SlowGuess/NAACL_2022_OCR huggingface dataset:
when  $k \leq 50$ . When  $k$  is larger than 500, the defense degrades rapidly as  $k$  increases. This result implies that the ground truth personas mostly lie in the top 2,000 predictions even if the defense is applied. For a smaller  $k$ , our proposed defense learning strategies are still effective.