Thank you for the comments! We would like to elaborate more as follows.
**Regarding the first concern:**
Our AA and CM viewpoints are exactly what you describe. However, we would like to draw the reviewer's attention to the definition of the corruption measure in the CM viewpoint: $C=\sum_{t=1}^T |\epsilon_t(a_t)|$. This definition only accounts for the corruption for the "chosen action" $a_t$, but not that for other actions $a\neq a_t$.
How does this property allow us to simulate a strong adversary in the AA viewpoint? Below, we illustrate it through a concrete example as in your response (below, we use "he" for the adversary and "she" for the learner). Consider a $d$-dimensional linear bandit with the action set being the canonical basis $e_{1:d}$. From the AA viewpoint, suppose the adversary wants to corrupt the $i$-th dimension of $\theta^*$, and his strategy can be described as the following:
*If $a_t=e_i$ is observed, then set $\epsilon_t=c$*;
*If $a_t\neq e_i$ is observed, then set $\epsilon_t=0$*.
Clearly, this is a strong adversary in the AA viewpoint since the adversary decides whether he wants to corrupt $a_t$, and to what extent he wants to corrupt it, after observing the chosen action $a_t$.
From the CM viewpoint, the equivalent adversary would specify the following "corruption function" $\epsilon_t(\cdot)$ *before* seeing $a_t$:
*$\epsilon_t(e_i)=c$, and $\epsilon_t(e_j)=0$ for $j\neq i$*.
After the learner chooses $a_t$, the learner experiences a corruption of $\epsilon_t(a_t)$.
We clarify two points:
1. The learner has exactly the same observations in the two viewpoints: if she chooses $a_t=e_i$, then she suffers a corruption of $c$; if she chooses $a_t\neq e_i$, then she suffers no corruption.
2. The total corruption $C$ is the same in the two viewpoints: In the AA viewpoint, $C=\sum_{t=1}^T |\epsilon_t|=\sum_{t=1}^T |c|\mathbf{1}\\{a_t=e_i\\}$. In the CM viewpoint, $C=\sum_{t=1}^T |\epsilon_t(a_t)|=\sum_{t=1}^T |c|\mathbf{1}\\{a_t=e_i\\}$.
One key observation is that: in the CM viewpoint, even though the corruption function might be a non-zero function (i.e., $\epsilon_t(a)\neq 0$ for some $a$), the amount of corruption counted towards $C=\sum_{t=1}^T |\epsilon_t(a_t)|$ is zero as long as $\epsilon_t(a_t)=0$. In other words, it is possible that $\epsilon_t(a)=0$ and $\epsilon_t(b)\neq 0$ for some arms $a,b$, which could simulate the AA strong adversary who decides NOT TO corrupt after observing $a_t=a$, but decides TO corrupt after observing $a_t=b$.
This might address the reviewer's concern, "*If $a_t$ is not known, the only option for the adversary is
to add corruption to each arm and hope the algorithm picks the arm that has
a high influence on the dimension it wants to corrupt.*" From the discussion above, we know that a CM adversary can simply do the following: set high corruption for the actions with high influence on the dimension, and set low/zero corruption for the actions with low influence on the dimension. Then, after $a_t$ is decided by the learner, the corruption level $|\epsilon_t(a_t)|$ will naturally adapt to the choice of $a_t$, i.e., the corruption will be high if $a_t$ has high influence on the dimension, and will be low/zero if $a_t$ has low influence on the dimension.
A mathematical conversion between the two viewpoints is as follows. Assume that the strategy of the AA strong adversary can be decribed as a function $\epsilon_t = f(h_{t-1}, a_t)$, where $h_{t-1}$ is the history up to time $t-1$ and $a_t$ is the chosen action at time $t$. Then in the CM viewpoint, the "corruption function" would be defined as $\epsilon_t(a) = f(h_{t-1}, a)$ for every $a$. Notice that the function $\epsilon_t(\cdot)$ depends only on the history up to time $t-1$.
**Regarding the second concern:**
If the corruption is always zero, our formulation (Line 74 - 79) is the same as the standard adversarial linear bandit setting formulated in Section 27 of Lattimore and Szepesvari (2020), where the linear reward vector $\theta_t$ changes over time. The only extension we make is that we consider additional reward corruption. We can refer to it as "adversarial linear bandits with corruption" to make things even clearer.
(Lattimore and Szepesvari, 2020) Bandit Algorithms.
**Regarding the third concern:**
Thanks for your suggestions. We will add the bound $\sqrt{dT \log k}$ to our Theorem 4.1. We will also discuss more about our bounds compared with previous works.