We sincerely thank Reviewer twGb for their incredibly thorough and detailed review. We are grateful for the positive feedback on our "strong empirical results," "SotA performance," "good literature review," and "extensive ablation studies." We also appreciate the constructive suggestions for improving the paper's clarity and structure, which we will incorporate into the final version.

The reviewer twGb's main concerns relate to the motivation behind our score formulation and the method's potential complexity and generalization. We believe the clarifications and extensive new supporting evidence below directly address these points and robustly demonstrate that our method is principled, not over-tuned, and highly generalizable.

---

1. Core Method Motivation: Justification for the $Q'$ Score Formulation

• The formulation of $Q' = Q + \lambda C_o$ is an intentional design choice. The $C_o$ term acts as a crucial regularizer to balance the influence of the feature-based OODness score ($Q$) and the original logits, preventing overconfident scaling and leading to superior OOD detection.

  Reviewer twGb correctly identifies that $Q$ indicates OOD-likeness while $C_o$ indicates ID-likeness, and questions their addition. The motivation is to prevent the scaling factor, which is derived from $Q$, from completely dominating the final energy score.

  As noted in Lines 185-187, relying solely on $Q$ can lead to "overoptimistic estimations." If an OOD sample gets a very high $Q$ score, it will produce a very large scaling factor. This can amplify the logits so much that it washes out the subtle but important information contained within the relative values of the logits themselves. By adding the opposing $C_o$ term, we "tame" or regularize these potentially overconfident scaling factors. This ensures a healthier balance where both the feature-level instability (captured by $Q$) and the original logit distribution contribute to the final OOD score.

• Illustrative Example: A simple toy example demonstrates why this balancing is critical. Assume a threshold of 25, where energy > 25 is ID and energy < 25 is OOD (We deal with magnitude for simplicity).

  • Logits: Let $\\text{logit}_\text{ID} = (1, 6, 2)$ and $\text{logit}_\text{OOD} = (1, 1, 1)$.
  • Case 1: Overconfident Scaling (using only $Q$) Let's say this yields scaling factors $r_\text{ID}=2$ and $r_\text{OOD}=5$.
    • $\text{energy}_\text{ID} = \log( e^{1 \cdot 2^2} + e^{6 \cdot 2^2} + e^{2 \cdot 2^2} ) = 24.0$
    • $\text{energy}_\text{OOD} = \log( e^{1 \cdot 5^2} + e^{1 \cdot 5^2} + e^{1 \cdot 5^2}) = 26.1$

  Here, \\text{energy}_\\text{OOD} > \\text{energy}_\\text{ID}, leading to an OOD detection failure.

  • Case 2: Balanced Scaling (using $Q'$ to temper the scaling) This leads to less extreme scaling, e.g., $r_\text{ID}=1$ and $r_\text{OOD}=2$. Assume a threshold of 5, where energy > 5.5 is ID and energy < 5.5 is OOD (We deal with magnitude for simplicity).
    • $\text{energy}_\text{ID} = \log( e^{1 \cdot 1^2} + e^{6 \cdot 1^2} + e^{2 \cdot 1^2} )=6.0$
    • $\text{energy}_\text{OOD} = \log( e^{1 \cdot 2^2} + e^{1 \cdot 2^2} + e^{1 \cdot 2^2} )=5.1$

  Here, \\text{energy}_\\text{ID} > \\text{energy}_\\text{OOD}, leading to a successful detection.

• Empirical Validation: The superiority of the combined score $Q'$ over just using $Q$ is confirmed by the results below. Using $Q'$ consistently and significantly outperforms using $Q$ alone across all 8 diverse architectures.

---

2. On Heuristic Design and Generalization

• We provide new, extensive results to assure the reviewer that AdaSCALE generalizes exceptionally well and is not over-tuned. We achieve SotA performance even when we fix almost all hyperparameters and tune only a single parameter, demonstrating the robustness of our approach.

  To directly address the valid concern about "searching for the best results on the test set," we provide the following evidence:

  1. Near-Insensitivity to most Hyperparameters: Our results show that many hyperparameters are robust. For instance, fixing $k_2=5\\%$ across all networks results in almost no significant average performance drop from the tuned version on ImageNet-1k benchmark (62.12 vs 61.17 FPR95 near-OOD; 30.25 vs 30.11 far-OOD).

  2. Generalization with Single Hyperparameter Tuning: To provide the strongest possible assurance, we ran a new experiment where we fixed all hyperparameters except one ($p_\text{max}$, tuned from a discrete set) across all 8 architectures on ImageNet-1k. Even in this highly constrained setting, AdaSCALE drastically outperforms the prior SotA (OptFS).

This result (+13% FPR95 / +8% AUROC on near-OOD vs. OptFS) confirms that the core mechanism of AdaSCALE is powerful and generalizable, not the result of over-tuning. Its practical application is comparable to prior work like ASH/SCALE, which also require tuning one parameter. We will add this full analysis to the paper.

Additionally, we present the results of both DenseNet and WideResNet networks with same set of hyperparameters in CIFAR-100 benchmarks only allowing $p_\text{max}$ to be tuned:

CIFAR-100 with WideResNet-40-2

CIFAR-100 with DenseNet-101

AdaSCALE outperforming SCALE & OptFS in CIFAR-100 datasets demonstrates the generalization of hyperparameters of AdaSCALE across datasets too.

---

3. Clarifications on Terminology and Figures

We thank the reviewer for pointing out these areas of unclarity, which we will fix in the final manuscript.

1. Use of "OOD Likelihood": We will revise the paper and replace this term with the more accurate "predetermined OODness score."
2. Interpretation of Figure 5: We apologize for the lack of clarity. For the AUROC plot, the axes are indeed not standard. p_min increases from left to right, and p_max increases from top to bottom. All entries satisfy p_\\text{min} \le p_\\text{max}. We will add arrows and a clearer explanation to the caption.
3. Definition of "Trivial Pixels": "Trivial pixels" refers to the o% of pixels with the lowest gradient attribution scores, representing the input features that are least salient for the model's current prediction.

---

We hope these detailed justifications, illustrative examples, and extensive new results have fully addressed the reviewer's concerns. We are very grateful for the insightful feedback, which has helped us to significantly strengthen the motivation and validation of our work.

4. We sincerely apologize for this valid confusion in the upper triangle. Top right corner is intended to be $p_\text{min}=65$, $p_\text{max}=95$.

As of now, it needs to be read as:

For top most row, p_\\text{min} = 65

For bottom most row, $p_\text{min} = 95$

For right most column, $p_\text{max} = 95$,

For left most column, $p_\text{max} = 65$,

We will explain this in more detail as soon as possible.

5. Since ResNet-50 is traditionally used to benchmark the results for ImageNet-1k, we determine these hyperparameters by simply tuning them in ResNet-50 architecture. We tuned hyperparameters from the following range:

$\epsilon$ in the range $\\{0.1, 0.5, 1.0\\}$

$\lambda$ in the range $\\{0.1, 1.0, 10.0, 100.0\\}$

$o$ in the range $\\{1, 5, 10, 50, 100\\}$

$k_1$ in the range $\\{1, 5, 10, 50, 100\\}$

$k_2$ in the range $\\{1, 5, 10, 100\\}$

$p_\text{min}$ is simply set to lower limit of percentile tuning (~60) inspired by ASH/SCALE.

The final recommended hyperparameters are ($\epsilon$, $\lambda$, $o$, $k_1$, $k_2$, $p_\text{min}$) = (0.5, 10, 5%, 1%, 5%, 60). For more detail on hyperparameter sensitivity study, we would sincerely like to request Reviewer twGb to refer to response to Reviewer J2BC. Importantly, we can simply use these values of hyperparameters across various architectures without significant average performance drop.

Why method was designed this way?

We believe scaled energy score as an OOD detection signal works well because it accomodates two independent and effective sources of OOD detection signal: activation pattern of feature space and logit information. Now inspired from this, we make an attempt to further add another independent source of OOD detection signal in this existing mechanism. We identify the possibility of activation shift to be a reliable additional OOD detection signal. We inject this extra signal through the application of adaptive percentile instead of static percentile. In order to compute the adaptive percentile, we need to rely on the computation of $Q’$.

We request Reviewer twGb to please let us know if there is more clarity we could add on any of the concerns above.

Also, we sincerely thank Reviewer twGb for insightful feedbacks.

We thank Reviewer A6Qe for their detailed feedback and for recognizing that our idea is "novel and conceptually sound" and supported by "experimentally validated" results.

We appreciate the opportunity to clarify the reviewer's concerns regarding hyperparameter tuning, the intuition behind our method, the perturbation ratio, and a minor typo. We believe our responses and new supporting evidence below fully address these points and demonstrate the practical robustness and effectiveness of our work. We are confident that these clarifications will merit a re-evaluation of the score.

---

1. On Hyperparameter Tuning and Computational Cost

• Our method is highly robust and requires minimal tuning. Fixing most hyperparameters and tuning only a single parameter, p_\\text{max}, still results in state-of-the-art performance, demonstrating strong generalization.

  We understand the concern about hyperparameter sensitivity. To directly address this, we conducted a new, extensive experiment where we fixed all hyperparameters across 8 diverse architectures on the ImageNet-1k benchmark, tuning only a single parameter, p_\\text{max}, from a discrete set.

  As shown below, even under this highly constrained setting, AdaSCALE significantly outperforms the previous state-of-the-art (OptFS) by an average of 13% (FPR95) / 8% (AUROC) on near-OOD and 14% (FPR95) / 2% (AUROC) on far-OOD datasets.

Furthermore, we present the results of both DenseNet and WideResNet networks with same set of hyperparameters in CIFAR-100 benchmarks only allowing $p_\text{max}$ to be tuned:

CIFAR-100 with WideResNet-40-2

CIFAR-100 with DenseNet-101

AdaSCALE outperforming SCALE & OptFS in CIFAR-100 datasets demonstrates the generalization of hyperparameters of AdaSCALE across datasets too.

---

Notably, OptFS achieves its optimal performance across a diverse range of architectures while utilizing a single constant (width) hyperparameter value. But, it comes with its not so impressive generalization in small-scale settings (CIFAR-10/100 benchmark) as reported in the manuscript (See Table 3) and above tables. Furthermore, though OptFS is the currently best generalizing method in large-scale settings, AdaSCALE outperforms it by 13% in near-OOD and 14% in far-OOD datasets in average FPR@95 metric on the ImageNet-1k benchmark across eight diverse architectures at the cost of just one hyperparameter.

Furthermore, the need of tuning one percentile hyperparameter for each architecture also exists in the predecessor of AdaSCALE i.e. (ASH/SCALE/LTS) for optimal performance. Needless to say, we reported the results of ASH/SCALE/LTS achieved by tuning percentile hyperparameter for each setup. This demonstrates that the practical application of AdaSCALE is comparable to prior works like ASH and SCALE, which also require tuning one key hyperparameter. We will add this comprehensive table and discussion to the paper.

• On computational Cost:
  • Table 8 shows the latency comparison of using variable vs fixed percentile for scaling across activation spaces of varying dimensions (for ex. ResNet-18 has activation dimension of 512 and ResNet-50 has activation dimension of 2048). Prior works such as ASH, SCALE, LTS use fixed percentile for scaling while AdaSCALE uses dynamic percentile for scaling. The results demonstrate the limitation of AdaSCALE in terms of higher latency introduced by the use of dynamic percentile. As an OOD detection method, SCALE and OptFS both have roughly equal latency. In comparison to them, AdaSCALE’s latency is about 2.91x higher when trivial pixels are selected for perturbation via gradient attribution method. If random pixels are selected for perturbation — which is shown to be almost equally effective — latency decreases to 1.56x factor. We will address this in the manuscript.

2. Insights Behind the Observed Activation Shifts

• The larger activation shifts in OOD inputs stem from their tendency to produce unstable, high-magnitude activations, an observation supported by prior work.

  To clarify the core intuition, we build upon the findings of ReAct, which observed that OOD samples often induce abnormally high-magnitude activations compared to ID samples. Our key insight is that the positions of these peak activations (e.g., the top 1\%) in OOD inputs are highly unstable. A minor, trivial perturbation is enough to change which neurons produce these peak activations. When the original peak activations are replaced by more normal values from other neurons post-perturbation, the result is a large "activation shift." For ID samples, the activations are more stable and less prone to such dramatic shifts. The analysis of input-space gradient values for OOD vs. ID data, while interesting, is outside the direct scope of our work, which focuses on the effect of perturbation on activations. For a deeper analysis of gradient values in image space for OOD detection, we refer to [1].

[1] Agarwal, C., D'souza, D. and Hooker, S., 2022. Estimating example difficulty using variance of gradients. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 10368-10378).

3. On the Optimal Perturbation Ratio ($o\\%$)

• A small perturbation ratio ($o=5\\%$) targeting trivial pixels is optimal because it efficiently disturbs the unstable peak activations that characterize OOD inputs.

  As the reviewer correctly notes, our results show that perturbing a smaller portion of the input is more effective. The full ablation study on the hyperparameter $o$ is presented in Appendix C.3, Table 11, which we referenced in the caption of Table 7.

  The study in the appendix confirms that perturbing just 5% of trivial pixels (those with the lowest gradient attribution) yields the best performance. This is because our goal is not to change the image content, but merely to introduce a small disturbance to identify the instability of peak activations (note: we only consider top $k_1=1\\%$ activations). Perturbing trivial pixels achieves this efficiently.

  Importantly, Table 11 also shows that random perturbation performs nearly as well as perturbing trivial pixels, and significantly better than perturbing salient (high-gradient) pixels. This leads to an excellent performance-efficiency trade-off, making the random perturbation of a small pixel subset (5%) our recommended practical approach, as it removes the need for any gradient calculations.

4. Clarification on Energy Values (Lines 223-224)

• Thank you for catching this. It is an error in our text, and we will correct it.

---

We hope these detailed responses and additional experiments resolve the reviewer's concerns. We have shown that our method is robust, requires minimal tuning, and is grounded in a clear intuition, with its practical efficiency being a key advantage. We thank the reviewer again for their valuable and constructive feedback.

We sincerely thank Reviewer A6Qe for the opportunity to make clarifications.

Consistent with the prior works [ASH, SCALE] (OpenOOD), the search range used for $p_{\text{max}}$ is [65, 70, 75, …, 90, 95, 99].

The final recommended hyperparameters are ($\epsilon$, $\lambda$, $o$, $k_1$, $k_2$, $p_\text{min}$) = (0.5, 10, 5%, 1%, 5%, 60).

The optimal value of $p_{\text{max}}$ is determined via validation set of OpenOOD (OpenImage-O) using AUROC metric.

Also, we sincerely thank Reviewer A6Qe for insightful feedbacks.

1. Since ResNet-50 is traditionally used to benchmark the results for ImageNet-1k, we determine these hyperparameters by simply tuning them using ResNet-50 architecture. We tuned hyperparameters from the following range:

$\epsilon$ in the range $\\{0.1, 0.5, 1.0\\}$

Comment: Since mean of rgb statistics is (0.485, 0.456, 0.406), magnitude of 0.5 is closer to those individual means and hence sufficient enough to destroy the pixel information to cause disturbance to peak activations. It is independent of architecture.

$o$ in the range $\\{1, 5, 10, 50, 100\\}$:

Comment: $o$ deals with extent of perturbation to cause disturbance in peak activations. It is also independent of architecture.

$\lambda$ in the range $\\{0.1, 1.0, 10.0, 100.0\\}$

Comment: The value of $\lambda$ should be at least 10 for $Q$ to dominate $C_o$ in forming $Q’$. $Q$ captures activation shift while $C_o$ is regularizer to prevent overconfident scaling.

$k_1$ in the range $\\{1, 5, 10, 50, 100\\}$

Comment: Inspired by ReAct, we observe only few peak activations (1%) in OOD show high fluctuations in activations under minor perturbation.

$k_2$ in the range $\\{1, 5, 10, 100\\}$

Comment: Since $C_o$ is regularizer to prevent overconfident scaling, it is dependent on $Q$ and thereby $k_1$. Empirically, we find $k_2=5$ to work well across all architectures to prevent overconfident scaling.

$p_\text{min}$ is simply set to lower limit of percentile tuning (~60) inspired by ASH/SCALE.

Importantly, we can simply use these values of hyperparameters across architectures without significant average performance drop. For more details on hyperparameter sensitivity study, we would sincerely like to request Reviewer A6Qe to refer to response to Reviewer J2BC.

2. The latency of tuning percentile hyperparameter in AdaSCALE is about 2.91x higher than that of SCALE when trivial pixels are selected for perturbation via gradient attribution method. If random pixels are selected for perturbation — which is shown to be almost equally effective — latency decreases to 1.56x factor.

We are grateful to Reviewer A6Qe for providing the opportunity to make useful clarifications.

We thank Reviewer J2BC for their insightful feedback and constructive suggestions. We are encouraged that the reviewer found our method "well-motivated" and based on an "interesting and principled" observation, and that they recognized the genuine limitation we address in existing scaling methods.

---

1. On Hyperparameter Complexity and Generalization (The Core Concern)

• We provide extensive new evidence to demonstrate that AdaSCALE is not sensitive to the vast majority of its hyperparameters. 6 of the 7 listed hyperparameters can be fixed to constant values across all 22 of our experimental setups [8 (ImageNet-1k OOD detection) + 8 (ImageNet-1k FSOOD detection) + 2 (CIFAR-10 OOD detection) + 2 (CIFAR-100 OOD detection) + 2 (ISH regularization) = 22 setups ]. Tuning only a single parameter (p_\\text{max}) is sufficient for AdaSCALE to establish a new state-of-the-art, proving its practical applicability and generalization.

We will address each group of hyperparameters to provide the strongest possible assurance.

• Six Hyperparameters That Do Not Require Tuning: We show that $\lambda, o, \varepsilon, p_\text{min}, k_1$, and $k_2$ are highly robust and can be fixed across all architectures and datasets without significant performance loss. For example, fixing $k_2=5\\%$ across all 8 diverse architectures on ImageNet results in a negligible average performance change compared to the tuned version in each case (62.12 vs 61.17 FPR95 near-OOD). This demonstrates these are not sensitive tuning parameters but rather stable configuration choices.

• Sensitivity study

$\lambda$: The sensitivity study of $\lambda$ using ResNet50 network on ImageNet-1k benchmark is presented in the Figure 7 in terms of near-OOD detection. The comprehensive study including far-OOD detection results is presented below:

We set $\lambda=10$ across all 22 setups. $\lambda$ hyperparameter does not require tuning.

$o$: The comprehensive study of $o$ using ResNet50 network on ImageNet-1k benchmark is provided in the Appendix (in Table 11). We set $o=5$ across all 22 setups. $o$ hyperparameter does not require tuning.

$\varepsilon$: The sensitivity study of $\varepsilon$ using ResNet50 network on ImageNet-1k benchmark is provided in the Appendix (in Table 8). We set $\varepsilon=0.5$ across all 22 setups. $\varepsilon$ hyperparameter does not require tuning.

$k_1$: We present sensitivity study of $k_1$ using ResNet50 network on ImageNet-1k benchmark below:

We set $k_1$ to $1\%$ across all 22 setups. $k_1$ hyperparameter does not require tuning.

$k_2$: We present sensitivity study of $k_2$ using ResNet50 network on ImageNet-1k benchmark below:

Though we allowed $k_2$ hyperparameter to be tuned for all 22 setups, it can be set to 5% across all setups without any substantial performance drop. $k_2$ hyperparameter does not require tuning.

• p_\\text{min} We initially tuned $p_\text{min}$​, but given prior work (ASH, SCALE, LTS) tunes percentiles in the ~[60, 99] range, we can simply set $p_\text{min}$ to 60.

• The Only Required Tuning Parameter: p_\\text{max} We ran a new experiment where we fixed all other parameters (p_\\text{min}=60, \lambda=10, \varepsilon=0.5, k_1=1\\%, k_2=5\\%, o=5\\%) and tuned only p_\\text{max} from a discrete set. Even under this highly constrained, practical setting, AdaSCALE overwhelmingly outperforms the previous state-of-the-art (OptFS).

Tuning a single percentile-related hyperparameter is standard practice for this entire line of work (e.g., ASH, SCALE, LTS), and our method achieves a ~13% FPR95 improvement on near-OOD benchmarks with the same practical effort.

• The n_\\text{val} hyperparameter: $n_\text{val}$ is not a hyperparameter to be tuned. The study in Table 6 demonstrates that AdaSCALE is robust even with extremely limited access to ID samples (e.g., $n_\text{val}=10$), unlike distance-based methods.

---

2. Intuition and Robustness

• Why Activation Shifts Occur: Our intuition is built on the seminal observations of ReAct [1], which showed OOD samples often produce abnormally high activations. We hypothesize that the positions of these peak activations are unstable. A minor, trivial perturbation is sufficient to cause these peak activations to be replaced by more normal values and peak activations occur elsewhere, resulting in a large activation shift that serves as a powerful, independent OOD signal. We will clarify this motivation in the paper.

• Robustness to Real-World Image Corruptions:

  • AdaSCALE's performance advantage holds even when inputs are subjected to common image corruptions, demonstrating its practical robustness. We tested AdaSCALE on ImageNet-1k with a ResNet-50 against SCALE and OptFS on images with Gaussian blur and JPEG compression. Even without any hyperparameter re-tuning, AdaSCALE remains the superior method.

Gaussian Blur (kernel_size=5, sigma=(0.1, 2.0)):

JPEG Compression (50%):

---

3. Additional Baselines and Clarifications

• Comparison with Simple/Efficient Baselines: Per the reviewer's suggestion, we compared AdaSCALE with NNGuide and MDS on ImageNet-1k benchmark using ResNet50 model. Our method significantly outperforms them. Furthermore, effectiveness of such distance-based approaches (MDS) is contigent upon the large availability of ID samples.

• Figure 5: We apologize for the confusion. The reviewer is correct that the plot is unclear. p_\\text{min} increases from left to right, and p_\\text{max} increases from top to bottom. We will add arrows and a clearer caption to fix this.

• Table 6 (n_\\text{val}): The values are from a single official PyTorch checkpoint. The key takeaway, which holds, is that performance is stable and excellent even with very few ID samples. We also confirm this with ResNet-101 network below:

As can be observed from the results, AdaSCALE works well with very limited access to ID data.

• Table 7 (Pixel Types): The perturbation settings are:
  • Random: o% of pixels are selected randomly.
  • Trivial: o% of pixels with the lowest gradient attribution scores are perturbed.
  • Significant / Salient: o% of pixels with the highest gradient attribution scores are perturbed.

Table 8 compares variable vs. fixed percentile scaling latency across activation space dimensions. Prior methods (ASH, SCALE, LTS) use a fixed percentile, while AdaSCALE uses a dynamic percentile, leading to higher latency. We'll update the manuscript to reflect "Fixed percentile (ASH/SCALE/LTS)." While SCALE and OptFS have similar latency, AdaSCALE's is 2.91x higher with gradient attribution for trivial pixel perturbation, dropping to 1.56x with random pixel perturbation.

• Formula Notation & Limitations: Thank you for the suggestion. We will revise the notation for clarity and will add a limitations section to the paper, explicitly discussing the practical need to tune the single p_\\text{max} hyperparameter for a new setup for optimal performance.

---

We thank the reviewer for the insightful review.

Joint parameter interactions:

Our method's reliance on activation shift for computing the adaptive percentile makes the hyperparameters $p_\text{max}$, $k_1$, and $\lambda$ particularly critical. We set $p_\text{max}=85$, and focus on the impact of $k_1$ and $\lambda$ on near-OOD detection, measured by FPR@95 / AUROC.

The results clearly indicate that the $\lambda$ hyperparameter exerts a more significant influence on the final OOD detection performance. Furthermore, a key relationship emerges: for optimal performance, a decrease in $\lambda$ must be compensated by an increase in $Q$ (and consequently, a higher $k_1$). This is explained by the formulation $Q' = \lambda \cdot Q + C_o$, where a smaller $\lambda$ necessitates a larger $Q$ value to ensure the term $\lambda \cdot Q$ dominates the regularizer $C_o$.

—————

Hyperparameter and generalization:

Since ResNet-50 is traditionally used to benchmark the results for ImageNet-1k, we determine these hyperparameters by simply tuning them using only one architecture (ResNet-50). Hence, these values are determined from 1 setup and can be used across 21 other setups. We apologize for the confusion, we mean: for any given new setup, 6 of 7 hyperparameters do not need to be tuned. We believe exceptional performance of AdaSCALE with these fixed hyperparameters when compared against SCALE / OptFS across new 21 setups confirms strong generalization.

We tuned hyperparameters from the following range:

$\epsilon$ in the range $\\{0.1, 0.5, 1.0\\}$

Comment: Since mean of rgb statistics is (0.485, 0.456, 0.406), magnitude of 0.5 is closer to those individual means and hence sufficient enough to destroy the pixel information to cause disturbance to peak activations.

$o$ in the range $\\{1, 5, 10, 50, 100\\}$:

Comment: $o$ deals with extent of perturbation to cause disturbance in peak activations. We just need to make trivial perturbation.

$\lambda$ in the range $\\{0.1, 1.0, 10.0, 100.0\\}$

Comment: The value of $\lambda$ should be at least 10 for $Q$ to dominate $C_o$ in forming $Q’$. $Q$ captures activation shift while $C_o$ is regularizer to prevent overconfident scaling.

$k_1$ in the range $\\{1, 5, 10, 50, 100\\}$

Comment: Inspired by ReAct, we observe only few peak activations (1%) in OOD show high fluctuations in activations under minor perturbation.

$k_2$ in the range $\\{1, 5, 10, 100\\}$

Comment: Since $C_o$ is regularizer to prevent overconfident scaling, it is dependent on $Q$ and thereby $k_1$. Empirically, we find $k_2=5$ to work well across all architectures to prevent overconfident scaling.

$p_\text{min}$ is simply set to lower limit of percentile tuning (~60) inspired by ASH/SCALE.

Just for extra verification, fixing $k_2=5$ across all 8 diverse architectures on ImageNet-1k results in a negligible average performance change compared to the tuned version in each case (62.12 vs 61.17 FPR95 near-OOD).

The percentile hyperparameter $p$ from prior works (ASH / SCALE) is similar to $p_\text{max}$.

Quoting directly from SCALE [1],

Discussion on percentile $p$: Note that $C(p)$ does not monotonically increasing with respect to $p$ (see Fig.4a). When $p \approx 0.95$, there is an inflection point and $C(p)$ decreases. A similar inflection follows on the AUROC for scaling (see Fig.4b), though it is not exactly aligned to $C(p)$. The difference is likely due to the approximations made to estimate $C(p)$. Also, as $p$ gets progressively larger, fewer activations ($D=2048$ total activations) are considered for estimating $r$, leading to unreliable logits for the energy score. Curiously, pruning also drops off, which we believe to come similarly from the extreme reduction in activations.

[1] Scaling from training time and posthoc ood detection enhancement

It should be noted that percentile hyperparameter beyond a certain threshold makes the method appear more sensitive. However, it should be seen from the context of prior works. This occurs in all of the prior works (ASH/SCALE/LTS). This pattern of sensitivity does not occur before that particular threshold.

Please see prior seminal works [1] (Figure 4.b) and [2] (Figure 4.c)

[1] Scaling from training time and posthoc ood detection enhancement

[2] Extremely simple activation shaping for out of distribution detection

The sensitivity study of the hyperparameters for ViT-B-16 is presented below (FPR@95↓ / AUROC↑):

We also present the joint sensitivity study of 4 hyperparameters in the ViT-B-16 network below with ($k_1=1\%$, and $k_2=5\%$) in terms of validation AUROC (the metric used to choose hyperparameters):

It shows AdaSCALE is indeed robust.

We sincerely thank Reviewer GsBJ for the positive and constructive feedback. We are grateful that the reviewer found our paper "well-motivated and well written," our concepts "clearly explained," and our experimental validation "fairly comprehensive."

The reviewer GsBJ's primary questions concern the comparison against distance-based methods and the analysis on adversarially trained models. We have conducted new experiments for both points as suggested. We believe the results presented below fully address these questions and further strengthen the contributions of our work.

---

1. Comparison with Distance-Based OOD Detection Methods

• AdaSCALE significantly outperforms representative distance-based methods in a large-scale setting.

  Per the reviewer GsBJ's suggestion, we have benchmarked AdaSCALE against distance-based methods, NNGuide and MDS, on the ImageNet-1k benchmark using a ResNet-50 backbone. The results, showing FPR95 (↓) / AUROC (↑), are as follows:

These results demonstrate a substantial performance gap in favor of our method in this large-scale setting. We will include these new results and a detailed discussion comparing AdaSCALE with distance-based approaches in the final version of the manuscript.

2. Analysis on Adversarially Trained Models

We thank the reviewer GsBJ for this insightful question regarding the interaction between our method and adversarial training. We have investigated both sub-questions, and our analysis confirms that our core premise holds and AdaSCALE remains highly effective.

• (a) On the sensitivity of adversarially trained networks:

  • Adversarially trained networks still exhibit the necessary activation shifts for OOD detection, confirming our method's applicability.

    Our method's effectiveness relies on the activation shift ratio ($Q_{OOD} / Q_{ID}$) being greater than 1. We measured this ratio taking top-1% activation shifts on a ResNet-50 model adversarially trained on ImageNet-1k. The results below show that the ratio remains consistently greater than 1 across various OOD datasets, confirming that OOD samples still produce a larger activation shift than in-distribution samples.

While $\\epsilon$ influences the magnitude of $Q_{OOD} / Q_{ID}$ ratio, the fundamental signal required for our method persists. (The slight trend reversal for ImageNet-O is interesting and, as we will discuss in the paper, likely due to its construction process which involved adversarially targeting a ResNet-50).

• (b) On the performance of AdaSCALE with adversarially trained networks:

  • AdaSCALE consistently outperforms baselines on adversarially trained models, even without any specific hyperparameter tuning.

    We evaluated AdaSCALE's performance on these models using the exact same hyperparameters as the vanilla ResNet-50. The results show that AdaSCALE's adaptive approach remains superior to the baselines.

These results highlight the robustness of AdaSCALE. We will add this full analysis and discussion to the appendix to further strengthen our paper's empirical validation.

---

We hope these clarifications and new results have fully addressed the reviewer GsBJ's questions. We are confident that incorporating this analysis will make our paper even stronger. We thank the reviewer GsBJ again for valuable feedbacks and for helping us improve our work.