To Reviewer # 1 attack suffices to detect some useful information of the training dataset and can validate the relationship between the

We thank all reviewers for their valuable comments. In what follows, we will respond to their concerns one by one. The author should evaluate different attack methods and show the experimental results. Here we refer to the attack used in our paper as the threshold attack. Actually, we have also shown the results of other attacks (i.e.