### Table 1 Joint Distribution of the Outputs of S

1995

"... In PAGE 5: ... Thus for a uniform distribution of inputs, each output in a uniform distribution of outputs would occur 4 times. Table1 (at the end of the paper) is a table of the number of times each output of the pair S 1 ;;S 2 occurred with the common key bits (0;; 0). Obviously, this distribution of outputs is non- uniform, as is the distribution of any other pair of adjacentS-boxes with anyvalue for the common key bits, and it is this fact we exploit in the cryptanalysis.... In PAGE 6: ...S X;;Y (s;; t)=#fI;;J 2 Z 6 2 j I 5 J 1 = s;; I 6 J 2 = t;; S p (I)=X;; S q (J)=Y g ;; so Table1 isatableofS X;;Y (0;; 0) for S-boxes 1 and 2, and X X;;Y S X;;Y (s;; t)=2 10 : We can de ne two more functions for the outputs of each S-box, namely d X (i;; j) = #fI 2 Z 6 2 jI 5 = i;; I 6 = j;; S p (I)=Xg;; e Y (i;; j) = #fJ 2 Z 6 2 jJ 1 = i;; J 2 = j;; S q (J)=Y g;; so d X and e Y are the number of outputs over all possible inputs of the individual S-boxes given that certain inputs are xed. Eachrow of a DES S-box is a permutation, so wehave the following properties, X i d X (i;; j)= X j e Y (i;; j) = 2 for all X;; Y 2 Z 6 2 : We can give an expression for S X;;Y in terms of the functions de ned above S X;;Y (s;; t) = P i;;j d X (i;; t j)e Y (s i;; j) = d X (0;;t)e Y (s;; 0) + d X (1;;t)e Y (s 0 ;; 0) + d X (0;;t 0 )e Y (s;; 1) + d X (1;;t 0 )e Y (s 0 ;; 1) = d X (0;;t)e Y (s;; 0) + (2 ; d X (0;;t))e Y (s 0 ;; 0) + d X (0;;t 0 )(2 ; e Y (s;; 0)) + (2 ; d X (0;;t 0 ))(2 ; e Y (s 0 ;; 0)) = 4+(d X (0;;t) ; d X (0;;t 0 ))(e Y (s;; 0) ; e Y (s 0 ;; 0)) = 4+(;1) s t (d X (0;; 0) ; d X (0;; 1))(e Y (0;; 0) ; e Y (1;; 0)) = 4+(;1) s t d X e Y ;; where d X =(d X (0;; 0) ; d X (0;; 1)), e Y =(e Y (0;; 0) ; e Y (1;; 0)), and s 0 denotes s 1, t 0 denotes t 1.... In PAGE 22: ...We can therefore calculate the distribution of the output of a pair of S-boxes given the inputs to (and hence the outputs of) the S-boxes two rounds earlier. This corresponds to perturbing the values of S X;;Y ,asgiven for example in Table1 , by a small but unknown amount, with most values of S X;;Y for most S-box pairs almost exactly correct. In order to perform the cryptanalysis, wehave to calculate Sn X;;Y ,an n-fold convolution of S X;;Y with itself.... ..."

Cited by 15

### Table 1. Joint distribution parameters

2007

### Table 11: Joint distribution without transfers

2001

"... In PAGE 27: ...oor. There is considerable persistent poverty. What is the effect of transfers on poverty? To answer this question, it is necessary to simulate the counterfactual joint distribution without transfers; as in the static incidence calculations, this is done by subtracting half the transfers received in each respective year from consumption in that year. The simulated joint distribution is given in Table11 . Transfers are found to have negligible impact on poverty.... ..."

Cited by 2

### Table 2. Joint Distribution of A and B

"... In PAGE 5: ...The weighted row and column averages shown in Table 1 are functions of weights derived from the joint distribution for A and B, which is shown in Table2 . Here, Pr( , ) ij i j pAaBb ===.... ..."

### Table 1: An example of joint distribution of two labels.

2005

"... In PAGE 3: ... (9) The following example shows why combining single-labelled classifiers does not always produce correct results for the multi- labelled classification problem when the categories are not inde- pendent. Assume that the joint distribution Pr(y1, y2|x) for some data point x is shown in Table1 . Further assume that we trained... In PAGE 4: ... Similarly, data x is assigned to the second category y2 = 1 as well. However, accord- ing to Table1 , Pr(y1 = 1, y2 = 1|x) = 0.3, which is less than Pr(y1 = 1, y2 = 0|x) = 0.... ..."

Cited by 4

### Table 15: The joint distribution of the actual and estimated robustness

1998

"... In PAGE 22: ...75, then it is predicted to become inconsistent after 123 transactions. From Table15 , this threshold produces a recall of 92.7 (= 89 / 96) percent and a precision of 28.... ..."

Cited by 8

### Table 5: Profit and Patent Joint Distributions

1998

### Table 1: Joint Probability Distribution

"... In PAGE 4: ... Probabilistic/Statistical Reasoning: Many forms of information are inherently probabilistic | eg, given certain symptoms, we may be 80% con dent the patient has hepatitis, or given some evidence, we may be 10% sure a speci c stock will go up in price. One possible downside of dealing with probabilities is the amount of information that has to be encoded: in general one may have to express the entire joint distribution, which is exponential in the number of features; see Table1 . For many years, this observation motivated researchers to seek ways to avoid dealing with probabilities.... In PAGE 4: ... To make this concrete, consider the claims that Hepatitis \causes quot; Jaundice and also \causes quot; a Bloodtest to be positive, in that the chance of these symptoms will increase if the patient has hepatitis. We can represent this information using the full joint over these three binary variables (see Table1 for realistic, if fabricated, numbers), then use this information to compute, for example, P( H j :B ) | the posterior probability that a patient has hepatitis, given that he has a negative blood test. The associated computation, P( H j :B ) = P( H; :B ) P( :B ) = PX62fH;Bg Px2X P( H; :B; X = x ) PX62fBg Px2X P( :B; X = x ) involves the standard steps of marginalization (the summations shown above) to deal with unspec- i ed values of various symptoms, and conditionalization (the division) to compute the conditional probability; see [Fel66].... In PAGE 5: ... While the saving here is relatively small (2 links rather than 3, and a total of 5 parameters, rather than 7), the savings can be very signi cant for larger networks. As a real-world example, the complete joint distribution for the Alarm belief net [BSCC89], which has 37 nodes and 47 arcs, would require approximately 1017 parameters in the naive tabular representation | a la Table1 . The actual belief net, however, only includes 752 parameters.... In PAGE 6: ... There are many obvious connections between the logic-based and probability-based formalisms. For example, we can view the possible worlds (as shown in Table 2) as a \qualitative quot; version of the atomic events (see Table1 ), with the understanding that each \impossible quot; world has probability 0 of occuring, and the other possible words have non-0 probability. Many, including Nilsson [Nil86], have provided formalisms that attempt link these areas.... ..."

Cited by 3

### Table 1 Joint Distribution of the Outputs of S1; S2

"... In PAGE 5: ... Thus for a uniform distribution of inputs, each output in a uniform distribution of outputs would occur 4 times. Table1 (at the end of the paper) is a table of the number of times each output of the pair S1; S2 occurred with the common key bits (0; 0). Obviously, this distribution of outputs is non- uniform, as is the distribution of any other pair of adjacent S-boxes with any value for the common key bits, and it is this fact we exploit in the cryptanalysis.... In PAGE 6: ...SX;Y (s; t) = # fI; J 2 Z6 2 j I5 J1 = s; I6 J2 = t; Sp(I) = X; Sq(J) = Y g ; so Table1 is a table of SX;Y (0; 0) for S-boxes 1 and 2, and X X;Y SX;Y (s; t) = 210 : We can de ne two more functions for the outputs of each S-box, namely dX(i; j) = #fI 2 Z6 2jI5 = i; I6 = j; Sp(I) = Xg; eY (i; j) = #fJ 2 Z6 2jJ1 = i; J2 = j; Sq(J) = Y g; so dX and eY are the number of outputs over all possible inputs of the individual S-boxes given that certain inputs are xed. Each row of a DES S-box is a permutation, so we have the following properties, Xi dX(i; j) = Xj eY (i; j) = 2 for all X; Y 2 Z6 2: We can give an expression for SX;Y in terms of the functions de ned above SX;Y (s; t) = Pi;j dX(i; t j)eY (s i; j) = dX(0; t)eY (s; 0) + dX(1; t)eY (s0; 0) + dX(0; t0)eY (s; 1) + dX(1; t0)eY (s0; 1) = dX(0; t)eY (s; 0) + (2 ? dX(0; t))eY (s0; 0) + dX(0; t0)(2 ? eY (s; 0)) + (2 ? dX(0; t0))(2 ? eY (s0; 0)) = 4 + (dX(0; t) ? dX(0; t0))(eY (s; 0) ? eY (s0; 0)) = 4 + (?1)s t(dX(0; 0) ? dX(0; 1))(eY (0; 0) ? eY (1; 0)) = 4 + (?1)s tdXeY ; where dX = (dX(0; 0) ? dX(0; 1)), eY = (eY (0; 0) ? eY (1; 0)), and s0 denotes s 1, t0 denotes t 1.... In PAGE 22: ... We can therefore calculate the distribution of the output of a pair of S-boxes given the inputs to (and hence the outputs of) the S-boxes two rounds earlier. This corresponds to perturbing the values of SX;Y , as given for example in Table1 , by a small but unknown amount, with most values of SX;Y for most S-box pairs almost exactly correct. In order to perform the cryptanalysis, we have to calculate SnX;Y , an n-fold convolution of SX;Y with itself.... ..."