However, since the attacker has access to the representation function r parameterized by θ r , they can generate a dataset from any corpus containing the private variables they want to recover.
it is not necessary that they have access to the original training corpus to train their classifier.