Title: Refining Norms: A Post-hoc Framework for OOD Detection in Graph Neural Networks
Venue: NeurIPS 2025
Accepted: yes
Keywords: graph neural network; out of distribution detection
Abstract: Graph Neural Networks (GNNs) are increasingly deployed in mission-critical tasks, yet they often encounter inputs that lie outside their training distribution, leading to unreliable or overconfident predictions. To address this limitation, we present RAGNOR (Robust Aggregation Graph Norm for Outlier Recognition), a post-hoc approach that leverages embedding norms for robust out-of-distribution (OOD) detection on both node-level and graph-level tasks. Unlike previous methods designed primarily for image domains, RAGNOR directly tackles the relational challenges intrinsic to graphs: local contamination by anomalous neighbors, disparate norm scales across classes or roles, and insufficient references for boundary or low-degree nodes. By combining global Z-score normalization, median-based local aggregation, and multi-hop blending, RAGNOR effectively refines raw norm signals into robust OOD scores while incurring minimal overhead and requiring no retraining of the original GNN. Experimental evaluations on multiple benchmarks demonstrate that RAGNOR not only achieves competitive or superior detection performance compared to alternative techniques, but also provides an intuitive, modular design that can be readily integrated into existing graph pipelines.


Peer reviews:
comments: SUMMARY:
This paper proposes RAGNOR, a node embedding norm-based method for both node-level and graph-level OOD detection. RAGNOR constructs an effective score function by refining node embedding norms through global Z-score normalization, median-based local aggregation, and multi-hop blending. Extensive experiments demonstrate that RAGNOR significantly outperforms the baselines on multiple benchmarks.

STRENGTHS AND WEAKNESSES:
Strengths:
1. The paper is well-written and easy to follow.
2. The proposed RAGNOR is a simple yet effective norm-based method for graph OOD detection.
3. Empirical experiments validate the superiority and robustness of RAGNOR.

Weaknesses:
1. In the experiments, NODESAFE+RAGNOR is tested, where the node embeddings are obtained from NODESAFE. What is the performance of GCN+RAGNOR or GNNSAFE+RAGNOR? It would be insightful to know whether the improvement mainly comes from RAGNOR itself, or depends primarily on the quality of the embeddings.
2. While the paper introduces three effective methods for refining norms, the technical innovation seems somewhat limited.
3. There is a lack of a related work section, which could provide valuable context and comparisons to existing methods.

QUESTIONS:
Please see Weaknesses.

LIMITATIONS:
NA.
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 2
DATE: 2025-06-11

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces **RAGNOR**, a post-hoc method for detecting out-of-distribution (OOD) nodes and graphs with Graph Neural Networks. Directly thresholding the embedding norm fails for four reasons: overlapping global norms, neighbour contamination, class-level scale shifts, and sparse-node effects. RAGNOR fixes these with three steps:  \n1. **Z-score normalisation** of norms,  \n2. **Median-based local reference** that resists contaminated neighbours, and  \n3. **Optional two-hop blend** that helps low-degree or boundary nodes.  \n\nThe difference between a node’s normalised norm and this blended reference is the OOD score. Lemma 6, Lemma 7, and Theorem 1 show that, if fewer than half of a node’s two-hop neighbours are OOD and a margin δ₀ exists, the score separates in-distribution (ID) and OOD nodes. Experiments on node-level and graph-level benchmarks give clear gains. Ablations show each component matters and the method is not sensitive to λ or α.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**  \n- Clear motivation: each design choice addresses a specific failure mode.  \n- Very light-weight: no retraining; only median calculations at inference.  \n\n**Weaknesses**  \n- Although it's a lightweight method, the author did not report wall-clock overhead for median calculations on a large graph relative to a forward pass.  \n- Did not include large OGB graphs (e.g., ogbn-products) to show scalability.\n\nQUESTIONS:\n- **Assumption realism** – The guarantees require that fewer than half of the neighbours within two hops are OOD. In practice a dense OOD cluster may break this, yet there is no quantitative stress test beyond modest contamination levels. Could the authors add experiments where γ approaches 0.6 or 0.7 to probe the failure boundary?\n\n- **Dependence on ID statistics** – Accurate µ_ID and σ_ID must be estimated. How sensitive is performance when these moments are biased, e.g. by label imbalance or small ID validation sets?\n\n- **Baseline breadth** – The comparison set is strong, yet recent score-matching and diffusion-based OOD detectors for graphs are absent. Even if they are heavy, a brief discussion would be useful.\n\n- **Hyper-parameter tuning protocol** – λ and τ appear tuned per validation set. Could the author clarify whether a single λ is used across all datasets or selected per task, and whether τ is chosen with knowledge of OOD proportion.\n\nLIMITATIONS:\nThe authors adequately discuss the limitations in the paper and throughout the work.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-25"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces RAGNOR, a post-hoc framework for out-of-distribution (OOD) detection in Graph Neural Networks (GNNs) that uses embedding norms. The authors identify three key challenges that cause naive norm-based methods to fail on graphs: local contamination from OOD neighbors, class-level variations in norm scales, and insufficient context for boundary or low-degree nodes. RAGNOR addresses these issues by creating a robust OOD score through a pipeline that involves global Z-score normalization, median-based local aggregation to resist contamination, and multi-hop blending for a more stable context. The final score is the discrepancy between a node's processed norm and its local reference. Supported by theoretical analysis and extensive experiments on various benchmarks, the paper demonstrates that RAGNOR achieves state-of-the-art OOD detection performance for both node and graph-level tasks without requiring retraining of the GNN.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1.\tThe proposed method, RAGNOR, is elegant in its simplicity and directly motivated by the identified challenges. Each component (Z-score normalization, median aggregation, multi-hop blending) is a well-justified, standard statistical technique chosen to solve a specific problem. \n\n2.\tRAGNOR demonstrates substantial and consistent performance gains over strong baselines on a wide variety of node-level and graph-level benchmarks.\n\n3.\tThe paper provides a formal theoretical analysis that justifies the method's design. The authors are also transparent about the assumptions and limitations of the theory.\n\nWeaknesses:\n\n1.\tThe method is a composition of well-known techniques. The novelty lies in the problem formulation and the application, not in the invention of new fundamental algorithms.\n\n2.\tThe method relies on the mean and standard deviation of norms from the ID training set. The effectiveness of the Z-score normalization step is therefore dependent on the training set being sufficiently large and representative of the true ID distribution.\n\n3.\tThe multi-hop component is proposed as a key part of the framework, but the main experiments appear to use a default of λ=1 (1-hop only). This makes the contribution of the multi-hop component feel somewhat secondary to the core idea of combining Z-scoring with median-based local reference.\n\nQUESTIONS:\n1.\tThe default configuration for RAGNOR in the main experiments uses a 1-hop local reference. Given the positive results for the multi-hop variant in the targeted analyses for low-degree nodes, could the authors clarify the practical impact of this component? Specifically, what are the results for the main benchmarks if λ is tuned on a validation set instead of being fixed to 1?\n\n2.\tFor graph-level OOD detection, the paper states that the score can be generated via max or mean aggregation of node scores, and the experiments use max aggregation. Have the authors experimented with mean aggregation?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a post-hoc method for OOD detection in graphs. It identifies that simply using the magnitude (norm) of a node's embedding fails due to three issues: (1) OOD neighbors skew any local averaging, (2) different classes of \"normal\" nodes can have vastly different norm scales, (3) Nodes with few neighbors lack a good reference point.\n    \nTo solve this, the authors do the following: (1) Applies a Z-score to all node norms based on the in-distribution (ID) data's mean and standard deviation. This addresses the class-level differences. (2) Instead of averaging the norms of a node's neighbors, it takes the median. This is a classic robust statistics technique to resist outliers (the \"contamination\"). (3) It combines the reference from 1-hop neighbors with 2-hop neighbors to give boundary nodes a more stable context. The final OOD score for a node is the difference between its own normalized norm and its robust, multi-hop local reference norm.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n- The experimental results are impressive. Across multiple datasets and GNN backbones, the method improves OOD detection performance (Tables 1, 2, 4, 10). The ablation studies (Table 3, 5) clearly show that each component contributes to the final result.\n- It's a post-hoc method, which is a huge advantage. Users can apply it to already-trained models without expensive retraining. I think this makes it simple, intuitive, and computationally cheap.\n- The paper does an excellent job of diagnosing _why_ naive norm-based methods fail on graphs (Figure 1, Appendix C). Kudos.\n- Well written paper, exceptional clarity. Experiments are well designed.\n\n### Weaknesses\n- The components of the techniques are standard. Z-score normalization is not new. Median aggregation is a foundational concept in robust statistics. Multi-hop information aggregation is the core principle of virtually all GNNs. It is possibly a good thing that the authors have found a way to combine these ideas to build something useful.\n- The theoretical sections and guarantees are well written, but fairly standard. I would have loved some more theoretical insight.\n- Comparison is done favorably against other graph OOD detection benchmarks, but ignores similar concepts in graph anomaly detection and robust graph learning. Any parallels drawn between the algorithms would be nice.\n\nQUESTIONS:\n1. The OOD separation guarantee in Theorem 8 requires that an OOD node's local reference be bounded by B. This condition seems unlikely to hold for OOD nodes within a contaminated local neighborhood. Could you comment on the practical applicability of this theoretical result and/or provide empirical analysis showing performance as the local contamination rate exceeds the 50% breakdown point?\n2. You state the overhead is \"minimal,\" but this is not quantified. You may want to explicitly mention what is the precise computational and memory complexity as a function of the number of nodes and edges, especially for large, dense graphs?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}