Research map / Federated learning and privacy / Privacy attacks and secure learning
Disparate Impact on Group Accuracy of Linearization for Private Inference
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that ReLU linearization for private inference disproportionately hurts accuracy of minority groups, gives a bound-based explanation via gradient norms and decision-boundary distance, and proposes a Lagrangian fairness regularizer during KD finetuning.
Problem
ReLU linearization used to speed up private inference (cryptographic secure inference) can cause uneven accuracy losses across demographic subgroups, particularly underrepresented ones, creating fairness costs that prior evaluations on balanced data missed.
Approach
Identifies a Matthew effect of ReLU linearization on group accuracy, explains it with a Taylor-expansion bound involving group gradient norms and Hessian eigenvalues (linked to distance to decision boundary), and mitigates it by adding group-vs-population loss-gap Lagrangian constraints to the knowledge-distillation finetuning of SNL and DR.
Key results
- On UTKFace race with SNL on ResNet-34, the 'other' race group suffers almost a 5-fold accuracy drop while white individuals are almost unaffected.
- With DR on ResNet-18, the 'other' group suffers almost a 10-fold relative accuracy drop, near 100% for the lowest ReLU budget.
- The proposed Lagrangian fairness mitigation consistently improves minority-group accuracy across linearization levels with minimal harm to majority groups, especially for DR at high linearization.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace half of the ReLU activations with linear activations | Illustrative classification task model · Illustrative classification task | global accuracy: 99.3% -> 99.0% | Hurt |
| Replace half of the ReLU activations with linear activations | Illustrative classification task model · Illustrative classification task, minority class | accuracy: 93.0% -> 88.0% | Hurt |
| Linearize more ReLU activations | SNL and DR linearized models · Unbalanced datasets, including UTKFace, SVHN, and CIFAR-10 | group accuracy | Mixed |
| Use fairness-regularized fine-tuning instead of standard fine-tuning | SNL and DR linearized models · UTKFace age and race groups | group accuracy | Helped |
| Vary the mitigation multiplier μ among 0.0005, 0.005, and 0.01 (ablation) | SNL mitigation on ResNet18 · UTKFace race | performance of mitigation strategy | No clear effect |
Surprising findings
- Reducing ReLUs disproportionately harms minority groups even when global accuracy is nearly unchanged (e.g., 99.0% global vs 88.0% minority vs 93.0% for ReLU model in a toy example).
Limitations
- Theoretical bound is restricted to strictly convex univariate functions and does not establish a formal relation between ReLU rate and group accuracy drop.
- Mitigation requires access to protected group labels.
- Attempts to reproduce SENet results failed due to missing linearization code.
Experimental setup
Datasets: UTKFace SVHN CIFAR-10 CelebA
Benchmarks: UTKFace SVHN CIFAR-10
Metrics: relative test accuracy drop per group global test accuracy gradient norm Hessian max eigenvalue distance to decision boundary
Baselines: SNL DR
Builds on: SNL (selective network linearization) Degree-reduced ReLU linearization (DR) DP-SGD fairness analysis knowledge distillation
Closest papers by meaning
- Selective Network Linearization for Efficient Private Inference (ICML 2022 · similarity 0.88)
- Assessing Per-Sample Membership Inference Vulnerability without Retraining (NeurIPS 2026 · similarity 0.85)
- Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy (NeurIPS 2026 · similarity 0.85)
- FairProof : Confidential and Certifiable Fairness for Neural Networks (ICML 2024 · similarity 0.84)
- Towards a Unified and Verified Understanding of Group-Operation Networks (ICLR 2025 · similarity 0.84)
- Mitigating Privacy Risk in Membership Inference by Convex-Concave Loss (ICML 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.