We would like to thank all reviewers for reading our paper and providing constructive comments. Sometimes, the primary interest is to understand agent behaviors, and hence only the learning mode is needed. Alternatively, when all game inputs are known, the focus is on the intervention mode. In the final version, we will (i) explain in 2.1 how these We agree that it is neither rigorous nor necessary to assert that "most" Our work is inspired by the current interests on complex optimization-based layers. It is the first to treat VIs as individual layers in the end-to-end framework.

We thank all the reviewers for their constructive comments. Making predictions directly on a pixel level without the intermediate structures won't be Still, we follow the reviewers' suggestion by including an additional baseline that predicts directly over the pixels. The above figure shows the results. Dreamer's prediction deviates from the ground truth and quickly becomes blurry, Baselines, even with graph-structured prediction models, cannot cope with such out of distribution generalization. Applicability of the proposed method (R4, R1).

Q2: Please summarize your review in 1-2 sentences The paper presents a method to scale up training of linear models. The idea is original, presentation is excellent, empirical results compelling, and all this accompanied with relevant theoretical guarantees.

We are grateful to reviewers for the constructive comments, which help to improve the quality & clarity of the paper. Figure 1: Test accuracy on CIFAR100 as suggested by R1 (i.e. In summary, when ambiguous passports are forged and used ( e.g. We will include above results to the final draft. V1 V2 V3 Training - Passport layers added - Passports needed - 15-30% more training time - Passport layers added - Passports needed - 100-125% more training time - Passport layers added - Passports needed - Trigger set needed - 100-150% more training time Inferencing - Passport layers & passports needed - 10% more inferencing time - Passport layers & passport NOT needed NO extra time incurred - Passport layers & passport NOT needed NO extra time incurred V erification - NO separate verification needed - Passport layers & passports needed - Trigger set needed (black-box verification) - Passport layers & passports needed (white-box verification)Table 2: Summary of network complexity for V1, V2 and V3 schemes.

We thank all reviewers for the constructive comments. Examples include Xu et al., (2016, arXiv:1602.04511), Therefore, many existing methods adopt such a procedure. RMSE cannot distinguish which prediction is better, while the log-likelihood for the best prediction is the largest. RNN is not suitable for the short sequence data we are targeting, so we did not include it.

Again, thank you all for giving us the opportunity to strengthen our paper with your valuable comments and queries.

We thank reviewers for their constructive comments, please see below for our response. We will make this clear in the revised version. We will include the new results in the revision. Reviewer#2-1-Why SVT suffers from low accuracy. PC's original privacy guarantee might not hold because the sensitivity of the utility score calculated with greedy search We will make the statement more clear in the revision.

We would like to thank all of the reviewers for their valuable time and their constructive comments. We will incorporate the proposed minor corrections in the final version of the paper. On whether support set changes during iterations, we observe that in experiments (subsection 4.1) IHT changes support, We thank the reviewer for the supportive and constructive review. Regarding the comment in lines 198-202, we apologize for any confusion. Regarding variance in experiments, we have observed high variance is not enough for the algorithm to get "lucky".