## 2 Related Work
### Adversarial Learning  
Adversarial learning has emerged as a key research direction in machine learning in recent years, with its core idea rooted in game theory. It involves two competing models (the generator and the discriminator) that jointly achieve data distribution fitting and privacy protection [28; 29; 30]. The most representative method in adversarial learning is GANs, where the generator creates samples that closely resemble the real data distribution, while the discriminator distinguishes between generated samples and real samples, ultimately leading to a mutual improvement of both the generator and the discriminator [31]. The principles of adversarial learning can be expressed in the following mathematical formulations. Let the real data distribution be denoted as \(p_{\text{real}}(\mathbf{X})\). The objective of the generator \(G\) is to sample from the noise distribution \(p_{z}(\mathbf{z})\) and generate samples \(\mathbf{X}^{\prime}\) that approximate the real data distribution as closely as possible:  
\[\mathbf{X}^{\prime}=G(\mathbf{z};\theta_{G}), \tag{2}\]  
where \(\mathbf{z}\) is the random noise input to the generator and \(\theta_{G}\) represents the parameters of the generator. Simultaneously, the goal of the discriminator \(D\) is to distinguish between real and generated data. Its input is a data sample \(\mathbf{X}\) or generated data \(\mathbf{X}^{\prime}\), and the output is the classification probability, defined as:\[D(\mathbf{X};\theta_{D})\in[0,1], \tag{3}\]  
where \(\theta_{D}\) represents the parameters of the discriminator. A value of \(D(\mathbf{X})\) close to 1 indicates that the data originate from the real distribution, while a value close to 0 indicates that the data come from the generator. To address potential mathematical inconsistencies when \(D(\mathbf{X})=0\) or \(D(\mathbf{X})=1\), we introduce a small positive constant \(\epsilon\) (e.g., \(\epsilon=10^{-8}\)) to ensure numerical stability. Specifically, the range of \(D(\mathbf{X})\) is constrained to \((\epsilon,1-\epsilon)\) by applying the transformation \(D(\mathbf{X})=\max(\min(D(\mathbf{X}),1-\epsilon),\epsilon)\). The revised adversarial objective function is expressed as:  
\[\min_{G}\max_{D}\mathcal{L}\mathrm{GAN}=\mathbb{E}\mathbf{X}\sim p_{\mathrm{ real}}[\log D(\mathbf{X})]+\mathbb{E}\mathbf{z}\sim p\mathbb{z}[\log(1-D(G( \mathbf{z}))+\epsilon)], \tag{4}\]  
where \(\mathcal{L}_{\mathrm{GAN}}\) represents the adversarial loss function for GANs. This adjustment ensures that logarithmic operations remain defined under all circumstances and improves the stability of the optimization process. Through this optimization, the discriminator aims to maximize its ability to differentiate between real and generated data, while the generator seeks to minimize the discriminator's ability to distinguish between the generated data and real data. In privacy-preserving scenarios, adversarial learning has been extended to generate obfuscated low-dimensional representations that make the generated data difficult to reverse into the original sensitive information while retaining the key information necessary for model training [32; 33; 34]. The incorporation of numerical stability measures in the discriminator and generator loss functions further enhances the robustness of adversarial learning frameworks in privacy-sensitive applications.