GOLD: Graph Out-of-Distribution Detection via Implicit Adversarial Latent Generation
Authors: Danny Wang
Ruihong Qiu
Guangdong Bai
Zi Huang
Venue: ICLR 2025 Spotlight (2025)
Keywords: Graph Neural Network
Out-of-Distribution Detection
Primary area: learning on graphs and other geometries & topologies

Abstract: Despite graph neural networks' (GNNs) great success in modelling graph-structured data, out-of-distribution (OOD) test instances still pose a great challenge for current GNNs. One of the most effective techniques to detect OOD nodes is to expose the detector model with an additional OOD node-set, yet the extra OOD instances are often difficult to obtain in practice. Recent methods for image data address this problem using OOD data synthesis, typically relying on pre-trained generative models like Stable Diffusion. However, these approaches require vast amounts of additional data, as well as one-for-all pre-trained generative models, which are not available for graph data. Therefore, we propose the GOLD framework for graph OOD detection, an implicit adversarial learning pipeline with synthetic OOD exposure without pre-trained models. The implicit adversarial training process employs a novel alternating optimisation framework by training: (1) a latent generative model to regularly imitate the in-distribution (ID) embeddings from an evolving GNN, and (2) a GNN encoder and an OOD detector to accurately classify ID data while increasing the energy divergence between the ID embeddings and the generative model's synthetic embeddings. This novel approach implicitly transforms the synthetic embeddings into pseudo-OOD instances relative to the ID data, effectively simulating exposure to OOD scenarios without auxiliary data. Extensive OOD detection experiments are conducted on five benchmark graph datasets, verifying the superior performance of GOLD without using real OOD data compared with the state-of-the-art OOD exposure and non-exposure baselines.

Published as a conference paper at ICLR 2025
GOLD: GRAPH OUT-OF-DISTRIBUTION DETECTION VIA IMPLICIT ADVERSARIAL LATENT GENERATION
Danny Wang, Ruihong Qiu, Guangdong Bai, Zi Huang The University of Queensland (danny. wang, r. qiu, g bai, helen huang) @uq. edu.au
ABSTRACT
Despite graph neural networks' (GNNs) great success in modelling graph- structured data, out-of-distribution (OOD) test instances still pose a great chal- lenge for current GNNs. One of the most effective techniques to detect OOD nodes to expose the detector model with an additional OOD node-set, yet the extra OOD instances are often difficult to obtain in practice. Recent methods for image data address this problem using OOD data synthesis, typically relying on pre-trained generative models like Stable Diffusion. However, these approaches require vast amounts of additional data, as well as one-for-all pre-trate pre-trained gen- erative models, which are not available for graph data. Therefore, propose the GOLD framework for graph OOD detection, an implicit adversarial learning pipeline with synthetic OOD exposure without pre-trained models. The implicit adversarial training process employs a novel alternating optimisation framework by training: (1) a latent generative model regularly imitate the in-distribution (ID) embeddings from an evolving GNN, and (2) a GNN encoder and an OOD detector accurately classify ID data while increasing the energy divergence be- tween the ID embeddings and the generative model's s synthetic embeddings. This novel approach implicitly transforms the synthetic embeddings into pseudo-OOD instances relative to the ID) data, effectively simulating exposure to OOD scenar- ios without auxiliary data. Extensive OOD detection experiments are conducted on five benchmark graph datasets, verifying the superior performance of GOLD without using real OOD data compared with the sfate-of-the-art OOD exposure and non-exposure baselines.
INTRODUCTION
The proliferation of Graph Neural Networks (GNNs) across diverse domains and real-world appli- cations has underscored the importance of robust and reliable predictive systems (Kipf & Welling, 2017: Hamilton et al., 2017). Their performance relies crucially on the assumption that the testing data follows the same distribution as the training data (Li et al., 2023; Kipf & Welling, 2017; Yu al., 2023; Hamilton al., 2017). This assumption frequently violated in practice, as real-world graph data is generally filled with out-o--distribution (OOD) instances (Bitterwolf et al., 2020; Chen et al., 2022; Ding et al., 2021; Zhou et al., 2022; Li et al., 2022a; Yang et al., 2022). Consequently, inaccurate predictions will inevitably be made by the deployed models, which can be detrimental in critical areas like medical diagnosis and drug discovery (Cao et al., 2020; Ahmedt-Aristizale et al., 2021; Giuffrè & Shung, 2023; Lee et al., 2023b; Ji et al., 2022). Thus, is necessary to de- velop OOD detection methods to identify -uttt--distributtin instances that deviate from the training distribution (Yang et al., 2021; Ren et al., 2019; Lang et al., 2023; Bazhenov et al., 2022).
Recent work has made significant strides in developing OOD detection techniques tailored for graph- structured data, primarily in three categories (Song& & Wang, 2022; Huang et al., 2022a; Wu et al., 2023b; Stadler et al., 2021). (1) General OOD detection methods train the detector only with in- distribution (ID) data from the training (Ding & Shi, 2023; Ma et al., 2023; Liu al., 2023b; Wang et al., 2024). This process involves fine-tuning a classifier and learning graph representations
Coode available https: /ttpe/////ghhtttteee/eee htt.:/tttt......oo.oo/oeeeameeee 10/G/.

---

Published as a conference paper at ICLR 2025
to improve the model's OOD detection performance using various scoring metrics. (2) A more ef- fective method for OOD detection is OOD exposure, which takes advantage of exposing the detector with additional OOD samples during training (Wang & Li, 2023; Wu et al., 2023b; Hendrycks et al., 2019; Koo et al., 2024). These methods generally require an extra dataset containing OOD samples and the detector is trained discriminate the ID training data with these OOI) data. (3) More cently, OOD synthesis methods have been proposed for image data, mainly leveraging pre-trained generative models, e.g., Stable Diffusion (Rombach et al., 2022), to create OOD samples that lie on the boundary of ID data (Tao et al., 2023; Du et al., 2023; Wu et al., 2023a; Zheng et al., 2023).
Despite the effectiveness of OOD exposure-based methods over general OOD detection methods, two challenges remain: (1) For the OOD exposure approaches using a real and additional OOD dataset, acquiring these extra OOD samples is often infeasible during model training in the real world. Furthermore, relying on the additional OOD dataset to guide the detector in distinguishing the ID and OOD data could lead to an inaccurate decision boundary. This because the training logic assumes that the exposed OOD data can represent the distribution of OOD data from test scenarios, which has no guarantee in real-world (Du et al., 2022: Vernekar et al., 2019). (2) Although OOD synthesis-basee based approaches have been proposed to resolve the lack of unknown data, these methods typically rely on pre-trained models built upon substantial amounts of auxiliary data (Huang et al., 2022c; Tao al., 2023; Du al., 2023; Shen al., 2024). Moreover, the lack of one-for-all pre-trained generative model for graph data hinders the synthesis of OOD data using simple plug- and-play models (Liu et al., 2023a). Thus, this presents the key motivation:
How to enhance graph OOD detection by exposing to OOD scenarios without auxiliary data?
In light of the above challenges, the intuition of this work is to generate and expose pseudo- OOD samples solely based on the ID training data to ensure effective OOD detection. To achieve this, we propose an implicit adversar- ial training framework with a novel alternating optimisation schema by training: (1) a latent generative model (L.GM) to regularly gener- ate embeddings similar to the in-distribution (ID) embeddings from an evolving GNN. and (2) GNN encoder and an OOD detector to ac- curately classify ID data while increasing the energy divergence between these generated embeddings and the ID embeddings. This novel approach implicitly transforms synthetic embeddings into pseudo-OOD instances rela- tive to the ID data, effectively simulating OOD exposure without auxiliary data. Evident in Figure 1, the initially similar energy distribu- tions after LGM training diverge post-training, which implicitly separates the embedding dis- tributions, ensuring the pseudo-OOD data resemble close to the real OOD instances. The main contributions of this paper are summarised follows:
20
1.6
Density
1
91.0
0.8 -0.7 -0.6
0.0
-10
-8
Energy score
Energy score
(a) Initial energy.
(b) Post-training energy.
21
17
13
11
13
(c) Initial embeds.
(d) Post-training embeds.
Figure I: Motivation of GOLD: The initially close energy distributions (a) after training the latent generative model, become separated after train- ing GOLD (b), where the initial pseudo-OOD (p- OOD) embeddings (embeds..)
(c) implicitly di- verges from the ID data and resembles real OOD instances (d).
We propose GOLD, a novel non-OOD exposed synthesis- based framework for graph OOD detection. GOLD includes a unique implicit adversarial training paradigm for effective pseudo-OOD synthesis, which is achieved by a latent generative model and novel detector.
We conducted extensive experiments on five benchmark datasets. Without auxiliary OOD data, GOLD achieves state-of-the-arr performance compared with non-OOD and OOD ex- posure methods, with the best improvement of FPR95 reduced from 33.57% to 1.78%.
2 PRELIMINARY
Generally, for a node classification problem. a graph is denoted as G = AX, where X E Raxd is the node feature matrix with nodes and feature dimension d, and A RRax is an adjacency
2

---

Published as a conference paper at ICLR 2025
matrix indicating the connection among nodes. Each node is associated with label y {1, .... C} indicating a total of C' classes. For out -fstsiiibiitttinn detection, there are generally two main tasks:
Task I: In-distribution classification. To formulate the node classification problem for in- distribution data, given test nodes from the same distribution as training nodes, Ptrain (X, A) = ( (X, A) and the conditional distribution Prraen (y|X, A) (y X, A), the task is to de- velop an L-layer GNN classifier to predict the label y E IR" for the testing nodes with trainable parameters in the GNN classifier (see Appendix A.5 for details of GNN):
y = Softoox SoNNMaxxGNN((X, A)).
Task II: Out-of-distribution detection. To detect the testing nodes coming from a different distri- bution from the training data, where Ptrain (X, A) Ptest (X, A) and the conditional distribution Ptrain (y X, A) * atest (y) XX A), the task is to require an OOD detector F to output a binary prediction for the testing nodes. F is usually built upon the output from the classifier GNN with F(x, A; GNN) = for data from in-distribution and F(x, A; GNN) = 0 for data from out-of- distribution (Wu al., 2023b; Liu al., 2020; Yang et al., 2023a).
Energy Score-based Detector. Recent work indicated that using the energy score from logits in the classifier can benefit OOD detection (Liu et al., 2020; Wu al., 2023b; Grathwohl al., 2020). The energy score e for a node i is defined as:
= log Σ exp(zi.o),
(2)
where e; E the energy score of node i, z; E RC is the logits for node output from the classifier Z = GNN(X, A) E R"xC, and e is to select the logit of the e-th element of z,. Therefore, the energy score-based OOD detector for a node is instantiated with threshold 7 as:
{1,
0, if e, 2T
F (x,, A: GNN)
(3)
if 6 <T
The training of this energy score- base- OOD detector is generally based on an energy regu- lariser (Liu et al.. 2020), which maximises the difference between the energy scores from in- distribution data (PI)) and out-of-distriuttion data (PooD) with two scalar thresholds, tn and fooD:
max LERegy where LeReg = Ei~Plo [max (0, lTD - =+]] + Ej-Pooo [max (0, ej lOoD)] (4) GNN
Energy Propagation for OOD Detector. To facilitate the energy score for graph data, GNNSAFE (Wu et al., 2023b) proposes an energy propagation schema that emulates label prop- agation for effective OOD detection. This propagated energy is then fed into the objective in Eq. 4:
e (k) = (k-1) + (1 (1-a)D-'Ael)
(5)
where (k) E Fax1 is the energy scores for nodes after k-th energy propagation with E [0.1] 1] controlling the concentration of energy. D is the degree matrix of graph G. In the following, the en- ergy scores in our framework will be the propagated energy scores and will be used interchangeably.
GOLD
In this section, the GOLD framework for graph OOD detection is described with illustration in Figure 2. In summary, GOLD is trained with a novel implicit adversarial objective that optimises latent generative model (LGM), a GNN classifier, and an OOD detector. The LGM aims generate embeddings akin to ID data, while the implicit adversarial objective encourages divergence between the ID and OOD energy scores derived from GNN and detector. This process implicitly transforms the synthetic embeddings into pseudo-OOD effectively facilitating synthetic OOD exposure.
The GNN classifier is trained to maximise the log probability the ground truth classification label:
max LCLS, where LCLS = log logp(y/>, 9x)-
(6)
GNN
In the following, the detector and the latent generator are both built upon this GNN in GOLD.
3

---

Published as a conference paper at ICLR 2025
Original Graph
Joint Objective for GOLD:
H
CNN
Model
min
IDAX
Lea + Laus + Lune
GNN 1i--1
00 Labelled Nodex
GNN
MLP
Noke
000
0000
Hooon
Trainable Model Freeze Model
Generative
Figure 2: Overview of GOLD. Given input graph, GOLD consists of two components: Step
trains a latent generative model using hidden representation H from a frozen GNN. Step @ trains GNN classifier and OOD detector based on the ID data H and the latent generator generated pseudo data HO-OO The overall training is in an adversarial manner.
3.1 LATENT GENERATIVE MODEL AS PSEUDO-OOD GENERATOR
In light of the key motivation of exposing the model OOD scenarios with generated data, an LGM is employed for pseudo-OOD MOD synthesis. The model would take input from the encoded node representations H Raxd", where d' is the hidden dimension, of the GNN module after the (I-1)- th layer, which captures both the global and local information (Kipf Welling, 2017):
H -N- A); Z & A) GNN(X,
The LGM aims to mimic and generate latent embeddings close to the ID representations. This is typically achieved by minimising a reconstruction loss or distance between a target and predicted embedding, i.e,, if latent diffusion model (LDM) (Ho et al., 2020) or variational autoencoder (VAE) (Kingma & Welling, 2014) is used as the pseudo-OOD generator, the objective is given by:
min LGeu:
Enorer
v1I ( +
t)
LDM
where LGen
E (hpoon h) [logp(h//pp-oom) - KL [qD (ttpp/o////ll(pppoo00
if VAE
with latent vectors h and decoder D. For LDM, D is denoising network that predicts and progres- sively removes noise during the backward denoising step. Contrary, VAE minimises reconstruction and embedding distance loss, based the input latent embeddings and the embeddings generated by the decoder D. The pseudo-OOD latent embeddings hp-OOD can thus be generated using the decoder network D with noise vector sampled from normal distribution hy ~ (O, via:
OOD ~ Pp.OOD, and Po. Pp hw)
For comparison, VAE presents competitive performance and faster training time due to model de- sign, while LDM remains efficient and performs better among (non-) OOD exposure methods when used in GOLD. Moreover, GOLD achieves the same inference time as SOTA baselines with any LGMMs. This is because the generative model is not involved during inference. A detailed descrip- tion of the two generative methods and their corresponding objective is provided in Appendix A. A.11, and further results about effectiveness and efficiency will be discussed in Section 4.1 and 4.6.
Note that at this stage, the synthetic embeddings generated by the LGM still imitate the ID data. In the following subsections, with novel detector, an implicit adversarial training process will be introduced, which separates the synthetic embeddings from the ID representations, transforming it into pseudo-Oee OOdd instances.
3.2 OOD DETECTOR FOR AND PSEURO-OOD SEPARATION
Given that trained latent generator can synthesise latent representations akin the ID embeddings, the OOD detector is designed to pull apart the energy scores of ID instances from those the gener- ated data. This ensures clear separation between the distributions, and through gradient flow the
4

---

Published as a conference paper at ICLR 2025
trainable GNN encoder, it implicitly separates the synthetic embeddings from the ID embeddings. Hence, the synthetic data is effectively transformed into pseudo- Mandoo-ODDano instances relative to ID data, as shown in Figure 1, allowing the model to be exposed to OOD scenarios without the need for real OOD data. For clarity, in the following, the OOD exposure in previous methods will be replaced with the pseudo-OOD) data generated by the LGM from Eq. 9.
In the general design of an energy-based OOD detector as in Eq. 2, the energy score is a combination of the prediction logits. To overcome the potential difficulties when the number of classes increases or when certain classes are unable to be accurately distinguished by the model, an MLP is applied to the energy and trained with an uncertainty loss as Du al. (2022) with & as the softmax function:
max Lune, where Lune = Ri-P GNN, MLP
+ Ep--Pooo log (MLLP(()))))l
(10)
The subscripts indicate the label of the corresponding logit value from the MLP model after applying (i.e.. [0] represents the ID Class and [1] represents the OOD Class 1). In addition to using this
uncertainty objective, we aim to further transform the energy with the classifier output to enhance the separability of the energy:
e = - -ogle MLP(echo + e MLLP(e)DnI..
(11)
With the transformed energy e', we propose new divergence regularisation to obtain a more di- verged energy score distribution than the pre-transformed energy from the GNN classifier:
max LDReg where LDReg = Ei max (0, e; - et)² + Eij-P max (0, e/j - e,)² (12)
GNN, MLP
We next show that the combination of the two proposed losses with pseudo-OOD data could enable the detector to produce more distinctive energy scores between distributions assist OOD detection.
The gradient descent on Line and LoRes will overall decrease (increase) the transformed energy e' for in-distribution (pseudo-out-of -fftttoo---stiuuttion instance, bounded by the given initial energy
Proposition 1.
Pıo (P (Pp.0oD), respectively, for the detector MLP model.
The proof is provided in Appendix A.I. Intuitively, the Lne aims to train the detector to classify the ID and OOD data with high probability under binary classification, which ensures the separability of embeddings. While the LoREy aims to diverge the energy of ID) and OOD based on the logits from this same detector. Therefore, the logits of ID data are expected to have a larger scale than the logits of OOD data, which leads to the energy score based on the logits for this binary classification providing greater discrepancy between ID and OOD data. The empirical visualisation is shown in Figure of Appendix A.2.
Energy Divergence Objective: Replacing POoD with Pp Pp.ooD. additionally with the LiReg from Eq. 4, the objective to diverge the energy for the OOD detector is a combination with weight μ4, X, 7 E R:
max LDV,, where LDN JLLERey + XL + LDReg GNN, MLP
(13)
After optimising the MLP detector and GNN classifier with the final energy divergence objective LDw, the embeddings generated by the fixed LGM will implicitly diverge from the ID embeddings produced by the updated classifier. This divergence occurs because the energy scores generated by the detector are separated by the optimised objective, which will further train the GNN classifier via gradient flow. As result, the LGM would effectively function as a pseudo-OOD generator.
3.3 IMPLICIT ADVERSARIAL. OBJECTIVE
To accomplish the ID classification and the OOD detection, the overall objective of the pseudo-OOD synthesis and OOD detector can be formulated in an adversarial style, by combining Eq. 8, and 13:
min max D GNN,
LGen + LCLS + LDiV
(14)
The intuition of this adversarial objective stems from the contradictory optimisation purpose from the individual objectives. When fixing the GNN encoder, Luen aims to optimise the LGM to min- imise the gap between the generated pseudo-OOD embeddings and ID embeddings. This ensures the LGM can generate meaningful representations that are initially close to ID data, instead of gen- erating meaningless and far away pseudo-OOD data. When fixing the generator, Lets and LDw
5

---

Published as a conference paper at ICLR 2025
aims optimise the GNN encoder and the MLP detector to maximise the discrepancy in the energy score between the pseudo-OOD data and the ID data, while keeping the GNN encoding for data meaningful for classification. Notably, GOLD does not directly generate pseudo-embedee embeddings from the IGM against the ID embeddings but instead, the encoder and the detector implicitly pull the II) embeddings away from the generated pseudo-OOD embeddings via the energy score divergence.
We note that adversarial training schemas were also previously developed by Lee et al. (2018a) and Dai et al. (2017) generate OOD data outliers without pre-training. These methods present GAN-based model with generator and discriminator components, alongside additional density esti- mation methods, such as a confidence classifier and pre-trained models for OOD prediction. These methods are shown to be not comparable to the OOD exposure- basee detector (Du et al., 2023), In contrast, the key adversarial aspect of our framework is that the I.GM generates embeddings resem- bling II) data, while the detector and classifier amplify the energy score gap between these generated pseudo-OOD embeddings and ID samples, implicitly affecting the embeddings' distribution.
3.4 ALTERNATING OPTIMISATION
Algorithm 1 Adversarial Optimisation of GOLD
Input: ID graph G = (A,X) randomly initialised
To facilitate effective optimisation of the implicit adversarial objective in Eq. 14, we propose an alternating training schema for GOLD, shown in Algorithm 1. The in- tuition is to repetitively generate samples close to the ID embeddings of GNN, and then diverge the energy score distribution of the ID and the synthesised pseudo- data. This process ensures the pscudo-
GNN, MLP detector, and latent generator D, epoch numbers Mi and M2, loss coefficients
X, N.
Output: Optimised GNN, MLP detector, and genera- tive model
1: while train do
2: Obtain H for ID data with GNN from Eq. 7
3:
for epoch .,... M1 do
// Step
4:
Train D with Loen and H from Eq. 8 end for
OOD data do not diverge too far from ID) enabling effective pseudo-OOD exposure.
5:
6: Sample noise H2 from Normal distribution Generate pseudo-OOD HpOOD with D and Hr from Eq. 9 for epoch L........ M2 do
Thus, GOLD consists of two alternating optimisation steps: Step O: LGM mim- icking embeddings of evolving GNN:
8:
// Step 2
A latent generative model is trained to mimic the ID embeddings H, extracted from the (I. 1)-th layer of an evolving GNN encoder trained in Step 2, to gen- erate pseudo-OOD OOD embeddings. This en- sures the pseudo-OOD, Hp-OOD. is suffi- ciently close to the ID embeddings and avoids far away and meaningless generation before sub- sequent divergence (Line 2-7 in Algorithm 1); Step @: Detector and GNN diverging energy of evolving generator: The GNN encoder and OOD detector are trained diverge the energy between the ID embeddings and the pseudo-OOI embeddings generated by the evolving LGM trained in Step 1 (Line 8-11 in Algorithm 1). Figure illustrates the adversarial essence of this training paradigm.
9:
Train GNN with LCtS and H Eq. 6 Train GNN and MLP with DDV. H and
10:
Hp Hp-OOD from Eq. 13
11:
end for
12:
end while
0.75
1.00
10 Ciaa
0.8
0.50
0.25
91.0 -0.9 -0.8
-0.6
-0.5
0.00
0.00
0.0
-10
Eneray
Energy
(a) Ep 1, Tr. LGM.
(b) Ep 14, Tr. GNN & Det.
(c) Ep 16, Tr. LGM.
(d) Ep 22, Tr. GNN & Det.
Figure 3: Transformed energy distribution during adversarial training (Tr.) on the Twit ch dataset
for in-distribution (ID), pseudo (p-)OOD, and real OOD across epochs. (a) shows that after LGM trains to mimic ID data, energy scores are overlapped for ID, p-OOD, and OOD in the initial stages. (b) indicates that after training GNN and the detector to separate the energy of ID and the p-OOD, the real OOD energy cannot be effectively separated from ID. This is similar situation to the OOD exposure for GNNSafe in Figure 4c. (c) shows that under adversarial learning, the LGM will be updated to generate p- OOD closer to the updated ID data, preventing from being too far away from ID data with ineffective OOD learning. (d) displays the final energy distribution after convergence, with real OOD and ID being well separated, while p-OOD and OOD being well aligned.

---

Published as a conference paper at ICLR 2025
Table 1: Model performance comparison: out-of-distribution detection results are measured by AU- ROC (t) / AUPR (t) FPR95 (4) (%) and in-distribution classification results are measured by accuracy (ID ACC) (t). The average performance of the OOD test sets is reported, with variance reflecting performance differences across distinct test sets. Detailed results for individual subsets are reported in Appendix A.9. OOD detection performance was prioritised, with the detection results of our Non-OOD exposed GOLD against Non- (Real-) OOD Exposure methods highlighted by best and runner-up (best and runner-up). respectively. Dashed line indicates unavailabilityy
Matrics
MSP
OIDIN
Maha
Energy
Non-OOD
GKBR
GPN
GNNSAFE
NODESAFE
OK
Energy
FT
Real OOD NODESAPE**
GNNSSEE*
W/ VAI
GOLD (NO)-OO))
v/ LBM
AUBOC
91:35
$9.99
55-12
61.30
05.34
03.50
03.15
FPR55
98.96
10:13
91.63
05.62
42.00
95.07
3,05
9.443
ID ACC
66.72
70.79
00.51
73.40
67:44
63.00
70.40
71.79
70.73
70.32
70.15
71.35
63.30
09.49
0.113
AUBOC:
49:87
54.24
06:31
$4.15
79:76
85:11
89.96
00.0
AUPR
83.08
13.19
75.32
3.76
[D ACC
7691
79
79.57
80.34
79.36
$1.65
$0.32
$1.90
71.69
50.41
$1.45
81.55
76.79
R1
7.94
AUROC
96.52
50.12
73.81
05.73
05.08
02.40
98.49
97:30
08.00
58.99
99.68
05.21
1.00
AUPS
1.31
93.54
10.30
1,0
AUROC
05.74
51.71
62.02
95.64
69:24
69.59
98.82
97.65
06.17
99.25
98.78
90.00 L.19
AUIP
87.05
01.00
80.17
72.17
99.40
48.04
99.73
-0443
1.87
AUROC
63.81
55.07
56.93
65.20
58.33
0OM
71.06
72.04
69.00 50
71.55
76.77
75:49
71.53
73-90-0 0.11
AUPR
85.85
08.85
01.03
75.78
7367
00M
50.43
81.51
85.15
50- 077
83.31
X1.71
10.35
K1.53
0.13
F9995
003
75:34
81.05
30:30
4 EXPERIMENTS
Datasets.
Following Wu et al. (2023b), five benchmark datasets are used for OOD detection eval-
uation, including four single-graph datasets: (1) Cora, (2) Amazon Photo, (3) Coauthor CS, with synthetic OOD data created via: structure manipulation, feature interpolation, and label leave- out; and (4) ogbn-Arxiv OOD by year, and (5) one multi-graph scenario: Twi it Wwitchhaaerss Explicit, OOD by different graphs. Detailed splits are provided in Appendix A.6.
Baselines. We compared GOLD with 12 baseline models, classed into three categories. (1) Gen- eral non-OOD exposed methods: MSP (Hendrycks & Gimpel, 2017b), ODIN (Liang et al., 2018), Mahalanobis (short for Maha) (Lee et al., 2018b), and Energy (Liu et al., 2020), with GNN used as backbone. (2) Graph-specific non-OOD exposed detection methods: GKDE (Zhao et al., 2020), GPN (Stadler et al., ), GNNSAFE (Wu et al., 2023b), and NODES (Yang et al., 2024). (3) Real OOD exposed methods: adopts techniques from computer vision, such as OE (Hendrycks ct al., 2019) and Energy FT (Liu et al., 2020), along with the state-of-the-an arts GNNSafe++ (Wu et al., 2023b) and NODESAFE++ (Yang et al., 2024) for graph data. Note that OOD synthesis methods from computer vision (Du et al., 2022; 2023; Lee et al., 2018a; Tao et al., 2023) are not compared due to the non-trivial application from image graph.
Metrics. The following common practice metrics are used for evaluation: AUROC, AUPR, and FPR95 for OOD detection and Accuracy for ID classification. Metric details are in Appendix A.7.
Implementations. For fair comparison, GCN is used the backbone across all methods, with a layer depth of 2 and a hidden size of 64. The propagation iteration & in Eq. 5 is set to 2, and the controlling parameter of 0.5 is used. For LDM, the timestep T is configured within (600, 800, 1000). 31 = 10-4, and Br = 0.02. The demoising network D and the MLP detector model are implemented with varying layer and hidden dimension sizes within {2. 3} and {128, 256, 512) respectively, subject to the dataset. Additional hyperparameter analysis and parameter details are provided in Appendix 1. We use the Adam optimizer for optimisation (Kingma & Ba, 2015).
4.1 OVERALL PERFORMANCE
Our Non-OOD exposed GOLD can outperform Non-OOD exposure methods and is compet- itive with Real OOD exposed methods. As shown in Table 1. GOLD with LDM consistently surpasses the state-of-the thht---rttttttttt non-OOD exposure methods NODESAFE and GNNSAFE by large margin across all datasets, as indicated by the teal colouring. When using VAE as LGM, the OOD detection performance is very close while being more lightweight due to the model design. GOLD
7

---

Published as a conference paper at ICLR 2025
with VAE can achieve ofate-of-the-rr performance especially when the datasets are challenging for general methods, like Twitch and Arxiv. Additionally, considering LDM as the genera- tive model, GOLD can largely outperform GNNSAFE++ and achieves better performance than the SOTA NODESAFE++ in OOD detection for Twitch and CORA, as highlighted in bold. While for Ama zon, Coauthor, and Arxiv dataset, GOLD can achieve comparable performance with GNNSAFE++ while not significantly surpassing them. The reason can be two-fold. For Amazon and Coauthor, the classifier and the OOD detector are already in high performance, which leads to the fact that the energy from the classifier and the information given by the real OOD data have already been well utilised. The pseudo-OOD generation in GOLD cannot provide much more use- ful supervision signals for the detector. Nonetheless, GOLD still largely outperforms the non-OOD exposure. While for the Arxiv dataset, the OOD situation defined by time, which leads to a huge boost of OOD information when exposing a real OOD dataset. In contrast, for GOLD, the pseudo- OOD generation largely limited by the ID accuracy of the classifier at 50%. A more detailed table with individual OOD test set performance and variance can be found in Appendix A.9.
Since GOLD uses GNNSAFE as the backbone, the following detailed experiments are mainly con- ducted based the comparison with the base GNNSAFE/++ approach. GOLD with LDM is used as the default model without specific notation.
4.2 VISUALISATION OF ENERGY SCORE GAP
This experiment presents the energy distribution of GOLD and GNNSAFE. Figures 4a and 4d dis- play a distinct separation in the energy scores of ID and p-OOD, as well as ID and OOD, produced by the detector, exemplifying the effectiveness of GOLD in distinguishing and amplify- ing the energy margin between II) and (P-)OOD data. Furthermore, Figures 4b and 4e illustrate the energy score distributions of the test ID) data, synthetic OOD data, and the test OOD data. These figures reveal an optimal and almost disjoint between ID and OOD data, where the thresholds tp and fOOD indicate a clear energy boundary, thereby indicating the efficacy of GOLD in simulating pseudo-OOD data to facilitate effective OOD detection. Compared with the energy distribution of test ID data, test OOD data and exposed OOD data from GNNSAFE in Figures 4c and 4f, GOLD can further separate the energy scores between the test ID and OOD data with the Sreudo-OOD data.
1.6
1.5
1.22
-00
Go
Roco
Densty
e -000
e'c
Density
1.0
Gonp
0.8
ein
0.8
coo
0.4
000
0.4
0.5
0.0
12
10
8
12
10
8
-6
-8
6
0
Energy score
Energy score
Energy score
(a) Twitch training (GOLD).
(b) Twi test (GOLD).
(c) Twit ch test (GNNSafet+).
1.50
5 0.075
> x1.5
5 1.00
1.50
6p-oco
é'p
2 0.75
1100
1.25
d/ocp
p000
Density
0.4
0.50
dp-c00
0.50
0.2
0.25
0.25
0.00
20
-15 -10
0.00
0.00
20
-10
-5
0.0
12
10
Energy score
Energy score
Energy score
(d) Cora-1..raining. (GOLD).
(c) Cora-1. (GOLD).
(f) Cora-li (GNNSafc++).
Energy score distributions for Twitch and Cora-L with GOLD and GNNSAFE++. The vertical green (red) dashed lines represent the thresholds in (toop) from Eq. 4. e denotes original energy scores from the GNN, while e' are transformed scores from the detector, with subscripts for ID, OOD, p-OOD (pseudo), and e-OOD (exposed) data. (a) & (d) show that transformed energy e' (green and red) can be further diverged from the original energy e (blue and orange). (b) & (c) indicate that GOLD can align the transformed energy e' for pseudo OOD (red) and real OOD (purple) in testing. At the same time, the transformed energy e' of ID (green) can be separated. (c) & (f) demonstrate that energy separation of test ID (blue) and OOD (pink) in GNNSAFE++ is not effective, such that although the exposed OOD (orange) can diverge far away from the ID (blue), the real OOD (pink) is still closer to the ID (blue).
Figure 4:
8

---

Published as a conference paper at ICLR 2025
4.3 ABLATION STUDY
Table 2: Ablation study.
Metrics
GNNSAFE
GNNSAFE++
who Adv.
weo Det.
GOLD
In the ablation study, two variants are stud-
AUROC
66.82
95.36
$4.59
77.70
99.46
Twites
AUPR
70.97
07.12
58.00
83.91
ied: (1) pre-training the LDM without the adversarial pipeline (w/o Adv.), and (2) re- moving the MLP detector, using GNN energy scores instead (w/o Det.). In Table 2. both the adversarial training paradigm and the new detector significantly contribute to the
FPR95
76.24
33.57
79.84
ACC
70.40
70.18
70.97
70.97
AUROX
91.25
92.98
AUPR
80.23
EPR95
47.38
38.44
46.33
34.01
17.83
ID ACC
80.37
%1.45
77.00
$0.70
$1.66
AUROC:
71.06
74.77
69.76
69.91
73.90
AUPR
50.64
83.21
78.93
79.05
82.52
EPROS
35.00
77.43
89.16
59:67
50.57
GOLD. The results reveal that without adver- sarial learning, the OOD detection performance has significant drop for all situations. This under-
ID ACC
$3.39
$3.50
49.89
49
50.59
scores the efficacy of the adversarial framework in pseudo-OOD exposure. Moreover, we observe a more unstable performance when removing the detector. In this scenario, the model can still surpass other baselines on datasets like Cora, but it shows a significant drop on others. This juxtaposi- tion exemplifies the necessity of the detector model in GOLD. Nonetheless, the results illustrate the importance of integrating all components to enhance the model's OOD) detection capabilities. We provide additional explanation and visualisation of the ablation study in Appendix A.
4.4 ADVERSARIAL. TRAINING ANALYSIS
Table 3: Adversarial training analysis.
GNNSAFE+*
To further assess the proposed adversarial train- ing framework, three variants of (pseudo-) OOD exposure studied: (1) using an ID- pretrained LDM to generate once to train GOLD (Gen. Once), which is the same as w/o Adv. in Section 4.3; (2) using an ID-pretrained LDM to generate multiple rounds of pseudo- OOD along the GOLD training loops (Gen. Multi); (3) using real OOD data instead of pSeudo-OOD to train GOLD (Real OOD). The results are detailed in Table 3, which highlights that using an ID-pre-trained generative model would not improve OOD detection performance. This is because without the adversarial training, the detector will be biased by set of inaccurate and close-to-ID pseudo-OOD data generated by the pre-trained diffusion model. When incorporating real OOD data to substitute the pseudo-OOD in our framework, the Real OOD variant can achieve consistently better performance than Gen. Once and Gen. Multi. For Arxiv, Real OOD can surpass our default GOLD model with the advantage of OOD exposure in this dataset. Furthermore, a comparison of the results after removing the adversar- ial process highlights the superiority of the adversarial framework, as all adversarial-basee methods outperform their non-adversarial baselines. This robust set of results validates the efficacy of our adversarial training paradigm in enhancing model performance for OOD detection. Despite these modifications, our synthetic-basee OOD detection continues to maintain strong performance.
AUROC
95.36
$4.59
34.35
97.55
99.46
ALPR
97.12
38
15.38
58.50
FPR95
33.57
59.71
57.00
14.39
1.75
AUROC
92.98
39.64
92.85
95.59
95.84
ALPR
$4.93
85.09
FPR99
38.44
46.35
30.11
21.54
17,83
ACC
$1.45
77.60
80.56
$1,66
AUROC
24.72
69.76
72.15
78,90
73.00
ALPR
$3.31
78993
80.57
H5.46
K2.52
FFROS
77.43
88.16
82.02
68.94
90.57
ID ACC
$3.50
49.89
$0.77
49.99
50,99
4.5 EFFECTIVENESS OF ENERGY REGULARISER
Extending beyond the previous analysis, observed that the energy regularisers in GOLD are important factors for OOD detection, especially for the divergence regularisation. We provide a comprehensive assessment of the energy regularisers, Lux from Eq. 10, LEReG from Eq. 4, and LDReg from Eq. 12, across three datasets: Twitch, Cora, and Amazon, reporting the average per- formance across subsets in Table 4. The default GOLD that incorporates all regularisers, consis- tently shows superior performance across all datasets, effectively indicating the contribution of the energy regularisers in OOD defection. Notably, each dataset exhibits different sensitivities to the absence or presence of specific regularisers. For instance, all datasets are significantly affected by the removal of LDReg. highlighting its critical role. There a substantial performance drop for Cora without LEREY- Additionally, individual regulariser performance is context-depender LDeEg emerging as particularly impactful, often driving better outcomes when combined with either of the other two regularisers. This is reflected in the best runner-up results, where LDReg is combined with another regulariser, underscoring its influence as the most impactful of the three. Nonetheless, this analysis demonstrates the effectiveness of holistic approach of combining all proposed regu- larisers, as shown by GOLD's consistently high performance across all metrics and datasets. The extended performance of each subset is provided in Appendix A.9.
with

---

Published as a conference paper at ICLR 2025
Table 4: Energy regulariser analysis.
Twitch
Coza
Amazon
AUROC
AUPR
FPR
ID Ave
AUROC
AUPR
FPR
ID Acc
AUROC
AUPR
FPR
ID Acc
86.44
79.84
68.97
61.14
57.82
89.70
76.23
72.67
46.72
92.07
10.18
40.62
97.8 97.84
70.15
70.76
65.12
94.37
81.05
67.20
71.73
68.13
93.70
78.02
83.37
78.90
70.98
66.00
63.32
54,06
80.44
48.65
61.93
77.91
93.45
69.04
76.88
44.54
70.79
84.39
74.57
68.49
76.08
97.72
96.83
8.28
92.79
8
76.88
81.49
76.14
70.99
34.63
39.27
96.84
81.25
71.15
63.84
74.85
93.30
64,43
75,46
45.95
70.90
94.03
73.89
73.54
74.53
97.03
4.54
93.20
89.58
93.12
43.78
69.64
93.28
87.50
31.04
79.58
98.02
98.42
3.40
92.81
GOLD
99.46
99.62
1,78
68.49
95.84
91.17
17.83
81.66
98.81
98.92
2.07
92.99
4.6 COMPUTATIONAL COST
Table 5: Inference and training time (s) of GOLD.
Table 5 shows that GOLD gener- ally achieves very close inference time, and a faster (w/ VAΣ) or com- parable (w/LDM) training time rel- ative to the GNNSafe(++)) baseline. This is under the situation that the non-OOD exposed GOLD outperforms the existing non-OOD
GNNSAFE Train.
GNNSAFE++ Train.
GOLD w/ VAE
GOLD LDM
Inf.
Train.
Train.
Twi:ch
0.08
2.41
0.09
4.74
0.09
2.78
0.10
8.96
Cora-2
0.03
4.40
0.03
5.32
0.04
3.91
0.04
5.93
Amazon-7
13.51
12.52
0.07
Coauthor-F
0.35
57.80
0.36
67.83
0.35
55.65
0.37
89.74
0.40
85.25
0.40
132.36
0.45
80.77
0.47
244.95
exposure methods, while matching or surpassing the real-OOD exposed SOTA baselines, all under the same backbone. In addition to the high-performing L.DM variant, a lightweight VAF is also ex- perimented, providing efficient alternative with comparable performance. Thus, consider this training cost as an acceptable trade-off for improved OOD detection performance, and is discussed in Appendix A.4. However, highlight that GOLD can achieve similar inference time as the baselines, regardless of the LGM, as shown in Table 5. This reveals a competitive application of GOLD while having strong performance. We provide detailed results in Appendix 1.
RELATED WORK
Our work intersects with three major research areas: 1) Non-OOOD- OOD Detection that purely relies on ID data for detecting OOD instances, this involves score-based methods, feature learning, and techniques specific for graph-structured data (Lee et al., 2018a; Hendrycks & Gimpel, 2017a;b; Koo et al., 2024; Liu et al., 2020; Ding & Shi, 2023; Ma et al.. 2023; Zhao et al., 2020; Liu et al., 2023b; Li et al., 2022b; Wu al., 2023b; Yang et al., 2024); OOD Exposure-Based OOD Detection, prominent line of work that adopts auxiliary OOD data to assist training, often achieving higher performance than non-OOD-expe exposuuo based methods (Hendrycks et al., 2019; Liu et al., 2020; Park et al., 2023; Zhu et al., 2023; Zheng et al., 2023; Du et al., 2024; Wu et al., 2023b; Bao et al., 2024); and 3) OOD Generation, a more recent field that aims to synthesise OOD-like data to assist OOD detection (Vernekar et al., 2019; Serrà et al., 2020; Xiao et al., 2020: Wang et al., 2020; Nalisnick et al., 2019; Schirmeister ct al., 2020; Lee et al., 201 Du et al., 2022; Tao et al., 2023). Notably for graph data, GNNSAFF considers the inter-dependence nature of node instances and proposes an energy propagation schema, and explores an OOD-exposed variant GNNSAFE++ (Wu et al., 2023b). NODESAFE/++ builds upon GNNSAFE/++ and proposes additional regularisation terms to reduce and bound the generation of extreme energy scores (Yang et al., 2024). Bao et al. (2024) proposes a generalised Dirichlet energy score for graph OOD detection. detailed review of related work is provided in Appendix A.3.
6 CONCLUSION
In this paper, we propose GOLD, a novel graph OOD detection framework with latent generative model trained in a novel implicit adversarial paradigm. Unlike methods that rely on pre-trained generative models or real OOD data requiring auxiliary data inputs, GOLD synthesises pseudo- OOD data to inherit OOD characteristics through the implicit adversarial framework, solely based on ID data. An effective OOD detector head is further designed to address the difficulties with multiple classes in the logit space, optimising the energy score for improved detection. Extensive experiments show the efficacy of GOLD, outperforming SOTA non- and OOD-exposed methods. We hope this work inspires future synthetic- based graph OOD detection research for roal-world applications.
10

---

Published as a conference paper at ICLR 2025
7 ACKNOWLEDGEMENT
This research has been partially supported by Australian Research Council Discovery Projects (DP230101196, DP24010306, DE250100919 and CE200100025).
REPRODUCIBILITY STATEMENT
To support reproducible research, summarise our efforts below:
1. Baselines & Datasets. We follow the baseline from (Wu et al., 2023b) and utilise publicly available datasets. The details are described Section and Appendix A.6.
2. Model training. Our implementation of the energy-based OOD detector builds upon the open-sourced work GNNSAFE by Wu et al. (2023b), https: / /github. com/ Detailed implementation setting provided Sec-
tion 4 and Appendix A.8.
3. Methodology. Our GOLD framework is fully documented in Section 3. In addition, we provide detailed pseudo code in Algorithm
4. Evaluation Metrics. We discuss the evaluation metrics used in Section 4 and Appendix
A.7.

---

Published as a conference paper at ICLR 2025
REFERENCES
Sami Abu-EI-Haija, Bryan Perozzi, Amol Kapoor, Nazanin Alipourfard, Kristina Lerman, Hrayr Harutyunyan, Greg Ver Steeg, and Aram Galstyan. Mixhop: Higher-order graph convolutional architectures via sparsified neighborhood mixing. In ICML, 2019.
David Ahmedt-Ariisizzball Mohammad Ali Armin, Simon Denman, Clinton Fookes, and Lars Pe- tersson. Graph-based deep learning for medical diagnosis and analysis: Past, present and future. Sensors, 21 (1(1):475 2021. doi: 00.3390/S2211440 44758. URL htt.t:/t//// http://ooioo///////////oo 3390/ s21144758.
Tianyi Bao, Qitian Wu, Zetian Jiang, Yiting Chen, Jiawei Sun, and Junchi Yan. Graph out-of- distribution detection goes neighborhood shaping. ICML, 2024.
Gleb Bazhenov, Sergei Ivanov, Maxim Panov, Alexey Zaytsev, and Evgeny Burnaev. Towards OOD detection in graph classification from uncertainty estimation perspective. CoRR, 2022.
Julian Bitterwolf, Alexander Meinke, and Matthias Hein. Certifiably adversarially robust detection of out-of distribution data. In NeurIPS, 2020.
Tianshi Cao, Chinwei Huang, David Yu-Tung Hui, and Joseph Paul Cohen. A benchmark of medical out of distribution detection. CoRR, 0as/2007.04250 2020. URL https://arxiv.. org/
abs/2007. 04250.
Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. distribution detection using outlier mining. In ECML PKDD, 2021.
ATOM: robustifying out-of-
Qichao Chen, Zhiyuan Chen, Tomás Maul, Kuan Li, and Jianping Yin. Outlier exposure with focal loss for out-of-distribution detection. In ACAI, 2023.
Yongqiang Chen, Yonggang Zhang, Yatao Bian, Han Yang, Kaili Ma, Binghui Xie, Tongliang Liu, Bo Han, and James Cheng. Learning causally invariant representations for out-of-distribution generalization graphs. In NeurlPS, 2022.
Sung-Ik Choi and Sac- Young Chung. Novelty detection via blurring. In ICLR, 2020.
Zihang Dai, Zhilin Yang, Fan Yang. William W. Cohen, and Ruslan Salakhutdinov. Good semi- supervised learning that requires a bad GAN. In NeurIPS, 2017.
Mucong Ding, Kezhi Kong, Jiuhai Chen, John Kirchenbauer, Micah Goldblum, David Wipf, Furong Huang, and Tom Goldstein. A closer look at distribution shifts and out-of-distribution generaliza- tion on graphs. In NeurIPS Workshop. 2021.
Zhihao Ding and Jieming Shi. SGOOD: substructure-eehaaned graph-level vut-of-distributt de- tection. CORR, 2023.
Andrija Djurisie, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple activation shaping for out-of-distribution detection. In ICLR, 2023.
Xin Dong, Junfeng Guo, Ang Li, Wei-Te Ting, Cong Liu, and H. T. Kung. Neural mean discrepancy for efficient out-of-distributiin detection. In CVPR, 2022.
Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. VOS: learning what you don't know by virtual outlier synthesis. In ICLR, 2022.
Xuefeng Du Yiyou Sun, Jerry Zhu, and Yixuan Li. Dream the impossible: Outlier imagination with diffusion models. In NearlPS, 2023.
Xuefeng Du, Zhen Fang. Hlass Diakonikolas, and Yixuan Li. How does unlabeled data provably help out-of-distributtin detection? In ICLR, 2024.
lakovos Evdaimon, Giannis Nikolentzos, Michail Chatzianastasis, Hadi Abdine, and Michalis Vazir- giannis. Neural graph generator: Feature-condittonee graph generation using latent diffusion models. CoRR, 2024.
12

---

Published as a conference paper at ICLR 2025
Mauro Giuffrè and Dennis L. Shung. Harnessing the power of synthetie data in healthcare: innova- tion, application, and privacy. npj Digit. Medicine, 2023.
Will Grathwohl, Kuan-Chieh Wang, Jörn-Henrik Jacobsen, David Duvenaud, Mohammad Norouzi, and Kevin Swersky. Your classifier is secretly an energy based model and you should treat it like one. In ICLR, 2020.
Shurui Gui, Xiner Li, Limei Wang, and Shuiwang Ji. GOOD: A graph out-of-distribution bench- mark. In NeurIPS, 2022.
Yuxin Guo, Cheng Yang, Yuluo Chen, Jixi Liu, Chuan Shi, and Junping Du. A data-centric frame- work to endow graph neural networks with out-of--istribus detection ability. In KDD, 2023.
William L. Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. In NeurlPS, 2017.
Matthias Hein, Maksym Andriushchenko, and Julian Bitterwolf. Why relu networks yield high- confidence predictions far away from the training data and how to mitigate the problem. In CVPR, 2019.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. In ICLR, 2017a.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. In ICLR, 2017b.
Dan Hendrycks, Mantas Mazeika, and Thomas G. Dietterich. Deep anomaly detection with outlier exposure. In ICLR, 2019.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In NeurIPS, 2020.
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized ODIN: detecting out-of- distribution image without learning from out-of-distribution data. In CVPR, 2020.
Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning on graphs. In NeurlPS, 2020.
Tiancheng Huang, Donglin Wang, Yuan Fang, and Zhengyu Chen. End-to-end open-set semi- supervised node classification with out-of-distribution detection. In IJCAI, 2022a.
Tianjin Huang, Tianlong Chen, Meng Fang. Vlado Menkovski, Jiaxu Zhao, Lu Yin, Yulong Pei, Decebal Constantin Mocanu, Zhangyang Wang, Mykola Pechenizkiy, and Shiwei Liu. You can have better graph neural networks by not training weights at all: Finding untrained gnns tickets. In LoG, 2022b.
Wenjian Huang, Hao Wang, Jiahao Xia, Chengyan Wang, and Jianguo Zhang. Density-driven regu- larization for distr--iittiittio detection. In NeurlPS, 2022c.
Yuanfeng Ji, Lu Zhang, Jiaxiang Wu, Bingzhe Wu, Long- Kai Huang, Tingyang Xu, Yu Rong, Lan- qing Li, Jie Ren, Ding Xue, Houtim Lai, Shaoyong Xu, Jing Feng. Wei Liu, Ping Luo, Shuigeng Zhou, Junzhou Huang, Peilin Zhao, and Yatao Bian. Drugood: Out-of-distribution (OOD) dataset curator and benchmark for ai-aided drug discovery focus on affinity prediction problems with noise annotations. CoRR, 2022.
Xue Jiang. Feng Liu, Zhen Fang, Hong Chen, Tongliang Liu, Feng Zheng, and Bo Han. Detecting out-of-distributtio data through in-distribution class prior. In ICMI. 2023.
Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In ICLR, 2015.
Diederik P. Kingma and Max Welling. Auto-encoding variational bayes. In ICLR, 2014.
Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional net-
works. In ICIR, 2017.
13

---

Published as a conference paper at ICLR 2025
Jiin Koo, Sungjoon Choi, and Sangheum Hwang. Generalized outlier exposure: Towards trust- worthy -uttof--isttibution detector without sacrificing accuracy. Neurocomputinng. 2024.
Mare Lafon, Elias Ramzi, Clément Rambour, and Nicolas Thome. Hybrid energy based model in the feature space for out-of-distribution detection. In ICML, 2023.
Hao Lang, Yinhe Zheng, Yixuan Li, Jian Sun, Fei Huang, and Yongbin Li. A survey on out-of- distribution detection in NLP. CoRR, 2023.
Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibrated classifiers for detecting out- -ittof--iitribttoon samples. In ICLR, 2018a.
Kimin Lee, Kihok Lee, Honglak Lee, and Jinwoo Shin. simple unified framework for detecting out-of-distribution samples and adversarial attacks. In NeurlPS, 2018b.
Seul Lee, Jaehyeong Jo, and Sung Ju Hwang. Exploring chemical space with score-based out-of- distribution generation. In ICMI., 2023a.
Seungyeon Lee, Changehang Yin, and Ping Zhang. Stable clinical risk prediction against distribution shift in electronic health records. Patterns, 2023b.
Haoyang Li, Xin Wang, Ziwei Zhang, and Wenwu Zhu. Out-of-distribution generalization on graphs: A survey. CoRR, 2022a.
Haoyang Li, Xin Wang, Ziwei Zhang, and Wenwu Zhu, OOD-GNN: out-of-distribttion generalized graph neural network. IEEE Trans. Knowl. Data Eng., 2023.
Kuan Li, YiWen Chen, Yang Liu, Jin Wang, Qing He, Minhao Cheng, and Xiang Ao. Boosting the adversarial robustness of graph neural networks: An ood perspective. In ICLR, 2024.
Zenan Li. Qitian Wu, Fan Nic, and Junchi Yan. Graphde: A generative framework for debiased learning and distr--disttiiutio detection on graphs. NeurlPS, 2022b.
Shiyu Liang Yixuan Li, and R. Srikant. Enhancing the reliability of -uttof-distriiution image detection in neural networks. In ICLR, 2018
Ziqian Lin, Sreya Dutta Roy, and Yixuan Li. MOOD: multi-level out-of-distributtin detection. In CVPR, 2021.
Jiawei Liu, Cheng Yang. Zhiyuan Lu, Junze Chen, Yibo Li, Mengmei Zhang, Ting Bai, Yuan Fang, Lichao Sun, Philip S. Yu, and Chuan Shi. Towards graph foundation models: A survey and beyond. CoRR, 2023a.
Weitang Liu, Xiaoyun Wang, John D. Owens, and Yixuan Energy-based out-of-distribution detection. In NewrIPS, 2020.
Yixin Liu, Kaize Ding, Huan Liu, and Shirui Pan. GOOD-D: on unsupervised graph out-of- distribution detection. In WSDM, 2023b.
Longfei Ma. Yiyou Sun, Kaize Ding, and Fei Wu. Score propagation catalyst for graph out-of- distribution detection: A theoretical and empirical study. In ICLR, 2023.
Julian J. McAuley, Christopher Targett, Qinfeng Shi, and Anton van den Hengel. Image-based recommendations on styles and substitutes. In SIGIR, 2015.
Eric T. Nalisnick, Akihiro Matsukawa, Yee whye Teh, Dilan Görür, and Balaji Lakshminarayanan.
Do deep generative models know what they don't it know? In ICLR, 2019.
Aristotelis-Angelle Papadopoulos, Mohammad Reza Rajati, Nazim Shaikh, and Jiamian Wang. Outlier exposure with confidence control for out-of-distribution detection. Neurocomputing, 2021.
Sangha Park, Jisoo Mok, Dahuin Jung, Sachyung Lee, and Sungroh Yoon. On the powerfulness of textual outlier exposure for visual ood detection. In NewrIPS, 2023.
14

---

Published as a conference paper at ICLR 2025
Jie Ren, Peter J. Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark A. DePristo, Joshua V. Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distribution detection. In NeurIPS, 2019.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In CVPR, 2022.
Benedek Rozemberczki and Rik Sarkar. Twitch gamers: dataset for evaluating proximity preserv- ing and structural role-based node embeddings. CoRR, 2021.
Robin Schirrmeister, Yuxuan Zhou, Tonio Ball, and Dan Zhang. Understanding anomaly detection with deep invertible networks through hierarchies of distributions and features. In NeurlPS, 2020.
Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Gallagher, and Tina Eliassi-Rad. Collective classification network data. Mag., 2008.
Joan Serrà, David Álvarez, Vicenç Gómez, Olga Slizovskaia, José F. Núñez, and Jordi Luque. Input complexity and 2020.
detection with likelihood-based generative models. In ICLR,
Xu Shen, Yili Wang, Kaixiong Zhou, Shirui Pan, and Xin Wang. Optimizing ood detection in molecular graphs: A novel approach with diffusion models. CoRR, 2024.
Yu Song and Donglin Wang. Learning on graphs with outoo--distribution nodes. In KDD, 2022.
Maximilian Stadler, Bertrand Charpentier, Simon Geisler, Daniel Zügner, and Stephan Günnemann. Graph posterior network: Bayesian predictive uncertainty for node classification. In NeurIPS, 2021.
Yiyou Sun and Yixuan Li. DICE: leveraging sparsification for out-of-distribution detection. In ECCV, 2022.
Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distribution detection with rectified activa- tions. In NeurlPS, 2021.
Leitian Tao, Xuefeng Du, Jerry Zhu, and Yixuan Li. Non-parametric outlier synthesis. In ICLR, 2023.
Puja Trivedi, Mark Heimann, Rushil Anirudh, Danai Koutra, and Jayaraman J. Thiagarajan. Aceu- rate and scalable estimation of epistemic uncertainty for graph neural networks. ICLR, 2024.
Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks. In ICLR, 2018.
Sachin Vernekar, Ashish Gaurav, Vahdat Abdelzad, Taylor Denouden, Rick Salay, and Krzysztof Czarnecki. Out-of-distribution detection in classifiers via generation. CoRR, 2019.
Apoorv Vyas, Nataraj Jammalamadaka, Xia Zhu, Dipankar Das, Bharat Kaul, and Theodore L.. Willke. Out-of-distribttion detection using an ensemble of self supervised leave-out classifiers. In ECCV, 2018.
Han Wang and Yixuan Li. A graph-theoretic framework for joint ood generalization and detection. In CoRR, 2023.
Haoran Wang, Weitang Liu, Alex Bocchieri, and Yixuan Li. Can multi-label classification networks know what they don't it know? NeurIPS, 2021.
Luzhi Wang, Dongxiao He, He Zhang, Yixin Liu, Wenjie Wang. Shirui Pan, Di Jin, and Tat-Seng Chua. GOODAT: towards test-time graph out-of-distiitttion detection. In AAAI, 2024.
Ziyu Wang, Bin Dai, David P. Wipf, and Jun Zhu. Further analysis of outlier detection with deep generative models. In NeurlPS, 2020.
Aming Wu, Da Chen, and Cheng Deng. Deep feature deblurring diffusion for detecting out-of- distribution objects. In ICCV, 2023a.
15

---

Published as a conference paper at ICLR 2025
Qitian Wu, Yiting Chen, Chenxiao Yang, and Junchi Yan. Energy-based for graph neural networks. In ICLR, 2023b.
detection
Zhisheng Xiao, Qing Yan, and Yali Amit. Likelihood regret: An out-of-distribution detection score for variational auto-encoder. In NeurIPS, 2020.
Jingkang Yang. Kaiyang Zhou, Yixuan Li, and Ziwei Liu, Generalized out-of-distribution detection: A survey. CoRR, 2021.
Jingkang Yang, Kaiyang Zhou, and Ziwei Liu. Full-spectrum out-of-distribution detection. Int. J. Comput. Vis., 2023a.
Lina Yang, Bin Lu, and Xiaoying Gan. Graph open-set recognition via entropy message passing. In ICDM, 2023b.
Nianzu Yang, Kaipeng Zeng, Qitian Wu, Xiaosong Jia, and Junchi Yan. Learning substructure invariance for out-of distrbbuutn molecular representations. In NeurlPS, 2022.
Shenzhi Yang, Bin Liang, An Liu, Lin Gui. Xingkai Yao, and Xiaofang Zhang. Bounded and uniform energy-based out-of-distribution detection for graphs. In ICML, 2024.
Junchi Yu, Jian Liang, and Ran He. Mind the label shift of augmentation--uased graph OOD gener- alization. In CVPR, 2023.
Xujiang Zhao, Feng Chen, Shu Hu, and Jin-Hee Cho. Uncertainty aware semi-supervised learning on graph data. In NeurlPS, 2020.
Haotian Zheng, Qizhou Wang, Zhen Fang, Xiaobo Xia, Feng Liu, Tongliang Liu, and Bo Han. Out- of-distribution detection learning with unreliable out-of-distribution sources. NeurIPS, 2023.
Cai Zhou, Xiyuan Wang, and Muhan Zhang. Latent graph diffusion: A unified framework for generation and prediction graphs. CoRR, 2024.
Yangze Zhou, Gitta Kutyniok, and Bruno Ribeiro. OOD link prediction generalization capabilities of message-passing gnns in larger test graphs In NeurIPS, 2022.
Jianing Zhu, Yu Geng, Jiangchao Yao, Tongliang Liu, Gang Niu, Masashi Sugiyama, and Bo Han. Diversified outlier exposure for disti--iittoonttion detection via informative extrapolation. In NeurlPS, 2023.
16

---

Published as a conference paper at ICLR 2025
A APPENDIX
In the Appendix, we provide additional supplementary material to the main paper. The structure is as follows:
We provide the proof for Proposition in A.I.
An extended related work is detailed in A.3.
Potential Limitations is discussed in A.4.
Preliminary GNN description is described in A.5.
We provide the description of datasets in A.6.
The evaluation metrics and implementation details are provided in A.7 and A.8.
Additional experiment results, including extended subset performance, ablation study vi- sualisations, empirical evaluations of logits vs. softmax scores, and computational cost are detailed in A.9, A. A.2, A.12.
Descriptions of the latent generative models: 1) Latent diffusion model, and 2) Variational autoencoder are provided in A.11.
A.1 PROOF FOR PROPOSITION 1.
Proof. Let lo denote the logits of the MLP detector with parameter 0 for class y, e denote the softmax function. Assume the hyper-parameters =
Note that:
Olog(e cb)
c des Obg c 89
(15)
00
& + 8
The gradient of MinMLP - -Luue + DDREY)
w.r.t is given by:
HLumc
log (lo(((lo())))oo))
a (lo(@(()(e))))))
EjnPpo00
00
00
00
i logl (otes) + (o(e)
θ Olog
Pains (o) +o (
-.EA-P
E Ejj 0000
00
00
0loo log(e clo(c))t11)
En
[ol((e)(1]
log(c/o(ez)o) + clo(e))1n)]
(16)
PooOD
00
(ls(e))
daleddo olle:) + elalec) 0lo(es)u 80
00
dole:)o + clo(e))
alo(e))
(o(e)) ololes)o cl(e)) (l((e)) 89
+ EjxPponn
00
doles)on do(())
Notice that max 6; <f) and max(0, of e,) are positive and monotonie, the optimised 0 that minimises the functions (arg min) would also minimise max(0, e; ee(2 and max(0, e' -e,)² thus, consider the gradient of a surrogate function of LiREy as L
17

---

Published as a conference paper at ICLR 2025
ÖLneeRs
0
B Pro Pio max (0,e: -e()
00 Proco max (0, eg)
00
00
e; c 0 or c/ C the gradient is O, else:
0
Bir
e + log(c/olls)) + c
00
[ log(e + elllssh Ej
E3 Bj Ps000
00
b Olog(eble))n) eloles))))
-Ei-PI
(17)
00 θ Dogeooolesio + elo(es)uu))
Ppoon
00
c (e:) clo(ss)
ala(e
(o(e)) + cl((s))
cloles) ( + elo(es) Blote))
+ Prji.
do(o)) + clles)
ULme
@LDReSS)
(es()))
(ole))o Ma(es)o + (es))u (es(
-(
+
= EiNPo
89
00
00
00
coo + (
alo(e))
(os()) Olo(e,)o + cl((s))
ola(es) 00
+ Ej- PROOD
00
00
doles)oo (l(()))
clo(s)) ol((e)) + elles))
alo(e:)1u
-E nlo
80
dalessool + clo(ss)
el(es))o Malee))a + elo(e)) (ll(e))
+ Ej- Ppomo
89
clole))oo + clo(e)mm
(18)
Define the energy w.r.t. label as E(e, v) = -l((e)
aE 0)
Ej-P,00 dE(e,, 1)
= EiPAo
00
00
-2 (ollole))i DE 0)
+ (loo(e))) @E(e,,
00
00
aE(c,. 0)
Ej~Ppon (1 - 20(lo(e)))))) 1E(e,,1)
ENPO
00
00
OE(e;,
2
00
From the above equation, the training procedure that overall minimises the first order gradient of the negative sum of Lume and the surrogate function of LiReg will decrease the energy score E(e;, 0;4, for in-distribution data, and increase the energy score B(e,, 1o) and Ele,, 0; (a) for pseudo-OOD data, given
0.5 as the detector continues improve detection performance.
A.2 LOGITS SOFTMAX DISCREPANCY
In this section, we present an empirical evaluation of the Logits vs. Softmax discrepancy between ID and OOD data from the detector. It is evident from Figure 5, while the softmax confidence scores present high confidence for ID and OOD instances, where the majority of the scores corresponding to the respective class were close to (based on the marginal distribution), the energy scores provide more meaningful information for distinguishing between them. Notably, ID data typically possess higher and positive ID Logits and lower OOD logits than OOD data. Thereby, leading to more distinguishable energy scores than softmax for OOD detection.
18

---

Published as a conference paper at ICLR 2025
Data
12
Dat
0G0 Dats
0CO Data
20-
0.-
0.6
0.4
-10-
0.
-70
0.0
-30
-02
0.8
000
000
(a) Logits Joint distribution
(b) Softmax Joint distribution
Figure 5: Logits vs. Softmax joint distribution plot for Twitch dataset.
A.3 EXTENDED RELATED WORK
Von-OOOD-xposure OOD Detection. OOD detection is a fundamental task extensively studied in diverse machine learning domains (Lee et al., 201 8a; Lafon et al., 2023; Jiang et al., 2023; Huang et al., 2022e; Hendrycks & Gimpel, 2017b; Lee et al., 2018b; Koo et al., 2024; Papadopoulos purely ID data is based on the model's 's output including using softmax score (Hendrycks & Gimpel, 2017a; Liang et al., 2018), us- ing energy score (Liu al., 2020; Wang et al., 2021; Yang et al., 2024), and activation muning-basedd methods (Djurisic et al., 2023; Sun & Li, 2022; Sun et al., 2021), 1). Other approaches involve confi- dence enhancement (Hsu et al., 2020; Hein al., 2019; Vyas et al., 2018), feature learning (Lin et al., 2021; Dong et al., 2022), and adversarial strategies (Bitterwolf et al., 2020; Chen et al., 2021; Choi & Chung, 2020). More recent studies have applied OOD detection graph-structured data (Ding & Shi, 2023; Ma et al., 2023; Wang et al., 2024; Huang et al., 2022a;b; Trivedi et al., 2024; Yang et al., 2023b; Li et al., 2024; Wang & Li, 2023; Gui et al., 2022: Bazhenov et al., 2022). For node-level de- tection, GNNSAFE considers the dependdeeeeeence nature of node instances and proposes energy propagation schema (Wu et al., 2023b). NODESAFE builds upon GNNSAFF and proposes addi- tional regularisation terms to reduce and bound the generation of extreme energy scores (Yang al., 2024). GKDE proposes a multi-source uncertainty framework to estimate the node-level Dirich- let distributions to assist OOD detection (Zhao et al., 2020). GPN applies Bayesian posterior and density estimation to estimate the uncertainty for each node (Stadler et al., 2021). For graph-level detection, recent methods include modelling distribution shifts through a graph generative process, overseeing from a data-centric perspective, and unsupervised methods (Li et al., 2022b; Guo et al., 2023; Liu et al., 2023b).
al.,
2021: Chen et al., 2023). A representative line of work that relies
OOD Exposure- Based OOD Detection. OOD exposure is another prominent line of work that adopts auxiliary OOD data to assist training (Hendrycks et al., 2019; Liu et al., 2020; Park al., 2023: Zhu et al., 2023; Zheng et al., 2023; Du et al., 2024; Wu et al., 2023b). The aforementioned GNNSAFE model also considers additional version GNNSAFE++ to adopt OOD exposure and has shown greater performance than the standard model (Wu et al., 2023b). Yang et al. (2024) also presents NODESAFE++ as an extended OOD exposed version. Bao et al. (2024) proposes generalised Dirichlet energy score for OOD detection. Our proposed GOLD method attempts to take advantage of the effectiveness of OOD exposure by synthesising samples that exhibit OOD characteristics. Thus, avoiding the necessity of real OOD data during training.
OOD Generation. Recent studies begin to work synthesising OOD data (Vernekar al., 2019; Serrà et al., 2020; Xiao et al., 2020; Wang et al., 2020; Nalisnick et al., 2019; Schirmeisstr et al., 2020; Lee et al., 201 10;;; Du et al., 2022; Tao al., 2023). GAN-based approach is proposed
19

---

Published as a conference paper at ICLR 2025
to generate OOD data by jointly training confidence classifier (Lee et al., 2018a). VOS gener- ates synthetic outliers from low low-probability regions of multivariate Gaussian distributions (Du et al., 2022). Recently.pre- trained diffusion models have been widely employed for OOD generation in- cluding DFDD (Wu et al., 2023a), Dream-OOD (Du et al., 2023). Several initial graph-level OOD studies have been initiated, predominantly for molecule (Lee et al., 2023a; Shen et al., 2024). A score-based OOD molecule generation model is proposed by MOOD (Lee et al., 2023a), which em- ploys an OOD-controlled reverse-timg diffusion. A recent work PGR-MOOD (Shen al., 2024) proposes to rely on pre-trained molecule diffusion for generation. These methods typically rely on pre-trained models that are trained with additional data. In contrast, GOLD does not rely on pre-trained generative models to synthesise pseudo-OOD data.
A.4 POTENTIAL LIMITATIONS
In our concluding remarks, we highlight that our methodology leverages generative model (specif- ically, diffusion model) to generate effective pseudo-OOD instances for OOD detection. To curb computational expenses, we employ a latent diffusion model, which reduces the computational de- mands of direct input space manipulation. Despite this, training-timm efficiency may still be im- pacted. Nonetheless, during the inference phase, model does not necessitate the generation of extra data, thus mitigating the impact of high latency. Moreover, we have experimented with a lightweight VAE as the latent generative model, which can achieve competitive computational time as the standard SOTA baselines. Additionally, our approach currently targets node-level prediction tasks: however, we envisage its upplicability to graph-level OOD detection, which we leave for fu- ture research. Following the propositions of Liu et al. (2020) and Wu et al. (2023b), our framework incorporates an energy-bounded regulariser that ideally ensures ID scores are lower than those of OOD samples, as illustrated in our visualisations in Section 4.2. Extended experiments detailed in Table 19 reveal that using only the energy regulariser results in AUROC scores near the single-digit range. This outcome highlights the regulariser's 's limitations and challenges the assumption that OOD energy scores consistently exceed ID scores, thereby undermining the effectiveness of the OOD met- ric in true detection performance. Nevertheless, framework introduces an additional regulariser, which effectively addresses these discrepancies, as showcased by our consistently positive results.
A.5 GNN
GNNs, by their very nature, excel in modelling the complex relationship of node-dependence in graphs. Central their success is the message-passing mechanism, which iteratively aggregates neighbouring information towards the centre node to capture both local and global knowledge. De- note the learnt representation of node i at the I-th layer as h (1)
typical Graph Convolutional
Network (GCN) executes recursive layer propagation via:
H oD -D-11/2An AD 1/2 w()), H 11 ()) = X
(19)
with A = A - I, where I is the identity matrix, D is the diagonal degree matrix of A, a is a non- linear activation function (i.e., ReLU),, and W()) is the corresponding weight matrix at layer I (Kipf & Welling, 2017).
A.6 DESCRIPTION OF DATASETS
The datasets utilised in this study are publicly available benchmark datasets for graph learning. We follow the same data collection and processing protocol in Wu et al. (2023b) and utilised the data loader for the ogbn-Arxiv dataset provided by the OGB package?, and others from the Pytorch Geometric Package'. For all datasets, we follow the provided splits and generation process in Wu et al. (2023b). We provide a brief description of the datasets below:
The Twit TwitchGamers social network from a different region (Rozemberezki & Sarkar, 2021). The nodes within these subgraphs indicate Twitch gamers, while the edges depict the follower relationships between two
Explicit dataset consists of multiple subgraphs, each representing
20

---

Published as a conference paper at ICLR 2025
users. Node features include embeddings based on the games played by Twitch users, and for this study, we focus on the label that indicates whether a user broadcasts mature content (i.e., Explicit).
We utilise subgraph DE ID data, and subgraphs ES, FR, RU as testing data. Dataset details are provided in Table 6.
Twitch
Splits
# Nodes
Edges
Feature Dimension
# Classes
Twitch-DD
ID
9498
315774
128
Twitch-ES
OOD
4648
123412
128
Twitch-FR
00D
6551
231883
128
Twitch-RR
0OD
4385
78993
128
Table 6: Twi tch dataset overview
The Cora dataset is citation network where each node represents published paper, and each edge reflects a citation relationship between papers (Sen et al., 2008). The dataset consists of seven labels. Since Cora does not contain explicit domain attribute to partition into OOD subgraphs, we follow the provided protocol in Wu et al. (2023b), and synthetically create the OOD data as mentioned in Section 4. Dataset details provided in Table 7.
Cora
Splits
# Nodes
# Edges
Feature Dimension
# Classes
Cora-S
ID
2708
10556
1433
7
Cora
OOD
2708
6696
1433
7
Cora
ID
2708
10556
1433
7
Cora
OOD
2708
10556
1433
7
Cora-L
ID
904
10556
1433
3
Cora-L
OOD
986
10556
1433
3
Table 7: Cora dataset overview
The Maazoon-Phott dataset forms an item co-purchasing network on Amazon, where each node represents product and each edge signifies that the linked products are frequently bought to- gether (McAuley et al., 2015). Node labels categorise the products. Similar to the Cora dataset, we employ three synthetic methods to create the OOD data due the lack of clear domain for partition. Dataset details are provided in Table 8.
Amazon-Photo
Splits
# Nodes
# Edges
Feature Dimension
Classes
Amazon-$
ID
7650
238162
745
8
Amazon-S
0OD
7650
149168
745
8
Amazon-F
ID
7650
238162
745
8
Amazon-F
0OD
7650
238162
745
8
Amazon-I
3095
238162
3
Amazon-L
0OD
3673
238162
745
4
Table 8: Amazon-Photo dataset overview
The Coauthor-CC dataset describes a network computer science coauthors. Such that each node represents author, and edges connect any two authors who have collaborated
paper. The dataset aims to classify authors into their respective fields of study based on the keywords from their publications, which also used node features. Due to the lack of a clear domain to split the data, OOD graphs were constructed following the same protocol aforementioned. Dataset details provided in Table 9.
21

---

Published as a conference paper at ICLR 2025
Coauthor-CS
Splits
# Nodes
Edges
Feature Dimension
# Classes
Coauthor-S
ID
18333
163788
6805
15
Coauthor-S
OOD
18333
92802
6805
15
Coauthor-F
ID
18333
163788
6805
15
Coauthor-F
OOD
18333
163788
6805
15
Coauthor-l,
ID
13290
163788
6805
10
Coauthor-b,
0OD
3649
163788
6805
4
Table 9: Coauthor-CS dataset overview
The oowoo-rxxxeeoo -Arxiv dataset curated an extensive dataset from 1960 to 2020, where each node repre- sents paper, labelled by its subject area for classification (Hu et al., 2020). Edges reflect the citation relationships among papers, and each node is associated with a 128-dimensional vector derived from word embeddings of its title and abstract. Following Wu et al. (2023b), we utilise time information to partition the graph, where data before 2015 are used as ID data and papers published after 2017 used as OOD data. Dataset details are provided in Table 10.
ogbn-Arxiv
Splits
# Nodes
# Edges
Feature Dimension
# Classes
Arxiv-2015
ID
53160
152226
128
40
Arxiv-2018
0OD
29799
622466
128
40
Arxiv-2019
0OD
39711
1061 197
128
40
Arxiv-2020
00D
8892
1166243
128
40
Table 10: ogbn-Arxiv dataset overview
A.7 EVALUATION METRICS
In this section, we provide a detailed description of the metrics used for evaluation. Following com- mon practice in OOD detection (Wu et al., 2023b; Liu et al., 2020; 2023b), we employed three key metries to measure the performance Operating Characteristic curve (AUROC); (2) the Area Under the Precision-Recal curve (AUPR); and (3) the false positive rate (FPR95) OOD examples when the true positive rate of ID examples is 95%. AUROC measures the trade-off between the true positive rate (TPR) and the false posi- tive rate (FPR) at different threshold levels, providing insights into the model's ability to accurately distinguish between ID and OOD instances. However, highly imbalanced datasets with only few OOD instances, AUROC might be overly optimistic. AUPR, on the other hand, offers a more realistic performance measure by accounting for both precision and recall. FPR95 provides further insight into the model's 's performance under high- conditions, indicating the probability of misclassifying in n--iistrbbution samples OOD when the TPR is 95%.
detecting OOD instances: (1) the Area Under the Receiver
A.8 IMPLEMENTATION DETAILS
We utilised the publicly available benchmark (i.e., datasets and baselines) provided by Wu et al. (2023b), and fully respect their CC-BY 4.0 license. The experiments were conducted using Python 3.8.0 and PyTorch 2.2.2 with Cuda 12.1, using Tesla V100 GPUs with 32GB memory for experi- ments. The datasets were obtained from Pytorch Geometric 2.0.3 and OGB 1.3.3 under the MIT license. Extending beyond the thresholds provided in Wu al. (2023b). we tuned the margins tp and fooD with various ranges for different dataset (i.c., for Twitch tp E (-5. -4, -33.,,3.... -3),toon toon e (1)).)). The detector loss weights X, 7 are tuned in the range of {0, (0,0.3, 0.5, 0.7, 1,15), de- pending on the dataset. Hyperparameter sensitivity analysis for the detector and classifier loss objective can be found Figure 6. The LGM training step M1 configured {100, 200, 600, 800}, and the classifier and detector update M2 is tuned from (5 20} subject to the dataset, with early stopping applied to ensure the ID accuracy does not reduce sigmificantly. Regarding baseline models, we utilised the provided benchmark in Wu et al. (2023b), which includes modified versions of the different baseline models. This involves adapting to the same encoder GCN backbone (i.e,, hidden size of 64 and layer number of 2) for MSP, ODIN, Mahalanobis, Energy
the range of
22

---

Published as a conference paper at ICLR 2025
and Energy FT. We also considered latest SOTA OOD Detection method by Yang al. (2024) using their reported results.
A.9 ADDITIONAL EXPERIMENT RESULTS
In this section, we provide additional experimental results supplement the results provided in the maintext. Specifically, we present detailed OOD detection performance of the subsets for each OOD dataset (i.e., subgraphs for Twitch, three types of OOD data for Cora, Amazon, and Coauthor, and different years for Arxiv) in Tables 11 to 15, complementing Table 1 in the main text. Fur- thermore, in Tables 16 and 17, we report an extended version the ablation study and adversarial training effectiveness,, covering the subsets of Twit Cora, and Arxiv, supplementing Table and in the maintext. Lastly, we provide the full tables for the energy regulariser analysis in Table 4 for Twit tch, Cora, and Amazon in Tables 18, 19, and 20, respectively.
Table 11: Model performance on OOD sub cub-graphs ES, FR and RU of Twitch dataset.
Datuset
Metries
MSP
ODIN
Mahulamobis
Non-OOD Expesure Energy
GKDE
GPN
GNNSAFE
OE
Real OOD Exposure
Energy FT GNNSAFE44
GOLD
Ours
AUROC
37.72
83.83
45.66
38, 80
45.70
53,00
49.07
55.97
80.73
94.56
99. 0.00
Twitch
FPRO5
AUPK
53.08
91.43
33.28
95.48
02
54,25
61.05
05.37
64.24
95.05
44.06
97.17
59.82
+0.11
68.72
70.79
70.51
70.40
70.18
Iwitch-FR
FPRO5
AUPR
99
38:27
64.63
92:57
95.
91.57
61.48
95
52.94
93.92
90.80
05 48
31,20
76.39
$1.06
95.44
99:25
3,77+ 0.92
0.15
ID ACC
68.72
70.79
70,51
70.40
67.44
68.09
70.40
90.73
70.52
70.18
68.49 0.13
AUROC
41:23
56.67
35.68
57.72
46.48
50.39
87.90
55. 55.72
93.12
98.10
99.38 0.05
Twiteb-RL
FPRU5
AUPR
56.06
93.98
72:58
66.42
62.11
65.14
89.05
70.18
95.36
98.74
99.78L 0.04
0.35
70.79
68
Table 12: Model performance on Cora with three types of OOD (Structure manipulation, Feature interpolation, and Label leave-out).
Datavel
Metries
MSP
ODIN
Mahulanohis
Non-COD Expusure Energy
GKDE
GPN
GNNSAFE
OE
Real COD Exposure
Energy FT GNNSAFE++
Ours GOLD
AUROC
70.90
19.92
46.68
71.73
68.61
77.47
87.52
67.98
75.88
90.62
95.45 0.28
AUPR
45.75
27.01
29.03
46.08
44.26
53.26
77.46
46.93
81.88
91.06 0.32
CoEa-E
ACC
75.50
74.90
74.90
76.00
73.70
76.50
75.80
71.80
75.50
76.10
77.4 1: 0.56
AUROC
85.39
49.88
49.93
86.15
$2.79
85.88
93:44
81.83
88.15
95.56
96.64 0.15
Cora-F
FTR95
AUPP
64.88
73:70
100.00
26.96
99.93
31.95
65.81
74.42
66.52
68.24
56.17
73.79
88.
38.92
83.79
70.84
47.53
75.99
27.73
90.27
93,82 0.24
14.35 2.05
76.77
AUPR
78.03
24.27
42.31
78.14
27.50
82:21
77.01
78.89
82.64
$8.65 0.25
Coca-L
FTR95
31.99
100.00
90.77
41.08
88.95
37.
30.55
16.55
37.83
31.08
17.28 0.50
ID ACC
88.92
98.92
$3.90 92
89.92
$9.87
91.46
88.92
87.97
90.51
91.46
50.82 0.55
Table 13: Model performance on Amazon with three types of OOD (Structure manipulation, Feature interpolation, and Label leave-out).
Exposure Emergy
Expostre Energy
GNNNATE
GNNSAFEL+
GOLD
AUROC
98.27
93.26
71.69
98.51
76.39
97.17
99.58
99.60
98.83
99.82
99,99 0.00
Amazon-3
FPR05
AUPR
98.54
6.13
95.25
65.44
99.91
79.01
98.72
4.97
81.58
99.25
96.39
11.65
99.76
0.00
99.51
01.51
99.14
1.31
90.89
0.00
99.99 0.02
0
ID ACC
92.84
92.84
92.79
92.85
87.57
88.51
92.53
92.61
92,79
92.33
92,03 1:333:0000 0.24
AUROC
97.51
81.15
97.87
98.55
98.39
98.68
99.17
AUPPR
95.16
78.47
95.64
90.31
Amason--
ID ACC
92.89
92.71
92.85
92.96
86.18
90.05
92.81
92.30
92.52
92.39
91.76 0.57
AUROC
93.97
65.97
73.25
93.81
65.58
92.72
97.35
95.
96.61
97.51
97. 0.27
Art Amasonn
FPRU5
AUPR
91.32
26.65
$7.80
90.25
74.30
66.89
91.13
28.48
96.87
65.20
90.34
37.15 16616
97.12
6.59
92.53
17.72
94,92
13.78
97.07
6.15
97.46 0.29
6.06 + 1.81
ID
95.76
96.08
95.76
95.72
89.37
90.07
95.76
95.72
96.83
95.84
95.18
23

---

Published as a conference paper at ICLR 2025
Table 14: Model performance on Coauthor with three types of OOD (Structure manipulation, Feature interpolation, and Label leave-out).
Metries
Non-ODD Esposure
Energy
GKDE
Energy
Exposure
95.
99.99
coauthor-8
HAK95
AUPR
24.75
94.37
99.92
08.83
70.75
76.65
18.02
72.63
99.45
99.57
40.21
01.26
96.81
9.23
97.78
3.97
99.99
0.02
99.78 0.01
0.01 # 0.01
ID ACC
92.47
92.34
92.33
92.75
88.62
89.45
92.73
92.40
92.61
92.92
91.41 +: 0.16
AUROC
97.05
51.54
93.23
97.88
80.69
$1.77
99:64
99.04
99:43
99.97
99.78 1: 0.15
Coauthoz-P P
FPR95
AUPR
90.93
15.55
45.50
100.0
50.88
28,10
97.09
9.75
96.57
86.47
74.46
MI..5
99.66
0.51
95.30
4.44
99.25
2.25
99.95
0:09
99.96 0.09
DA0 0.01
ID ACC
92.45
92.39
92.34
92.75
84.72
$7.05
92.73
92.64
92.50
92.87
91.81
AUROC
Coauthor-1
ACC
95.15
95.19
91.68
95.24
Table 15: Model performance on OOD datasets of paper published in 2018, 2019, and 2020 on Arxiv.
Non-OLD Exposure Energy
Exposure Energy
GNNSAFE
GNNSATE44
Arxiv-2018
HPRO5
AUTR
91.67
70.63
63.06
10000
93.69
91.74
94.31
0OM
00M
89.44
74.99
36.67
$2.10
$1.47
78.62
83.20 0.57
77.12
ID ACC
53.78
51.59
$1.59
$3.36
50.76
DOM
53.50
52.50
53.26
$3.50
50.50
0.53
AUROC
63.07
53.95
56.75
63.15
57.87
0OM
68.36
69.33
70.58
72.16
72.46 0.35
Arxiv-2019
FPR895
ALPRR
66.00
90.82
56.07
100.0
$7.85
94.01
90.96
65.78
02.34
93.97
0OM
(OM
88.02
71.57
85.52
72.15
72.03
81.30
79.33
75.43
81.
75.41 0.58
0.58
ID
AUROC
AUTPR
AEk1v-2020
$1.59
0OM
53.39
52.39
$3.50
24

---

Published as a conference paper at ICLR 2025
Table 16: Extended ablation performance of individual subsets.
Dataset
Metrics
GNNSAPE
GNNSAFE++
w/o Adv.
w/o Det.
GOLD
AUROC
49.07
94.54
69.10
$7.65
99.72
AUPR
57.62
97.17
75.86
65.82
99.82
Twitch-ES
FPR95
93,98
44.06
85.82
91.65
0.44
ACC
70.40
70.18
70.97
70.97
68.49
AUROC
63.49
93.45
93.86
88.98
99.08
AUPR
66.25
95.44
95.45
92.61
99.25
Twitch-FR
FPR95
90.80
51.06
39.44
70.84
3.77
ACC
70.40
70.18
70.97
70.97
68.49
AUROC
87.90
98.10
90.81
99.58
AUPR
89.05
98.74
94.75
93.30
99.78
Twitch-RU
FPR95
43.95
5.59
53.87
77.01
1.14
ID ACC
70.40
70.18
70.97
70.97
68.49
AUROC
87.52
90.62
90.05
93.33
95.48
AUPR
77.46
81.88
83.04
87.13
91.06
Cora-8
FPR95
73.15
53,51
59.45
31.98
21.86
ID ACC
75.80
76.10
67.70
75.60
77.40
AUROC
93.44
95.56
94,43
95.24
96.64
AUPR
88.19
90.27
91.74
91.23
93.82
Cora-F
FPR95
38.92
27.73
29.54
26.74
14.35
ACC
76.40
76.80
76.50
75.70
76.77
AUROC
89.47
92.75
84.45
91.71
95.40
AUPR
82.21
82.64
65.90
81.98
88.65
Cora-L
FPR95
30.83
34.08
50.00
43.31
17.28
ACC
88.92
91.46
88.60
90.80
90.82
AUROC
66.47
70.40
64.97
69.74
AUPR
74.99
78.62
72.71
73.63
77.12
Arxiv-2018
FPR95
89.44
81.47
90.12
91.19
83.20
ID ACC
53.39
53.50
49.89
49.66
50.59
AUROC
68.36
72.16
67.21
67.13
72.46
AUPR
71.57
75.43
69.70
69.06
75.41
Arxiv-2019
FPR95
88.02
79.33
88.97
90.27
81.16
ID ACC
53.39
53.50
49.89
49.66
50.59
AUROC
78.35
81.75
77.11
77.04
79.50
AUPR
94.76
95.57
94,39
94.45
95.02
Arxiv-
FPR95
83,57
71.50
85.40
87.54
77.36
ACC
53.39
53.50
49.89
49.66
50.59
25

---

Published as a conference paper at ICLR 2025
Table 17: Extended adversarial training effectiveness analysis of individual subsets.
Dataset
Metrics
GNNSAFE++
Dif. Once
Dif. Multi
Real OOD
GOLD
AUROC
94.54
69.10
66.32
98.99
99.72
AUPR
97.17
75.86
73.49
99.52
99.82
Twitch-BS
FPR95
44.06
85.82
87.07
1.38
0.44
ID ACC
70.18
70.40
71.12
70.45
68.49
AUROC
93.45
93.86
95.20
94.51
AUPR
95.44
95.45
96.54
96.33
99.25
Twitch-PR
FPR95
51.06
39.44
31.08
40.62
3.77
ID ACC
70.18
70.40
71.12
70.45
68.49
AUROC
98.10
90.81
91.28
99.24
99.58
AUPR
98.74
94.75
95,10
99.65
99.78
Twitch-RO
FPR95
5.59
53.87
82.84
1.16
1.14
ID
70.18
70.40
71.12
70.45
68.49
AUROC
90.62
90.05
95.69
94.12
95.48
AUPR
81.88
83.04
91.59
89.91
91.06
Cora-8
FPR95
53.51
59.45
22.30
37.11
21.86
ID ACC
76.10
67.70
76.10
75.90
77.40
AUROC
95.56
94.43
96.02
97.60
96.64
AUPR
90.27
91.74
92.99
94.23
93.82
Cora-F
FPR95
27.73
29.54
18.94
10.27
14.35
TD ACC
76.80
76.50
77.30
71.70
76.77
AUROC
92.75
84.45
86.76
95.04
95.40
AUPR
82.64
65.90
70.70
86.01
88.65
Cora-1
FPR9S
34.08
50.00
49.09
17.24
17.28
ID ACC
91.46
88.60
88.29
87.65
90.82
AUROC
70.40
64.97
67.26
75.32
69.74
AUPR
78.62
72.71
74.72
80.89
77.12
Arxiv-2018
FPR95
81.47
90.12
85.23
72.40
83.20
ID ACC
53.50
53.39
50.77
49.99
50.59
AUROC
72.16
67.21
69.66
77.98
72,46
AUPR
75.43
69.70
72.05
79.56
75.41
Arxiv-2019
FPR9S
79.33
88.97
83.33
95.92
81.16
ID ACC
53.50
$3.39
$0.77
49.99
$0.59
AUROC
81.75
77.11
79.52
83.41
79.50
AUPR
95.57
94.39
94,95
95.92
95.02
Arxiv-2020
FPR9S
71.50
85.40
77.52
64.93
77.36
ID ACC
53,50
53.39
50.77
49.99
50.59
Table 18: Extended energy regulariser effectiveness analysis on Twitch.
Dan
Casee
Louer
AUROC
ThitchhEE AUPR
FPR
Ace
AUROC
AUPR
Twitch-FR
FPR
ID Acc
AUROC
Twitch-BU
AUPR
FPR
ID Ace
74,33
76.23
52.97
68.97
98.34
98.72
2.58
68.97
26.92
48.67
91.70
68.97
17.39
44.31
98.00
70.15
5.69
34.24
99.07
70.15
7.48
43,30
96.42
70.15
60.03
68.63
92.36
70.98
90.21
92.64
66.57
70.98
83.81
88.85
77.77
70.98
70.79
59.40
68.30
92.77
70.99
91.91
93.23
56.07
70.99 0
79.32
83,03
79.59
70.99
7.50
42.10
99.07
70.90
99.04
98.15
1.30
70.90
86.75
86.13
37.49
70.90
41.98
91.30
80.94
GOLD
99.72
99.82
0.44
68.49
99.08
99.25
3.77
68.49
99.58
99.78
1.14
68.49
26

---

Published as a conference paper at ICLR 2025
Table 19: Extended energy regulariser effectiveness analysis on Cora.
Copa-E
Cora-L
AUROC
AUPR
FPR
ID Ace
AUROC
AUPR
FPR
ID Acc
AUROC
AUPR
FPR
ID Ace
86.44
91.26
35.20
67.70
13.00
16.79
99.19
70.80
83,98
76.01
90.06
90.19
68.06
67.14
89.18
80.00
68.01
77.40
45.70
75.80
76.20
60.36
96.65
87.34
V
94,70
90.09
30.54
74.30
10.41
15.72
100
76.20
92.90
84.14
31,64
90.82
74.36
70.00
v
47.95
49.68
91.32
77.60
47.63
54.31
99.41
76.60
8.30
13.82
99.80
89.55
64.59
67.50
86.39
93.94
88.86
28.99
75,60
95.54
92.69
22.05
76.70
90.35
80.94
42.09
87.34
GOLD
95.48
91.06
21.86
77.40
96.64
93.82
14.35
76.77
95.40
88.65
17.28
90.82
Table 20: Extended energy regulariser effectiveness analysis on Amazon.
Amazon-8 AUPR
imszonn2
Anazon
AUROC
AUROC
96.67
97.48
20.16
88.35
1.21
26.70
99.35
92.11
94.64
93.84
20.66
95.76
84,90
90.80
100.00
92.17
21.53
93.45
18.21
95.96
52.82
69.21
100.00
92.74
1.58
26.81
98.47
91.89
91.53
89.77
35.26
95.72
V
100.00
100.00
0.00
91.35
99,76
99.55
0.63
91.62
93.39
90.94
24.20
95.39
94.79
100.00
100.00
0.00
92.35
98.61
99.09
0.29
91.76
95.11
91.99
13.34
95.52
98.58
99.21
92.25
98.36
98.75
0.60
92.04
97.13
97.29
9.61
94,14
GOLD
99.98
99.99
0.00
92.03
99.17
99.31
0.14
91,76
97.26
97.46
6.06
95.18
100
60
AUROC (96)
90
FPRO5 (%)
Y
20
70
0.0
0.5
1.0
1.5
0.0
1.0 Detector Weight Hyperparam
0.5
1.5
Detector Weight Hyperparam
(b)
Figure 6: The Twitch dataset was utilised for conducting hyper-parameter sensitivity analysis. (6a) and (6b) are fyper-parameter sensitivity different weights in Eq. 13 for Detector measured by AUROC and FPR95.
A. ABLATION STUDY VISUALISATION
To explore how the different modules contribute to OOD detection, we present further energy distri- bution visualisations in Figure 7. The adversarial training can help maintain the closeness between synthetic and ID data, preventing the synthetic samples from diverging too far from real ID/OOD data to bias the detector. Our method alternates between two tasks: (1) the latent diffusion model pulls latent embeddings of ID data and generated pseudo-OOD embeddings closer, while (2) the GNN & detector push their energies apart. Without this component, the pseudo-OOf distribution diverges significantly compared to GOLD in Figure 7 c/f, where synthetic embeddings are regularly updated. This divergence makes OOD data indistinct from ID) data, leading to poor performance in the ablation study. The detector can decrease the overlap of energy distribution between the ID) and OOD samples, leading to better energy-basse OOD detection. Figure b/e shows that w/o detector will lead to a large overlap of energy distribution between ID and OOD samples. This overlap occurs because the energy scores, derived from prediction logits of the GNN classifier, become indistinct the number of predicted classes increases and when the classifier struggles distinguish certain classes. Thus, introducing a dedicated detector to further discern energy scores enhances detection by reducing the number of output classes.
27

---

Published as a conference paper at ICLR 2025
1.50
1.6
21.00
21.00
125
eip
1.2
3.50
eloen
0..50
20.75
2.00
-8
Energy
Energy
Energy
(a) Twitch w/o Adv.
(b) Twitch w/o Det.
(c) Twtich GOLD
9-000
0--000
0.75
dooco
eloco
0.50
0.25
0.00
20
-15
-10
0
0.00
0
-8
-6
-2
0.00
20
-15
-10
-5
Energy score
Energy score
Energy score
(d) Cora-L w/o Adv.
Cora-L w/o Det.
Cora-I GOLD
Figure 7: Visualisation of the energy score distributions of GOLD without adversarial training or the use of detector for Twitch and Cora-L datasets. (a) and (d) illustrate the energy score gaps w/o adversarial training. where the energy of p-OOl> data will be diverged too far and fail to diverge the energy of real OOD. (b) and (e) shows the energy scores derived from the GNN classifier without proposed detector, where the energy scores cannot be effectively separated. (c) and (f) demonstrates the ability of GOLD to effectively distinguish the ID and OOD energy distributions, illustrating the effectiveness of the adversarial and detector components.
A.11 LATENT GENERATIVE MODEL
In this section, we provide description of the two latent generative models utilised: The variational autoencoder and the latent diffusion model.
A.11.1 VARIATIONAL AUTOENCODER
The variational autoencoder (VAE) is generative model consisting of encoder that learns latent variables from training data and decoder that then uses those latent variables to reconstruct the input data. VAEs trained to optimise a lower bound on the marginal log-likelihood log Po(x)) over the data by using a learned approximate posterior 4e (h] as follows:
L( Φ; x)) =
po - DR (go (1(os/h/)))) (M)x))]p(hh))
s.t the first term is the reconstruction loss, and the second term the KI. divergence of the ap- proximate from the true posterior. The trained approximate posterior go (h(x)) would thus act as an encoder that maps the data r to lower dimensional latent representation, and latent samples h can be drawn via the reparametrisation trick:
= (x) + (x) @ c, where e ~ NO, I) if the models are Gaussian.
We the encoder hidden dimension size to be 512, the decoder dimension to be 256, and layer sizes to be 2.
A.11.2 LATENT DIFFUSION MODEL
The latent diffusion model consists of a forward diffusion and a backward denoising process on set of latent representations (Ho et al., 2020; Zhou et al., 2024; Evdaimon et al., 2024). In our GOLD, latent node representation he Rd is initialised at timestep O from the GNN encodings H in Eq. 7. At the forward process, the model progressively adds Gaussian noise to the latent node representation ho, according to a known variance schedule BI,..., 3r. for < B1 < ...3T 1. This process will produce sequence of increasingly noisy vectors (h,, ... hr) with timestep & = {1, 2.3, T}. Denoting 1 1- 3r and a, = - ag we can derive closed form for obtaining the representation any timestep given the initial representation hg:
h A (Vā,ho. (1 a.) I).
(20)
The backward denoising process involves predicting the noise added to the representation at a given timestep via denoising model D (e.g., MLPP. To train the latent diffusion model, we minimise the
28

---

Published as a conference paper at ICLR 2025
mean squared enror loss between the added noise (. and the predicted noise from the noisy representation h2 at a given timestep t with the reparameterisatioon trick:
||- | V
min Leen. where LGen = Eno.et
(21)
D
Hyperparams
AUROC
AUPR
FPR
ID ACC
0.00001
99.43
99.59
1.77
68.48
0.0001
99.46
99.62
0.001
99.52
99.66
1.44
68.11
0.01
99.46
99.60
1.99
67.71
0.005
85.91
88.79
44.77
71.04
Pr
0.02
99.46
99.62
1.78
68.49
0.1
82.02
86.79
55.27
400
96.59
97.84
18.23
69.43
500
95.15
96.38
21.32
68.99
600
99.46
99.62
1.78
68.49
T
700
98.80
99.27
4.07
68.09
92.02
95.68
66.94
68.85
1000
17.35
45.22
99.57
71.20
Table 21: Performance comparison for different hyperparameters for Diffusion model on Twitch dataset. Default values highlighted in Bold.
We set the diffusion model parameter 3 be sequence of linearly increasing constants from 81 = 10-1 to 37 = 0.02 as presented in (Ho et al., 2020; Rombach et al., 2022). A hyperparameter sensitivity experiment on the Twitch dataset is provided in Table 21. Generally, larger (smaller) adds removes more (less) noise at each step. A larger ''' increases noise corruption, making recovery harder but with more output variation, while a smaller reduces noise corruption, making recovery easier but limiting variation. B1 typically does not affect performance, while 32 is more sensitive, reflecting higher/lower corruption at the end of the timestep. The value of T also im- pacts performance, with non-default values either limiting or excessively diversifying the synthetic samples.
A.12 COMPUTATIONAL COST
In this section, provide the computational cost of GOLD against SOTA baselines. GOLD out- performs the baselines with rough trade-off of 2x training time and memory usage.
Table 22: Computation cost (one 32GB (32768MiB) NVIDIA V100 GPU) and OOD detection performance of GOLD (Non-OOD Exposed) against both Non- and Real-OOD exposed SOTA baselines. The "Train' column the training convergence time in seconds. The "Test' column the inference time in seconds. The 'Mem.' column is the maximum memory usage in Mebibytes (MiB). The 'FPR95' column is the OOD detection performance in %, the lower the better. The inference time of these methods is the same with the same backbone GNN.
Teitees
Coraer
Couut howe
Sestiv
GNNROW (Noe)
667
3431
4.00
165
3892
1351
965
1730
651
8531
0/9)
37.01
UNNS oe (Reil
476
009
657
35.5
532
0.08
465
35.35
1840
800
865
0.13
6355
0.36
1525
609
13.36
0.30
3330
77.41
DOLD LDM (iei
800
131
08
1987
1451
3404
500
1947
037
6H0
3408
647
1087
BLB
1.13 ABLATION WITH ADDITIONAL BACKBONE
We provide the following experiments with two additional backbones: GAT (Velickovic et al., 2018) and MixHop (Abu-EI-Haija et al., 2019). We compare these architectures against GNNSafe and NodeSafe and their O0D-exposed variants. To ensure a fair comparison, we maintain the same configuration as the original GCN implementation, with hidden dimension of 64, two layers, attention heads for GAT, and two hops for MixHop. The results shown Table 23, demonstrate that GOLD outperforms other methods across the evaluated backbones.
29

---

Published as a conference paper at ICLR 2025
Table 23: Ablation of different backbones
Dataset
Backbone
Metries
GNNSAFF
GNNSAFE+
NODESAFF
NODESAFE++
GOLD
AUROC
72.08
95.07
57.91
95.08
96,94
MixHop
FPR95
93.76
30.71
17.98
69.66
66.04
70.09
70.56
67.58
Twitch
AUROC
97.51
54.78
95.07
98.64
GAT
FPR95
50.46
20.43
93.24
30.71
1.42
ID Acc
68.21
68.54
68.40
70.56
67.32
AUROC
88.65
91.33
82.60
92.79
91.42
MixHop
FPR95
59.08
44.59
60.22
38.63
25.09
ID Acc
79.52
80166
82.16
81.45
80.67
Cora
AUROC
91.62
92.50
85.55
92.32
94,66
GAT
FPR95
33.81
33.44
55.20
34.93
19.63
ID Acc
79.44
79.32
81.06
80.23
78.40
30


Reviews:
[{"review_id": "pXg8jFFWO0", "reviewer": "Reviewer_syps", "summary": "The paper presents a framework designed to detect out-of-distribution data without requiring pre-existing OOD datasets or pre-trained models. The proposed GOLD framework includes:\n- A latent generative model to generate synthetic embeddings that imitate in-distribution embeddings from a GNN.\n- A GNN encoder and OOD detector to classify in-distribution data and maximize energy divergence between in-distribution and synthetic embeddings.", "questions": "- Could the author better clarify the key novelty of GOLD compared to existing works? What distinguishes the usage of the generator in GOLD from previous works?\n- The training procedure has two stages: one stage involves fixing the GNN and training the LGM, and the second stage involves fixing the LGM and training the GNN. Is it possible to combine these two stages using a gradient reversal layer?\n- Further ablative studies on  $L_{DReg}, L_{Unc}, L_{EReg}$  (removing each of them or applying each individually) may help to better demonstrate the effectiveness of the proposed new divergence regularization (Eq. 12).\n- What modifications would be needed to extend the framework beyond node-level detection, such as to graph-level OOD detection tasks?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- *No OOD Data Required*: Synthesizes pseudo-OOD data through adversarial training, alleviating the need for real OOD samples.\n- *Implementation Flexibility*: Supports both LDM and VAE variants, offering trade-offs between performance and computational efficiency.\n- *Strong Empirical Performance*: Outperforms non-OOD methods and matches/exceeds methods using real OOD data.", "weaknesses": "- Using generative models to generate samples for downstream tasks has been widely adopted in previous methods. For example, generated samples are commonly used in continual learning for experience replay. It seems that the use of generators in GOLD applies the same concept to different tasks. Energy-based detection is also widely used. The major contribution seems to lie in a new divergence regularisation (Eq.12).\n- Further ablative studies on divergence regularisations may be needed to better reflect their effectiveness.\n- The presentation needs to be improved.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "sUpGv5ZNwA", "reviewer": "Reviewer_SRXq", "summary": "This paper introduces a new framework called GOLD, which aims to address the challenges faced by graph neural networks (GNNs) when dealing with out-of-distribution (OOD) test instances. The GOLD framework detects OOD nodes in graph data through an implicit adversarial learning process without relying on pre-trained models. The core of the framework is the alternating optimization framework.", "questions": "1. Regarding the generation process of pseudo-OOD samples based on ID data, if these generated samples are overly close to the ID distribution, it could lead to confusion in the OOD detector, potentially causing ID samples to be misclassified as pseudo-OOD. Could the authors elaborate on whether any specific techniques were applied during training to control this distributional proximity?\n2. Additionally, I noticed that the model exhibits substantial variance in the FPR95 metric on the Amazon and Coauthor datasets. Could the authors clarify whether this variance is linked to the aforementioned distributional control during the generation process?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper presents a method with notable novelty, particularly in how it handles the generation of OOD (Out-of-Distribution) samples based on ID (In-Distribution) data. This approach demonstrates creative problem-solving and provides a potentially valuable contribution to OOD detection research.\n2. The experimental section is comprehensive, covering multiple datasets and providing a range of performance metrics. This thorough evaluation supports the robustness of the method and suggests that it may perform effectively across diverse scenarios.", "weaknesses": "1. Certain issues in the manuscript reduce its overall clarity and precision. For example, Figure 1(d) appears to be blank, which may hinder understanding and interpretation of the paper’s content.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "opxXrudfo3", "reviewer": "Reviewer_AALT", "summary": "The paper presents GOLD, a novel framework aimed at enhancing Out-of-Distribution (OOD) detection in graph neural networks (GNNs) without relying on external OOD data. GOLD introduces an implicit adversarial training pipeline where a latent generative model (LGM) is trained to generate embeddings that mimic in-distribution (ID) data, while an OOD detector is optimized to increase divergence between ID embeddings and these synthetic pseudo-OOD embeddings. It effectively simulates OOD exposure, helping the model distinguish OOD nodes in graph data. Extensive experiments demonstrate that GOLD outperforms state-of-the-art methods in OOD detection across several benchmark datasets without the need for real OOD data.", "questions": "1. What does subscript (i.e., [0], [1]) in Eq(10) mean?\n\n2. Have the authors tried other backbone models?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- GOLD’s adversarial latent generation is a novel approach that synthesizes pseudo-OOD data without auxiliary datasets, making it efficient and broadly applicable.\n\n- GOLD’s effectiveness is demonstrated through comprehensive experiments on five benchmark datasets, showing its robustness across various graph types and OOD scenarios.\n\n-  The implicit adversarial objective and energy-based detection approach lead to a clear divergence between ID and OOD embeddings, validated by experimental visualizations.\n\n- This paper is well-structured.", "weaknesses": "This paper has no obvious weaknesses except for the training computational cost induced by the pseudo-OOD data. However, this cost increase is acceptable. And the authors have also discusses this issue in POTENTIAL LIMITATIONS section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2GoYn0qWiQ", "reviewer": "Reviewer_yx8w", "summary": "This paper proposes the GOLD, a novel framework for graph OOD detection that employs implicit adversarial learning to generate synthetic OOD instances without the need for pre-trained models or additional OOD data. By utilizing a latent generative model to produce embeddings mimicking in-distribution data, which are then differentiated from actual in-distribution embeddings by a graph neural network encoder and an OOD detector, the method is able to effectively simulate the OOD exposure. The framework is evaluated on five benchmark graph datasets, demonstrating superior OOD detection performance without using real OOD data compared with the state-of-the-art OOD exposure and non-exposure baselines.", "questions": "See weakness.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. The idea of implicit adversarial learning is novel.\n2. The experiments are solid and comprehensive, especially the improvements achieved on the FPR95 dataset is impressive.\n3. The paper is easy to follow and well-structured. The writing is good. The theoritical proofs are provided.", "weaknesses": "I didn't see obvious weaknesses. Here I provide some suggestions:\n\nCould you provide a more in-depth analysis of the performance achievements on the FPR95 dataset, including an analysis from the perspective of the dataset's characteristics? Additionally, could you explain why similar significant improvements were not observed on other datasets (although the improvements on other datasets are also quite good)?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Spotlight)