Thus, to limit the number of different inputs to the classifier, we wish to reduce the number of distinct word recognition outputs that an attacker can induce, not just the number of words on which the model is “fooled”. We denote this property of a model as its sensitivity. 
 Question: What does the "sensitivity" quantity denote?
the number of distinct word recognition outputs that an attacker can induce