Fair Graph Machine Learning under Adversarial Missingness Processes
Authors: Debolina Halder Lina
Arlei Silva
Venue: ICLR 2026 Poster (2026)
Keywords: Fairness
GNN
Missingness
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: Fair graph ML models can be manipulated by adversarial missing values and a 3-player adversarial learning scheme can address that.

Abstract: Graph Neural Networks (GNNs) have achieved state-of-the-art results in many relevant tasks where decisions might disproportionately impact specific communities. However, existing work on fair GNNs often assumes that either sensitive attributes are fully observed or they are missing completely at random. We show that an adversarial missingness process can inadvertently disguise a fair model through the imputation, leading the model to overestimate the fairness of its predictions. We address this challenge by proposing Better Fair than Sorry (BFtS), a fair missing data imputation model for sensitive attributes. The key principle behind BFtS is that imputations should approximate the worst-case scenario for fairness---i.e. when optimizing fairness is the hardest. We implement this idea using a 3-player adversarial scheme where two adversaries collaborate against a GNN classifier, and the classifier minimizes the maximum bias. Experiments using synthetic and real datasets show that BFtS often achieves a better fairness x accuracy trade-off than existing alternatives under an adversarial missingness process.

Published as a conference paper at ICLR 2026
FAIR GRAPH MACHINE LEARNING UNDER ADVERSAR- IAL MISSINGNESS PROCESSES
Debolina Halder Lina
Department of Computer Science, Rice University, Houston, TX 77005, USA
Arlei Silva
Department of Computer Science & Ken Kennedy Institute, Rice University, Houston, TX 77005, USA
ABSTRACT
Graph Neural Networks (GNNs) have achieved state-of-the-art results in many rel- evant tasks where decisions might disproportionately impact specific communities. However, existing work on fair GNNs often assumes that either sensitive attributes are fully observed they missing completely at random. We show that an adversarial missingness process can inadvertently disguise a fair model through the imputation, leading the model overestimate the faireess of its predictions. We address this challenge by proposing Better Fair than Sorry (BFtS), a fair missing data imputation model for sensitive attributes. The key principle behind BF(S is that imputations should approximate the worst-case scenario for fairnss-i.c.. when optimizing fairness the hardest. We implement this idea using 3-player adversarial scheme where two adversaries collaborate against a GNN classifier, and the classifier minimizes the maximum bias. Experiments using synthetic and real datasets show that BFIS often achieves better fairness x accuracy trade-off than existing alternatives under an adversarial missingness process.
INTRODUCTION
With the increasing popularity of machine learning in high-stakes Decision-making has become consensus that these models carry implicit biases that should be addressed to improve the fairness of algorithmic decisions (Ghallab] 2019). The disparate treatment of such models towards African Americans and women has been illustrated in the well-docummnted COMPAS (Angwin et al.) 2022) and Apple credit card (Vigdor, 2019) cases, respectively. While there has been extensive research on fair ML, the proposed solutions have mostly disregarded important challenges that arise in real-world settings. For instance, in many applications, data can be naturally modeled as graphs (or networks) (Dong et al., 2023), representing different objects. their relationships, and attributes, instead of as sequences or images. Moreover, fair ML is also prone to missing data (Little Rubin| This is particularly critical because fair algorithms often require knowledge of sensitive attributes that more likely to be missing due to biases in the collection process or privacy concerns. For instance, census and health surveys exhibit missingness correlated with gender, age, and race (O'Hare & O'Hare 2019 Weber et al.) 2021). Networked data, such as disease transmission studies, face similar issues (Ghani al. 1998). As a consequence, fair ML methods often rely missing data imputation, which can introduce errors that compromise fairess (Mansoor et al. 2022 Jeong et al., 2022).
This work investigates the impact of adversarial sensitive value missingness processes on faimesss, where the pattern of missing sensitive data is structured to obscure true disparities. If the predictions from the imputation method fail to capture the true distribution of sensitive attribute, any faimesss- aware model trained on the imputed data is prone to inheriting the underlying true bias. More specifically, a key challenge arises when an adversarial missingness process makes the imputed dataset appear to be fair. In graphs, an adversary can exploit the graph structure to manipulate the imputed values and, as a consequence, the fairness-an aware model. Prior work on the fairness of graph machine learning assumes sensitive values are Missing Completely At Random (MCAR). However, this assumption rarely holds in practice (O'H & O'Hare 2019; Weber et al., 2021 Ghani et al.
1998 Jeong al. 2022.
Luh (2022) and Fukuchi al. (200)) provide motivational examples of how

---

Published as a conference paper at ICLR 2026
Female positive
Male positive
Female negative
Male
Missing genders
negative
(a) Missing values.
(b) Imputed sensitive attributes.
(c) Worst-case imputation.
Figure I: In Fig. (a), graph machine learning algorithm is applied to decide who receives credit (positive or negative) based on possibly missing sensitive attribute, gender (and binary only for illustrative purposes). As shown in Fig. (b), traditional missing data imputation does not account for outcomes (positive/negative), and thus, their imputed values can under-represent the bias of the complete dataset- demographii parity (DP) is 0.09 in this example (DP and bias are inversely related). This paper proposes BFtS, an imputation method for graph data that optimizes faimesss in the worst-case imputation scenario using adversarial learning, shown in Fig. (c), where DP is 0.47.
fairness can be manipulated by adversarial data collection. Methods that overlook the adversarial missingness process risk producing misleading fairness guarantees w.rt. the complete data.
Figure I motivates our problem setting using a toy example. A machine learning algorithm is applied to decide whether individuals should or should not receive credit. Figure Ta shows both the gender and outcome for each individual. The genders of some samples are unknown in Figure Ta and the demographic parity (ADP) considering only the observed values is 0.25 (ADP is a bias metric described in Section 5). We illustrate how different missing data imputations affect the fairness of credit decisions in Figures Ib and [c] A straightforward imputation is demonstrated in Figure [bb where the gender of the majority of neighbors is assigned to the missing attribute, resulting best-case scenario in terms of fairness with a ADP of 0.09. However, in the worst-case scenario, shown in Figure Ic| ADPis is 0.47. If an adversarial missingness process can induce the imputation model to generate the imputation from Figure Tb but the complete data is Figure Tc trained on the imputed data will still biased w.r.t. the complete data.
[c]
fair model
To counter an adversarial missingness process for sensitive values on graphs, we propose Better Fair than Sorry (BF(S), a 3-player adversarial learning framework for missing sensitive value imputation based on Graph Neural Networks (GNNs), Our experiments show that BFIS achieves a better accuracy x fairness trade-off than existing approaches, especially under adversarial missing sensitive values.
We summarize our contributions as follows: (1) potential of an adversarial missingness process to bias a fair GNN; (2) We propose Better Fair than Sorry (BFtS), novel 3-player adversarial learning framework for the imputation of missing sensitive data that produces worst-case imputed values for fair GNNs and is effective under adversarial missingness processes and even when sensitive attribute information is completely unavailable; and (3) We show empirically that BFTS achieves a better fairness x accuracy trade-off than the baselines.
We investigate theoretically and empirically the
1.1 RELATED WORK
Fairness in graph machine learning. Our work is focused on group fairness Pessach & Shhueli
(2022); Dong et al. (2023). Existing work can be grouped into pre-processing, extended objectives,
and adversarial learning. Pre- Pre-processing methods such as FairOT, FairDrop. FairSIN, EDITS, and
Graphair remove bias from the graph before training (Laclau al. 2021 Spinelli et al., 202T Yang
et al. 2024 Dong et al.) 2022 Ling et al. 2023).
Objective-based methods-including Fairwalk, lk PFR-AX, FairSAD, and SaiGGAF-modinn GNN
Crosswalk, Dehayes, MONET, NIFTY, Fair VGNN,
losses to learn fair representations RRahman et al.
2019 Khajehnejad et al. 2022, Buyl & De Bie
2020
Palowitch & Perozzi| 2020; Agarwal et al.
2021 Wang et al. 20222 Merchant Castillo
2023 Zhu al.] 2024 Fan al. 2021). Adversarial methods such as CFC, FLIP. DKGE, and Debias
jointly train GNNs with adversaries for fair prediction (Bose & Hamilton 2019; Masrour et al. 2020
Arduini et al. 2020 Zhang et al. 2018). All these require fully observed sensitive attributes.
Missing Data Imputation and fairness. Missing data can be imputed using unconditional mean.
reconstruction, preferential attachment, autoencoders, etc. (Donders et al. 2006 Pereira et al. 2020
2

---

Published as a conference paper at ICLR 2026
Huisman 2009). The traditional procedure for handling missing data is independent imputation i...
to first impute the missing values and then solve the task (Rossi et al. 2022 Buck 1960). SAT is a
matching- based GNN for graphs with missing attributes (Chen et al. 2020). but it does not account
for fairness. Training a classifier from imputed data can amplity the bias of a machine learning model,
as discussed in (Subramonian et al. [202 Zhang& & Long 2021 Feng al. 2023 Guha et al.) 2024
Saartnnzz-Plumee et al. 2019 Fricke|| [020]] Mansoor et al.] 2022). Some studies try to generate fair
feature imputations (Subramonian al. 2022; Feng et al. [023]] Jeong et al., 2022 Zhang & Long
2022). However, as the approaches discussed earlier, these methods do not consider missing sensitive information and require full knowledge of the sensitive attributes for fairness intervention.
Fairness with missing sensitive attributes. One extreme assumption is the complete unavailability of sensitive information. For example, [Hashimoto et al. (2018) considers the worst-case distribution over group sizes, |Lahoti et al. (2020) reweighs training samples adversarially, Chai & Wang (2022) minimizes top-k average loss, and Zhao et al. (2022) reduces correlation between predictions and features associated with sensitive attributes. Other approaches include class re-balancing (Yan et al. 2020) and learning soft labels from an overfitted teacher (Chai et al.) 2022). In practice, partial sensitive information is often available and improves faimess (Chai & Wang (022). but these models fail to leverage it. FairGNN (Dai & Wang (021) assumes limited sensitive data and imputes missing values independently. FairAC (Guo et al. 2023) uses only observed attributes without imputation, and RNF (Du et al.] (021) generates proxy annotations using generalized cross-entropy (Zhang & Sabuncu 2018). Similar to RNF, our approach handles completely or partially missing sensitive information. BFtS applies a 3-player scheme to minimize the maximum possible bias and outperforms FairGNN and RNF in terms of fairness X accuracy. Minimizing the maximum instead of the average risk, similar to our method, has been shown to achieve better guarantees SShale-SSwaarz & Wexler 2016). A similar minmax approach has been applied to maximize the robustness and accuracy of uncertainty models (Löfberg 20033 Lanckriet et al., 2002; Chen et al., 2017, Fauß et al.) (2021). In (Nguyen et al. 2017 Vandenhende et al.) 2019). a 3-player adversarial network is proposed to improve the classification and stability of adversarial learning.
Adversarial attacks on faarrees. Recent work has investigated data poisoning as a means to adversarially degrade model fairness (Mehrabi al. [021] (ooans et al. 2020). UnfairTrojan and TrojFair introduce backdoor attacks specifically aimed at reducing model fairness (Furth et al., 2024 Xue et al. 2023). In the context of graph neural networks (GNNs), most adversarial faimess attacks modity graph topology: Hussain et al.] (2022); Zhhang et al. (2024) perturb edges, NIFA injects nodes via uncertainty maximization and homophily enhancement (Luo et al.] 2024), and FATE applies bilevel meta-learning for poisoning (Kang et al. 2024). Thus, prior work has primarily focused on poisoning, node injection, or structural perturbations, while attacks that compromise fairness solely by manipulating sensitive-attriuut missingness remain unexplored. In this study, we focus on adversarial missingness rather than data poisoning, as represents a more practical and plausible threat model in many real-world systems. Prior work on adversarial missingness in causal structure learning (Koyuncu et al., 20233 2024) highlights that when data authenticity is enforced (e.g.. via cryptographically signed sensor records), an adversary cannot modify values or inject fabricated samples without violating digital-signature constraints. Such tampering would introduce inconsistencies across logs, backups, and signatures, making it infeasible under standard integrity guarantees. In contrast, selectively withholding, dropping, or failing to log certain fields does not break these integrity checks and is indistinguishable from common pipeline failures. Under this threat model, the adversary is therefore limited to partially concealing existing data and can strategically choose which sensitive attributes withhold. This makes adversarial missingness plausible and practically relevant mechanism for undermining fairness.
2 PRELIMINARIES
Let (V,,, be an undirected graph where V is the set of nodes, E C V x V is the set of edges, X' are node attributes, and S is the set of sensitive attributes. The matrix A E NxN is the adjacency matrix of G where Age = 1 if there is an edge between u and v and Age = O, otherwise. We focus the setting where sensitive attributes might be missing, and only Vs C V nodes include the information of the sensitive attribute s, for a node v. The sensitive attribute forms two groups, which are often called sensitive (s, 1) and non-sensitive (s, = 0).
3

---

Published as a conference paper at ICLR 2026
While work can be generalized to other fairess--waar tasks, will focus binary fair node classification, where the goal is to learn a classifier fc to predict node labels ye E {0, 1) based on a training set Vz. S V. Without loss of generality, we assume that the class y 1 is the desired one (e.g., receive credit or bail). Given classification loss Lelass and group fairness loss Liias the goal is to learn the parameters delass of fdass by minimizing their combination:
ddass arg min Lelass + a Chhiiss
Bcloxs
where Lhins measures the impact of the sensitive attribute 8, over the predictions from scloss and ar is a hyperparameter. The main challenge addressed in this paper is how to handle missing sensitive attributes. In this scenario, one can apply an independent imputation model By Re famp(t) (v) before training the fair classifier. However, the faireess of the resulting classifier will be highly dependent on the accuracy of fimp. as will be discussed in more detail in the next section.
INTRODUCING BIAS VIA AN ADVERSARIAL MISSINGNESS PROCESS
We investigate the impact of missing sensitive values fairesss in graph machine learning. Datasets with substantial missingness typically require imputation. In this section, we focus on how the miss- ingness process (i.e., the process that generates missing values) can lead to (intended or unintended) biases in a fair model trained using the imputed data, leading fair models to underestimate bias and remain unfair relative the complete data.
We can describe the missingness process using a threat model. The asset is the graph G(V.E,X, and the threat is increasing the bias of node classification model felass applied to The vulnerability arises because the adversary can select subset of sensitive attributes V \ Vs to be missing, thereby inducing a strategically biased missingness pattern. Our mitigation combines missing-data imputation and fair node classification to counter such adversarial missingness. The attacker's capabilities and constraints are described next the adversarial missingness formulations introduced this section.
The simplest missingness process for sensitive values is missing completely at rundom-i.e., the probability of a value being missing is independent of the data. However, in practical scenarios, missing values rarely random (O Hare & O'Hare 2019 Weber et al. 202 Ghani et al. 1998). We focus on the particular case where the missingness process is adversarial. We prove that manipulating the missingness process induce bias optimally is computationally hard. However, a simple heuristic can effectively introduce bias to an independent imputation model that simply tries to maximize imputation accuracy. We formulate the problem for a given number of observed sensitive values k.
Definition 1. Adversarial Missingness Against Fair Classification (AMAFC): Given a graph = (V, E), select of nodes V that maximizes the bias of fair classifier with parameters 0r Ostass trained with an imputation model with parameters 0r Cimp trained with Vs:
V/ arg 1 & Criins (Ortasss V)
Bd arg ming Ccdass(Odaasi + C.LiiassBelaa o Cmpp Vs)
S.I. 8" 0mp arg ming.mp CCmm((aag Vs)
where we assume that the adversary can compute the bias Liiae (8t (Baees V) based on all sensitive attributes 8,, while the classifier can only estimate its bias based on a combination of nodes Vs with observed 8, and imputed values produced with imm-- While AMAFC describes the objective of an idealized adversary, it is impractical due to its associated complexity (tri-level optimization).
Definition 2. Adversarial Missingness against Data Bias (AMADB): Given a graph G= (V. select set of nodes V that minimizes the bias in the labels estimated using an imputation model with parameters 0mm trained with Vs:
V/ = arg mil miny
Vs. Vi)
s.f.
Cmmp = arg ming. Limp (0smps Vs))
where Lrias (0 mm: Vs. VL) is computed based on labels instead of felass- By minimizing the bias computed based on imputed values and labels, AMADB attempts to misguide any classifier that relies on such imputation to mitigate bias. AMADB is more tractable than AMFC, but still NP-hard.
4

---

Published as a conference paper at ICLR 2026
Theorem 1. The AMADB problem is NP-hard.
See the proof in the Appendix. We frame AMADB as adversarial version of active learning where the goal is to strategically minimize the accuracy of the imputation by selecting observed sensitive coverage problem (Ychuda et al., 2022, Ren et al., 2021). Theorem can be interpreted as positive result, as it shows that, in theory, simpler surrogate of the adversary's 's objective still hard to optimize.
attributes. More specifically, we apply a popular formulation of active learning
A simple (yet effective) heuristic for adversarial missingness: Let 8 E {0,1} denote the true sensitive attribute and å E {0,1} be its imputation. We define the imputation error rate as p(s of 8) Let & E {0, 1 be the prediction of a fair model that minimizes demographic parity (ADP) with respect to 8, where we define DPP with respect to a sensitive attribute a E {s,8) as follows:
ADP = lp(ū = 1aa = 0)- = 1/a = =1]
We want to design a heuristic where the goal of the adversary is to choose missing values to maximize the difference between the true demographic parity ADP, and empirical demographic parity ADP;
max ADP. ADP:
max 1p(0 =
- -1s 1|s 1)1 - |p( = 1|8 = - 1)1
We assume the minority class is underrepresentedd i.e. (va, 1p(0 = 1/a 1 0) p(ů = 1/a = 11)):
max p(ğ = 1|s 0) -() 1|s =
p(g = 1|3 = 0) + p(ū 1|$ = 1)
max plğ 1|s -(p 1|6 0) + p(p 1|$ = 1) - -( = 1|s = 1)
= max p(ğ = 1|s = 0)- 1|3 = + p0ù = 0|s = 1) - p0 = 0| = 1)
Assuming p(O + y) 0, the adversary should attack nodes with y = 1 s = 0 and 0 to maximize p(s + =
0) and p(s * 6ly 0, 1). Based on Theorem [ this problem is NP-hard. It also requires the adversary to have access to true class labels and sensitive values, which strong assumption. For practicality, we design an efficient adversary that aims increase the imputation error = p(s + 8) by exploiting the degree bias of GNNs using only the graph topology.
Definition 3. The degree bias assumption: Given nodes u, v E V where deg(u) > deg(v), we assume that p( + 8o) > p( 8.).
The degree bias assumption has been supported by both theoretical and empirical results in the literature for both homophilic and non-homophilic graphs (Tang et al. 2020 Liu et al. 2023 Ju et al. 2024. Subramonian et al. 2024). Moreover, low-degree nodes are known to be more vulnerable to attacks than digh-degree nodes (Zügner et al. 2018 Zügner & Günnemann 2019). Therefore, our adversarial missingness process simply selects low-degres nodes to have missing sensitive values. We call the heuristic based on the degree bias assumption the 'degree' heuristic.
We also consider another heuristic to evaluate the effectiveness of the degree one. We select missing values uniformly at random from the set Vixies = {u= E (I = 1 s, = 0) V (y. = 0 s, 1)]. If the desired number of missing nodes exceeds [Mmiss ). we draw the remaining /V Vsl - Vmisa samples uniformly random from V Viniss. We call the resulting heuristic 'targeted'.
To assess the effect of degree-based adversarial missingness, we compare imputation under adversarial degree, targeted and random missingness. Figure reports correlations between sensitive attributes and class labels across datasets. Using a G Convolutional Network (GCN) (Kipi & Welling (017) for independent imputation, we observe that with less than 50% sensitive data, adversarial missingness consistently underestimates the true bias in the dataset, while random missingness and targeted missingness perform slightly better (Figures 2 top row). In contrast, BFS (Figures [] bottom row), introduced in the next section, rarely underestimates bias. These results highlight that off-the-shelf imputation can mislead fair graph learning by underestimating bias in the dataset, particularly under adversarial missingness. Among the three missingness processes, the degree heuristic exhibits the largest bias discrepancy between imputed and original values (i.e., is more ad adversarial). Therefore, we focus our analysis the degree heuristic.
5

---

Published as a conference paper at ICLR 2026
Bias in data represented correlation between node labels and sensitive attribute Ind, Adv (Targeted)
A1. Ind, MCAR
C1. Ind, Adv (degree)
German
Bail
Credit
Pokec-z NBA
0.1
Pokec-n
A2. BFIS, MCAR
B2. BFIS, Adv (Targeted)
C2. BFtS, Adv (degree)
0.0
German
Bail
-0.1
Credit
Pokec-z
-0,2
NBA
Pokec-
20
30
40
50
60
100
100
30
40
50
60
100
% of available sensitive information
Figure 2: Empirical evaluation of three missingness processes and their effect on bias estimation. Degree-based adversarial missingness most effectively drives independently trained GCN imputa- tion model to underestimate bias, compared with random and targeted missingness. The final column in each matrix reports the true bias, where lower values indicate stronger underestimation. NBA shows the largest correlation gap (up to a 433% discrepancy when only 20% of protected attributes are observed) under the degree heuristic. We also include results for BFS (Section 4). our 3-player adversarial imputation framework.
ADVERSARIAL MISSING DATA IMPUTATION
We introduce BFIS (Better Fair than Sorry), a 3-player adversarial framework for fair GNN training under adversarially missing sensitive data. The fair GNN is trained jointly with two adversaries one predict sensitive attributes based on GNN embeddings and another to impute missing values that minimize fairness, ensuring that fairness is evaluated against worst-case imputations.
We motivate the worst-case assumption using distributionally robust optimization (Ben- Tal al., 2013) Mandal et al.] 2020 Namkoong & Duchi 2016; Shafieezadeh Abadeh et al. (015).. Let P, be the sensitive attribute distribution. can express the fairness objective in terms the expected bias.
Paasss arg min Lelass + a.gpP, [Crias]
Betass
However, under adversarial missingness, the true distribution of sensitive values cannot be accurately estimated from the observations (Mohan et al., 2013] Tian (017). To handle this uncertainty, let us define uncertainty set l of plausible distributions for This leads to the worst-case imputation:
0-
arg min Celass + a max E,au [Crias]
Octose
uell
4.1 PROPOSED MODEL. (BFTS)
Our goal is to learn group fair and accurate GNN ÿ = [etass X') for node classification with adversarially missing sensitive values. The proposed solution is model-agnostic (e.g., GNN) and based on adversarial learning. formulates the imputation model as a second adversary the GNN. Figure 3 depicts the flow diagram of the proposed model. The model has three primary components: a missing sensitive attribute imputation GNN fymps a node classification GNN felase. and a sensitive attribute Deep Neural Net (DNN) prediction foios- falase takes X and inputs and predicts the node labels. foins is an adversarial neural network that attempts to estimate the sensitive information from the final layer representations of felass assess the bias. More specifically, felass is biased if

---

Published as a conference paper at ICLR 2026
the adversary foias accurately predict the sensitive attribute information from the representations of falase. The model fmpp predicts the missing sensitive attributes by taking X and g as inputs and generating the missing sensitive attributes st. The goal of fimp is to generate sensitive values that minimize the fairness of falass: and, thus, it works as second adversary to fclass.
4.1.1 PLAYER ARCHITECTURES
GNN classifier Selase: Node classi- fication model De fclass (Z 9) im- plemented using GNN. We assume that Seass does not apply sensitive at- tributes but uses other attributes in X that might be correlated with sensitive ones. The goal of feluss is achieve both accuracy and fairness. To im- prove fairness, felass tries to mini- mize the loss of adversary fhins. Sensitive attribute predictor (Adver- sary 1) fiias: Neural network that uses representations h. from falass to predict sensitive attributes as s0g Jbias (h,). fclass is fair if fbios per- forms poorly.
node features
input/output
minimize maximize
Imputation Adversary:
Cias
Limp
sa
Node Classifier: flass
hg
y
Latass
Fairness Adversary: bins
Figure 3: 3-player framework for fair GNN training with missing data imputation (BFtS). felass generates node rep- resentations h, by minimizing the classification loss Lelass (Eqn. D and the maximizing sensitive attribute prediction loss Lhins (Eqn. B). fbios predicts sensitive attributes using representations from falass by minimizing Liiae. Simp pre- dicts missing values by minimizing the imputation loss Limp (Eqn. 2) and maximizing Lrias. si, sa are predictions from Jclass: fimp and fbias. respectively.
Missing data imputation GNN (Ad- versary 2) fimp: Predicts miss- ing sensitive attributes si, fimp(Ia, 9). However, besides being accurate, fimp plays the role of ad- versary to felas by predicting values that maximize the accuracy of fbias-
4.1.2 LOss FUNCTIONS
Node Classification: We apply the cross-entropy loss to learn felass as follows:
Lelass
1
Σ Volog(De) (1 (o)log(1 (v). vEV.
V2l
Sensitive Attribute Imputation:
Because sensitive attributes tend to be imbalanced, fimp applies
the DistribbtiionAAaaaae Margin (LDAM) loss Cao et al. (2019). Let ši famp (X, G') be the one-hot encoded predictions and si the prediction for 8p. The LDAM loss of fimp is defined as:
Vvl
Limp
log
[/s
A
E
ext."
where A = C/n and j E 10, C is constant independent of the sensitive attribute s, and n, is number of samples that belong to s =.
The LDAM loss is weighted version of the negative log-likelihood loss. Intuitively, since A is larger for smaller values of ny. and thus ensures higher margin for the smaller classes.
Sensitive attribute imputation with no sensitive information: BFtS can generate fair outputs when very little or no sensitive information is provided by letting fimp impute the sensitive values from the ground truth training labels y using the LDAM loss Du et al. (222)). More specifically, we replace Vs with V. and s with y for each node v E V2 in Eq The reasoning is that the worst-case fairness model generally assigns more desired outcome to the non-sensitive group and less desired outcome to the sensitive one. Therefore, the nodes predicted as the minority class will fall into the sensitive group, and vice versa. This is consistent with the worst-case assumption of BFtS
7

---

Published as a conference paper at ICLR 2026
Sensitive Attribute Prediction: Given the sensitive information for Vs. we first replace siy by se for v E Vy and thereby generate s. The parameters of fuius are learned using:
Cbias En (hopphli= (hias(h) + oh [log Sbias (h))
For simplicity, we consider binary sensitive attribute in this paper. However, BFtS extends to non-binary or continuous sensitive attributes by appropriately generalizing the imputation loss Cimp and the bias loss Lbis multi-class or continuous settings.
4.1.3 LEARNING THE PARAMETERS OF BFTS
Let dclase: Obias. and 0imp be the parameters of fclass. fbios, and fimps respectively, which learned via a 3-player adversarial scheme described in Figure 3 Parameters Aeloss are optimized as:
ddess
arg min Lelass aL
Gelaxe
where a is hyperparameter that controls the trade-off between accuracy and fairness. The parameters of the sensitive attribute predictor Biins are learned by maximizing Lhins-
Oixas
arg max Lhias-
Bbins
To learn the parameters Oimp of the imputation model to generate predictions that are accurate and represent the worst-case scenario for fairness, we apply the following:
0 imp = arg min Limp
BL
(6)
0imp
Here is a hyperparameter that controls the trade-off between imputation accuracy and worst-case imputation. The min-max objective between the three players is therefore:
min max Ensp(h/a=t))log (uins(h) + Ep (log(1 - Shins (h)))-
Getaxs Prip,
The training algorithm and time complexity analysis of BFtS are discussed in Appendix.
4.2 THEORETICAL ANALYSIS
We will analyze some theoretical properties of BFtS. All the proofs are provided in Appendix.
Theorem 2. BFtS learns an imputation model femp with the worst-case imputation:
0im arg IIRX Liios = arg max p0 = 1|$ = 1) - p(ğ = 1|$ = 0)1
Oimpp
Oimp
where ý = felaso (g, X) and, $ fimp
The theorem shows that Simp indeed generates imputations with minimum fairness (or maximum bias) based on Demographic Parity for given classifier fetoss-
Theorem 3. BFIS learns classifier Setasa that minimizes the worst-case bias:
gx Plass
arg min sup 1 =
p(g 1/3 1/3=1 0)1
Betasy 0emp
The optimal GNN classifier falase, will achieve demographic parity (ADP = 0 in Sec for the
worst-case imputation (minimum fairness) & generated by famp- As felues is minimax estimator, the maximal ADP of BFTS is minimum amongst all estimators of s.
Corollary 1. Let = f(G, X) an imputation method independent of models felase and foios. then the BFtS imputation = fimplg, X) is such that:
JS(p(hls' 1):s(h = 0)) s JS(p(h|s = 1): p(h 0))
8

---

Published as a conference paper at ICLR 2026
where JS is the Jensen Shannon divergence.
The value of JS(p(h))' = 1); = 0)) is related to the convergence of adversarial learning. For independent imputation, if s' is inaccurate, then JS(pph)s' p( = 0j) 0 and Coias Eq. will be constant. The interplay between the three players makes BFS more robust to convergence issues because the objective minimizes the upper bound the JS divergence. This reduces the probability that the divergence vanishes during training (see details in the Appendix).
Debias
FairGNN
RNF
FairVGNN
FairSIN
BF1S
(a) Assortativity 0.17 (b) Assortativity 0.37 (c) Assortativity 0.57 (d) Assortativity 0.77
1
1.00
1 DP
.70
.70
.80
.65
.60
.60
TQPP
1
1.00
98
.95
.95
.95
.90
.93
.90
0.00
.50
0.00
.50
1.00
.90
.95
.90
.95
Score
Figure 4: Performance of the methods using the SIMULATION dataset for different values of assor- tativity coefficients. In the x-axis, we plot the score, and in the y-axis of the top row, we plot 1 ADP, and in the y-axis of the bottom row, we plot 1 AFQOP. The top right corner of the plot, therefore, represents a high Fl with low bias. When the assortativity is low, other methods fail to learn the node labels. With higher assortativity, though other methods learn the class labels, BF(S less biased and has similar accuracy. Note that the X-axes have different ranges.
5 EXPERIMENTAL EVALUATION
We compare our approach (BFtS) against alternatives in terms of accuracy and fairness using real and synthetic data. We apply average precision (AVPR) and F1 for accuracy evaluation and ADP and AEQOP for fairness. Details about datasets, baselines, evaluation, and hyperparameters are provided in the Appendix. We group the baselines into categories. First, we compare with methods that are explicitly designed to handle missing values: Debias Buyl & De Bie (2020), FairGNN Dai & Wang (202T), and RNF al. (202T). Among these, RNF can operate when all sensitive attributes missing, whereas Debias and FairGNN require access at least some sensitive information. Both RNF and FairGNN rely on independent sensitive-attribure imputation procedures. Second, we compare our approach with state-of-the-art fair GNN models, including FairSIN Yang et al. (2024) and FairVGNN Wang et al. (2022). These methods cannot accommodate missing values directly,
apply independent imputation strategy consistent with the procedure used in FairGNN to supply the missing sensitive attributes before training. Additional experiments varying the GNN, scalability and complexity analysis using synthetic large-scale graph, ablation studies (hyperparameter sensitivity, impact of LDAM loss, and impact of varying Vs), and visualization of learnt representation and worst case assumption trade-off are also included in the Appendix. Our code can be found here: http:////ttttb..ccco///oolllllaa
5.1 RESULTS AND ANALYSIS
Figure 4 shows the score, 1 - ADP, and AEQOP for different methods while varying their hyperparameters, The SIMULATION graph was generated using stochastic block model with different assortativity coefficients, i.e., the extent to which links exist within clusters compared with across clusters. Learning missing sensitive values and node labels under low assortativity is hard, and graphs with assortativity 0.17 and 0.37 represent the scenario described in Corollary [ therefore, the IS divergence tends to be small for independent imputation, which may result in lack of convergence

---

Published as a conference paper at ICLR 2026
Debias
FairGNN
RNF
FairVGNN (d) NBA
FairSIN Pokec-z
BFts
(a) Bail
(b) Credit
(c) German
(f) Pokec-n
.98
.95
1-
.55
.95
95
.95
.93
.93
95
90
900
1-AEQPP
.98
95
95
95
98
98
.93
.96
190
90
95
95
80
.85
.65.70
.75
.70
75
.70
.73
.70
.73
.70
.73
F1 Score
Figure 5: Fairness vs. accuracy results. The x-axis of each plot shows the F1 score. We plot 1
ADP and 1 AFQOP on the y-axis of rows and 2, respectively. The top right corner of the plot represents high FI with low bias. BFtS often achieves better fairness for a similar value of FI.
RNF
BFtS
%AVPR(()
$/())
%ADP(L
(AEQ()
SAVPR((
%
%ADP()
%AEQUI
BATI.
81.020.1
85.320.3
11.6520.02
8.51
83.120.2
86.220.3
8.0120.03
4.1220.01
CREDIT
80.420.4
75.9=0.1
8.01#0.08
7.25+0.08
82.120.4
76.820.0
5.97=0.10
4.9620.06
GERMAN
73,240.2
74.4+0.1
9.42+0.04
8.92+0.1 12
74.1+0.3
74.7+0.4
6.42#0.11
7.68+0.17
NBA
70.1=0.2
70.2+0.1
6.47+0.03
5.8920.05
72.940.3
69.8=0.1
5.19=0.01
3,59+0.05
POKEK-Z
73.120.4
71.2+0.1
6.18#0.05
6.29#0.07
73.4+0.2
73.240.3
5.10=0.02
3,2020.06
POKEK-N
71.6+0.2
72.2+0.1
7.58+0.01
7.09+0.04
72.6+0.1
69.6+0.4
4.29#0.02
3.01
Table I: AVPR, FI, %ADP, and %ΛEQOP without any sensitive information for BFTS and RNF (only baseline that operates in this setting). BFtS outperforms RNF in terms of fairness and accuracy.
for the baselines (FairGNN and Debias). As increase the assortativity, all baselines can predict the labels, but BFT still achieves a better fairness vs. accuracy trade-off in all cases.
We demonstrate the accuracy fairness trade-off for real datasets in Figure 5 The top right corner of the plot represents high fairness and accuracy. Our model achieves better fairness and similar accuracy the best baseline for the BAIL, NBA, GERMAN, POKEC-N and POKEC-Z, For all datasets, BFS achieves a better fairness-accuracy tradeoff.
Table shows the accuracy and faimess results for BAIL, CREDIT, GERMAN, POKEC-Z, POKEK-N and NEA without any sensitive attribute information. Among the baselines, only RNF works in this setting. BFtS outperforms RNF for the BAIL, GERMAN, and CREDIT. BFtS also outperforms RNF in terms of fairness on POKEC-7, and NBA with similar AVPR and F1.
BFtS outperforms the baselines because effectively implements the worst-case assumption for missing value imputation. This assumption leads to stronger fairness guarantees (Theorem 3) than the baselines in cases where missing values are adversarial.
6 CONCLUSION
We investigate the challenge of incorporating fairness considerations into graph machine learning models when sensitive attributes missing due to adversarial processes. Our solution is BFtS, a 3-player adversarial learning framework for the imputation of adversarially missing sensitive attributes that produce challenging values for graph-based fairness. Theoretical and empirical results demonstrate that BFtS achieves better fairness x accuracy trade-off than existing alternatives.
As future work, want to investigate fair graph machine learning that incorporates faimess consid- erations beyond the ones considered here. In particular, we are interested metrics that are more sensitive the ranking of predictions Mattos al. (0066) Han et al. (0025)
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGEMENTS
We acknowledge the support by the US Department of Transportation Tier-I University Transportation Center (UTC) Transportation Cybersecurity Center for Advanced Research and Education (CYBER- CARE) (Grant No. 69A3355348332), and the Rice Ken Kennedy Institute.
REFERENCES
Chirag Agarwal, Himabindu Lakkaraju, and Marinka Zitnik. Towards a unified framework for fair and stable graph representation learning. In UAI, 2021.
Julia Angwin, Jeff Larson, Surya Mattu, and Lauren Kirchner. Machine bias. In Ethics of data and analytics, pp. 254-264. Auerbach Publications, 2022.
Mario Arduini, Lorenzo Noci, Federico Pirovano, Ce Zhang, Yash Raj Shrestha, and Bibek Paudel. Adversarial learning for debiasing knowledge graph embeddings. In SIGKDD MLG, 2020.
Aharon Ben-Tal, Dick Den Hertog, Anja De Waegenaere, Bertrand Melenberg, and Gijs Rennen. Robust solutions of optimization problems affected by uncertain probabilities. Management Science, 59(2):341-357, 2013.
Richard Berk, Hoda Heidari, Shahin Jabbari, Matthew Joseph, Michael Kearns, Jamie Morgen- stern, Seth Neel, and Aaron Roth. A convex framework for fair regression. arXiv preprint arXiv:1706.02400% 2017.
Derrick Blakely, Jack Lanchantin, and Yanjun Qi. Time and space complexity of graph convolutional networks. Online Preprint, 2021.
Avishek Bose and William Hamilton. Compositional faimess constraints for graph embeddings. In ICML, 2019.
Samuel F Buck. A method of estimation of missing values in multivariate data suitable for use with an electronic computer. Journal of the Royal Statistical Sociery: Series B, 1960.
Maarten Buyl and Tijl De Bie. Debayes: a bayesian method for debiasing network embeddings. In ICMI., 2020.
Kaidi Cao, Colin Wei, Adrien Gaidon, Nikos Arechiga, and Tengyu Ma. Learning imbalanced datasets with aibelldistributio--wwaa margin loss. In NeurIPS, 2019.
Junyi Chai and Xiaoqian Wang. Self-supervised fair representation learning without demographics. In NeurlPS, 2022.
Junyi Chai, Taeuk Jang, and Xiaoqian Wang. Fairness without demographies through knowledge distillation. In NeurlPS, 2022.
Robert S Chen, Brendan Lucier, Yaron Singer, and Vasilis Syrgkanis. Robust optimization for non-convex objectives. In NeurlPS, 2017.
Xu Chen, Siheng Chen, Jiangchao Yao, Huangjie Zheng, Ya Zhang, and Ivor W Tsang. Learning on attribute-missing graphs. TPAMI, 14(2):740-757) 2020.
Eden Chlamtáč, Michael Dinitz, and Yury Makarychev. Minimizing the union: Tight approximations for small set bipartite vertex expansion. In SODA, 2017.
Enyan Dai and Suhang Wang. Say no to the discrimination: Learning fair graph neural networks with limited sensitive attribute information. In WSDM, 2021.
A. Rogier T. Donders, Geert J.M.G. van der Heijden, Theo Stijnen, and Karel G.M. Moons. gentle introduction to imputation of missing values. Journal of Clinical Epidemiology. 59(10):1087-109 2006.
Yushun Dong, Ninghao Liu, Brian Jalaian, and Jundong Li. Edits: Modeling and mitigating data bias for graph neural networks. In WebConf, 2022.

---

Published as a conference paper at ICLR 2026
Yushun Dong, Jing Ma, Song Wang. Chen Chen, and Jundong Li. Fairness in graph mining: A survey. IEEE TKDE, 15000) 2023.
Mengnan Du, Subhabrata Mukherjee, Guanchu Wang, Ruixiang Tang, Ahmed Awadallah, and Xia Hu. Fairness via representation neutralization. In NewrIPS, 2021.
Wei Fan, Kunpeng Liu, Rui Xie, Hao Liu, Hui Xiong, and Yanjie Fu. Fair graph auto-encoder for unbiased graph representations with wasserstein distance. In ICDM, 2021.
Michael FauB, Abdelhak M Zoubir, and H Vincent Poor, Minimax robust detection: Classic results and recent advances. IEEE 7SP, 69:2252-2222 2021.
Raymond Feng. Flavio Calmon, and Hao Wang. Adapting faimesss interventions to missing values. In NewrlPS, 2023.
Christian Fricke. Missing fairness: The discriminatory effect of missing values in datasets on fairness in machine learning. Master's thesis, Aalto University, Espoo, Finland, 2020.
Kazuto Fukuchi, Satoshi Hara, and Takanori Maehara. Faking fairness via stealthily biased sampling. In AAAI, 2020.
Nicholas Furth, Abdallah Khreishah, Guanxiong Liu, NhatHai Phan, and Yasser Jararweh. Unfair trojan: Targeted backdoor attacks against model fairness. In Handbook of Trustworthy Federated Learning, pp. 149-168. Springer, 2024.
Malik Ghallab. Responsible ai: requirements and challenges. Al Perspectives, 2019.
AC Ghani, CA Donnelly, and GP Garnett. Sampling biases and missing data in explorations of sexual partner networks for the spread of sexually transmitted diseases. Statistics in Medicine, 17(18): 1998.
Justin Gilmer, Samuel Schoenholz, Patrick Riley, Oriol Vinyals, and George E Dahl. Neural message passing for quantum chemistry. In ICML, 2017.
David Gray Grant. Equalized odds is requirement of algorithmic fairness. Synthese, 231 2023.
Shubha Guha, Falaah Arif Khan, Julia Stoyanovich, and Sebastian Schelter. Automated data cleaning can hurt fairness machine learning-bar based decision making. IEEE TKDE, 36(12):7368-7377 2024.
Dongliang Guo, Zhixuan Chu, and Sheng Li. Fair attribute completion on graph with missing attributes. In ICLR, 2023.
Xiaotian Han, Zhimeng Jiang. Hongye Jin, Zirui Liu, Na Zou, Qifan Wang, and Xia Hu. Retiring (delta)text (DP) New distribution-leve metrics for demographic parity. TMLR, 2025.
Moritz Hardt, Eric Price, and Nati Srebro. Equality of opportunity in supervised learning. In NeurIPS, 2016.
Tatsunori Hashimoto, Megha Srivastava, Hongseok Namkoong, and Percy Liang. Fairness without demographics in repeated loss minimization. In ICML, 2018.
Hans Hofmann. Statlog (German Credit Data). UCI Machine Learning Repository, 1994.
Mark Huisman. Imputation of missing network data: Some simple procedures. Journal of Social Structure, 10(1), 2009.
Hussain Hussain, Meng Cao. Sandipan Sikdar, Denis Helic, Elisabeth Lex, Markus Strohmaier, and Roman Kern. Adversarial inter-group link injection degrades the faimess of graph neural networks. In ICDM, 2022.
Haewon Jeong, Hao Wang, and Flavio P Calmon. Fairness without imputation: A decision tree approach for fair prediction with missing values. In AAAI, 2022.
12

---

Published as a conference paper at ICLR 2026
Kareem L Jordan and Tina L Freiburger. The effect of race/ethnicity on sentencing: Examining sentence type, jail length, and prison length. Journal of Ethmicity Criminal Justice, 13(3): 179-196, 2015.
Mingxuan Ju, Tong Zhao, Wenhao Yu, Neil Shah, and Yanfang Ye. Graphpatcher: mitigating degree bias for graph neural networks via test-time augmentation. In NeurIPS, 2024.
Faisal Kamiran and Toon Calders. Classifying without discriminating, In ICCCC, 2009.
Jian Kang, Yinglong Xia, Ross Maciejewski, Jiebo Luo, and Hanghang Tong. Deceptive faireess attacks on graphs via meta learning. ICI.R 2024.
Ahmad Khajehnejad, Moein Khajehnejad, Mahmoudreza Babaei, Krishna Gummadi, Adrian Weller, and Baharan Mirzasoleiman. Crosswalk: Fairness-enhanced node representation learning. In AAAI, 2022.
Thomas Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In ICLR, 2017.
Deniz Koyuncu, Alex Gittens, Bülent Yener, and Moti Yung. Deception by omission: Using adversarial missingness to poison causal structure learning. In SIGKDD, 2023.
Deniz Koyuncu, Alex Gittens, Bülent Yener, and Moti Yung. Adversarial missingness attacks on causal structure learning. ACM TIST, 15(6):1-60, 2024.
Laclau, I Redko, M Choudhary, and C Largeron. All of the fairness for edge prediction with optimal transport. In AISTATS, 2021.
Preethi Lahoti, Alex Beutel, Jilin Chen, Kang Lee, Flavien Prost, Nithum Thain, Xuezhi Wang, and Chi. Fairness without demographics through adversarially reweighted learning. NeurIPS, 2020.
Gert RG Lanckriet, Laurent El Ghaoui, Chiranjib Bhattacharyya, and Michael I Jordan. A robust minimax approach to classification. JMLR, 3:555-582, 2002.
Hongyi Ling, Zhimeng Jiang, Youzhi Luo, Shuiwang Ji, and Na Zou. Learning fair graph representa- tions via automated data augmentations. In ICLR, 2023.
Roderick JA Little and Donald B Rubin. Statistical analysis with missing data. John Wiley & Sons, 2019.
Zemin Liu, Trung-Kiee Kien Nguyen, and Yuan Fang. On generalized degree faimess in graph neural networks. AAAI, 2023.
Johan Löfberg. Minimax approaches to robust model predictive control. Linköping University, 2003.
Elizabeth Luh. Not so black and white: Uncovering racial bias from systematically misreported trooper reports. SSRN Working Paper 3357063, University of Michigan, 2022. URL https:
//ssrn. com httn//abst.ract=33373
Zihan Luo, Hong Huang, Yongkang Zhou, Jiping Zhang, Nuo Chen, and Hai Jin. Are your models still fair? fairness attacks graph neural networks via node injections. In NeurIPS, 2024.
David Madras, Elliot Creager, Toniann Pitassi, and Richard Zemel. Learning adversarially fair and transferable representations. In ICML, 2018.
Debmalya Mandal, Samuel Deng, Suman Jana, Jeannette Wing, and Daniel J Hsu. Ensuring faimesss beyond the training data. In NeurIPS, 2020.
Haris Mansoor, Sarwan Ali, Shafiq Alam, Muhammad Asad Khan, Umair UI Hassan, and Imdadullah Khan. Impact of missing data imputation on the fairness and accuracy of graph node classifiers. In BigData, 2022.
Fernando Martinez-Plumed César Ferri, David Nieves, and José Hernández-Oraloo Fairness and missing values. arXiv preprint arXiv:1905. 1eti11905..28..... 2019.
13

---

Published as a conference paper at ICLR 2026
Farzan Masrour, Tyler Wilson, Heng Yan, Pang-Ning Tan, and Abdol Esfahanian. Bursting the filter bubble: Fairness-awar aware network link prediction. In AAAI, 2020.
Joao Mattos, Debolina Halder Lina, and Arlei Silva. Breaking the dyadic barrier: Rethinking faimess in link prediction beyond demographic parity. In AAAI, 2026.
Ninareh Mchrabi, Muhammad Naveed, Fred Morstatter, and Aram Galstyan. Exacerbating algorith- mic bias through fairness attacks. In AAAI, 2021.
Arpit Merchant and Carlos Castillo. Disparity, inequality, and accuracy tradeoff's in graph neural networks for node classification. In CIKM, 2023.
Karthika Mohan, Judea Pearl, and Jin Tian. Graphical models for inference with missing data. In NeurIPS, 2013.
Hongseok Namkoong and John C Duchi. Stochastic gradient methods for distributionally robust optimization with f-divergences. NeurlPS, 29, 2016.
Tu Nguyen, Trung Le, Hung Vu, and Dinh Phung. Dual discriminator generative adversarial nets. NeurIPS, 2017.
William P O'He and William PO'Haree Potential explanations for why people missed in the us census. Differential Undercounts in the US Census: Who is Missed?, pp. 123-138, 2019.
John Palowitch and Bryan Perozzi. Debiasing graph representations via sectadata-orthogone training. In 2020 IEEE/ACM International Conference on Advances Social Networks Analysis and Mining (ASONAM), pp. 435-442, 2020. doi: 10.1109/ASNNAM4979 22000.938222 1348.
Ricardo Cardoso Pereira, Miriam Seoane Santos, Pedro Pereira Rodrigues, and Pedro Henriques Abreu. Reviewing autoencoders for missing data imputation: Technical trends, applications and outcomes. JAIR, 19:1255- 2020.
Dana Pessach and Erez Shmueli. review on fairness in machine learning. ACM CSUR, 55(3):1 44, 2022.
Tahleen Rahman, Bartlomiej Surma, Michael Backes, and Yang Zhang. Fairwalk: towards fair graph embedding. In AAAI, 2019.
Pengzhen Ren, Yun Xiao, Xiaojun Chang, Yao Huang, Zhihui Li, Brij B Gupta, Xiaojiang Chen, and Xin Wang. survey of deep active learning. ACM computing surveys (CSUR). 54(9):1-40, 2021.
Emanuele Rossi, Henry Kenlay, Maria I Gorinova, Benjamin Paul Chamberlain, Xiaowen Dong, and Michael M Bronstein. On the unreasonable effectiveness of feature propagation in learning on graphs with missing node features. In LOG, 2022.
Soroosh Shafieezadeh Abadeh, Peyman M Mohajerin Esfahani, and Daniel Kuhn. Distributionally robust logistic regression. In NeurlPS, 2015.
Shai Shalev-Shwards and Yonatan Wexler. Minimizing the maximal loss: How and why. In ICML, 2016.
David Solans, Battista Biggio, and Carlos Castillo, Poisoning attacks on algorithmic faimesss. In ECML PKDD, 2020.
Indro Spinelli, Simone Scardapane, Amir Hussain, and Aurelio Uncini. Fairdrop: Biased edge dropout for enhancing fairness in graph representation learning. IEEE Transactions Artificial Intelligence, 3(3):344-354, 2021.
Arjun Subramonian, Kei-Wei Chang, and Yizhou Sun. On the discrimination risk of mean aggregation feature imputation graphs. In NeurlPS, 2022.
Arjun Subramonian, Jian Kang, and Yizhou Sun. Theoretical and empirical insights into the origins of degree bias in graph neural networks. In NeurIPS, 2024.
14

---

Published as a conference paper at ICLR 2026
Lubos Takac and Michal Zabovsky. Data analysis in public social networks. In DTI, 2012.
Xianfeng Tang, Huaxiu Yao, Yiwei Sun, Yiqi Wang, Jiliang Tang, Charu Aggarwal, Prasenjit Mitra, and Suhang Wang. Investigating and mitigating degree-related biases in graph convoltuional networks. In CIKM, 2020.
Hoang Thanh- Tung and Truyen Tran. Catastrophic forgetting and mode collapse in gans. In IJCNN, 2020.
Jin Tian. Recovering probability distributions from missing data. ACML, 2017.
Simon Vandenhende, Bert De Brabandere, Davy Neven, and Lue Van Gool. A three-player gan: generating hard samples to improve classification networks. In MVA, 2019.
Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pictro Lio, Yoshua Bengio, et al. Graph attention networks. In ICLR, 2018.
Neil Vigdor. Apple card investigated after gender discrimination complaints. New York Times, 2019.
Wang et al. Improving fairness in graph neural networks via mitigating sensitive attribute leakage. In SIGKDD, 2022.
Ann M Weber, Ribhav Gupta, Safa Abdalla, Beniamino Cislaghi, Valerie Meausoone, and Gary Darmstadt. Gender-related data missingness, imbalance and bias in global health surveys. BMJ Global Health, 6(1 1):0074005, 2021.
Lilian Weng. From gan to wgan. arXiv preprint 1.Xiv:1904.08800 2019.
Jiaqi Xue, Mengxin Zheng, Yi Sheng, Lei Yang. Qian Lou, and Lei Jiang. Trojfair: Trojan fairness attacks. In Proceedings of the 1st ACM Workshop on Large Al Systems and Models with Privacy and Safety Analysis, pp. 47-56, 2023.
Shen Yan, Hsien-te Kao, and Emilio Ferrara. Fair class balancing: Enhancing model fairness without observing sensitive attributes. In CIKM, 2020.
Cheng Yang, Jixi Liu, Yunhe Yan, and Chuan Shi. Fairsin: Achieving fairness in graph neural networks through sensitive information neutralization. In AAAI, 2024.
I-Cheng Yeh and Che-hui Lien. The comparisons of data mining techniques for the predictive accuracy of probability of default of credit card clients. Expert systems with applications, 36(2): 2473-2480. 2009.
Ofer Yehuda, Avihu Dekel, Guy Hacohen, and Daphna Weinshall. Active learning through a covering lens. In NeurlPS, 2022.
Binchi Zhang, Yushun Dong. Chen Chen, Yada Zhu, Minnan Luo, and Jundong Li. Adversarial attacks on fairness of graph neural networks. In ICLR, 2024.
Brian Hu Zhang, Blake Lemoine, and Margaret Mitchell. Mitigating unwanted biases with adversarial learning. AIES, 2018.
Yiliang Zhang and Qi Long. Assessing fairness in the presence of missing data. In NeurIPS, 2021.
Yiliang Zhang and Qi Long. aairness-aware missing data imputation. In NeurIPS Workshop Trustworthy and Socially Responsible Machine Learning, 2022.
Zhilu Zhang and Mert Sabuncu. Generalized cross entropy loss for training deep neural networks with noisy labels. In NeurlPS, 2018.
Tianxiang Zhao, Enyan Dai, Kai Shu, and Suhang Wang. Towards fair classifiers without sensitive attributes: Exploring biases in related features. In WSDM, 2022.
Yuchang Zhu, Jintang Li, Zibin Zheng, and Liang Chen. Fair graph representation learning via sensitive attribute disentanglement. In WebConf, 2024.
15

---

Published as a conference paper at ICLR 2026
Daniel Zügner and Stephan Günnemann. Certifiable robustness and robust training for graph convolutional networks. In SIGKDD, 2019.
Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural networks for graph data, In SIGKDD, 2018.
16

---

Published as a conference paper at ICLR 2026
A
TECHNICAL APPENDICES AND SUPPLEMENTARY MATERIAL
This supplementary material includes the following:
Details of Graph Neural Network (GNN)
Evaluation Metrics
Dataset Details
Baselines
Software and Hardware
Hyperparameter Setting
Proof of theorems and corollaries
Training algorithm
Complexity and Rumning time comparison
Imputation accuracy
Worst case fairness accuracy trade-off
Additional experiments
Ablation Study
GRAPH NEURAL NETWORK
Two of the models (or players) learned by our model are GNNs. Without loss of generality, we will assume that they refer to as GNNs. A GNN learns node representations h, for each node that can be used to predict (categorical or continuous) values Ye f(h,). These representations are learned via successive AGGREGATE and COMBINE operations defined as follows:
peessage-passing neural networks (Gilmer al. 2017). which we will simply
h = COMBINE" (h AGGREGATE
" k-1 Au,u 1))).
where h are representations learned at the k-th layer.
EVALUATION METRICS
Utility Evaluation: As with many datasets the fairness literature, our datasets are imbalanced. To evaluate their accuracy, we apply average precision (AVPR) and the Fl score.
Fairness Evaluation: We apply two bias metrics that will be defined based on a sensitive attribute Let s be the sensitive group and 0 be the non-sensitive group. The Demographic Parity (DP) requires the prediction to be independent of the sensitive attribute (amiran & Calders 2009). We evaluate demographic parity
ADP(ğ,s) 8) = lr( 1|s = 1) r(ū = 118= 0)|-
(8)
Equality of Opportunity (EQOP) calculates the difference between true positive rates between sensitive and non- non-sensitive groups (Hardt et al. 2016) as follows:
AEQOP(O s.y) = l( = 1|s = 1. 1) p(ğ = 1|s = 0, = =]]-
Equalized Odds (EQODDs) calculates the average difference between true positive rates and false positive rates between sensitive and non-sensitive groups (Grant 2023) as follows:
2 Ipū = 1/s 1, ,, 1) p(ù = 1 0, 1)}+
(10)
lp( = 1|s 1,y 0) p(ù = 1/s 0, 0)}.
We can get corresponding faimess by subtracting ADP and AEQO from
We use ADP and A AEQO for most of our analysis they commonly used group- based metrics in fairness literature. Our theoretical analysis guarantees Demographic Parity, but we can change the L. bias loss account for different type of faimess Madras et al. (2018).
17

---

Published as a conference paper at ICLR 2026
DATASET DETAILS
SIMULATION: We simulate a synthetic graph consisting of 1000 nodes based on the stochastic block model with blocks of sizes 600 and 400, for the majority and minority classes, respectively. We can have different edge probabilities within and across blocks and generate graphs with different assortativity coefficients. The sensitive attribute is simulated as Bernoullipp) if = 1 and 8 ~ Bernoulli(1 p) otherwise. The probability p = 0.5 generates a random assignment of the sensitive attribute, while p close to 1 or indicates extremely biased scenario. For our simulation, we use p = 0.7 so that the dataset is unfair. Each node has 20 attributes, of which 8 are considered noisy. The noisy attributes are simulated as Normal 1) and the remaining ones as * + + N Normal (0, 1). where y is the strength of the signal in important features.
BAIL (ordaan & Freiburger 2015); Contains 18,876 nodes representing people who committed criminal offense and were granted bail by US state courts between 1990 and 2009. Defendants are linked based on similarities in their demographics and criminal histories. The objective is to categorize defendants as likely to post bail vs. no bail. No-bail defendants are expected to be more likely to commit violent crimes released. Race information is considered a sensitive attribute. Features include education, marital status, and profession.
CREDIT (Yeh Lien 2009): The dataset has 30, 000 nodes representing people each with 25 features, including education, total overdue counts, and most recent payment amount. The objective is to forecast if a person will or won't miss a credit card payment while considering age as a sensitive attribute. Nodes are connected based on payment patterns and spending similarities.
The dataset consists 1000 nodes and 20 features (c.g., credit amount, savings) representing clients a German bank. Labels are credit decisions for person (good bad credit). The sensitive attribute is gender. The goal is to predict who should receive credit.
GERMAN [Hofmann [994):
Kaggle dataset about the National Basketball Association (US). contains 403 players as nodes connected based on their Twitter activity. Attributes represent player statistics and nationality is considered the sensitive attribute. The goal is to predict the players' salaries (above/under the median).
NBA Dai & Wang 2021): Dataset based
POKEC (Takac & Zabovsky 2012): This dataset has two variations: POKEC-Z and POKEC-N. The pokec dataset is based on a popular social network in Slovakia. The sensitive attribute in POKEC-Z and POKEC-N are two different regions of Slovakia. The goal to predict the working field of users.
BASELINES
Vanilla: The vanilla model is the basic GNN model trained with cross-entropy loss without any fairness intervention.
Debias (Zang et al. 2018): Debias is an adversarial learning method that trains a classifier and an adversary simultaneously. The adversary is trained using the softmax output of the last layer of the classifier. It does not handle missing sensitive data. Hence, we only use Vs E V to calculate the adversarial loss.
FairGNN first uses a GNN to estimate the missing sensitive attributes. then trains another GNN-based classifier and a DNN adversary. The adversary helps to eliminate bias from the representations learned by the GNN classifier.
FairGNN DDa & Wang 2021
RNF (Du et al., 202T): RNF imputes the missing sensitive attributes by first training the model with generalized cross entropy (Zhang & Sabuncu 2018). It eliminates bias from the classification head. RNF uses samples with the same ground label but distinct sensitive attributes and trains the classification head using their neutralized representations.
FaNN WWang et al., 2022): FairVGNN learns fair node representations via automatically identifying and masking sensitiie-correlated features. It requires complete sensitive information, so we use the same imputation method as FairGNN for the missing values.
FairSIN YYng al. 2024h: FairSIN learns fair representations by adding additional faimesss- facilitating features. It also requires complete sensitive information, so we use the same independent imputation method as FairGNN for the missing values. (Yang et al. 2024):
18

---

Published as a conference paper at ICLR 2026
SOFTWARE AND HARDWARE
Operating System: Linux (Red Hat Enterprise Linux 8.9 (Ootpa))
GPU: NVIDIA A40
Software: Python 3.8. 1.8.10, torch 2.2.1, dgl==0.4.3
HYPERPARAMETER SETTINGS
The size of Vs was set to 30% of [ unless stated otherwise. Each GNN has two layers and dropout probability of 0.5. In practice, some sensitive information is often available, unless otherwise stated. Therefore, we concentrate the majority of our experiments on the assumption that there is a limited amount of sensitive information available, and we generate the imputations using the available sensitive information in Equation 2. The Vs was set 30% for all experiments unless stated otherwise. Vz is 300, 400, 1400, 100, 500, 500, and 800 for the SIMULATION, GERMAN, CREDIT, NBA, POKEC-Z, POKEC-N and BAIL datasets, respectively. We adjust the values of a and 3 for each dataset using cross- volsddalio based on the F1 score. For all baselines, we choose the respective regularizers using cross- validation based on the same metrics. Every model, except RNF, combines the training of several networks with various learning rates. We stop training RNF based early stopping to eliminate overfitting. We train the rest of the models for certain epochs and choose the model with the best AVPR. All the results shown in the following section are the average of 5 runs. We use GCN as the GNN architecture for all experiments unless mentioned otherwise.
PROOF OF THEOREMS
THEOREM 1
We will consider an adversarial active learning setting, where the goal of the adversary is to select l labels (i.c., observed sensitive values) minimize the bias Liias of the data imputed by fimp. More specifically, our proof will use the coverage model for active learning, where an unlabeled data point z. can be correctly predicted iff it is covered by at least one labeled point z/j. The goal is for the
labeled points {01. 2z zz.................... Lgg to cover as many unlabeled data points {>" z²,... ......Ir. xH } as possible select labels to minimize the coverage of the tollowing sets of nodes: (1) nodes in the sensitive group (s, = 1) and the negative class (y = 0) and (2) nodes in the non-sensitive group (s,, = 0) and the positive class (y 1). This can be achieved by minimizing the coverage of such nodes. We provide reduction from the minimum k-union problem.
(Yehuda et al./ 2022] Ren et al. 202I). Thus, in our setting, the adversary's goal
Minimum k-union problem (MKU, Chlamttc et al. (2017)): Given set of sets S = S,,,S2.- S.p where each set S. C I and I is a set of items. The problem consists of selecting r sets S1, S2, $2,.... .. S, from S to minimize the coverage S n S552 S,.
Under our coverage model, the reduction is straightforward. Given an instance of MKU, we define corresponding instance of the Adversarial Missingness against Data Bias (AMADB) problem as follows. We represent each item in I and each set in S as a data point & and assign all data points to both the non-sensitive group (s, 0) and the positive class (y 1). Moreover, we will add one data point x' that will belong to the sensitive group (s,, = 1) and the positive class (y- = 1). Therefore, the resulting set of data points is 22. )n where n |S| + | + 1. Moreover, let x.; cover z;j iff x, represents a set S; E S, Iy represents an item i, E I, and i, E S,. It follows that minimizing the bias in the AMADB instance by selecting data points xy to be labeled is equivalent to minimizing the coverage in the corresponding MKU instance.
THEOREM 2
Proof. From Eq. 7, the min-max objective of BFtS is: Bppp(h|a=1) (oi(s (h))] + E o= Sbias (h)))
Σ p(hls 1) log (h)) + Σ
phhls 0) log(1 - sbios (h))
h
19

---

Published as a conference paper at ICLR 2026
If fix Iclass and Oopp. then the optimal foias is p(hlá=1)
p(h]s=1)+p(((3-- By substituting the optimal
Joins in Eq. 7 get:
p(h s 1)
min max Bn--phhi==1)loog [log p(h|s 3 1) + p(hls 0) |+
Potuss Demp
p(h|$ 1)
Bp-p(h|s=o) [log(1 phh/ 1) p(hls 0)
We further simplify the objective function and get:
p(h 1)
E 1n-nth/==i)log p(h = p(h) $ 0) |+
p(h|$ 0)
E Bh-p(b/s-o) llog
p(h|$ 1) p(hpphhh11-- 0)
p(h 8 = 1)
Σ p(hls 1) log
p(h|6 1) p(h 8
ph 0)
Σ p(h - log
p(h|$ 1) + p( 0)
log 4 + 1):
0))
By removing the constants, we can further simplify the min-max optimization with optimal fhios to:
min max JS(p(h p) 0))
9elasa Pemp
The optimal fimp thereby maximizes the following objective:
JS(p(h| 1):p(h] 0))
Since ÿ o(h.w,, f fimp generates imputation that
min sup JS(p( & = 1); P(0ls 0))
Betass
The supremum value will make the two probabilities maximally different. Therefore, for the optimal fimp get,
min sup ppols 8 = 1) p(0) 0)l
Belass
Let ADP Batass 8.mp Ip(0 = 1|3 = p(ù 1/8 = 0)}, then, the optimal 0imp generates the worst-case (minimum fairness) imputation so that Po 2 DDPo DDPottore.en.
THEOREM 3
Proof. From Theorem 2, we get,
min sup (p(ls 1) p 0)]
Octose
Let us assume that there can be different 8 that produce sensitive attributes 82, 8m If we let
D; the uniform distribution over each s,, then BF minimizes the |p(ū]8 = 1) - p(g]s = 0) in
the worst case over these different distributions D,. Therefore, felass is minimax estimator. The objective of Eq. with optimal B 6imp and f becomes:
inl sup |p(j|8 = 1) p(g]8 =0]
Therefore, fetass minimax estimator and the maximal ADP of BRS minimum among all estimators of s.
At the global minima of fclass. |p(jlš 1) p(lls 0)l will be minimum. Its minimum value is 0.
Therefore, p(hl$ 1) p(h|$ = 0) = 0. The optimal 6 achieves demographic parity for the worst case.
20

---

Published as a conference paper at ICLR 2026
COROLLARY
Proof. If 8' is a separate imputation independent of fetass and fbias. then the min max game according to Dai & Wang (2021) is the following:
min max E Bhy-phh/s'=1)) Joins (h)]
Ocloax Obxax
b=p(hjs'= [log(1 Sbias (h)))-
With optimal 6 the optimization problem simplifies to-
min - log 4 + JS(p(hls' = 1):p(hls' = 0)).
With independent imputation 8' the adversary faias tries to approximate the lower bound of Jensen Shannon Divergence (Weng 2019). In BFtS, the adversarial imputation fimp tries to approximate the upper bound of the JS divergence, and the classifier felass tries to minimize the upper bound on the IS divergence provided by the adversarial imputation (see Proposition 1). Therefore,
JS((p(h]s' = P(hss' =0)) JS ph (
CONVERGENCE OF ADVERSARIAL LEARNING FOR THREE PLAYERS VS TWO PLAYERS WITH INDEPENDENT IMPUTATION
Let us consider a scenario when the independent missing sensitive value imputation (Dai & Wang 2021 fails to converge. There are three possible reasons for convergence to fail:
1. 8 is always
2. 8' is always 0
3. 8' is uniform, i.e. p(h]s' = -) =phhs' =
In scenario and the supports p(h]s' = 1) and p(hls' = 0) are disjoint. According to (Dai & Wang 2021), the optimization for the classifier with an optimal adversary is
min
log 4 + 2.S((p(h)s' = 1):p(h]s' = -))
Octose
As the supports of p(h|s' = 1) and phh|s' 0) are disjoint, [S(p(h)s' r(hl'' 0)) is always 0. The gradient of the IS divergence vanishes, and the classifier gets useful gradient information it will minimize a constant function. This results in extremely slow training of the node classifier, and it may not converge.
In scenario 3, & is uniform. Therefore, p(h s' = 1) will be equal to p(h = 0) which results in [S|p (hhss' 0)) being equal 0. Moreover, the classifier may assign all training samples to a single class and yet have an adversary that may not be able to distinguish the sensitive attributes of the samples as & is random. If the classifier assigns all samples to the majority class, will achieve low classification loss Celaes along with minimum Csias- The training of the classifier may get stuck in this local minima (see Eq. 4). This phenomenon similar the mode collapse of GANs (Thanh- Tung & Tran 2020).
Based on Corollary our approach is more robust the convergence issues described above.
TRAINING ALGORITHM
Algorithm iis a high-level description of the key steps applied for training BFtS. It receives the graph G. labels y, labeled nodes Vz, nodes with observed sensitive attributes V/ and hyperparameters, a and B as inputs and outputs the GNN classifier falass- sensitive attribute predictor, foias and missing data imputation GNN fimp- We first estimate si and then fix Actoss and Ovius to update 0smp- Then we update trias with Eq. 5. After that, we fix Ossos and G fmmp and update fstass with Eq. and repeat these steps until convergence.
21

---

Published as a conference paper at ICLR 2026
Algorithm Training BFtS
Input: 9: y; VL; Vs: a, 3
Output: fclasss Jbias Simp
1: repeat
2: Get the estimated sensitive attributes si with Simp
3: Fix Octase and Obias and update Dimp using Eq. 6
4: Update Obias using Eq. 5
5: Fix Pimp and Obias and update fctass using Eq. 4
6:
until converge
COMPLEXITY ANALYSIS
BFtS model consists of two GNNs and one DNN. If we consider GCN for training the GNN, the time complexity is ( F² + F), and space complexity is O(LE LF + L[V where I is the number of layers and F is the nodes in each layer (We assume that the number of nodes in each layer the same) (Blakely et al. 202T). The complexity is polynomial, and therefore, BFtS scalable. The complexity of FairGNN (Dai & Wang [021) is the same the complexity of BRS. FairGNN makes an additional forward pass to the trained sensitive attribute imputation network. Therefore, the empirical running time of FairGNN is higher than the one for BFtS, shown in the next section.
RUNNING TIME
Table 2 shows that Debias has the lowest runtime but performs the worst in fairness (See Fig. 4 and 5). BFTS had the second-lowest runtime. While the 3-player network adds complexity, removes the requirement of training separate imputation method (as for other benchmarks). Figure presents
German
Credit
Bail
NBA
pokec-z
pokec-n
Debias
21.74
110.99
170.95
14.85
650.67
647.62
FairGNN
31.43
229.41
340.48
29.12
1356.57
1234.62
FairVGNN
212.64
10557.79
2554.72
234.57
15956.62
15632.75
RNF
136.67
432.31
655.54
138.31
1945.58
2012.13
FairSIN
615.74
15142.25
2884.34
342.14
20565.13
20456.34
BFtS
28.91
168.88
242.88
22.34
942.35
956.42
Table 2: Running time (secs) of different methods
the convergence behavior of Letassi Lhias and Limp across training epochs on the NBA dataset.
Training Loss Curves
Loss Value (log)
10a
Leloss
Laias
Limp
10"
25
50
75
100
125 Epochs
150
200
225
250
Figure 6: Convergence of Colaser Lotos and Cimp- All three losses converge smoothly, confirming theoretical stability.
22

---

Published as a conference paper at ICLR 2026
(A) ADP
(B)
0.68
0.04
0.03
0.66
0.02
0.01
0.62
10
10
10-2
10-2
10-3
10-1
10
10
10
10-2
10-1
10-1
1
1
10
10
10
10
Figure 7: Sensitivity analysis of a and 8. BFt is more sensitive to than B. These parameters can be optimized using automated techniques, such as grid search.
Debias Credit
FairGNN
FairVGNN
RNF
BFIS
Bail
German
NBA
Pokec-z
Pokec-n
F1 Score
.90
.75
.75
.75
.75
.70
.70
.70
.70
.65
65
.08
.05
.10
AP
.10
.08
.03
.05
.05
.03
.05
40OP
-10
.05
1.03
05
.03
.03
20
40
60
80
20
60
20
40
60
80
20
40
60
80
20
40
60
80
20
40
60
80
% of known protected attribute
Figure 8: Performance of the models different datasets for varying amounts of observed data Vs. In the majority of the settings, our approach (BFtS) achieves a better fairness x accuracy trade-off than the baselines.
23

---

Published as a conference paper at ICLR 2026
VANILLA
DEBIAS
FairGNN
RNF
FairVGNN
FairSIN
BFS (Ours)
AVPR (T)
0,86#0.00
0.8120.00
0.82+0.00
0.81:0.00
0.80 =0.00
0.8120.00
0.83+0.00
FI score (T)
0.88+0.00
0.85 #0.00
0.84+0.00
0.84+0.01
0.84
0.84z0.00
0.85+0.00
BAII.
%ADP(L
19.10=0.03
8.78+0.02
7.9+0.03
8.50+0.04
9.81 +0.09
8.64 40.20
6.70=0.03
%AEQOP (L)
14.20=0.04
7.50+0.03
4.10=0.04
4.70=0.05
4.7920.06
3,92 #0.09
2.70=0.01
%AEQODDs (
11.49=0.08
8.61#0.02
5.2840.08
3.4240.07
5.01
4,96 #0.01
0.802
(T)
0.85+0.00
0.82+0.00
0.83+0.00
0.81#0.00
0.81 #0.02
0.81 #0.02
0.82+0.00
score (t)
0.79:0.00
0.73 +0.00
0.76:0.00
0.75+0.01
0.73 #0.00
0.75 +0.00
0.76:0.00
CREDIT
% &ADP (L)
12.10=0.10
8.80+0.20
5.60=0.05
5.30=0.09
7.77 #0.25
5,21 #0.12
5.40=0022
%AEQOPO (L)
14.50=0.10
9.20+0.10
5.90+0.10
5.10=0.00
5.56 +0.21
4.50+0.01
%AEQODDs (1)
12.30+0.20
10.10=0.22
6.03+0.09
5.20=0.03
5.98 #0.24
5.30
4.85+0.02
(T)
0.75+0.00
0.72 #0.00
0.7340.
0.7240.01
0.70 #0.01
0.73 #0.00
0.74=0.00
score (f)
0.78=0.01
0.73 =0.00
0.7340
0.72+0.01
0.72+0.00
0.72 #0.00
0.74=0.00
GERMAN
%ADP (L)
8.30+0.10
5.02+0.20
5.70 +0.30
4.20=0.00
4.37 #3.06
4.05
2.74
%AEQOP
7.40=0.08
6.24+0.20
5.7020.20
5.9020.01
3.63 #3.03
4.2 10.13
1.7020.04
%AEQODDs (4)
7.78=0.01
6.91
5.9120.08
6.26:4.08
3.75 #1.13
2.1420.03
AVPR (t)
0.76#0.00
0.73+0.00
0.73+0.00
0.7340.00
0.73 =0.07
0.73
0.7420.00
score (t)
0.73+0.00
0.67 +0.00
0.70=0.00
0.69#0.00
0.69 +0.05
0.70
0.71
NBA
%DDP (L)
13.1020.02
6.40
1.20=0.03
1.50.0.05
2.32
1,5 +0.21
1.1020.04
%AEQOP (1)
11.50=0.02
5.50+0.02
5.30=0.00
00
3.10=0.03
4.19 #2.1
3.9 #0.07
2.70=0001
DAEQODD= (1)
10.10
8.51
4,23=0. 10
4.92+0.03
5.62 #0.91
5.12 +0.02
2.90=0.05
AVPR (T)
0.76#0.00
0.7240.00
0.7220.00
000
0.7340.00
0.72 20.07
0.71 #0.05
0.73+0.00
(T)
0.73+0.00
0.69 #0.00
0.70=0.00 00
0.69:0.00
0.68 20.01
0.71 20.03
0.70=0.00
POKEC-Z & (L)
12.10+0.01
7.40+0.02
5,20=0.01
5.51
5.69 +1.1
5.98 +1.06
4.10:0.004
%AEQOP (1)
16.50=0.01
8.50+0.06
3.30=0.00
2.10:0.03
4.19
2.1 #1.09
1.70=0.03
%4 MAAQODDs (1)
13.10:0.04
7.59x0.02
3.18:0.08
2.81=0.04
5.09 =1.02
2.56 +0.57
1.91
AVPR (t)
0.74x0.00
0.71
0.72+0.00
0.7210.00
0.70 #0.08
0.71 #0.02
0.72+0.00
FI score (t)
0.75+0.00
0.70 +0.00
0.71
0.71+0.00
0.70 #0.03
0.72 40.04
0.73+0.00
POKEC-N &ADP (L)
11.10=0.02
5.40=0.01
2.1000.01
2.50=0.01
2.37
2.12 20.98
1889=0.02
%AEQOP
10.50=0.01
5,50+0.02 02
3. 3.1000.00
2.90=0.01
3.19
2.1 #0.85
1.80+0.01
%ABQODDs (1)
11.56+0.02
6. 6.15+0.03
4.8140.04
3.04+0.02
4.51 +2.13
3.49 +0.05
2.05+0.04
Table 3: AVPR, Fl score, %ADP, A EQOP, and % EQODDs of different methods. For the BAIL, and NBA dataset, outperform all baselines in terms of accuracy and fairness. For other datasets, we improve fairness while slightly sacrificing accuracy.
24

---

Published as a conference paper at ICLR 2026
VANILLA
DEBIAS
FAIRGNN
RNF
FairVGNN
FairSIN
BRS (Ours)
AVPROT)
0.88#0.00
0.81=0.00
0.8120.00
0.82#0.00
0.82 20.01 0.83 #0.01
0.84
(I
0.71+0.00
0.59 +0.00
0.68+0.00
0.62=0.003
0.6620.01 0.69 #0.02
0.70=0.00
BAIL.
%ADP (L)
11.10=0.00
12.70+0.04
8.20=0.03
9.80+0.05
8.48 #0.51 8.31 40.03
7.940.04
%AEQOP (L)
8.90=0.01
6.50=0.06
4.30=0.03
5.90=0.01
5.88 20.08
3,96 #0.21
2.80=0.02
%AEQODDs (L)
9. 9.18+0.00 02
6.93=0.02
5.21+0.04
6.42+0.03
5.89 20.06
4.21 +0.26
0.93
AVPR (T)
0.79+0.00
0.73=0.00
0.75+0.00
0.75 #0.01
0.7620.00 0.74 #0.00
0.74=0.00
FI (1)
0.71+0.00
0.68 +0.00
0.69=0.00
0.71=0.00
0.70 +0.00 0.70 #0.00
0.71
CREDIT
%ADP (L)
14.20=0.00 02
9.10 =0.02
8.02+0.05
6.40=0.04
6,70 20.05 5.01 #0.20
0.20
AEQOP (1)
18.30
15. 1240.08
12. 15
10.95
9.75+0.09
9.31 40.09
8.60+0.04
%EEOODDs (L)
15.51
10.2240.01
9.04+0.32
9.9240.05
8.96#0.02
8.54 10.10
7.57
AVPR (T)
0.73+0.00
0,70 #0.00
0.71
0.72+0.00
0.71
0,70 40.00
0.71=0.00
GERMAN FI (t)
0,74 00
0,71 +0.00
0.70=0.00
0.7240.01
0.71 +0.00 0.71 #0.01
0.72+0.00
%ADP (L)
9.80+0.07
6.1260.06
6.70 #0.10
7.10#0.00
6.01
5.01 #0.02
4.120.04
%AEQOP (1)
10.80=0.00
6.70=0.10
5.80=0.04
6.10#0.06
5.20=0.07
#0.09
3.90=0.04
"DEQODDs (L)
11.15=0.05
6.87=0.20
6.13+0.05
5.89=1.06
4.97+0.03
#0.02
3.21=0.05
AVPR (t)
0.74+0.00
0.70=0.00
0.71=0.00
0.72#0.00
0.71+0.00
0.70 #0.00
0.71=0.00
NBA
(t)
0.79+0.00
#0.00
0.75+0.00
0.75+0.00
0.75+0.01
0.74 +0.08
0.7620.00
%ADP (L)
7.60=0.03
4.20=0.03
2.30=0.01
3.10=0.04
2.10=0.04
10.10
2.01=0.01
AEQOP (1)
11.20=0.03
5,40=0.04
3.30
3.30+0.01
3.1240.05
2.91
2.10+0.01
AEQOODS (1)
10.21
6.51
3.65+0.07
3.95+0.02
3,48+0.08
40.02
1.89+0002
AVPR (f)
0.78+0.00
0.73=0.00
0.74+0.00
0.73#0.00
20.07
0.7420.00
score (?)
0.75+0.00
=0.00
0.72+0.00
0.72+0.00
#0.01
40.03
0.74
POKEC-Z %ADP (L)
10.19
8.21
5.98+0.07
5.18
5.79
42.01
3.90%0.05
%AEQOP (L)
12.13+0.01
6.85=0.02
2.98=0.02
2.38
3.15 #2.01
2.90
#1.07
1.9820.01
%AEQODDs (L)
13.13=0.02
6.93=0.06
3.15+0.07
2.95+0.03
2.65 #1.01
2.13 +0.97
1.7920.02
AVPR (1)
0.75+0.00
0.72+0.00
0.72+0.00
0.7240.00
0.71
0.72 #0.04
0.73+0.00
score
0.78+0.00
0.75 +0.00
0.75
0.74+0.00
0.74 #0.02
0.75
0.7620.00
POXEC-N %ADP (L)
14.10=0.01
6.51=0.02
3.40=0.02
4.12+0.02
2,98 +1.9
2.75
1.8920.02
%AEQOP (1)
12.50=0.07
5.50=0.02
3.1000.00
2.90=0.01
3.19 +2.2
2.1 20.85
1.8000.01
%AEQODDs (L) 13.5740.03
5.9120.04
3.70
3.20=0.01
2.91
2.43 40.06
1.71=0.05
Table 4: AVPR, F1, % ADP, % A EQOP, and % A EQODDS of different methods. GAT is the GNN architecture for all models. For the BAIL dataset, our model outperforms every other baseline in terms of fairness and accuracy. For the GERMAN, NBA A and CREDIT datasets, we perform more fairly but less accurately.
25

---

Published as a conference paper at ICLR 2026
IMPUTATION ACCURACY
Table 5 shows the imputation accuracy of the methods. We exclude results for Debias, which is based only on the sensitive information available, and for FairVGNN and FairSIN, as they identical to FairGNN (same imputation method). The results show that BFtS imputation outperforms independent imputation methods. BFtS worst-case imputation based on the LDAM loss outperforms the alternatives in terms of accuracy. This is due to the adversarial missingness process where low-degree nodes are selected have missing values. Independent imputation methods are less
effective in this adversarial setting.
German
Credit
Bail
NBA
pokec-z
pokec-n
FairGNN
0.70
0.90
0.56
0.78
0.81
0.84
RNF
0.59
0.73
0.53
0.64
0.65
0.68
BFIS
0.72
0.94
0.63
0.78
0.83
0.87
Table 5: Accuracy of missing sensitive imputation.
Positive, White Negative, White
Positive, Black Negative, Black
race Unknown (in training)
(a) FairGNN
(b) BFIS
60
100
40
80
60
20
40
20
0
-20
-20
0 200 400
200 400
600
Figure 9: 2-D kernel PCA node representations for the BAIL dataset generated by the FairGNN and BFIS (our approach). We use differrnnt markers for nodes depending their predicted class, sensitive attribute (race), and whether the sensitive attribute is missing. The results show that representations for nodes with missing values class region. On the other hand, nodes with missing values are better spread over the space for BF representations. In BFtS, there more 'Race Black' nodes than in FairGNN that have missing sensitive values in training but are predicted to be positive.
more biased for FairGNN where they are concentrated in negative
WORST-CASE FAIRNESS ACCURACY TRADE-OFF
As our proposed model operates under a worst-case fairness assumption, it may overestimate the bias in the complete data, as illustrated in Figure 2 using the BAIL dataset. This results in trade-off between fairness and utility, which is governed by a hyperparameter 3. Figures [0 (b), and (c)
show the F1 score, 1 ADP, and 1 AEQOP, respectively, 3 varies and with 30% of sensitive values observed. Here, F1 serves as the utility metric, while ADP and AEQOP quantify fairness. We compare our BFtS model against fair adversarial model trained with complete sensitive information. By tuning 8, we balance predictive utility and fairness under worst-case bias, achieving an effective trade-off.
ADDITIONAL EXPERIMENTS
LARGE SCALE GRAPH DATASET
To verify the performance of BFtS on large-scale dataset, we generated synthetic graph with 250k nodes and 100 features, as we were unable to identify a large-scale real-world graph dataset with
26

---

Published as a conference paper at ICLR 2026
(a)F1
.95
(b)1 4DP
[c] AEOOP
BFIS with missing
88
.98
Fair Adv Model w/o missing
94
BF1S with missing
Fair Adv Model w/o missing
96
BF1S with missing
84
93
Fair Adv Model w/o missing
82
10
10
10
10
10
10
10
10
10"
10"
10"
Figure 10: utiliiy trade-off BFtS on the BAIL dataset as 3 varies, compared to a fair
adversarial model trained with complete data. Lower / yields higher accuracy but lower faimesss.
Debias
FairGNN
RNF
FairVGNN
FairSIN
BF1S
.7
.92
EOOP
APP
.90
.88
.93
.86
.90
76.00
78.00
80.00
76.00
78.00
80.00
F1 Score
Figure 11: Fairness accuracy trade off for large scale graph dataset. BFtS achieves better fairness- accuracy trade-off
sensitive values. Following the setup in Figure 4 (with 150k nodes in the non-protected group and assortativity = 0.77). We compared BFtS against other baselines in Figure II across different hyperparameter settings. BFtS completed training in 85.4 minutes versus RNF's (the strongest baseline in this scenario) 1 114.6 minutes.
AVERAGE PERFORMANCE WITH GCN AND GAT
Table 3 shows the average results for BAIL, CREDIT, GERMAN, POKEK-Z, POKEK-N, and NBA datasets. In terms of accuracy and fairness, BFS outperforms all baseline approaches for the POKEK- POKEK-N, BAIL, GERMAN and NBA datasets. We also outperform competitors on the CREDIT dataset in terms of fairness, with a slight AVPR loss. Although we lose some AVPR in the CREDIT dataset, we win in F1 and the AVPR loss is negligible when compared to the fairnsss benefit, Table shows the average results for BAIL, CREDIT, GERMAN, POKEK-Z, POKEK-N, and NBA datasets using GAT Velickovic et al. 20118) to train selass and Simp- In terms of accuracy and fairness, BFtS outperforms all bascline approaches for the POKEK-Z, POKEK-N, POKEK-N,BAIL dataset. We also outperform competitors on the CREDIT, GERMAN, and NBA datasets in terms of fairness with slight AVPR loss. The AVPR loss is negligible when compared to the faimess benefit.
VISUALIZATION OF REPRESENTATIONS
Figure shows kernel PCA node representations produced by FairGNN and BFtS using the BAIL. dataset. We show the samples with missing "Race" with navy dot in the middle and samples predicted as positive class and negative class in green and red, respectively. The representations generated by FairGNN are noticeably more biased than the ones generated by our approach. A higher number of "Race = Black" samples with missing sensitive values in training are predicted as positive by BFS than for FairGNN. Moreover, BFtS spreads nodes with missing values more uniformly over the space. This illustrates how the missing value imputation of FairGNN underestimates the bias in the training data and, therefore, the model could not overcome the bias in the predictions.
27

---

Published as a conference paper at ICLR 2026
Method
MSE (+))
ADP (#)
BFtS Vanilla
0.71 + 0.10
0.15 + 0.02
0.65 = 0.10
0.21 + 0.01
Table 6: Fair regression: MSE and Fairness (ADP) Comparison Between BFtS and Vanilla Models
CROSS ENTROPY Jimp
LDAM femp
AVPR
FT
CADP()
[_EQOP
AVPR(1)
FRD
XADP
GERMAN
0.75 20.00
0.73 20.00
4.00
3.70 10.03
0.74 20.00
0.74 20.00
2.74 10.02
1.7 20.04
20.02
4.5
BAIL
0.85 #0.000
0.85 +0.00
7.10 +0.02
3.1 +0.06
0.83 =0.00
0.85 #0.00
6.70 #0.03
2.7 #0.01
NBA
+0.00
#0.00
2.11 =0.03
3.5 #0.02
+0.00
#0.04
2.70 =0.01
SIMULATION
0.94 +0,00
0.96 10,00
16.00 #0.03
8.00 #0.08
0.92 =0.00
0.96 =0.01
12.00 =0.03
5,10 =0.04
Table Ablation study using LDAM loss and cross-entropy loss for Somp- Using L.AMM loss gives better fairness and accuracy trade-off.
FAIR NODE REGRESSION
While fairess-aware node regression datasets are lacking, we created synthetic node regression task (assortativity 0.77) following our setup in Figure 5, with group-wise targets from A/ 1) and N222 1). The Table reports MSE and ADP (Berk al. 2017) for regression.
ABLATION STUDY
To see the impact of and B. we train BFIS on the GERMAN dataset with different values of a and We consider values between [10- 3,00-,11 2, 101001100 1, 10] for both a and B. Figure 7 shows the ADP and of BFtS on the GERMAN dataset. a and 3 control the impact of the adversarial loss LA on the GNN classifier and the missing value imputation GNN, respectively. The figure shows that o has a larger impact than 3 on the fairness and accuracy of the model.
We also vary the amount of observed data Vs and plot the results in Figure We use 10,, 20%, 80%, of training nodes as Vs. For nearly all models, fairness increases and accu- racy decreases with [Vsl- With BFts, both accuracy and bias often decline with the increase of Vs. In the majority of the settings, our approach (BFtS) achieves a better fairness x accuracy trade-off than the baselines.
To see the impact LDAM loss, we train fimp with cross-entropy loss and compare the performance with fimp trained with LDAM loss in Table Evidently, LDAM achieves better trade-off between accuracy and fairness.
28


Reviews:
[{"review_id": "JIEFPWj9zH", "reviewer": "Reviewer_1oQi", "summary": "This paper investigates the problem of fair graph learning when sensitive attributes are missing under an adversarial missingness process. The authors propose Better Fair than Sorry (BFtS), a three-player adversarial framework involving a graph classifier, a bias discriminator, and a missing-value imputer. The method aims to enhance fairness robustness by simulating worst-case imputations. Both theoretical arguments and empirical evaluations are presented, demonstrating that BFtS achieves superior fairness–accuracy trade-offs on multiple graph datasets compared to existing methods.", "questions": "1. Limited theoretical depth\nThe theoretical results provide general insights but remain high-level. The proofs are brief and do not include convergence or generalization guarantees for the proposed min–max training objective. A more formal analysis of the optimization dynamics would strengthen the paper.\n\n2. Comparison to related methods\nWhile the paper compares BFtS with existing fair graph learning approaches, it could more clearly articulate how its mechanism differs from other fairness-aware imputation or robustness frameworks. The conceptual novelty may appear incremental without deeper discussion.\n\n3. Experimental diversity\nThe adversarial missingness is modeled primarily through degree bias, which may not capture all possible real-world scenarios. Including other structural or attribute-based missingness patterns would make the empirical evaluation more convincing.\n\n4. Fairness metrics and discussion\nThe choice of fairness metrics (Demographic Parity and Equality of Opportunity) is standard, but the paper could briefly justify why these particular measures were selected and whether the method generalizes to others.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Novel and important problem\nThe paper targets a realistic setting where sensitive attributes are not missing at random, which is often overlooked in existing fair graph learning literature. Formulating this as an adversarial missingness problem is both intuitive and practically meaningful.\n\n2. Methodological soundness\nThe three-player adversarial design is conceptually well-motivated and integrates ideas from fairness, robust optimization, and adversarial learning into a unified framework. The training procedure is clearly described and the objectives are well defined.\n\n3. Comprehensive experiments\nThe evaluation covers both synthetic and real-world datasets, reporting multiple fairness and accuracy metrics. The results consistently show that BFtS outperforms baseline methods under different missingness settings.", "weaknesses": "1. Limited theoretical depth\nThe theoretical results provide general insights but remain high-level. The proofs are brief and do not include convergence or generalization guarantees for the proposed min–max training objective. A more formal analysis of the optimization dynamics would strengthen the paper.\n\n2. Comparison to related methods\nWhile the paper compares BFtS with existing fair graph learning approaches, it could more clearly articulate how its mechanism differs from other fairness-aware imputation or robustness frameworks. The conceptual novelty may appear incremental without deeper discussion.\n\n3. Experimental diversity\nThe adversarial missingness is modeled primarily through degree bias, which may not capture all possible real-world scenarios. Including other structural or attribute-based missingness patterns would make the empirical evaluation more convincing.\n\n4. Fairness metrics and discussion\nThe choice of fairness metrics (Demographic Parity and Equality of Opportunity) is standard, but the paper could briefly justify why these particular measures were selected and whether the method generalizes to others.\n\n5. Presentation details\nSome notations are inconsistent between equations, and the visual presentation of a few figures could be improved for clarity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gyrXjX37Ue", "reviewer": "Reviewer_8hmM", "summary": "This paper studies graph fairness when demographic attributes are partially observed under adversarial missingness processes.\nIt introduces BFtS (Better Fair than Sorry), a 3-player adversarial learning framework combining a GNN classifier, a fairness adversary, and an imputation adversary. BFtS imputes worst-case sensitive attributes to make fairness evaluation robust under adversarial missingness. Both theoretical analyses and empirical results demonstrate superior tradeoffs between fairness and accuracy compared to baselines.", "questions": "Please see Weaknesses", "limitations": "", "rating": 4, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- The work identifies a realistic yet overlooked issue: adversarial missingness of sensitive attributes, which can mislead fairness evaluations in graph learning, and formalizes two adversarial missingness problems (AMAFC, AMADB) \n\n- Theorems 2 and 3 clearly demonstrate that BFtS minimizes worst-case bias and approximates robust fairness\n\n- Extensive evaluations are conducted across synthetic and real-world datasets. Empirical results consistently show superior fairness–accuracy trade-offs and robustness under limited or missing sensitive data\n\n- The paper is well organized and easy to follow", "weaknesses": "- The practicality of adversarial missingness is vague. Whether a value is missing or not seems to be difficult to control by adversaries. If the adversaries can deliberately drop some values, in this case, modifying these values seems to be a stronger adversary we can think about. It would be helpful to add more discussions on the practical scenarios of adversarial missingness in real-world cases.\n\n- It would be helpful to add an introduction of the threat model setting in the main text.\n\n- The bilevel optimization raises concerns about training stability. Although the authors propose the loss curve in Figure 6, it seems that Figure 6 is plotted with only a few points. It would be helpful if the training stability could be better shown in the experiments.\n\n- It seems that the proportion of missing sensitive attributes is more than 50% of the total nodes in Figure 8. It would be helpful to see more experimental results under more stealthy attack settings.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ra4UW6aF5F", "reviewer": "Reviewer_53p8", "summary": "This paper addresses a critical and underexplored problem in fair graph machine learning: the effect of adversarial missingness of sensitive attributes on fairness-aware Graph Neural Networks (GNNs). The authors argue that prior fairness methods assume that sensitive attributes are either fully available or missing completely at random (MCAR), which is unrealistic in practice. To overcome this limitation, the paper introduces Better Fair than Sorry (BFtS), a 3-player adversarial framework that jointly learns a node classifier, a fairness adversary that predicts sensitive attributes from learned embeddings, and an imputation adversary that imputes missing sensitive attributes to approximate the worst-case fairness scenario. Moreover, the authors provide theoretical analysis showing that BFtS corresponds to a min–max optimization that minimizes classifier bias under worst-case imputations.", "questions": "1. How sensitive is BFtS to hyperparameter tuning, especially the fairness weight (α) and imputation adversary weight (β)? Could the authors provide empirical or theoretical guidance on selecting them?\n2. Does the degree-bias assumption for adversarial missingness generalize to graphs with highly non-homophilous structures?\n3. Could BFtS be extended to handle multi-valued or continuous sensitive attributes rather than binary ones?\n4. Is there any evidence of mode collapse or instability during the 3-player adversarial training, and if so, how is it mitigated?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. This paper has principled theoretical grounding, clear definitions, and basic robust justification.\n2. This paper proposes an innovative framework with 3-player adversarial setup elegantly unifies imputation, fairness estimation, and classification.\n3. Extensive experiments on both synthetic and real-world benchmarks and the robustness is shown under varying degrees of missingness.", "weaknesses": "1. The 3-player adversarial training could be computationally heavy, particularly on large-scale graphs. A detailed runtime or memory comparison would strengthen the empirical analysis.\n2. The study focuses on Demographic Parity (ΔDP) and Equality of Opportunity (ΔEQOP). It would be beneficial to include other fairness notions (e.g., Equalized Odds, Counterfactual Fairness) for completeness.\n3. While the adversarial imputation approach is conceptually powerful, there is little discussion of how it performs under realistic partial observability (e.g., when only 5–10% of sensitive data is known).\n4. The intuition behind the imputation adversary’s learned behavior could be further explored, perhaps via visualization or sensitivity analysis.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)