## 3 Materials and Methods
### Proposed Method  
The proposed data security training framework, based on symmetric projection spaces and adversarial training, consists of several interconnected modules: data input, the symmetric projection space extractor, adversarial training with a generator and discriminator,an autoencoder-based data generation module, and a projection loss function, as shown in Figure 2.  
These modules work together to achieve a balance between data privacy protection and model utility. The detailed construction and interactions of each module are described below. First, the preprocessed input data \(\mathbf{X}\in\mathbb{R}^{n\times d}\) are fed into the first module of the model--the symmetric projection space extractor. The primary task of this module is to map the high-dimensional data into a lower-dimensional latent space through a nonlinear transformation and obfuscate the input data to protect data privacy. The symmetric projection space extractor learns a mapping function \(f(\cdot)\) that maps the input data to a low-dimensional abstract space, producing a low-dimensional representation \(z\in\mathbb{R}^{n\times k}\), where \(k<d\). This low-dimensional representation retains the essential information of the input data. The processed data \(\mathbf{Z}\) are then passed into the adversarial training network framework. In this framework, the generator \(G\) is responsible for generating obfuscated data \(\mathbf{X}^{\prime}\) based on the low-dimensional representation \(\mathbf{Z}\) while maintaining data privacy. The generated data \(\mathbf{X}^{\prime}\) are encrypted to ensure that it is difficult to reverse-engineer into the original sensitive data. Meanwhile, the discriminator \(D\) is tasked with distinguishing between real data and generated data, determining whether the data come from the real data distribution. The generator and discriminator optimize each other through adversarial learning: the generator continuously improves the privacy of the generated data, while the discriminator increases its ability to differentiate between real and generated data. The optimization goal of adversarial training is to minimize the discriminator's ability to distinguish between real and generated data while maximizing its discriminatory power. Furthermore, an autoencoder-based data generation module is introduced to further enhance privacy protection accuracy. In this module, the input data \(\mathbf{X}\) are mapped into the latent space by an encoder to obtain the latent representation \(\mathbf{H}\), which are then decoded back into data \(\mathbf{X}^{\prime}\) by the decoder. This process obfuscates the data during encoding and decoding, effectively separating sensitive and nonsensitive information and generating a privacy-preserving representation of the data. Unlike traditional noise addition methods, the autoencoder module improves privacy protection and training efficiency by optimizing the network weights. Finally, a projection loss function is employed to optimize the balance between data obfuscation and model utility. It consists of two components: reconstruction error and privacy loss. The reconstruction error measures the similarity between the generated data \(\mathbf{X}^{\prime}\) and the original data \(\mathbf{X}\), while the privacy loss evaluates the effectiveness of data privacy protection based on the output of the discriminator.