A Additional Related Works

We review the recent studies in OOD detection, model reprogramming, and backdoor attack. The classification-based methods use the representations extracted from the well-trained classification models in OOD scoring. Matrix to exploit models' detection capability from embedding features; [ Our methods can also be used in the distance-based methods. The term "attack" lies in the fact that, by reprogramming, an attacker can easily In this paper, we also employ the reprogramming property of deep models for transfer learning. Output: learned watermark w .