On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
Authors: Junyi Chai
Taeuk Jang
Jing Gao
Xiaoqian Wang
Venue: ICML 2025 poster (2025)
Keywords: fairness
adversarial robustness
Primary area: social_aspects->fairness
TL;DR: unifying adversarial attack and adversarial robustness regarding fairness and accuracy

Abstract: While numerous work has been proposed to address fairness in machine learning, existing methods do not guarantee fair predictions under imperceptible feature perturbation, and a seemingly fair model can suffer from large group-wise disparities under such perturbation. Moreover, while adversarial training has been shown to be reliable in improving a model's robustness to defend against adversarial feature perturbation that deteriorates accuracy, it has not been properly studied in the context of adversarial perturbation against fairness. To tackle these challenges, in this paper, we study the problem of adversarial attack and adversarial robustness w.r.t. two terms: fairness and accuracy. From the adversarial attack perspective, we propose a unified structure for adversarial attacks against fairness which brings together common notions in group fairness, and we theoretically prove the equivalence of adversarial attacks against different fairness notions. Further, we derive the connections between adversarial attacks against fairness and those against accuracy. From the adversarial robustness perspective, we theoretically align robustness to adversarial attacks against fairness and accuracy, where robustness w.r.t. one term enhances robustness w.r.t. the other term. Our study suggests a novel way to unify adversarial training w.r.t. fairness and accuracy, and experiments show our proposed method achieves better robustness w.r.t. both terms.

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
Junyi Chai Taeuk Jang'
Jing Gao Xiaoqian Wang
Abstract
models do not reflect real-world discrimination. However, machine learning models have shown biased predictions against disadvantaged groups several real-world tasks (Larson et al., 2016; Dressel & Farid, 2018; Mehrabi et al., 2021a). In order to improve fairesss and reduce discrimina- tion of machine learning systems, variety of work has been proposed to quantify and rectify bias (Hardt et al., 2016; 6; Kleinberg et al., 2016; Mitchell et al., 2018). Despite the emerging interest in fairness, fairness depreciation in the context of adversarial perturbation and the corresponding defense techniques have not been adequately discussed.
While numerous work has been proposed to ad- dress fairness in machine learning, existing meth- ods do not guarantee fair predictions under im- perceptible feature perturbation, and a seemingly fair model can suffer from large group-wise dis- parities under such perturbation. Moreover, while adversarial training has been shown to be reli- able in improving a model's robustness to defend against adversarial feature perturbation that dete- riorates accuracy, it has not been properly studied in the context of adversarial perturbation against fairness. To tackle these challenges, in this paper. we study the problem of adversarial attack and ad- versarial robustness w.r.t. two terms: fairness and accuracy. From the adversarial attack perspec- tive, we propose a unified structure for adversar- ial attacks against faimess which brings together common notions in group fairness, and we theoret- ically prove the equivalence of adversarial attacks against different fairness notions. Further, we de- rive the connections between adversarial attacks against fairness and those against accuracy. From the adversarial robustness perspective, we theo- retically align robustness adversarial attacks against fairness and accuracy, where robustness w.r.t. one term enhances robustness w.r.t. the other term. Our study suggests novel way to unify adversarial training w.r.t. fairness and accu- racy, and experiments show our proposed method achieves better robustness w.r.t. both terms.
Previous work has demonstrated that by applying small magnitude of adversarial perturbations to input features, the performance (classification accuracy) of machine learn- ing models can be severely deteriorated (Goodfellow et al., 2014; Madry et al., 2017). Realizations of such pertur- bations are generally referred to as the adversarial attack and have been widely discussed in current literature (Croce et al., 2020; Bai et al., 2021). Being the complementary of adversarial attack, the adversarial robustness provides reliable quantification regarding the statistical properties of machine learning model when subjected to such ad- versarial perturbations, particularly concerning accuracy. Methods that focus on improving adversarial robustness are referred to as adversarial training (Chakraborty et al., 2018; Wong et al., 2020; Sriramanan et al., 2021). However, such discussion becomes troublesome when extended to the sta- tistical parity of a model, i.e., the adversarial robustness in the context of fairness. Regarding fairness, the adversarial perturbations aim at exacerbating disparities between sen- sitive groups, typically characterized by the group fairness notions, including demographic parity (DP) and equalized odds (EOd). Owing to the variations in the statistical charac- teristics of fairness and accuracy, such perturbations may not necessarily align with the adversarial attack. As shown in Tab. 1, while the adversarial attack effectively approximates the worst-case perturbations against the accuracy, it fails to provide appropriate estimations regarding the worst-case perturbations against fairness measures, especially in terms of EOd. Under a successful adversarial attack, the difference in group-wise classification errors vanishes, Ieading to zero violation in EOd. Consequently, a successful adversarial attack does not necessarily ensure fairness depreciation, and
1. Introduction
As machine learning systems have been increasingly applied in high-stake fields, it is imperative that machine learning
'Elmore Family School of Electrical and Computer Engineer- ing, Purdue University. Correspondence to: Xiaoqian Wang <joy- wang @ purdue..dudd..
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
vice versa.
as samples that are adversarially perturbed by the accuracy attack. We leave the mathematical formulations in Sec. 3.1. We define such robustness to the accuracy attack as accu- racy robustness, i.e., a model's 's ability to resist adversarial perturbation by an accuracy attack and remain same pre- dictions on clean and accuracy adversarial samples. Similar to those of accuracy, we define the fairness attack as the imperceptible perturbation to deteriorate fairness, and fair- ness ad adversarial samples samples that are adversarially perturbed by the fairnsss attack. We show the mathemati- cal formulations in Sec. 3.2. Specifically, while accuracy attacks aim at exacerbating the classification error, fairness attacks try to deteriorate group-wis wiiup parity between different sensitive groups, leading to varied perturbations up to each individual. Work including (Solans et al., 2020; Mehrabi et al., 2021b) first proposed to generate fairness adversarial samples taking into account faimess objectives to perturb the training process and to exacerbate bias on clean testing data. However, the detailed mechanism of fairness attacks has not yet been properly discussed, as it remains unclear how the instance-wise perturbations work, and the relation- ship between fairness attacks and accuracy attacks remains ambiguous. Moreover, the adversarial robustness regard- ing faimess attacks, as well as its connection with accuracy robustness, has been overlooked in current literature.
Acc
DP
EOd
0 0.3
1.17%
1..54%1.65%
28.45:12.27%
0
15.13+0..17% 0
Table 1. Comparison of changes in statistical measures (Acc for accuracy. DP and EOd for fairness) under adversarial attacks on Adult dataset. Lower DP and EOd indicates smaller disparities between sensitive groups.
As discussed in (Solans et al., 2020; Mehrabi et al., 202 Chhabra et al., 2022; Kang al., 2023), similar to accuracy, fairness can also be targeted by malicious adversarials, lead- ing to biased outcomes against certain demographics. While previous work has been focused on the poisoning attack against fairness measures, the adversarial attack and adver- sarial robustness in the context of fairness has been rarely discussed. Given that current adversarial attack techniques not readily applicable to fairness depreciation through adversarial perturbation, there is a pressing necessity to develop tailored methods for formulating the adversarial attacks, as well as the adversarial robustness, within the context of fairness.
Black
White
TPR
TNR
TPR
TNR
Just as a model optimized for accuracy in training may not be robust against an accuracy attack, similarly, a fair model trained for static fairness may not inherently possess fair- ness robustness against faimess attacks. Here we similarly define fairness robustness model's ability to resist ad- versarial perturbation by fairness attack and remain same predictions on clean and fairness adversarial samples. As shown in Fig. 1, fairness can be volatile under adversarial perturbations, where a small degree of perturbation can lead to significant variations in group-wise disparities, and en- forcing fairness alone during training does not necessarily lead to improvement in robustness against fairness attacks. In fairness literature, although adversarial training has been widely discussed, most of them have been focused on ap- plying adversarial training as a means to unlearn the impact of sensitive attributes to achieve static fairness (Madras et al., 2018; Creager et al., 2019). Chhabra et al. (2022) first propose defense framework for adversarial perturba- tion against fairness; however, such perturbation is targeted against sensitive information, rather than input features.
38.05%
86.88%
34. 54%
89.70%
100%
0%
100%
Always pradicted as high riskirecidiiism under adverawrial perturbation
Alsaya predicted as law resknan-recidiviin under schersorial pertabation
Figure 1. Demonstration of adversarial attacks against fairess on COMPAS dataset (Larson al., 2016), where the statically fair classifier is obtained by in-processing (Wang et al., 2022). Under a small perturbation level 0.05 ( 1.5% of input feature's 's norm), the disparities in true positive rates (TPR) and true negative rates (TNR) between white and black people increase sharply to 100%, and the outcomes of classifier become solely dependent of sensitive information, leading to destructive social injustice against the disadvantaged group (where all the black individuals will be considered as of high risk in this demonstration). Fairness shall not be considered as static measure. and a classifier with small fairness gaps can show large disparitics under fairness attacks. Image credit: (Angwin et al., 2016).
In this work, we propose a general framework for fairness attacks, where we show impacts of faimess attacks up to each individual under different notions, as well as the con- nections between these notions regarding gradient-bass attacks. Based on this unified framework, we discuss the relationship between faimness attacks and accuracy attacks, Furthermore, we show that despite the discrepancies in ad- versarial perturbations between the faimess attack and the
For simplicity of discussion, with slight abuse of phraseol- ogy we define the adversarial perturbations against accuracy as the accuracy attack, i.c., the imperceptible perturbation to deteriorate accuracy, and accuracy adversarial samples
2

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
accuracy attack for certain samples, fairesss robustness and accuracy robustness do not necessarily conflict with each other. Based on the spatial proximity between such samples and samples where the fairess attack and the accuracy at- tack acts in the same direction, we show theoretically how fairness robustness and accuracy robustness can benefit from each other, i.e., the alignment between fairness robustness and accuracy robustness. Our theoretical results suggest a novel defense framework, fair adversarial training, which incorporates fair classification with adversarial training so as to improve fairness robustness. We summarize our con- tribution as follows:
machine learning. Goodfellow et al. (2014) propose a simple one-step gradient-based attack adversarially perturb the input features. Madry et al. (2017) extend the one-step attack to an iterative attack strategy and show that iterative strategy is better at finding accuracy adversarial samples. Accordingly, different methods on adversarial defense have been proposed (Shafahi et al., 2019; Wong et al., 2020; Xie et al., 2020; Cui et al., 2021; Jia et al., 2022: Dong & Xu, 2023; Ma et al., 2024) to improve accuracy robustness of classifier. However, few literature has addressed the adversarial training and adversarial attack against fairness. Some work discusses the problem of fairness poisoning attack during training (Solans et al., 2020; Mehrabi et al., 2021b); however, it is not clear how fairness attacks would influence the predicted soft labels.
We propose a unified framework for fairness attacks, which brings together different notions in group fair- ness.
Fairness in adversarial robustness. Group fairesss in the context of adversarial robustness has been less studied in current work. Work including (Nanda et al., 2021; Xu et al., 2021; Ma et al., 2022) argues that adversarial training with- out proper regularization leads to class-wise disparities in accuracy and robustness. However, group-wise disparities are not considered in these work, and the formulation of dis- parities by these work is not in accord with notions in group fairness. Recent work studies the poisoning attack against group fairnsss measures (Solans et al., 2020; Mehrabi et al., b02 Zeng et al., 2023); however, these work lacks in- depth discussion regarding the detailed mechanism of the fairness attack and the defense techniques. Specifically, the relationship between the fairness attack and the accu- racy attack, as well that between faimess robustness and accuracy robustness remains unclear. Our work is most related to (Chhabra et al., 2022), where adversarial pertur- bation against sensitive information and the corresponding defense mechanism are considered. In comparison, our framework considers feature-level perturbation, rather than innttive-innommatin--eeeed which provides more general quantification regarding the worst-case perturbations against faimess.
We theoretically demonstrate the alignment between fairness robustness and accuracy robustness, and we propose a novel defense framework, fair adversarial training, which incorporates faimess robustness with fair classification.
We empirically validate the superiority of our method under faireess attacks, and the connection between fairness robustness and accuracy robustness on four benchmark datasets.
2. Related Work
Fairness in machine learning. Fairness has gained much attention in machine learning society. Different notions have been proposed to quantify discrimination of machine learning models, including individual fairness (Lahoti et al., 2019; John al., 2020; Mukherjee et al., 2020), group fair- ness (Feldman al., 2015; Hardt et al., 2016; Zafar et al., 2017) and counterfactual fairness (Kusner et al., 2017). Our work is most closely related with group fairness notions. Works on group faimness generally fall into three categories:
preprocessing (Creager et al., 2019; Jiang& & Nachum, 2020; Jang& & Wang. 2024; Yu et al., 2024; Jung et al., 2025), where the goal is adjust training distribution to reduce discrimination; in- inoprocessing (Zafar et al., 2017; Jung al., 2021; Roh et al., 2021; Chai & Wang, 2022; Lu et al., 2024), where the goal is to impose fairness constraint during train- ing by reweighing or adding relaxed fairness regularization; and post-pne processicg (Hardt et al., 2016; Jang et al., 2022; Cruz & Hardt, 2023; Tifrea et al., 2023), where the goal is to adjust the decision threshold in each sensitive group to achieve expected faimess parity. Compared with existing work, we extend the discussion to both static fairness and fairness robustness, emphasizing the faimess notions under adversarial scenarios.
3. Problem Definition
3.1. Adversarial attack against accuracy
We start by formulating the accuracy attack. Denote x e R" as the input feature, y E {0, 1 as the label, and a e {0, 1} as the sensitive attribute. Let ff R² + [0, 1] be the function of classifier and f(x) the predicted soft label, then the objective of accuracy attack for sample (I. y, a) can be formulated as
arg max Ler(f(x +),)), s.t/|c|l S co.
Adversarial machine learning. Adversarial training and adversarial attack have been widely studied in trustworthy
where ||||] refers to the LP norm of e with general choice of I 0, norm, and T.c is the cross-entropy loss. By estimating
3

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
the perturbation that maximize Lee, we seek amplify the difference between the predicted soft label and the ground- truth label, thereby deteriorating accuracy. A common way to obtain accuracy adversarial samples is through projected gradient descent (PGD) attack, where accuracy adversarial samples are iteratively updated in each step based on the signed gradient:
4. Connection between Adversarial Attacks
Before delving into the discussion, we first clarify the nota- tions in Tab. 2. Without loss of generality, we assume S the advantaged group with higher average positive predic- tion. We refer to fairness attacks targeting DP and EOd as DP attack and EOd attack, respectively.
x (+1 7 (x' + a sign (V u)))
4.1. Connection between fairness attacks
We now discuss the detailed relationship between DP at- tack and EOd attack. The following corollary states the compatibility of the two objectives:
where a the step size, S == {<, allowed perturbation and 1I is the projection operator that clips the perturbed input into the allowed cy-ball. PGD attack has been shown to be effective in finding adversarial samples compared with one-step adversarial attack (Madry et al., 2017).
|||||| || I <o) is the set of
Corollary 4.1. The udversarial objective of EOd attack lower-bounded by that of DP attack up to multiplicative constants.
We defer the proof to appendix. Corollary 4.1 shows the con- nection between adversarial attacks against different group fairness notions, where these attacks perturb the predicted soft labels against sensitive attributes. A successful DP attack also leads successful EOd attack, while the op- posite does not necessarily hold true. We will focus DP attack for the rest of this paper. In the following context, we refer to DP attack as fairness attack unless otherwise specified. For a given sample (2z, yj- az) in the advantaged group, we can rewrite LP in (1) as:
3.2. Adversarial attack against fairness
Similar to that of accuracy attack, we formulate the fairness attack as follows:
arg max +((( s.t.llel| S c0.
where L is some relaxed fairness constraint. By approx- imating the worst-case perturbation regarding fairness at- tack, we seek to amplify the difference in predicted soft labels across different sensitive groups. We consider two widely adopted group fairness notions: demographic par- ity (DP) and equalized odds (EOd). For a testing set = {(x,, Vi, a.), 1 S S N). denote Sy* := {r:lyı j, a. = k), and S == (an/a, = k). The objective can be formulated as relaxations of fairness notions (Wang al., 2022):
f(x:)
f(;;)
LDP
1
S.ol
1
f(yy)
(xx) Saal
[S, +
Σ
(2)
S..y
m1
f(xz)
+ +Cj,
[.,
(xx)
(xx)
LI =
Σ
[S,1
S.ol
where 0 = | agl and Cj is a constant w.r.t. xy since it 2Lix. This shows that the DP attack is ex- dx;
x, 1
24 a
does not affect pected to maximize the prediction in the advantaged group.
fxx;) Syn
f(x;)
LEOa Σ
Σ p
Syy
Similarly, for a sample (IK, yk, ax) in the disadvantaged group, we have:
And fairness adversarial samples can be obtained analo- gous to the accuracy attack via PGD attack:
f(x))
f(x:) |S,o|
f(xk) S
LIP Σ
+ Ck.
S
Z.ES.1
x ++1 II (x* ar sign (V V.L((,,,,)) a.
(3)
where Cs is constant w.r.t. Te thus does not affect LLee
dag
(3) shows that the DP attack in the disadvantaged group is contrary to that of advantaged group, where the predictions are expected to be minimized.
We summarize the bhite-box threat model as follows: The adversary has full access to the target model's 's parameters. Adversarial manipulations are applied at the input level, sub- ject to a maximum allowable perturbation. Fairness attacks aim to maximize group- wise disparities on the testing data, measured by metrics such as DP and EOd. In contrast, ac- curacy attacks seek to maximize classification error on the testing data.
4.2. Connection between the fairness attack and the accuracy attack
We move on to discuss the connection between the faimess attack and the accuracy attack. The following corollary
4

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
Faub.a
The clean samples in the clean subgroup.
" a
The adversarial sample(s) obtained after the attack type obj.
# a
Adversarial sample(s) generated from the clean subgroup (sub, a) at f-th iteration largeting atlack type obj e (DP,EOd, Ace).
The set of samples in the clean subgroup.
ab.a
Pabba
The distribution predicted soft labels the clean subgroup (sub, a) after the attack type obj.
Pabia
The distribution of predicted soft labels in the clean subgroup (sub, a) without atlack.
Table Summarization of notations.
shows the connection between the fairness attack and the accuracy attack:
fairness robustness and accuracy robustness also attain align- ment on these samples. Consider sample from the 'Same Direction' groups, by Corollary 4.2 we have:
Corollary 4.2. The fairness attack and the accuracy attack operate in the same direction regarding true negative (TN) and false positive (FP) samples in the advantaged group and true positive (TP) false negative (FN) samples in the disadvantaged group.
[( Fair) = / (Iaa+s (x) + ar sign (Va, Lm( dz, 9c))) = (Tz,+s (x) + a sign (Va, Ien (vi, 9:))
Under same perturbation level c and same step size a up to T iterations, the faimess attack and the accuracy attack leads to equivalent perturbations in predicted soft labels regard- ing x;'s 's in the 'Same Direction' category. Therefore, is feasible to leverage existing adversarial training tools target- ing accuracy robustness to improve fairness robustness for such samples. However, such alignment cannot be directly extended to the four subgroups in the 'Opposite Direction' category. As the faireess attack and the accuracy attack operate in the opposite direction, it is not straightforward whether there exists alignment or misalignment between fairness robustness and accuracy robustness regarding those samples.
We defer the detailed proof to appendix. Notably, the fair- ness attack and the accuracy attack behave in the opposite direction for the remaining sets of samples (i.e.. TP and FN samples in the advantaged group, and TN and FP samples in the disadvantaged group). Specifically, for the two sub- groups 1 and SyN.o. the fairness attack aims at maximiz- ing their predicted soft labels as in (2) and (3), respectively. This results in maximizing the predicted soft labels for STP,1 and minimizing the predicted soft labels for STN,o- Whereas the accuracy attack seeks to minimize the predicted soft labels for I and maximize the predicted soft labels for SIN,0-
Therefore, in the following we focus our discussion on the four 'Opposite Direction' subgroups in Table 3: STP.1. SPN.1, SIN.O. SFP.o- Under e-level fairness at- tack with step size a and up to T iterations, we define Fair sub,a := [f a) y) - (f 3) as the change of cross- cross-entropy loss for sample Tsub,a and sub,o == (s - ((=ssub.a) as the change of (3rabb.a). Therefore, Daiir sub,a and Faiir are related with fairness robustness, and sub.a smaller sub,a and sub.a indicate better fairness robustness. Likewise, under c-level accuracy attack with step size a and up to T iterations, we define DA := |LCR (rAr, ,, y) LCE (f (Tsab.a), y)l as the change of cross-entropy loss for sample Tsub,a and gÅce := (f(Arss..) (I.abaa)) as the change of f a), and smaller D and 8Aue indicates better accuracy robustness. Before we state the detailed relationship, we first state the assumptions we need to prove the relationship:
Likewise, for the subgroups S and Spp,o, the fairness attack tries to 'correct' the predicted soft labels such that the adversarial predictions align with the ground-truth labels. In contrast, the accuracy attack is designed to exacerbate the error within these subgroups. We summarize the con- nection between the fairness attack and the accuracy attack on various subgroups in Table 3.
Sensitive Group
Same Direction
Inverse direction
Disadvantaged
STp.O. SEN,0
STN.o. SFP.0
Advantaged
STY.I. SFP,1
STP,1, SPN,1
Table 3. Connection between the fairness attack and the accuracy attack regarding samples in different subgroups.
5. Alignment between Fairness Robustness and Accuracy Robustness
Assumption 5.1. The gradient of f w.r.t. input feature xr is Lipschitz with constant K.
We now discuss the alignment between faimesss robustness and accuracy robustness. According to Table 3, the relation- ship between fairness robustness and accuracy robustness is straightforward on the four subgroups in 'Same Direc- tion' category. Since the fairness attack and the accuracy attack operate in the same direction for those samples, the
Assumption 5.2. The distributions Pauh,a are uniformly bounded by constants Maab.-
Under Assumption 5.1 and 5.2, below we discuss the align- ment between faimess robustness and accuracy robustness
5

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
in two directions, i.e., how fairness/accuracy robustness improves accuracy/faimnes robustness. While the assump- tion of Lipschitz gradient seems a bit strong, it is widely used assumption for neural network, and it is feasible to estimate the Lipschitz constant (Fazlyab et al., 2019; Shi et al., 2022). Also, the difference in fairness/accuracy ro- bustness as discussed in the Theorem 5.3 and 5.6 are indeed upper-bounded by the Lipschitz constant K, and a smaller K indicates better upper-bounds for the difference in robust- ness, which also suggests better alignment between fairness robustness and accuracy robustness.
regarding the upper-bound of robustness difference:
D FP.O
min 23p.1 ES001
FP,1
Σ H
Vnk 8-1 F.irr F-1.Fair "FPP1
H =
+ p: 6p 1 1,A00
f(EEp, Faair)
f(
-
(-1.
Pt
f(
5.1. From accuracy robustness to fairness robustness
5.2. Fair adversarial training
We first derive the guarantee for fairness robustness by ac- curacy robustness. We will focus on ZPN, and 2pp.0, as fairness attack regarding 2TP.1 and ZTN,0 does not affect fairness, i.e., the predicted labels for 2TP,1 and FyN,0 will remain the same before and after the fairness attack.
Theorem 5.3 provides robustness guarantee in terms of changes in predicted soft labels under the fairness attack regarding 'Opposite Direction' samples. Based on such dis- cussion, we now derive the fairness robustness guarantee regarding fairness measures, namely DP and EOd. Con- sider Dp DP, EOd and EOd as the fairesss measures after and before the fairness attack, the following theorem states the fairness guarantee by static faimess and accuracy robustness under the fairness attack:
Theorem 5.3. Given classifier J. consider e-level fair- ness attack with step size a and up to T iterations, the difference of fairness robustness between IPN,1 and TyN.o is by the accuracy robustness of IPN.o up to an additive and a multiplicative constant:
Theorem 5.5. Given a classifier f. consider e-level fair- ness attack with step size a and up to T iterations, let A == max(aeBaaa)) sub.a be the maximun shift in pre- dicted soft labels within the subgroup under allack type obj, let M = max mbb.a Maub as the resulting faimess measures are upper-bounded by the corresponding clean measures and accuracy robustness of the classifier up to a multiplica- five constant:
D FN
min 230
FN.O + Σ G
EG.
golj
/nKd(atw) Fair 1-1,Fuir , FPNO f(a Fairr)
G
+ FN,0
1,cce
f(akab - f (iaii 1 Ffir (1
DpFair SDP+ M Racc;
(4)
T =
EOd < EOd + M RRaee
(5)
where Race TP.0 + +ming; (D) + +H,) A T8,1 +
Detailed proof and empirical verification can be found in the appendix. As discussed in Section 4.2, adversarial training w.r.t. accuracy also improves fairness robustness of sub- group SpN,o while it is unclear for subgroup Spx.1 Thus, we leverage TPx,o to explore robustness guarantee against fairness attack for xpN.1- Specifically, for f' under adver- sarial training w.r.t. accuracy and f under normal training, we have similar upper-bound, except that we now have 6 11t11, < o 1,Acc which indicates a tighter upper-bound for f' in Theorem 5.3. For the marginal advantaged FN samples (I which are more vulnerable under the fair- ness attack, we have their fairness robustness bounded by marginal disadvantaged FN samples (IIN,O). and smaller ON..o or tighter bound indicates better fairness robustness. Similar inequality in Theorem 5.3 also holds for Frp.o and IFP.1:
min,, 68m.o (D, + G2)).
We defer full proof to the Appendix. The DP and EOd terms in the upper-bounds of Theorem 5.5 corresponds to the static fairness, and the remainder corresponds to the accuracy robustness as stated in Theorem 5.3. Consequently, retaining small fairesss violations under the faireess attack calls for two different interventions: 1) enhancing static fairness during training, which results in lower values of DP and EOd in (4) and (5); and 2) enhancing accuracy robustness, resulting in lower value of Rase in (4) and (5). These two interventions lead to smaller upper-bounds for Fair Fair and Fair thereby ensuring fairness robustness.
One direct result regarding Theorem 5.5 is to incorporate accuracy adversarial samples during training to obtain a classifier that is also robust to fairness attack. Correspond- ingly, regarding the defense framework against the fairness
Remark 5.4. For o and 1 we have similar inequality
6

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
attack, we consider the following objective minimize the fairness gap while ensuring accuracy robustness, as means
Since the change of predictions under accuracy attack is upper-bounded by fairness robustness, it is also feasible to improve accuracy robustness of classifier by using fairness adversarial samples during training.
to ensure fairnsss robustness. Specifically, we propose to improve fairness robustness of classifier by incorporating accuracy adversarial samples and fairnsss constraints during training:
6. Experiments
arg min 8
Σ N
Len(s(a) ).n,, 8.1. L IS%
(6)
We evaluate our method on four datasets: Adult (Dua & Graff, 2017), COMPAS (Larson al., 2016), German (Dua & Graff, 2017) and CelebA (Liu et al., 2015) '. We use accuracy as the performance metric, and DP and EOd as fairness metrics. All the evaluation metrics are calculated based on 0 - cutoff, rather than the relaxed version. The classifier is chosen as ResNet-18 for CelebA and MLP for the other three datasets, and all methods are trained un- der the same data partition. During adversarial training, the perturbation level is set 0.2 for Adult dataset, 0,005 for COMPAS dataset, 0.01 for German dataset and 1 for CelebA dataset, where the perturbation level is empirically determined to achieve the largest perturbation while still ensuring convergence.
where 2A corresponds to the accuracy adversarial sample by F;, the TCE (xx v,) term corresponds to accuracy robustness, and L S. y corresponds to static fairness, as we derived in Theorem 5.5. L can be explicitly specified by fairness relaxations during training or implicitly specified as preprocessing or post-processing techniques. We defer the pseudo-code of our fair adversarial training framework to the Appendix.
5.3. From fairness robustness to accuracy robustness
For the other direction, under Assumption 5.1, we have the following guarantee for accuracy robustness by fairness robustness. We will focus on ITP,1 and I7N,0, as accuracy attack regarding IFN,1 1 and IFP,0 does not affect accuracy, i.., the predicted labels remain false before and after the accuracy attack.
In the following, we validate the adversarial training frame- work under fairness attacks and accuracy attacks, respec- tively. We defer details of cach dataset, full experimental results and empirical verification of theoretical results to the Appendix.
Theorem 5.6. Given a classifier f. consider e-level accu- racy attack with step size a and up to T iterations, the accuracy robustness of TT a is upper-bounded by the fair- nexs robustness of ITP,O up to an additive constant:
Robustness against fairness attack. Regarding normal training, we consider the following four baselines: Baseline (without fairness regularization): Preprocessing (Yu et al., 2024); In-processing (Wang al., 2022); Post-processing (Jang et al., 2022). Regarding adversarial training, we con- sider one baseline and three different realizations of fair adversarial training: Adversarial training: Neural network under adversarial training w.r.t accuracy; Adversarial train- ing (preprocessing) with samples reweighed by Yu et al. (2024); Adversarial training (in-processing) with relaxed EOd constraint by Wang et al. (2022); Adversarial train- ing (post- post-processing) with soft predictions postprocessed by Jang et al. (2022). The three versions differ in the fairness regularization L in (6). Results on classifiers under fairness attack on Adult dataset are shown in Fig. 2. The fairness attack enforces biased predictions on testing samples, and under a successful attack (DP reaches its maximum), EOd also reaches its maximum, while the accuracy determined by the base rate of each group. Compared with adversarial training, normal training shows a sharp increase in DP and EOd under faimess attacks, and improvement in faireess under normal training does not help with fairness robust- ness. In comparison, classifiers under adversarial training w.r.t. accuracy show improvement in fairness robustness,
TP
min 2m.0E910
TP.D
Vnakd(aTre Σ t=1
Here the fairness attack and the accuracy attacks are in alignment regarding TTP,0. which we use to upper-bound ac- curacy robustness of TTP, Specifically, the first term in the RHS of the inequality corresponds to the faimess robustness of #TP,0. and the second term is determined by the spatial distance between ZTP.o o and TTP,1 under the accuracy attack. Theorem 5.6 shows that adversarial training w.r.t. fairness also benefits accuracy robustness. Specifically, for f" under adversarial training w.r.t. fairness and ff under normal train- ing, we have similar inequality, except that we now have "AAce < 0- which indicates better accuracy robustness for ITP, 1 under adversarial training. Similar upper bound also holds for TN samples:
Remark 5.7. For 1 and T7 we have similar inequality regarding the upper-bound of accuracy robustness:
SASE S IN.
min
Fair TN.1
Vña dd simi -.....
'oode available at https: /tbp::///ithuul com/ ojy24/ Bair-adversane sateariiaatttrninng
PIN,, EB01
t=1
7

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
1.0
2.0
10
19
0.9
18
05-
14
13
-8" buosii
trantg
accertace tteening
12
luakey deprossing
8
adversrial making (ettprecastng
0.
advertaraa traiiin sprocessing
Iaprocesinn
66
0.7
65
jmprocessing
03-
0.4
pespporecchy
prpprsossang
boschin
ot obharsan traseng
adveranaa traiiing (rprosesarg)
88
(peprocessig)
03
preprcessiig
60
poiprccearg
000 0.0 130
015
0.0 0.5 0.30 0.25 048 6.45
250
0.00 0.05 0.10
015
0.25
0.30
5.39
2.00
0.45
050
0.00 0.5 0.0 6.19 0.00 0.5
0:30
0:35
0.40 0:45 0.39
tesiion
bxsien
Epoiin
(a) FOd (Adult)
(h) DP (Adult)
(c) Accuracy (Adult)
Figure 2. Change of accuracy. DP and EOd under fairness attack on Adult dataset. Three variations of our fair adversarial training method obtain improved fairness robustness (lower EOd, DI and higher accuracy) with significant margin.
1.9
baseine
baseine
basdine
185
adverssral ifairess)
adverserial training (fwimess)
0.9
adverseride (teimese)
1.7
1.-
0.3
1.5
144
0.
1.3
12-
0.5
1.1
3 1.0
8 0.5
6.6
0.9
0.4
0.4
0.7
3.6
0.3
0.
3.-
0.2
0.3
0.1
0.0
0.10
0.05 0.19 0:30
(a) EOd (Adult)
(b) DP (Adult)
(c) Accuracy (Adult)
Figure 3. Change of accuracy. DP and EOd under accuracy attacks Adult dataset. Adversarial training (fairness) corresponds to vanilla adversarial training using fairness adversarial samples.
1.0
2.0
1.0
03
0.-
14
15
07.
07
15
12
Advessrall misiigg /atmeat
08-
06-
Aiversiaal mikig Snprtsesing
Advernre brennng grepoossing
05
0.8
Adversrral tnkling (wottrresting
0.4
04
6.7
64
63-
85
Areroodalttiiikg ponuany)
Maaerari tniniin (acuneyy
Acvenatal trunnig flamaza)
Adeesani training faimest
Acorooii traning (ngrooeedng)
Adverentaa trannig rerocesing) Maersaiaal training (searoeesdag) Advesunia buinng (sstppscsssng)
Arxcsarlliaoning (pegrooszigg)
50
68
Acsstartaa brarnny pestgroounng
6.00
506 130 015 0.20 0.5 0.0 025 046 646 130
0.00 006 0.0 015 0.28 0.5 0.30 0.5 240 045 030
0.08 0:5 0.89 6.15 5.20 025 3.30 0.40 0:55 0.39
fookon
(a) EOd
(b) DP
(c) Accuracy
Figure 4. Ablation study: change of accuracy, DP and EOd on CelebA dataset under fairness attacks. Adversarial training (accuracy) corresponds vanilla adversarial training using accuracy adversarial samples.
8

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
and classifiers under fair adversarial training show further remarkable improvement in terms of fairness robustness.
ticularly in contexts where both fairesss and robustness critical.
Robustness against accuracy attack. We move on to dis- cuss the improvement of accuracy robustness under adver- sarial training w.r.t. fairness. We compare baseline with adversarial training (fairness) (adversarial training w.r.t. re- laxed DP), and results on classifiers under accuracy attack on Adult dataset are shown Fig. Under a successful accuracy attack (the accuracy reaches its minimum), EOd also becomes zero, while DP does not necessarily vanish due to disparities in base rates. The classifier under adver- sarial training shows remarkable improvement in accuracy robustness, which validates that accuracy robustness also benefits from adversarial training w.r.t. fairness.
A potential consequence of our method is the generation of fairness adversarial samples, which, if not properly su- pervised, could be maliciously exploited to compromise trustworthiness. This potential misuse calls for proactive defenses and rigorous oversight to prevent adversarial ma- nipulations from undermining fairness-aware Al systems.
References
Angwin, J., Larson. J., Kirehner, L., and Mattu, S. Machine bias. ProPublica, available at: 2016.
Ablation study. We validate the superiority of method over vanilla adversarial training under fairness attacks, and the results are shown in Fig. 4. Heuristic adaptations of adversarial training utilizing fairness adversarial samples or accuracy adversarial samples alone, without incorporat- ing fairness regularization, fail to maintain fairness robust- ness under larger perturbations, highlighting the intricacy of achieving fairness robustness. In comparison, our frame- work shows remarkable improvement in fairness robustness.
Bai, T., Luo, J., Zhao, J., Wen, B., and Wang, Q. Recent advances in adversarial training for adversarial robustness. arXiv preprint arXiv:2102.01356 2021.
Chai, J. and Wang, X. Faireess with adaptive weights. In International Conference on Machine Learning, pp. 2853- 2866. PMLR, 2022.
Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., and Mukhopadhyay, D. Adversarial attacks and defences: A survey. arXiv preprint arXiv: arXiv: 1810.0009, 2018
7. Conclusion
Fairness attack and defense are an important, yet not prop- erly addressed problem. In this paper, we propose uni- fied framework for fairness attack against group fairness notions, where we show theoretically the connection of fair- ness attacks under different notions, and we demonstrate the connections between fairness attack and accuracy at- tack. We show theoretically the alignment between fair- ness robustness and accuracy robustness, and we propose a fair adversarial training structure, where the goal is to improve fairness robustness while maintaining fairness. Fur- ther, from experiments we validate that our method achieves better fairness robustness, and that faimess robustness and accuracy robustness align with each other.
Chhabra, A., Li, P., Mohapatra, P., and Liu, H. Robust fair clustering: A novel fairness attack and defense frame- work. arXiv preprint (..i::22100009555 2022.
Creager, E., Madras, D., Jacobsen, J..H., Weis, M., Swersky, K., Pitassi, T., and Zemel, R. Flexibly fair representation learning by disentanglement. In International conference on machine learning, pp. 1436-1445. PMLR, 2019.
Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., and Hein, M. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670) 2020.
Acknowledgements
Cruz, A. F. and Hardt, M. Unprocessing seven years of algorithmic fairness. arXiv preprint arXiv:2306.07261 2023.
This work was partially supported by the EMBRIO Institute, contract #2 #212000 National Science Foundation (NSF) Biology Integration Institute, and NSF IIS #1 #1955890, IIS #2146091, IIS #2345235.
Cui, J., Liu, S., Wang, L., and Jia, J. Learnable bound- ary guided adversarial training. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 15721-15730, 2021.
Impact Statement
his paper aims to bridge two perspectives on adversarial robustness: robustness concerning fairness notions and ro- bustness concerning accuracy. We believe this work will
Dong, M. and Xu, C. Adversarial robustness via random projection filters. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pp- 4077-4086, 2023.
benefit the trustworthy machine learning community, par-
9

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
Dressel, J. and Farid, H. The accuracy, fairness, and limits of predicting recidivism. Science advances, 4(1) :eaao55800 2018.
Kang, J., Xia, Y., Maciejewski, R., Luo, J., and Tong, H. Deceptive fairness attacks on graphs via meta learning. arXiv preprint arXiv:2310. 15653, 2023.
Dua, D. and Graff, C. UCI machine learning repository, 2017. http:/ archive. ics. uci. edu ml.
Kleinberg, J., Mullainathan, S., and Raghavan, M. Inherent trade-offs in the fair deternination of risk scores. arXiv preprint 1w0iv:160.005000 2016.
Fazlyab, M., Robey, A., Hassani, H., Morari, M., and Pap- pas, G. Efficient and accurate estimation of lipschitz constants for deep neural networks. Advances in Neural Information Processing Systems, 32, 2019.
Kusner, M. J., Loftus, J., Russell, C., and Silva, R. Counter- factual fairesss. Advances neural information process- ing systems, 30, 2017.
Feldman, M., Friedler, S. A., Moeller, J., Scheidegger, C.,, and Venkatasubrammniian S. Certifying and removing dis- parate impact. In proceedings of the 2/th ACM SIGKDD international conference on knowledge discovery and data mining, pp. 259-268, 2015.
Lahoti, P., Gummadi, K. P., and Weikum, G. Operationaliz- ing individual faimess with pairwise fair representations. arXiv preprint 1eXiv:990.011333 2019.
Larson, J., Mattu, S., Kirchner, L.,, and Angwin, J. Com- pas analysis. GitHub, available at: https://github 2016.
Goodfellow, I. J., Shlens, J., and Szegedy, C. Explain- ing and harnessing adversarial examples. arXiv preprint arXiv: 1412.65222. 2014.
compproublicccemmp--anddyy
Liu, Z., Luo, P., Wang, X., and Tang, X. Deep learning face attributes in the wild. In Proceedings of International Conference Computer Vision (ICCV), December 2015,
Hardt, M., Price, E., and Srebro, N. Equality of opportunity in supervised learning. Advances in neural information processing systems, 29, 2016.
Lu, S., Chai, J., and Wang, X. Neural collapse inspired debiased representation learning for min-max fairness. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 2024.
Jang, T. and Wang, X. Fades: Fair disentanglement with sensitive relevance. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition,
pp. 12067-12076, 2024.
Jang. T., Shi, P., and Wang, X. Group-aware threshold adaptation for fair classification. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36,
Ma, X., Wang, Z., and Liu, W. On the tradeoff between robustness and faimesss Advances in Neural Information Processing Systems, 15:26230-262444 2022.
pp. 6988 08986699,222 2022.
Ma, Y., Dong, M., and Xu, C. Adversarial robustness through random weight sampling. Advances in Neural Information Processing Systems, 36, 2024.
Jaa X., Zhang, Y., Wu, B., Wang. J., and Cao, Boost- ing fast adversarial training with learnable adversarial initialization. IEEE Transactions Image Processing, 31:4417-4430, 2022.
Madras, D., Creager, E.,, Pitassi, T., and Zemel, R. Learning adversarially fair and transferable representations. In International Conference on Machine Learning, pp. 3384- 3393. PMLR, 2018.
Janng H. and Nachum, O. Identifying and correcting label bias in machine learning. In International Conference Artificial Intelligence and Statistics, pp. 702-712. PMLR, 2020.
Madry, A., Makelov, A., Schmidt, I.., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. arXiv preprint 1eo::006600.833 2017.
John, P. G., Vijaykeerthy, D., and Saha, D. Verifying individ- ual fairess in machine learning models. In Conference on Uncertainty in Artificial Intelligence, pp. 749-758. PMLR, 2020.
Mchrabi, N., Morstatter, F., Saxena, N., Lerman, K., and Galstyan, A. A survey on bias and fairness in machine learning. ACM Computing Surveys (CSUR), 14(6))1-35, 2021a.
Jung, H., Chai, J., and Wang, X. Adversarial latent feature augmentation for fairness. In International conference on learning representations, 2025.
Jung, S., Lee, D., Park, T., and Moon, T. Fair feature distillation for visual recognition. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 221254 2021.
Mchrabi, N., Naveed, M., Morstatter, F., and Galstyan, A. Exacerbating algorithmic bias through faimess attacks. Proceedings of the AAAI Conference on Artificial In- telligence, volume 35, pp. 8930-89993 2021b.
10

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
Mitchell, S., Potash, E., Barocas, S., D' Amour, A., and Lum, K. Prediction-based decisions and fairness: A catalogue of choices, assumptions, and definitions. arXiv preprint arXiv:/811.07867, 2018.
Xie, C., Tan, M., Gong, B., Yuille, A., and Le, Q V. Smooth adversarial training. arXiv preprint arXiv:2006. 24066 2020.
Xu, H., Liu, X., Li, Y., Jain, A., and Tang. J. To be robust be fair: Towards faimess in adversarial training. In International conference on machine learning, pp. 11492- 11501. PMLR, 2021.
Mukherjee, D., Yurochkin, M., Banerjee, M., and Sun, Y. Two simple ways to learn individual fairness metrics from data. In International Conference Machine Learning, pp. 7097-7107. PMLR, 2020.
Yu, Z.., Chakraborty, J., and Menzies, T. Fairbalance: How achieve equalized odds with data pre-processing. IEEE Transactions on Software Engineering, 2024.
Nanda, V., Dooley, S., Singla, S., Feizi, S., and Dickerson, P. Fairness through robustness: Investigating robust- disparity in deep learning. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, pp. 466-477, 2021.
Zafar, M. B., Valera, I., Rogriguez, M. G., and Gummadi, P. Fairness constraints: Mechanisms for fair classifica- tion. In Artificial intelligence and statistics, pp. 962-970. PMLR, 2017.
Roh, Y., Lee, K., Whang, S., and Suh, C. Sample selec- tion for fair and robust training. Advances in Neural Information Processing Systems, 14:815-827, 2021.
Zeng, H., Yue, Z., Shang. L.., Zhang, Y., and Wang, D. On adversarial robustness of demographic fairness face attribute recognition. Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence, pp. 527-535, 2023.
Shafahi, A., Najibi, M., Ghiasi, M. A., Xu, Z., Dickerson, J. Studer, C., Davis, L. S., Taylor, G., and Goldstein, T. Adversarial training for free! Advances in Neural Information Processing Systems, 32, 2019.
Zhang. H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., and
Shi, Z., Wang, Y., Zhang, H., Kolter, Z., and Hsieh, C.-J. Efficiently computing local lipschitz constants of neural networks via bound propagation. Advances in Neural Information Processing Systems, 35:2350-2364, 2022.
Jordan, M. Theoretically principled trade-off between robustness and aceuracy. In International conference on machine learning, pp. 1472-7482. PMLR, 2019.
Solans, D., Biggio, B., and Castillo, C. Poisoning at- tacks on algorithmic fairesss. In Joint European Confer- on Machine Learning and Knowledge Discovery in Databases, pp. 162-177, 177. Springer, 2020.
Sriramanan, G., Addepalli, S., Baburaj, A., et al. Towards efficient and effective adversarial training. Advances in Neural Information Processing Systems, 34:11821- 1 11833, 2021.
Tifrea, A., Lahoti, P., Packer, B., Halpern, Y., Beirami, A., and Prost, F. Frappé: post-processing framework for group fairness regularization. arXiv e-prints, pp. arXiv- 2312, 2023.
Wang, J., Wang, X. E., and Liu, Y. Understanding instance- level impact of fairness constraints. In International Con- ference on Machine Learning, pp. 23114-23130, PMLR, 2022.
Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., and Gu, Q. Im- proving adversarial robustness requires revisiting misclas- sified examples. International conference on learning representations, 2019.
Wong, E., Rice, L., and Kolter, J. Z. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.0m 003994 2020.

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
A. Experimental supplementary
validate our method on four datasets:
Adult (Dua & Graff, 2017): The Adult dataset contains 65, 123 samples with 14 attributes. The goal is to predict whether individual's annual income exceeds 50K, and the sensitive attribute is chosen as race.
COMPAS (Larson et al., 2016): The ProPublica COMPAS dataset contains 7,215 samples with 10 attributes. The goal is to predict whether defendant re-offend within two years. Following the protocol in earlier fairesss methods (Zafar et al., 2017), we only select white and black individuals COMPAS dataset, which contains 6, 6,050 samples in total. The sensitive attribute in this dataset race.
German (Dua & Graff, 2017): The German credit risk dateset contains 1,000 samples with attributes. The goal is to predict whether client is highly risky, and the sensitive attribute in this dataset is sex.
CelebA (Liu et al., 2015); CelebA dataset contains 202,599 samples with 40 binary attributes. We choose gender as target label, and the sensitive attribute this dataset is age.
Details of our fair adversarial training framework are shown as follows:
Adversarial training (preprocessing (Yu et al., 2024)): Neural network under adversarial training w.r.t accuracy with training samples reweighed by Yu al. (2024);
Adversarial training (in-processing (Wang et al., 2022)): Neural network under adversarial training w.r.t. accuracy with relaxed EOd constraint by Wang et al. (2022);
Adversarial training (post-processing (Jang et al., 2022)): Neural network under adversarial training w.r.t. accuracy with predicted soft labels postprocessed by Jang et al. (2022).
B. Pseudo-code
We include pseudo-codes of the three variations of our fair adversarial training framework as follows:
Algorithm Adversarial training (preprocessing)
Input: Network fe with parameter 0, training data D = {(t, 9:), & < N) reweighed inversely proportional to each group-label pair's s empirical frequency by (Yu et al., 2024), batch size M, training epochs E, learning rate 7), allowed perturbation set (c, ||e|| < <o), attack step size a, attack steps k.
1: for epoch 1 to F. do:
2: for batch B = { 0;), < j M] C D do:
3: for attack step = to do:
4:
2 Nay+s (#f + asiggn (c),,))()),))))
5:
end for Training loss:
6:
1 M
LCE
Σ M j=1
by log log(f((#5)) (1 ú5 log(1 - fo(
7: Update 0 by gradient descent:
LCE
0
00
8:
end for end for
9:
12

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
Algorithm 2 Adversarial training (in-processing)
Input: Network fe with parameter 0, training data D = {( Yi, az), 1 < & NJ. batch size M, training epochs E, learning rate 7/, allowed perturbation set = {e, ||e]| < 6o), attack step size a, attack steps k, regularization coefficient X, gorup size [S.]. [-
1: for epoch to E do:
2: for batch B - [1,,, U5); < i MJ C do:
3: for attack step = 0to do:
4:
+ (a) + assign (Va, Lcx(s),
5: end for
6:
Training loss:
1 M
LCE =
Σ j=1
Uy log log(fo(z)))) - (1 - リ₁ log(1 (1- - fo(x))),
M
f(a
LD
[11
|
8568
EyC8.
Lioall
= LCE + ALDP.
7: Update by gradient descent:
Lioil
0 = 0
00
8: end for
9: end for
Algorithm Adversarial training prost-processing
Input: Network fo with parameter 0, training data D { Vi, az), 1 < i < N), batch size M, training epochs E, learning rate allowed perturbation set S = {e, ||||| < { attack step size a, attack steps k.
1: for epoch to E do:
2:
for batch B {(r,, yj), & 1 M) c D do:
3: for attack step = 01o do:
4:
aftt Tayts (ot + asiin (Va, (cr(().,)))))
5:
end for
6:
Training loss:
1 M
LCE
yソ log log(f((z))) 3/) log(1 fo())))
M j=1
7: Update by gradient descent:
LCE
-
00
end for
9: end for
10: post-process (z) training data D by estimating the group-dependent thresholds (Jang et al., 2022).
C. Connection between DP attack and EOd attack
We empirically validate our discussion regarding the relationship between DP and EOd attack as Corollary 4.1. As shown in Fig 2, under a successful DP attack, FOd always reaches its maximum, and successful DP attack also leads to
13

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
successful EOd attack.
D. Proof of Corollary 4.1
Proof. The objective for EOd attack can be written as the following form:
f(x))
f(z.)
f(z))
fa,)
Lead
Sool
So1
S10
S11
ESpo
24 E5n
f(x))
((x)
(x)
(ar
Σ
Suu
Son
S10
Sn1
i Epo
E
a E
((x
S.ol
[(x)
|
[(x:)
S.1
[(x) S
3o0
3,ol
100
S.0
301
S11
ESo
2
#E801
rE811
This shows that the EOd attack is lower-bounder by the weighted DP attack as in (1), Specifically, under successful DP
attack, we have f(x) 2 0.5, VI E S.a and f(x) < 0.5, Vr E S,a', and we have EOd under under such attack
Exeroo [[f(x) 2 0.5)
En [[f(x) 2 0.5]
Exes.. 1[f(x) 0.5]
Exes..
1ff(x)
0.5]
EOd
= 2,
110
Sn1
Spol
So1
which shows that successful DP attack always implies successful EOd attack.
Remark D.1. A successful EOd attack does not always imply a successful DP attack. Consider the following counter- [(xs) f(z)) and Ex, [Soo Ex,e%, [5n] under successful EOd attack,
example: assume Ex, E8oo [Soo Ear Bal
f(xs))
f(ur)
E810
all the predictions in the disadvantaged group will become correct, while all the predictions the advantaged group will
become incorrect, and the disparate impact will be maximized both groups contain positive predictions.
E. Proof of Corollary 4.2
Proof. The objective for accuracy attack for sample x; can written as
max Len((a; + +), 3.) [[el ||l||
en,
(8)
Consider the DP attack in (1), we have the objective for DP attack as follows:
f(x; + + S
||l|| S e',
max O6
where -1 for a; = 0 and a; = for = 1. For positive samples, we can further write (8) as
max (x, ||e E0.
where the perturbation is expected to minimize the predicted soft label, which in alignment with the objective of DP when a; 11, i.e., for TP and EN disadvantaged samples, the two attacks in alignment. Similarly, for negative samples, have (8) as
max log(1 - f(x + +)),
< se
where the perturbation is expected to maximize the predicted soft label, which is in alignment with the objective of DP when a; = 1, i.c., for TN and FP advantaged samples, the two attacks are in alignment. Specifically, for gradicnt- based attacks, we have the two kinds of attack equivalent.
14

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
F. Proof of Theorem 5.3
Proof. Let f be the function of classifier, consider the positive testing set {( 1, 1 iteration, we have the linear approximation of testing CE loss under the fairness attack follows:
S i N) for simplicity, at t-th
8t
LCE(æ²)= = =- -=o((f((')) = log(f(x(-1) -8" = - (z) +
f(øt-1) + -T (x(xx
(9)
where 8t-1,Fair is the change of soft label induced by the fairness attack at /-th iteration, and rr. (x.) the remainder of Taylor's expansion. For gradient-based attack. the predicted soft label for fairness adversarial sample can be formulated as
f(x') = f(x'=(=='- + asign V L = f(x=-1) + a a( ") sign( v + tr((x²²))
(10)
where Lpp is the relaxed DP and ry (2) is the remainder of Taylor's expansion. Let Dr. = [L(x') - L(x be the change of CE loss under the fairness attack at I-th iteration, according (9) and (10) we have
[cR(=*) - LCR(x(-)) log( log(f(x(-11)) + 8 F,air
F
f(xt-1) + (r)( + log(f(x))
1 ((x(-1))) sign(V (gon(Ver-1lnn LDP)
f(x-11
Consider FN sample 2FN,0 from disadvantaged group and FN sample JFN,1 from advantaged group, since the gradient is Lipschitz with constant K, have the difference of change in CE loss under DP attack at f-th iteration follows:
Fair Fair PN,1
Fair PN.O
--11 torr (x Fair sign( V 1-1.br LPp)
1. 1-1,Fair ") sign( FNN.0
(3
1.1. LP)]
#Pv.1
f fI F-airyy
fl f L-1,Fair
V 1,Bux fI Fair ))TT
1pN,1
"T''sisinnn sign( AIN.
L LDP)
(V
1. fo myy
PN,0
1. )) sign( V
=ix.0
1. LDe)
=0
I [ 1.
/ [1 1.Fair
1-1 Par ( 1-1. ) P'signn N.
1.1 Far (1 1-1,
l [ (-1, )) "iign( No
No V --- sar (xTx,0 Fair))
=0
f 1
>) j=1 12 (=
1.Fir
Ej=
O. f (2 Fair
f ( FFiir
f( 1-1,
IV -- 1.1rr (1 1-1, II
IV x-1,0m f [ ( (1-t-1,ri 1.Fair
FN.0
f 1 1,irr
f f 1.irr
(11)
where is the dimension of input feature. Since (x) is Lipschitz, we have
S [[va[(=)) V.l(co))la Kd(x11
-
where the first sign is due to triangle inequality. By Jensen's inequality we have |||||| < ||0|| S Vnll=r/2. and
[=f(m))]| (=,((2))) - v=f(x:))ll SnKd(m,,
(12)
15

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
[1 J. 1.Rár PN.
((2t)1 Ill
1.Rúr 1.Fir (M ( l)l
Assume
FV.
"F..0
plugging (12) back into (11), we have
f(
I f(a ha)
Fair PN,1
PN.O
-- 1.brr FN
1
PN
1-1 1.irir
1l2
BPN.1
PN.
[ Fair
1-irry Fair)
VnKd(viv.1 Fair Fair
1. far (2/N,0 1.
)ll
(I 1- |11
TN.
Par
(13)
<a
px.o
J(FFN.1
F.ir
t-ir f [I
VnaK d( 1-i. 2
1-1 f ( Ill
a vove I FNEN
1...aar
)l1
FN.11
+
[1 F.uir)
[ F.ii)
[ ((11-1 Fuirr)
where d(x,y) = 1| 2/12 is the distance between the two feature. Taking the summation over T iterations, we have
VnaKd(aiN.) t- 1.Fair
1-1 Fair
T
M Fair
S (N 1,,1,-1FFrrr Fair
D D S
FFN. f(1 F-a.Fiy
Σ a
8pN.0
gt-1,Acc
(14)
[(
1-1.Faa )f f
(-1,
1=1
Fair I|| is the change of ayN,o's predicted label under e-level accuracy attack 1-th iteration since both are equivalent regarding FrN,o. Since the above inequality holds true for all disadvantaged TP samples and D DE FN,1 1. we can further write (14) as
where 5/-1,Ace = | 1- So (No
Fair <
DAN, E81o
min
+
T
1-1.Fair 1air
INN.O
Σ a
T
f ((
f(
1-1, 1,
Fair
OFN.
f(
1-1.Fuir
f(
1.Fai
If Farr
This shows that under the fairness attack, the difference of change in performance regarding marginal advantaged FN samples are upper-bounded by the robustness of marginal disadvantaged FN samples up additive constant. For under normal training and f' under normal training, we have similar upper-bound except that we now have 6 gtt-1,Acc 2
FNN 1,Ac which indicates that the adversarial classifier achieves tighter upper- bound than that of normal classifier. For
IV 1 ( Ila
1.P (1 I)
"R8.1
PN.0
5(1 Tir) we have same upper-bounde
[( 1.11r 1.60r)
D Fair PN,1
- D
1V
1.10 1.1r ( 1.
IV 1-1.
fa.nnf((e f 4-1.Faat 1.Fair ll1
PN.1
"N.0
fl f( I-I.Fai
f f(ziN,0 1-ii
| 1 1.rir (#FN.O
1-1.Fair
ll
c 1.F (x
1-1,Fair 1,
Il1
Vnk (iKd(appp
1-1,Fair 1-1i =F,NO
<0
#yv.0
$N.0
f (-1.Fai
f(IEN,0 L-ibar
/naK 2- 1, 1.Fair t 1.
a 1-1. of
f 1-1. >
1.Fax far f 1-1 )11
+
[ |x F-ir
f(x Fairr
f( 2(12-11 1.Fiir)
16

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
G. Proof of Theorem 5.5
Proof. Let Eya be the error rate in the subgroup Sya. let bo be the base rate in group a, denote as mea mea after the fairness attack, we have the following expression regarding DI after the fairness attack:
Fair the fairness measure
DpFair
Po
df-
p1
Fair df
0.5
J.5
--("" (bi
(bo
e10
Fair
PIP.O
Fair
+ (1 - bo)e PFP,0)
(1-bo)e
Fair Fair
Fair,,,irr, df
Fair )p + (1 - b1 b1 PEP.1 df
Fair Fair
0.5
0.5
f
bo(1 - =10))TRood +
(1 - bp bo00PoPF
4.5
A.5
PP.0
(15)
[-]
b1 (11)PIP,1df
0.5
0..5
0.5
0.5
(1- -e0)(-=o)))Tx.11
bIeLIPEN,1d
00.5
0.5 A iN.1
=102(1 (11 Prr, (1 be) Prp., (0.5) - b1)(1 c01 PIN, (0.5 - A Fxir
+bge11 1 AN.11 bu e20 PI. (0.5 + A Pair
- -(1 -1-bbleww FPP (0.5 + AP.
where Air ahha := asbbaa) 8f is the maximum prediction shift within the subgroup, Puuh. a is the CDF of Paub. and the inequality is due to that the worst-case prediction shift upper-boune bounds the overall shift in the distribution predicted soft label. Since Puub Lipschitz continuous with constant M subbo (Psub is uniformly bounded by M Mabb,a), we can further simplify (15)
DpFair
111(1 PTp, (1- bi Jmm Pip, (0.5) (1 (1)(1 en1) PTN, ANN.)
FN.1)
bo(1 PIr.0 (Pto)) - (1 bol Per (0.5 A
DP + bo(1 e10) MTP
IP.0 (1 b00
Fair
A Fair
(1 b1)(1 Fair + bIelI A PN.1
FP.0
DP ( + min (DAce H3) + Ase min (DAce + Gj)).
2
JE
where M max MF MIN.1, MyN.1 and the two minimization terms in the last inequality correspond to the upper-bounds in Theorem 5.3 and Remark 5.4. Since the fairness robustness and accuracy robustness are equivalent regarding 2TP,0 and TN.1, and D,. H, and Gj are determined by the intrinsic distance between samples and the accuracy robustness FP., and #pN.0, we can conclude that DpFiir upper-boundeds by static fairness, i.e., the DP term, and the accuracy robustness 8Aps, minjesa, (DAce + H,), AAR,, and minyesSx,o (D + Gý), which validates our fair adversarial training framework.
17

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
Similarly, we have the following upper-bound regarding EOd
Poo
Fair
df
Fair df
+
P10
Fair
df
Pi1
Fair df
0.5
0.5
0.5
0.5
[" ((1 c (oN)PNN, col PFP, df
((1
CD PTN.0 + 60 PFP.0) df
Fair
0.5
+
Fair Fair ((1 10 /PPPO + eo0 PFN.o) df
Fair
Fair
((1 - e11 /PTP, + en PFN.1) df
Fair Fair
Fair Fair
0.5
0.3
[' (1 -e00)PIN.OO + f
S(d Co1PFr, 0.5
CooPFR,Odff
- (1-EoipPNN1d
0.5
A03- 10.0
-.5- T8.
+
(1- + @I0PFN.off
(1-e11 (1-E11)PTP,dd 0.5-
e1IPFN,1df
0.5-A
0.5
0.5
Fair < EOd + MF
FP.O
Fair (1 601 MoN,)1MMM,111
TN,1
+ (1 (11--0))
Pair TP,0
e1 M
Fair
EOd + M((AMp)
Ace min (D) + H2) A IN,1 jE jE3m,
min
(D)x++G)) GG))),
where the first term in the last inequality corresponds to static fairness, i.c. EOd without faimess perturbation, and the second term corresponds to accuracy robustness.
H. Proof of Theorem 5.6
Proof. Let f be the function classifier, consider æTP.o, we have the predicted soft label for sample TTP.0 under accuracy attack at f-th iteration follows:
f( f(1i)0)) =f (= A-cc + asign( V 1- LCE))
~ f =f (-1AA + a: 1-1, f (2 1-1, sign( I [aTTp,
"
(x-t1.Ac 1.Ace)
--1 1.0
= =f (-C,
+ 0: (V VV
( 1- (2 sign(V 2. ICE)
210,0 1Aw (xtr)) (=
= =f (100 - a: V
"ip,0
=f 1-c,
1.Fir
OTP.0
=1p.0 1, ( I|1 is the change of 2TP,0's predicted label under e-level fairness attack t-th iteration since both are equivalent regarding TTP,0- This shows that disadvantaged TP samples that attains d-level robustness under e-level fairness attack also attains similar robustness w.r.t. accuracy attack.
fwhere 6PP00 a
For 1 let st_Ace : (f
f(att) we have its change in predicted soft label under accuracy attack f-th
iteration follows:
8(17AA1)
= (1( - -00--f(rrr f(111) 1-1,Acc
(1 1-1,Ac assign(V 1-11. LCE)) (aaoi)))(((FFre (10011
(16)
signn V.L Lcv) za ( - 1.w0 fl
V -- (2
2opp + vnakd -1, ~Tp
1-1,A00)
Taking the summation over all iterations, we have
18

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
A
TPPO
+ Σ
TTPp, (..0
(17)
where FFar is the change of predicted soft label of sample TTP,0 under e-level fairness attack. Since the inequality hold true for all 27,,0, we can further write (17)
T
TP,1
S
min 1110
TP.0
VnaKd(arppp
1.Ac L..1..cc.. 1r,
And the lower bound f 2 0 naturally holds true for samples under accuracy attack. This shows that for samples in the advantaged group, the change of predicted soft label under accuracy attack is lower-bounded by the faimesss robustness its neighbor sample(s) in the disadvantaged group up to an additive constant. For f" under adversarial training w.r.t. fairness and f under normal training, we have similar upper-bound except that now have TP,0 SyPair which indicates that the adversarial classifier achieves tighter upper-bound than that of a normal classifier.
I. Empirical verification of theoretical results
Method
Daiir
FN
D female
0.1
Baseline
0.16+0.03
0.18+0.02
0.1
Adversarial training (preprocessing)
0.07=0.02
0.09#0.02
0.1
Adversarial training (in (in-processing
0.07=0.02
0.11=0.02
0.1
Adversarial training (post-processing)
0.08#0.01
0.09#0.02
0.3
Baseline
0.26#0.03 0.23#0.02
0.3
Adversarial training (preprocessing)
0.09#0.02
0.1120.02
0.3 Adversarial training (in-processing)
0.10+0.02
0.12+0.02
0.3
Adversarial training (post-processing)
10+0.00
0.09
Table Change of cross-entropy loss for FN samples on CelebA dataset under faimess attacks with 0.1 and 0.3. Experiments are repeated three times.
We empirically validate the effectiveness of the upper-bounds stated Theorem 5.3. Results on the change of cross-entropy loss for samples from different groups by baseline and by fair adversarial training under different perturbation levels shown in Tab, 4. Under fair adversarial training, both advantaged and disadvantaged groups show improvements in Dair compared with the baseline, which validates our theoretical results, that is, the alignment between fairness robustness and accuracy robustness.
Results DP and EOd, as well as their theoretical bounds by Theorem 5.5 under varying levels of fairness attacks on CelebA dataset are shown in Fig. 5. While the theoretical bounds differ from the ground-truth values, they effectively capture the difference in the faimess robustness between the baseline and our method, validating the effectiveness of analysis.
J. Results of robustness against DP attack
We include the results of fair adversarial training in Fig. 6 to better distinguish between different fairness methods. Results of classifiers under DP attack on COMPAS, German and CelebA datasets are shown in Fig. 7.
K. Extension to alternative adversarial training methods
We consider the following alternatives to PGD-based adversarial training, including Trades (Zhang et al., 2019) and Mart (Wang et al., 2019) for our fair adversarial training framework, and the results on robustness against fairness attack on CelebA dataset are shown in Fig. 8. Compared with vanilla adversarial training methods, our framework demonstrates remarkable improvement in fairness robustness, which validates that our proposed framework generalizes well to various adversarial training techniques.
19

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
1.0
2.0
0.9
16
1.5
1.4
0.6
1.1
8
0.5
1.0
0.9
0.4
0.6
0.5
0.4
baseline
0.3
baseline
ours
ours
0.1
(baseline)
theoretical (baseline)
theoretical bound (ours)
0.0
thearetical bound (ours)
0.0
0.00
0.05
0.10
0.15 0.20 0.25 0.30
0.35 0.40 0.45 0.50
0.00
0.05
0.10
0.15
0.20 0.25 0.30 0.35 0.40 0.45 0.50
Epsilon
Epsilon
(a) DP
(b) EOd
Figure Visualizations of theoretical bounds on the CelebA dataset under fairness attacks, where "ours" refers to adversarial training (preprocessing).
L. Results of robustness against accuracy attack
We show the results on robustness against accuracy attack on COMPAS, German and CelebA datasets in Fig. 9-11.
20

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
beannning
1.-
sorprouring
07-
$45
61
uu oto 022 Oar 5.0 2.D. 5.0 L.S. Ert. X/ aud
6-
120 08D 0.22
1.0
0.0 L. 1/1 a aud
use obo u.20 Bit L.A.
1/1 An
(a) Black TPR (Adult)
(b) White TPR (Adult)
(c) Black TNR (Adult)
(d) White TNR (Adult)
Oprtion va
365
boxire
Engrooserrg Sonturacsiing
63
poitoweatingg
058 066 020 015
A4 ase
030
0.9 065 030 025 C.0
436
Eic x4s a58
566 822 6is
(e) Black TPR (COMPAS)
White TPR (COMPAS)
Black TNR (COMPAS)
(h) White TNR (COMPAS)
47-
05
cort compraenting
2:45
6.1
Sigroosrgg butte sucting
62
069 065
030
615
CX
6.0 6.6 EAC X45 ase
0d0 065 030 025
620 4.5
0.00
4.5 E4C 245 as
089 045 030 615
<X 625 6.00 6.6 E4C 345 a58
009 065 030
025
020 025
6.00 4.5 E4C 245 459
(i) Male TPR (German)
(i) Female TPR (German)
(k) Male TNR (German)
(1) Female TNR (German)
1.
33-
36-
yainne varn perpermee Sprniaing
1,55
polp soising
41
c/o cho
ais
(m) Young TPR (CelebA)
(n) Young TNR (CelebA)
(o) Elder TPR (CelebA)
(p) Elder TNR (CelebA)
Figure 6. Change of true positive rate (TPR) and true negative rate (TNR) under fairness attacks on the four datasets.
21

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
1.0
2.
1.-
19
0.1
atreserld tran rg
18
0.-
17
0.5
adroserd buin lsziprocssiig)
rprocesting
14
12
11
1.0
+ bucckn
+ busoii
65
0.6
edarrera traretg
advertrnal maainng (eprEsmeeng
0.-
accerant tharing
sceeradc traning (nproceeding
03
64
toakeg (ssrrocsségg)
(potprecessing)
02-
(esprseseg)
02
preprocesiing
01
prepresesaro peegrocessigg
kproressing
01-
0.-
0.0 0.00 130 013 0.00 025 0.50 0.25 040
6.4 250
0.00
0.00 0.10
025
0.25 0.30 Boster
c.5 2.0 0.45 050
0.50 0.03 0.18
0.19
0.45 0.39 Epokin
025
030
035
0.40
tpsioon
(a) EOd (COMPAS)
(b) DI (COMPAS)
(c) Accuracy (COMPAS)
2.0
1.0
0.
16-
1.
0.5
0.5
15
14
0.7
077
13
0.6
06-
3 100
8
03
69-
08
0.4
04-
82-
08
trainin
03-
03
abvesand tranerg (nnismunainng
adversrall tiiiiing (oepoceeddg)
02-
acwrrooii traiiing (peppoeetiii)
pvecnuiiliburig (pour souunn! reprceestin
adversa nal trivin (ostpmessiing)
(pwenceesnn))
02
Ieprooeedig
61
peprocessing
preproonsing
prprecesiigg
60
peciproosiing
pestrosessing
polppeossing 9
6.00
5.0 3.00 0.5 0.20 0.5 0:0 0:35 0.48 6.5 3.50
0.00 005 0.10 015
0.28
0.25 6:30 6.35 340
0.5 050
0:5 6.0 6.15 925 3.30
0.40 6:45 0.53
Spelkon
(d) EOd (German)
(c) DI (German)
(f) Accuracy (German)
1.0
advosaril train ro
18
0.5
adversrte iepreceingg
17
lamproondiig
16
0.5
15
saring
0.7
costprecssing
peppocees
eaara faring (nprocending
0.6
8 L0
1.1
naainng (orooceesivo)
maring (porssncessing
0.5
59
88
0.8-
07
0.-
aneeforrittaan (nprocesdigg)
0.3-
03
02-
acoerarial lnaiiing (poprocening
accerocia traeiing (poegrowweegg
0.-
02
61
03
kepoocosing
01-
60
ais
0.0
als
08
030
Epelon
Caslinn
Quilan
(g) EOd (CelebA)
(h) (CelebA)
(i) Accuracy (CelebA)
Figure 7. Change in accuracy, DI and FOd under faimess attacks German dataset. Our adversarial training methods (preprocessing. in-processing, procppcccsssng) obtain improved fairness (lower EOd and DI) and higher accuracy with significant margin.
22

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
1.0
20
1.-
19
04
00
15
14
077
13
12
0.6
0.-
8 3.0
Adversrial trasirg inpresmarg
Adversrall mivis (pmporecó)))
0.5
0.-
0.7
Adverural besking (olprccarr)
0.-
69
65
03-
84
03
Asserooial
Adarraria training Itlinesst
Acverarial ingroossing)
Adeessraal trainig (epecessing)
Acvenoatii traning perprcessinn
Adersariaa training ipwersoomesns
Atverovia trannig (poctrooessss)
Maeerroi trainng snstpoocessly
600 cos 310 0.15 0: a.s 6:10 6.3 046 645 350
0.00 a.s. 0.1 ais 0.35 6.5 6:30 Eas 340 0.5 ase sasion sttcc)
0.20 ods 6.s 6.15 0.00 02s 3:50 a.55 0.40 045 0.50 Goalion Phimess attack)
Epeloon (fimes smaad
(a) EOd
(b) DI
(c) Accuracy
Figure& 8, Experimental results on CclebA dataset under fairness attacks.
2.0
1.0
1.0
1.9
bascine
biseing
basaline
284
adverseral training (farress)
0.9
adversatial traiting (heimeos)
edverserdl trwnnngg (feimess)
2.7
26
0.8
8
0.5
0.4
0.
0.1
0.0
0.00
0.05 0.10
0.20
0.20
0.25 0.30
0.35
0.40
0.45 0.50
0.00 3.05 0.30 3.15 0.20 0.25 0.35 0.40 0.45 0.00
0.00 010..15 0.20 0.25 0.35 0.40 0.45 050
Essilon
Epsitoo
Epsilon
(a) EOd
(b) DI
(c) Accuracy
Figure Results a classifier adversarially trained w.r.t DP. Change of accuracy, and EOd under accuracy attacks on COMPAS dataset.
baseline training
baseine
basdine
training
training
0.8
154
244
07-
12
2
actursc
0.9
0.5
0.7
0.
3.
0.4
02-
02
03
0.3
0.1
01
0.0
0.0
0.00
005 0100 0.20 0.30
0.35
0.60 0.45 0.50
0.05 0.10 3.15
0.20 0.25 0.30 0.35 0.45 0.30
0.5s 0 c.15
0:20
0.30 Epsioo
0.49 030
Epsioon
Epsioon
(a) EOd
(b) DI
(c) Accuracy
Figure 10. Results of classifier adversarially trained w.r.t DP. Change of accuracy, DP and EOd under accuracy attacks German dataset.
23

---

On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness
bwoeine
beselne
baseine triningg (bimmsss)
adversanal usining
adversorial traniigg (faimss)
09
08
15
144
133
L.2
L.1
2 1.0
8
0.8
0.9
0.4
0.4
0.
0.7
03
0.3
05
0.
02
0.5
0.
0.1
0.1
0110 0.25
0.0
0.05
(a) BOd (CelebA)
(b) DI (CelebA)
(c) Accuracy (CelebA)
Figure 11. Results of classifier adversarially trained w.r.t. DI. Change of accuracy, DP and EOd under accuracy attacks on CelebA dataset.
24


Reviews:
[{"review_id": "7HkE7SGaRp", "reviewer": "Reviewer_yumK", "summary": "The paper analyzes adversarial attacks and robustness with respect to both fairness and accuracy. The authors prove theoretically the equivalence of adversarial attacks against different fairness notions, like DP and EOD. The theoretical analysis also shows the connections between attacks targeting accuracy and those targeting fairness. In this sense, improvements in robust accuracy have a positive impact on robust fairness and vice versa. The authors also propose a fair adversarial training strategy which integrates adversarial training with fairness constraints to enhance both fairness and accuracy robustness. The experimental evaluation using four common benchmarks in the fairness research literature corroborates the theoretical results and the benefits of the proposed adversarial training strategy.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the detailed comments.\n\n[W1: Clarification of Threat Model] \n\nIn our threat model, we assume that the adversarial has full access to the parameters of the target model. The adversarial manipulation is performed at the input level, subject to a maximum perturbation level $\\epsilon$. The fairness attacks aim to maximize group-wise disparities on the testing data, quantified by metrics including Demographic Parity (DP) and Equalized Odds (EOd), while the accuracy attacks are designed to maximize the classification error on the testing data. We 'll include the description in the revised paper.\n\n[W2: Computational Trade-Off]\n\nWe include the training time of our proposed framework relative to vanilla adversarial training in the following table, where the fairness intervention is chosen as in-processing [1]:\n\n|Dataset   | Adult | German | COMPAS | CelebA |\n| --------- | -------- | -------- | -------- | -------- |\n| Time| 1.32    |1.27    |1.22    |1.24    |\n\nOur method leads to relatively small increase in the training time compared with vanilla adversarial training, and therefore leads to a reasonable computational trade-off.\n\n[W3: Practical Applicability]\n\nAs shown in Eq. 6, our method does not require additional assumptions about the model architecture, fairness interventions, or adversarial training techniques. Consequently, it can be seamlessly integrated into the training process of fair models by simply replacing clean samples with adversarial ones.\n\n[1] Wang, Jialu, Xin Eric Wang, and Yang Liu. \"Understanding instance-level impact of fairness constraints.\" International Conference on Machine Learning. PMLR, 2022.", "claims_and_evidence": "Yes, the claims made in the submission are supported by convincing evidence, both theoretical and empirical. The assumptions for the theoretical analysis are reasonable and common in the scope of the work. \n\nPerhaps, it would be appropriate to include a discussion on the computational complexity of the proposed adversarial training approach compared to traditional approaches focusing just on robust accuracy.", "methods_and_evaluation_criteria": "The scope of the work is well presented and reasonable. The proposed method seems sound, and the evaluation criteria is enough to support the theoretical claims made in the paper.", "theoretical_claims": "I quickly schemed through the different proofs included in the appendix. From this, the theoretical claims seem reasonable to me, although I did not have the chance to check everything thoroughly.", "experimental_designs_or_analyses": "The experimental analysis is reasonable and serves to support the theoretical claims in the paper. The datasets and the models selected for the experiments are adequate and commonly used in the research literature in fairness.", "relation_to_broader_scientific_literature": "Fairness has been an aspect somewhat overlooked in the research literature in adversarial machine learning. Perhaps, this aspect has been more considered in the context of poisoning attacks, e.g., (Solans et al., 2020; Mehrabi et al., 2021b) among others. However, in the context of adversarial examples training has focused on some implications and difficulties of applying adversarial training when considering fairness. In this sense, as mentioned by the authors, some works like (Nanda et al., 2021; Xu et al., 2021; Ma et al., 2022) state that adversarial training without proper regularization leads to class-wise disparities in accuracy and robustness. To my best knowledge, this is the first work proposing a more general framework of attacks and defenses considering group fairness.", "essential_references_not_discussed": "None that I am aware.", "other_strengths_and_weaknesses": "Strengths: \n+ The paper provides a nice contribution to the fairness literature, especially in adversarial contexts. \n+ The authors strived to provide a solid theoretical foundation supported by a reasonable empirical validation. \n\nWeaknesses:\n+ The paper would benefit from a clearer threat model, before the theoretical analysis is presented. \n+ The paper does not address properly the computational trade-offs and discuss how this framework could be used in practical scenarios.", "other_comments_or_suggestions": "See the comments above.", "questions_for_authors": "+ Could the authors provide some insights on the computational trade-offs and the practicality of the proposed approach in real scenarios?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "NThmYZPXeQ", "reviewer": "Reviewer_Mgij", "summary": "The authors introduce a cohesive framework for adversarial training that can be adapted to multiple definitions of group fairness.  The general idea is to formulate a certain objective function that captures the loss and then to perturb the input in a direction given by the gradient so as to increase the loss. Then, the paper experimentally shows how adversarially trained models achieve robustness to both accuracy attacks and fairness attacks.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the detailed comments. We will carefully refine the writing and include tables of notations in the revised paper to enhance readability. We include a short list of notations in the following table: \n\n|Notation  | Meaning|\n| --------- | ------------|\n|$x_{\\text{sub},a}^{t, \\text{obj}}$|Adversarial sample(s) generated from the clean subgroup {sub, a} at t-th iteration, targeting obj (Acc, DP, EOd)\n|$\\mathbb{S}_{\\text{sub},a}^{t, \\text{obj}}$|The set of adversarial samples at t-th iteration from the subgroup {sub, a}|\n|$x_{\\text{sub},a}^{\\text{obj}}$|Adversarial sample(s) obtained after the adversarial attack targeting obj|\n|$p_{\\text{sub},a}^{\\text{obj}}$|The distribution of predicted soft labels in the clean subgroup {sub, a} after the adversarial attack targeting obj|\n|$x_{\\text{sub},a}$ |Clean samples from the subgroup {sub, a}|\n|$p_{\\text{sub},a}$|The distribution of predicted soft labels in the clean subgroup {sub, a} before the adversarial attack|\n\n[W1: Clarification of Adversarial Perturbation]\n\nRegarding the fairness attack, while the adversarial objective is formulated at the group level, the perturbations are applied to individual input samples rather than directly modifying sensitive attributes. Similar to how labels guide perturbation directions in the accuracy attack, sensitive attributes are used solely to determine the perturbation directions in the fairness attack. Specifically, the fairness attack shifts samples from the advantaged group toward the subspace of positive predictions, while pushing samples from the disadvantaged group toward the subspace of negative predictions.", "claims_and_evidence": "The claims within this paper are well supported roughly.", "methods_and_evaluation_criteria": "The evaluation criteria, such as datasets (e.g. CelebA) are popular and sufficient for assessing performance.", "theoretical_claims": "Although I have not examined the proofs in detail, the theoretical claims appear to be generally correct.", "experimental_designs_or_analyses": "The experimental design is valid and well-organized.", "relation_to_broader_scientific_literature": "This paper investigates the fairness problem in the context of adversarial attacks, which could be potential useful for future research.", "essential_references_not_discussed": "There are no essential references missing.", "other_strengths_and_weaknesses": "**Strengths**\n\n- The paper extend the typical adversarial attacks problem towards accuracy and then explores the fairness problem under adversarial attacks.\n- The fairness robustness under adversarial attacks is worthy investigating.\n- The empirical results provide enough convincing evidences.\n\n**Weaknesses**\n\n- Given the vague connections between features and sensitive attributes, it seems to be hard to understand the perturbations on these sensitive attributes.", "other_comments_or_suggestions": "- The writing should be polished. There are same typos shown in many places, for example, \"the the fairness attack\".\n\n- The mathematical notations are quite intricate. I strongly recommend that the authors present them in a more accessible format, such as tables, for easier reading.", "questions_for_authors": "I don't have any specific questions", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "A8aYfEXLjU", "reviewer": "Reviewer_5adC", "summary": "The paper \"On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness\" explores the connections between adversarial training for fairness and accuracy objectives. The authors demonstrate the potential synergy between these two robustness goals. After a theoretical analysis of their alignment - showing that fairness robustness can benefit from adversarial accuracy training under a relaxed fairness control - the authors present experiments that support their claims. The results indicate that even without specific fairness fine-tuning against fairness attacks, a model trained adversarially for accuracy robustness retains reasonable fairness properties. Furthermore, improving fairness by controlling the adversarial dataset during preprocessing, optimizing under a relaxed fairness constraint (in-processing), or applying fairness post-processing to the outputs is shown to further enhance fairness robustness, in line with theoretical predictions. I believe this paper could be valuable to the community for designing models that are robust with respect to both criteria.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the detailed comments.\n\n[W1: Extension to Non-Binary Classification]\n\nOur method can be readily extended to multi-class scenarios by simply replacing $L_{\\text{CE}}$ and the fairness constraint $L$ with their respective multi-class formulations. We show results in the following table on Drug dataset [1] to validate the extension, where the perturbation level is chosen as $0.1$:\n\n|Method   | Accuracy | DP | EOd |\n| --------- | -------- | -------- | -------- |\n| Baseline| 0.41   |0.96    |1.97    |\n| Advcersarial Training| 0.63   |0.49    |1.03    |\n| Advcersarial Training (preprocessing)| 0.64   |0.15    |0.22   |\n| Advcersarial Training (in-processing)| 0.63   |0.17    |0.23   |\n| Advcersarial Training (post-processing)| 0.64   |0.18    |0.25   |\n\nOur method (last three rows) achieves remarkably better performance under the fairness attack, validating the extensibility to non-binary tasks.\n\n[W2: Theoretical Analysis]\n\nWe may clarify that our analysis is not limited to fully successful attacks. Under a successful DP attack, we have $f(x) < 0.5$ for samples in the disadvantaged group $\\mathbb{S}\\_{.0}$, and $f(x) \\geq 0.5$ for samples in the advantaged group $\\mathbb{S}\\_{.1}$. Consequently, we have\n\\begin{align*}\n\\text{EOd} = &\\\\left|\\\\frac{\\\\sum_{x \\in \\mathbb{S}\\_{10}} \\mathbb{1}[f(x) \\geq 0.5]}{|\\mathbb{S}\\_{10}|} - \\sum_{x \\in \\mathbb{S}\\_{11}} \\frac{\\mathbb{1}[f(x) \\geq 0.5]}{|\\mathbb{S}\\_{11}|}\\right| \n\\\\\n&+ \\left|\\sum_{x \\in \\mathbb{S}\\_{00}} \\frac{\\mathbb{1}[f(x) < 0.5]}{|\\mathbb{S}\\_{00}|} - \\sum_{x \\in \\mathbb{S}\\_{01}} \\frac{\\mathbb{1}[f(x) < 0.5]}{|\\mathbb{S}\\_{01}|}\\right|\n\\\\\n& =2,\n\\end{align*}\n\nwhich indicates that a successful DP attack implies a successful EOd attack. However, the converse does not hold true, as discussed in the counterexample of Appendix D. Furthermore, our analysis in Sec. 5 of the main paper on the alignment between fairness robustness and accuracy robustness does not rely on additional assumptions about the attacks. The discussion on fully successful attacks is included solely to illustrate this relationship.\n\n[W3: Fairness Metrics]\n\nWe are sorry for the confusion. The results we reported are calculated based on 0-1 fairness metrics, rather than the relaxed version. We 'll clarify the choice in the revised paper.\n\n[W4: Optimization of Algorithm 2]\n\nThe relaxed fairness constraint is optimized over each mini-batch. Since the mini-batches are randomly constructed from the training data, as long as the batch size is not excessively small, $L_{\\text{DI}}$ can be reliably estimated and optimized using only mini-batches.\n\n[R1: Algorithm Presentation]\n\nThank you for the suggestion. We 'll include the details of the fairness interventions in Algorithm 1 and 3 in the revised paper. The preprocessing method [2] reweighs each training sample to balance the class distributions within each sensitive group, while the post-processing method by [3] adjusts the decision threshold for each group based on approximated logit distributions.\n\n[R2: Projection Operator]\n\nOur formulation primarily follows the conventional formalism [4]. We 'll include more explanations in the revised paper to avoid confusion.\n\n[R3&4: Notations]\n\nWe are sorry for the confusion. $L\\_{\\text{DI}}$ should be $L\\_{\\text{DP}}$. Since $\\delta^{\\text{fair}}\\_{\\text{sub,a}}$ is defined as the change in $L\\_{\\text{CE}}$ before and after the fairness attack, we slightly abuse the notation here, as we focus on the DP attack as the fairness attack.\n\n[R5: Assumption 5.2]\n\nBy \"bound of a distribution\" we refer to the supremum of function values of a distribution, i.e., \n$$\n\\max_{x} p(x),\n$$\nwhere $p$ is the probability density function (PDF) of the distribution.\n\n[R6: Clarification of Theroem 5.3]\n\nAs discussed in Sec. 5 (line 272-274) of the main paper, the fairness robustness of $x_{\\text{FN},0}$ naturally aligns with the accuracy robustness of $x_{\\text{FN},0}$ since the fairness attacks and accuracy attacks are identical regarding $x_{\\text{FN},0}$. Consequently, $x_{\\text{FN},0}$ is naturallly bounded under adversarial training. Therefore, our discussion in Theroem 5.3 focuses on $x_{\\text{FN},1}$, where the fairness attack diverges from the accuracy attack.\n\n[1] Fehrman, E., Egan, V., & Mirkes, E. (2015). Drug Consumption (Quantified) [Dataset]. UCI Machine Learning Repository. https://doi.org/10.24432/C5TC7S.\n\n[2] Yu, Zhe, Joymallya Chakraborty, and Tim Menzies. \"FairBalance: How to Achieve Equalized Odds With Data Pre-processing.\" IEEE Transactions on Software Engineering (2024).\n\n[3] Jang, Taeuk, Pengyi Shi, and Xiaoqian Wang. \"Group-aware threshold adaptation for fair classification.\" Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 36. No. 6. 2022.\n\n[4] Madry, Aleksander, et al. \"Towards deep learning models resistant to adversarial attacks.\" arXiv preprint arXiv:1706.06083 (2017).", "claims_and_evidence": "Yes. Experiments look convincing and well follow theoretical claims. While I did not fully check all proofs, the theoretical analysis looks well sounded. \n\nMy only concern regarding the experiments is the use of fairness attacks for accuracy robustness (Figure 3). While the authors claim in the accompanying text that fairness adversarial training significantly improves accuracy robustness, I observe the opposite in the reported curves. Maybe the legends have been swapped?", "methods_and_evaluation_criteria": ".", "theoretical_claims": ".", "experimental_designs_or_analyses": ".", "relation_to_broader_scientific_literature": ".", "essential_references_not_discussed": ".", "other_strengths_and_weaknesses": "Strengths : \n- Interesting theoretical of fairness and accuracy robustness alignement\n- Experiments that well match the theory \n\nWeaknesses : \n- Maybe confined to binary classification and binary sensitives\n- Doesn't fully follow classical definition of fairness metrics for binary classification, that usually considers the final binary decision rather than the class probablity (this is what justifies adversarial fair training rather than relaxed constraints on differentiable statistic, see for instance [2] that discusses that point in section A.2.2, starting from the approach in [1]).  \n\n\n[1]  Brian Hu Zhang, Blake Lemoine, and Margaret Mitchell. Mitigating unwanted biases with adversarial learning. In Proceedings of the 2018 AAAI/ACM Conference on AI, Ethics, and Society, pp. 335–340, 2018.\n\n[2] Grari, Vincent, et al. \"On the Fairness ROAD: Robust Optimization for Adversarial Debiasing.\" The Twelfth International Conference on Learning Representations. 2023.", "other_comments_or_suggestions": ".", "questions_for_authors": "- The paper looks limited to binary classification and binary sensitives. How could the work be extended behind that restricted setting ? \n- Theoretical analysis considers only fully succesful attacks (see for instance the proof of corollary 4.1) where f(x)=1 for all individuals from the privileged group. But doesn't is correspond to a kind of shift of analysis, since in practice this is not the case, at least for some reasonnable bounds for the attack norms ? \n- As mentionned above, fairness metrics considered in the paper are relaxed versions of original ones. What would be the results with 0-1 fairness metrics ? How could this limiting setting be overcome ? I feel reporting fairness metrics based on outcome probabilities is not enough since the unprivileged group could can have better probas in average (for instance 0.49 for everyone in the group), while the other group getting probas close to 0.5 also (for instance 0.51 for everyone), reporting a quite fair model, while being strongly unfair when outcomes are thresholded. \n- In algo 2, the relaxed fairness constraint looks a bit difficult to be optimized as it. are the statictics performed on the minibatch only ? Is it enough ? \n\n\nPresentation remarks  :\n- I feel that the paper should be more self-contained regarding the fairness mitigation approaches that are used in the algorithms. Rather than only saying \"reweighting data by Yu et al\" in algo 1, or \"post-process by Jang et al.\" in algo 3, it would be nice if authors could give even a minimal rationnale of what these are. \n- The projection operator is not well defined in section 3.1. And it is confusing, as it looks as a product at a first glance. Also, is x+S correct, I feel this formalism is misleading (I would say S(x^t) for a given ball around x^t of something like that)\n- Directly above (2), the text mentions L_{DI}, while (2) gives L_{DP}. same line 204 for the gradient. \n- line 237 second columns. whe have $\\delta^{Fair}$ defined with $x^{DP}$. Correct ? \n- Assumption 5.2 doesn't look fully clear to me. What do you mean for a bound of a distribution ? \n- The text in theroem 5.3 is somehow also confusing to me, as it mentions the difference of fairness between false negatives of both groups that would be bounded, while tha LHS of the inequality only gives the robustness of the group 1. \n-", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2MYJ1jh9UW", "reviewer": "Reviewer_qsrr", "summary": "This work theoretically discusses adversarial attacks against fairness, include the connection between adversarial attacks on fairness and those on accuracy, the connection between accuracy adversarial robustness and fairness  adversarial robustness.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the detailed comments.\n\n[Theoretical Contribution and Insights]\n\nOur discussion is not focused on designing novel attack schemes, as this has been extensively covered in the existing literature. Instead, our goal is to identify efficient defense strategies against fairness attacks, which has not been adequately addressed in existing work.\n\nOur results contradict existing studies that suggest a trade-off between fairness and adversarial robustness. For example, [1] observes that in linear classifiers, a fairer model can be more vulnerable to accuracy attacks compared to a baseline model. Similarly, [2] empirically finds that reliance on sensitive information (i.e., exacerbating group-wise disparities) can enhance adversarial robustness. These observations suggest that adversarial training alone may be sufficient to improve fairness robustness. However, our analysis indicates that when designing defense strategies against fairness attacks, both static fairness and adversarial robustness shall be taken into account. This conclusion is supported by both our theoretical insights and empirical results under fairness attacks.\n\n[Applicability of Theoretical Results]\n\nAs discussed in Section 5 of the main paper, the two assumptions we adopt align with those used in existing work and are introduced to facilitate our analysis. Although they may lead to slightly looser bounds, our analysis in Appendix I and the visualization results below validate the effectiveness of our theoretical framework in quantifying the alignment between fairness robustness and accuracy robustness. While the theoretical bounds differ from real-world values, they exhibit similar trends and preserve the relative ordering, where smaller upper-bounds correspond to smaller real-world values.\n\n[Formulation of the DP Attack]\n\nSince DP is defined by the difference in positive prediction rates, maximizing DP under a given perturbation level is most efficiently achieved by increasing one group's rate while decreasing the other's. In contrast, increasing the positive prediction rates for both groups does not align with the objective of maximizing disparity.\n\n[Visualization of Theoretical Bounds]\n\nThank you for the suggestion. We show DP and EOd, as well as their theoretical bounds under varying levels of fairness attacks on CelebA dataset in the following link:\n\nhttps://drive.google.com/file/d/1nR1o4IHUOxFAhNc0AvLac2e9L1ehFYvD/view?usp=sharing\n\nWe 'll include full results in the revised paper.\n\n[Setting of Adversarial Attacks]\n\nWe refer to Sec. A of the appendix for the detailed setup.\n\n[Misalignment between Experimental Results and Analysis]\n\nWe apologize for the confusion. The labels for \"baseline\" and \"adversarial training (fairness)\" in Fig. 3 are swapped. Specifically, \"baseline\" should be labeled as \"adversarial training (fairness),\" and \"adversarial training (fairness)\" should be labeled as \"baseline.\" We 'll correct the mislabeling in the revised paper.\n\n[Performance Differences in Figure 2 and 4]\n\nThe performance differences between the baseline, vanilla adversarial training and our method validate our analysis in Theorem 5.5 of the main paper. Our analysis demonstrates that to achieve smaller changes in group-wise disparities under a fairness attack, it is essential to consider both static fairness and accuracy robustness; focusing on only one does not guarantee low fairness violations. In contrast, our method jointly addresses both aspects, resulting in lower fairness violations compared with other methods.\n\n[Generalization to Other Metrics]\n\nOur formulation can be generalized to alternative fairness notions as it aims to maximize disparities in predictions between groups. The two metrics we focus on have been shown to be conflicting under varying base rates [3], but by maximizing DP, we also maximize EOd. We show results of two alternative metrics, predictive equality (PE) [3] and positive class balance (PCB) [4] on CelebA dataset under the perturbation level $\\epsilon=0.15$ in the following link:\n\nhttps://drive.google.com/file/d/1CS41yfL4YwBwYakPQVQVtxDqoLX-e4xn/view?usp=sharing\n\nThe DP attack effectively maximizes PE and PCB on the baseline, while our method maintains lower values for both metrics, validating the generalizability of our formulation and our defense framework.\n\n[1] Tran, Cuong, et al. \"Fairness increases adversarial vulnerability.\" arXiv preprint arXiv:2211.11835 (2022).\n\n[2] Moayeri, Mazda, Kiarash Banihashem, and Soheil Feizi. \"Explicit tradeoffs between adversarial and natural distributional robustness.\" Advances in Neural Information Processing Systems 35 (2022): 38761-38774.\n\n[3] Chouldechova, Alexandra. \"Fair prediction with disparate impact: A study of bias in recidivism prediction instruments.\" Big data 5.2 (2017): 153-163.\n\n[4] Kleinberg, Jon, Sendhil Mullainathan, and Manish Raghavan. \"Inherent trade-offs in the fair determination of risk scores.\" arXiv preprint arXiv:1609.05807 (2016).", "claims_and_evidence": "The work makes several claims, but the valuable insights are limited. For example, Theorem 5.3 and Theorem 5.5 establish the relationship between attack robustness in terms of accuracy and fairness, leading to the conclusion that improving accuracy robustness and fairness in real-world applications can enhance fairness robustness. However, this is not a surprising result and lacks effective quantitative guidance for the community.\n\nMost claims are supported by theoretical evidence; however, multiple assumptions are made to simplify the theorems, which limits the applicability of the results.\n\nI also have concerns regarding the following claim:\n\nThe DP fairness attack aims to maximize the difference in the positive label rate between the advantaged and disadvantaged groups. However, in Section 4.1, it is simplistically analyzed as maximizing predictions in the advantaged group and minimizing them in the disadvantaged group. In real-world scenarios, it is also possible for the positive rate to increase in both groups, but with a greater increase in the advantaged group. Therefore, I believe that this overly simplified analysis may be problematic, especially since its validity serves as the foundation for the subsequent Corollary 4.2.", "methods_and_evaluation_criteria": "I believe evaluating the tightness of the theoretical bounds through visualized experimental results would be more effective.\n\nAdditionally, there is a lack of detailed information regarding the setup of the adversarial attack scheme.", "theoretical_claims": "The proofs in the appendix seem correct, except that they require introducing assumptions on the foundation and boundary relaxations.", "experimental_designs_or_analyses": "The settings of the adversarial attack in the experiments are not introduced.\n\nSome observations in Figure 3 do not align with the analysis. For example, when adversarial training w.r.t. fairness is introduced, accuracy robustness deteriorates rather than improving, which contradicts the analysis stating that 'accuracy robustness also benefits from adversarial training w.r.t. fairness.'\n\nAdditionally, I am confused about the significant performance differences in Figure 4 and Figure 2 under fairness attacks across the two datasets after adversarial training.", "relation_to_broader_scientific_literature": "This work focuses on fairness-oriented adversarial attacks, an important topic. It aims to clarify the theoretical connections between adversarial attacks on fairness and accuracy in terms of attack effectiveness and adversarial robustness, making it a timely contribution. However, the technical innovations are limited, and the work does not provide insights based on its theoretical results for designing more effective adversarial attacks or corresponding defense strategies targeting specific performance aspects, only accuracy or only fairness.\n\nAdditionally, fairness metrics are diverse and sometimes conflicting. This work focuses on two specific forms, EOd and DP, but other metrics, such as the equal error rate, might lead to different conclusions. I would expect the findings of this work to be more generally applicable across a broader range of fairness metrics.", "essential_references_not_discussed": "n/a", "other_strengths_and_weaknesses": "n/a", "other_comments_or_suggestions": "n/a", "questions_for_authors": "Could the authors provide a discussion on the insights from this work's results regarding the design of more effective adversarial attacks, such as those targeting only accuracy or fairness, as well as the corresponding defense strategies?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The paper proposes an adversarial attack on model fairness. While the reviewers provide strongly diverging scores, they agree that the proposed research question is novel and interesting. Major weaknesses are seen in the paper not being self-contained, mathematical notation not being clear, simplifications not always being motivated. After the rebuttal, the AC sees most of these concerns addressed. The amount of editorial changes to the manuscript that are promised by the authors makes the paper a borderline case, but the changes, while necessary, will be easy to implement. The authors will have to improve the manuscript by incorporating their responses, in particular to reviewers 5adC, yumK and Mgij into the final manuscript.
Decision: Accept (poster)