Using targeted attack strategy allows us to include the randomness of the target label sampling. We choose Jester dataset as it generally takes few queries to attack Jester dataset, thussavingtesting time. GEO-TRAP can employ different kinds of geometric transformations in theTRANS-WARP function. Thisisdemonstrated bythefactthatGEO-TRAP'sgradients generally have larger cosine similarity with the ground truth gradients. Wedenote the probability score associated with this label aspy(x).

Using the examplse in Figure 2(a), where only inter-edges exist, prior to conducting score propagation, all ID and OOD nodes can be fully distinguished.

We develop a method to generate prediction intervals that have a user-specified coverage level across all regions of feature-space, a property calledconditional coverage.

The null block, containing the square patch, does not encode any information of the image class.