The attacker's rates are lower than in Table 1, indicating the adversarial training is effective in removing some of the protected attribute.
table 3 summarizes the attacker's recovery rate on the adversarialy-trained encoders for the different settings.