Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 3: Weak Reject
review_content: This paper proposes to use a GAN style approach for training a classifier that is robust to data poisoning and can achieve a pre-specified notion of group fairness.

The contribution of this paper is incremental in the context of prior Adversarial Debasing (AD) approach using essentially same GAN for group fairness and prior work presenting ideas of utilizing clean validation data to defend against data poisoning. This paper is proposing to add an additional discriminator to the AD approach that distinguishes training data and clean validation data. If the training data is poisoned, such distinguishment may be possible and maximizing loss of this discriminator can help to robustify against poisoned samples.

Experimental results are insufficient to argue improvement over the AD. There are no AD results in the equalized odds Adult experiment in the supplement. I recommend more detailed comparison against the AD method (including results showing confusion matrices). Also note that AD, as presented in the original paper, is optimizing for demographic parity, but can also be adjusted to other group fairness metrics. Finally, in the context of Adult dataset, it is important to also report performance metrics such as balanced TPR since the labels are quite imbalanced.

Are there any real data examples where poisoning does not need to be introduced artificially and the proposed method helps to improve the fairness properties? I think an interesting direction could be to consider data where labels are subjective. For example, a dataset on loan decisions can be naturally "poisoned" with human biases, i.e. information that someone did not receive the loan may be due to an error or bias of a human in charge of the decision making.

Lastly I think that the discussion of the prior related work on fairness is incomplete. This paper exclusively covers group fairness, which indeed has been shown to have some disadvantages. For example, prior work [1] has shown that some group fairness notions can not be satisfied simultaneously in certain cases. In this regard it is also important to report multiple group fairness metrics simultaneously in the experiments. The other fairness definition, that has not been mentioned in this paper, is individual fairness [2]. It has legal and intuitive interpretations. Multiple recent papers have explored the direction of individual fairness [3,4,5,6].

[1] Kleinberg, J., Mullainathan, S., & Raghavan, M. (2016). Inherent trade-offs in the fair determination of risk scores.
[2] Dwork, C., Hardt, M., Pitassi, T., Reingold, O., & Zemel, R. (2012, January). Fairness through awareness.
[3] Garg, S., Perot, V., Limtiaco, N., Taly, A., Chi, E. H., & Beutel, A. (2019, January). Counterfactual fairness in text classification through robustness.
[4] Yurochkin, M., Bower, A., & Sun, Y. (2019). Learning fair predictors with Sensitive Subspace Robustness.
[5] Kearns, M., Roth, A., & Sharifi-Malvajerdi, S. (2019). Average Individual Fairness: Algorithms, Generalization and Experiments.
[6] Jung, C., Kearns, M., Neel, S., Roth, A., Stapleton, L., & Wu, Z. S. (2019). Eliciting and Enforcing Subjective Individual Fairness.
review_title: Official Blind Review #1

final_score: rating: 3: Weak Reject
review_content: This paper combines adversarial fair training with adversarial robust training. The basic idea is that a classifier is combined with two adversaries: one tries to predict the sensitive attribute $Z$ from the output of the classifier (essentially the approach by Edwards&Storkey 2015) and the other adversary tries to recognize if a label was predicted or is from a clean hold-out dataset. The latter is intended to harden the classifier against data-poisoning of the training set.

---

The paper is clearly written and technically sound.

The fairness aspect of the proposed method is fairly standard and not very novel (going back to 2015). The robustness aspect is an interesting addition and seems novel, but I'm not sure if it's enough to get the paper accepted. If I understand it correctly, FR-GAN without the "R" part should just be equivalent to Adversarial Debiasing (Zhang et al., 2018). And if there is no data-poisoning, then the "R" part doesn't have any effect.

The fact that this is the first fairness-related method that additionally deals with robustness, makes it also difficult to judge the performance of the method. I would wish for a more appropriate baseline; one that makes use of the clean validation set somehow.

There might be synergistic effects where the robustness aspects helps the fairness aspect but this comes at the cost of needing a clean validation set (and it only matters with poisoned data).

What is also missing is a motivating real-world example. When would you encounter flipped labels in the training set, but also have access to a clean validation set?

Minor comments:

- I did not understand what was meant by the phrase "so that the model accuracy is reduced the most." in the first paragraph of section 3
review_title: Official Blind Review #2

final_score: rating: 3: Weak Reject
review_content: This paper introduces a new method for training a classifier that simultaneously optimizes for a fairness criterion and robustness to data poisoning. The method is shown to increase measures of fairness and reduce inaccuracy on poisoned data relative to classifiers that only consider accuracy or fairness. Extensive results are shown for both synthetic and real benchmark data sets.

I would lean to reject for the following reasons: 1) the problem is not well-motivated. I would like a more clear example of some problem with sensitive attributes in which the data is publicly available and the providers of the data are motivated to falsify it. 2) the contribution is very simple and the individual pieces do not seem to be significant contributions. In particular, the use of GANs for fairness is previously done, and the use of the GAN for robustness here seems too simple to be broadly useful 3) the results are less convincing than they might otherwise be because none of the competing methods tested make use of a clean validation set 4) the paper is somewhat unpolished. I find the results difficult to read, although the arrows are helpful, and it is not clear to me whether these results are on a test set or the training set.

Lack of convincing tests for robustness: It is disappointing that FR-GAN does not offer any promises to be robust in general. Despite access to a clean validation set, the classifier is trained only to ignore the type of data poisoning that exists in the training set. If the test set were out of distribution in a different way relative to the training set, I see no reason to believe FR-GAN would protect against this. Furthermore, because it is not stated that these are test set results, I am not certain that they are not training set results, in which case some performance may be due to overfitting.

Minor notes:

It would be nice for comparison if the charts had the same axes throughout.

What are the numbers of nodes used in the hidden layers?
review_title: Official Blind Review #3

Meta-review: This manuscript proposes an approach for fair and robust training of predictive modeling -- both of which are implemented using adversarial methods, i.e., an adversarial loss for fairness and an adversarial loss for robustness. The resulting model is evaluated empirically and shown to improve fairness and robustness performance.

The reviewers and AC agree that the problem studied is timely and interesting, as there is limited work on joint fairness and robustness. However, the reviewers were unconvinced about the novelty and clarity of the conceptual and empirical results. In reviews and discussion, the reviewers also noted insufficient motivation for the approach. 
Decision: Reject