Adversarial Learned Fair Representations using Dampening and Stacking
Authors: Max Knobbout
Venue: Submitted to ICLR 2023 (2023)
Keywords: Machine Learning
Deep Learning
Fairness
Adversarial Learning
Fair Representation Learning

Abstract: As more decisions in our daily life become automated, the need  to have machine learning algorithms that make fair decisions increases. In fair representation learning we are tasked with finding a suitable representation of the data in which a sensitive variable is censored. Recent work aims to learn fair representations through adversarial learning. This paper builds upon this work by introducing a novel algorithm which uses dampening and stacking to learn adversarial fair representations. Results show that that our algorithm improves upon earlier work in both censoring and reconstruction.

Under review as a conference paper at ICLR 2022
ADVERSARIAL LEARNED FAIR REPRESENTATIONS US- ING DAMPENING AND STACKING
Anonymous authors Paper under double-blind review
ABSTRACT
As more decisions in our daily life become automated, the need to have machine learning algorithms that make fair decisions increases. In fair representation learn- ing we are tasked with finding a suitable representation of the data in which a sen- sitive variable is censored. Recent work aims to learn fair representations through adversarial learning. This paper builds upon this work by introducing a novel algorithm which uses dampening and stacking to learn adversarial fair represen- tations. Results show that that our algorithm improves upon earlier work in both censoring and reconstruction.
INTRODUCTION
The need to have machine learning algorithms that make fair decisions becomes increasingly impor- tant in modern society. A decision is fair if it does not depend on sensitive variable such as gender, race, or age. Models trained with biased data can lead to unfair decisions Mchrabi al. (202I) In fair representation learning we are tasked with finding a suitable representation of the data in which the sensitive variable is censored. This ensures that these representations downstream task, such as classification or segmentation, which should not rely on the value of the sensitive variable. Throughout this paper, we often refer this sensitive variable as the protected variable.
be used for any
Fairness can be applied to machine learning algorithms roughly three stages of the process: during preprocessing, inprocessing or pestprocessing. With preprocessing we aim to learn a new represen- tation of the input data which more fair. A well known example of this is Zemel et al. (013)). which obfuscates inputs when it can lead to unfairness. With inprocessing techniques the task is to make a machine learning algorithm more fair during training. typically by modifying the learning algorithm or by adding extra constraints to the learning objective. With postprocessing to correct the predictions of machine learning algorithm after training in order to achieve fairness. In recent years, inprocessing techniques such as Zhang al. (2018) have become very popular since they typically strike an optimal balance between accuracy and fairness. However, the major ad- vantage of preprocessing over any other technique is that the transformed data can be used for any downstream task, both supervised and unsupervised. This makes preprocessing still invaluable in many practical applications where we know the protected variable beforehand, but have no specific machine learning task in mind yet. Hence the focus on preprocessing in this paper. Moreover, as shown in McNamara et al. (2017), preprocessing techniques can still provide with theoretical fairness guarantees if required.
are trying
It is important note that the notion of fairness not trivial, and multitude of fairness constraints have been proposed pertaining to both group fairness and individual fairness Mitchell et al. (202T). In this paper we adopt the demographic parity constraint due its widespread use in benchmarking and evaluating fairees of machine learning algorithms. Demographic parity enforces that classifier treats the data containing the protected variable statistically similar to the general population, and major downside of this criterion is that it tends to cripple accuracy as long we achieve equal acceptance rates. In reality, for every specific dataset and problem we need to assess which fairness criterion is most applicable and cannot simply select one preferred Verma & Rubin 2018). The upside however is that in this paper we encode our fairness constraint in the form of a loss function, and shown in Madras al. (001)) are able to associate different loss functions to different

---

Under review as a conference paper at ICLR 2022
group fairnsss constraints. This makes this approach applicable to far more fairness metries than the one that we adopted in this paper.
Often with learning fair representation, the naive approach of dropping certain features of the data is insufficient. The origin of the bias might latently depend on some nonlinear combination of other variables, and can thus leak back into decision making model. This inspired the work by Edwards & Storkey (2016), which aims to learn a fair representation through adversarial learning. They use an auto-encoder as a generator for the new representation whose aim is learn new latent representation which attempts to censor the protected variable for the adversary. This work was later extended in Madras et al. (2018) where they propose learning objectives for other fairness metries such as equalized odds and equal opportunity. In In|Kenfack et al. (2021) this work was further extended by introducing stacked auto-encoders to enforce fairness and improve censoring at different latent spaces.
This work builds on the previous adversarial approach. In particular it focuses on the case where the downstream task we may encounter is unknown, i.e. it can be either some supervised classification objective or some unsupervised clustering or segmentation objective. The challenge with learning fair representations is that on one hand we want to censor the data, and on the other we want to retain as much information as possible. Since these objectives are often opposed. the approaches in Edwards & Storkey (2016). Madras et al. (2018). Kenfack et al. (202T), and various others define the global objective of the model as a weighted sum of reconstruction error and predictive loss. This requires the trainer of a model to select some suitable hyperparameter which defines how much we value reconstruction error over predictive loss. This hyperparameter often has a large impact on the learned representations we get, and we can identify at least three issues with it. Firstly, we have no priori knowledge on how the reconstruction error and the predictive loss relate. It could be nonlinear, which makes it almost impossible to make an informed decision beforehand. Secondly, the value of this hyperparameter gives us no formal guarantee of the censoring capabilities of the model. Some values can cause a collapse of the model. Thirdly, the hyperparameter choice is not explainable to the relevant stakeholders of the model. This makes it impractical for most industry use cases where hyperparameter choices need to be justified, As such, many authors using this methodology such as Edwards & Storkey (2016), [Beutel et al. (017). Madras et al. (018)) Feng et al. (2019), Kenfack approach, or an arbitrary chosen constant, with regard to the choice of this hyperparameter. More often than not, the censoring capabilities of the learned representation are a hard constraint of the model. Thus, in many industry use cases, we are only interested in finding solutions in some restricted hypothesis space abiding some censoring constraint.
et al. (2021) use a
A second perhaps even greater issue with the previous work is its instability. In particular, due to the unstable dynamic between actor and adversary we often learn suboptimal solutions. This has been observed in many cases such as Edwards & Storkey (2016) and Kenfack et al.) (202I). but never fully addressed. This paper attempts to mitigate these issues by introducing a novel algorithm for learning fair representations. In particular, it uses dampening to stabilize the interaction between actor and adversary, and uses stacking to learn strong censored representations within a restricted hypothesis space.
The remainder of the paper is structured as follows: in Section 2 we briefly reiterate related work, in Section 3 we formally define the problem, in Section 4 we introduce the algorithm, in Section we discuss the experiments and results, and in Section 6 we conclude this work.
2 RELATED WORK
In Zemel et al. 2013) the first fair representation learning approach was presented. Their method- ology aims to map input data to a new representation in terms of a probabilistic mapping to a set of prototypes. Several other noteworthy algorithms for finding fair representations are further explored in Feldman et al. (2015) and Calmon et al.) (2017).
In Louizos et al. 2016) an architecture based on the Variational Auto-Encoder (VAE) was proposed in order to learn fair representations, called the Variational Fair Auto Encoder A similar idea is explored in Locatello et al. (2019). Although the idea of disentanglement between the protected variable and other features seems promising, it has not found widespread use yet due to the difficulty of finding independence between the sensitive and latent factors of variations.
2

---

Under review as a conference paper at ICLR 2022
In Edwards & Storkey (2016) the first adversarial approach was introduced to learning fair repre- sentations. They use an auto-encoder as a generator for the new representation whose aim is to lear new latent representation which attempts to censor the protected variable for the adversary. Many paper in the fairness community have followed this line, noteworthy [eutel et al. (2017) and Feng et al. (20T9). This work was extended by Madras al. (2018) where they propose learning objectives for other fairness metrics. In Kenfack et al. (2021) this work was further extended by introducing stacked auto-encoders enforce fairness at different latent spaces.
PROBLEM DEFINITION
This paper focuses purely on representation learning rather than classification. The aim to learn a fair representation independent of the downstream that may be encountered (supervised or unsuper- vised). The notation of Edwards & Storkey (2016) of using the letter X to represent the data, and S to represent the protected variable is adopted. Each 24; X is assumed to be some real-valued vec- tor 24 E RR", and each 8; E S is either 0 or 1, denoting if instance i sensitive or not: 8; &E {0. 1) As argued in the introduction, the demographic parity constraint is adopted Dwork al. (2012)
given data X and protected variable S, the aim is to learn a new representation J(X) for which it holds that for any predictor 9 derived from f(X) we have g(f(X)) 1 S, i.e. ((f())) and are independent. In short, the aim is to find representation f(X) which give no predictive preference towards S. Throughout this paper (X) is referred to as the censored representation. is important to note that the censored representation is not (necessarily) in the same space as the original data, and can have a different number of dimensions.
On one hand the aim is to censor the representation, while on the other hand the goal is to retain as much information as possible. In order to capture these opposing objectives, the learning objective adversarial learning problem. Similar to Edwards & Storkey (2016) and various
can be framed papers following this, two agents are modeled with competing objectives: An auto-encoder e with corresponding decoder d representing the actor; and classifier h representing the adversary. As per usual, e, d and are implemented in this paper using a feed-forward neural network. The aim to find censored representation e(X). The objective of the adversary is to predict S from the censored representation e(X), while the aim of the actor is to learn this censored representation such that d(e(X)) ) is as close X as possible (the normal objective of an auto-encoder) and deny the adversary from being able to learn S from e(X).
To make these notions precise, let Cas be the loss of the auto-encoder, and it to be the mean- squared error (MSE), alternatively reconstruction error:
pact a,
Σ 1,, | 2,EX
X
Moreover, the loss of the adversary set to be the negative cross-entropy loss over S:
Lech
cadv
1
Σ
(;,og($i) + (1 s:) log(1 8:)
X
Note that in Madras et al. 2018) multitude of other loss functions are proposed which lead to different notions fairness (e.g. equal opportunity or equalized odds), but as argued earlier this paper optimizes for parity. Defining the loss to be the negative cross-entropy allows us frame it as maximization problem rather than minimization one, which entails that the joint objective of the actor and adversary is in the form of a min-max problem. Particularly, let L(e,, d, h) be the joint loss, and define as a weighted sum of Cast and gade.
cade Lle, d, h) = cast + aL
Here is some predetermined chosen hyperparameter denoting the importance of Cast over Lech- Since the negative cross-entropy loss is considered, the aim is to minimize this loss under the as- sumption that the adversary is trying to maximize this. Thus, the aim is to find e and d which satisfy the following:
min max ((e, d. h)
3

---

Under review as a conference paper at ICLR 2022
Once these and d have been found, the fair representations can be computed with e(X) and the censored original representation by d(e(X)). Reason to use the latter can be due to the fact that these representations share lot of the inherent properties of X both dimension- and structure-wing Thus, depending on the use case and task, e(X) or d(e(X)) can be used to characterize the censored data.
3.1 RESTRICTING THE HYPOTHESIS SPACE
A problem with the joint loss function C(e, d, h) is the correct choice of a. This hyperparameter needs to be selected beforehand, and it has large impact on the representations that are learned. Since (1) there is typically no a priori knowledge on how Lag and Ladi relate for a given X and S, (2) choices of a give no formal guarantee on the censoring ability of the encoder, and (3) choice of a is hard to explain
the relevant stakcholders, any choice of a is hard to justify and interpret. Additionally, low and high values for a could cause the trivial function to be learned, i.e. either the encoder learns an uncensored representation, or constant function is learned.
In order to eliminate these problems, we propose a different objective function. More often than not, the censoring capabilities of the target function are hard constraint on the resulting model. We recognize that perfect censoring is in most cases not feasible, and as such these hard constraints should define a hypothesis space of possible target functions. An example hard constraint could be that we do not wish that very competent adversary receives above 60% accuracy trying to classify the gender based on a loan application. Such a hard constraint solves the problem of not having formal guarantee of the target function, and is both more intuitive and explainable to the relevant stakeholders.
To formalize this, score function scorex,s,e and accompanying threshold T is assumed to be specified beforehand which evaluates the performance of adversary h based on data X, S and encoder e. The constrained hypothesis space É for can be defined as follows:
E =
saore(arg max((edt (add)) I T)
X,S.e
assumed that score and T are chosen in accordance with the distribution of S such that É is nonempty, e.g. if an accuracy score is used, T' should at least be 50%. The global objective is now to simply to minimize Lad by only considering encoders from the viable hypothesis space É, that
to optimize min e Cerd- In order to find solutions in É, different optimization methods need to be used. One of the main contributions of this paper is that such an algorithm is supplied.
ADVERSARIAL LEARNING USING STACKING AND DAMPENING
Before delving into the technical details, is worthwhile to discuss the shortcomings of the current approach. As mentioned in Edwards & Storkey 2016), Madras al. (2018), and various other papers, it is very difficult to train these models due to the unstable dynamic between the actor and the adversary. This is true for adversarial learning general because of the underlying saddle point optimization problem. Different approaches in literature have been proposed to stabilize adversarial networks, ranging from simple solutions such early stopping weight clipping Arjovsky et al. 2017) to more intricate ones such as adding extra stabilizing steps Yadav et al. (2018). A multitude of stabilization methods exist, but the downside is that they need be adapted accordingly to the properties of the loss function Xing et al. (202T). Thus, in the context of our setting, it is worthwhile to investigate what the root cause of the instability is. During training, the actor continuously updating in the direction to make the adversary worse at predicting the protected variable (recall that the objective of the actor is to minimize the negative cross-entropy loss of the adversary. while the adversary is trying to maximize this). A key insight here is that the loss signal that the adversary is giving to the actor is paradoxical in nature:
If the magnitude of the loss is high, the adversary is incompetent at predicting S. Since the adversary is also updating its own loss towards O. it means we are at a point where the gradient of the loss will be high. This in turn will result in big update of the actor.
4

---

Under review as a conference paper at ICLR 2022
However, the adversary already incompetent at predicting S, but big update in an uninformative direction is performed as opposed to a smaller conservative update.
If the magnitude of the loss is relatively low, the adversary is competent at predicting S. When the loss is relatively smooth at local maxima, a low magnitude of the loss will more often than not result in small update of the actor. However, the adversary competent at predicting S, but we are performing a small update in an informative direction when we would rather perform bigger less careful update.
already
The key issue is thus that if the adversary is too competent then the gradients will be weak, and if the adversary is too incompetent the gradients will be uninformative. This interplay between the competence of the adversary and the size of the gradients is also mentioned in Edwards & Storkey (2016), but not further explored.
Now consider what this means when we are actually training and updating the actor and adversary. When the weights of the actor and adversary are adjusted in turns, as described Goodfellow et al. (2014). there is risk that the adversary will never be sufficiently competent in the task. This is particularly true when a strong adversary used with a lot of parameters, which typically need more batches to converge. This means that constantly big weight adjustments in an imprecise direction are made, which again causes the adversary to be incompetent. On the other hand when the adversary is trained in the inner loop, apart from it being very inefficient, would also run the risk of the adversary being too strong, and not being able to make any meaningful updates.
To mitigate these problems and make the training process more stable, the notion of dampening introduced.
4.1 DAMPENING
Dampening is function that serves as modulating term of our algorithm in the interaction between actor and adversary. Similar ideas for weighted loss schemes such as focal loss have been proposed for imbalanced datasets Lin et al. (017), but here it is applied to modulate the actor and adversary. Dampening returns number between and I denoting how much information the classifier has over a training sample. First, define g as function over subsets S" of our protected variable S' S:
9(8')
max
Σ E'S
E1 1-8
Σ E'ES'
S
In words, g(S") represents the best possible accuracy a predictor can receive when using only infor- mation about S" Observe that since the protected variable is binary, g(S") [0.5, 1]. The role of g(S") is to serve as baseline guessing accuracy.
Now given a classifier f and training sample X',S', dampening is defined as:
8(J, max(0, acc(ff X',S') -(S))
In the above definition, ace(f, X', SS)) is used as shorthand notation to denote the accuracy score of on training sample X', S Whenever g(S") 1, we 8(ʃ, X', S') O. In words, dampening ō(f, X', S') E [0, tells us the percentage decrease of number of misclassifications would we use instead of guessing the most frequent label in the sample. Whenever dampening is for f. we know that f achieves perfect accuracy on the training sample X', S", and whenever dampening is 0 we would be no worse off by just informed guessing. Thus, dampening is measure of information a classifier has over a certain classification task. An important property of dampening is that it is contained within the unit interval, meaning that it can be used as a modulating term since the results will never be larger than the original value. Multiple notions of bounded information were explored, but found dampening to work the best for a variety of tasks. We suspect it is due to its linear scaling with the number of correctly classified samples whenever its value is nonzero; small increase in correctly classified samples translates in a small increase in dampening, and vice versa for big increase.
5

---

Under review as a conference paper at ICLR 2022
Algorithm ALFR-DS
Initialize = id, initialize (aet and (adv randomly.
> Start with the "empty" encoder.
repeat
Initialize Enew randomly.
Enew e
Add new encoder to the (frozen) stack.
repeat
X S' random mini-batch from X,S
L Ced (X')
L Leh (',5)
(act = (act 1l (V (Vgnct gact L Lact + X', Vaaee L Lddv
godv godv + 17 (1 8(h o e, X", S')) Dada I,ade
until Sufficient epochs reached.
Freeze encoder e.
until scorex,s,e - T or Deadline reached.
4.2 STACKING
Stacking is technique for censoring which was recently introduced in Kentack et al. (202T). The idea that during training we start out with a simple encoder which learns a censored representation. After this initial training phase, we freeze the encoder and append new trainable one. This process continues until we are completely done with training. Another perspective on this process that once we learn censored representation, except that we use the censored representation as the new input. The key idea behind stacking is that censored representation is learned and frozen, it is highly likely that some information about the protected variable is lost for good. Thus in theory, repeating the stacking operation can give us representation with arbitrary strong censoring properties.
recursively start over completely new training process,
is important to note that the authors found that stacking did increase censoring over the original approach, but unsurprisingly also comes at the cost of reconstruction error. In other words, stacking should preferably be combined with a very careful and stable censoring algorithm, which in our case handled by the addition of dampening. Stacking together with dampening serves the basis for our algorithm.
4.3 ALFR-DS
In Algorithm T a new algorithm is proposed called ALFR-DS ("Adversarial Learned Fair Represen- tations using Dampening and Stacking"). This algorithm differs from basic ALFR, as discussed in Edwards & Storkey (2016), on three key aspects:
A different loss function for the actor and adversary is used, instead of the same function
[(e, d, h) as given in Section 3 for both.
An inner loop for normal backpropagation is used, and an extra outer loop which incorpo- rates stacking is added. An extra termination condition is added which allows us to find solutions in the restricted hypothesis space E, as defined in Section/.11
The actor and adversary are trained concurrently instead of interleaved.
In the description of the algorithm, Lest (X') (X') and Lade (X', 5") is used to denote the loss functions defined in Section 3 applied to X' and S'. Moreover gact and gado refer to the model parameters of the actor (e and d) and subsequently the adversary
(h). The fixed learning rate can be replaced with a parameter-dependent dynamic one: in all of the experiments the Adam optimizer has been found to work the best Kingma & Ba (2014).
The role of dampening the adversary is weak, 8 will be close to 0 in our algorithm. This means the actor will hardly use the loss of the adversary in updating the censored representations, i.e. it will act like a normal auto- encoder. Since representation learning in normal auto-encoder is stable, it gives the adversary time to learn and catch up. Whenever the adversary is strong, will be close to 1, meaning the adversary will hardly update itself. This allows the auto-encoder incorporate the loss of the adversary and
the algorithm is to act like a "fuzzy" turn-taking mechanism: whenever

---

Under review as a conference paper at ICLR 2022
learn censored representation. In other words, the actor can catch up. This is how dampening attempts to stabilize the learning process: it gives either the actor or the adversary time to catch up, resulting in only informative updates of the model. In the experiments extra stabilizing methods such as gradient clipping were needed.
The width and depth of the encoder that is added to the stack be varied at any moment. In our implementation, every subsequent encoder after the first uses the same input and output size. In order to be able to censor nonlinear relations in the data at every step, every encoder is given single hidden layer. It is important to note that the adversary / can have any neural architecture, depending on the desired censoring strength of the resulting model. It is also important to note that a strong adversary typically means longer training period for convergence.
The termination condition scorex,s,e S T tells us when an encoder is contained within the desired hypothesis space given adversary h. Although not explicitly mentioned in the algorithm, it sometimes beneficial to fully train h on the training data X, S without additionally training the encoder after termination of the inner loop. This is to ensure that the adversary is fully converged before an assessment about the censoring capabilities of the model made. Under the reasonable assumption that score is chosen in such a way that it eventually decreases as Lede decreases, and that
fex decreases after a completion of the inner loop, it can be concluded that scorex,s,e (h) S T will eventually hold. In other words, ALFR-DS will eventually find a solution in the constrained hypothesis space. In order to encourage that Lede decreases after completion of the inner loop, the hidden size of each encoder that is added to the stack can be decreased, or the inner loop can be terminated early. However, since it is often undesirable that the model complexity of the encoder grows arbitrarily large, an extra deadline criterion is used to allow early stopping. Whenever an early termination occurs, a solution with the desired censoring capabilities was not found within the complexity bounds of the model.
5 EXPERIMENTS AND RESULTS
This section consists of two different experiments that were conducted. Motivated by the image anonymization task proposed in Edwards & Storkey (2016), the aim of the first experiment is to closely compare ALFR with ALFR-DS on a widely used image dataset (MNIST; Deng] (2012). The second experiment is more general and aims to compare several variants of ALFR, ALFR-DS and other preprocessing algorithms from the widely used IBM AI Fairness 360 package |ellamy et al. (2018) on several widely used faimess-rrelted datasets.
5.1 MNIST
The dataset contains 60,000 handwritten images with corresponding labels. The goal is to censor all the 8s in the dataset, i.e. the protected variable 8; is set to 1 whenever the label is 8, and otherwise. Even though this task does not serve a direct practical use, it is great benchmark for its inherent challenging properties. In particular, the protected variable is unevenly distributed and the task is very nonlinear in nature. Moreover, due to its wide spread it allows for easy replication.
In this experiment the goal is to compare ALFR-DS to ALFR in its ability to reconstruct and censor. In order ensure fair comparison, every model was trained for 30 epochs. For ALFR-DS, variants were considered: ALFR-DS(1) which runs the inner loop of Algorithm [ once for 30 epochs, ALFR-DS(2) which runs the inner loop twice for 15 epochs, and ALFR-DS(3) which runs the inner loop three times for 10 epochs. Both ALFR-DS and ALFR used the same Multi-Layer Perceptron (MLP) adversary. However, we observed that ALFR typically performs better against a weak ad adversary, so we also considered a variant of ALFR against an adversary using simple Logistic Regression (LR). These two variants are referred to as ALFR (MLP) and ALFR (LR). For ALFR several values for a were tried, but only report for a = 1 since ALFR-DS outperforms ALFR for all nontrivial choices of a in both censoring and reconstruction. Both ALFR-DS and ALFR were given the same number of target dimensions to embed to. In order to measure how well model censors, each model was trained on one slice of the data, after which another slice was used for evaluation. Two new classifiers, one using LR and one using MLP, were freshly trained these new representations and were asked to predict protected variable S. The resulting accuracy scores were used as a benchmark (lower is better). Additionally, normal auto-encoder was trained that did
7

---

Under review as a conference paper at ICLR 2022
0.08
Algorithm
LR
MLP
ALFR-DS(1))
DS12)
ALFR-DS(())
0.91 = 0.01
0.98 0.01
ALFR-DS13)
ALFR-DS()
0.9 0.0
0.05
0.06
ALFR (LR)
ALFR-DS())
0.91 0.0
0.93
0.05
Uncensored
ALFR (MLP)
ALFR (LR)
0.92
0.01
ALFR (MLP)
0.93 0.02
0.05
0.04
Uncensored
0.96 + 0.0
0.99
0.03
4
5
8
3
3
0.02
4
5
3
3
2
0
10
15
20
25
30
9
0
3
3
8
Epoch
Figure 1: Left shows the reconstruction eπror (MSE) over 30 epochs for the MNIST task. Top-right lists all the accuracy scores of different adversaries with increasing strength trained on the final representation, where lower is better. Bottom-right shows some examples of the original MNIST digits (black outline at the top) which were both censored by ALFR-DS(3) (green outline in the middle) or by ALFR (LR) (red outline at the bottom).
not use an adversary and called this Uncensored (which is equivalent of using ALFR with a = 0). All experiments were repeated 10 times to account for naturally occurring deviations in the results.
In Figure the result of the experiment can be seen, which also provides a visual output of ALFR- DS(3) versus ALFR (LR). In one instance ALFR-DS censors an 8 to 3 and in another instance an to a 6. From this visual inspection, it is clear that a lot more information is lost about the original images with ALFR. Moreover, an "imprint" of an 8 across most images in the censored representations can be observed. The "spikes" in the reconstruction graph occur at the times in which new encoder is added to the stack; in this case the loss briefly rises since each new encoder is initiated randomly. It is also interesting to note is that for the first 3 to epochs, the graphs of ALER-DS and Uncensored are almost identical due to the fact that especially in the early phases dampening will be relatively small. The learned representations are still evolving lot, meaning that the adversary has no time to become competent at predicting S. Only when the representations start to stabilize after approximately 5 epochs, a difference in the graphs can be observed.
The lowest theoretical accuracy that can be achieved due to the distribution of S is 0.9 for this task and the highest possible accuracies are reported for Uncensored. Again ALFR-DS DS achieves superior results in both censoring and reconstructing over ALFR. It is clear from the results that the number of stacked encoders in ALFR-DS does come at the cost of reconstruction. Particularly, outperformed by ALFR-DS(3) in terms of censoring, however ALFR-DS(() leaves much more of the data intact. It is thus clear that balance has to be struck between censoring and reconstruction, which is normally handled by the algorithm with the use of the score function with accompanying threshold T. In both tasks when it comes to censoring, ALFR-DS(2) and ALFR-DS DS((3) perform similarly except when a strong nonlinear MLP adversary was tasked to predict S, in which case it becomes clear that ALFR-DS(3) has greater censoring capabilities. It is noteworthy to observe that ALFR(LR) outperforms ALFR(MLP) for censoring even though a weaker adversary was used during training. The reason is that LR converges much faster, and thus gives a more informative loss signal to the actor after each turn. Due to dampening, ALFR-DS does not have this problem and can reliably be used against strong adversaries.
5.2 AIF360 BENCHMARK
To really see how ALFR-DS performs in practice, is compared to several preprocessing algorithms on several datasets using AIF360. Finding the right comparison is non-trivial, since ALFR-DS is designed to leam a censored representation for any target variable as opposed to one specific variable. In practice this means that ALFR-DS does not have access the target variable training time, putting at a major disadvantage. Taking this into consideration, it is still worthwhile to investigate how ALFR-DS compares.
8

---

Under review as a conference paper at ICLR 2022
Dutaset
Adult
German
Bank
COMPAS
Sex
Race
Sex
Age
Age
Sex
Race
App
App
App
BA
App
BA
App
BA
App
ALFR-DS(
69
17
68
63
5
62
10
60
3
66
14
64
15
ALFR-DS(2)
68
15
66
'58
"4
*58
'8
*58
3
65
13
64
13
ALPR-DS(3)
67
14
67
'51
22
-57
*7
557
*3
63
11
63
12
ALFR-S(1)
73
18
73
5
*6
557
3
66
65
ALPR--(2))
70
17
68
*55
55
"53
*7
"51
*1
61
11
62
12
AL3R-S(3)
69
17
69
'55
5
554
*7
551
*1
*58
"8
"58
"11
75
17
76
65
68
11
83
5
67
15
67
8
LFR
550
50
0
550
0
55
00
55
22
Uncensorad
78
18
78
66
70
16
75
68
68
Table 1: Results (%). Best are given in bold and discarded (< 60% BA) marked with *
This experiment conducted on several datasets and protected variables. For each combination, a censored representation is learned 80 percent of the data using the algorithm of choice. After- wards gradient boosting classifier was trained on these representations to predict the target variable. The performance was evaluated on the remaining 20 percent. Due imbalanced datasets, the bal- anced accuracy (BA) was reported together with the demographic parity distance (ADp), which is the proportional distance of positive outcomes between the privileged and unprivileged groups. To strike balance between censoring and accuracy, only results with BA of 60% are considered. This is to remove all cases where there is too much information removed (c.g. the trivial uni-label function). From these candidates the one with the lowest ABP is elected as the winner.
To analyze the individual effects of stacking and dampening, an ablation study is performed where ALFR-S(n) is default ALER performed with stacks, and ALFR-DS(n) ALFR-DS with stacks. Thus, vanilla ALFR is equal to ALFR-S(1) and ALFR-DS DS without stacking is equal to ALFR- DS(1). Additionally. Learning Fair Representations (LFR) Zemel et al. (2013), 3) and Disparate Im- pact Remover DIR) Feldman et al. (2015) are compared. Note that the removal of disparate impact equivalent achieving demographic parity. The optimized stochastic preprocessing technique from Calmon et al. (2017) was not benchmarked due to unavailability of the required preprocessing and distortion functions for all datasets. The datasets that were used are UCI Adult (predict the income of person) Asunción & Newman (2007), German (predict defaults on consumer loans), Bank Marketing (predict subscription of term deposit) Moro et al. (2014). and the well-known COMPAS dataset (predict recidivism).
In Table the average percentage results 10 runs are shown. cases where careful censoring is needed to stay above 60% BA, ALFR-DS(11 gives good results (German and Bank). In cases where there more room for censoring, ALFR-DS(3) performs better. Whenever accuracy outweighs fair- ness, DIR tends outperform ALFR-DS, but note that DIR is conditioned on the target variable and in some cases (Adult) stays close to the uncensored representations. Only in the case of the COM- PAS race task does DIR outperform ALFR-DS in terms of censoring. ALFR-S(n) either seems to censor too strongly (German, Bank), or not strong enough (Compas, Bank). Moreover, LFR seems give poor results overall, even after numerous attempts optimize the hyperparameters. Over- all, ALFRRDS((n) gives the best results when careful balance between censoring and accuracy is needed, where higher implies stronger censoring.
CONCLUSIONS
In this paper, we have given a novel algorithm that uses dampening to stabilize the interaction between actor and adversary, and uses stacking to learn strong censored representations within restricted hypothesis space. This algorithm outperforms the current approach in both censoring and reconstruction, shown in empirical results.
Since the aim to learn meaningful representations which can be learned for fair downstream tasks, believe that good comparison should be made with VAE's that attempt to learn these disen- tangled representation. Moreover, due to the empirical nature of this study, theoretical bounds on reconstruction and censoring using stacking and dampening should be further explored.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial net- works. In Doina Precup and Yee Whye Teh (eds.), Proceedings of the 34th International Con-
ference on Machine Learning, volume 70 of Proceedings of Machine Learming Research, pp.
223. PMLR, 06-11 Aug 2017. URL https::/prroceeding. ml wtt.:gss......rrr. www.sss........//////
ar jrjovsky17a. html
A. Asunción and D.J. Newman. UCI Machine Learning Repository. http: www ics. uci edu/ rn Milaar/rsooeeessttoooyotoo
2007. URL http:/ wwwp://wwww//..oo///////////wwww ics wwi. /S\
wmmmlmmrnnn....mmmmmmmmmmmmammme (MLR) spositorry html
Rachel K. E. Bellamy, Kuntal Dey, Michael Hind, Samuel C. Hoffman, Stephanie Houde, Kalapriya Kannan, Pranay Lohia, Jacquelyn Martino, Sameep Mehta, Aleksandra Mojsilovic, Seema Na- gar, Karthikeyan Natesan Ramamurthy, John T. Richards, Diptikalyan Saha, Prasanna Sattigeri, Moninder Singh, Kush R. Varshney, and Yunfeng Zhang. Al fairness 360: An extensible toolkit for detecting, understanding, and mitigating unwanted algorithmic bias. CoRR, abs/1810.01943, 2018. URL httt::tppaaxiii orq/ abs 1810. C1943
Alex Beutel, Jilin Chen, Zhe Zhao, and Ed H. Chi. Data decisions and theoretical implications when adversarially learning fair representations. CoRR, abs/1 707.00075, 2017. URL http:
laaaxii.orgabbbe............. /at.b////77..0000 00075
Flavio Calmon, Dennis Wei, Bhanukiran Vinzamuri, Karthikeyan Natesan Ramamurthy, and Kush R Varshney. Optimized pre-processing for discrimination prevention. In I. Guyon, U. Von Luxburg, S. Bengio, Н. Wallach, R. Fergus, S. Vishwanathan, and R. Gar- nett (eds.), Advances in Neural Information Processing Systems, volume 30. Curran Asso-
ciates, Inc., 2017. URL
pdf
Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 141 2012.
Cynthia Dwork, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Richard Zemel. Fairness through awareness. In Proceedings of the 3rd Innovations in Theoretical Computer Science Con- ference, ITCS 12. pp. 214-226, New York, NY. USA, 2012. Association for Computing Machin- cry. ISBN 9781450311151, doi: 02.144522090236220002555 URL htttpp://doo.ozg//// 1145/2090233 2090255
Harrison Edwards and Amos Storkey. Censoring representations with adversary. In International Conference in Learning Representations (ICLRR2066, pp. 1-14, May 2016. URI https::/ ielr ccr..cc/aaae wece/rrchiii vrrcciee wwww doku pF d=i cl r201 6 m:mai htmml 4th International Conference on Learning Representations, ICLR 2016 Conference date: 02-05-2016 Through
04-05-2016.
Michael Feldman, Sorelle A. Friedler, John Moeller, Carlos Scheidegger, and Suresh Venkatasub- ramanian. Certifying and removing disparate impact. In Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD '15, pp. 259-268, New York, NY, USA, 2015. Association for Computing Machinery. ISBN 978 9781450336642.. doi: 10.1145/2783258.22 2783311. URL httpttts:///do /tttpp://doi..rg/1...o 1145/1 772228232888 000.:2288.22211111 27833111
org/10.
Rui Feng, Yang Yang, Yuehan Lyu, Chenhao Tan, Yizhou Sun, and Chunping Wang. Learning fair representations via an adversarial framework. ArXiv, abs/1904. 13341,, 2019.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sher- jil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Z. Ghahramani, M. Welling, C. Cortes, N. Lawrence, and K. Q. Weinberger (eds.), Advances in Neural Information Processing Systems, volume 27. Curran Associates, Inc., 2014. URL httpp:://pp htteps://prooceednng. nww..ss........................e ce pttp://pp/////ieee 18 1tt.2//...........c.aaaaaoaaaaa.
Patrik Joslin Kenfack, Adil Mchmood Khan, Rasheed Hussain, and S. M. Ahsan Kazmi. Adversarial stacked auto-encoders for fair representation learning. 2021.
10

---

Under review as a conference paper at ICLR 2022
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. CoRR,
abs/1412.6980, 2014. URL bttt:://bbis uni-trierr... de/dd///////.. journalssoooor//
object detection. CoRR, 02//1708.0200 2017. URL /ttp:///iee...ee////oorraa/ao///
corr1412. html KiingmaB14
Tsung-Yi Lin, Priya Goyal, Ross B. Girshick, Kaiming He, and Piotr Dollár. Focal loss for dense
02002
Francesco Locatello, Gabriele Abbati, Tom Rainforth, Stefan Bauer, Bernhard Schölkopf, and Olivier Bachem. On the fairesss of disentangled representations. CoRR, 1as/1905.13662 2019.
URL http::/arxiv..r org/ abs 1905. 13662
Christos Louizos, Kevin Swersky, Yujia Li, Max Welling, and Richard S. Zemel. The variational fair autoencoder. In Yoshua Bengio and Yann LeCun (eds.), 4th International Conference on Learning Representations, ICLR 2016, San Juan, Puerto Rico, May 2-4, 2016, Conference Track Proceedings, 2016. URL http::ttpp/aattet wwtp:/iw..rggabb////ooea/
00830
David Madras, Elliot Creager, Toniann Pitassi, and Richard Zemel. Learning adversarially fair and transferable representations. In Jennifer Dy and Andreas Krause (eds.), Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pp. 3384-3393. PMLR, 10-15 Jul 2018. URL https::/proceeteeee
mmr.
press//800/aarzasee..
Daniel McNamara, Cheng Soon Ong, and Robert C. Williamson. Provably fair representations. CoRR, abs/1710.04394, 2017. URL/http://axxxworrrr
04394
Ninareh Mchrabi, Fred Morstatter, Nripsuta Saxena, Kristina Lerman, and Aram Galstyan. A survey on bias and fairness in machine learning. ACM Comput. Surv., 54(6), jul 2021. ISSN 0360-0300. URL httlh:ttp:///ee wtt.:ei..rr/11.111111111....1111 345777777777
doi: 10. 10.1144551 00.1145/345700,
Shira Mitchell, Eric Potash, Solon Barocas, Alexander D' Amour, and Kristian Lum. Algorithmic fairness: Choices, assumptions, and definitions. Anmual Review of Statistics and Its Application, 8(1):141-163, 2021. doi: 000116////murr-sstiiittt--000000 125902. URL httpp:://oo..
Sérgio Moro, P. Cortez, and Paulo Rita. data-driven approach to predict the success of bank telemarketing. Decis. Support Syst., 62:22-31, 2014.
Sahil Verma and Julia Rubin. Fairness definitions explained. In Proceedings of the International Workshop on Software Fairness, Fair '18 pp. 1-7, New York, NY, USA, 2018. Associa- doi: 10.1145/3194770031947776 URL
tion for Computing Machinery, ISBN 9781450357463.
https: http:://oooooog/000 org/10.............ooo..o....... 1111/1194111111
3194776
Yue Xing, Qifan Song, and Guang Cheng. On the algorithmic stability of adversarial training. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan (eds.), Ad- vances in Neural Information Processing Systems, volume 34, pp. 26523-26535. Curran Asso- ciates, Inc., 2021. URL https: dflfld20ee 67088677044550 https::/ppocceeiiiitttn http:////occeeeeee.e.ee wtw.ooceedingg..eeriisss.ss www.nneuiip.... cc/papeer2021/iile
Paper.pd
Abhay Yadav, Sohil Shah, Zheng Xu, David Jacobs, and Tom Goldstein. Stabilizing adversarial nets with prediction methods. International Conference on Learning Representations, 2018. URL
net htte//oormmmiddkkieeeee
Rich Zemel, Yu Wu, Kevin Swersky, Toni Pitassi, and Cynthia Dwork. Learning fair repre- sentations. In Sanjoy Dasgupta and David McAllester (eds.), Proceedings of the 30th In- ternational Conference on Machine Learning, volume 28 of Proceedings of Machine Learn- ing Research, pp. 325-333, Atlanta, Georgia, USA, 17-19 Jun 2013. PMLR. URL https: //proceedings.o mlr. www.:mmw.............. prwss saress/28//ez http//////zemee133 html
Brian Hu Zhang, Blake Lemoine, and Margaret Mitchell. Mitigating unwanted biases with adversar- ial learning. CoRR, abs/1801 005593 2018. URL http:://rx.x...v//tp//// www.aawwwwww.oo/aaoo..e..o www.orrgaaa... abs wwts///1...... 1atp//180007593 07593


Reviews:
[{"review_id": "nh_q--YeiY", "reviewer": "Reviewer_4DEf", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this paper the authors study the problem of learning a fair representation given a dataset. In order to learn fair representations, previous works have balanced the reconstruction loss with an adversarial loss using a weighting term. This weighting term is a central problem identified by the authors as blind selection of this weighting term can easily lead to trivial classifier performance (or unstable performance) and even if this weighting term is selected appropriately it can be difficult to justify to stake-holders. To remedy this, the authors propose to use dampening and stacking in order to develop stable fair representations with an informed choice of the weighting term. The authors then go on to experimentally evaluate this approach on MNIST and on standard fairness benchmarks. \n\nUltimately, the paper's writing is unclear in several places. The empirical results are not very strong, and it seems that they could have evaluated against stronger baseline methods.  ", "summary_of_the_review": "While the paper aims at tackling an important problem (learning fair representations) its clarity and empirical evaluation need improvement for the impact of this work to be realized.", "strength_and_weaknesses": "Strengths:\n\nThe paper identifies and discusses a very interesting problem (fair representation learning). The background discussion in the introduction is easy to read and follow, though it may be more appropriate for a background or related works section. The idea of training until a fairness score T is met makes sense and is an interesting stopping criteria.\n\nWeaknesses:\n\nI start with the weaknesses in the presentation, then discuss some weaknesses in the methodology, then finally discuss weaknesses in the experimental evaluation. \n\nThe paper is not very well written, in my opinion. I will go into slightly more detail on methodological we  The abstract is sparse giving the reader little idea what exactly is explored and what the results are. The introduction is primarily a context for the work wit h little description of the aim of the work until the fifth paragraph of the introduction. The bullet point text in Section 4 is a bit convoluted and each time I read the paper I had to double take at what exactly it is trying to say. A minor stylistic note (but one that should be addressed) is that all of the citations here use \\citet or \\cite when they almost always should use \\citep. \n\nI think some intuition should be provided for the score function and T. Given that these values would be set by regulators or perhaps non-technical stakeholders I think further discussion of these values is important to give the reader an idea of exactly how these can be used in practice.\n\nThe experimental section is one of the biggest weaknesses of the paper. It is unclear the MNIST scenario studied fits into the problem framework set out by the authors. Are images of eights given a sensitive attribute vector that is all ones ($s_i$)? The results on the fairness benchmarks are much more intuitive, but the performance leaves something to be desired. Indeed the method improves fairness, but at a large cost to accuracy and it seems the authors have avoided comparing to the more recent benchmarks that are cited (Edwards & Storkey (2016), Madras et al. (2018)) instead opting for older and perhaps more simple baselines (unless I have missed something in this regard). \n\n\n\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "mCjs8wX2N6U", "reviewer": "Reviewer_Hobp", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper focusses on adversarial fair representation where the model should not rely on the sensitive variable based on a preprocessing approach. The authors highlight the problem with adversarial min-max loss leading to either  (a) high gradient and high loss in case of incompetent adversary; or (b) small loss and slow actor updates in the case of good adversary. They  introduce dampening, a new measure of information captured from a protected variable scaled to [0, 1] which balances between the min-max adverasarial loss objective between actor and adversary. This is coupled with stacking [Kenfact et al., 2021] where exist encoder is frozen (leading to loss of some information about the protected variable) and a new trainable single-layer encoder is appended to the existing encoder per training stage. Empirical evaluation on MNIST and AIF360 datasets shows censoring of protected variable (e.g., \"8\" in the MNIST dataset) using the ALFR-DS approach with the stacking helping (ALFR-DS(3) vs ALFR-DS(1)).  ", "summary_of_the_review": "The paper presents a new loss objective (dampening) coupled with stacking as a preprocessing method and show better censoring as part of empirical evaluation. There is no theoretical fairness guarantee accompanying the new loss and the empirical evaluation section could be written better to aid understanding of how dampening helps. ", "strength_and_weaknesses": "+ Clearly written paper for the most part.\n+ MNIST experiments shows the influence of the approach with protecting censored data. \n+ Mixed results on AIF360 dataset per my limited understanding - I do not follow the argument on ablation study and improvement obtained on dampening.\n\n- Some recommendations: AIF360 benchmark and the dataset should be described better including what are the features, what is being censored. I strongly recommend adding a section to appendix/supplementary material to capture this information making the paper self-contained when reading the evaluation. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "G7RVDuNwzA3", "reviewer": "Reviewer_kwp8", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper considers the problem of learning fair representations containing little or no information about the protected variable. In the absence of prior knowledge about downstream tasks, it requires the learned representations to be both fair and discriminative enough, which turns out to be a trade-off and may incur instability when applying adversarial training.\n\nThe main contribution of this paper is to propose a new algorithm called ALFR-DS that retrofits the existing adversarial learning framework ALFR [1] with dampening and stacking. Specifically, the algorithm uses an adaptive parameter (dampening) to stabilize the gradients of the actor and the adversary when the adversary is too weak and combines it with stacked encoders (stacking) [2] to improve censoring. Experimental results on MNIST and the AIF360 benchmark show that ALFR-DS achieves better censoring and reconstruction performance than several baselines.\n\n[1] Edwards, Harrison, and Amos Storkey. \"Censoring representations with an adversary.\" arXiv preprint arXiv:1511.05897 (2015).\n\n[2] Kenfack, Patrik Joslin, et al. \"Adversarial Stacked Auto-Encoders for Fair Representation Learning.\" arXiv preprint arXiv:2107.12826 (2021).", "summary_of_the_review": "Overall, I think this paper does not present significant contributions and would recommend rejection. Please see my comments in Strength And Weaknesses.", "strength_and_weaknesses": "Pros:\n\n1. The paper considers an important problem of how to learn fair representations without knowing downstream tasks.\n\n2. The paper is well-structured.\n\nCons:\n\n1. The novelty of this work is limited. Compared with ALFR, the main novelty brought by ALFR-DS is the use of dampening together with some other tricks discussed in Section 4.3 to tame the instability of adversarial training. Given that ALFR was proposed 7 years ago and a variety of studies has explored similar issues in a more principled way [1, 2, 3], the contributions made in terms of methodology are inadequate.\n\n2. The proposed dampening mechanism needs more support. In its current version, the paper does not provide sufficient theoretical grounding nor empirical analysis to verify that dampening does prevent instability. The only effort made is plotting the curve of the reconstruction error (Figure 1), which seems too coarse-grained to prove the effectiveness of dampening.\n\n3. The writing is not clear enough. In Section 3 the problem formulation is entangled with the methodology. It is also hard to find a proper mathematical definition of “good” fair representations.\n\n4. I have some questions regarding important details that are not well specified. For example, it is unclear how to select threshold $T$ and what value is used exactly for experiments. It also seems inexplicit why to exclude results with BA less than 60% for the AIF360 Benchmark.\n\n[1] Roth, Kevin, et al. \"Stabilizing training of generative adversarial networks through regularization.\" Advances in neural information processing systems 30 (2017).\n\n[2] Yadav, Abhay, et al. \"Stabilizing Adversarial Nets with Prediction Methods.\" International Conference on Learning Representations. 2018.\n\n[3] Jenni, Simon, and Paolo Favaro. \"On stabilizing generative adversarial training with noise.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2019.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject