Results
OOD detection under adversarial attack: To perform a comprehensive study, AUROC is computed in four different settings for each method. First, the standard OOD detection without any attack is conducted (Clean). Next, either in- or out-datasets are attacked (In/Out). Finally, both the in- and out-sets are attacked (In and Out). Note that resistance against the attack to both in- and out-sets is much harder than other cases since the perturbation budget has effectively been doubled. Based on the results in Table 1 , ViT+MD and OpenGAN-fea have the best performance in the standard OOD detection, but they completely fail under the adversarial setting. Early defenses improved adversarial performance at the cost of a decrease in the clean detection rate. Among them, HAT+OpenMax and HAT+MD are the most effective defenses in CIFAR-10 and CIFAR-100, respectively. Still, they are not as effective as our method ATD, which significantly outperforms them in both datasets while preserving the clean detection performance.

Black-box evaluation: To evaluate ATD under the black-box setting, we generate adversarial perturbations by attacking the introduced baselines as the source models and transferring them to the ATD as the target model. This test can also be considered as a sanity check for detecting gradient obfuscation in the model athalye2018obfuscated . Since the single-step attack enjoys better transferability than the multi-step ones kurakin2018adversarial , we use FGSM for attacking the source models. Based on the results in Table 2 , ATD is sufficiently robust against all the transferred attacks.

Ablation study: ATD uses HAT as the feature extractor and performs adversarial training on open and closed sets to robustify the discriminator. As an ablation study using CIFAR-10 as the in-distribution data, we replace HAT with a standard trained model to check its effectiveness. Also, in another experiment, we replace the discriminator adversarial training with the standard training. The results in Table 3 demonstrate that these settings are not as effective as ATD in achieving a robust detection model. As another ablation, we consider removing the feature extractor and generating images instead of features.
Based on the results, the trained discriminator with this method is also not as robust as the ATD.
Moreover, we check the effect of attacking the generated images, which leads to a lower AUROC score. This confirms that attacking generated data is not helpful in the training.

Classification attack instead of end-to-end attack: OSAD method is evaluated against an attack on the classification, and not the OOD detection, in their original work. Here, we show that this is not a strong attack on the detection method. This is done by checking whether an attack on classification or detection method is effective on the other or not. Results in Table 4 for the OSAD and ATD methods demonstrate that attacking the classification and detection is significantly more effective on their self than the other. Thus, an end-to-end attack is a better basis for the evaluation of the classification or detection defenses.

Comparison with ATOM: Our baselines include
all the previous methods that consider robustness on both in- and out-of-distribution data to make a fair and comprehensive evaluation of our methods. ATOM method chen2021atom is a defense that considers robustness only on the out-of-distribution data. Therefore, this method would not be robust against attacks on the in-distribution data. In addition, we have compared our results against ALOE, which can be regarded as an extension of ATOM that accounts for both in- and out-of-distribution robustness.
Still, a comparison with the ATOM method is performed in the Table 5 using PGD-100 with \epsilon=\frac{8}{255} that supports our arguments.