\begin{table}
\centering
\begin{adjustbox}{max width=\textwidth}
    \begin{tabular}{l|cccc|cccc}
    \toprule 
    \multicolumn{1}{l}{\multirow{4}{*}{Method}} & \multicolumn{8}{c}{In-Distribution Dataset} \\
\cmidrule{2-9}    \multicolumn{1}{l}{} & \multicolumn{4}{c|}{CIFAR-10} & \multicolumn{4}{c}{CIFAR-100} \\
\cmidrule{2-9}    \multicolumn{1}{l}{} & Clean & In    & Out   & In and Out & Clean & In    & Out   & In and Out \\
    \midrule
    OpenGAN-fea & 0.971 & 0.473 & 0.425 & 0.266 & \textbf{0.958} & 0.198 & 0.324 & 0.088 \\
    OpenGAN-pixel & 0.818 & 0.000 & 0.008 & 0.000 & 0.767 & 0.000 & 0.004 & 0.000 \\
    \midrule
    ViT (MSP) & 0.975 & 0.448 & 0.172 & 0.002 & 0.879 & 0.269 & 0.129 & 0.002 \\
    ViT (MD) & \textbf{0.995} & 0.136 & 0.495 & 0.000 & \underline{0.951} & 0.053 & 0.279 & 0.000 \\
    ViT (RMD) & 0.951 & 0.427 & 0.446 & 0.025 & 0.915 & 0.365 & 0.361 & 0.037 \\
    ViT (OpenMax) & \underline{0.984} & 0.346 & 0.291 & 0.004 & 0.907 & 0.086 & 0.166 & 0.001 \\
    \midrule
    AT (MSP) & 0.735 & 0.462 & 0.442 & 0.174 & 0.603 & 0.324 & 0.250 & 0.085 \\
    AT (MD) & 0.771 & 0.429 & 0.527 & 0.232 & 0.649 & 0.278 & 0.357 & 0.108 \\
    AT (RMD) & 0.836 & 0.436 & 0.523 & 0.151 & 0.700 & 0.366 & 0.363 & 0.136 \\
    AT (OpenMax) & 0.805 & 0.468 & 0.508 & 0.208 & 0.650 & 0.319 & 0.350 & 0.132 \\
    \midrule
    HAT (MSP) & 0.770 & 0.560 & 0.548 & 0.325 & 0.612 & 0.393 & 0.335 & 0.176 \\
    HAT (MD) & 0.789 & 0.572 & 0.586 & 0.369 & 0.810 & \underline{0.587} & \underline{0.603} & \underline{0.363} \\
    HAT (RMD) & 0.878 & 0.602 & 0.606 & 0.258 & 0.730 & 0.443 & 0.416 & 0.191 \\
    HAT (OpenMax) & 0.821 & 0.613 & \underline{0.648} & \underline{0.415} & 0.703 & 0.462 & 0.462 & 0.263 \\
    \midrule
    OSAD (MSP) & 0.698 & 0.411 & 0.407 & 0.154 & 0.557 & 0.285 & 0.194 & 0.055 \\
    OSAD (MD) & 0.626 & 0.375 & 0.432 & 0.231 & 0.615 & 0.368 & 0.416 & 0.216 \\
    OSAD (RMD) & 0.776 & 0.421 & 0.456 & 0.123 & 0.680 & 0.369 & 0.353 & 0.140 \\
    OSAD (OpenMax) & 0.827 & 0.544 & 0.554 & 0.251 & 0.647 & 0.325 & 0.330 & 0.123 \\
    \midrule
    AOE (MSP) & 0.780 & 0.544 & 0.527 & 0.285 & 0.566 & 0.332 & 0.324 & 0.157 \\
    AOE (MD) & 0.709 & 0.361 & 0.484 & 0.215 & 0.743 & 0.406 & 0.539 & 0.255 \\
    AOE (RMD) & 0.780 & 0.382 & 0.421 & 0.075 & 0.682 & 0.355 & 0.313 & 0.121 \\
    AOE (OpenMax) & 0.797 & 0.528 & 0.586 & 0.298 & 0.591 & 0.282 & 0.356 & 0.143 \\
    \midrule
    ALOE (MSP) & 0.843 & \underline{0.664} & 0.538 & 0.287 & 0.701 & 0.438 & 0.317 & 0.127 \\
    ALOE (MD) & 0.827 & 0.369 & 0.479 & 0.132 & 0.793 & 0.516 & 0.543 & 0.264 \\
    ALOE (RMD) & 0.815 & 0.293 & 0.364 & 0.022 & 0.632 & 0.275 & 0.283 & 0.078 \\
    ALOE (OpenMax) & 0.868 & 0.584 & 0.606 & 0.261 & 0.731 & 0.399 & 0.389 & 0.125 \\
    \midrule
    ATD (Ours) & 0.943 & \textbf{0.837} & \textbf{0.862} & \textbf{0.693} & 0.877 & \textbf{0.734} & \textbf{0.739} & \textbf{0.553} \\
    \bottomrule
    \end{tabular}%
\end{adjustbox}
\caption{Table 1: OOD detection AUROC under attack with $\epsilon = \frac{8}{255}$ for various methods trained with CIFAR-10 or CIFAR-100 as the closed set. A clean evaluation is one where no attack is made on the data, whereas an in/out evaluation means that the corresponding data is attacked. The best and second-best results are distinguished with bold and underlined text for each column.}
\end{table}