Appendix

The ablation of applying summation over baseline methods is providedinTable5. We use ResNet [14] to train on the in-distribution datasets. In particular, ODIN was originally designed for multi-class but we adapt for the multi-label case by taking the maximum of calibrated label-wise predictions. The input perturbation is calculated using ˆx = x sign( `ˆyi), where`ˆyi is the binary cross-entropy loss for the labelˆyi with the largest output, i.e.,ˆyi = argmaxip(yi = 1 | x). For Mahalanobis distance,we extract the feature embeddingφ(x)foragivensample.