The proof for Corollary 1 is provided in Appendix. ?.
We assume the best possible scenario for Crypto-Eve s.t.: 1) The induced probability of the codewords from coset 1 is as high as possible while the induced probability of the codewords from coset 2 is as low as possible(In [cohen2022partial] the induced probabilities of each of the codewords were equal since the probability of the messages was uniform.), and 2) the advantage Crypto-Eve has from Crypt^{\dag}_1 is as high as possible.
We start by bounding the maximum and minimum possible probabilities of the codewords in \mathcal{B}_1 and \mathcal{B}_2. We denote those probabilities by p_{max} and p_{min}. First, we consider j s.t. [j \mu, j (\mu + 1)] \in \mathcal{H}_V, i.e. the bits that are mapped to the symbol in column j were not padded by the uniform seed, and their entropy is lower bounded by 1 - \delta_n. The case for [j \mu, j (\mu + 1)] \in \mathcal{J}_V will be addressed later on.
For each column j, we recall the set of possible messages from symbols \{k_s+1,...,\ell\}, M_{k_w} \in \mathbb{F}_{2^\mu}^{k_w}. In each column j of the message matrix, the symbols are independent since they are obtained from independent source messages. Thus, we have
\begin{aligned}
p(M_{k_w} =m_{k_w}) &= \prod_{i=1}^{k_w}p(M_{k_w,i} = m_{k_w,i}) \\
&= \prod_{i=1}^{k_w} \prod_{j'=1}^{\mu} p(M_{k_w,i,j'} = m_{k_w,i,j'}).
\end{aligned}
From (?), we conclude that
\begin{aligned}
H(m_{k_w,i,j'}) \geq H\left(m_{k_w,i,j'}|m_{k_w,i,j'}^{j\mu + j'-1}\right) \geq 1 - \delta_n,
\end{aligned}
where m_{k_w,i,j'}^{j \mu +j'-1} = \left(m_{k_w,i,j'}(1),...,m_{k_w,i,j'}(j \mu +j'- 1)\right) are the bits in columns 1 to j-1 of the i-th row in the message matrix. We denote \zeta \in (0,\frac{1}{2}) s.t. H(\frac{1}{2} - \zeta) = H(\frac{1}{2} + \zeta) = 1 - \delta_n, and use \zeta to bound p_{min} and p_{max}
\begin{aligned}
p_{min} \triangleq \left(\frac{1}{2} - \zeta\right)^{\mu k_w} \leq p(\underline{m}_{k_w}) \leq \left(\frac{1}{2} + \zeta\right)^{\mu k_w} \triangleq p_{max}.
\end{aligned}
We bound \zeta using the binary entropy bounds given in [topsoe2001bounds], 4p(1-p) \leq H_b(p) \leq \left(4p(1-p)\right)^{\ln{4}} for 0 < p < 1. That is, by replacing p = \frac{1}{2} + \zeta we obtain the upper bound by
\begin{aligned}
H_b\left(\frac{1}{2} + \zeta\right) \leq \left(4\left(\frac{1}{2} + \zeta\right)\cdot \left(\frac{1}{2} - \zeta\right)\right)^{\frac{1}{\ln 4}},
\end{aligned}
and the lower bound by
\begin{aligned}
H_b\left(\frac{1}{2} + \zeta\right) \geq 4\left(\frac{1}{2} + \zeta\right)\left(\frac{1}{2} - \zeta\right).
\end{aligned}
From which, we conclude
\begin{aligned}
\frac{1}{2} + \zeta \leq \frac{1}{2} + \frac{1}{2}\cdot \sqrt{1 - (1 - \delta_n)^{\ln 4}},
\end{aligned}
and therefore, the upper bound for \zeta is given by
\begin{aligned}
\zeta \leq \frac{\sqrt{1 - (1 - \delta_n)^{\ln 4}}}{2}.
\end{aligned}
Now, we give the probability for some codeword from the set \mathcal{B}_1 \cup \mathcal{B}_2. We denote the codeword by \alpha \in \mathcal{B}_1 \cup \mathcal{B}_2 and we denote |\mathcal{B}_1| = |\mathcal{B}_2| = |\mathcal{B}| (see Corollary 1). The probability for \alpha is
\begin{aligned}
\mathbb{P}[\alpha | \alpha \in \mathcal{B}_1 \cup \mathcal{B}_2] =
\begin{cases}
\frac{p_{max}}{|\mathcal{B}| \cdot (p_{max} + p_{min})} & \text{if } \alpha \in \mathcal{B}_1 \\
\frac{p_{min}}{|\mathcal{B}| \cdot (p_{max} + p_{min})} & \text{if } \alpha \in \mathcal{B}_2
\end{cases}.
\end{aligned}
From (?), we conclude that the probability for a codeword \alpha to be from the set \mathcal{B}_1 is
\begin{aligned}
\mathbb{P}[\alpha \in \mathcal{B}_1 | \alpha \in \mathcal{B}_1 \cup \mathcal{B}_2] =
\frac{p_{max}}{p_{max} + p_{min}}.
\end{aligned}
Since Crypt_1^{\dag} is SS-CCA1, Crypto-Eve can obtain some negligible information about the original codeword or some function of the codeword. We consider the function f: \{\mathcal{B}_1 \cup \mathcal{B}_2\} \rightarrow \{1,2\}, i.e. the function that takes a codeword from the set \{\mathcal{B}_1 \cup \mathcal{B}_2\} and outputs whether it belongs to \mathcal{B}_1 or \mathcal{B}_2
\begin{aligned}
f(\alpha \in \{\mathcal{B}_1 \cup \mathcal{B}_2\}) =
\begin{cases}
1 & \text{if } \alpha \in \mathcal{B}_1\\
2 & \text{if } \alpha \in \mathcal{B}_2
\end{cases}.
\end{aligned}
From the definition of SS-CCA1, we conclude
\begin{aligned}
\mathbb{P}[M_{i^{*},1}] = \mathbb{P}[\alpha \in \mathcal{B}_1] + \epsilon_{ss-cca1},
\end{aligned}
where \epsilon_{ss-cca1} is a negligible function in c s.t. \epsilon_{ss-cca1} \leq \frac{1}{(\mu c)^{d}}. Thus, by substituting (?) into (?), we have
\begin{aligned}
\mathbb{P}[M_{i^{*},1}] - \frac{1}{2} &= \mathbb{P}[\alpha \in \mathcal{B}_1] + \epsilon_{ss-cca1} - \frac{1}{2} \\
&= \frac{p_{max} - p_{min}}{p_{max} + p_{min}} + \frac{1}{(\mu c)^{d}} .
\end{aligned}
We bound the term \frac{p_{max}-p_{min}}{p_{max}+p_{min}} from (?) by
\begin{aligned}
\frac{p_{max}-p_{min}}{p_{max}+p_{min}} &= \frac{(\frac{1}{2}+\zeta)^{\mu k_w}-(\frac{1}{2}-\zeta)^{\mu k_w}}{(\frac{1}{2}+\zeta)^{\mu k_w}+(\frac{1}{2}-\zeta)^{\mu k_w}} \\
& = \frac{\sum_{i=0}^{\mu k_w}\binom{\mu k_w}{i}(2\zeta)^i - \sum_{i=0}^{\mu k_w}\binom{\mu k_w}{i}(-2\zeta)^i}{\sum_{i=0}^{\mu k_w}\binom{\mu k_w}{i}(2\zeta)^i + \sum_{i=0}^{\mu k_w}\binom{\mu k_w}{i}(-2\zeta)^i} \\
& = \frac{2\sum_{i=0}^{\lfloor \frac{\mu k_w-1}{2} \rfloor}\binom{\mu k_w}{2i+1}(2\zeta)^{2i+1}}{2\sum_{i=0}^{\lfloor \frac{\mu k_w}{2} \rfloor}\binom{\mu k_w}{2i}(2\zeta)^{2i}} \\
& \overset{(a)}{<} 2\zeta \mu k_w \overset{(b)}{\leq} 2^{\frac{3}{2}}2^{\frac{-n^{\beta}}{2}}\mu k_w,
\end{aligned}
where (a) follows from the upper bound \frac{\sum_{i=0}^{\lfloor (\mu k_w-1) / 2 \rfloor}\binom{\mu k_w}{2i+1}(2\zeta)^{2i}}{\sum_{i=0}^{\lfloor \mu k_w / 2 \rfloor}\binom{\mu k_w}{2i}(2\zeta)^{2i}} < \mu k_w, which can be easily proved, and (b) is from (?).
By substituting (?) into (?), it can be shown that for every d' Crypto-Eve’s advantage can be made smaller than \frac{1}{(\mu c)^{d'}} by choosing an appropriate d. Thus, we showed that column j \in \mathcal{H}_V is ISS-CCA1.
For the case of a column j s.t. j \in \mathcal{J}_V, ISS-CCA1 follows directly from the SS-CCA1 of Crypt_1, considering Crypto-Eve has the maximal advantage in guessing the seed from its ciphertext. Thus, we can conclude the cryptosystem is IIND-CCA1 and thus ISS-CCA1 as well [goldwasser2019probabilistic].