are used for regularization of local client objective (Os) (Eq. (5)).
4.1 NATURAL OOD DATA IN NON-IID FL.
Recent advances show promising OoD detection performance by incorporating OoD samples during the training phase, and however, Ool detection in FI. is largely overlooked. In FL. each client does not have access to a large volume of real OoD samples because it can be costly or even infeasible to obtain such data for resource-constraine devices. As such, an OoD training method for FL that relies on few or even no real OoD examples is strongly desired. Novel to this work, we notice that data from classes out of the local class set, namely external-clan data, natural OoD samples w.t.. the local data and can serve as OoD surrogate samples in OoD training. As shown in Fig. 2, training w/ external-clasy data achieves better Ool detection performance than normal training and
4

---

Published as a conference paper at ICLR 2023
VOS, since the score of ID and real OoD data is well separated. Besides, compared to the real OoD dataset adopted in prior arts, external-clss. samples are likely to be nearer to the ID data, since they sampled from similar feature distributions (refer to (a) and (b) in Fig. 2).
60
Rxses siree
47-
62-
Negatie wwwgg 2008
Supatter elengy Score
(a) Normal training.
(b) Training w/ VOS.
(c) Training w/ external-class data.
Figure 2: The density of negative energy score for OoD detection evaluation using dataset Textures.
We use 5 ID classes, and 5 external classes of CIFAR-10.
4.2 SYNTHESIZING EXTERNAL-CLAS DATA FROM GLOBAL CLASSIFIER
Though using external-class data OoD surrogate is attractive and intuitive, it not feasible in FL to directly collect them from other non-iid clients, due to privacy concerns and high communication costs on data sharing.
We thereby propose to generate samples from the desired classes leveraging the encoded class information in the global classifier head. Given the global classifier H 2 + parameterized by 0 we utilize w-governed conditional generative network Gw y Z generate samples from specified classes on clients' demand. As such, we solve the following optimization problem:
min J(w) Eyrptt) Geu
(2)
where p(y) is the ground-trute prior which is assumed to be uniform distribution here. We follow the common practice of the generative networks (Zhu et al., 2021) to let y be a one-hot encoding vector, where the target class entry is and others are O. To encourage the diversity of the generator outputs (2)ly), we use a Gaussian noise vector ~ N (0, 7) to reparameterize the one-hot encoding vector during the generating process, following the prior practice (Kingma Welling, 2013). Thus, (=ly)y) = Gw e/e ~ NO, I)) given ~ y, where y is the global label set. The generator training process can refer Fig. 1 Step 1. Then for local training (see Fig. 1 Step 2). by downloading the global generator as substitute of Qt. each local client indexed by h can generate virtual OoD samples given an arbitrary external class set y y* the feature space, we denote the virtual samples as z ~ Gw (=ly,, e) given y ~ )*k
),),
4.3 FILTERING VIRTUAL EXTERNAL- CEEERSAL-CLASS SAMPLES
Although synthesized features are intuitively conditioned on external class, the quality of generated OoD samples may vary by iterations likely because of the lack of two properties: (1) Diversity. Like traditional generative models (Srivastava et al.. 2017: Thanh-Tume Tung & Tran, 2020), the trained conditional generator may suffer from mode collapse (Mao et al., 2019) in a class, where generator can only produce a small subsets of distribution. As result, the effective synthesized OoD samples will be mostly unchanged and OoD training will suffer from the lack of diverse samples. (2) Hardness. For a client, its internal and external classes may co-exist with another client, which will enlarge the between-class margins gradually. As the FL training proceeds, the class-conditioned synthesis OoD samples will become increasingly easier to be memorized, namely, overfit by the model. In other words, the hardness of OoD examples declines over time.
(1) Encourage OoD diversity by tail sampling. As mode collapse happens in the high-density area of a class, samples that approximate the class but have larger variance are preferred for higher diversity. For this purpose, seek to find samples of low but non-zero probability from the distribution of the external classes. Specifically, for each client, we first assume that the set of virtual OoD representations {zt, ~ G(2ly,, e)ly; ~ DeC, ~ (O, Ny forms a Gaussian distribution p(zx 1y c) - ~N Eg), where Sa is the Gaussian mean of samples from
multivariate
5

---

Published as a conference paper at ICLR 2023
the external class set )d for client k. and Σg is the tied covariance matrix. The parameters of the cons-conniiionll Gaussian can be estimated using the empirical mean and variance of the virtual external class samples:
1 1
Σ 2kis Σg
NE Σ
Σ
(#ki (2)) (2ki
pm)
NE
where No is the number of samples, and NE is the number of samples of class in the virtual Ool set. Then, we select the virtual outliers falling into the c-likelihood region as:
exp 2 (vg
7 Ex (vg (26 <,,Vi G(-ly- c,,))
V (vālso
(2 42 Σ 1//2
where ensures the sample is not totally random, small pushes the generated vi. away from the mean the external class in favor of the sampling diversity.
Algorithm Federated Out-of- Dff-riiiiibttion Synthesizer (FOSTER)
1: Input: Tasks (Tx ]
Global parameters 0g. local parameters {0x R
Global generator parameter w: Learning rate 3, local steps T, ID batch size B, OE batch size Boe-
2: repeat
3: Server selects active clients A uniformly random, then broadcast 0, to A.
4: for all user & E AA in parallel do
5: Initialize local parameters 0₂
6: for f ,.. . do
7:
{(2,, (4) 21) Du. ZOE {aus G(zlyi, ~ yt (x(, 1) Estimate the multivariate Gaussian distributions based on Zoe by Eq. (3). Filter virtual external class samples according Eq. (4).
8:
9:
10:
O₂ 6 02 end for
NV, ((ex). & Optimize Eq. (5)
12:
Client & sends 0₂ back to the server.
13:
end for
14: Server updates 0g f- [A] Σtea Ox.
fort 1, ...... do
16: w + a [ww)(w).
Optimize Eq. (2)
end for
18:
until training stop
(2) Increase the hardness by soft labels. To defend the enlarged margin between internal and external classes, we control the condition inputs to the generator such that generated samples are closer to the internal classes. Given one-hot encoding label vector y of class c, assign ó to the e-th entry, and a random value within (0, 8) to the rest of the positions, where ò E (0, 0.5).
In summary, given an observable Dr. we formulate the local optimization of FOSTER as:
min ((x)) de
Σ
(cr(ha ((): (z:))
Σ (OE(vx)
(5)
DR
[V
V&EV2
and the overall framework our algorithm is summarized in Algorithm 1. The major difference from FedAvg is that we introduce generator for OoD outlier synthesis. Since the generator is trained on the server, the computation overhead for the client is marginal, with only the inference of low-dimensional vectors. As compared to VOS, the samples generated from external classes more likely to approximate the features from real images due to the supervision real external class prototypes from the classifier head.
5 EXPERIMENTS
In this section, we first introduce the experiment setup and then show empirical results demonstrating the effectiveness of the proposed FOSTER.

---

Published as a conference paper at ICLR 2023
ID Datasets for training. We use CIFAR-10, 10, CIFAR- 100 (Krizhevsky et al., 2009), STL10 (Coates et al., 2011), and DomainNet (Peng et al., 2019) as ID datasets. Both CIFAR- 10 and CIFAR- 100 are large datasets containing 50, 000 training images and 10, 000 test images. Compared with CIFAR, STL10 is a small dataset consisting of only 5,000 training images and 8,000 test images. DomainNet consist of images from 6 different domains. We use Domain- Net to explore how FOSTER performs in the case of feature non-iid among different clients.
OoD Datasets for evaluation. We use Textures (Cimpoi et al., 2014), Places365 (Zhou et al., 2017), LSUN- (Yu et al., 2015), LSUN-Resize (Yu et al., 2015) and iSUN (Xu et al., 2015) as the OoD datasets for eval- uation. When ID dataset is CIFAR- 10, we also evaluate on CIFAR-100 to check near-OoD detection perfor- mance, since CIFAR-10 10 and CIFAR- 100 datasets have similarities, al-
Generated OnD daca 1D cata
Genorated OoD
ID data
(a) CIFAR-10.
(b) CIFAR- 100.
Figure 3: Visualization of generated external class samples
though their classes are disjoint.
and ID) samples.
Baselines. We compare the proposed FOSTER with both Post hoc and Virtual synthetic OoD detection methods that have been mentioned in Section 2: a) Post hoc OoD detection methods: Energy score (Liu et al., 2020). MSP (Hendrycks& & Gimpel, 2016). ODIN (Liang et al., 2017). b) Synthetic OoD detection method: VOS (Du et al., 2022). For a fair comparison, the training method of FL for all of the above approaches including the proposed FOSTER is FedAvg (McMahan et al., 2017) with personalized classifier head, and we note that our framework can be extended to other FL variants. All the approaches only use ID data without any auxiliary OoD dataset for training.
Metrics for OoD detection and classification. To evaluate the classification performance on II) samples, we report the test accuracy (Acc) for each client's 's individual test sets, whose classes match their training sets. For OoD detection performance, we report the area under the receiver operating characteristic curve (AUROC), and the area under the PR curve (AUPR) for ID and OoD classification. In FL setting, all three metrics are the mean results of all the clients.
Heterogeneous federated learning. For CIFAR-10 and CIFAR-100, the total client number is 100, for STL.10, the total client number is 50. For NemainNet, the total client number is 12 (2 for each domain). To model class non-iid data of the training datasets, we follow a uniform partition mode and assign partial classes each client. We distribute 3 classes per client for CIFAR-10 and STL10, 5 classes for DomainNet, and 10 classes for CIFAR-100, unless otherwise mentioned.
5.1 VISUALIZATION OF GENERATED EXTERNAL CLASS SAMPLES
In Fig. 3. we visualize the generated external class samples and ID samples of client using TSNE for both CIFAR-10 and CIFAR-100. Without accessing the raw external-class data from the other users, our generator, trained merely from the shared classifier head, yields samples that are strictly out of the local distribution without any overlap. We also obtain consistent conclusion from CIFAR- 100, which has as many as 90 external classes. The enormous external classes diversify the OoD set and therefore we observe larger gain of OoD detection accuracy (a 2.9% AUROC increase versus the best baseline) compared to other benchmarks in Table 1. The observation also motivates our design of the tail sampling encourage diversity.
5.2 BENCHMARK RESULTS
FOSTER outperforms existing methods. We compare FOSTER with other competitive baselines in Table 1. The proposed FOSTER shows stronger OoD detection performance all three training sets, while preserving a high test accuracy. VOS is another regularization method using virtual OoD samples, which even shows worse results than post hoc methods. The virtual OoD data synthesized by VOS is based on a large amount of ID samples. For the FL setting, when data stored in each device is limited, these synthesized OoD samples based on ID data will no longer be effective, which
7

---

Published as a conference paper at ICLR 2023
deteriorates the OoD detection performance. For FOSTER, the virtual OoD samples based on the external class knowledge extracted from other clients, which are close to real OoD samples. Thus, they are effective in improving the OoD detection performance while preserving the test accuracy.
ID dataset
Method
Acc t
AUROC
AUPR t
Energy
0,9431
0.7810
0,9262
MSP
0,9431
0.8829
0.9691
CIFAR-10
ODIN
0.9431
0.8842
0.9689
VOS
0.9426
0.7970
0,9342
FOSTER
0.9432
0.9091
0.9785
Energy 0.8129
0.8056
0,9575
MSP
0.8129
0.8606
0.9782
CIFAR-100
ODIN
0.8129
0.8657
0,9789
VOS
0.8063
0.8372
0,9666
FOSTER
0,8218
0.8945
0.9838
Energy 0.8236
0.7529
0.9228
MSP
0.8236
0.7410
0,9309
STLI0
ODIN 0.8236
0.7418
0,9306
VOS 0.8264
0.7370
0.9126
FOSTER
0.8410
0.7671
0.9425
Table 1:
Our FOSTER outperforms competitive baselines. numbers are best performers.
iindicates larger value is better. Bold
Near OoD detection. We evaluate the model training with CIFAR1O datasets on both near OoD (CI- FAR100) and far OoD datasets. The results are shown in Table 2, and the best results are highlighted. The proposed FOSTER outperforms baselines for all of the evaluation OoD datasets, especially the near OoD dataset CIFAR 100. By synthesizing virtual external class samples, FOSTER has access to virtual near OoD samples during training, which is also an advantage of FOSTER over other baselines.
Datasets
Textures
Places365
LSUN-C
LSUN-Resize
iSUN
CIFAR- 100
AUROC AUPR
AUROC AUPR
AUROC AUPR
AUROC AUPR
AUROC AUPR
AUROC AUPR
Energy
0,7080
0.8868
0.8221
0.9411
0,7009
0.9065
0.8376
0.9519
0.8289
0.9462
0,7883
0,9248
MSP
0,8107
0.9375
0,8964
0,9754
0.9043
0.9774
0.9154
0.9825
0.9103
0.9805
0,8604
0.9615
ODIN
0.8124
0.9367
0.8976
0.9752
0.9062
0.9773
0.9166
0.9825
0.9114
0.9805
0.8614
0.9613
VOS
0.7346
0.8993
0.8267
0,9447
0.7270
0.9196
0.8451
0.9541
0.8397
0.9499
0.8086
0.9379
FOSTER
0.8458
0.9544
0.9253
0.9842
0.9332
0.9863
0.9316
0.9870
0.9238
0.9849
0.8952
0.9742
Table 2: Near and far Ool) detection for CIFAR10. The proposed FOSTER outperforms baselines for all of the evaluation OoD datasets, especially near OoD dataset CIFARI00.
OoD detection for feature non-iid clients. We explore whether our FOSTER can still work well when feature non-iid also exists among different clients on Domain- Net. Under this problem setting, different clients not only have different classes, but may also come from different domains. According to the results shown in Table 3, although the results are not that significant compared with feature iid settings, FOSTER still out- performs the baselines. For feature non-iid settings, the external class knowledge extracted from clients from different domains sults also show that in this case, there is still some invariant external class information across different domains that can be extracted by our FOSTER help improve the OoD detection performance.
Method
Acc 1
AUROC 1
AUPR 1
Energy
0.7237
0.6745
0.8953
MSP
0.7237
0.6871
0.9048
ODIN
0.7237
0.6871
0.9047
VOS
0.7340
0.6796
0.8988
FOSTER
0.7348
0.6960
0.9075
Table 3: Our FOSTER outperforms competi-
tive baselines under feature non-iid setting.
so consistent compared with feature iid cases. However, our experimental re-
5.3 QUALITATIVE STUDIES
Effects of active client number. We investigate the effects of active client number on CIFAR-10. The number of clients fixed to be 100, while the number of active clients is set to be 20, 50 and 100, re- spectively, According to the results in Table 4, FOSTER shows better OoD detection performance than baselines in all cases of active users. With the increase of active clients, the OoD performance of Fos- TER remains stable, which means our proposed FOSTER is not sensitive to the number of active users.
8

---

Published as a conference paper at ICLR 2023
Active
Method
Acc f
AUROC1 1
AUPR 1
Classes /
Method
Acc f
AUROC 1
AUPR 1
DUM
client
Energy
0.9399
0.7760
0,9363
Energy
0.8129
0.8056
0,9575
MSP
0.9399
0.8560
0,9674
MSP
0.8129
0.8606
0,9782
20
ODIN
0.9399
0.8562
0,9674
10
ODIN
0.8129
0.8657
0.9789
VOS
0,9410
0.7545
0,9173
VOS
0.8063
0.8372
0.9666
FOSTER
0.9401
0.9011
0.9776
FOSTER
0.8218
0.8945
0.9838
Energy
0,9432
0.7592
0.9185
Energy
0.8976
0.7735
0.9157
MSP
0,9432
0,8869
0.9728
MSP
0.8976
0.8776
0.9704
ODIN
0.9432
0.8879
0,9727
ODIN
0.8976
0.8831
0,9714
vos
0.9430
0.7946
0,9311
VOS
0.8974
0.7927
0,9289
FOSTER
0.9429
0.8947
0,9750
FOSTER
0.8981
0,9081
0,9778
Energy
0.9431
0.7810
0,9262
Energy
0.9383
0.7215
0,8684
MSP
0,9431
0.8829
0.9691
MSP
0.9383
0.8682
0,9586
100
ODIN
0.9431
0.8842
0,9689
ODIN 0.9383
0.8723
0,9592
VOS 0.9426
0.7970
0,9342
VOS
0.9393
0.7636
0.8990
FOSTER 0.9432
0.9091
0.9785
FOSTER
0.9397
0.8865
0.9697
Table 4: Ablation study on the number of active Table 5: Ablation study on ID class number: the clients:FOss FOSTER is not sensitive to the number of advantage of the proposed FOSTER over other baselines is not affected by the number of ID class number.
active users.
Effects of ID class number. We investigate the effects of ID class number CIFAR-100 100. We set the classes distributed per client (classes client) to be 10, 5 and 3, respectively. According to the results in Table 5, the advantage of the proposed FOSTER over other competitive baselines is not affected by the number of ID classes. When the number of ID classes decreases, for FOSTER the maximum changes AUROC and AUPR are 2.16% and 0.81 %. respectively. VOS, as another virtual synthetic OoD detection method, with the decrease of ID classes, AUROC and AUPR drop by 7.36% and 6. 6.76%, respectively, which much larger variation compared with our method. Thus, the ID class number has a large impact on VOS, while almost has no effect on FOSTER.
Effects of the p.d.f. filter. We report the effects of the p.d.f. filter as mentioned in Section 4.3 on CIFAR-I0 in Table 6. The generator without a p.d.f. filter is outperformed by baselines. The phenomenon occurs because not all generated external class samples are of high quality, and some of them may deteriorate OoD detection performance. Since add Gaussian noise during the process, some randomly generated external class samples might overlap with ID samples. Thus, we build class-condition Gaussian distribution for external classes, and adopt a p.d.f. filter select diverse virtual Ool) samples which do not overlap with the ID) clusters. According to this table, filter- ing low-quality Ool) samples improves AUROC and AUPR by 4.44% and 1.18%, respectively.
Method
AUROC1
AUPR
Energy
0,9431
0.7810
0.9262
MSP
0,9431
0.8829
0.9691
Method Acc 1
AUROC: 1 AUPR
ODIN
0,9431
0,8842
0.9689
FOSTER
0.8410
0.7671
0.9425
VOS
0.9426
0.7970
0,9342
FOSTER w/ soft label
0.8294
0.7872
0.9501
FOSTER w/o pdf filter
0.9425
0.8647
0.9667
FOSTER w/ pdf filter
0,9432
0.9091
0.9785
Table 7: Ablation study on random soft labels: soft label strategy increase the hardness of gen-
Table 6: Ablation study pdf filter: pdf filter erated virtual OoD samples.
plays an effective role in selecting diverse, high- quality virtual Ool) samples.
Effects of the random soft label strategy. We study the effects of the random soft label strategy on STL10, and 5 0.2. As shown in Table 7, after replacing the one-hot label with the random soft label as the input for the generator, we improve AUROC and AUPR by 2.01 % and 0.75% respectively, while preserving similar ID classification test accuracy. That is because soft label contains knowledge from ID classes make the generated external class samples closer to ID samples.
6 CONCLUSION
In this paper, we study largely overlooked problem: OoD detection in FL. To turn the curse of heterogeneity FL into a blessing that facilitates OoD detection, we propose novel OoD synthesizer without relying on any real external samples, allowing client to learn external class knowledge from manner. Empirical results showed that
other non-iid federated collaborators in the proposed approach achieves state-of-the- performance in non-iid FL.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGMENTS
This material is based in part upon work supported by the National Science Foundation under Grant ISS22222174, US--1749440 Office of Naval Research N00014-20-1-2382. and National Institute on Aging (NIA) RFIAG072449. The work of Z. Wang part supported by the National Science Foundation under Grant IIS-2212176.
REFERENCES
Manoj Ghuhan Ariaazhagan, Vinay Aggarwal, Aaditya Kumar Singh, and Sunav Choudhary. Feder- ated learning with personalization layers. arXiv preprint 1rXiv:1912..0 2019.
Debraj Basu, Deepesh Data, Can Karakus, and Suhas Diggavi. Qsparse-local-sgde Distributed sgd with quantization, sparsification and local computations. Advances in Neural Information Processing Systems, 32, 2019.
Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describ- ing textures in the wild. In Proceedings of the IEEE conference on computer vision and pattern 2014.
recognition, pp.
Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. Proceedings of the fourteenth international conference on artificial intelligence and statistics, pp. 215-223, JMLR Workshop and Conference Proceedings, 2011.
Enmao Diao, Jie Ding. and Vahid Tarokh. Heterofl: Computation and communication efficient federated learning for heterogeneous clients. arXiv preprint arXiv:2010.0/264, 2020.
Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't know by virtual outlier synthesis. arXiv preprint arXiv:2202.01197, 2022.
Matej Greié, Petra Bevandić, and Siniša Segvić. Dense open-set recognition with synthetic outliers generated by real nvp. arXiv preprint arXiv:2011.11094. 2020.
Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why ReLU networks yield high- confidence predictions far away from the training data and how to mitigate the problem. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition, pp. 41-50, 2019.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out- out-oofdiistribttio examples in neural networks. arXiv preprint 1rXiv:1610.021166 2016.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint 1812::800000000 2018.
Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Measuring the effects of non-identical data distribution for federated visual classification. arXiv preprint arXiv: /et////99900333. 2019.
Sanghun Jung, Jungsoo Lee. Dachoon Gwak, Sungha Choi, and Jaegul Choo. Standardized max logits: A simple yet effective approach for identifying unexpected road obstacles urban-scene segmentation. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 15425-15434, 2021.
Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Ad- vances and open problems in federated learning. Foundations and Trends@ in Machine Learning, 14(1-2):1-210, 2021.
Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International Conference on Machine Learning, pp. 5132-5143. PMLR, 2020.
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint OrXiv=1312.000 2013.
10

---

Published as a conference paper at ICLR 2023
Jakub Konečný, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492,, 2016.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distribtion samples and adversarial attacks. Advances in neural information processing systems, 31, 2018.
Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions. IEEE Signal Processing Magazine, 3703):50-60, 2020a.
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine Learning and Systems, 2:429-450, 2020b.
Xiaoxiao Li, Meirui Jiang, Xiaofei Zhang, Michael Kamp. and Qi Dou. Fedbn: Federated learning on non-iid features via local batch normalization. arXiv preprint arXiv:2102.076633 2021.
Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of-distributioo image detection in neural networks. arXiv preprint arXiv: 1766v1/70600269, 2017.
Ziqian Lin, Sreya Dutta Roy, and Yixuan Li. Mood: Multi-level gut-of-distribun detection. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition, pp. 15313-15323, 2021.
Weitang Liu, Xiaoyun Wang. John Owens, and Yixuan Li. Energy-based oftttf-distribution detection. Advances in Neural Information Processing Systems, 33:2 33:21464-21475, 2020.
Qi Mao, Hsin-Yine Ying Lee, Hung- Yu Tseng, Siwei Ma. and Ming-Hsuan Yang. Mode seeking generative adversarial networks for diverse image synthesis. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 1429 1437, 2019.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera Arcas. Communication-effciient learning of deep networks from decentralized data. In Artificial intelli- gence and statistics, pp. 1273-1282. PMLR, 2017.
Sina Mohseni, Mandar Pitale, JBS Yadawa, and Zhangyang Wang. Self-supervised learning for generalizable out-of-distribution detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 5216-5223, 2020.
Xingchao Peng, Qinxun Bai, Xide Xia, Zijun Huang, Kate Saenko, and Bo Wang. Moment matching for multi-source domain adaptation. Proceedings of the IEEE International Conference on Computer Vision. pp. 1406-1415, 2019.
Zhaonan Qu, Kaixiang Lin, Jayant Kalagnanam, Zhaojian Li, Jiayu Zhou, and Zhengyuan Zhou. Federated learning's 's blessing: Fedavg has linear speedup. arXiv preprint arXiv:2007.05690 2020.
Sashank Reddi, Zachary Charles, Manzil Zaheer, Zachary Garrett, Keith Rush, Jakub Konečný, Sanjiv Kumar, and H Brendan McMahan. Adaptive federated optimization. arXiv preprint arXiv:2003.0023 00295, 2020.
Vikash Sehwag, Mung Chiang, and Prateek Mittal. Ssd: A unified framework for self-supervised outlier detection. arXiv preprint arXiv:2103.12051, 2021.
Akash Srivastava, Lazar Valkov, Chris Russell, Michael U Gutmann, and Charles Sutton. Veegan: Reducing mode collapse in gans using implicit variational learning. Advances in neural information processing systems, 30, 2017.
Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. arXiv preprint arXiv:2204.06507 2022.

---

Published as a conference paper at ICLR 2023
Jihoon Tack, Sangwoo Mo, Jongheon Jeong, and Jinwoo Shin. Csi: Novelty detection via contrastive learning on distributionally shifted instances. Advances in neural information processing systems, 33:11839-11 11852. 2020.
Hoang Thanh-Tung and Truyen Tran. Catastrophic forgetting and mode collapse in gans. In 2020 International Joint Conference on Neural Networks (IJCNN), pp. 1-10. IEEE, 2020.
Haoqi Wang. Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: Out-of-distributin with virtual- logit matching. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4921 4921-4930, 2022.
Jianyu Wang and Gauri Joshi. Cooperative sgd: A unified framework for the design and analysis of communication-efficentt sgd algorithms. arXiv preprint arXiv: /00v:/07877 2018.
Jim Winkens, Rudy Bunel, Abhijit Guha Roy, Robert Stanforth, Vivek Natarajan, Joseph R Ledsam, Patricia Millimis Pushmeet Kohli, Alan Karthikesalingam, Simon Kohl, et al. Contrastive training for improved out-of distriibiintt detection. arXiv preprint arXiv:2007.05566 2020.
Zhisheng Xiao, Qing Yan, and Yali Amit. Likelihood regret: An out-of-distribution detection score for variational auto-encoder. Advances neural information processing systems, 33:20685-20696, 2020.
Pingmei Xu, Krista A Ehinger, Yinda Zhang, Adam Finkelstein, Sanjeev R Kulkarni, and Jianxiong Xiao. Turkergaze: Crowdsourcing saliency with webcam based eye tracking. arXiv preprint 2015.
Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: 1.Kiv::500.. 03365, 2015.
Tao Yu, Eugene Bagdasaryan, and Vitaly Shmatikov. Salvaging federated learning by local adaptation. arXiv preprint arX14:2002.04758, 2020.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv: 2016.
Jingyang Zhang, Nathan Inkawhich, Yiran Chen, and Hai Li. Fine-grained out-of-diisribution detection with mixup outlier exposure. arXiv preprint arXiv:2106.03911 2021.
Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. IEEE transactions pattern analysis and machine intelligence, 4056))1442-1464, 2017.
Zhuangdi Zhu, Junyuan Hong, and Jiayu Zhou. Data-free knowledge distillation for heterogeneous federated learning. In International Conference Machine Learning, pp. 12888-12889. PMLR, 2021.
12


Reviews:
[{"review_id": "nSFkvjnAdIf", "reviewer": "Reviewer_Liwm", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors studied the problem of OOD detection in the literature of federated learning. The authors claim that the main challenge that prevents previous state-of-the-art OOD detection methods from being incorporated to FL is that they require large amount of real OOD samples, which are closely or even infeasible to obtain in reality. Further, the authors claimed that the data heterogeneity where each client collects non-iid data can hurt the performance of the system. Accordingly, the authors suggest to so called “taking advantage of such heterogeneity and turning the curse into a blessing that facilitates OOD detection”. Specially, the authors propose a novel federated OOOD Synthesizer (FOSTER), which learns a class-condtional generator to synthesize virtual external-class OOD samples. The authors claimed their superiority over the state-of-the-art counterparts. ", "summary_of_the_review": "I think studying OOD detection in the literature of FL is an interesting problem, but I am not sure if OOD data scarcity is really an important problem that require the in-depth discussion. ", "strength_and_weaknesses": "> Strength \n\n- The authors consider the problem of OOD detection in federated learning, which seems to be a realistic problem. For security sensitive applications such as autonomous driving and voice recognition authorization, I agree with the authors that FL can be useful in these scenarios and taking OOD detection into consideration can be important. \n\n- The authors conduct a set of experiments with various OOD detection settings, e.g., CIFAR benchmarks, STL10, and hard OOD detection. To some extent, the experimental results verify the superiority of the proposed method over a set of classical OOD detection methods. \n\n> Weakness\n\n- *The literature review is not enough*. The authors attribute the existing methods in OOD detection into two classes, namely, the real-data approaches and the synthetic approaches. However, I believe there is a large group of methods that do not rely on any OOD data (either real ones or the virtual ones), which is uncovered in the authors’ discussion. These works (e.g., post-hoc approaches [1], fine-tuning approaches [2], and contrastive learning approaches [3]) are popular and effective in OOD detection (even better than OE in many cases). Since they do not rely on OOD data for training, it seems that the considered problem of OOD data scarcity is actually not a big issue. I think the authors should cover a larger group of methods, and then discuss why collecting/synthesizing additional OOD data is important in FL. \n\n[1] Yiyou Sun, et al. Out-of-distribution Detection with Deep Nearest Neighbors. ICML’22.\n\n[2] Haoqi Wang, et al. ViM: Out-of-distribution with Virtual-logit Matching. CVPR’22.\n\n[3] Vikash Sehwag, et al. SSD: A Unified Framework for Self-supervised Outlier Detection. ICLR’21. \n\n- The authors follow the methodology named VOS. When applying the VOS for FL, the authors claim that enormous examples should be drawn for an accurate estimation of parameters. However, *I am not sure if the statement is true*. Especially, the estimation of MoG is in low dimensional space and the number of tunable parameters are in small scale. In fact, the authors of VOS actually claimed their superiority over previous GAN-based methods [4] in easy to be optimized, which may refute this paper’s point. Therefore, I think further discussion and experimental justification may require here. \n\n[4] Kiin Lee, et al. Training Confidence-calibrated Classifiers for Detecting Out-of-distribution Samples. ICLR’18. \n\n- Another little confusion point is that *if the data are synthesized in low-dimensional space where the MoG can properly model it, is it necessary to use the generative models in data synthesis?* It may increase the number of trainable parameters, which may exaggerate the data scarcity issue in FL.\n\n\n\n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "O5pXvtbBGu", "reviewer": "Reviewer_3v8K", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes a new algorithm named FOSTER for out-of-distribution (OoD) detection in the federated setting. Since there may be no OoD sample in the federated setting, the paper proposes to use samples from the other classes that do not exist in the current client as OoD samples for local training. Since the raw data are not allowed to transfer, FOSTER trains a conditional GAN in the server, which helps to generate the synthetic external-class samples during local training. The experiments show that FOSTER outperforms the other approaches that directly apply existing OoD studies in the federated setting.", "summary_of_the_review": "I think the paper still needs more analysis and experiments to justify the effectiveness of the proposed approach.", "strength_and_weaknesses": "Strength: The studied problem is important and less exploited in the current FL literature.\n\nWeaknesses:\n\n1. The intuition of FOSTER is to utilize the external-class samples as OoD. However, in the testing, the external-class samples are not true OoD samples. Then, the models may misclassify these samples into OoD. In the experiments, do the authors consider the external-class samples when testing the ID classification accuracy? If yes, why the ID classification accuracy is high given the external-class samples?\n\n2. FOSTER is based on personalized FL. What about the baselines? The paper only mentions that the training method of all approaches is FedAvg in Section 5. The baselines should also adopt personalized FL for fair comparison. Also, local training without FL can also be added as a baseline, e.g., the clients can simply conduct unsupervised learning locally such as one-class SVM.\n\n3. Figure 2 is confusing. How is the training performed? Is it based on OoD training or is it based on vanilla supervised training? The green points seem to be mixed with blue and yellow points even in the left figure.\n\n4. A generator is required in FOSTER, which introduces additional privacy concern, communication, and computation overhead. The paper should discuss these aspects.\n\n5. Experiments to investigate the effect of client sampling and data heterogeneity can be added.\n\n6. Typo: Line 3 of Algorithm 1: broadcast \\theta and w to A; Section 6: “we studied”, “we propose”. Please keep consistency for the tense. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "F0F81VZmTXz", "reviewer": "Reviewer_eA7B", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this paper, the authors study a largely overlooked problem: OOD detection in FL. To turn the curse of heterogeneity in FL into a blessing that facilitates OOD detection, the authors propose a novel OOD synthesizer without relying on any real external samples, allowing a client class knowledge from other non-iid federated collaborators in a privacy-preserving manner. Empirical results showed that the proposed approach achieves SOTA performance in non-iid FL.\n\nFrom the view of the problem setting, this paper studies a very important problem, which contains enough significance in the field of FL and OOD detection. From the technical part, the authors propose a novel federated OOD synthesizer to take advantage of data heterogeneity to facilitate OOD detection in FL, allowing a client to learn external class knowledge from other non-iid federated collaborators in a privacy-aware manner. This work bridges a critical research gap since OOD detection for FL is currently not yet well-studied in literature. The proposed FOSTER is the first OOD learning method for FL that does not require real OOD samples.\n", "summary_of_the_review": "From the view of the problem setting, this paper studies a very important problem, which contains enough significance in the field of FL and OOD detection. From the technical part, the authors propose a novel federated OOD synthesizer to take advantage of data heterogeneity to facilitate OOD detection in FL, allowing a client to learn external class knowledge from other non-iid federated collaborators in a privacy-aware manner. This work bridges a critical research gap since OOD detection for FL is currently not yet well-studied in literature. The proposed FOSTER is the first OOD learning method for FL that does not require real OOD samples.", "strength_and_weaknesses": "Pros:\n\n1.  The problem setting is very important, filling up a gap between FL and OOD detection. This study is significant in the fields of FL and OOD detection.\n\n2. From the technical part, the authors propose a novel federated OOD synthesizer to take advantage of data heterogeneity to facilitate OOD detection in FL, allowing a client to learn external class knowledge from other non-iid federated collaborators in a privacy-aware manner. This work bridges a critical research gap since OOD detection for FL is currently not yet well-studied in literature. The proposed FOSTER is the first OOD learning method for FL that does not require real OOD samples. Note that, it is not trivial to directly use the OOD techniques in FL, which is the major technical contribution of this paper.\n\n3. Experiments cover many aspects regarding this paper (like CIFAR10/100 and near OOD detection).\n\n\nCons:\n\n1. The problem setting should be presented explicitly. What the data you have and what the aim this paper wants to do should be demonstrated in a separated paragraph or subsection.\n\n2. The generated OOD data is somehow different from the true OOD data. Relevant discussions are needed.\n\n3. What is the validation dataset used to find the best hyperparameters of your method? Validation datasets are very important to the OOD detection. We cannot select validation datasets containing OOD data. \n\n4. ImageNet benchmark should be used to verify the effectiveness of the proposed method.\n\n5. To ensure the completeness of the ablation study, performance of Foster w/o pdf and soft label should be reported.\n\n6. In section 3, it is wired to say that a sample belongs to (using \\in) a distribution. For example, x \\in D. It should be x ~ D. \n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "3oFPUBbJHTI", "reviewer": "Reviewer_1Z2K", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a virtual OoD sample synthesizer suitable for federated learning, called FOSTER. It uses the class information collected by the client to train the generator on the server and broadcast. Under the premise of ensuring privacy, FOSTER uses the knowledge of other non-iid federated partners to generate virtual OoD samples locally on the client. Using virtual samples to join training will improve the OoD detection performance of the model. Experimental results show that FOSTER outperforms traditional OoD detection methods in federated learning.", "summary_of_the_review": "This paper explores the OoD detection technology under federated learning, proposes a virtual OoD synthesizer suitable for this scenario, and achieves performance beyond the baseline. I recognize the significance of the work and the performance gains achieved by the paper. But the paper lacks some novelty in technology, and the description of the method needs to be clearer.", "strength_and_weaknesses": "Strength.\n\n1) This paper explores the OoD detection method for federated learning for the first time, which is indeed a problem to be solved.\n\n2) Without the need for additional real OoD samples, FOSTER can generate valid virtual OoD samples on clients with limited class data. Experimental evaluations show that this strategy outperforms previous OoD detection methods in federated learning scenarios, which is worthy of recognition.\n\nWeaknesses.\n1) The technical novelty of this paper is not good enough. The techniques used in the paper, including virtual sample generation, tail sampling, and soft labels, have been used in previous OoD detection. The main contribution is to use these technologies in the federated learning scenario.\n\n2) The specific training process of the sample synthesizer lacks clarity. After reading Section 4.2 I still don't understand how synthesizers learn class information and synthesize samples efficiently. Hope for a clearer explanation.\nMinors.\n\n3) Figure 2 is hard to read.\n\n4) Typo. See the last sentence of the 'challenge' paragraph.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: notable-top-25%