Further, calculating the effect of the attack on e s and e r requires a third order derivative of the loss, which is not practical (O(n 3 ) in the number of parameters).
we assume that e s e s and e r e r .