For values of N up to 1 000, our FastText and GloVe models are able to learn representations that allow training de-identification models that reach or exceed the target F 1 score of 95%.
training becomes unstable for N > 500: at this point, the adversary is able to break the representation privacy when trained for an additional 50 epochs (Fig.