\begin{figure}[t]
\centering
\resizebox{.68\textwidth}{!}{%
\begin{tikzpicture}

    \node [rectangle,draw,thick,minimum width=1.5cm, minimum height=0.75cm] (targetmodel) {$\targetmodel$};
    
    \node[below of=targetmodel,yshift=-0.3cm,database,database radius=0.4cm,database segment height=0.2cm, label={below:\footnotesize $\traindata: (X, Y)$}] (trainingdata) {};

    \node [left of=targetmodel,minimum width=0.75cm,xshift=-0.8cm,fill=red!20,rectangle,draw,thick,label={below:\footnotesize Input}] (inputrecord) {$X'(\omega)$};
    \node [right of=targetmodel,xshift=1.5cm,rectangle,draw,thick] (outputpred) {$\targetmodel(X'(\omega))$};
    % \node [below of=outputpred,minimum width=1.5cm,rectangle,draw,thick] (explanation) {$\phi(x)$};

    \begin{scope}[on background layer]
        \node (tm1) [fit=(targetmodel) (trainingdata), fill= gray!20, rounded corners, inner sep=0.1cm, label={above:\footnotesize }] {};
    \end{scope}

    \node [right of=outputpred,rectangle,draw,thick,minimum width=1.5cm, minimum height=0.75cm,xshift=1.2cm,fill= gray!20] (attmodel) {$\attackmodel$};

    \node [right of=attmodel,xshift=0.6cm,minimum width=0.75cm,rectangle,draw,thick] (attout) {$S(\omega)$};

    \node[below of=attmodel,database,database radius=0.4cm,database segment height=0.2cm,yshift=-0.3cm, label={below:\footnotesize $\auxdata: (X', Y', S')$}] (auxdata) {};

\begin{scope}[on background layer]
    \node (models) [fit=(attmodel) (outputpred) (attout) (auxdata), fill= red!20, rounded corners, inner sep=0.1cm] {};
\end{scope}


\draw[->,ultra thick] (inputrecord.east) -- node[anchor=south, align=center] {\em\footnotesize } (targetmodel.west);
\draw[->,ultra thick] (targetmodel.east) -- node[anchor=south, align=center] {\em\footnotesize } (outputpred.west);
% \draw[->,ultra thick] (targetmodel.east) -- node[anchor=south, align=center] {\em\footnotesize } (explanation.west);


\draw[->,ultra thick, dashed] (outputpred.east) -- node[anchor=south, align=center] {\em\footnotesize } (attmodel.west);
% \draw[->,ultra thick, dashed] (explanation.east) -- node[anchor=south, align=center] {\em\footnotesize } (attmodel.west);
\draw[->,ultra thick] (attmodel.east) -- node[anchor=south, align=center] {\em\footnotesize } (attout.west);
\draw[->,ultra thick,dashed] (trainingdata.north) -- node[anchor=south, align=center,label={[yshift=-0.2cm]right:\footnotesize Train}] {\em\footnotesize } (targetmodel.south);
\draw[->,ultra thick,dashed] (auxdata.north) -- node[anchor=south, align=center,label={[yshift=-0.2cm]right:\footnotesize Train}] {\em\footnotesize } (attmodel.south);


\end{tikzpicture}
}
\vspace{-1mm}
\caption{\adv wants to infer sensitive attributes for an input given its prediction. \adv trains $\attackmodel$ on $\auxdata$ to map $\targetmodel(X'(\omega))$ to $S'(\omega)$. Once trained, \adv only uses $\targetmodel$'s outputs as input to $\attackmodel$ to infer sensitive attributes. \colorbox{red!20}{red} indicates accessible by \adv.} 
\vspace{-1mm}
\label{fig:tm2}
\end{figure}