A Additional Related Works We review the recent studies in OOD detection, model reprogramming, and backdoor attack

We review the recent studies in OOD detection, model reprogramming, and backdoor attack. A.1 OOD Detection Following [58], we attribute existing works into three categories, namely, the classification-based methods, the density-based methods, and the distance-based methods. In general, these methods aim to maximize the gap between ID and OOD data regarding specified metrics in identifying OOD data. The classification-based methods use the representations extracted from the well-trained classification models in OOD scoring. For example, [17, 32, 33, 37, 46, 51] employ logit outputs from models in estimating the confidence of ID data; [28, 44] adopt Mahalanobis distance and Gram Matrix to exploit models' detection capability from embedding features; [21, 32] further demonstrate the importance of gradient information, either perturbing inputs with its gradients or directly using the gradient norm in scoring.