However, they only use a single adversary to alter the training of the main model and to evaluate the privacy of the representations, with the risk of overestimating privacy.
once the parameters of our main model are fixed, we train a new classifier from scratch to evaluate privacy.