Attack accuracy on probe groups. In addition to the original Alice set, we have the adjusted set where the feature values are adjusted by subtracting the mean BLEU difference between Alice and Bob models.