degree of the polynomial approximation to sigmoid, but observed that

We thank all reviewers for their helpful comments, and provide our response below (reviewers' comments are italicized). We will also apply the changes suggested by the reviewer to improve the overall presentation. We would like to clarify/correct a few key points in reviewer's comments, with the hope that this will help PPML schemes that we compare with (and build upon). Poisoning attacks is certainly an interesting future direction. Please note that, even in this domain, the problem is already very challenging and an active area of research.