## 3 Materials and Methods
### Proposed Method
#### 3.3.1 Adversarial Training Network Framework  
The proposed adversarial training network framework utilizes a game-theoretic mechanism between a generator and a discriminator, aiming to ensure that the generated data not only has high privacy but also maintains distribution consistency with the original  
Figure 2: Flowchart of proposed method. data, as shown in Figure 3. This framework is an improvement over the traditional GAN structure, adapted to meet the requirements of data privacy protection tasks. Through the optimization of both the generator and the discriminator, the adversarial training framework enables the balance between privacy protection and data utility, thereby maximizing the privacy protection capability of the model while maintaining the effectiveness of the training data. In this framework, both the generator and the discriminator are structured as deep neural networks. The generator \(G\) is tasked with generating obfuscated training data \(\mathbf{X}^{\prime}\) based on the low-dimensional representation \(z\) (obtained through the symmetric projection space extractor). The structure of the generator \(G\) consists of several fully connected layers, combined with activation functions (such as ReLU or LeakyReLU) to introduce nonlinearity and enhance its representational power. The input to the generator is the low-dimensional representation \(z\in\mathbb{R}^{n\times k}\), where \(k\) is the dimension of the latent space, typically set to a value smaller than the input data dimension \(d\) (i.e., \(k<d\)). The output of the generator is the generated data \(\mathbf{X}^{\prime}\in\mathbb{R}^{n\times d}\), which shares the same dimensionality as the original data \(\mathbf{X}\). The network structure of the generator generally includes several fully connected layers, batch normalization layers, and an output layer. The goal of the generator is to learn the optimal parameters \(\theta_{G}\) so that the generated data closely match the distribution of the real data \(\mathbf{X}\) while ensuring sufficient privacy protection. The discriminator \(D\) is responsible for classifying the input samples (real data \(\mathbf{X}\) or generated data \(\mathbf{X}^{\prime}\)) to determine whether they come from the real data distribution. The discriminator is typically modeled using CNN or FCN, where the structure consists of several convolutional layers or fully connected layers, followed by activation functions to produce an output probability representing the likelihood that the input data come from the real data distribution. The output of the discriminator is \(D(\mathbf{X};\theta_{D})\in[0,1]\), where \(D(\mathbf{X})\) close to 1 indicates that the data come from the real distribution, and close to 0 indicates that the data are generated. The goal of the discriminator is to maximize its ability to distinguish between real data and generated data. The entire adversarial training process achieves a game-theoretic balance by optimizing the objective functions of the generator \(G\) and the discriminator \(D\). Meanwhile, the discriminator \(D\) optimizes by maximizing its ability to distinguish between real data and generated data. Through adversarial training, the generator continuously improves the privacy of the generated data, while the discriminator improves its ability to differentiate between real and generated data. In privacy protection tasks, the game between the generator \(G\) and the discriminator \(D\) is not only aimed at generating more realistic data but also ensuring that the generated data effectively protect privacy. Specifically, the generator decodes the low-dimensional representation \(z\) to generate data  
Figure 3: Architecture of adversarial training network framework. \(\mathbf{X}^{\prime}\) with privacy-preserving features, while the discriminator performs classification tasks to determine whether the generated data exhibit sufficient privacy.