Using the adversarially learned representation, de-identification models reach an F 1 score of 97.4%, which is close to the non-private system (97.67%).
the representation allows training a de-identification model while being robust to adversaries trying to re-identify protected information or building a lookup table of representations.