22456f4b545572855c766df5eefc9832-Supplemental.pdf

We list the best hyperparameter configurations for our methods in each dataset. In Tables 11 to 16, we list all results. The reason why we include the sub-optimal versions ofIT-GANis that one can easily decrease the attack success score by selecting sub-optimal models (and thereby, potentially sacrificing the synthesis quality). As shown in Table 23,IT-GAN(L)shows the lowest attack success scores overall. Wealso compare with various sub-optimal versions ofIT-GAN.While trainingIT-GAN,wecould obtain several sub-optimal versions around the epoch where we obtainIT-GAN and call them as IT-GAN(Sk)withk {1,2,3}.