SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Matthew Wicker
The Alan Turing Institute mwicker@turing.ac.uk
Vihari Piratia
University of Cambridge  
vp421@cam.ac.uk
Adrian Weller
University of Cambridge & The Alan Turing Institute
Providing formal guarantees of algorithmic fairness is of paramount importance to socially responsible deployment of machine learning algorithms. In this work, we study formal guarantees, i.e., certificates, for individual fairness (IF) of neural networks. We start by introducing a novel convex approximation of IF constraints that exponentially decreases the computational cost of providing formal guarantees of local individual fairness. We highlight that prior methods are constrained by their focus on global IF certification and can therefore only scale to models with a few dozen hidden neurons, thus limiting their practical impact. We propose to certify distributional individual fairness which ensures that for a given empirical distribution and all distributions within a  $\gamma$ -Wasserstein ball, the neural network has guaranteed individually fair predictions. Leveraging developments in quasi-convex optimization, we provide novel and efficient certified bounds on distributional individual fairness and show that our method allows us to certify and regularize neural networks that are several orders of magnitude larger than those considered by prior works. Moreover, we study real-world distribution shifts and find our bounds to be a scalable, practical, and sound source of IF guarantees.
There is a growing concern about the potential of machine learning models to perpetuate and amplify discrimination (Barocas & Selfst, 2016). Machine learning algorithms have been put forward to automate decision making in a variety of fairness-sensitive domains, such as healthcare (Davenport & Kalakota, 2019), employment (Ding et al., 2021), and criminal justice (Dressel & Farid, 2018; Zilka et al., 2022). It has been demonstrated that such models produce biased outcomes that unfairly disadvantage certain individuals or groups (Seyyed-Kalantari et al., 2021; Yurochkin & Sun, 2020). To combat this, there has been a surge of interest in algorithmic fairness metrics (Mehrabi et al., 2021). Fairness metrics provide practitioners with a means to quantify the extent of bias within a model and facilitate development of heuristics for debiasing models (Madras et al., 2018; Yurochkin et al., 2019). However, relying solely on heuristic debiasing methods may not be satisfactory for justifying the deployment of machine learning models as they do not provide guarantees of fairness. To address this concern, there has been a recent focus on certification approaches, which provide formal guarantees that a model adheres to a specified fairness criterion (John et al., 2020; Benussi et al., 2022; Khedr & Shoukry, 2022). Providing certified guarantees of fairness is of utmost importance as it offers users, stakeholders, and regulators formal assurances that the predictions of a model align with a rigorous standards of fairness. These guarantees serve as a powerful tool to promote trust, accountability, and ethical deployment of machine learning models.
In this work, we study the problem of certifying individual fairness (IF) in neural networks (NNs). Individual fairness enforces the intuitive property that a given neural network issues similar predictions for all pairs of similar individuals (Dwork et al., 2012). Individuals are considered similar if they differ only with respect to protected attributes (e.g., race, gender, or age) or features correlated with the protected attributes. This similarity is captured by a fair distance metric which can be learned by
querying human experts or extracted from observed data (Mukherjee et al., 2020). Given a NN and a fairness metric, recent works have established procedures for certifying that a NN conforms to a given IF definition, which is a crucial step in developing and deploying fair models (Benussi et al., 2022; Khedr & Shoukry, 2022). While current approaches to IF guarantees for NNs are effective for simple problems, they face scalability issues when dealing with NNs containing more than a few dozen neurons. This limitation is due to their emphasis on global individual fairness, which guarantees the IF property for every input within the NN's domain (Benussi et al., 2022; Khedr & Shoukry, 2022). Although global IF certification is the gold standard, it places constraints on extreme outliers, such as ensuring loan decisions are fair to a three-year-old billionaire applying for a small business loan. Subsequently, as the dimension of the input space grows, solving an optimization problem that covers the entire domain becomes either impossible for current solvers to deal with or computationally prohibitive. On the other hand, distributional individual fairness (DIF), first proposed in Yurochkin et al. (2019), enforces that a model's predictions are individually fair w.r.t. a family of distributions that are within a  $\gamma$ -Wasserstein ball of the empirical distribution over observed individuals. The focus on distributions removes the constraints on unrealistic individuals while enforcing fairness on the relevant part of the input domain. As such, providing certification of DIF can provide strong guarantees of fairness that scale to even relatively large neural network models. However, prior works in DIF focus only on heuristic debiasing techniques (Yurochkin et al., 2019).
In this work, we provide the first formal certificates of DIF. As it cannot be computed exactly, we present a framework for bounding distributional individual fairness. We start by presenting a novel convex relaxation of local IF constraints, i.e., IF with respect to a single prediction. Our approach to local IF certification offers an exponential computational speed-up compared with prior approaches. Building on this efficient bound, we are able to propose an optimization problem whose solution, attainable due to the problem's quasi-convexity, produces sound certificates of DIF. Further, our certified bounds can be easily incorporated as a learning objective, enabling efficient individual fairness training. In a series of experiments, we establish that our method is able to certify that IF holds for meaningful, real-world distribution shifts. Further, our proposed regularization is able to certifiably fair neural networks that are two orders of magnitude larger than those considered in previous works in a fraction of the time. We highlight the following key contributions of this work:
- We prove a convex relaxation of local individual fairness, enabling exponentially more efficient local IF certification compared with prior mixed integer linear programming approaches.
- We formulate a novel optimization approach to certificates of local and distribution individual fairness and leverage quasi-convex optimization to provide the first formal upper and lower bounds, i.e., certificates, on distributional individual fairness.
- We empirically demonstrate the tightness of our distributional individual fairness guarantees compared with real-world distributional shifts, and demonstrate the considerable scalability benefits of our proposed method.
Individual fairness, originally investigated by Dwork et al. (2012), establishes a powerful and intuitive notion of fairness. Subsequent works have focused on defining the individual fairness metrics (Mukherjee et al., 2020; Yurochkin & Sun, 2020), expanding the definition to new domains (Gupta & Kamble, 2021; Xu et al., Doherty et al., 2023), and importantly, guaranteeing that a model conforms to individual fairness (John et al., 2020; Ruoss et al., 2020; Benussi et al., 2022; Khedr & Shoukry, 2022; Peychev et al., 2022). In (John et al., 2020) the authors consider a relaxation of individual fairness and present methods to verify that it holds for linear classifiers. In (Yeom & Fredrikson, 2020; Peychev et al., 2022) the authors extend randomized smoothing to present statistical guarantees on individual fairness for neural networks. These guarantees are much weaker than the sound guarantees presented in Benussi et al. (2022); Khedr & Shoukry (2022) which are based on mixed integer linear programming (MILP). Both of these methods focus solely on the global notion of individual fairness which proves to only scale to neural networks with a few dozen hidden neurons. Our work relaxes the need to certify a property globally allowing us to scale to neural networks that are orders of magnitude larger than what can be considered by prior works. Further, prior works have sought to debias models according an individual fairness criterion (Yurochkin et al., 2019; Benussi et al., 2022; Khedr & Shoukry, 2022). In Yurochkin et al. (2019) the authors present a method for debiased training relying on PGD which is insufficient for training a NN with strong fairness guarantees (Benussi et al., 2022).
In (Benussi et al., 2022; Khedr & Shoukry, 2022) the authors use linear programming formulations of fairness during training which leads to strong IF guarantees but at a large computational cost and greatly limited scalability.
Distributional individual fairness was originally proposed by Yurochkin et al. (2019) and the importance of distributional robustness of notions of fairness has been underscored in several recent woks (Sagawa et al., 2019; Sharifi-Malvajerdi et al., 2019; Taskesen et al., 2020; Mukherjee et al., 2022).
To the best of our knowledge, this work is the first that provides formal certificates that guarantee a model satisfies distributional individual fairness. We provide further discussion of works related to distributional robustness in Appendix C
We consider a supervised learning scenario in which we have a set of  $n$  feature-label pairs drawn from an unknown joint distribution  $\{(x^{(i)},y^{(i)})\}_{i = 1}^{n}\sim P^{0}(x,y)$  with  $x\in \mathbb{R}^m$  and  $y\in \mathbb{R}^k$ . We consider a feed forward neural network (NN) as a function  $f^{\theta}:\mathbb{R}^{m}\to \mathbb{R}^{k}$ , parametrised by a vector  $\theta \in \mathbb{R}^p$ . We define a local version of the individual fairness definition that is studied in (John et al., 2020; Benussi et al., 2022) to evaluate algorithmic bias:
Definition 1. Local  $\delta$ - $\epsilon$ -Individual Fairness Given  $\delta > 0$  and  $\epsilon \geq 0$ , we say that  $f^{\theta}$  is locally individually fair (IF) with respect to fair distance  $d_{fair}$  and input  $x'$  iff:
$$
\forall x ^ {\prime \prime} s. t. d _ {f a i r} \left(x ^ {\prime}, x ^ {\prime \prime}\right) \leq \delta \Rightarrow \left| f ^ {\theta} \left(x ^ {\prime}\right) - f ^ {\theta} \left(x ^ {\prime \prime}\right) \right| \leq \epsilon
$$
For a given value of  $\delta$  we use the notation  $\mathcal{I}(f^{\theta},x,\delta)$  to denote the function that returns the largest value of  $\epsilon$  such that the local IF property holds. Further,  $\mathcal{I}(f^{\theta},x,\delta) = 0$  holds if a network is perfectly locally individually fair. Throughout the paper, we will refer to the value  $\epsilon$  as the IF violation as this is the amount by which the perfect fairness property is violated.
Several methods have been investigated for crafting fair distance metrics (Mukherjee et al., 2020). Methods in this work can flexibly handle a majority of the currently proposed metrics. We discuss the particulars in Appendix D While certifying local IF is sufficient for proving that a given prediction is fair w.r.t. a specific individual, it does not suffice as proof that the model will be fair for unseen individuals at deployment time. To this end, prior works have investigated a global individual fairness definition. Global  $\epsilon$ - $\delta$  individual fairness holds if and only if  $\forall x \in \mathbb{R}^m, \mathcal{I}(f^\theta, x, \delta) \leq \epsilon$ . However, global individual fairness is a strict constraint and training neural networks to satisfy global individual fairness comes at a potentially prohibitive computational cost. For example, training a neural network with only 32 hidden units can take up to 12 hours on a multi-GPU machine (Benussi et al., 2022).
4 Distributional Individual Fairness
In this section, we describe distributional individual fairness (DIF) as a notion that can ensure that neural networks are individually fair at deployment time while not incurring the considerable overhead of global training and certification methods. DIF ensures that individuals in the support of  $P^0$  and distributions close to  $P^0$  are treated fairly. To measure the distributions close to  $P^0$  we consider the  $p$ -Wasserstein distance between distributions,  $W_{p}(P^{0},\cdot)$ . Further, we denote the ball of all distributions within  $\gamma$ $p$ -Wasserstein distance of  $P^0$  as  $\mathcal{B}_{\gamma ,p}(P^0)$ . To abbreviate notation, we drop the  $p$  from the Wasserstein distance, noting that any integer  $p\geq 1$  can be chosen.
Definition 2. Distributional  $\gamma$ - $\delta$ - $\epsilon$ -Individual Fairness Given individual fairness parameters  $\delta > 0$  and  $\epsilon \geq 0$ , and distributional parameter  $\gamma > 0$ , we say that  $f^{\theta}$  is distributionally individually fair (DIF) with respect to fair distance  $d_{\text{fair}}$  if and only if the following condition holds:
$$
\sup  _ {P ^ {\star} \in \mathcal {B} _ {\gamma} (P ^ {0})} \left(\mathbb {E} _ {x \sim P ^ {\star}} [ \mathcal {I} (f ^ {\theta}, x, \delta) ]\right) \leq \epsilon \tag {1}
$$
Intuitively, distributional individual fairness ensures that for all distributions in a Wasserstein ball around  $P^0$  we maintain individual fairness on average. In Figure [1], we visualize the difference between local, distributional, and global IF in a toy two dimensional settings. Prior work that focuses on DIF only provides a heuristic method based on the PGD attack to train debiased NNs and therefore
Figure 1: Using the halfmoons dataset we illustrate the benefits of DIF. Left: local IF does not do enough to provide guarantees on individuals we are likely to see. Right: Global IF provides a strict constraint on anomalous points, leading to scalability issues. Center: Distributional IF covers likely individuals without over-constraining the problem leading to scalable and reliable fairness guarantees.
provide no formal guarantees (Yurochkin et al. 2019). Below we state two key computational problems in the study of guarantees for distributional individual fairness:
Problem 1. Certification of Distributional Individual Fairness: Given a neural network,  $f^{\theta}$  and parameters  $\delta$  and  $\gamma$ , compute a value  $\overline{\epsilon}$  such that  $\overline{\epsilon}$  provably upper-bounds the left hand side of Equation (1). An optimal certificate is the smallest such  $\overline{\epsilon}$  such that Equation (1) holds.
The problem of certifying distributional individual fairness is critical to ensuring that the definition can be used in practice as it allows for regulators and auditors to have similar assurances to global individual fairness, but only on what is deemed to be the relevant portion of the input space as controlled by  $\gamma$ .
Problem 2. Distributionally Individually Fair Training: Given a randomly initialized neural network,  $f^{\theta}$  and parameters  $\delta$  and  $\gamma$  and a dataset drawn from  $P^0$ , learn a neural network that approximately minimizes both the standard loss,  $\mathcal{L}$ , and the DIF violation:
$$
\underset {\theta \in \Theta} {\arg \min } \mathbb {E} _ {P ^ {0}} \left[ \mathcal {L} \left(f ^ {\theta}, x, y\right) \right] + \sup  _ {P ^ {\star} \in \mathcal {B} _ {\gamma , p} \left(P ^ {0}\right)} \left(\mathbb {E} _ {P ^ {\star}} \left[ \mathcal {L} \left(f ^ {\theta}, x, \delta\right) \right]\right) \tag {2}
$$
Problem 2 is tantamount to certified debiased training of a neural network w.r.t the DIF definition. Certified debiasing places a focus on formal guarantees that is not present in prior distributional individual fairness work.
To address Problems 1 and 2 we start by providing a novel and efficient computation for certificates of local individual fairness. We then build on this efficient guarantee to compute formal bounds and proposed regularizers for certified DIF training.
5.1 Certifying Local Individual Fairness
A key step in certification of distributional individual fairness is proving that a given neural network satisfies local individual fairness i.e., Definition [1]. While there are many methods for efficiently certifying local robustness properties, individual fairness must be certified w.r.t. a ball of inputs whose shape and size is determined by  $d_{\mathrm{fair}}$ . Existing works in crafting individual fairness metrics use Mahalanobis metrics to express the fair distance between two individuals, i.e.,  $d_{\mathrm{fair}}(x,x^{\prime}) = \sqrt{(x - y)^{\top}S^{-1}(x - y)}$  where  $S$  is a positive semi-definite matrix  $\in \mathbb{R}^{m\times m}$ . In order to certify this more expressive class of specifications prior works use linear bounding techniques as part of a larger MILP formulation (Benussi et al. 2022). In this work, we show that one can in fact use exponentially more efficient bound propagation techniques developed for robustness certification to certify local individual fairness. In order to do so, we provide the following bound that over-approximates the  $d_{\mathrm{fair}}$  metric ball with an orthotope:
Theorem 5.1. Given a positive semi-definite matrix  $S \in \mathbb{R}^{m \times m}$ , a feature vector  $x' \in \mathbb{R}^m$ , and a similarity threshold  $\delta$ , all vectors  $x'' \in \mathbb{R}^m$  satisfying  $d_S(x', x'') \leq \delta$  are contained within the axis-aligned orthope:
$$
\left[ x ^ {\prime} - \delta \sqrt {d}, x ^ {\prime} + \delta \sqrt {d} \right]
$$
where  $d = \operatorname{diag}(S)$ , the vector containing the elements along the diagonal of  $S$ .
Theorem 5.1 holds as well for weighted  $\ell_p$  fairness metrics by setting the diagonal entries of  $S$  to the weights for metric provides an over approximation of the  $\ell_{\infty}$  metric, which is also a valid over-approximation for any  $p \leq \infty$ . The key consequence of Theorem 5.1 is that it directly enables efficient certification of local  $\delta-\epsilon$  individual fairness. By over-approximating the fair distance with an axis-aligned orthotope, we are able to leverage the efficient methods developed for robustness certification (Gowal et al., 2018). Such methods allow us to take the given input interval and compute output bounds  $[y^L, y^U]$  such that  $\forall x \in [x' - \delta \sqrt{d}, x' + \delta \sqrt{d}]$ ,  $f^\theta(x) \in [y^L, y^U]$ . Subsequently, it is clear to see that if  $|y^U - y^L| \leq \epsilon$  then we have certified that  $\forall x' \in [x - \delta \sqrt{d}, x + \delta \sqrt{d}] \Rightarrow |f^\theta(x) - f^\theta(x')| \leq \epsilon$  which proves that local individual fairness holds according to Definition 1. Computing such output bounds requires the computational complexity of two forward Mirman et al. (2018); Gowal et al. (2018). MILP approaches, on the other hand, requires complexity cubic in the largest number of neurons in a layer plus requires exponentially (in the number of problem variables) many MILP iterations Benussi et al. (2022). We denote the function that takes the interval corresponding to an individual  $x$  and value  $\delta$  and returns  $|y^U - y^L|$  with the notation  $\overline{\mathcal{I}(f^\theta, x, \delta)}$ . Given that bound propagation methods are sound, this value over-approximates the  $\epsilon$  function in Definition 1. We emphasize that this approach to local fairness certification only takes two forward passes through the neural network, and can therefore be used as real-time decision support. We provide exact details of the computations of this upper bound in Appendix D. By exploring the orthotope using methods developed for adversarial attacks, e.g., PGD (Madry et al., 2017), we can find an input  $x^\star$  that approximately maximizes  $|f^\theta(x') - f^\theta(x^\star)|$ . Subsequently, this value is a valid lower-bound on the local IF violation around  $x$ . As such, we will denote the value produced by PGD as  $\underline{\mathcal{I}(f^\theta, x, \delta)}$ .
5.2 Certifying Distributional Individual Fairness
In this section we leverage the efficient upper bound on  $\mathcal{I}(f^{\theta},x,\delta)$  to prove bounds on distributional individual fairness. We first highlight that computing the Wasserstein distance between two known distributions is non-trivial, and that in general we do not have access to the joint distribution  $P^0$ . Thus, computing the Wasserstein ball around the data generating distribution is infeasible. To overcome this, as is traditionally done in the distributional robustness literature, we make the practical choice of certifying distributional individual fairness w.r.t. the empirical distribution  $\hat{P}^0$  which is the probability mass function with uniform density over a set of  $n$  observed individuals (Sinha et al. 2017). While this introduces approximation in the finite-sample regime, we can bound the absolute difference between our estimate and the true value by using Chernoff's inequality, discussion in Appendix D. Given the empirical distribution of individuals as well as IF parameters  $\gamma$  and  $\delta$ , we pose an optimization objective whose solution is the tightest value of  $\epsilon$  satisfying Definition 2.
$$
\epsilon^ {*} = \max  _ {\phi^ {(1.. n)}} \quad \frac {1}{n} \sum_ {i = 1} ^ {n} \mathcal {I} \left(f ^ {\theta}, x ^ {(i)} + \phi^ {(i)}, \delta\right), \quad s. t., \quad \phi^ {(i)} \in \mathbb {R} ^ {m}, \frac {1}{n} \sum_ {i = 1} ^ {n} | | \phi^ {(i)} | | ^ {p} \leq \gamma^ {p} \tag {3}
$$
Unfortunately, computing the optimal values of  $\phi^{(i)}$  even when  $n = 1$  is a non-convex optimization problem which is known to be NP-hard (Katz et al., 2017). We restate this optimization problem in terms of our bounds on  $\mathcal{I}(f^{\theta}, x, \delta)$  to get formal lower  $(\underline{\epsilon})$  and upper  $(\bar{\epsilon})$  bounds on  $\epsilon^{\star}$  such that  $\underline{\epsilon} \leq \epsilon^{\star} \leq \overline{\epsilon}$ .
5.3 Bounding Distributional Individual Fairness
Lower-bound on DIF Observe that any selection of  $\{\phi^{(i)}\}_{i = 1}^n$  satisfying the constraints represents a feasible solution to the optimization problem and therefore a lower-bound on the maximization problem of interest. Thus, the lower-bound can be stated as:
$$
\underline {{\epsilon}} = \max  _ {\phi^ {(1.. n)}} \quad \frac {1}{n} \sum_ {i = 1} ^ {n} \underline {{\mathcal {L}}} \left(f ^ {\theta}, x ^ {(i)} + \phi^ {(i)}, \delta\right) \quad s. t., \quad \phi^ {(i)} \in \mathbb {R} ^ {m}, \frac {1}{n} \sum_ {i = 1} ^ {n} | | \phi^ {(i)} | | ^ {p} \leq \gamma^ {p} \tag {4}
$$
We can optimize this lower bound to be tight by observing that for any given  $i$ , the function  $\mathcal{I}(f^{\theta}, x^{(i)} + \phi^{(i)}, \delta)$  is differentiable w.r.t.  $\phi^{(i)}$  and is therefore amenable to first-order optimization. In particular, we denote  $\phi_0^{(i)}$  to be a randomly selected, feasible assignment of  $\phi_0^{(i)}$ , we can then gradient ascent to find a locally optimal assignment of  $\phi^{(i)}$ :
$$
\phi_ {j + 1} ^ {(i)} \leftarrow \phi_ {j} ^ {(i)} + \alpha \nabla_ {\phi^ {(i)}} \underline {{\mathcal {I}}} (f ^ {\theta}, x ^ {(i)} + \phi^ {(i)}, \delta)
$$
where  $\alpha$  is a learning rate parameter. Subsequently, one could use a projection step in order to ensure that the constraint in Equation (3) is never violated. We note that this is a strict lower-bound unless the Equation (4) is solved exactly and  $\underline{\mathcal{I}}(f^{\theta}, x^{(i)} + \phi^{(i)}, \delta) = \mathcal{I}(f^{\theta}, x^{(i)} + \phi^{(i)}, \delta)$  for all  $i$ . Finally, we denote the computed solution to Equation (4) as  $I_{\gamma}(f^{\theta}, X, \delta)$  where  $\gamma$  is the distributional parameter of the DIF specification and  $X$  is the tensor containing the  $n$  individual feature vectors.