• As an upper bound, we trained a classifier that can optimize the hidden representations (r) for the attacker's tasks.
this baseline is trained to predict de-  mographic variables from x, as if it were the main task.