Differential privacy methods are unable to protect the user privacy of h under adversarial attacks, as described in Section 1.
we consider how to learn an unbiased representations of the data with respect to specific attributes which we expect to behave as confounds in a generalisation setting.