# Exposing the Illusion of Fairness: Auditing Vulnerabilities to Distributional Manipulation Attacks

Valentin Lafargue, Adriana Laurindo Monteiro, Emmanuelle Claeys, Laurent Risser, Jean-Michel Loubes

► To cite this version:

Valentin Lafargue, Adriana Laurindo Monteiro, Emmanuelle Claeys, Laurent Risser, Jean-Michel Loubes. Exposing the Illusion of Fairness: Auditing Vulnerabilities to Distributional Manipulation Attacks. 2025. hal-05374858

HAL Id: hal-05374858

https://ut3-toulouseinp.hal.science/hal-05374858v1

Preprint submitted on 20 Nov 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Exposing the Illusion of Fairness: Auditing Vulnerabilities to Distributional Manipulation Attacks

Valentin Lafargue<sup>1,2,3</sup>, Adriana Laurindo Monteiro<sup>4</sup>,
Emmanuelle Claeys<sup>5</sup>, Laurent Risser<sup>1,3</sup>, Jean-Michel Loubes<sup>2,3</sup>

<sup>1</sup> Institut de Mathématiques de Toulouse, France

<sup>2</sup> Institut national de recherche en sciences et technologies du numérique, France

<sup>3</sup> Artificial and Natural Intelligence Toulouse Institute 2, France

<sup>4</sup> Instituto Nacional de Matemática Pura e Aplicada, Brazil

<sup>5</sup>Institut de Recherche en Informatique de Toulouse, France

## Abstract

Proving the compliance of AI algorithms has become an important challenge with the growing deployment of such algorithms for real-life applications. Inspecting possible biased behaviors is mandatory to satisfy the constraints of the regulations of the EU Artificial Intelligence's Act. Regulation-driven audits increasingly rely on global fairness metrics, with Disparate Impact being the most widely used. Yet such global measures depend highly on the distribution of the sample on which the measures are computed. We investigate first how to manipulate data samples to artificially satisfy fairness criteria, creating minimally perturbed datasets that remain statistically indistinguishable from the original distribution while satisfying prescribed fairness constraints. Then we study how to detect such manipulation. Our analysis (i) introduces mathematically sound methods for modifying empirical distributions under fairness constraints using entropic or optimal transport projections, (ii) examines how an auditee could potentially circumvent fairness inspections, and (iii) offers recommendations to help auditors detect such data manipulations. These results are validated through experiments on classical tabular datasets in bias detection. Our code is available on Github<sup>1</sup>.

<figure><img src="image_2.png" /><figcaption>Figure 1: Evading Bias Audits: Undetectable Maximal Fairness Manipulation in Seven Benchmark Datasets</figcaption></figure>

## 1 Introduction

Fairness auditing has emerged as a critical practice to ensure that machine learning models comply with ethical and legal standards by not exhibiting discriminatory bias. We refer to (Barocas, Hardt, and Narayanan 2019; Besse et al. 2022; Oneto and Chiappa 2020; Wang, Zhang, and Zhu 2022) and references therein. High-profile investigative audits, such as the ProPublica analysis of the COMPAS recidivism risk tool, have exposed significant biases against certain demographic groups (Angwin et al. 2016). These findings underscored the societal harms of unverified AI systems and prompted calls for regular fairness audits by independent parties (Raji et al. 2020). In response, regulators have begun instituting fairness compliance requirements. For instance, the EU's proposed AI Act mandates bias monitoring, and in the U.S., the Disparate Impact DI doctrine (the “80% rule”) is used to quantify indirect discrimination in algorithms (Feldman et al.

2015). This doctrine requires that the selection rate for a protected group be at least 80% of that of the most favored group. Consequently, the demographic parity metric (also known as statistical parity) has become a standard global fairness criterion which has inspired many mitigation methods, for example, in (Hardt, Price, and Srebro 2016a; Gouic, Loubes, and Rigollet 2020; Chzhen et al. 2020). A small demographic parity gap or a ratio above 0.8 is expected for fairness under this rule, along with other metrics such as equalized odds and predictive parity. These metrics provide quantifiable targets for auditors and have been integrated into various auditing toolkits (Bellamy et al. 2018; Bird, Dimmery, and Walker 2020).

We consider an auditing framework in which the auditee submits a sub-sample of their dataset to a regulatory authority, either by providing the algorithm's outputs on that sample or by sharing the sample itself along with API access to the model, allowing the auditor to compute outputs independently. The supervisory body is then responsible for verifying that the submitted sample is sufficiently representative of the
auditee's complete dataset. This framework is particularly relevant for high-risk systems, where rigorous oversight is required. The supervisory authority may be internal (e.g., a general inspection body) or external, such as the Cour des Comptes for public administration or the ACPR for banking supervision,

Ensuring the good faith of the auditee is critical, as exemplified by the Volkswagen emissions scandal (Jacobs and Kalbers 2019), in which vehicles were engineered to detect auditing conditions and deceive regulators by temporarily producing compliant behavior. Similar concerns arise in machine learning, where inconsistencies in model behavior during auditing have been documented, such as in the case of Facebook's models discussed in (Bourrée et al. 2025).

In summary, the auditing framework (similar to the one proposed in (Fukuchi, Hara, and Maehara 2020)) involves three distinct entities:

1. **The audited entity**, which provides a subset of its data and, in the context of the audit, grants access to run its algorithm on this data.

2. **The auditor**, who applies standardized procedures to assess whether the dataset and corresponding model outputs satisfy a prescribed fairness criterion, in this case, Disparate Impact.

3. **The supervisory authority**, a higher-level body that oversees the integrity of the entire auditing process. It ensures that the audited entity submits a dataset that is representative of the full underlying data distribution, and that the auditor adheres to established auditing protocols.

In this work, our objective is to support supervisory authorities by identifying potential strategies that audited entities might use to circumvent fairness audits, and by providing tools to detect such attempts. Building on the notion of *manipulation-proof* introduced in (Yan and Zhang 2022), we show how a dataset that initially violates a fairness criterion, such as Disparate Impact, can be minimally altered to appear compliant, with limited distributional shift as measured by the Kullback-Leibler (KL) divergence or the Wasserstein distance. By systematically analyzing these plausible manipulations, our aim is to raise awareness of audit vulnerabilities and to equip oversight bodies with methods to detect suspicious modifications, thereby strengthening the reliability and robustness of fairness auditing processes. Our contributions are the following:

* We introduce an entropic projection under constraint tool to a new field that is fairness application and auditing, we also build upon this tool to enable constraints on DI.

* We provide mathematical foundations for Wasserstein projection under constraint and implement its application, as well as other Wasserstein-minimizing algorithm, to control distribution shift under fairness constraint.

* We assess whether-and to what extent- a sample from the projected distribution can significantly increase, without being detected by distributional-based statistical tests, the Disparate Impact from 7 unfair tabular datasets, as illustrated in Fig. 1. These tests would be used by the supervisory authority to assert the representativeness of the sample.

## 2 Related Works

**Bias mitigation** Achieving fairness under these metrics has has prompted extensive research. One line of work proposes *pre-processing* techniques that alter the training data to remove bias. (Kamiran and Calders 2009) introduced a “data massaging” approach, flipping class labels of a few selected instances to reduce discrimination. (Feldman et al. 2015) proposed repairing datasets by adjusting feature values to remove disparate impact, while (Calmon et al. 2017) framed the problem as a convex optimization for probabilistic data transformation. More recently, (Celis, Straszak, and Vishnoi 2019) introduced a maximum entropy approach to learn fair distributions under statistical constraints. (Gordaliza et al. 2019) or (Chakraborty, Oudot, and Vayatis 2024) applied optimal transport (OT) to modify datasets by respectively reweighting the training dataset or reducing the relationship between the sensitive attribute and the covariates, ensuring fairness criteria are met while minimizing divergence from the original distribution. These methods illustrate the feasibility of improving fairness metrics with relatively small changes to the data. Note that the use of Wasserstein metric to assess fairness is proposed in (Del Barrio, Gordaliza, and Loubes 2019). On the other hand, post-processing methods modify the outputs of the model to enforce fairness and let practitioners retrofit fairness to black-box systems. These methods modify the attributes of the individuals to modify global fairness measures such as statistical parity or Equality of opportunity or odds. In its seminal paper, (Hardt, Price, and Srebro 2016a) solves a linear program on validation data to find flipping probabilities that equalize FPR and FNR. Optimal transport method can also be used to move the outputs towards the Wasserstein barycenter. This post-processing method is proven to be optimal with respect to the accuracy of this model, as discussed in (Jiang et al. 2020), (Gouic, Loubes, and Rigollet 2020) or (Chzhen et al. 2020).

**Fair-washing** Ironically, these same tools can be misused to *fake* fairness. A growing body of work highlights how auditees may deliberately manipulate data or outputs to deceive auditors, a phenomenon called *fair-washing* (Aivodji et al. 2019). One major vulnerability is that global fairness metrics measure the impact of a sensitive attribute on the decision or on the loss of the model. Yet estimating these probabilities require observations from a test sample. Hence these fairness measures depend heavily on the audited sample. (Fukuchi, Hara, and Maehara 2020) proposed so-called *stealthily biased sampling*, where biased decision-makers curate benchmark datasets that appear fair but mask discrimination in the full data. Their method guarantees that the audited sample passes fairness checks (Disparate Parity (Barocas and Selbst 2016) under a threshold), while remaining close to the biased distribution in a way that is hard to detect.

Another form of fair-washing involves model output manipulation. (Aivodji et al. 2019) showed that interpretable proxy models can be trained to mimic the behavior of a black-box model but appear much fairer. These surrogates can be presented as evidence of fairness, while the actual deployed model remains biased. (Le Merrer and Trédan 2020) discusses altering decisions during audits, for instance, tem-
porarily approving more minority applicants to artificially satisfy demographic parity. Case studies have confirmed discrepancies between model behavior shown to auditors and that experienced by users (Raji et al. 2020), reinforcing the idea that audits based solely on observed data or queries can be manipulated.

We note that even explainability tools are vulnerable to exploitation. (Slack et al. 2020) and (Anders et al. 2020) demonstrated attacks on the explainable methods LIME (Ribeiro, Singh, and Guestrin 2016) and SHAP (Lundberg and Lee 2017), generating biased models that appear fair by masking the influence of sensitive attributes. (Shamsabadi et al. 2023) examined the theoretical limits of fair-washing detection, showing that under certain conditions, audit evasion may be provably undetectable.

Other approaches leverage external consistency. (Garcia-Borruey, Loiseau, and Le Merrer 2023) proposed two-source audits, comparing outputs across APIs and user-facing systems to identify inconsistencies indicative of manipulation. (Bourrée et al. 2025) suggested using prior knowledge or independent ground-truth data to detect implausible distributions. They provide bounds on the extent of bias an auditee can inject without detection.

In summary, fairness auditing is undergoing an arms race between auditees' capacity to fake compliance and auditors' ability to detect manipulation. Our contribution to this evolving landscape is twofold: we formalize entropic and optimal transport (OT)-based data transformation techniques that can be used to simulate potential audit circumvention, and we analyze these methods to provide insights into how supervisory authorities can identify such attempts. By modelling both the attack and its detectability, our work aims to strengthen the resilience of fairness auditing frameworks and support the development of more robust oversight mechanisms.

## 3 Methodology

Statistical parity property ensures that the decision of the algorithm does not depend on the sensitive attribute. The most widely used metric to quantify this fairness property is given by the well-known Disparate Impact, defined for a model $\hat{Y} = f(X)$ by the ratio

$$DI(f, Q_n) := \frac{\mathbb{P}(\hat{Y} = 1 | S = 0)}{\mathbb{P}(\hat{Y} = 1 | S = 1)}$$

This quantity is equal to 1 when no probabilistic relationship exists between the outcome of the model and the sensitive variable, which implies a strict independence in the case where $f(X)$ is a two-class classification model. A smaller DI corresponds to more discrimination towards the minority class indexed by $S = 0$. Hence, several norms or regulations impose that a model should have its disparate impact greater than a given level $t$. This level is often set to $t = 0.8$ as chosen originally in (Equal Employment Opportunity Commission et al. 1978), but also in (Groves et al. 2024) or (Wright et al. 2024).

In this part, we propose a methodology that enables stakeholders to evade an audit based on the application of a fairness criterion, the Disparate Impact. Therefore, our method aims

to construct a dataset whose distribution is close to the distribution of the original data, while ensuring that the fairness measure is above a threshold, required by the regulations. The mathematical model is as follows. Let $(E, \mathcal{B}(E))$ be a measurable space. Denote by $\mathcal{P}(E)$ and $\mathcal{M}(E)$, respectively the space of probability measures on $E$ and the space of finite measures in $E$. Consider a distance $d$ in $E$. In reality, given an empirical distribution $Q_n = \frac{1}{n} \sum_{i=1}^n \delta_{Z_i}$ where $Z_i$ is an i.i.d. sample of a random variable with value in $E$, the construction of a falsely compliant dataset is modeled as finding the solution to the optimization problem

$$\underset{P \in \mathcal{P}(E), DI(f,P) \ge t}{\operatorname{argmin}} d(P, Q_n), \quad (1)$$

In the following, we will consider two different distances: in Section 4.1, one is related to the similarity for probabilistic inference (KL information), while in Section 5, the other distance captures geometric information between distances (Monge-Kantorovitch a.k.a. Wasserstein distance). Consequently, fair-washing amounts to modify the initial distribution of the data by providing a fake but plausible distribution $Q_t$ in order to achieve that $DI(f, Q_t) = t$ or $DI(f, Q_t) \ge t$.

# 4 Using entropic projection to fake fairness

## 4.1 Entropic distributional projection

Recall the definition of the KL information. Set $Q$ a probability measure on $E$. If $P$ is another probability measure on $(E, \mathcal{B}(E))$, then the KL information $KL(P, Q)$ is equal to $\int_E \log \frac{dP}{dQ} dP$, if $P \ll Q$ and $\log \frac{dP}{dQ} \in L^1(P)$, and $+\infty$ otherwise. For a given $k \ge 1$, the resulting dimension, let

$$\Phi : (X, S, \hat{Y}, Y) \in E \mapsto \Phi(X, S, \hat{Y}, Y) \in \mathbb{R}^k$$

be a measurable function representing the shape of the stress deformation on the whole input. Note that our results are stated for a generic function $\Phi$ of all variables $Z = (X, S, \hat{Y}, Y)$. Of course, this includes the case of functions depending only on $X$, $(X, Y)$ or $(X, \hat{Y})$. We set for two vectors $x, y \in \mathbb{R}^k$ the scalar product as $\langle x, y \rangle = x^\top y$. The problem can be stated as follows: given the distribution $Q_n$, our aim is to construct a distribution close to $Q_n$ but satisfying a constraint expressed through the mean of the chosen function $\Phi$. Actually, for $t \in \mathbb{R}^k$, we aim at finding a new distribution $Q_t$ satisfying the constraint

$$\int_E \Phi(x) dQ_t(x) = t,$$

and being the closest possible to the initial empirical distribution $Q_n$ in the sense of KL divergence, i.e. with $KL(Q_t, Q_n)$ as small as possible. The following theorem, whose proof can be found in (Bachoc et al. 2023), characterizes the distribution solution $Q_t$.

**Theorem 4.1.** Let $t \in \mathbb{R}^k$ and $\Phi: E \to \mathbb{R}^k$ be measurable. Assume that $t$ can be written as a convex combination of $\Phi(X_1, \hat{Y}_1, Y_1), \dots, \Phi(X_n, \hat{Y}_n, Y_n)$, with positive weights. Assume also that the empirical covariance matrix $\mathbb{E}_{Q_n}(\Phi\Phi^\top) - \mathbb{E}_{Q_n}(\Phi)\mathbb{E}_{Q_n}(\Phi^\top)$ is invertible.

Let $\mathcal{D}_{\Phi,t}$ be the set of all probability measures $P$ on $E$ such that $\int_E \Phi(x) dP(x) = t$. For a vector $\xi \in \mathbb{R}^k$, let
$Z(\xi) := \frac{1}{n} \sum_{i=1}^{n} e^{\langle \Phi(X_i, \hat{Y}_i, Y_i), \xi \rangle}$. Define now $\xi(t)$ as the unique minimizer of the strictly convex function $H(\xi) := \log Z(\xi) - \langle \xi, t \rangle$. Then,

$$Q_t := \operatorname{arginf}_{P \in \mathcal{D}_{\Phi,t}} \mathrm{KL}(P, Q_n) \quad (2)$$

exists and is unique. It can also be computed as

$$Q_t = \frac{1}{n} \sum_{i=1}^{n} \lambda_i^{(t)} \delta_{X_i, \hat{Y}_i, Y_i}, \quad (3)$$

with, for $i = 1, \dots, n$,

$$\lambda_i^{(t)} = \exp \left( \langle \xi(t), \Phi(X_i, \hat{Y}_i, Y_i) \rangle - \log Z(\xi(t)) \right). \quad (4)$$

## 4.2 Faking Statistical Parity using Entropic Projection

Let $t_0$ such that $DI(f, Q_n) = t_0$. We aim at building a distribution $Q_t$ such that $DI(f, Q_n) = t_1 \ge t_0$ for a given $t_1$. Define the as Fairness improvement $\Delta_{DI} := DI(f, Q_t) - DI(f, Q_n)$ Note that

$$DI(f, Q_n) = \frac{\lambda_0/n_0}{\lambda_1/n_1}$$

where $n_0 = |\{i = 1, \dots, n | S_i = 0\}|$, $n_1 = |\{i = 1, \dots, n | S_i = 1\}|$, $\lambda_0 = |\{i = 1, \dots, n | \hat{Y}_i = 1 \wedge S_i = 0\}|$ and $\lambda_1 = |\{i = 1, \dots, n | \hat{Y}_i = 1 \wedge S_i = 1\}|$. Note also that $\lambda_0 = \sum_{i=1}^n \hat{Y}_i(1 - S_i)$ and $\lambda_1 = \sum_{i=1}^n \hat{Y}_i S_i$. Hence modifying the DI can be achieved applying Theorem 4.1 for $Z = (S, \hat{Y})$ and selecting the function

$$\Phi(s, f(x)) = \begin{pmatrix} (1-s)f(x) \\ sf(x) \\ s \\ 1-s \end{pmatrix} \quad \text{and} \quad m = \begin{pmatrix} \lambda_0 + \delta_0 \\ \lambda_1 - \delta_1 \\ n_1 \\ n_0 \end{pmatrix} \quad (5)$$

Note that our purpose is to improve the perceived fairness of the model, i.e the measure of the fairness on a well-chosen dataset, which requires increasing the DI. Accordingly, we only consider increasing the numerator $+\delta_0 \ge 0$ and decreasing the denominator $-\delta_1 \le 0$.

**Proposition 4.2 (KL-fair washing method).** Finding a solution $Q_t$ such that $KL(Q_t, Q_n)$ is minimum and $DI(f, Q_t) = DI(f, Q_0) + \Delta_{DI}$ is achieved by finding the solution to (2) with $\Phi$ defined as in (5) and with the two possible choices of parameters:

* Balanced case : set $\delta_0 = \delta_1$ and

$$\delta_1 = \frac{\lambda_1}{1 + \frac{n_1}{n_0 \Delta_{DI}} (1 + \frac{\lambda_0}{\lambda_1})}$$

* Proportional case : set $\frac{\delta_0}{n_0} = \frac{\delta_1}{n_1}$ and

$$\delta_1 = \frac{\lambda_1}{1 + \frac{1}{\Delta_{DI}} \left(1 + \frac{n_1 \lambda_0}{n_0 \lambda_1}\right)}$$

**Remark 4.1.** The first set of parameters corresponds to modifying both the individuals from both classes $S_i = 0$ and $S_i = 1$ equally, while the second adjusts the amount of modification in proportion to the $n_0$ and $n_1$ classes sizes. A proportional modification is a natural choice, as altering a single individual in a larger class induces a smaller shift in the overall distribution, resulting in a lower divergence.

If the target value $t_1$ is chosen according to the balanced case, we refer in the Experimental section to the method as Entropic balanced. If $t_1$ is instead selected following the proportional case, we refer to it as Entropic proportional. We point out that the Proposition 4.2 enables to create distributions $Q_t$ at a minimal KL distance to the empirical observations while achieving the desired level of fairness, i.e $DI(f, Q_t) = t$. Note that $Q_t$ is a reweighted sample of $Q_n$. This enables to drawing observation samples from this manipulated distribution. Experimental results are provided in Section 6

# 5 Fair-washing using Optimal Transport

## 5.1 Monge Kantorovich (MK) Projection

For two distributions $P$ and $Q_n$ over $E \subset \mathbb{R}^d$ a compact subset, endowed with the norm $\|\cdot\|$, recall that their 2 Monge-Kantorovich, a.k.a. Wasserstein distance, is defined as:

$$W_2^2(P, Q_n) = \min_{\pi \in \Pi(P, Q_n)} \int_{x \in E, y \in E} \|x - y\|^2 d\pi(x, y), \quad (6)$$

where $\Pi(P, Q_n)$ denotes the set of distributions on $E \times E$ with marginals $P$ and $Q_n$. We will write $T_{\#}Q = Q \circ T^{-1}$ to denote the push-forward of a measure by the transport map.

As in Section 4.1, consider for a given $k \ge 1$, a continuous function $\Phi: E \to \mathbb{R}^k$ representing the constraints. For fixed $t \in \mathbb{R}^k$, the set $D_{\Phi,t} = \{P \in \mathcal{M}(E) \mid \int_E \Phi(x)dP(x) = t\}$ is closed for the weak convergence and convex, since it is linear in $P$. The function $P \mapsto W_2^2(P, Q_n)$ is convex as it is the supremum of linear functionals by Kantorovich duality (see (Santambrogio 2015)), therefore the projection problem

$$\operatorname{arginf}_{P \in D_{\Phi,t}} W_2^2(P, Q_n) \quad (7)$$

is well-defined.

**Theorem 5.1.** Consider $Q_n = \frac{1}{n} \sum_{i=1}^n \delta_{Z_i}$. Then $Q_t$ is a solution to (7) if, and only if, it is defined as

$$Q_t = T_{\lambda} \# Q_n = \frac{1}{n} \sum_{i=1}^{n} \delta_{T_{\lambda} \star (Z_i)}, \quad (8)$$

where $T_{\lambda}$ is defined as

$$T_{\lambda}(Z_i) \in \arg \min_{x \in E} \|x - Z_i\|^2 - \langle \lambda, \Phi(x) \rangle \quad (9)$$

and $\lambda^*$ satisfies $t = \frac{1}{n} \sum_{i=n}^n \Phi(T_{\lambda^*}(Z_i))$.

**Remark 5.1.** The previous result is stated for the empirical distribution, but it is also valid for any distribution $Q$.

**Remark 5.2.** Note that the constraint can be modified to include the condition $D_{\Phi,t} = \{P \in \mathcal{M}(E) \mid \int_E \Phi(x)dP(x) \ge t\}$. This is detailed in Proposition D.1 in the Appendix.
## 5.2 Faking Statistical Parity using MK projection

The objective is to construct a fake dataset drawn from a distribution $Q_t$ defined as the solution to

$$Q_t = \operatorname{arginf}_{P \in \mathcal{D}_{\mathrm{DI},t}} W(Q_n, P) \quad (10)$$

with $\mathcal{D}_{\mathrm{DI},t} = \{P \in \mathcal{P}(E), \mathrm{DI}(P) \ge t\}$. Following the framework of the previous section, for a fixed $\lambda$, we set $\Phi(x, s, f(x), y) = f(x)$. Then the constraint on the Disparate Impact $\mathrm{DI}(Q) \ge t$, can be reformulated with the double inequality $\int_{x \in E|s=0} f(x)dQ(x) \ge t_0 = t + \delta_0$ and $\int_{x \in E|s=1} f(x)dQ(x) \le t_1 = t - \delta_1$ with $\frac{t_0}{t_1} \ge t$. As such, we divide the dataset for each $s \in \{0, 1\}$, and consider $Q_t = \pi Q_{t,1} + (1 - \pi)Q_{t,0}$ with $\pi = \mathbb{P}_{Q_n}(S = 1)$ and

$$Q_{t,s} := \operatorname{arginf}_{P \in \mathcal{D}_{\mathrm{DI},t_s}} W(Q_{n,s}, P)$$

with the conditional distributions for each $s \in \{0, 1\}$:

$$Q_{n,s} := Q_n(\cdot | S = s), \mathcal{D}_{\mathrm{DI},t_0} = \{P \in \mathcal{P}(E), \mathrm{DI}(P) \ge t_0\} \\ \text{and } \mathcal{D}_{\mathrm{DI},t_1} = \{P \in \mathcal{P}(E), \mathrm{DI}(P) \le t_1\}.$$

Following Theorem 5.1, we compute for all $x = Z_i$, the solution $T_\lambda(x)$ of the minimization problem w.r.t $x$

$$\mathcal{L}(x, \lambda) = \|Z_i - x\|_2^2 + <\lambda, t - f(x)> \quad (11)$$

This minimization does not have a closed form in general, but it can be achieved using a gradient descent using a learning step of $\eta$ and computing $x^t = x^{t-1} - \eta \frac{\partial \mathcal{L}}{\partial x}(x^t)$ with

$$\frac{\partial \mathcal{L}}{\partial x} = 2(z-x) - <\lambda, \nabla_x f(x)> \quad (12)$$

We point out that this method requires knowledge of the gradients of the classifier, which will be estimated at each step of the method.

To complete the method's explanation, we need to clarify how to choose $t_0$ and $t_1$ and $\lambda$:

1. The choice of $t_0$ and $t_1$ is explained in Section 4.2: from $t$ we either go with the balanced case where $\delta_0 = \delta_1$ or the proportional case where $\frac{\delta_0}{n_0} = \frac{\delta_1}{n_1}$.

2. $\lambda$ is a constraint regulation coefficient, meaning that the bigger $\lambda$ is, the more the optimization solution will take into account the constraint $\int_{x \in E|S=s} f(x)dQ(x) \le t_s$. And consequently, the bigger $\lambda$ is, the farther the solution will be from the original distribution. This is why want $\lambda$ to be as small as possible while still achieving the constraint. This lead to start with a low $\lambda$ and we solve the optimization problem of Equation (11); if the solution does not respect the constraint, then we start again with a slightly bigger $\lambda$.

This method creates new individuals without any constraint on the covariates $X$, this might be an issue as this implies no restriction of types (discrete variable staying discrete, i.e., age = 1.0002) or of bounds (age = -1). Thereby, we created a variant of this method that constrains the achievable covariates: we transport, variable per variable, each covariates toward the nearest (for the $L_2$ norm) achieved value in the dataset; we call this variant the 1D-transport variant.

<figure><img src="image_3.png" /><figcaption>Figure 2: Admissible modifications on $\tau: \{0, 1\}^2 \to \{0, 1\}^2$ increasing Disparate Impact</figcaption></figure>

**Remark 5.3.** Note that we chose to modify the output of the model, $f(x) \in \{0, 1\}$. For practical purposes, to know when the convergence is attained, we look at the logits of the neural network instead of the binary values: after a sigmoid, $f(x) \in [0, 1]$. We could therefore apply our constraint on the logits, which highlights the ability to use these methods for non-binary tasks, for instance, in regression settings.

**Remark 5.4.** The constraints are imposed separately on the squared Wasserstein distances $W_2^2(Q_{n,1}, Q_{t,1})$ and $W_2^2(Q_{n,0}, Q_{t,0})$. Inequality (13) provides an upper bound on the overall distance between the two samples. The proof of this result is deferred to Appendix E.2.

$$W_2^2(\pi Q_{n,1} + (1-\pi)Q_{n,0}, \pi Q_{t,1} + (1-\pi)Q_{t,0}) \le \pi W_2^2(Q_{n,1}, Q_{t,1}) + (1-\pi)W_2^2(Q_{n,0}, Q_{t,0}) \quad (13)$$

This subsection introduces four methods, summarized as follows: (1) GradBalanced, and (2) GradProportional, which differ based on whether the gradient constraints satisfy $\delta_0 = \delta_1$ or $\delta_0/n_0 = \delta_1/n_1$; and (3) GradBalanced1D-transport, and (4) GradProportional1D-transport, which apply the corresponding 1D-transport variant of each method.

## 5.3 Faking Statistical Parity using sensitive attributes replacement

In this section, we consider that the auditor does not have access to the model itself and only request the outcome of the algorithm $\hat{Y}$, without computing it from the observations $f(X)$. Hence, faking fairness can be achieved by manipulating only the outcomes and sensitive attributes associated with each individual. Let $Z_i = (S_i, \hat{Y}_i)$ and $Q_n = \frac{1}{n} \sum_{i=1}^n \delta_{S_i, \hat{Y}_i}$. Consider the optimization problem

$$\operatorname{arginf}_{P \in \mathcal{D}_{\mathrm{DI},t}} W_2^2(Q_n, P) \quad (14)$$

with $\mathcal{D}_{\mathrm{DI},t} = \{P \in \mathcal{P}(E), \mathrm{DI}(Q_t) \ge t\}$. A solution to (14) can be achieved as follows. Note that $\hat{Y} \in \{0, 1\}$ and $S \in \{0, 1\}$, thus we only have 4 possible values for the points. Each individual with characteristic $Z_i \in \{0, 1\}^2$ can be modified to the individual $\tau(Z_i) = (\tau_S(S_i), \tau_{\hat{Y}}(\hat{Y}_i)) \in$
<table><caption>Table 1: Summary of the methods and their nicknames</caption><thead><tr><th>Subsections</th><th>Nicknames & Summary</th></tr></thead><tbody><tr><td>4.2</td><td>Entropic balanced (1) Entropic proportional (2) : Entropic distributional projection by re-weighting every individual's importance from the original distribution to increase the DI with the balanced (1) or proportional case (2)</td></tr><tr><td>5.1</td><td>Grad balanced (1), Grad proportional (2), Grad balanced 1D-transport (3), Grad proportional 1D-transport (4): applying Theorem (5.1) in the balanced (1) or proportional case (2) ; (3) and (4) applying a 1D-transport on the achievable values</td></tr><tr><td>5.3</td><td>Replace (S, Ŷ) : Replacing the key attributes S and Ŷ to increase the DI while minimizing the number of replacements done</td></tr><tr><td>5.3</td><td>M<sub>W(X,S,ŷ)</sub> : Recursive Wasserstein-minimizing matching method</td></tr></tbody></table>

{0, 1}². We first point out that not all solutions improve the disparate impact and we can restrict ourselves to a set of admissible changes $\tau \in \mathcal{A}$ as pointed in Figure 2, more details explaining why in Section H.1 in the Appendix. Then iteratively we approximate the exact solution by an iterative method starting from $Z = (Z_1, \dots, Z_n)$ and testing every possible modification $Z^j = (Z_1, \dots, Z_n)$ maximizing the DI at each step $j$.

<caption>Algorithm 1: Replace (S, Ŷ) algorithm</caption>

1: $Z^j = (Z_1, \dots, Z_n), Z_i = (S_i, \hat{Y}_i), t \in [0, 1[$
2: $\tau_i := (\tau, j)$ such as $\tau \in \mathcal{A}, i \in 1, \dots, n$
3: **while** DI($Z^j$) < t **do**
4: &nbsp;&nbsp;&nbsp;&nbsp; $\tau_{i_0} \in \text{argmax} \text{DI}(\tau_{i_0}(Z^j)) - \text{DI}(Z^j)$
5: &nbsp;&nbsp;&nbsp;&nbsp; with $\tau_{i_0}(Z^j) := (Z_i, \dots, \tau(Z_{i_0}), \dots, Z_n)$
6: &nbsp;&nbsp;&nbsp;&nbsp; $Z^j \leftarrow Z^{j+1} = \tau_{i_0}(Z^j)$
7: **end while**
8: **return** $Z^j$

We note that in this case the observations $X_i$ are not taken into account. A natural variant consists in combining this minimization scheme and adding a continuous displacement on the variables $X$, this is presented in the following subsection. In our experiments, the method based on this algorithm is denoted by Replace (S, Ŷ).

## 5.4 Faking Statistical Parity using constrained matching

Namely, we define a matching algorithm using $Z = (X, S, Ŷ)$ and $\tau(Z_i) = Z_k$, with $k \in \{1, \dots, n\}$. We use the same proceedings as Alg. 1 with the newly defined $\tau$, but at every iteration $j$ of the while loop we maximize for every candidate $\tau_{i_0}$

$$ \frac{\text{DI}(\tau_{i_0}(Z^j)) - \text{DI}((Z^j))}{\|\tau_{i_0}(Z^j) - Z^j\|} $$

**Remark 5.5.** This algorithm transports individuals towards others ($\tau(Z_i) = Z_k$), therefore, contrary to its Replace (S, Ŷ) counterpart, it can be used in any type of audit (with or without access to the model).

In our experiments, we call the method based on this algorithm $M_{W(X,S,ŷ)}$.

# 6 Experimental Settings

Table 1 provides the nicknames and a brief summary of each method introduced earlier, which will be used in the experiments. We also formalize some key details of our experiments here.

## 6.1 Datasets

We use 7 benchmarking datasets : Adult Census Income dataset as the most famous benchmark in fairness community, where Ŷ is an individual's income is above 50k (Adult) (Becker and Kohavi 1996). We also use 5 benchmark datasets from (Ding et al. 2021) which records information about the USA's population, including income (INC), population's mobility (MOB), employment (EMP), travel time to work (TRA) and public system coverage (PUC). We also include Bank Account Fraud generated dataset (BAF) from (Jesus et al. 2022). We refer to Table 2 for the sensitive variable and the original Disparate Impact (DI) of each dataset.

<table><caption>Table 2: Dataset presentation, sensitive variable (S) associated, and original Disparate Impact (DI)</caption><thead><tr><th></th><th>Adult</th><th>INC</th><th>TRA</th><th>MOB</th><th>BAF</th><th>EMP</th><th>PUC</th></tr></thead><tbody><tr><th>S chosen</th><td>Sex</td><td>Sex</td><td>Sex</td><td>Age</td><td>Age</td><td>Disability</td><td>Disability</td></tr><tr><th>DI</th><td>0.30</td><td>0.67</td><td>0.69</td><td>0.45</td><td>0.35</td><td>0.30</td><td>0.32</td></tr></tbody></table>

## 6.2 Neural network predictions

As we are working only with tabular data, we provide a Ŷ with a multilayer perceptron (MLP) neural network $f$ ending with a sigmoid activation function ($f(x) \in [0, 1]$). While having the best prediction accuracy was not the goal of experiments, we still achieve reasonable accuracy learning with the ScheduleFree optimizer (Defazio et al. 2024). We defined the logit threshold based ground truth mean : $l_{th} := \min_{l \in [0,1]} |\mathbb{E}(\hat{Y}_l) - \mathbb{E}(Y)|$ with $\hat{Y}_l = \{f(x) > l | x \in \mathcal{D}\}$. This was especially necessary for the BAF dataset, where the learning task is basically an anomaly detection task, and $\mathbb{E}(Y) \sim 0.01$.

## 6.3 Statistical tests

We outline below potential strategies a supervisory authority could adopt to assess whether the auditee conducted com-
<table><caption>Table 3: Results of the 7 tests independently; for each unbiased method (DI=0.8) and datasets. Sampling is stopped as soon as one sample satisfies the $H_0$ hypothesis, or after 30 trials if none do. The symbol — means the method was undetected by the test for both sampling sizes of 10% and 20% ($H_0$ accepted), ○ means that only the 20% sampling size was undetected ($H_0$ accepted for 20% and rejected for 10%); and ŷ means that the method was detected at both 10% and 20% sample sizes ($H_0$ rejected). Positional and color coding indicate which test each result corresponds to, in the following order and color scheme: KL(X, S, ŷ), KL(S, ŷ), W(X, S, ŷ), W(S, ŷ), K-S(ŷ), MMD(X, S, ŷ), MMD(S, ŷ). Note that Grad_proportional (Grad_p) and Grad_balanced (Grad_b) have been merged with their 1D counterpart due to identical test results.</caption><thead><tr><th rowspan="2">Dataset</th><th colspan="8">Methods</th></tr><tr><th>Grad_p(1D-t)</th><th>Grad_b(1D-t)</th><th>Rep (S, Ŷ)</th><th>M<sub>W(X,S, Ŷ)</sub></th><th>Entropic_b</th><th>Entropic_p</th></tr></thead><tbody><tr><td>ADULT</td><td>○ ○ — ○ ○ —</td><td>○ ○ — ○ ○ —</td><td>○ ○ — ○ ○ —</td><td>○ ○ — ○ ○ ○</td><td>— ○ — ○ ○ —</td><td>— ○ — ○ ○ —</td></tr><tr><td>EMP</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ — ○ ○ —</td><td>○ ○ — ○ ○ ○</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ ○ ○ — ○</td></tr><tr><td>INC</td><td>○ — — — —</td><td>○ — — — —</td><td>○ — — — —</td><td>— — — — —</td><td>— — — — —</td><td>— — — — —</td></tr><tr><td>MOB</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ — ○ — ○</td><td>○ ○ — ○ — ○</td><td>○ ○ — ○ ○ ○</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ ○ ○ — ○</td></tr><tr><td>PUC</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ ○ ○ ○ ○</td><td>○ ○ ○ ○ — ○</td></tr><tr><td>TRA</td><td>○ — — — —</td><td>○ — — — —</td><td>○ — — — —</td><td>— — — — —</td><td>— — — — —</td><td>— — — — —</td></tr><tr><td>BAF</td><td>○ ○ — — — —</td><td>○ ○ — — — —</td><td>○ — — — —</td><td>— — — — —</td><td>— — — — —</td><td>— — — — —</td></tr></tbody></table>

pliance tests using a sample drawn from the original data distribution. The auditee presents a sample $D_{n,t}$, drawn from a distribution $Qn, t$. To verify the authenticity of this sample, the authority must be granted access to the full dataset upon request. This access enables the authority to infer the ground-truth distribution and determine whether the submitted data has been manipulated or follows the initial distribution $Qn$.

To assess representativeness, the authority must rely on statistical testing. Two main categories of tests are available. The first includes hypothesis tests that evaluate, at a chosen confidence level, whether the distribution of the submitted sample $D_{n,t}$ is statistically similar to the original distribution $Qn$. In their study (Fukuchi, Hara, and Maehara 2020), the authors apply a Kolmogorov-Smirnov (KS) test for one-dimensional data ($X \in \mathbb{R}^1$), and a test based on the Wasserstein distance for higher-dimensional settings ($X \in \mathbb{R}^k$, with $k > 1$). In our framework, we apply both the KS test and the Wasserstein test on the conditional distribution $\hat{Y} | S$.

The second approach evaluates whether the sample $D_{n,t}$ could plausibly result from a random draw from the original distribution $Qn$, by measuring a divergence or distance metric $d$. The idea is to test whether the observed value $d(D_{n,t}, Qn)$ lies within the $(1 - \alpha/2)$ confidence interval of $d(Q_{n,t}, Q_n^\sigma)$, where $Q_n^\sigma$ represents a reference sample drawn from the original distribution. For the distance metric $d$, we considered several options, including the Maximum Mean Discrepancy (MMD) (Gretton et al. 2012), the Wasserstein distance, and the Kullback-Leibler (KL) divergence.

## 6.4 Extension to non tabular data

The method we develop is originally meant to handle tabular data but we could use it directly on images or text flattened as vectors. Yet, using as previously the $L^2$ distance between individuals, might not be the natural way to capture semantic similarity between images or token distributions. A way to circumvent this issue is to represent the images in another space, where the regular distances would have semantic meanings.

<figure><img src="image_4.png" /><figcaption>Figure 3: Radar graph ranking the optimization result depending on the fair-washing method. This graph shows why $M_{W(X,S, ŷ)}$ is the most promising method.</figcaption></figure>

The construction of such a space has already seen numerous works using PCA projections or latent spaces of AE, VAE or CNN classifiers. We present such results in Section C.

# 7 Fairness manipulation vs fraud detection

In this section, we begin by examining the distributional shifts induced by each falsely fair manipulation method and evaluating the ability of statistical tests to detect falsely compliant samples. In the second part, we explore the trade-off between fairness and distribution shift by identifying, for each dataset, the most fair manipulated samples that remain undetected.

## 7.1 Detecting Fraud through Distributional Shifts

**Fairness cost: Distribution shift per method** Fig 3 illustrates the comparative performance of each method across
<table><caption>Table 4: Highest undetected achievable Disparate Impact for each dataset, sample size (S Size) and fair-washing method. The symbol – indicates that some methods couldn’t reach a DI improvement. To emphasize the best method to use in order to deceive the auditor, we put the DI achieved in bold when one or two overperformed the others.</caption><thead><tr><th>Dataset</th><th>Original</th><th>S size (%)</th><th>Grad_p</th><th>Grad_b</th><th>Grad_p 1D</th><th>Grad_b 1D</th><th>Rep (S, Ŷ̂)</th><th>Entr_b</th><th>Entr_p</th><th>M<sub>W(X,S,ŷ̂)</sub></th></tr></thead><tbody><tr><td rowspan="2">ADULT</td><td rowspan="2">0.30</td><td>10</td><td>0.47</td><td>0.43</td><td>0.49</td><td>0.44</td><td>0.50</td><td><strong>0.54</strong></td><td>0.52</td><td><strong>0.54</strong></td></tr><tr><td>20</td><td>0.39</td><td>0.40</td><td>0.38</td><td>0.39</td><td>0.41</td><td><strong>0.42</strong></td><td>0.41</td><td><strong>0.42</strong></td></tr><tr><td rowspan="2">EMP</td><td rowspan="2">0.30</td><td>10</td><td>—</td><td>—</td><td>—</td><td>—</td><td>—</td><td>0.36</td><td>0.36</td><td><strong>0.37</strong></td></tr><tr><td>20</td><td>—</td><td>—</td><td>—</td><td>—</td><td>—</td><td>0.34</td><td><strong>0.36</strong></td><td>0.35</td></tr><tr><td rowspan="2">INC</td><td rowspan="2">0.67</td><td>10</td><td>0.75</td><td>—</td><td>—</td><td>—</td><td>0.88</td><td>0.94</td><td><strong>0.95</strong></td><td>0.93</td></tr><tr><td>20</td><td>—</td><td>—</td><td>—</td><td>—</td><td>0.83</td><td>0.83</td><td><strong>0.84</strong></td><td><strong>0.84</strong></td></tr><tr><td rowspan="2">MOB</td><td rowspan="2">0.45</td><td>10</td><td>0.53</td><td>0.51</td><td>—</td><td>0.50</td><td><strong>0.53</strong></td><td>0.52</td><td>—</td><td>0.52</td></tr><tr><td>20</td><td>—</td><td>—</td><td>—</td><td>0.48</td><td>0.50</td><td>0.50</td><td>—</td><td>0.50</td></tr><tr><td rowspan="2">PUC</td><td rowspan="2">0.32</td><td>10</td><td>—</td><td>—</td><td>—</td><td>—</td><td>—</td><td>0.33</td><td><strong>0.35</strong></td><td><strong>0.35</strong></td></tr><tr><td>20</td><td>—</td><td>—</td><td>—</td><td>—</td><td>—</td><td>—</td><td>—</td><td>—</td></tr><tr><td rowspan="2">TRA</td><td rowspan="2">0.69</td><td>10</td><td>0.72</td><td>0.79</td><td>0.77</td><td>0.73</td><td>0.80</td><td>0.83</td><td>0.84</td><td><strong>0.85</strong></td></tr><tr><td>20</td><td>—</td><td>—</td><td>—</td><td>—</td><td>0.77</td><td>0.79</td><td>0.79</td><td><strong>0.80</strong></td></tr><tr><td rowspan="2">BAF</td><td rowspan="2">0.35</td><td>10</td><td>—</td><td>—</td><td>—</td><td>—</td><td>—</td><td>1</td><td>1</td><td>1</td></tr><tr><td>20</td><td>—</td><td>—</td><td>—</td><td>—</td><td>—</td><td>0.77</td><td><strong>0.80</strong></td><td>0.79</td></tr></tbody></table>

different distance metrics. We select metrics based on either the KL divergence or the Wasserstein distance, as both capture the distributional shifts induced by the modifications. Specifically, these metrics serve two purposes: (1) they quantify the extent of distributional change, and (2) they help assess each method’s ability to evade detection by the statistical tests. For example, we observe that Replace (S, ŷ̂) induces minimal perturbation with respect to the Wasserstein distance—denoted as W(S, ŷ̂) in the radar chart. As a result, we expect this method to perform well on statistical tests based on this criterion. We also provide complementary results on simulated data and the computation time and memory cost of each method in the Appendix (see Sec F). The smallest surface area in the radar chart is archived by M<sub>W(X,S,ŷ̂)</sub>, hence, given the results, this method appears to be the most suitable method for someone seeking to disguise their dataset, as it significantly improves the DI while preserving a distribution close to the original data. We now examine how an auditor could detect such manipulations.

**Fraud Detection** In the case of a compliant audit, is it possible to detect a fraud attempt based on the provided sample and the original dataset?

We observe whether we can create a falsely compliant sample from several $Q_t$ (with DI($Q_t$) ≥ 0.8), each created from one of our methods, and for each dataset. More precisely, we randomly sample from these $Q_t$, and apply seven distinct statistical tests under the null hypothesis $H_0$ that the original and sampled manipulated distributions are equivalent. Our evaluation relies on two Wasserstein based tests, two MMD based tests and two KL based tests, each applied to either only the sensitive variable (S, Y) or the full space (X, S, Y). We also include a two-sample Kolmogorov-Smirnov as an additional test to assess distributional differences.

Table 3 reports the acceptance or rejection of $H_0$ between a modified sample of 10% or 20% and the original dataset. We randomly select samples and stop as soon as the sample

passes the test i.e., $H_0$ accepted (if it can). Most methods that could satisfy the $H_0$ hypothesis did it before 5 tries, while others consistently failed. Therefore, Table 3 reports results over 30 samples as the maximum tries. Additional details on the probability of passing the tests are provided in Appendix K.1. Methods based on gradients (Grad balanced and Grad proportional) are easily detected (rejection of $H_0$), regardless of the sampling size (as indicated by the ⊙ symbol). $M_{W(X,S,ŷ̂)}$ and Entropic-based methods tend to be hardly detected ($H_0$ accepted for both sampling sizes, — symbol) for the INC, TRA and BAF datasets. For the TRA and INC datasets, the DI of the original data was close to that of the modified data (see Table 4), implying that the required modifications were minimal and therefore difficult to detect. For the BAF dataset, the proportion of instances with ŷ̂ = 1 and Y = 1 was very low (1%), resembling an anomaly detection scenario; as a result, only limited modifications were also needed in this case. We also provide complementary information in Appendix about the simulation setup in Sec F, which confirms the superior trade-off achieved by $M_{W(X,S,ŷ̂)}$ and we report the computational costs of the different methods in Section H.2 in the Appendix.

## 7.2 Trade-off: DI improvement vs distribution shift

Fig. 4 and Fig. 5 illustrates the trade-off between fairness correction and distribution shift on the Adult and Mobility datasets by the Wasserstein distance and KL divergence between the full original and modified distributions. Replace (S, ŷ̂), $M_{W(X,S,ŷ̂)}$ and Grad variant methods preserve the structure of the input space and are better alternatives to the entropic projection method. We recall that since Replace only modifies S and ŷ̂, it naturally leads to the lower difference between distributions.
<figure><img src="image_5.png" /><figcaption>Figure 4: Line plot showing the trade-off between fairness correction and distribution shift on the Adult dataset. Wasserstein Distance on the individual's characteristics *X*, and global KL divergence depending on the fairness correction per method.</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>Figure 5: Line plot showing the trade-off between fairness correction and distribution shift on the Mobility dataset. Global Wasserstein distance ((X, S, Ŷ), and global Kullback-Leibler divergence depending on the fairness correction per method.</figcaption></figure>

## 7.3 Fairest undetected falsely compliant sample

We saw previously that the higher the corrected disparate impact DI($Q_t$), the higher the distribution shift will be (represented by $W(Q_n, Q_t)$ or KL($Q_n, Q_t$)). This fact naturally induces a trade-off between fairness correction, and the fraud attempt being detected, where a lower distribution shift is advantageous. When considering Table 3 results, which presents the inability to cheat the supervisory authority in the Adult, EMP, MOB and PUC datasets with DI($Q_t$) $\ge$ 0.8, we study based on this trade-off the highest undetected fairness correction we are able to achieve. It also highlights that the Wasserstein tests were amongst the most effective methods for detecting data manipulation.

Table 4 presents the highest Disparate Impact (DI) values not rejected by the combination of five statistical tests, selected from 100 random samples comprising 10% and 20% of the modified dataset, respectively. The four Grad variants and Replace methods failed to reduce DI on three common datasets (EMP, PUC, and BAF), primarily due to consistent rejection by the KL based tests (100% rejection rate). This highlights the advantage of Entropic methods and the matching approach $M_{W(X,S,ŷ)}$, which avoids scenarios where $KL(Q_t, Q_n) = +\infty$, and thus performs more robustly. The results also underscore the influence of sample size: for example, in the PUC dataset, improvements were possible with 10% samples but not with 20%, indicating that

as the sample size increases (relative to the original dataset), it becomes more challenging to increase DI without detection. Overall, $M_{W(X,S,ŷ)}$ consistently achieves the best results. A visual illustration of this method's performance for a 10% sample size is shown in Fig. 1.

## 8 Conclusion and Perspectives

This work presents a comprehensive study of methods designed to manipulate data in order to satisfy the Disparate Impact (DI) criterion. We provide a theoretical analysis demonstrating why these methods can minimize the distance between the original and modified data distributions while satisfying fairness constraints. Our findings are supported by experiments on both simulated and real benchmark datasets.

Our results show that with the recursive Wasserstein-minimizing matching method, $M_{W(X,S,ŷ)}$, an auditee can very likely increase fraudulently the Disparate Impact without being detected by rigorous statistical tests. Hence supervisory authorities should be aware of the possibility that datasets may have been intentionally manipulated. Their countermeasure is first to use multiple statistical tests combining different geometrical properties of the distributions as shown in Table 4. However, it may still be insufficient in some cases, for instance, when the original DI is already close to the required threshold, or when the probability of observing ŷ is low. Yet, in more typical scenarios (e.g., when the DI increase is $\ge$ .1 and the predicted positive rate is $\ge$ 10%), these tests remain effective countermeasures for fraud detection, as demonstrated in our evaluation across multiple datasets. We show that a second option is to increase the sample size required from the auditee as seen in Fig 9. In this study, we primarily focused on tabular data due to the high impact of scoring algorithms in nowadays applications. So, our testing pipeline was specifically designed for such datasets. Yet our method can be extended for other type of data such as text or image. If distributional distances applied directly to raw image pixels or token distributions, may not be appropriate, similar techniques can be considered over higher-level representations, known as descriptors. Such approaches are already well-established in evaluating generative models, as exemplified in (Heusel et al. 2018). We presented some results in this direction that will be continued in a further work.

## Concluding Ethical Statement

This work explores the potential for malicious actors to manipulate dataset samples in order to falsely appear compliant with fairness regulations, specifically with respect to Disparate Impact, with possible extensions to other various fairness metrics. Our primary objective is to expose and analyze these vulnerabilities. We believe that research into adversarial strategies is essential to improving the robustness and reliability of fairness auditing procedures. By providing detailed methods for faking compliance, alongside statistical tests for detection, our intent is to support supervisory authorities and auditors in developing more resilient oversight mechanisms. We emphasize that our findings are not intended to be used as tools for deceptive practices. To this end, we have deliberately omitted full implementation details that would
lower the barrier to misuse, and we have focused our analysis on defensive strategies available to regulators. Moreover, the public release of our code is designed to assist the research community in building stronger auditing tools, not to enable audit circumvention. We encourage regulators and institutions to develop governance frameworks that anticipate such adversarial behavior and recommend routine adoption of statistical tests to verify the representativeness of audit samples.

## Acknowledgements

The authors are partially supported by the AI Interdisciplinary Institute and ANR Regulia, which is funded by the French "Investing for the Future – PIA3" program under the Grant agreement n°ANR-23-IACL-0002.

## References

Aivodji, U.; Alesi, P.; Gambs, S.; Huguenin, K.; Martínez, S. R.; and Roy, M. 2019. Fairwashing: the risk of rationalization. In *Proceedings of the 2019 AAAI/ACM Conference on AI, Ethics, and Society*, 160–166.

Anders, C.; Barocas, S.; Zittrain, J.; Kohli, P.; and Gomez-Rodriguez, M. 2020. Fairwashing explanations with optimal transport. https://arxiv.org/abs/2006.05241. ArXiv:2006.05241.

Angwin, J.; Larson, J.; Mattu, S.; and Kirchner, L. 2016. Machine Bias. *ProPublica*.

Bachoc, F.; Gamboa, F.; Halford, M.; Loubes, J.-M.; and Risser, L. 2023. Explaining machine learning models using entropic variable projection. *Information and Inference: A Journal of the IMA*, 12(3): 1686–1715.

Barocas, S.; Hardt, M.; and Narayanan, A. 2019. *Fairness and Machine Learning*. fairmlbook.org. Http://fairmlbook.org.

Barocas, S.; and Selbst, A. D. 2016. Big Data's Disparate Impact. *California Law Review*, 104: 671.

Becker, B.; and Kohavi, R. 1996. Adult. UCI Machine Learning Repository. DOI: https://doi.org/10.24432/C5XW20.

Bellamy, R. K. E.; Dey, K.; Hind, M.; and et al. 2018. AI Fairness 360 Open Source Toolkit. https://aif360.mybluemix.net.

Besse, P.; del Barrio, E.; Gordaliza, P.; Loubes, J.-M.; and Risser, L. 2022. A survey of bias in machine learning through the prism of statistical parity. *The American Statistician*, 76(2): 188–198.

Bird, S.; Dimmery, D.; and Walker, K. R. V. 2020. Fairlearn: A toolkit for assessing and improving fairness in AI. https://fairlearn.org.

Bourrée, J. G.; Godinot, A.; Vos, M. D.; Vujasinovic, M.; Biswas, S.; Tredan, G.; Merrer, E. L.; and Kermarrec, A.-M. 2025. Robust ML Auditing using Prior Knowledge. arXiv:2505.04796.

Calmon, F. P.; Wei, D.; Vinzamuri, B.; Ramamurthy, K. N.; and Varshney, K. R. 2017. Optimized pre-processing for discrimination prevention. *Advances in Neural Information Processing Systems (NeurIPS)*, 30.

Celis, L. E.; Straszak, D.; and Vishnoi, N. K. 2019. Fair distributions from biased samples. In *International Conference on Machine Learning (ICML)*, 1365–1374. PMLR.

Chakraborty, S.; Oudot, S.; and Vayatis, N. 2024. Constrained Reweighting of Distributions: an Optimal Transport Approach. https://arxiv.org/abs/2310.12447. ArXiv:2310.12447.

Chzhen, E.; Denis, C.; Hebiri, M.; Oneto, L.; and Pontil, M. 2020. Fair regression with Wasserstein barycenters. *Advances in Neural Information Processing Systems*, 33: 7321–7331.

Defazio, A.; Yang, X.; Mehta, H.; Mishchenko, K.; Khaled, A.; and Cutkosky, A. 2024. The Road Less Scheduled. arXiv:2405.15682.

Del Barrio, E.; Gordaliza, P.; and Loubes, J.-M. 2019. A central limit theorem for Lp transportation cost on the real line with application to fairness assessment in machine learning. *Information and Inference: A Journal of the IMA*, 8(4): 817–849.

Devlin, J.; Chang, M.-W.; Lee, K.; and Toutanova, K. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. arXiv:1810.04805.

Ding, F.; Hardt, M.; Miller, J.; and Schmidt, L. 2021. Retiring Adult: New Datasets for Fair Machine Learning. In Beygelzimer, A.; Dauphin, Y.; Liang, P.; and Vaughan, J. W., eds., *Advances in Neural Information Processing Systems*.

Equal Employment Opportunity Commission et al. 1978. Section 4D, Uniform guidelines on employee selection procedures.

Feldman, M.; Friedler, S. A.; Moeller, J.; Scheidegger, C.; and Venkatasubramanian, S. 2015. Certifying and removing disparate impact. In *proceedings of the 21st ACM SIGKDD international conference on knowledge discovery and data mining*, 259–268.

Fukuchi, K.; Hara, S.; and Maehara, T. 2020. Faking fairness via stealthily biased sampling. In *Proceedings of the AAAI Conference on Artificial Intelligence*, volume 34, 412–419.

Garcia-Borruey, D.; Loiseau, P.; and Le Merrer, E. 2023. Mitigating Fairwashing Using Two-Source Audits. https://arxiv.org/abs/2305.13883. ArXiv:2305.13883.

Gordaliza, P.; Del Barrio, E.; Fabrice, G.; and Loubes, J.-M. 2019. Obtaining fairness using optimal transport theory. In *International conference on machine learning*, 2357–2365. PMLR.

Gouic, T. L.; Loubes, J.-M.; and Rigollet, P. 2020. Projection to fairness in statistical learning. *arXiv preprint arXiv:2005.11720*.

Gretton, A.; Borgwardt, K. M.; Rasch, M. J.; Schölkopf, B.; and Smola, A. 2012. A Kernel Two-Sample Test. *Journal of Machine Learning Research*, 13(25): 723–773.

Groves, L.; Metcalf, J.; Kennedy, A.; Vecchione, B.; and Strait, A. 2024. Auditing work: Exploring the New York city algorithmic bias audit regime. In *Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency*, 1107–1120.
Hardt, M.; Price, E.; and Srebro, N. 2016a. Equality of opportunity in supervised learning. In *Advances in Neural Information Processing Systems (NeurIPS)*, 3315–3323.

Hardt, M.; Price, E.; and Srebro, N. 2016b. Equality of Opportunity in Supervised Learning. CoRR, abs/1610.02413.

He, K.; Zhang, X.; Ren, S.; and Sun, J. 2015. Deep Residual Learning for Image Recognition. arXiv:1512.03385.

Heusel, M.; Ramsauer, H.; Unterthiner, T.; Nessler, B.; and Hochreiter, S. 2018. GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium. arXiv:1706.08500.

Jacobs, D.; and Kalbers, L. P. 2019. Volkswagen emissions scandal.

Jesus, S.; Pombal, J.; Alves, D.; Cruz, A.; Saleiro, P.; Ribeiro, R. P.; Gama, J.; and Bizarro, P. 2022. Turning the Tables: Biased, Imbalanced, Dynamic Tabular Datasets for ML Evaluation. In *Advances in Neural Information Processing Systems*.

Jiang, R.; Pacchiano, A.; Stepleton, T.; Jiang, H.; and Chiappa, S. 2020. Wasserstein Fair Classification. In Adams, R. P.; and Gogate, V., eds., *Proceedings of The 35th Uncertainty in Artificial Intelligence Conference*, volume 115 of *Proceedings of Machine Learning Research*, 862–872. PMLR.

Kamiran, F.; and Calders, T. 2009. Classifying without discriminating. In *2nd International Conference on Computer, Control and Communication*, 1–6. IEEE.

Kamiran, F.; Karim, A.; and Zhang, X. 2012. Decision Theory for Discrimination-Aware Classification. In *2012 IEEE 12th International Conference on Data Mining*, 924–929.

Le Merrer, E.; and Trédan, G. 2020. Faking Fairness via Model Manipulation. In *Companion Proceedings of the Web Conference 2020*, 661–665.

Liu, Z.; Luo, P.; Wang, X.; and Tang, X. 2015. Deep Learning Face Attributes in the Wild. In *Proceedings of International Conference on Computer Vision (ICCV)*.

Lohaus, M.; Perrot, M.; and Luxburg, U. V. 2020. Too Relaxed to Be Fair. In III, H. D.; and Singh, A., eds., *Proceedings of the 37th International Conference on Machine Learning*, volume 119 of *Proceedings of Machine Learning Research*, 6360–6369. PMLR.

Lundberg, S.; and Lee, S.-I. 2017. A Unified Approach to Interpreting Model Predictions. arXiv:1705.07874.

Oneto, L.; and Chiappa, S. 2020. Fairness in machine learning. In *Recent trends in learning from data: Tutorials from the INNS big data and deep learning conference (INNSB-DDL2019)*, 155–196. Springer.

Peypouquet, J. 2015. *Convex Optimization in Normed Spaces*. Springer Cham.

Raji, I. D.; Smart, A.; White, R.; and et al. 2020. Closing the AI accountability gap: Defining an end-to-end framework for internal algorithmic auditing. In *Proceedings of the 2020 ACM Conference on Fairness, Accountability, and Transparency*, 33–44. ACM.

Ribeiro, M. T.; Singh, S.; and Guestrin, C. 2016. "Why Should I Trust You?": Explaining the Predictions of Any Classifier. arXiv:1602.04938.

Santambrogio, F. 2015. *Optimal Transport for Applied Mathematicians. Calculus of Variations, PDEs and Modeling*. Birkhäuser Cham.

Shamsabadi, A.; Douzal-Chouakria, A.; Contissa, G.; and Lepri, B. 2023. Is Fairwashing Provably Undetectable? https://arxiv.org/abs/2303.10427. ArXiv:2303.10427.

Slack, D.; Hilgard, S.; Jia, E.; Singh, S.; and Lakkaraju, H. 2020. Fooling LIME and SHAP: Adversarial Attacks on Post hoc Explanation Methods. https://arxiv.org/abs/1911.02508. ArXiv:1911.02508.

Szegedy, C.; Vanhoucke, V.; Ioffe, S.; Shlens, J.; and Wojna, Z. 2015. Rethinking the Inception Architecture for Computer Vision. arXiv:1512.00567.

Wang, X.; Zhang, Y.; and Zhu, R. 2022. A brief review on algorithmic fairness. *Management System Engineering*, 1(1): 7.

Wright, L.; Muenster, R. M.; Vecchione, B.; Qu, T.; Cai, P.; Smith, A.; Investigators, C. S.; Metcalf, J.; Matias, J. N.; et al. 2024. Null Compliance: NYC Local Law 144 and the challenges of algorithm accountability. In *Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency*, 1701–1713.

Yamamoto, Y.; and Hara, S. 2025. Fast Stealthily Biased Sampling Using Sliced Wasserstein Distance. In Nguyen, V.; and Lin, H.-T., eds., *Proceedings of the 16th Asian Conference on Machine Learning*, volume 260 of *Proceedings of Machine Learning Research*, 873–888. PMLR.

Yan, T.; and Zhang, C. 2022. Active Fairness Auditing. arXiv:2206.08450.
# Appendix

## A Other fairness metrics

In our paper, we focused on the Disparate Impact (DI) fairness metric, as it is one of the most widely used metrics. While this choice is justified, it is natural to wonder whether our results are specific to this metric or whether they are metric-agnostic.

Our fair-washing method could have been implemented to minimize the distribution shift while being constrained to other global fairness metrics as long as we can write them as an integrable function or a combination of integrable functions. This condition is not very restrictive in our case. In fact, it only excludes the individual fairness metric, whereas most global fairness metrics can still be expressed in the required form.

To prove this point, we decided to implement our best-performing method, the $M_{W(X,S,\hat{Y})}$ for the Equality of Odds (EoO) metric :

$$EoO = |\mathbb{P}(\hat{Y} = 1|S = 1 \land Y = 1) - \mathbb{P}(\hat{Y} = 1|S = 0 \land Y = 1)|$$

Note that similarly to the Disparate Impact, which is the multiplicative counterpart of the Disparate Parity, we could have taken the multiplicative definition of the EoO. However, we choose the additive definition because the multiplicative case is trivial for us, as we could have directly applied our DI-fair-washing method on the $Q_{n,Y=1}$.

The only difference to the matching method $M_{W(X,S,\hat{Y})}$ going from DI constraint to EoO constraint is, following the notation of Section 5.3, iteratively from maximizing the left part of Eq. 15 to its right part.

$$\frac{\mathrm{DI}(\tau_{i_0}(Z^j)) - \mathrm{DI}((Z^j))}{\|\tau_{i_0}(Z^j) - Z^j\|} \rightarrow \frac{\mathrm{EoO}(\tau_{i_0}(Z^j)) - \mathrm{EoO}((Z^j))}{\|\tau_{i_0}(Z^j) - Z^j\|} \quad (15)$$

The minus sign comes from the difference between the fairness metric : an independence toward the sensitive variable $S$ for the Disparate Impact implies $DI = 1$, we therefore try to maximize the DI. On the other hand, independence for the EoO implies $EoO = 0$, leading us to minimize this criterion (i.e., maximizing minus the criteria). We illustrate this capacity in Fig. 6.

<figure><img src="image_7.png" /><figcaption>Figure 6: Distribution shift of Wasserstein distance, KL divergence and MMD, when constraining the Equality of Odds (EoO) metric on the Adult dataset using the $M_{W(X,S,Y)}$ method minimizing the EoO.</figcaption></figure>

## B Comparison with other fair-washing methods

### B.1 Bias mitigation methods as fair-washing methods

As discussed in the introduction, bias mitigation methods can also be misused to artificially improve fairness metrics, thereby creating the illusion of fairness while concealing underlying biases. Several such methods have been proposed in the literature, including the approach presented in (Bourrée et al. 2025), that we reference here, such as ROC Mitigation (Kamiran, Karim, and Zhang 2012), Optimal Label Transport (OT-L) (Jiang et al. 2020), Linear Relaxation (LinR) (Lohaus, Perrot, and Luxburg 2020), and Threshold Manipulation (ThreshOpt) (Hardt, Price, and Srebro 2016b).

We directly compare these approaches to the Replace $(X, S, \hat{Y})$ method. This method, like the others mentioned, modifies the decision-making process based on the sensitive attribute $S$, for example by applying different decision thresholds conditioned
on *S*. This common dependency on *S* makes these methods similar in spirit to Replace (*X*, *S*, *ŷ*), as the fairness outcome is explicitly linked to sensitive attributes. However, a key distinction is that methods like ROC Mitigation or OT-L typically yield reproducible, model-dependent outcomes, while Replace (*X*, *S*, *ŷ*), as explained in Section 5.3, cannot be applied in audits where auditors have direct access to the model and its decision thresholds.

Nevertheless, from the perspective of a supervisory authority, all these methods share a fundamental limitation. Since supervisory audits in our framework employ statistical tests based on the Kullback-Leibler (KL) divergence, these methods are easily detectable. Specifically, because they generate *new* synthetic individuals, the KL divergence between the original and manipulated distributions satisfies KL(*Q*<sub>*n*</sub>, *Q*<sub>*t*</sub>) = +∞.

One might ask whether the Wasserstein distance provides a more suitable metric. However, since these methods do not modify the covariates *X* ((Gouic, Loubes, and Rigollet 2020) projects individuals towards their Wasserstein barycenter only to change the network's output), the global Wasserstein distance remains unchanged, i.e., W(*Q*<sub>*n*</sub><sub>*, ŷ*</sub>, *Q*<sub>*t*</sub><sub>*, ŷ*</sub>) = 0. Regarding the Wasserstein distance between (*S*, *ŷ*), W(*Q*<sub>*n*<sub>*, ŷ*</sub><sub>*, ŷ*</sub></sub>, *Q*<sub>*t*<sub>*, ŷ*</sub><sub>*, ŷ*</sub></sub>), the choice of method has minimal impact, since the distance is computed within the finite set of categorical bins *S*, *ŷ* ∈ {0, 1}<sup>2</sup>.

## B.2 Comparison with fairness manipulation via the Stealthily Biased Sampling (SBS) method (Fukuchi, Hara, and Maehara 2020)

**Technical insecurities** When following the installation instructions from their GitHub page, we encountered a problem. Indeed, the CMake version the authors used was 2.8 which is no longer supported with CMake (oldest version supported is 3.5); when changing in the CMake file the minimum version to 3.5, we had encountered another error with their (CMake_policy(set CMP0048 OLD)) which is no longer supported as well, we change it to the new version and ended up with a warning but could continue from there.

When we use the command make, we had the warning that "ISO C++17 does not allow 'register' storage class specifier", and other warnings with "this statement may fall through" associated with if statement or case statement.

However, when we used 'make' for each of the stealth-sampling and wasserstein files, it went without any issues or warning, hence, we attempted to replicate their experiments; the provided random seed should have ensured identical results.

The authors did not use a requirement file, or specify which version of libraries to use. Hence, some errors within their code appear, mainly discrepancies between the former and new behavior of numpy. We modified the code for it to work with the latest version of the different libraries, while keeping the exact intended functioning.

<table><caption>Table 5: Old and new results of the SBS method on the Adult dataset, '—' means that the new version has exactly the same result as the old one.</caption><thead><tr><th></th><th>Version</th><th>Accuracy</th><th>DP</th><th>WD on Pr[x]</th><th>WD on Pr[x—s=1]</th><th>WD on Pr[x—s=0]</th></tr></thead><tbody><tr><td rowspan="2">Baseline</td><td>Old</td><td>0.851</td><td>0.1824</td><td>22.1638</td><td>25.6454</td><td>35.0421</td></tr><tr><td>New</td><td>0.85115</td><td>—</td><td>—</td><td>—</td><td>—</td></tr><tr><td rowspan="2">Case-control</td><td>Old</td><td>NaN</td><td>0.0250</td><td>23.9060</td><td>22.5855</td><td>37.9543</td></tr><tr><td>New</td><td>NaN</td><td>0.0243</td><td>23.2002</td><td>23.3179</td><td>37.8548</td></tr><tr><td rowspan="2">Stealth</td><td>Old</td><td>NaN</td><td>0.0712</td><td>23.6396</td><td>24.2404</td><td>36.1657</td></tr><tr><td>New</td><td>NaN</td><td>0.0708</td><td>24.1415</td><td>25.1640</td><td>35.5028</td></tr></tbody></table>

As you can see in Table 5, we observed a slight mismatch between the value they obtained and the value we obtained running exactly their code. This might indicate that because of the warnings we mentioned above, the performance was affected; or it could simply also be a different behavior from the newer version of libraries, and our result might actually be more representative. As you can see on Fig. 7, the aggregated results are alike. The authors would have obtained the same results and thus produced the same paper, we choose to use this implementation instead of "their" Sliced Wasserstein Distance method (Yamamoto and Hara 2025), which compromises slightly the results for a significant boost in computational time.

<figure><img src="image_8.png" /><figcaption>Figure 7: Original (Old) and Latest (New) results for their synthetic datasets, the experiments were done with 30 runs for several different α.</figcaption></figure>
**Explanation of the SBS method** This method was designed to minimize the distribution shift measured by W(X) under a fairness constraint on the disparate parity:

$$DP = |\mathbb{P}(\hat{Y} = 1|S = 1) - \mathbb{P}(\hat{Y} = 1|S = 0)|$$

Notably, the method does not allow specifying a target threshold *t* for the fairness criterion. Instead, the authors designed their sampling procedure to produce a perfectly fair dataset, such that DP = 0 in expectation. The only tunable hyperparameter is the common acceptance rate for positive outcomes, denoted by $\alpha := \mathbb{P}(\hat{Y} = 1|S = 1) = \mathbb{P}(\hat{Y} = 1|S = 0)$.

This lack of flexibility in selecting a targeted DP complicates direct comparisons. As demonstrated in our paper, achieving fairness solely to pass compliance checks (i.e., fair-washing) often remains detectable by our statistical tests. To evaluate robustness, we progressively relax the fairness constraint until samples evade detection. Such adaptive calibration is not feasible with their approach.

One practical advantage of their method is that it outputs individual sampling probabilities rather than a fixed dataset, similar to our Entropic approach. This allows us to resample and generate distributions with varying degrees of fairness.

Their reported results were obtained via grid search over $\alpha$ values, as illustrated in Figure 10. Consequently, to benchmark their method, we either had to identify the optimal $\alpha$ minimizing distribution shift or evaluate performance across all tested $\alpha$ values.

This method's high computational cost, already acknowledged by the authors in a subsequent paper (Yamamoto and Hara 2025), is a notable limitation. Due to these computational constraints, we applied their method exclusively on the Adult dataset, as experiments on larger datasets failed to complete within reasonable time frames.

**Result of the SBS method in our audit** In this section, we evaluate on the Adult dataset: (1) the distribution shift incurred when creating a fair distribution (DI($Q_t$) > 0.8) and (2) the maximum achievable DI without detection by our statistical tests. The first comparison (1) is well-aligned with the purpose of the method, which targets compliance. However, the second (2) inherently disadvantages their approach, as it was not designed to trade off fairness against detectability.

<table><caption>Table 6: Metric result of the fair-washing method (DI($Q_t$) ≥ 0.8), cost calculated on the projected dataset (or projected distribution for Entropic and SBS) on the Adult dataset.</caption><thead><tr><th rowspan="2">Dataset</th><th colspan="9">Unbiasing Methods</th></tr><tr><th>SBS</th><th>Grad_p</th><th>Grad_b</th><th>Grad_p_1D</th><th>Grad_b_1D</th><th>Rep (S, Ŷ)</th><th>M<sub>W(X,S,ŷ)</sub></th><th>Entr_b</th><th>Entr_p</th></tr></thead><tbody><tr><td>W(X, S, Ŷ)</td><td>0.91</td><td>0.10</td><td>0.08</td><td>0.13</td><td>0.09</td><td><strong>0.05</strong></td><td><strong>0.06</strong></td><td>0.28</td><td>0.35</td></tr><tr><td>W(S, Ŷ)</td><td><strong>0.00</strong></td><td>0.09</td><td>0.08</td><td>0.09</td><td>0.08</td><td>0.05</td><td>0.05</td><td>0.08</td><td>0.09</td></tr><tr><td>KL(X, S, Ŷ)</td><td>0.73</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>0.03</td><td><strong>0.02</strong></td><td>0.03</td></tr><tr><td>KL(S, Ŷ)</td><td>0.73</td><td>0.02</td><td>0.02</td><td>0.02</td><td>0.02</td><td>0.03</td><td>0.03</td><td>0.02</td><td>0.03</td></tr></tbody></table>

Regarding $d(Q_n, Q_t)$, their method, like our Entropic approaches, produces sampling probabilities rather than a direct sample. This yielded strong performance on W(S, Ŷ), but it underperformed on KL(S, Ŷ) and did not stand out on W(X, S, Ŷ). For KL(S, Ŷ), it was less competitive, though it notably avoided divergence to infinity, making it one of the more globally competitive Wasserstein-based methods.

<table><caption>Table 7: Highest undetected achievable Disparate Impact for the Adult dataset, for each sample size (S Size) and fair-washing method. The symbol – indicates that some methods couldn't reach a DI improvement. To emphasize the best method to use in order to deceive the auditor, we put the DI achieved in bold when one or two over-performed the others. We remind that the original DI of our Adult dataset is 0.30.</caption><thead><tr><th>Dataset</th><th>S size (%)</th><th>SBS</th><th>Grad_p</th><th>Grad_b</th><th>Grad_p 1D</th><th>Grad_b 1D</th><th>Rep (S, Ŷ)</th><th>Entr_b</th><th>Entr_p</th><th>M<sub>W(X,S,ŷ)</sub></th></tr></thead><tbody><tr><td rowspan="2">ADULT</td><td>10</td><td>0.47</td><td>0.47</td><td>0.43</td><td>0.49</td><td>0.44</td><td>0.50</td><td><strong>0.54</strong></td><td>0.52</td><td><strong>0.54</strong></td></tr><tr><td>20</td><td>–</td><td>0.39</td><td>0.40</td><td>0.38</td><td>0.39</td><td>0.41</td><td><strong>0.42</strong></td><td>0.41</td><td><strong>0.42</strong></td></tr></tbody></table>

Conversely, as shown in Table 7, the method is not suitable for maximizing fairness without detection. To assess this, we computed 500 samples from each tuple sample size, $\alpha$ and observed whether the samples passed our statistical tests. Across 500 * 10 * 2 samples (10 $\alpha$ and 2 sample size), 5 samples passed the 7 statistical tests, they were all for $\alpha$ = 0.25 and sample size of 10% (instead of 20%).
## C Extension to other data type

The method we develop is originally meant to handle tabular data. However we propose some natural direction to extend this work to text or images. The distances used to evaluate Wasserstein distance or the Maximum Mean Discrepancy (MMD) relies on the inherent informative information between individual within the input space, in another word they rely on the fact that the distance between individual is proportional to their semantic similarity. This hypothesis is always verified on tabular data (with the $L_2$ distance, for instance), but it might not be on images or token distributions. We will first evaluate our method based on $W(X)$ or MMD($X$) to detect fraud attempt and expect the method to achieve a lower efficiency because $d(Q_t, Q_n)$ is hardly related to the semantic meaning of the images. Thus a fair-washing manipulation might not change this distance distribution.

Hence we embed the images in another space, where the regular distances have semantic meanings. The construction of such a space has already seen numerous works, including Principal Component Analysis, using the latent space of Auto-encoder or Variational Auto-Encoder, or using the latent space of Convolutional Neural Network classifiers. Using such space, which we call descriptor $D$, have become common practice after the introduction of the Fréchet Inception Distance (FID)(Heusel et al. 2018). We define the function $E$ such as

$$E: \mathbb{R}^N \to \mathbb{R}^m \qquad N, m \in \mathbb{N}, N \gg m \\ X \mapsto E(X) = D$$

and set $E(Q) := \{E(X) | X \in Q\}$ if $Q$ is a distribution. We choose in the following latent features given by the CNN classifier.

### C.1 Experimental settings

We audited the CelebA dataset (Liu et al. 2015): predicting the attractiveness, with the sensitive attribute being having heavy makeup. We note here that we choose this sensitive attribute instead of others for mainly two reasons:

1. Low DI: 0.4 on the whole dataset

2. Representativeness: Similarly to what we saw for the BAF dataset having a low probability of $P(Y = 1) = 0.01$, If the sensitive variable was too rare, then detecting a modification on $X$ would be impossible (for tabular or non-tabular data)

Note also that the variable *young* would have been another viable candidate.

The fair-washing method used in those experiments is the Wasserstein-based matching method $M_{W(X,S,Y)}$. We fine-tune 3 CNN models: an InceptionV3 (Szegedy et al. 2015), a ResNet18 and a ResNet101 (He et al. 2015) on CelebA and select part of the test set to audit, on this subset we observe respectively a DI of 0.34, 0.35 and 0.35. The malicious auditee, aware that the statistical tests on the covariates $X$ might not be on the pixels of the images, but on the descriptor of the images, could minimize $d(E(Q_n), E(Q_t))$ instead of $d(Q_n, Q_t)$. Therefore, we consider 6 different fair-washing scenarios given (1) the network choice amongst ResNet18, InceptionV3 and ResNet101 which implies different descriptors' space and (2) if the auditee optimized the Wasserstein-based matching method on the pixel's space or on the latent space of those models. We first investigate the use of statistical tests directly of the pixels' space. Secondly, for each of the above scenario, we use statistical tests based of the latent space of the CNN. We remind here that (1) in term of complexity, the CCN are ranked as follow: ResNet18 (11 million parameters) < InceptionV3 (27 million parameters) < ResNet101 (44 million parameters), (2) the latent space of the CNN is the space at the hidden layer before the last linear layer, for the three models above's latent space share the same dimension size of 1000.

### C.2 Topics of Interest and Answers

In this subsection, we present key questions of interest and provide direct answers. These answers are supported by selected (cherry-picked) results for illustrative purposes, we refer to Table 8 for complete results on the descriptors analysis results. We address the following questions:

1. Are the statistical tests presented in our paper for tabular data relevant for non-tabular data?

* Yes. We consider several data-agnostic statistical tests, such as $W(S, Y)$, MMD($S, Y$), KL divergence, and the KS test. These tests remain applicable regardless of data type.

* What about tests based on $W(X, S, Y)$ or MMD($X, S, Y$), which rely on $W(X)$ or MMD($X$) where $X$ is high-dimensional? Tests conducted directly in pixel space can be useful. For example, fair-washing attempts with a sampling size of 20% were detected using tests applied directly to raw pixel values. In contrast, with a sampling size of 10%, and fair-washing to a Disparate Impact (DI) of 0.95, the null hypothesis $H_0$ was not rejected, this indicates that these manipulations may go undetected at smaller sampling sizes.

2. Are statistical tests based on learned descriptors more effective?

* Yes. Descriptor-based tests can detect fair-washing even with smaller samples. For instance, fraud attempts were identified using only 10% of the CelebA dataset (noting that detection becomes harder with smaller samples).

* However, the auditee could potentially optimize their manipulation based on the descriptor used by the auditor, rendering these tests ineffective again at the 10% sample size.
3. Is the choice of the descriptor impactful ?

• Yes, the results do depends on both the auditee choice of descriptor as well as the descriptor used in the statistical tests.

• Yes for the manipulation: it was harder to detect manipulation based on the ResNet18 descriptors, and the easiest was the manipulation based on the ResNet101 descriptors. For instance, for the sampling size of 20%, even while testing using the ResNet101 descriptors, for a fair-washing at DI = 0.55, it was undetected when optimizing using ResNet18 descriptors but detected when optimizing using ResNet101's one (by "detected", we mean that across multiple samples, 50 in this case, none accepted the null hypothesis H₀, i.e., the hypothesis that the sample and original distributions are the same.).

• Yes for the fraud detection: Statistical tests based on the ResNet18 was more easily fooled by manipulation. To support this claim, we refer to for example to the last three columns of the Table 8 where with optimization on the image pixels, for a 10% sampling size, no fair-washing method was detected even with DI = 0.95.

4. Is there a difference using statistical tests based on the latent space the auditee's fair-washing method optimized on?

• No, our results are not conclusive enough to answer this question positively. For InceptionV3 and ResNet101, we did not observe a significant difference.

• That being said, in our experiments, with a 20% sampling size and fair-washing to DI = 0.60, only the auditee optimizing on the same descriptors (ResNet18) was able to generate an undetected sample when the test was based on those same descriptors.

• Importantly, in practice, it is unlikely that the supervisory authority would use the same descriptors as the auditee. Even if the authority had full access to the auditee's network (which is rare, since this would go beyond API access), they may deliberately avoid using the same descriptors to prevent optimization-based circumvention.

In conclusion, on non-tabular modalities, running statistical tests directly on raw signals (in our cases pixels) is not useless, but tests in a learned descriptor space are markedly more sensitive. The choice of descriptor is critical: tests based on higher-capacity, semantically rich encoders (e.g., ResNet101) are substantially more robust to manipulations. We therefore recommend that supervisory authorities apply statistical tests both on the raw data and in a high-quality descriptor space. For text datasets, though not evaluated here, a natural first descriptor we would recommend is the CLS embedding from a BERT-style model (Devlin et al. 2019), we leave this for a further work.

<table><caption>Table 8: Highest DI without being detected for the CelebA Dataset using the matching fair-washing method based on different minimization objective testing on the descriptors which are the latent space of the different models, for sample size of 10% and 20%. The different scenarios are the following: 18, 101 and v3 are respectively a ResNet18, a ResNet101 and an Inceptionv3 optimized on their latent space; the 18 pixels, 101 pixels and v3 pixels are the methods optimized on the pixel space (even if they have the same objective, they are different because the prediction of each network might be different).</caption><thead><tr><th rowspan="2">Descriptors</th><th rowspan="2">Size (%)</th><th colspan="7">Fair-washing minimization objective</th></tr><tr><th>18</th><th>101</th><th>v3</th><th>18 pixels</th><th>101 pixels</th><th>v3 pixels</th></tr></thead><tbody><tr><td rowspan="2">ResNet18</td><td>10</td><td>≥ 0.95</td><td>≥ 0.95</td><td>≥ 0.95</td><td>≥ 0.95</td><td>≥ 0.95</td><td>≥ 0.95</td></tr><tr><td>20</td><td>[0.6 - 0.7]</td><td>[0.5 - 0.55]</td><td>[0.5 - 0.55]</td><td>[0.4 - 0.5]</td><td>[0.4 - 0.5]</td><td>[0.4 - 0.5]</td></tr><tr><td rowspan="2">Inceptionv3</td><td>10</td><td>≥ 0.95</td><td>≥ 0.95</td><td>[0.8 - 0.95]</td><td>≥ 0.95</td><td>[0.8 - 0.95]</td><td>[0.8 - 0.95]</td></tr><tr><td>20</td><td>[0.55 - 0.6]</td><td>[0.5 - 0.55]</td><td>[0.5 - 0.55]</td><td>[0.4 - 0.5]</td><td>[0.4 - 0.5]</td><td>[0.4 - 0.5]</td></tr><tr><td rowspan="2">ResNet101</td><td>10</td><td>≥ 0.95</td><td>≥ 0.95</td><td>≥ 0.95</td><td>≥ 0.95</td><td>≥ 0.95</td><td>[0.7 - 0.8]</td></tr><tr><td>20</td><td>[0.55 - 0.6]</td><td>[0.5 - 0.55]</td><td>[0.55 - 0.6]</td><td>[0.4 - 0.5]</td><td>[0.4 - 0.5]</td><td>[0.4 - 0.5]</td></tr></tbody></table>

# D Auxiliary results

**Proposition D.1.** Consider the following minimization problem

$$ \min W_2^2(P, Q_n) \text{ such that } \int_E \Phi(x) dP(x) \ge t. \qquad (16) $$

Then $Q_t$ is optimal for (16) if, and only if, it is defined as the push-forward

$$ Q_t = T_{\lambda^*} \# Q_n $$

where $T_{\lambda}(y) \in \arg\min_x \{\|x - y\|^2 - \lambda^T \Phi(x)\}$ and and then $\lambda^* \in \mathbb{R}^k_{\ge 0}$ solves

• $\int_E \Phi(T_{\lambda^*}(x)) dQ(x) \ge t$,

• and $\langle \lambda^*, t - t_{\lambda^*} \rangle = 0$
E Proofs

E.1 Proof of Proposition 4.2

Proof. Theorem 4.1 implies the existence of a distribution $Q_t$ such that

$$
DI(f, Q_t) = \frac{\lambda_0 + \delta_0 n_1}{\lambda_1 - \delta_1 n_0} = t_1.
$$

We have

$$
\Delta_{DI} = \frac{n_1}{n_0} \left( \frac{\lambda_1 \delta_0 + \lambda_0 \delta_1}{(\lambda_1 - \delta_1) \lambda_1} \right)
$$

Among all possible solutions, we privilege the two solutions described in the Proposition. Knowing the new DI desired, we can
obtain a set of solution for $\delta_0$ and $\delta_1$.

Proof of Theorem 5.1

*Proof.* First, notice that the definition of $T_\lambda$ implies

$$
\begin{align*}
W_2^2(Q_n, T_{\lambda\#}Q_n) &\le \int_E \|T_\lambda(y) - y\|^2 dQ_n(y) \\
&= \int_E \|T_\lambda(y) - y\|^2 dQ_n(y) + \frac{1}{n} \left( \sum_{i=1}^n \lambda^\top \Phi(T_\lambda(Z_i)) - \sum_{i=1}^n \lambda^\top \Phi(T_\lambda(Z_i)) \right) \\
&= \int_E \|T_\lambda(y) - y\|^2 - \lambda^\top \Phi(T_\lambda(y)) dQ_n(y) + \int_E \lambda^\top \Phi(y) dT_{\lambda\#} Q_n(y) \\
&= \int_E \inf_x \{\|x-y\|^2 - \lambda^\top \Phi(x)\} dQ_n(y) + \int_E \lambda^\top \Phi(y) dT_{\lambda\#} Q_n(y) \\
&= \int_E (\lambda^\top \Phi)^c(y) dQ_n(y) + \int_E \lambda^\top \Phi(y) dT_{\lambda\#} Q_n(y).
\end{align*}
$$

Strong duality of the Kantorovich problem, see (Santambrogio 2015), guarantees that this inequality is indeed an equality. Since our equality constraint is linear, a necessary and sufficient condition for P* to be a minimizer, see (Peypouquet 2015), is finding Lagrange multipliers $\lambda_1, \dots, \lambda_k \in \mathbb{R}$ such that

$$
\sum_{i=1}^{k} \lambda_i \nabla g_i(P^*) \in \partial f(P^*) \quad \text{(extremality condition)} \\
g(P^*) = 0 \quad \text{(feasibility)}
$$

where $g(P) = \int_E \Phi(x)dP(x) - t$ and $f(P) = W_2^2(P, Q_n)$. The subgradient of $f$ is given, see Proposition 7.17 in (Santambrogio 2015), by the set of Kantorovich potentials between $P^*$ and $Q$:

$$
\partial f(P^*) = \left\{ \phi \in C(E) \mid \int \phi dP^* + \int \phi^c dQ = W_2^2(P^*, Q) \right\}. \quad (17)
$$

Our computations above prove the extremality condition for $P^* = T_{\lambda^*} \# Q_n = \frac{1}{n} \sum_{i=1}^n \delta_{T_{\lambda^*}(Z_i)}$ since $\nabla g_i(P) = \int \Phi dP$. The feasibility condition for the empirical measure $Q_n$ is to find $\lambda^*$ such that

$$
t = \int_E \Phi(y) dT_{\lambda^*} Q_n(y) = \frac{1}{n} \sum_{i=1}^{n} \Phi(T_{\lambda^*}(Z_i)). \quad (18)
$$

Proof of Proposition D.1

Proof. Let $g$ be the continuous function $g(P) = t - \int_E \Phi(x)dP(x)$ and $f(P) = W_2^2(P, Q)$. The set $\{P \in \mathcal{M}(E) \mid \int_E \Phi(x)dP(x) \ge t\} = g^{-1}([0, \infty))$ is closed for the weak convergence as $[0, \infty)$ is closed. Then the projection problem is well-defined. Before applying the Lagrange multiplier theorem, we must verify Slater's condition. By continuity of $\Phi_i$ and compacity of $E$ we can consider, for $i = 1, \dots, k$, $x_0^i \in E$ such that $\Phi_i(x_0^i) = \min_{x \in E} \Phi_i(x)$. Take $\alpha \in \mathbb{R}$ such that
$\max_{1 \le i \le k} t_i / \Phi_i(x_0^i) < \alpha$. Then $\bar{P} = \alpha \delta_{x_0^i}$ satisfies $g_i(\bar{P}) < 0$ for $i = 1, \dots, k$. The Lagrange multipliers theorem guarantees that $P^*$ is optimal for 16 if, and only if, there exists $\lambda_1, \dots, \lambda_k \ge 0$ such that

$$ \sum_{i=1}^{k} \lambda_i \nabla g_i(P^*) \in \partial f(P^*) \quad (\text{extremality condition}) $$

$$ g(P^*) \le 0 \quad \text{and} \quad \lambda_i g_i(P^*) = 0 \quad \text{for all } i = 1, 2, \dots, k \text{ (feasibility)} $$

The proof of the extremality condition is completely analogous to the proof of Theorem 5.1, replacing $Q_n$ by $Q$. To conclude, we need to find $\lambda^* \in \mathbb{R}_{\ge 0}^k$ such that the feasibility condition is satisfied:

$$ t \le \int_E \Phi(T_{\lambda^*}(x)) dQ(x) \quad \text{and} \quad \lambda^* \top \left( t - \int_E \Phi(T_{\lambda^*}(x)) dQ(x) \right) = 0. \quad (19) $$

<figure><img src="image_9.png" /></figure>

## E.2 Joint convexity of the Wasserstein distance under mixture-preserving coupling

Let $Q_n$ and $Q_t$ be probability distributions over $\mathcal{X} \times \{0, 1\}$, where $X \in \mathcal{X}$ denotes the data and $S \in \{0, 1\}$ is a binary group attribute.

For each $s \in \{0, 1\}$, define the conditional distributions:

$$ Q_{n,s} := Q_n(\cdot | S = s), \quad Q_{t,s} := Q_t(\cdot | S = s), $$

and let $\pi := Q_n(S = 1) \in [0, 1]$. Then, define the marginal (mixture) distributions over $\mathcal{X}$ as:

$$ \mu := \pi Q_{n,1} + (1 - \pi) Q_{n,0}, \quad \nu := \pi Q_{t,1} + (1 - \pi) Q_{t,0}. $$

We prove the inequality:

$$ W_2^2(\mu, \nu) \le \pi W_2^2(Q_{n,1}, Q_{t,1}) + (1 - \pi) W_2^2(Q_{n,0}, Q_{t,0}). $$

*Proof.* Let $\gamma_1 \in \Pi(Q_{n,1}, Q_{t,1})$ and $\gamma_0 \in \Pi(Q_{n,0}, Q_{t,0})$ be couplings between the corresponding conditionals. Define the coupling:

$$ \gamma := \pi\gamma_1 + (1 - \pi)\gamma_0. $$

Then $\gamma \in \mathcal{P}(\mathcal{X} \times \mathcal{X})$, and its marginals are:

$$ \gamma^X = \pi Q_{n,1} + (1 - \pi) Q_{n,0} = \mu, \quad \gamma^Y = \pi Q_{t,1} + (1 - \pi) Q_{t,0} = \nu. $$

Thus, $\gamma \in \Pi(\mu, \nu)$ is a valid coupling between $\mu$ and $\nu$.

Now compute the transport cost under $\gamma$:

$$ \int_{\mathcal{X} \times \mathcal{X}} d(x, y)^2 d\gamma(x, y) = \pi \int d(x, y)^2 d\gamma_1(x, y) + (1 - \pi) \int d(x, y)^2 d\gamma_0(x, y), $$

(Because the distance is an integrable function, we can use the linearity of the Lebesgue integral with respect to measures)

$$ = \pi W_2^2(Q_{n,1}, Q_{t,1}) + (1 - \pi) W_2^2(Q_{n,0}, Q_{t,0}). $$

Since $W_2^2(\mu, \nu)$ is the infimum of such costs over all couplings in $\Pi(\mu, \nu)$, we obtain:

$$ W_2^2(\mu, \nu) \le \pi W_2^2(Q_{n,1}, Q_{t,1}) + (1 - \pi) W_2^2(Q_{n,0}, Q_{t,0}). $$

<figure><img src="image_10.png" /></figure>

## F Results with Simulated dataset

We create a simulated dataset to cover all possible cases where $S \in \{0, 1\}$ and $\hat{Y} \in \{0, 1\}$. The simulation parameters control $\mathbb{E}(S)$, $\mathbb{E}(\hat{Y} | S = 0)$, and $\mathbb{E}(\hat{Y} | S = 1)$, allowing us to represent a wide range of scenarios. Fig 8 presents two logistic regression graphs illustrating how the distance between the complete original and 20% of manipulated data evolves from the initial Disparate Impact (before debiasing), to reach a DI=0.8, for our different correction methods. Methods with the highest KL and Wasserstein distance implies a high risk of being detected by a statistical test on the distribution. The lower the initial DI, the greater the change required to reach an acceptable DI (making fraud detection more likely). When the original DI is $\ge 0.55$, the methods Entropic, Replace and Matching are equivalent in terms of KL divergence. Regarding the Wasserstein distance, they become equivalent for original DI values $\ge 0.65$. Since the Sample method does not modify the original data, it preserves the distributional distances (KL and Wasserstein), and can be used as a reference: when the logistic regression score of a method is lower than that of Sample, we can infer that the modified dataset would not be detected as significantly different from the original according to these criteria. Among all methods, $M_{W(X,S,\hat{Y})}$ with an original DI $\in [0.45, 0.70]$ achieves the best trade-off between KL divergence and Wasserstein distance, reaching the required DI while keeping the modified distribution close to the original.
<figure><img src="image_11.png" /><figcaption>Figure 8: Logistic regression plots showing how the distance (left: $KL_{(S,\hat{Y})}$ and right: $W_{(S,\hat{Y})}$) between the original and 20% of manipulated datasets varies with the initial Disparate Impact for each unbiased method, with the manipulated dataset having DI = 0.8. The sample's results in the legend represent values from random samples from the original distribution $Q_n$.</figcaption></figure>

## G Further studies on the impact of the sample size

In our conclusion, we recommended strongly to the referring authorities, that in order to prevent undetectable fraud, with appropriate statistical tests, requiring a bigger sample size is one of the single most important point. To further support this claim, we provide in this section a study on the sample size impact on the Adult dataset.

Using the best performing fair-washing method ($M_{W(X,S,Y)}$, Entropic_balanced and Entropic_proportional), we observe on Fig. 9 the highest DI achievable without being detected by our 7 statistical tests depending on the sample size required.

<figure><img src="image_12.png" /><figcaption>Figure 9: Highest undetected DI achieved without being detected in the Adult dataset by different fair-washing methods depending on the sample size.</figcaption></figure>

## H More information on the methods

### H.1 Replacing key attributes and Wasserstein-minimizing sampling

In this section, we precise how Disparate Impact (DI) can be increased using methods based on optimal transport. We can exchange between the 4 bins of points :($Y$ = 0, $S$ = 0), ($Y$ = 0, $S$ = 1), ($Y$ = 1, $S$ = 0) and ($Y$ = 1, $S$ = 1), thus $4(4-1) = 12$ possible alterations. Due to the definition of DI, we can exclude the path from ($Y$ = 1, $S$ = 0) to ($Y$ = 0, $S$ = 0) and the path from ($Y$ = 1, $S$ = 1) to ($Y$ = 0, $S$ = 1) as it would decrease the DI, bringing the total to 10 possible transports.

Moreover, If we consider the Wasserstein cost only on $(S, \hat{Y})$), once again based on its definition, because it is more advantageous to have ($Y$=1,$S$=0) points instead of ($Y$=0, $S$=0), similarly for ($Y$=0, $S$=1) points instead of ($Y$=1, $S$=1), we only have 6 worthy alterations to consider instead of 10. Indeed, for instance, it would be suboptimal to transport a ($Y$=1, $S$=1) point to ($Y$=0, $S$=0) as moving it to ($Y$=1, $S$=0) would result in a higher DI with a lesser effort (with the cost is calculated only on $(S, \hat{Y}))$).
Furthermore, transport between the bins ($Y = 1, S = 0$) and ($Y = 0, S = 1$) (i.e., between the two back points in Fig. 2) can also be excluded from the optimal solution. Indeed, transport from ($Y = 1, S = 0$) to ($Y = 0, S = 1$) would both reduce the number of favorable outcomes (decreasing the numerator of the DI) and increase the number of unfavorable outcomes for the protected group (increasing the denominator), thus leading to a lower DI. In contrast, if the bin ($Y = 0, S = 1$) move from ($Y = 0, S = 0$), the DI is improved, as only the denominator increases while the numerator remains unchanged

To summarize, if the cost is calculated on ($S, \hat{Y}$), then we theoretically only have 4 moves to consider, the arrows in Fig. 2. The arrow from ($Y=0, S=0$) toward ($Y=0, S=1$) is doted for the following reason: in practice, for the simulated dataset presented in Section F, this transport was never optimal meaning not the one which increases the DI the most compared to other transports. The most rewarding one was usually from the transport from ($Y=0, S=0$) to ($Y=1, S=0$). This leads us to write the Alg. 2 which is the less concise version of Alg. 1. A notable difference between the two is that Alg. 2 has a speed parameter which express a trade-off performance rapidity as explained in Section H.2.

**Termination analysis** At every iteration of the while loop, the DI is strictly increasing, moreover, the number of iterations is limited by the number of points $|\{X|Y = 1, S = 1\}|$ and $|\{X|Y = 0, S = 0\}|$. In the extreme case where no transport would be possible (either of these sets is empty if $|\{X|Y = 1, S = 1\}| = 0$ or $|\{X|Y = 0, S = 0\}| = 0$) the algorithm could attempt to increase DI indefinitely (towards + inf). This ensures that the algorithm necessarily terminates.

**Objective analysis** The condition of the while loop is precisely aligned with the objective of our problem. Consequently, exiting the loop implies that a solution has been found. Finally, a more challenging question concerns the optimality of the solution returned by the algorithm. We leave this question open and do not provide a formal guarantee of optimality.

<caption>Algorithm 2: Replace ($S, \hat{Y}$) non simplified algorithm</caption>

speed ∈ $\mathbb{N}^*$; 0 < threshold < 1
2: $b = [|\{X|Y = 1, S = 1\}|, |\{X|Y = 0, S = 1\}|, |\{X|Y = 1, S = 0\}|, |\{X|Y = 0, S = 0\}|]$
DI = DI.fct(b)
4: $\text{swap}\_\text{possible} = \{Y_0S_0, Y_1S_1\} \to Y_0S_1, \{Y_0S_0\} \to Y_1S_1$
$\text{dic}\_\text{swap}\_\text{translation} = \{Y_0S_0 \to Y_1S_0 : [0, 0, 1, -1], Y_0S_0 \to Y_1S_0 : [0, 1, 0, -1], Y_1S_0 \to Y_1S_0 : [-1, 0, 1, 0]\}$
6: $\text{dic}\_\text{swap}\_\text{number} = Y_0S_0 \to Y_1S_0 : 0, Y_0S_0 \to Y_1S_0 : 0, Y_1S_0 \to Y_1S_0 : 0$
DI$_n = [0, 0, 0]; \text{Matrix}\_b = M_{(3,4)}(0)$
8: **while** DI$_i$ threshold **do**
&nbsp;&nbsp;&nbsp;&nbsp;$i = 0$
10: **for** $\text{swap} \in \text{swap}\_\text{possible}$ **do**:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$b\_n = b + \text{dic}\_\text{swap}\_\text{translation}[\text{swap}]$ &nbsp;&nbsp;&nbsp;&nbsp; $\triangleright Y_0S_0 \to Y_1S_0$ translation
12: $\text{Matrix}\_b[i, :] = \text{copy}(b\_n)$ &nbsp;&nbsp;&nbsp;&nbsp; $\triangleright$ We keep in memory the bins
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$\text{DI}_n[i] = \text{DI}\_\text{fct}(b\_n)$
14: $i = i + 1$
&nbsp;&nbsp;&nbsp;&nbsp;**end for**
16: $j = \text{argmax}(\text{DI}_n)$
&nbsp;&nbsp;&nbsp;&nbsp;$\text{dic}\_\text{swap}\_\text{done}[\text{swap}\_\text{possible}[j]] = \text{dic}\_\text{swap}\_\text{done}[\text{swap}\_\text{possible}[j]] + \text{speed} \triangleright$ More information on speed discussed in next subsection
18: $b = b + \text{speed} * (\text{Matrix}\_b[j, :] - b)$
&nbsp;&nbsp;&nbsp;&nbsp;$\text{DI} = \text{DI}\_\text{fct}(b)$ &nbsp;&nbsp;&nbsp;&nbsp; $\triangleright$ Equal to $\text{DI}_n[j]$ only if speed = 1
20: **end while**
&nbsp;&nbsp;&nbsp;&nbsp;**return** $\text{dic}\_\text{swap}\_\text{number}$

**Wasserstein gradient guided method** Alg. 3, which is a simplified version of the true algorithm (code available on our Github<fnref n="2" />), explains the main ideas being:

1. We find the target probabilities for each subgroup of s

2. We treat each $Q_{n,s} := Q_n(\cdot | S = s)$ separately

3. The gradient steps stem from Theorem 5.1

4. We start with a small constraint weight and increase it progressively

The elements present in our code but which we did not include in Alg. 3 for visibility are mostly computational optimizations. For instance, we did not compute the gradient on neither the points whose network decision we would not modify $Z_i$ (i.e., with if $S_i = 0$ and $\hat{Y}_i = 1$) nor on points $Z_i^{(s)}$ whose $\hat{Y}_i^{(s)}$ are already modified. We also kept streakily only the minimum number of modification necessary: some gradient step would change the network decision of multiple points at the same time and without this process our result would not be tight regarding $\tilde{P}_1, \tilde{P}_0$ (as we would have changed individuals' outcome more than necessary)

<footnote n="2">²github.com/ValentinLafargue/Inspection</footnote>
Algorithm 3: Fair-washing using Monge Kantorovich constrained projection algorithm Grad

**Require:** Neural network $f$, data $Z_0$, sensitive attribute $S \in \{0, 1\}^n$, prediction threshold $\tau$, desired DI threshold $t$, learning rate $\eta$, constraint weight $\lambda$, delta type ($\in \{\text{balanced, proportional}\}$)

**Ensure:** Updated samples $Z$ minimizing $\|Z - Z_0\|^2$ while satisfying $\text{DI}(f(Z), S) \ge t$

1: Compute: $\hat{Y} \leftarrow \mathbb{I}[f(Z_0) > \tau]$ ▷ where $\mathbb{I}$ is the indicator function

2: Compute $P_0 = \mathbb{E}[\hat{Y} | S = 0]$, $P_1 = \mathbb{E}[\hat{Y} | S = 1]$, $n_1 = \mathbb{E}[S = 1]$, $n_0 = \mathbb{E}[S = 0]$ ▷ Done following Prop.4.2

3: Compute $\delta_s$ according to delta type ▷ Done following Prop.4.2

4: Set new target rates:

$$ \tilde{P}_1 = P_1 - \delta_1/n_1, \quad \tilde{P}_0 = P_0 + \delta_0/n_0 $$

5: **for** $s \in \{0, 1\}$ **do**

6: Initialize $\lambda^{(s)} \leftarrow \lambda$

7: **while** $(\mathbb{E}[\hat{Y}^{(s)}] < \tilde{P}_s) \lor (\mathbb{E}[\hat{Y}^{(s)}] > \tilde{P}_s \land s = 1)$ **do**

8: Initialize $Z_i^{(s)} \leftarrow Z_0^{(s)}$, $\eta_i \leftarrow \eta$ ▷ where $Z_0^{(s)}$ is the subset of inputs with $S = s$

9: **for** $i \in \{1, \dots, 10\}$ **do**

10: Iteration of gradient step:

$$ \nabla = 2(Z_i^{(s)} - Z_0^{(s)}) + \lambda^{(s)} \cdot \nabla_Z f(Z_i^{(s)}) \cdot d_s $$

where $d_s = \begin{cases} +1 & \text{if } s = 0 \\ -1 & \text{if } s = 1 \end{cases}$ ▷ Gradient choice following eq. 12

$$ Z_i^{(s)} \leftarrow Z_i^{(s)} - \eta_i \cdot \nabla $$

11: Recompute predictions $\hat{Y}_i^{(s)} = \mathbb{I}[f(Z_i^{(s)}) > \tau]$

12: $\eta_i \leftarrow \eta_i/1.2$ ▷ Planning strategies could improve the performance, 1.2 was what we founded worked the best in practice (following the choice of the coefficient multiplying $\lambda^{(s)}$)

13: **if** 1D-transport variant **then**

14: Project each feature of $Z_i^{(s)}$ to its closest achievable value

15: **end if**

16: **if** $\mathbb{E}[\hat{Y}_i^{(s)}] < \tilde{P}_s$ (or $> \tilde{P}_s$ for $s = 1$) **then**

17: **Break** Exit for and while loop

18: **end if**

19: **end for**

20: Update: $\lambda^{(s)} \leftarrow 1.2 \times \lambda^{(s)}$ ▷ The solution of the optimization problem with this $\lambda$ is not within the constrained space (or we did not converge towards it fast enough at least); hence we increase the $\lambda$ progressively. Note that the 1.2 was what we founded worked best in practice (trade-off between precision with lower value and fast computation), however further tuning would be relevant.

21: **end while**

22: Compute perturbation $T^{(s)} = Z^{(s)} - Z_s$

23: **end for**

24: Assemble final perturbation $T$ such that:

$$ T_i = \begin{cases} T_i^{(0)} & \text{if } S_i = 0 \text{ and } \hat{Y}_i = 0 \\ T_i^{(1)} & \text{if } S_i = 1 \text{ and } \hat{Y}_i = 1 \\ 0 & \text{otherwise} \end{cases} $$

25: **return** $Z = Z_0 + T$

and thus overachieving $\text{DI}(f(Z), S) \ge t$ which is not beneficial in our use case where we highlighted the trade-off between fairness correction and distribution shift.

## H.2 Costs of the methods, solutions and tests

**Time** In Table 9, we wrote Trade-off possible for the methods which might take a more than a day to run with millions of individuals. The methods $M_{W(X,S,\hat{Y})}$ and Replace ($S, \hat{Y}$) evaluate at each step amongst 3 or 4 possibilities which is the optimal to take, we can only evaluate once for more step at the same time for both methods, this becomes a trade-off between
<table><caption>Table 9: Time cost analysis of the methods, note that every estimation depends on the original dataset, its Disparate Impact and the DI constraint. Time estimation given for a dataset size of 20k individuals.</caption><thead><tr><th>Methods</th><th>Summary</th><th>Solution</th></tr></thead><tbody><tr><td>M<sub>W(X,S,ŷ)</sub></td><td>3–10 minutes</td><td>Trade-off possible</td></tr><tr><td>Replace(S, Ŷ)</td><td>≤ 2 minutes</td><td>Trade-off possible</td></tr><tr><td>Entropic_b / Entropic_p</td><td>≤ 1 minutes</td><td></td></tr><tr><td>Grad_p / Grad_b</td><td>3–15 minutes, depends on λ and NN architecture</td><td>Trade-off possible</td></tr><tr><td>Grad_p(1D-t) / Grad_b(1D-t)</td><td>3–20 minutes, depends on λ and NN architecture</td><td>Trade-off possible</td></tr></tbody></table>

<table><caption>Table 10: Time analysis done during our Highest undetected achievable DI per datasets and methods</caption><thead><tr><th>Sample size</th><th>Test performed</th><th>Average testing time (second)</th></tr></thead><tbody><tr><td rowspan="5">500</td><td>DI(S) ≥ DI(Q<sub>t</sub>)</td><td>0.00</td></tr><tr><td>KL(S, Ŷ)</td><td>0.00</td></tr><tr><td>KL(X, S, Ŷ)</td><td>0.78</td></tr><tr><td>W(S, Ŷ)</td><td>0.29</td></tr><tr><td>W(X, S, Ŷ)</td><td>0.48</td></tr><tr><td rowspan="4">1000</td><td>DI(S) ≥ DI(Q<sub>t</sub>)</td><td>0.00</td></tr><tr><td>KL(S, Ŷ)</td><td>0.00</td></tr><tr><td>KL(X, S, Ŷ)</td><td>0.85</td></tr><tr><td>W(S, Ŷ) + W(X, S, Ŷ)</td><td>1.57</td></tr><tr><td rowspan="5">2000</td><td>DI(S) ≥ DI(Q<sub>t</sub>)</td><td>0.00</td></tr><tr><td>KL(S, Ŷ)</td><td>0.02</td></tr><tr><td>KL(X, S, Ŷ)</td><td>3.13</td></tr><tr><td>W(S, Ŷ)</td><td>4.93</td></tr><tr><td>W(X, S, Ŷ)</td><td>15.51</td></tr><tr><td rowspan="5">4000</td><td>DI(S) ≥ DI(Q<sub>t</sub>)</td><td>0.00</td></tr><tr><td>KL(S, Ŷ)</td><td>0.02</td></tr><tr><td>KL(X, S, Ŷ)</td><td>3.34</td></tr><tr><td>W(S, Ŷ)</td><td>9.58</td></tr><tr><td>W(X, S, Ŷ)</td><td>32.30</td></tr></tbody></table>

speed and precision, this is what we mean by trade-off possible for those methods. Moreover, we can also think about a trade-off about the number of transport mapping to consider, as explained in the Section. H.1.

For the Grad variant methods, we do not anticipate any changes to the model architecture. However, if inference from the neural network is computationally expensive, the overall cost of the method will also be high. Developing an efficient solution to this issue remains an open challenge. However, with tabular data model's number of parameters tends to be controllable, and thus in our experiments the reason of such a long time compute time (relative to the number of individual) was because we optimized for the λ parameter. We remind that to have the best results we start with a very small λ which we progressively increase; we thus can simply initialize the algorithm with a bigger λ to save computing time, another speed precision trade-off.

The results in Table 10 were obtained through the following procedure. For each sample, we recorded: (1) the total execution time of the testing pipeline, and (2) the reason the pipeline stopped. Since each sample must pass all five tests, the pipeline halts as soon as one test is failed. Based on our prior expectations regarding the relative runtime of the tests. To isolate the runtime of each individual test, we subtracted the mean runtime of the preceding tests from the total time observed at the stopping point. The results show that while all tests are fast for small sample sizes (e.g., 500 samples), the tests based on Wasserstein distances (in particular $W(X, S, Ŷ)$) are the most time-consuming.

**Memory** We consider only the Grad variant methods to potentially pose memory-related issues. Although it would be natural to adapt these methods to operate in a batch-wise manner, we did not implement such an approach in our current work.
<table><caption>Table 11: Memory cost analysis of the methods for a N × J dataset.</caption><thead><tr><th>Methods</th><th>Summary</th><th>Solution</th></tr></thead><tbody><tr><td>M<sub>W(X,S,ŷ)</sub></td><td>N × N distance matrix</td><td></td></tr><tr><td>Replace(S, Ŷ)</td><td>Negligible</td><td>Trade-off possible</td></tr><tr><td>Entropic_b/Entropic_p</td><td>Negligible</td><td></td></tr><tr><td>Grad(b/p)/(1D)</td><td>NN gradient to compute on at worse on N ind</td><td>Batch approach</td></tr></tbody></table>

# I Optimization result values

## I.1 Wasserstein distance

<table><caption>Table 12: Wasserstein distance manipulation cost of the fair-washing methods (DI($Q_t$) ≥ 0.8), cost calculated on the projected dataset: $W(Q_n, Q_t)$ with the original dataset $Q_n$ and $Q_t = f(Q_n)$ with f the fair-washing method</caption><thead><tr><th rowspan="2">Dataset</th><th colspan="7">Unbiasing Methods</th></tr><tr><th>Grad_p</th><th>Grad_b</th><th>Grad_p_1D</th><th>Grad_b_1D</th><th>Rep (S, Ŷ)</th><th>M<sub>W(X,S,ŷ)</sub></th><th>Entr_b</th><th>Entr_p</th></tr></thead><tbody><tr><td>ADULT</td><td>0.10</td><td>0.08</td><td>0.13</td><td>0.09</td><td><strong>0.05</strong></td><td><strong>0.06</strong></td><td>0.28</td><td>0.35</td></tr><tr><td>EMP</td><td>0.18</td><td>0.10</td><td>0.18</td><td>0.10</td><td><strong>0.06</strong></td><td>0.08</td><td>0.22</td><td>0.37</td></tr><tr><td>INC</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td></tr><tr><td>MOB</td><td>0.21</td><td>0.06</td><td>0.23</td><td>0.08</td><td><strong>0.03</strong></td><td>0.05</td><td>0.18</td><td>0.64</td></tr><tr><td>PUC</td><td>0.21</td><td><strong>0.13</strong></td><td>0.22</td><td>0.14</td><td><strong>0.12</strong></td><td>0.16</td><td>0.33</td><td>0.48</td></tr><tr><td>TRA</td><td>0.02</td><td>0.02</td><td>0.02</td><td>0.02</td><td><strong>0.01</strong></td><td><strong>0.01</strong></td><td>0.03</td><td>0.03</td></tr><tr><td>BAF</td><td>0.01</td><td><strong>0.00</strong></td><td>0.02</td><td>0.01</td><td><strong>0.00</strong></td><td>0.01</td><td>0.02</td><td>0.05</td></tr></tbody></table>

<table><caption>Table 13: Wasserstein distance manipulation cost of the fair-washing methods(DI($Q_t$) ≥ 0.8), cost calculated on the projected dataset: $W(Q_{n,(S,ŷ)}, Q_{t,(S,ŷ)})$ with the original dataset $Q_n$ and $Q_t = f(Q_n)$ with f the fair-washing method</caption><thead><tr><th rowspan="2">Dataset</th><th colspan="7">Unbiasing Methods</th></tr><tr><th>Grad_p</th><th>Grad_b</th><th>Grad_p_1D</th><th>Grad_b_1D</th><th>Rep (S, ŷ)</th><th>M<sub>W(X,S,ŷ)</sub></th><th>Entr_b</th><th>Entr_p</th></tr></thead><tbody><tr><td>ADULT</td><td>0.09</td><td>0.08</td><td>0.09</td><td>0.08</td><td><strong>0.05</strong></td><td><strong>0.05</strong></td><td>0.08</td><td>0.09</td></tr><tr><td>EMP</td><td>0.18</td><td>0.10</td><td>0.18</td><td>0.10</td><td><strong>0.06</strong></td><td><strong>0.06</strong></td><td>0.10</td><td>0.18</td></tr><tr><td>INC</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td><td>0.01</td></tr><tr><td>MOB</td><td>0.18</td><td>0.06</td><td>0.18</td><td>0.06</td><td><strong>0.03</strong></td><td><strong>0.03</strong></td><td>0.06</td><td>0.18</td></tr><tr><td>PUC</td><td>0.21</td><td>0.13</td><td>0.21</td><td>0.13</td><td>0.12</td><td><strong>0.10</strong></td><td>0.13</td><td>0.21</td></tr><tr><td>TRA</td><td>0.02</td><td>0.02</td><td>0.02</td><td>0.02</td><td><strong>0.01</strong></td><td><strong>0.01</strong></td><td>0.02</td><td>0.02</td></tr><tr><td>BAF</td><td>0.01</td><td>0.00</td><td>0.01</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td></tr></tbody></table>

## I.2 Kullback-Leibler divergence

# J Ablation study on the MMD test

We report the results in Table 16, which presents the highest Disparate Impact (DI) achieved by samples that remained undetected by the statistical tests based on KL divergence, Wasserstein distance, and the Kolmogorov-Smirnov (KS) test. This table corresponds to Table 4, but excludes the two tests based on the MMD distance.

From Table 16, we observe that excluding the MMD tests had negligible impact on detection outcomes. The only notable difference arises in the BAF dataset with a 20% sampling rate, where the achieved DI is slightly higher. We also point out that, due to the inherent randomness in sampling (100 random samples are drawn for each combination of dataset, fair-washing method, sample size, and target DI($Q_t$)), we occasionally found samples that passed all seven tests and exhibited marginally higher DI than those evaluated with only five tests. These cases are indicated by a '+' symbol in parentheses in Table 16.
<table><caption>Table 14: KL divergence manipulation cost of the fair-washing methods (DI($Q_t$) ≥ 0.8), cost calculated on the projected dataset : KL($Q_n, Q_t$) with the original dataset $Q_n$ and $Q_t = f(Q_n)$ with $f$ the fair-washing method</caption><thead><tr><th rowspan="2">Dataset</th><th colspan="8">Unbiasing Methods</th></tr><tr><th>Grad_p</th><th>Grad_b</th><th>Grad_p_1D</th><th>Grad_b_1D</th><th>Rep (S, Ŷ)</th><th>M<sub>W(X,S,ŷ)</sub></th><th>Entr_b</th><th>Entr_p</th></tr></thead><tbody><tr><td>ADULT</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>0.03</td><td><strong>0.02</strong></td><td>0.03</td></tr><tr><td>EMP</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td><strong>0.04</strong></td><td><strong>0.04</strong></td><td>0.07</td></tr><tr><td>INC</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>0.00</td><td>0.00</td><td>0.00</td></tr><tr><td>MOB</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td><strong>0.02</strong></td><td>0.03</td><td>0.17</td></tr><tr><td>PUC</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>0.06</td><td>0.07</td><td>0.10</td></tr><tr><td>TRA</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>0.00</td><td>0.00</td><td>0.00</td></tr><tr><td>BAF</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>∞</td><td>0.00</td><td>0.00</td><td>0.00</td></tr></tbody></table>

<table><caption>Table 15: KL divergence manipulation cost of the fair-washing methods (DI($Q_t$) ≥ 0.8), cost calculated on the projected dataset : KL($Q_{n,(S,ŷ)}, Q_{t,(S,ŷ)}$) with the original dataset $Q_n$ and $Q_t = f(Q_n)$ with $f$ the fair-washing method</caption><thead><tr><th rowspan="2">Dataset</th><th colspan="8">Unbiasing Methods</th></tr><tr><th>Grad_p</th><th>Grad_b</th><th>Grad_p_1D</th><th>Grad_b_1D</th><th>Rep (S, Ŷ)</th><th>M<sub>W(X,S,ŷ)</sub></th><th>Entr_b</th><th>Entr_p</th></tr></thead><tbody><tr><td>ADULT</td><td>0.02</td><td>0.02</td><td>0.02</td><td>0.02</td><td>0.03</td><td>0.03</td><td>0.02</td><td>0.03</td></tr><tr><td>EMP</td><td>0.06</td><td><strong>0.03</strong></td><td>0.06</td><td><strong>0.03</strong></td><td>0.04</td><td>0.04</td><td>0.04</td><td>0.07</td></tr><tr><td>INC</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td></tr><tr><td>MOB</td><td>0.12</td><td><strong>0.03</strong></td><td>0.12</td><td>0.03</td><td><strong>0.02</strong></td><td><strong>0.02</strong></td><td><strong>0.03</strong></td><td>0.17</td></tr><tr><td>PUC</td><td>0.09</td><td><strong>0.06</strong></td><td>0.09</td><td><strong>0.06</strong></td><td>0.08</td><td><strong>0.07</strong></td><td><strong>0.07</strong></td><td>0.10</td></tr><tr><td>TRA</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td></tr><tr><td>BAF</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td></tr></tbody></table>

<table><caption>Table 16: Highest undetected (without the MMD-based statistical tests) achievable Disparate Impact for each dataset, sample size (S Size) and fair-washing method. The symbol - indicates that some methods couldn't reach a DI improvement. To emphasize the best method to use in order to deceive the auditor, we put the DI achieved in bold when one or two over-performed the others. The number in parentheses are here to indicate the difference between those results and the results obtained with the MMD-based tests (Result without MMD - Result with).</caption><thead><tr><th>Dataset</th><th>Original</th><th>S size (%)</th><th>Rep (S, Ŷ)</th><th>Entr_b</th><th>Entr_p</th><th>M<sub>W(X,S,ŷ)</sub></th></tr></thead><tbody><tr><td rowspan="2">ADULT</td><td rowspan="2">0.30</td><td>10</td><td>0.45(-0.05)</td><td>0.53 (-0.01)</td><td>0.55 (+0.03)</td><td><strong>0.54</strong> (+0.01)</td></tr><tr><td>20</td><td>0.38(-0.03)</td><td><strong>0.43</strong> (+0.01)</td><td>0.42(+0.01)</td><td><strong>0.43</strong> (+0.01)</td></tr><tr><td rowspan="2">EMP</td><td rowspan="2">0.30</td><td>10</td><td>-</td><td>0.38(+0.03)</td><td><strong>0.39</strong> (+0.03)</td><td><strong>0.39</strong> (+0.02)</td></tr><tr><td>20</td><td>-</td><td><strong>0.36</strong> (+0.02)</td><td>0.35(-0.01)</td><td><strong>0.36</strong> (+0.01)</td></tr><tr><td rowspan="2">INC</td><td rowspan="2">0.67</td><td>10</td><td>0.88</td><td>0.95(+0.01)</td><td>0.95(+0.01)</td><td>0.95(+0.02)</td></tr><tr><td>20</td><td>0.83</td><td>0.84(+0.01)</td><td>0.84</td><td>0.84</td></tr><tr><td rowspan="2">MOB</td><td rowspan="2">0.45</td><td>10</td><td>0.54(+0.01)</td><td>0.53(+0.01)</td><td>0.51</td><td><strong>0.55</strong> (+0.02)</td></tr><tr><td>20</td><td>0.48(-0.01)</td><td><strong>0.50</strong></td><td>0.49</td><td><strong>0.50</strong></td></tr><tr><td rowspan="2">PUC</td><td rowspan="2">0.32</td><td>10</td><td>-</td><td><strong>0.36</strong> (+0.03)</td><td><strong>0.36</strong> (+0.01)</td><td>0.35</td></tr><tr><td>20</td><td>-</td><td>-</td><td>-</td><td>-</td></tr><tr><td rowspan="2">TRA</td><td rowspan="2">0.69</td><td>10</td><td>0.76(-0.03)</td><td>0.84(+0.01)</td><td>0.84</td><td>0.84</td></tr><tr><td>20</td><td>0.71(-0.06)</td><td>0.80(+0.01)</td><td>0.80(+0.01)</td><td><strong>0.81</strong></td></tr><tr><td rowspan="2">BAF</td><td rowspan="2">0.35</td><td>10</td><td>-</td><td>1</td><td>1</td><td>1</td></tr><tr><td>20</td><td>-</td><td>0.83(+0.06)</td><td>0.84(+0.05)</td><td><strong>0.85</strong> (+0.06)</td></tr></tbody></table>
# K Fraud detection

## K.1 Distribution of tries before acceptance of $H_0$

As shown in Fig 10, taking only 30 or 50 samples instead of 1000 gives us respectively 73% or 78% accuracy for the tests. This is arguably not that high, however knowing that we would have needed the combination of 5 statistical tests to accept our sample in our use case, it still gives us a good approximation to whether the test have a chance to be accepted (as it is harder to be accepted by the combination of 5 tests than the individuals one).

<figure><img src="image_13.png" /><figcaption>Figure 10: Distribution of number of tries to find an accepted sample for $H_0$ for the statistical test KS or KL($S, \hat{Y}$) with a maximum of 1000 tries per configuration (method, dataset, test) for all datasets.</figcaption></figure>

## K.2 Highest undetected achievable Disparate Impact probabilities and additional graph

We add details to Table 4 results, particularly its stability towards the number of sampling tries.

* We would have had 95%, 97% and 98% of similar results if we tried respectively 10, 20 and 30 samples compared to 100. (we had respectively 41, 24 and 19 scenarios which have us different results over the span of 896 combinations).

* In configurations where a fairer falsely compliant sample was found, it was generally around the 11th sample, while the median was equal to 4. (See Fig. 12)

<figure><img src="image_14.png" /><figcaption>Figure 11: Highest achieved Disparate Impact (DI) for all Datasets and methods (when they improve the original DI), with sample size of 20% of the dataset.</figcaption></figure>

<caption>Figure 12: Distribution of the number of sample tried before first accepted one for all datasets.</caption>