SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Upper-bound on DIF An upper-bound on the maximization in Equation (3), i.e.,  $\overline{\epsilon} \geq \epsilon^{\star}$ , constitutes a certificate that the model provably satisfies distributional individual fairness for all  $\epsilon$  greater than  $\overline{\epsilon}$ . Given that the optimization posed by Equation (3) is highly non-convex, searching for an optimal solution cannot be guaranteed to converge globally without knowledge of global Lipschitz constants, which are difficult to compute efficiently for large NNs (Fazlyab et al. 2019). Instead, we transform the optimization problem from one over the input space to the space of over-approximate local IF violations:
$$
\bar {\epsilon} = \max  _ {\varphi^ {(1.. n)}} \quad \frac {1}{n} \sum_ {i = 1} ^ {n} \overline {{\mathcal {I} \left(f ^ {\theta} , x , \delta + \varphi^ {(i)}\right)}} \quad s. t. \quad \varphi^ {(i)} \in \mathbb {R} ^ {+}, \frac {1}{n} \sum_ {i = 1} ^ {n} | | \varphi^ {(i)} | | ^ {p} \leq \gamma^ {p} \tag {5}
$$
The key change to the formulation is that we are no longer considering input transformations parameterized by  $\phi^{(i)}$ , but instead consider an over-approximation of all possible  $\phi^{(i)}$  that are within a  $\varphi^{(i)}$ -radius around the point  $x^{(i)}$ . Moreover, it is clear that picking any assignment of the  $\varphi^{(i)}$  values will not constitute an upper-bound on the DIF violation. However, the global maximizing assignment of  $\varphi^{(i)}$  values is guaranteed to over-approximate the value of Equation (3), formally stated in Theorem 5.2
Theorem 5.2. Given an optimal assignment of  $\{\varphi^{(i)}\}_{i = 1}^n$  in Equation (5), the corresponding  $\overline{\epsilon}$  is a sound upper-bound on the DIF violation of the model and therefore, is a certificate that no  $\gamma$ -Wasserstien distribution shift can cause the individual fairness of the model to exceed  $\overline{\epsilon}$ .
The proof of Theorem 5.2 is contained in Appendix E.3. Given that the function  $\overline{\mathcal{I}(f^{\theta},x,\delta + \varphi^{(i)})}$  is a continuous and monotonically increasing function, we have that the maximization problem in Equation (5) is quasi-convex. After proving this function is also Hölder continuous, one can guarantee convergence in finite time to the optimal solution with bounded error using recent advancements in quasi-convex optimization (Hu et al., 2020; Agrawal & Boyd, 2020; Hu et al., 2022). As the global optimal solution is guaranteed to be an upper-bound, we can use the methods for quasi-convex optimization to compute a certificate for the DIF property. In the Appendix we prove the Hölder continuity of  $\mathcal{I}$  and conduct numerical convergence experiments to validate this theory. Given that the result of this optimization is a certified upper bound on the DIF value, we denote its result with  $\overline{I_{\gamma}(f^{\theta},X,\delta)}$  where  $\gamma$  is the distributional parameter of the DIF formulation. While  $\overline{\epsilon}$  is a valid upper-bound on the DIF violation for the given dataset, in the low-data regime one may have non-negligible error due to poor approximation of the data distribution. The finite sample approximation error can be bounded by an application of Hoeffding's inequality as we state in Lemma 1
Lemma 1. Given an upper-bound,  $\overline{\epsilon}$  (a global maximizing assignment to Equation (5)) we can bound the error induced by using a finite sample from above by  $\tau$ . That is, the estimate  $\overline{\epsilon}$  is within  $\tau$  of the true expectation of  $\overline{\epsilon}$  with probability  $1 - \lambda$  as long as  $n$  is at least  $(-1/2\tau^2)\log(\lambda/2)$
5.4 Training Distributionally Individually Fair NNs
It is well-known that guarantees for certification agnostic neural networks can be vacuous (Gowal et al., 2018; Wicker et al., 2021). To combat this, strong empirical results have been obtained for neural networks trained with certified regularizers (Benussi et al., 2022; Khedr & Shoukry, 2022). In this work, we have proposed three novel, differentiable bounds on certified individual fairness. We
start by proposing a loss on certified local individual fairness similar to what is proposed in Benussi et al. (2022) but substituted with our significantly more efficient interval bound procedure:
$$
\mathcal {L} _ {\mathrm {F - I B P}} = \mathcal {L} (f ^ {\theta}, X, Y) + \alpha \overline {{\mathcal {I} _ {0} (f ^ {\theta} , X , \delta)}}
$$
where  $\alpha$  is a weighting that trades off the fair loss with the standard loss. When  $\gamma = 0$ , we recover exactly a local constraint on individual fairness for each  $x^{(i)} \in X$ . By increasing the  $\gamma$  from zero we move from a local individual fairness constraint to a DIF constraint:
$$
\mathcal {L} _ {\mathrm {U - D I F}} = \mathcal {L} (f ^ {\theta}, X, Y) + \alpha \overline {{\mathcal {L} _ {\gamma} (f ^ {\theta} , X , \delta)}}
$$
where U-DIF stands for upper-bound on DIF. This loss comes at the cost of increased computational time, but is a considerably stronger regularizer. In fact, given that the upper bound on certified DIF might be vacuous, and therefore difficult to optimize, at the start of training, we also propose a training loss that optimizes the lower bound on DIF as it may be empirically easier to optimize and serves as a middle ground between F-IBP and U-DIF:
$$
\mathcal {L} _ {\mathrm {L - D I F}} = \mathcal {L} (f ^ {\theta}, X, Y) + \alpha \overline {{\mathcal {I} _ {\gamma} (f ^ {\theta} , X , \delta)}}
$$
In this section we empirically validate our proposed method on a variety of datasets. We first describe the datasets and metrics used. We then cover a wide range of experimental ablations and validate our bounds on real-world distribution shifts. We conclude the section with a study of how IF training impacts other notions of fairness.
Datasets We benchmark against the Adult, Credit, and German datasets from the UCI dataset repository (Dua & Graff 2017). The German or Satlog dataset predicts credit risk of individuals. The Credit dataset predicts if an individual will default on their credit. The Adult dataset predicts if an individuals income is greater than 50 thousand dollars. We additionally consider three datasets from the Folktables datasets, Income, Employ and Coverage, which are made up of millions of data points curated from the 2015 to 2021 US census data (Ding et al., 2021). The Income dataset predicts if an individual makes more than 50 thousand US dollars, the Employ dataset predicts if an individual is employed, and the Coverage dataset predicts if an individual has health insurance. For each dataset gender is considered the protected attribute.
Metrics We consider four key metrics. For performance, we measure accuracy which is computed over the entire test-set. Next we consider the local fairness certificates (LFC), which is taken as  $1 / n\sum_{i = 1}^{n}\overline{\mathcal{I}_0(f^\theta,x_i,\delta)}$ . Next we consider the empirical distributional fairness certificate (E-DFC) which is the maximum of the LFC taken over a set of observed distribution shifts. That is, we observe a set of individuals drawn from a distribution shift,  $x^{(k)}\sim P^k$ , where  $P^k$  represents a shift of geographic context (e.g.,  $P^0$  being individuals from California and  $P^1$  being individuals from North Carolina) or a shift in time. E-LFC is then defined as  $\max_{j\in [k]}1 / n\sum_{i = 0}^{n}\overline{\mathcal{I}_0(f^\theta,x_i^{(j)},\delta)}$ . Finally, we consider the adversarial distributional fairness certification (A-DFC) which is our computed value of  $\overline{\mathcal{I}_{\gamma}(f^{\theta},x_i,\delta)}$ . Unless stated otherwise, we use  $\delta = 0.05$ ,  $\gamma = 0.1$ , and with respect to 1000 test-set individuals. Complete experimental details are given in Appendix A.
6.1 Comparing Training Methods
In Table I, we compare different individual fairness training methods on three datasets from Ding et al. (2021). For each dataset, we train a two layer neural network with 256 hidden neurons per layer. We compare with fairness through unawareness (FTU) which simply removes the sensitive feature and sensitive subspace robustness (SenSR) (Yurochkin et al., 2019). We observe a consistent decrease in accuracy as we increase the strictness of our constraint. While FTU has the best performance, we are unable to compute strong IF guarantees. This result is expected given that it is well-known that guaranteeing the performance of certification-agnostic networks is empirically challenging (Gowal et al., 2018). Similarly, we observe that SenSR has a positive effect on the DIF guarantee while paying a  $2 - 5\%$  accuracy cost. When only enforcing local guarantees with F-IBP, we observe a  $3 - 5\%$
$^{1}$ Code to reproduce experiments can be found at: https://github.com/matthewicker/DistributionalIndividualFairness
Income	Employ	Coverage
Acc	LFC	E-DFC	A-DFC	Acc	LFC	E-DFC	A-DFC	Acc	LFC	E-DFC	A-DFC
FTU	0.820	0.999	0.999	1.000	0.809	0.891	0.906	0.999	0.721	1.000	1.000	1.000
SenSR	0.782	0.895	0.931	0.995	0.743	0.247	0.300	0.639	0.709	0.538	0.865	0.899
F-IBP	0.771	0.076	0.092	0.130	0.743	0.040	0.090	0.178	0.699	0.162	0.253	0.288
L-DIF	0.763	0.035	0.051	0.095	0.738	0.025	0.051	0.091	0.698	0.101	0.128	0.136
U-DIF	0.725	0.002	0.002	0.042	0.724	0.000	0.006	0.067	0.681	0.000	0.042	0.071
Table 1: Performance of each training method across three folktables datasets. For each dataset we give the accuracy (Acc, ↑), local IF violation (LFC, ↓), empirical DIF violation (E-DFC, ↓), and the adversarial DIF violation (A-DFC, ↓). We observe a consistent drop in accuracy across datasets as we enforce more strict DIF constraints. However, we notice orders of magnitude decrease in the individual fairness violation across all three metrics as methods impose stricter constraints.
Figure 2: Empirical algorithm analysis for our upper and lower bounds on DIF. Left: Computational time comparison between MILP training (times reported in (Benussi et al., 2022)) and L-DIF demonstrates our methods considerable advantage in scalability. Center: As the NNs get larger our DIF certificates get looser, as expected with bound propagation methods (Gowal et al., 2018). Right: As we increase  $\gamma$  we also increase the gap between our upper and lower bounds due to the over-approximate nature of our upper-bounds.
decrease in accuracy, but achieve an order of magnitude decrease in the local and distributional fairness violations. Using both L-DIF and U-DIF results in the strongest IF and DIF guarantees, albeit at a larger accuracy cost. Each regularization method proposed provides a different fairness-accuracy trade-off which should be carefully chosen to suit the needs of a given application.
6.2 Empirical Bound Analysis
In this section, we provide an overview of our algorithm's performance as we vary architecture size and the distributional parameter  $\gamma$ . In the left-most plot of Figure 2 we use stars to plot the computational times reported to train a single hidden layer neural network from (Benussi et al., 2022). We use squares to denote the amount of time used by our most computationally demanding method (L-DIF). Our method scales up to 4096 neurons without crossing the one hour threshold. We report an extended version of this experiment in Appendix B. Moreover, the results from this paper were run on a laptop while the timings from (Benussi et al., 2022) use a multi-GPU machine.
In the center plot of Figure 2, we show how the value of our upper bound on the DIF violation grows as we increase the size of the neural network. As the neural network grows in size, we observe a steady increase in our upper-bounds. This is not necessarily because the learned classifier is less individually fair. The steady increase in the bound value can be attributed to the approximation incurred by using bound propagation methods. It is well-known that as the neural networks grow larger, certification methods become more approximate (Gehr et al., 2018; Wicker et al., 2021).
In the right-most plot of Figure 2, we show how our upper and lower bounds respond to increasing the distributional parameter  $\gamma$ . As  $\gamma$  grows, we expect that our bounds become loose due to the over-approximation inherent in our bounds. Here we consider a two-layer 16 neuron per-layer NN. Indeed we observe in the right-most plot of Figure 2, that the gap between our upper and lower bounds grow to almost an order of magnitude when we increase  $\gamma$  from 0.01 to 0.2.
(d)
Figure 3: Evaluating our bounds versus real-world distribution shifts. Column (a): An empirical distribution of Wasserstein distances between the distribution of individuals from different pairs of states, we certify w.r.t the upper quartile of these distributions. Columns (b) - (e): We plot the local fairness certificates (LFC) for each of the shifted dataset using a boxplot. We then plot our lower bound on the worst-case DIF violation as a blue triangle and our upper bound on the worst-case DIF violation as a red triangle.
6.3 Certification for Real-World Distribution Shifts
In this section we compare our adversarial bounds on DIF against real-world distribution shifts. In Figure 3 we study our ability to bound a shift in geographical context. We use the folktables dataset (Ding et al., 2021) and assume we can only train our model using data from California. We would then like to ensure that our model is individually fair when applied to other states. We start by computing the Wasserstein distance between the data observed for different states. The distribution of these values is plotted in Figure 3(a). By estimating the pairwise Wasserstein distance between the states data we can estimate what  $\gamma$ . In practice, one would use domain knowledge to estimate  $\gamma$ . Each dataset has a different worst-case  $\gamma$  value, i.e., 0.15 for Employ versus 0.4 for Coverage. In Figure 3(b)-(e) we then compute our upper bounds (red triangle) and lower bounds (blue triangle) for each observed value of  $\gamma$ . We also plot the observed local individual fairness certificates centered at each of the shifted datasets, i.e., the local fairness of our model when applied to North Carolina etc., and plot this as a box plot. We observe that our lower-bound tightly tracks the worst-case observed individual fairness. Our upper-bound is over-approximate but reasonably tight, especially for NNs trained with DIF guarantees. The validation of our upper and lower bounds against real world DIF violations highlights the value of our bounds as a scalable, practical, and sound source of guarantees for individual fairness such that model stakeholders can justify deployment.
In conclusion, our proposed method addresses the crucial need for scalable, formal guarantees of individual fairness. Our novel convex approximation of IF constraints enables efficient real-time audits of individual fairness by significantly reducing the computational cost local IF certification. We introduced the first certified bounds on DIF and demonstrated their applicability to significantly larger neural networks than previous works. Our empirical investigation of real-world distribution shifts further validated the scalability, practicality, and reliability of the proposed bounds. Our bounds on DIF violations offer a robust source of guarantees for individual fairness, enabling model stakeholders to justify the deployment of fair machine learning algorithms.
Limitations This work improves the scalability of prior IF guarantees by more than two orders of magnitude. However, the models we consider are smaller than models that may be deployed in practice we hope to further improve scalability in future work.
Broader Impact This work focuses on fairness quantification and bias reduction which is one critical aspect of developing socially responsible and trustworthy machine learning (ML). We highlight that this work focuses on individual fairness which is only one aspect of fairness in machine learning and on its own does not constitute a complete, thorough fairness evaluation. Experimental analysis of the impact of DIF on group fairness is in Appendix B.4. The intention of this work is to improve the state of algorithmic fairness in ML, and we do not foresee negative societal impacts.
Yurochkin, M., Bower, A., and Sun, Y. Training individually fair ml models with sensitive subspace robustness. arXiv preprint arXiv:1907.00020, 2019.
Zilka, M., Butcher, B., and Weller, A. A survey and datasheet repository of publicly available us criminal justice datasets. Advances in Neural Information Processing Systems, 35:28008-28022, 2022.