I'm interested in that claim as well, though maybe not so overtly hostile to the research. My first thought was certainly that, at the very least, an adversary

I'm interested in that claim as well, though maybe not so overtly hostile to the research. My first thought was certainly that, at the very least, an adversary can perform image classification as well. I think this is an obvious limitation of how privacy-preserving is possible, and so maybe it's just taken that the reader should understand that. And BIG-IF the adversary can't do much more than that, it would still be appreciated.