• Reward: Reward in our problem is defined based on how successfully the agent obfuscated the private-attribute information against the attacker so far.
we defined the reward function at state s t+1 according to the confidence of private-attribute inference attacker C p k for private-attribute p k given the resultant text embedding at state s t+1 , i.e., v t+1 .