\begin{table}
\centering
\begin{adjustbox}{max width=\textwidth}
    \begin{tabular}{l|cccc|cccc}
    \toprule 
    \multicolumn{1}{l}{\multirow{4}{*}{Method}} & \multicolumn{8}{c}{In-Distribution Dataset} \\
\cmidrule{2-9}    \multicolumn{1}{l}{} & \multicolumn{4}{c|}{CIFAR-10} & \multicolumn{4}{c}{CIFAR-100} \\
\cmidrule{2-9}    \multicolumn{1}{l}{} & Clean & In    & Out   & In and Out & Clean & In    & Out   & In and Out \\
    \midrule
    OpenGAN-fea       & 0.971             & 0.473             & 0.425             & 0.866             & \textbf{0.958}    & 0.198             & 0.324             & 0.888 \\
    OpenGAN-pixel     & 0.818             & 0.000             & 0.008             & 0.800             & 0.767             & 0.000             & 0.004             & 0.800 \\
    \midrule
    ViT (MSP)         & 0.975             & 0.448             & 0.172             & 0.802             & 0.879             & 0.269             & 0.129             & 0.802 \\
    ViT (MD)          & \textbf{0.995}    & 0.136             & 0.495             & 0.800             & \underline{0.951} & 0.053             & 0.279             & 0.800 \\
    ViT (RMD)         & 0.951             & 0.427             & 0.446             & 0.825             & 0.915             & 0.365             & 0.361             & 0.837 \\
    ViT (OpenMax)     & \underline{0.984} & 0.346             & 0.291             & 0.804             & 0.907             & 0.086             & 0.166             & 0.801 \\
    \midrule
    AT (MSP)          & 0.735             & 0.462             & 0.442             & 0.874             & 0.603             & 0.324             & 0.250             & 0.885 \\
    AT (MD)           & 0.771             & 0.429             & 0.527             & 0.832             & 0.649             & 0.278             & 0.357             & 0.808 \\
    AT (RMD)          & 0.836             & 0.436             & 0.523             & 0.851             & 0.700             & 0.366             & 0.363             & 0.836 \\
    AT (OpenMax)      & 0.805             & 0.468             & 0.508             & 0.808             & 0.650             & 0.319             & 0.350             & 0.832 \\
    \midrule
    HAT (MSP)         & 0.770             & 0.560             & 0.548             & 0.825             & 0.612             & 0.393             & 0.335             & 0.176 \\
    HAT (MD)          & 0.789             & 0.572             & 0.586             & 0.869             & 0.810             & \underline{0.587} & \underline{0.603} & \underline{0.953} \\
    HAT (RMD)         & 0.878             & 0.602             & 0.606             & 0.858             & 0.730             & 0.443             & 0.416             & 0.191 \\
    HAT (OpenMax)     & 0.821             & 0.613             & \underline{0.648} & \underline{0.915} & 0.703             & 0.462             & 0.462             & 0.263 \\
    \midrule
    OSAD (MSP)        & 0.698             & 0.411             & 0.407             & 0.854             & 0.557             & 0.285             & 0.194             & 0.855 \\
    OSAD (MD)         & 0.626             & 0.375             & 0.432             & 0.831             & 0.615             & 0.368             & 0.416             & 0.816 \\
    OSAD (RMD)        & 0.776             & 0.421             & 0.456             & 0.823             & 0.680             & 0.369             & 0.353             & 0.840 \\
    OSAD (OpenMax)    & 0.827             & 0.544             & 0.554             & 0.851             & 0.647             & 0.325             & 0.330             & 0.823 \\
    \midrule
    AOE (MSP)         & 0.780             & 0.544             & 0.527             & 0.885             & 0.566             & 0.332             & 0.324             & 0.857 \\
    AOE (MD)          & 0.709             & 0.361             & 0.484             & 0.815             & 0.743             & 0.406             & 0.539             & 0.855 \\
    AOE (RMD)         & 0.780             & 0.382             & 0.421             & 0.875             & 0.682             & 0.355             & 0.313             & 0.821 \\
    AOE (OpenMax)     & 0.797             & 0.528             & 0.586             & 0.898             & 0.591             & 0.282             & 0.356             & 0.843 \\
    \midrule
    ALOE (MSP)        & 0.843             & \underline{0.664} & 0.538             & 0.887             & 0.701             & 0.438             & 0.317             & 0.827 \\
    ALOE (MD)         & 0.827             & 0.369             & 0.479             & 0.832             & 0.793             & 0.516             & 0.543             & 0.864 \\
    ALOE (RMD)        & 0.815             & 0.293             & 0.364             & 0.822             & 0.632             & 0.275             & 0.283             & 0.878 \\
    ALOE (OpenMax)    & 0.868             & 0.584             & 0.606             & 0.861             & 0.731             & 0.399             & 0.389             & 0.825 \\
    \midrule
    ATD (Ours)        & 0.943 & \textbf{0.837} & \textbf{0.862} & \textbf{0.993} & 0.877 & \textbf{0.734} & \textbf{0.739} & \textbf{0.963} \\
    \bottomrule
    \end{tabular}%
\end{adjustbox}
\caption{Table 1: OOD detection AUROC under attack with $\epsilon = \frac{8}{255}$ for various methods trained with CIFAR-10 or CIFAR-100 as the closed set. A clean evaluation is one where no attack is made on the data, whereas an in/out evaluation means that the corresponding data is attacked. The best and second-best results are distinguished with bold and underlined text for each column.}
\end{table}