Research map / Adversarial robustness and security / Certified and empirical robustness
On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Studies adversarial attacks and adversarial training against group fairness (DP, EOd) alongside accuracy, proposing fair adversarial training that combines accuracy-adversarial training with fairness constraints.
Problem
Group fairness predictions are not robust to imperceptible feature perturbations: a fair model can show large group disparities under small input perturbations, and adversarial attacks/training have not been properly studied for fairness.
Approach
A unified PGD-based fairness attack framework covering DP and EOd, theoretical connections between fairness attacks and accuracy attacks (same vs. opposite directions per subgroup), and a bound showing fairness robustness and accuracy robustness benefit each other, motivating fair adversarial training that adds fairness constraints to adversarial accuracy training.
Key results
- On Adult, normal training shows sharp DP and EOd increases under fairness attack, while accuracy-adversarial training improves fairness robustness and fair adversarial training gives further remarkable gains (Fig. 2).
- Ablation on CelebA shows vanilla adversarial training with fairness or accuracy adversarial samples alone fails to maintain fairness robustness under larger perturbations, while the proposed framework improves it.
- Table 1 on Adult: under an attack with epsilon 0.3, accuracy drops from 84.25% to 15.13% and EOd drops from 28.45% to 0, showing fairness and accuracy attacks are not aligned.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use fair adversarial training combining accuracy adversarial samples with fairness regularization | Fair adversarial training · Adult | DP and EOd under fairness attack | Helped |
| Use accuracy adversarial training | Classifier · Adult | DP and EOd under fairness attack | Helped |
| Use fairness adversarial training with relaxed DP | Classifier · Adult | accuracy under accuracy attack | Helped |
| Use fairness adversarial samples alone without fairness regularization (ablation) | Adversarial training · CelebA | fairness robustness under larger fairness perturbations | Hurt |
| Use accuracy adversarial samples alone without fairness regularization (ablation) | Adversarial training · CelebA | fairness robustness under larger fairness perturbations | Hurt |
Surprising findings
- A successful fairness attack does not necessarily reduce fairness and a successful accuracy attack can drive EOd to zero, so accuracy attacks do not approximate worst-case fairness perturbations.
- Adversarial training with respect to accuracy improves fairness robustness, and fairness-targeted adversarial training improves accuracy robustness.
Limitations
- Theoretical bounds rely on strong assumptions such as Lipschitz gradients and uniformly bounded soft-label distributions.
- Perturbation levels are chosen empirically per dataset to ensure convergence.
- Evaluation is limited to small MLPs and ResNet-18 on four benchmark datasets.
Experimental setup
Datasets: Adult COMPAS German CelebA
Benchmarks: Adult COMPAS German CelebA
Metrics: accuracy demographic parity equalized odds
Baselines: Baseline (normal training) Preprocessing (Yu et al., 2024) In-processing (Wang et al., 2022) Post-processing (Jang et al., 2022) Adversarial training (accuracy) Adversarial training (fairness)
Builds on: PGD attack adversarial training (Madry et al.) Wang et al. 2022 in-processing fairness Yu et al. 2024 preprocessing fairness Jang et al. 2022 post-processing fairness
Closest papers by meaning
- DAFA: Distance-Aware Fair Adversarial Training (ICLR 2024 · similarity 0.92)
- On the Fairness ROAD: Robust Optimization for Adversarial Debiasing (ICLR 2024 · similarity 0.91)
- Towards Fairness-Aware Adversarial Learning (CVPR 2024 · similarity 0.91)
- Can Private Machine Learning Be Fair? (AAAI 2025 · similarity 0.90)
- Causal Adversarial Perturbations for Individual Fairness and Robustness in Heterogeneous Data Spaces (AAAI 2024 · similarity 0.90)
- Improving Adversarial Robust Fairness via Anti-Bias Soft Label Distillation (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.