Fig. 3: Test performance with differential privacy (DP) training. | Nature Communications