Also, we would like to evaluate whether the attacker's task is easier when the variables to predict are explicitly in the input, compared to when these information are only potentially and implicitly in the input.
this setting simulates the case where private in-formation may be used by the model to improve classification, but should not be exposed too obviously.