Enhancing Robustness of Last Layer Two-Stage Fair Model Corrections
Authors: Nathan Stromberg
Rohan Ayyagari
Sanmi Koyejo
Richard Nock
Lalitha Sankar
Venue: NeurIPS 2024 poster (2024)
Keywords: fairness
robustness
worst-group accuracy
subgroup
subpopulation
Primary area: fairness

Abstract: Last-layer retraining methods have emerged as an efficient framework for correcting existing base models. Within this framework, several methods have been proposed to deal with correcting models for subgroup fairness with and without group membership information. Importantly, prior work has demonstrated that many methods are susceptible to noisy labels. To this end, we propose a drop-in correction for label noise in last-layer retraining, and demonstrate that it achieves state-of-the-art worst-group accuracy for a broad range of symmetric label noise and across a wide variety of datasets exhibiting spurious correlations. Our proposed approach uses label spreading on a latent nearest neighbors graph and has minimal computational overhead compared to existing methods.

Label Noise Robustness for Domain-Agmoste Fair Corrections via Nearest Neighbors Label Spreading
Nathan Stromberg Arizona State University
Rohan Ayyagari Arizona State University
Sanmi Koyejo Stanford University sanmi stanford.
nstrombe@asu.c edu
rayyaga20asu. edu
Richard Nock
Lalitha Sankar
Google Research
Arizona State University 1sankar@asu, edu
ri riccarddnock@goglee.cooo
Abstract
Last-layer retraining methods have emerged as an efficient framework for correcting existing base models. Within this framework, several methods have been proposed to deal with correcting models for subgroup fairness with and without group membership information. Importantly, prior work has demonstrated that many methods are susceptible to noisy labels. To this end, we propose drop-in correction for label noise in last-layer retraining, and demonstrate that achieves state-of- the-art worst-group accuracy for a broad range of symmetric label noise and across a wide variety of datasets exhibiting spurious correlations. Our proposed approach uses label spreading on latent nearest neighbors graph and has minimal computational overhead compared existing methods.
Introduction
In order to ensure fairness between subpopulations, an important metric to consider is the lowest accuracy amongst all subpopulations, often referred to worst-group accuracy (WGA). State-of-the- art methods for optimizing WGA utilize group membership information to modify the training loss
the distribution of the training data [TO 6 [ in order account for imbalance amongst groups and successfully train a classifier which is fair across groups.
[1 21 20 22
While these methods can achieve astounding WGA, many have significant computational and data costs. Last-layer retraining (LLR) has emerged as a popular method to adapt existing deep models with minimal overhead while ensuring faimness [10 22 20). Additionally, the necessity of group membership information has been relaxed as new methods infer group membership by utilizing auxiliary classifiers detect minority groups (generally known as two-stage methods)
12) 22). Taken together, it now possible to correct powerful deep models for worst group accuracy with low computational and data cost. Two methods using this approach are SELF and RAD [22].
Unfortunately, class labels are often noisy 25 in practice. Further, Oh et al. [16] demonstrated just how fragile most two-stage model corrections are in the face of this issue. While Oh er [16] presented method with improved robustness to label noise, their method requires fully retraining the base model and cannot match the performance of existing methods at low noise levels. To
address these issues, connect the existing literature on label propagation and worst-group accuracy correction, i.e., we utilize label spreading on the latent nearest neighbors graph to correct for noisy labels and two-stage LLR methods maximize WGA without domain annotations. We list our main contributions below.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

We highlight the failure of state-of-the-ee (SOTA) LLR methods, in particular, SELF and RAD [2]] under target label noise.
We introduce an elegant label correction preprocessing method that significantly improves the performance of the SOTA LLR methods under label noise. The key insight here is that LLR models operate on largely separable embeddings, and therefore, label noise can be potentially corrected using label propagation techniques.
For various spurious correlation datasets. we highlight the effectiveness of our modular approach when combined with both SELF and RAD and compare to domain-aware and full retraining methods.
1.1 Related Work
Subgroup Robustness Downsampling has become one of the most common methods of increasing WGA. Kirichenko et al. [0] propose deep feature reweighting (DFR), which downsamples majority groups to the size of the smallest group to rebalance the retraining set. Chaudhuri et al. [4] explore the effects of downsampling theoretically and show that downsampling can increase WGA under certain data distribution assumptions. LaBonte et al. [II] propose using class-balancing when group membership information is unavailable and demonstrate its efficacy.
Upweighting is popular alternative to downsampling as it utilizes all available data. Idrissi et al. [ show that upweighting relative to the proportion of groups can achieve strong WGA, and Welfert et al. [26] prove downsampling and this form of upweighting are statistically equivalent. Upweighting has been extended to domain annotation- settings by Qiu al. (20) through loss-weighted learning.
Domain annotation free methods often use a secondary model to identify minority groups. These are referred as two-stage methods. Qiu et al. [20] use the pretrained model itself but do not explicitly identify minority examples and instead upweight proportionally to the loss. Unfortunately. this ties their identification method to the choice of the loss. Liu al. [12] consider fully retraining the pretrained model as opposed to only the last layer, but their method of minority identification using an early stopped model is considered in the last layer in LaBonte et al. (.]) LaBonte et al. [ not only consider early stopping as implicit regularization for their identification model, but also dropout (randomly dropping weights during training). Stromberg et al. (22) consider an explicit & regularizer, building on the work of LaBonte et al. 11 and Kirichenko et al. [10]
Wei et al. 225 show that human annotation of image class labels can be noisy with up to 40% noise proportion, thus motivating the need for robust methods for WGA. Oh et al. [16] consider robustness to class label noise. Their method, END, utilizes predictive uncertainty from a robust identification model to select an unbiased retraining set. Their method struggles against SOTA methods at low noise levels and is not easily adapted to other error set-selection techniques. Still, it achieves strong performance in the high noise regime where other two-stage full retraining methods fall apart.
Label Propagation The problem of spreading labels from small, but well-annotated set of reference points to a larger unlabeled set has been extensively explored in the literature. For survey of basic a graph, see Bengio et al. 2 and references therein. The graph
methods of label propagation on which labels are propagated is critical to the success of these methods. Common graphs are the k-nearest neighbors (kNN) graph, the adjacency matrix of an undirected graph, or underlying directed acyclic graph (DAG).
When labels are noisy, the objective of label propagation may be ill-equipped to correct these labels, but the general principles can be of use. For a restricted classifier setting. Gao et al. [5] prove the robustness of the kNN learning procedure to label noise and give sense of how to choose k the number of nearest neighbors, via an excess risk bound. This inspires our empirical analysis and our results verify the trends suggested by their bound. Iscen et al. [9] utilize neighbor consistency to deal with noisy labels when training deep models and frame their method as an implicit label propagation. Patrini et al. [19] consider label noise and possible corrections via loss and logit reweighting.
Label propagation and spreading have also been used in the semi semi-supervised learning setting for both general models and those focused on subgroup fairness. Iscen et al. 8 include label propagation in order to learn general deep models in a semi-supervise manner. Nam al. [15] utilize an auxiliary model inspired by the label propagation objective to predict group labels on unlabeled samples. This

---

allows for semi- sumi-supeeeieed fair training. Unfortunately, their method is very costly as it involves training both spurious attribute prediction model and running GroupDRO (2T.
Our work combines the ideas of two-stage last-layer corrections of LaBonte et al. Stromberg al. 22 with simple label propagation techniques in the latent space of the original (unfair) model. Because we have now-dimensional embedding in which clean examples are well-separated by linear classifier, we can utilize kNN label spreading with many nearest neighbors, which is enough to correct most label noise in the training data. With this preprocessing method, we can then proceed with any two-stage last-layer WGA correction to achieve fairness without domain information. Thus, our method is an elegant plug-and-p -lugaa addition to last-layer subgroup robustness methods, which achieves SOTA test WGA when training with noisy class labels.
2 Problem Setup
Let D = {(X,, k be a dataset of n iid examples with features X; E X' and class label Y; E V. Additionally let G = (9. y 1 be a partition of D, that each 9, C D, correpponding to the k groups of interest. In general, this partition is unknown at training time.
We are given a pre-trained deep model
f(x; arg max By (y (()(x),) wEy
(I)
where Φ : X + Rd is an embedding function and a: IR + [0, 1||2" such that σy is the estimate of the probability that X is in class y. An example of a is the oft-used softmax function. We assume that ff is trained on clean data. While this may seem like a strong assumption, it can be relaxed as recent work suggests that feature embeddings are typically robust to label noise [9] I7].
We seek to retrain solely the last layer of ʃ in order to increase the worst-group accuracy of the model. That is we learn OWGA such that
OWGA max min
1
Σ
1(s(;;)) y)-
(2)
9:
(r.y)ec;
That is, OWGA maximizes the worst-group accuracy (WGA). We will use WGA as our metric for all of our discussions moving forward.
2.1 Label Noise Model
We assume that we observe not D, but D {(X,, Ý.) where Y has been affected by symmetric label noise with noise level E (0, 1/2). . In general, this noise could be caused by human error, data corruption, or malevolence. Patrini et al. [9] consider wider class of class-dependent noises and show that in general, predictors can be made robust to such noise with relatively simple adjustments the loss function or data distributions. This simple correction is not helpful in two-stage methods as demonstrated by Oh et al. [T6]; we expand on this further in Section 2.3
2.2 Basic Last-Layer Model Corrections for WGA
When have information about the group membership G, standard methods are to upweight examples proportional to their group size or to remove samples from larger groups. Specifically, group upweighting (GUW) seeks minimize the following objective:
1
@(GU)) max
Σ (a.y)EG.
()) = y),
k
E
where the inner sum is upweighted by a factor inversely proportional to its prevalence in the dataset. Group downsampling (GDS) takes similar approach, but sub-samples all groups which are larger than the smallest group. Denoting Miia = ming.eg [Gsl as the size of the smallest group, we can write the GDS objective as:
(GGDS) max 0
Σ
Σ
1(f(x;0) v).
(4)
k7mmin G:EG (2.w)e
3

---

where G. is downsampled version of G with size mmin-
These two approaches are examined theoretically in Chaudhuri et al. their performance in the presence of label noise is unclear. Patrini et al. [9] suggest that a related upweighting factor Equation (3) may be helpful in combating label noise (the so-called backwards correction) suggesting that GUW may be robust to label noise. Welfert et al. (26) prove that GUW and GDS are equivalent in the statistical setting (infinitely many samples), which suggests that GDS should also have some resilience to label noise. We explore this empirically in Section 4
4 Welfert al. (26]. though
2.3 Two-Stage Last-Layer Model Correction
When group membership information is unavailable, techniques that build GUW or GDS have been explored. Broadly they fall into the category of two-stage corrections 12 16 14] and more specifically in our setting, last-layer model corrections for worst-group accuracy 11 22 These methods make the assumption that the groups of interest are determined by a tuple of class label Y and domain label D. Additionally there is spurious correlation between Y and D which causes the base model ff to perform poorly on minority groups. This same correlation is exploited when correcting the model in that an error set, &, is constructed that is likely to contain minority examples:
E ((X E D: fuas (X) *Y},
(5)
where faias is the base model / for LaBonte et al. 11 and highly regularized model intended to increase performance in Stromberg et al. [22] This error set is then used as a proxy for group- balanced or mimirity-dominated subset, respectively, for fair retraining. We present simplified version of the RAD [22] and SELF [1] algorithms Algorithm [ and Algorithm respectively. Note that in this work we focus the misclassification version of SELF, but other variations are discussed by LaBonte et al. [. The intuition behind these methods that the error set will likely contain mostly minority examples as the majority should be easily captured by the biased classifier.
The construction of this error set is precisely why using a noise-robust loss [16] or corrected loss [19 is not enough to achieve robustness to label noise for two-stage LLR methods. The robust models will still (correctly) misclassify noisy examples, including them the error set for retraining (see Appendix C for experimental results in this setting). This results in an error set which is dominated by noisy majority points rather than clean minority points. This is exacerbated by SELF which keeps only the examples with highest loss (most likely to be noisy). We present a proof of this failure for RAD in a group-conditional Gaussian setting in Appendix B Proposition the error set to depend on the entropy of the predictions rather than their correctness. While this increases robustness to label noise, it comes the cost of clean performance. We instead focus on cleaning the labels so that we can realize the performance gains of existing two-stage methods.
2 Oh et al. [16] circumvent this problem by changing the construction of
Algorithm 1 RAAD 22 Algorithm
Algorithm SELF [II Algorithm
Input: D (I,, y1) for [n]] et penalty
Input: D (ai, vi) for i [n], nsub: size of reweighting set
factor, X: upweight factor E E+o
& +
Learn Orias minimizing
ÿ - f(z;0)
if g. # y/4 then
Σ (D
E(x,, v: 0) + c|101|
(6)
E - EU E..
end if
Subsample E to select noub examples with high- est loss
+ f(x; )
if 0: * then E E (-E(()).))
Subsample E so that each class is equally rep- resented
end if Learn ARAD minimizing
Learn OSELF minimizing, starting from 0
Σ
l(x, y: 8)
(8)
Σ (x.))D)E
((, +
Σ
E(x, 0) (7)
(Z,)EE
(2.8)E
Return: ASELF
Return: ORAD

---

3 Label Spreading for Robust Worst-Group Accuracy
To correct for label noise in the training data, we will consider the labels of each point's nearest neighbors. We denote the k nearest neighbors matrix as V& where (i, is if Xj is one of the k nearest neighbors of X; in &z distance and 0 otherwise. Thus k VV is a row-stochastic matrix with uniform distribution on each point's nearest neighbors. Note that Vi is not necessarily symmetric and so defines a directed graph.
We update the estimated labels iteratively by taking a uniformly-weighted majority vote of each point's nearest neighbors. The idea is that noise is added at random to each class, thus it is likely that for noise level p. - p proportion of a given query point's neighbors have clean labels. It is intuitive to select higher k for increasing p in order to minimize the effect of local noise density. Thus most noisy points will be corrected after just one round of spreading, and noise will continue to diminish unless there is small cluster which is especially noisy. See Gao et al. S for a more complete theoretical treatment of kNN classification with label noise.
To better understand how the choice of is affected by the noise parameter consider the following:
Proposition 1 (Theorem 2 from Gao et al. (50 For k 2 8 and symmetric label noise level p
E [k RD
2R" Vk +
P
+ max (L, VLIva
k
1/(1+d)
(1-2p)vk
n
where R is the Bayes optimal risk, R2 is the risk of KNN. is the data feature dimensions, and is
the Lipschitz constant of the Bayes optimal classifier.
For > minimizing the upper bound in Equation p leads to the dependence of k on p as
o ((RR'T1-) 2p )
)
(10)
corroborating the intuitive choice of larger is for larger amounts of noise.
3.1 A Note Domain Label Spreading
Because of the effectiveness of simple domain-aware LLR methods like GDS and GUW, it may be tempting to consider kNN label spreading for domain noise as well as target noise. In this way, we could correct for the failures of GUW and GDS seen by Stromberg et al. [22] which lead them to propose RAD. The effectiveness of kNN label spreading for target labels is mainly due to the fact that the clean embeddings are close linearly separable (that is the original base model had high accuracy). In practice, not only are classes linearly separable in the latent space, but are tightly clustered. This has been observed empirically and partially explained theoretically under the framework of neural collapse [18]. Such collapse has not been seen for subgroups when this information is not explicitly utilized the training of the base model. Thus it unreasonable to expect that domains should be as well separated as classes. This limits the effectiveness of kNN label spreading for domain labels, but as we demonstrate in Section kNN-RAD can achieve SOTA WGA without using domain labels at all in the training phase. Nam et al. [15 bypass this issue by training separate neural network to predict group membership using semi-supervised data, effectively causing neural collapse for groups rather than classes. However, their method suffers from poor computational performance and struggles to deal with label noise as demonstrated by Oh et al. [6].
3.2 KNN-RAD and KNN-SELF
In order to retrain the base model, we first perform T rounds of kNN label spreading (in practice we take T = 1) and then pass the cleaned labels to any last layer method. We denote the combination of these procedures kNN-RAD, Algorithm or KNN-SELF, Algorithm 4 depending on the two-stage method used after label spreading. While we focus using embeddings from model trained on
5

---

clean data, prior work suggests that the embeddings should be relatively robust to label noise 9 17
Algorithm 3 KNN-RAD Algorithm
Algorithm KNN-SELF Algorithm
Input: D = (I,, 84) for é [n]. k: number of neighbors, penalty factor, A: upweight factor
Input: D = (I,, Dt) for E [n]. k: number of
neighbors, Sub size of reweighting set
Calculate KNN graph V& (0)
Calculate KNN graph Vi
for (()) -- 1 (V&. (t- 2 2)
, do 1, ,,..,
for 1, ...., T do
(1) t 1 1V28 (1-1) 22
end for
end for
ORAD + RAD(x (T) C, (Algorithm
OSELF + SELF(x, ( (Nsub) Return: OSELF
) (Algorithm
Return: ORAD
4 Experiments
We present worst-group accuracies for several representative methods across four large publicly available datasets. Specifically, we compare kNN-RAD and kNN-SELF END [I6] which aims to provide robustness to label noise for two-stage full retraining methods. As baselines we include group upweighting (GUW) and group downsampling (GDS) which are simple and effective, but require domain annotations which are not available to other methods. Additionally, we demonstrate that uncorrected RAD 22 and SELF 11 suffer large performance degradation under label noise.
4.1 Experimental Details
We perform experiments with several common datasets in the literature of worst-group accuracy, including three vision datasets and one text dataset. Following prior work [10 11. we use half the validation retraining data (with noisy target labels) and half as clean holdout. More details can be found in Appendix A
CMNIST [I] is variant of the MNIST handwritten digit dataset in which digits 0-4 are labeled y and digits 5-9 are labeled = Further, 90% of digits labeled y = are colored green and 10% are colored red. The reverse is true for those labeled y = 1. Thus, we can view color as domain, and we can see that the color of the digit and its label are correlated.
CelebA 13 is a dataset of celebrity faces. For this data, we predict hair color as either blonde (y = 1) or non-blonde (y- 0) and use gender, either male (d 1) or female (d 0), as the domain label. There is a correlation in the dataset between hair color and gender because of the prevalence of blonde female celebrities.
Waterbirds 21 is a semi-synthetic dataset which places images of land birds (y = 1) or sea birds (y 0) land (d 1) or sea (d 0) backgrounds. There is correlation between background and the type of bird in the training data but this correlation is removed in the validation data.
ComilComments 3 is text corpus dataset of public comments news websites. Comments labeled either as toxic (y = 1) or civil (y = 0) and the spurious attribute is the presence (d I) or absence (d 0) of minority identifier (e.g. LGBTQ, race, gender). There is a strong class imbalance (most comments are civil), though the domain imbalance is modest.
4.2 Empirical Evidence for Label Spreading
To empirically evaluate the effectiveness of kNN label spreading, we add symmetric label noise to embeddings from three image datasets and then perform label spreading over 10 rounds. We see in Figure that kNN label spreading can correct most of the noise present in the training data with only one round of spreading. This is likely due to the well-separated nature of the embeddings. CMNIST suffers from decreasing performance with too many rounds or neighbors as the data is not perfectly clustered into classes as it is in the other image datasets. Here, it is likely that the nearest neighbors for the small clusters to the side Figure 2 are of the opposite class, allowing noisy points to spread more casily than clean points. For this reason, employ smaller value of & for CMNIST than for other

---

colbA
(a) CelebA
(b) Waterbirds
(C) CMNIST
Figure 1: Accuracy (and 95% confidence intervals over 10 runs) of predicted labels from kNN under 20% symmetric label noise. CelebA and Waterbirds achieve strong performance with large number of nearest neighbors, but CMNIST struggles as the number of neighbors or rounds grows too large.
5
5
(a) CelebA
(b) Waterbirds
(c) CMNIST
Figure 2: ISNE projection of the 2048 dimensional latent embeddings into 2 dimensional space for visualization. We see that CelebA and Waterbirds show clear class separation while CMNIST has more hierarchical clustering. This could lead to decreased performance of label spreading.
datasets. Distance-weighted voting could be another way to combat this issue. Additionally, because the label spreading process is so quick, we spread for only 1 round in practice. A distance- approach may require more rounds for clean labels to spread throughout the dataset.
4.3 Robustness of KNN to Noisy Embeddings
While we assume that the embedding model & is train on clean (but imbalanced) data, is not always the case in practice. While Iscen et al. (9] suggest that embeddings are relatively robust to noise, they find that the classification head is not. Both RAD and SELF rely on the embeddings and SELF on classification head as well. Additionally, the kNN label spreading proposed in this work assumes clean embeddings with only symmetric label noise.
To explore how robust our method is to violation of these assumptions, we train base models for both CelebA and Waterbirds on data which contained 20% SLN. We then the finetuning procedure with varying levels of label noise. We see in Table [ that both RAD and SELF suffer when using noisy embeddings, and this only exacerbated by noise the finetuning set. Still, kNN label cleaning able to provide significant boost in performance despite having relatively low-quality embeddings. We see a similar trend for Waterbirds in Table which shows even stronger performance gains for kNN over vanilla two-stage methods.
is also notable that SELF has significantly worse performance than RAD when using noisy embeddings, likely because SELF additionally reuses the final classification layer of the base model. Previous work [8] has shown that most of the drop performance when training deep models with noisy data comes from poor classification head.
4.4 Results
We report the worst-group accuracy of each approach and its standard deviation over 10 noise seeds. Note that for END [66,, we report the results of Oh al. [16]. For SELF [T] and RAD [22) we implement their algorithms ourselves ensure fair comparison. Each table involves the following:
7

---

Table I: CelebA WGA (std. dev.) using embeddings from a noisy base model. We see that kNN label correction still offers a significant increase in performance over vanilla sto-e methods.
Method
0%
10%
20%
30%
RAD
80.55 (0.02)
74.78 (2.32)
(
(0)
SELF
31.86 (2.32)
40.55 (0.66)
17.68 (16.71)
50.55 (1.36)
KNN
RAD
80.55 (0.02)
77.38 (1.7)
76.56 (2.24)
69.94 (3.07)
KNN SELF
31.01 (0.42)
41.9 (3.84)
44.8 (4.64)
46 (7.20)
Table 2: Waterbirds WGA (std. dev.) using embeddings from noisy base model. We see that kNN strongly outperforms vanilla two-stage methods at every noise level.
Method
0%
10%
20%
30%
RAD 86.12 (0.05)
52.49 (2)
32.26 (2.99)
16.94 (2.5)
SELF
67.43 (4.48)
21.67 (3.12)
16.71 (1.30)
6.43 (19.30)
KNN RAD
84.04 (0.04)
74.28 (2.63)
73.78 (3.29)
61.07 (9.68)
KNN SELF
68.96 (3.79)
68.02 (1.9)
74.90 (2.73)
49.41 (9.89)
Each table is broken into three parts: the first are simple baselines with access to clean domain annotations, the second are SOTA two-stage LLR methods for WGA, and the third are robust two-stage methods including our own (last layer retraining) KNN-RAD and KNN-SELF.
We write GUW* and GDS* denote the worst-group accuracies of upweighting and downsampling. respectively, that can be achieved with oracle access to clean domain labels at training time. Note that such access not available to the two-stage methods.
We highlight in bold both the best domain imnoaaiion-free method for each noise level and the method within one standard deviation of the best.
The "Domain Annotation" column denotes whether a method requires access to domain annotation only at validation (model selection) time or over both training and validation phases. The "Layer" column denotes whether given method retrains only the last layer or the full model.
For the CMNIST dataset, in Table 3 we that kNN label spreading gives small gains over vanilla RAD, but even vanilla RAD is not significantly diminishing in performance with increasing noise levels. This is likely due to the ease of the dataset overall. As noted in Section 3 CMNIST is as strongly clustered as other image datasets, so it is necessary to use a smaller number of nearest neighbors. Here, KNN-SELF provides small gains over vanilla SELF as both are fairly robust.
For the CelebA dataset, Table shows that KNN-RAD achieves dramatically improved performance relative vanilla RAD and also over END. Although it retrains only the last layer, KNN-RAI achieves SOTA performance for domain annotation free methods at every noise level for this dataset. In fact, KNN-RAD is competitive with domain aware methods such GDS and GUW across noise levels. Here KNN-SELF falls behind kNN-RAD and END, but still achieves significantly more robustness than vanilla SELF. Note the relatively higher variance of WGA for SELF and KNN-SELF; this is likely due to the downsampling step that induces different data distributions for different seeds.
For the Waterbirds dataset, we see in Table 5 that KNN-RAD strongly outperforms END and is competitive with domain -ware methods across noise levels, improving the performance of even the oracle methods GDS and GUW, Vanilla RAD experiences catastrophic failure at 20% label noise and above which KNN- RAD is able to correct. SELF performs well at 0% label noise, but quickly degrades with label noise. KNN-SELF achieves dramatic gains over vanilla SELF and maintains an edge over END at every noise level.
For the CivilComments dataset, we see in Table that kNN-RAD is able to match the performance of the domain-aware methods without having access to domain information. Additionally, kNN label spreading demonstrates significant gains over vanilla RAD. SELF struggles on CivilComments even the experiments of LaBonte et al. [IT, so it no surprise that performs poorly here. The heavy class imbalance is likely the culprit combined with the class balancing performed in Algorithm 2
8

---

Table 3: CMNIST WGA (std. dev.): GUW and GDS* denote the worst- worst-group accuracies of upweighting and downsampling, respectively, achieved with oracle access to clean domain labels which aren't available to the two-stage methods. We list both the best domain annotation-fres method for each noise level and the method within one standard deviation of the best in bold. We see that CMNIST a relatively easy dataset in general, so label noise does not cause dramatic performance loss. Yet, kNN provides some additional robustness for both RAD and SELF. CMNIST is not considered in [66 and thus, results for END are not reported.
Label Noise (%)
Domain
Method
Layer
0
10
20
30
Annotation
GUW
Training
Last
95.27 (0.07)
95.17 (0.53)
93.11 (0.94)
92.05 (1.23)
GDS
Training
Last
95.37 (0.22)
94.19(1.02)
94.35 (1.29)
93.31 (0.98)
RAD [22]
Val
Last
93.41 (0.79)
89.62 (0.72)
89.52 (0.65)
88. 58.78 (0.89)
SELF
Val
Last
92.04 (0.20)
89.98 (1.16)
88.05 (2.35)
90.58 (1.12)
END [66
Val
Full
kNN-RAD
Val
Last
93.42 (0.63)
92.46 (0.92)
91.95 (0.86)
90.50 (3.59)
KNN-SELF
Val
Last
91.77 (0.21)
92.81 (0.88)
91.06 (1.06)
90.16 (3.67)
Table 4: CelebA WGA (std. dev.): We see that RAD and SELF achieve strong performance at 0% noise, but are not robust at larger noise levels. Here kNN-RAD and KNN-SELF maintain strong performance relative to their vanilla counterparts up to 30% noise and kNN-RAD strongly outperforms END at all noise levels.
Label Noise (%)
Domain
Method
Layer
0
10
20
30
Annotation
GUW* GDS
Training
Last
86.67 (0)
84.58 (1.21)
82.74 (1.42)
82.08 (2.50)
Training
Last
85.72 (1.65)
84.63 (1,58)
84.06 (2.40)
83.12 (1.91)
RAD 122
Val
Last
83.89 (0)
81.80 (0.37)
(0)
(0)
SELF 11
Val
Last
83.48 (0)
60.48 (6.09)
59.99 (4.52)
60.71 (3.70)
END [66
Val
Full
82.6 (2)
79.7 (1)
81.1 (2)
77.8 (3)
KNN-RAD
Val
Last
83.89 (0)
83.20 (1.53)
82.29 (1,25)
79.5 (1.91)
kNN-SELF
Val
Last
83.48 (0)
72.96 (22.96)
75.77 (8.02)
73.98 (4.40)
5
Discussion and Limitations
We observe that kNN label spreading dramatically increases the robustness of both RAD and SELF and additionally find several interesting trends that warrant discussion. First, it is clear that for larger noise levels, larger number of nearest neighbors is needed correct for the noise. This is suggested by Gao et al. (5) for large k, but is empirically verified with our experiments. The empirically optimal k value increases with each increase in label noise, which allows the label spreading to average over a larger number of nearest neighbors. For CMNIST, we must use smaller, but still increasing, l to account for the smaller clusters within classes. A limitation of our method is that chosen as a hyperparameter, but these insights help to suggest likely ranges for the optimal. Indeed, if an estimate of the noise prevalence is available, the choice of l nearest neighbors could reasonably be estimated without hyperparameter tuning at all.
We also note that the quality of the embeddings is crucial in the selection of the number of neighbors and the number of spreading rounds. CMNIST is the prime example of a dataset that is generally well-separated but has not yet experienced "neural collapse," " so each class has several clusters of points. The danger of this is that some clusters may be nearer to the opposite class than their own, requiring fewer nearest neighbors to prevent noisy labels from spreading. The base model accuracy can help indicate how extensively it is trained, though embeddings can also be analyzed qualitatively. As pointed out in Section 3 a limitation of our method is that we assume that embeddings are from a model trained on clean data, but this need not be the case. Indeed Iscen et al. [9] use the robustness of embeddings to label noise in order to train robust deep learning models and we verify the robustness of RNN-RAD in particular in Section
9

---

Table 5: Waterbirds WGA (std. dev.): We see that both KNN-RAD and kNN-SELF strongly outperform END even though they update only the last layer. Non-robust methods fail quickly.
Label Noise (%)
Domain
Method
Layer
0
10
20
30
Annotation
GUW
Training
Last
91.60 (0.05)
90.90 (0.78)
88.25 (1.91)
84.78 (3.53)
GDS
Training
Last
92.32 (0.58)
89.53(1.66)
86.93 (2.40)
78.09 (3.36)
RAD
12
Val
Last
91.23 (0.06)
79.33 (1.38)
50.74 (2.23)
19.52 (1.91)
SELF 11
Val
Last
92.83 (0.49)
7.58 (2.77)
1.38 (0.20)
0.66 (0.14)
END [16]
Val
Full
82.8 (I)
84.2 (1)
83.2 (1)
81.8 (I)
KNN-RAD
Val
Last
90.92 (0.08)
90.72 (0.63)
89.93 (1.10)
86.90 (3.07)
KNN-SELF
Val
Last
92.65 (0.47)
89.55 (0.65)
88.24 (2.93)
82.44 (10.43)
Table 6: Civil Comments WGA (std. dev.): SELF struggles on this highly class-imbaless dataset,
but kNN-RAD is comperitive with domain-aware methods even for large noise. Oh et al. [16] do not consider this dataset and thus, results for END are not reported.
Label Noise (%)
Domain
Method
Layer
0
10
20
30
Annotation
GUW*
Training
Last
80,25 (0.03)
80.04 (0.43)
81.58 (0.18)
79.39 70.70)
GDD
Training
Last
79.67 (0.48)
80.16(0.63)
81.18 (0.53)
81.21 (0.32)
RAD
12
Val
Last
80.99 (0.03)
79.25 (0.44)
77.45 (0.71)
54.36 (1.30)
SELF I1I
Val
Last
60.61 (0.04)
59.92 (0.03)
59.92 (0.04)
59.95 (0.03)
END [16]
Val
Full
KNN-RAD
Val
Last
81.0 (0.03)
81.15 (0.60)
80.70 (0.62)
78.56 (1.52)
ANN-SELF Val
Last
60.65 (0.05)
72.30 (1.58)
64.64 (2.72)
61.30 (0.72)
Finally, we note that while kNN label spreading works well with both SELF and RAD, the down- sampling to balance the class aspect of the SELF algorithm combined with label spreading leads to a much larger variance than with KNN-RAD. That said, preprocessing with a kNN label spreading module still achieves significant gains in worst-group accuracy relative vanilla SELF. A coupled label cleaning and error set selection process may an interesting direction for future work. By leaving our preprocessing generic, we can ensure our method is applicable when future two-stage methods are developed.
Our work allows for the robustness of two-stage fairness corrections, which could improve fairness for minority groups in a wide variety of models. Unfortunately, no two-stage last layer correction can provide guarantees on the fairness of the resulting model in the general setting. This could lead to practitioners assuming fairesss without auditing it.
Acknowledgements
Nathan Stromberg, Rohan Ayyagari, and Lalitha Sankar acknowledge support by NSF CIF-2007688, SCH-2205080, PIPP-2200161, and Google AI for Social Good grant. Sanmi Koyejo acknowledges support by NSF Career Award 2046795 and SCH-2205329, Stanford HAI, and Google Inc.
10

---

References
[1] M. Arjovsky, L. Bottou, I. Gulrajani, and D. Lopez-Paz. Invariant risk minimization. arXiv preprint arXiv: 028999 2019.
[2] Y. Bengio. O. Delalleau, and N. Le Roux. Label propagation and quadratic criterion. 2006.
[3] D. Borkan, L. Dixon, J. Sorensen, N. Thain, and L. Vasserman. Nuanced metrics for measuring unintended bias with real data for text classification. CoRR, (bss/1903.045//1 2019. URL
http://arxivv org abs/ 1903. 04561
[4] K. Chaudhuri, K. Ahuja, M. Arjovsky, and D. Lopez-Paz. Why does throwing away data improve gorst-group error? In Proceedings of the 40th International Conference on Machine Learning, 2023.
[5] W. Gao, B.-B. Yang. and Z.-H. Zhou. On the resistance of nearest neighbor to random noisy labels. (arXiv:1007.07522) Sept. 2018. http://///arii htge//bs/1600...o urXiv:1607.07522 [es].
[6] G. Giannone, S. Havrylov, J. Massiah, E. Yilmaz, and Y. Jiao. Just mix once: Mixing samples with implicit group distribution. In NewrlPS 202/ Workshop on Distribution Shifts, 2021.
[7] B. Y. Idrissi, M. Arjovsky, M. Pezeshki, and D. Lopez-Paz. Simple data balancing achieves competitive worst-group-accon accurruraa.c...ccc..... In Proceedings of the First Conference Causal Learning and Reasoning, 2022.
[8] A. Iscen, G. Tolias, Y. Avrithis, and O. Chum. Label propagation for deep semi-supervised learn- ing. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 5070-5079, 2019.
[9] A. Iscen, Valmadre, A. Arnab, and C. Schmid. Learning with neighbor consistency for noisy labels. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4672-4681, 2022.
[10] P. Kirichenko, P. Izmailov, and A. G. Wilson. Last layer re-training is sufficient for robustmess to spurious correlations. The Eleventh International Conference on Learning Representations. 2023.
[11] T. LaBonte, V. Muthukumar, and A. Kumar. Towards last-layer retraining for group robustness with fewer annotations. In Conference on Neural Information Processing Systems (NeurIPS), 2023.
[12] E. Z. Liu, B. Haghgoo, A. S. Chen, A. Raghunathan, P. W. Koh, S. Sagawa, P. Liang, and C. Finn. Just train twice: Improving group robustness without training group information. In Proceedings of the 38th International Conference on Machine Learning, 2021.
[13] Z. Liu, P. Luo, X. Wang, and X. Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), 2015.
[14] Nam, H. Cha, S. Ahn, Lee, and J. Shin. Learning from failure: De-biasing classifier from biased classifier. Advances in Neural Information Processing Systems, 33:20673-20684, 2020.
[15] J. Nam, J. Kim, J. Lee, and J. Shin. Spread spurious attribute: Improving worst-grow group accuracy with spurious attribute estimation. arXiv preprint arXiv:2204.02070, 2022.
[16] D. Oh, D. Lee, J. Byun, and B. Shin. Improving group robustness under noisy labels using predictive uncertainty. ArXiv, abs/2212.0700 2022.
[17] D. Ortego, E. Arazo, P. Albert, N. E. O'Connor, and K. McGuinness. Multi-ohjective in- terpolation training for robustness to label noise. farXiv:2012.04462) Mar. 2021. URL http://arxiv org. abs 2012. 04462 arXiv:2012.04462 [cs].
[18] V. Papyan, X. Han, and D. L. Donoho. Prevalence of neural collapse during the terminal phase of deep learning training. Proceedings of the National Academy of Sciences, 117(40): 24652-24663, 2020.

---

[19] G. Patrini, A. Rozza, A. Krishna Menon, R. Nock, and L. Qu. Making deep neural networks robust label noise: A loss correction approach. Proceedings of the IEEE conference on computer vision and pattern recognition, 2017.
[20] S. Qiu, A. Potapezynski, P. Izmailov, and A. G. Wilson. Simple and fast group robustness by automatic feature reweighting. In Proceedings of the 40th International Conference on Machine Learning, 2023.
[21] S. Sagawa, P. W. Koh, T. B. Hashimoto, and P. Liang. Distributionally robust neural networks. In International Conference on Learning Representations, 2020.
[22] N. Stromberg, R. Ayyagari, M. Welfert, S. Koyejo, and L. Sankar. Robustness to subpopulation shift with domain label noise via regularized annotation of domains, 2024.
[23] Sypherd, M. Diaz, J. Cava, G. Dasarathy, P. Kairouz, and L.. Sankar. tunable loss function for robust classification: Calibration, landscape, and generalization. IEEE Transactions on Information Theory, 68(9))6021 --001,, 2022.
[24] T. Sypherd, R. Nock, and L. Sankar. Being properly improper. In K. Chaudhuri, S. Jegelka, L. Song, C. Szepesvari, G. Niu, and S. Sabato, editors, Proceedings of the 39th International Conference on Machine Learning, volume 162 Proceedings of Machine Learning Research, pages 20891-20933 PMLR, 17-23 Jul 2022. URL https: https: wttp://////oocecen......amo www.iinnns........mmm..... mlr.prsss
html
[25] J. Wei, Z. Zhu, H. Cheng, T. Liu, G. Niu, and Y. Liu. Learning with noisy labels revis- ited: study using real-world human annotations. In International Conference on Learning Representations, 2022.
[26] M. Welfert, N. Stromberg, and L. Sankar. Theoretical guarantees of data augmented last layer retraining methods, 2024.
[27] H. Yao, Y. Wang, S. Li, L. Zhang, W. Liang, Zou, and C. Finn. Improving out-of-distribution robustness via selective augmentation. In Proceedings of the 39th International Conference Machine Learning, 2022.
12

---

A Experimental Details
The upstream base models for all the datasets which are considered taken from [22]. This includes all the hyperparameters, data augmentations and training procedures that we use for the upstream models. We use these base models to generate the embeddings for the predefined validation and test splits of the datasets. In our experimental setup, we assume access to a small set of clean data which we use for validation and hyperparameter selection. We split the validation data into halves. One half is used as the aforementioned clean set for validation and the other half is used for training during hyperparameter selection. During the final testing, we use the entire (noisy) validation split for retraining and the test split for testing. Once we do the hyperparameter selection, we run the algorithms over 10 different noise seeds and report the accuracy and variance over these runs. This procedure is repeated for each dataset and each noise level.
A.1 Last Layer Retraining Methods
For the methods that involve only last-layer retraining (either with downsampling upweighting), we only tune c, which the inverse the the regularization strength. For all datasets, we tune over 10 values equally spaced on the log scale ranging from le-4 to 1.
A.2 RAD
For each dataset, we fix the с values for both the identification and retraining models. We get these values from [22]. We tune the upweight factor for each dataset and each noise level. The hyperparameter values and ranges used are given in Table 7 The identification model implemented using the PyTorch library and the retraining model is implemented using the sklearn. diiner_mmodee Logisti cRegression package. The learning rate (id) is the learning rate of the identification model and the epochs (id) the number of epochs used to train the identification model.
A.3 kNN-RAD
We follow the same procedure for KNN-RAD as we did for RAD but with the added kNN based label spreading preprocessing step. addition to the upweight factor, we also tune n_neighbors, which is the number of nearest neighbours used in the kNN algorithm. When there is no noise, we fix the n_ -_neighbors value at 1. use the sklearn. neighbors. KNeighborsClene cslassifirr package to perform the label spreading step. The ranges and hyperparameter values used are given in Table 8
A.4 SELF
We implemented misclassification-SEII using code adapted from LaBonte et al. 11 that it would be compatible with our setup where we use pre-generated embeddings from the base models. We fix the f finetuning steps which the number of steps of fine-tuning we perform once construct the class balanced error set. We tune the learning rate and the number of points that are selected for class balancing. The hyperparameter values and ranges used are given in Table
A.5 KNN-SELF
The procedure for KNN-SELF is the same as SELF but with the added kNN based la- bel spreading preprocessing step. We fix hyperparameters using the values selected in the hyperparameter selection in SELF We additionally tune n_neighbors. We use the sklearn. wew.ghbor...leiggbrrse.......e.e KWWeighborsClassiff.
package to perform the label spreading step. The ranges and hyperparameter values used are given in Table 10
13

---

Table RAD Hyperparameters
Dataset
C (id)
(retraining)
LR (id)
epochs (id)
upweight factor range
CelebA
6.16e-4
0.007848
le-5
6
[5. 10, 25, 50]
Waterbirds
3.0e-6
0.143845
le-5
60
[5, 10, 25, 50]
CMNIST
33.6
0.007848
le-5
6
3, 20,
Civilcomments
6.95e-07
0.001833
le-5
6
[1, 6, 10]
Table 8: KNN RAD Hyperparameters
num neighbors range
upweight factor
Dataset
(id)
(retraining)
LR (id)
epochs (id)
range
CelebA
6.16e-4
0.007848
le-5
[5. 11, 21]
[10, 25, 50, 75]
Waterbirds
3.0c-6
0.143845
le-5
60
[5, 21,
[10, 25, 50. 75]
CMNIST
33.6
0.007848
le-5
[3, 7]
[1, 20, 30]
Civilcomments
6.95e-07
0,001833
le-5
11,
[6. 25, 50]
Table 9: SELF Hyperparameters
Dataset
fine-tuning steps
learning rate range
num points range
CelebA
500
[1e-6, 1e-5, le-4]
[2. 20, 100]
Waterbirds
500
[1e-4, 1e-3, le-2]
[20, 100, 500]
CMNIST
500
[le-5, le-4, Te-3]
[100, 500, 700]
Civilcomments
200
[1e-6, le-5, le-4)
[20, 100, 500]
Table 10:
- Hyperparameters
Dataset
fine-tuning steps
learning rate
num points
num neighbors
CelebA
500
le-5
2
[11, 25,
Waterbirds
500
le-4
500
[5, 11, 21]
CMNIST
250
le-5
500
[7, 41]
Civilcomments
200
le-6
500
[11,31,41]
A.6
Compute Resources
Experiments in Section Appendix([wwrr conducted on supercomputing cluster using NVIDIA GPUs for hardware acceleration. Most compute time is spent training base models which needs be done just once per dataset. Beyond that, experiments finish within hours.
B RAD Fails Under Label Noise
Consider the data distribution introduced in Yao et al. 27 (also used in (6] with group-conditional Gaussians aligned such that the difference between means within class is given by [C1,0, .., e Rd and the difference between means across classes is given by [0, C2, .......... Rd. That is, we have axis-aligned core and spurious features. Refer Figure 3 for visual.
Proposition 2 (Axis-Aligned Gaussian Mixture). Let RAD use the fixed upweighting scheme le El For the dataset described above, with C2 > C1 > for sufficienlly large Co. RAD fails entirely when learning with symmetric label noise p > 0. Otherwise, RAD fails if > p > 2 achieving lower worst-gan corst-group accuracy than ERM.
Proof. We assume that X, the l regularization strength of the biased classifier, is large enough that only the first (spurious) second (core) feature is learned. Consider the two cases separately:
14

---

0.
0.0
0.-
-03
-0.6
-14
-5.2
3.4
0.6
-34
-04
0.0
0.2
0.6
5.8
(a) Error Set
(b) Upweighted points
Figure 3: Label noise causes the RAD algorithm to select, and then upweight, the incorrect error set. We show that RAD fails under suffient SLN for imbalanced settings.
Spurious Feature Learned Consider the error set &. is made of up clean minority samples and noisy majority samples. When upweighting, the effective noise level in the retraining set will increase for the majority and decrease for the minority. For 2np < p < 5. as goes to O, the effective noise in the upweighted majority is 50% and 0% in the upweighted minority. In this case, the optimal separator will split the majorities and correctly classify the minorities. By assumption, C2 > C1 so the & penalty in the retraining step will force the spurious feature to be learned again. Note that ERM would learn classifier biased to the majorities, but not be restricted to only the spurious feature. Thus RAD performs worse than ERM.
Core Feature is Learned The error set & now consists of entirely noisy samples which are upweighted by a factor of -=e This results in an effective noise level at retraining of 50%, making the retraining task impossible. Thus RAD fails.
C a-RAD, Why Robust Losses are Not Enough
may tempting to believe that simply using a robust loss should enough to make two-step methods robust to label noise. The issue is that while robust losses can learn a classifier which performs well on clean data, it will (correctly) misclassify noisy examples. This leads to noisy points (which will much more likely to be from majority group) being selected for the error set which is used to retrain the final classifier. Thus the final classifier will not be trained on data from minority groups as intended, but mostly majority points, exacerbating unfairness. To demonstrate this, we train RAD [22] using a-loss in the identification step. a-loss [23] has been demonstrated to be robust to symmetric label noise both theoretically [24] and empirically (24 23).
We first examine the types of points which are selected by RAD in the error set. In Figure 4 we see that for all noise levels, true minority examples are misclassified (and therefore selected) but as the noise increases, the amount of noisy (former) majority points increases as well. These points drown out the effect of the true minority points, causing failure of RAD at large noise levels. We see in the Table IT that even when training with this robust loss, worst-group accuracy experiences dramatic dropoff at larger noise levels. This is the same failure mode that is demonstrated with vanilla cross entropy loss in the main text Section
Table 11: a-RAD
Label Noise (%)
Dataset
0
15
20
CelebA
79.33 (0.48)
83.78 (1.28)
80.67 (1.78)
58.07 (0.1)
46.45 (0.15)
CMNIST
91.68 (0.37)
88.03 (1.47)
90.56 (1.08)
80.68 (1.08)
47.17 (2.56)
15

---

Alpha RAD
ID model sample selection analysis
1750
True minority samples
Noisy minority samples
1500
1250
Number samples
1000
750
500
250
15
20
Noise level (%)
Figure 4: RAD trained with a-loss is able to capture minority points at all noise levels, but an increasing number of noisy majority points are selected noise increases. This leads to poor downstream fairness
NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We propose drop-in correction which is able to achieve SOTA worst-group accuracy across several datasets as claimed the abstract.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals are attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We point out that we use clean embeddings and have clean holdout dataset, which is common the literature. We additionally provide references that suggest clean embeddings may not be necessary.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings,
16

---

model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged
the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [NA]
Justification:
No theoretical results are presented
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: Full experimental details are provided in the appendix including datasets, model details, and hyperparameters. Algorithms included in the main body. Code will be released publically on GitHub and is included as supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
17

---

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome describe the particular way they provide for reproducibilitty In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: Code is included in supplemental materials along with documentation. Code will additionally be released on GitHub after acceptance.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
www.iisssiippcccc.ooo for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
18

---

Answer: [Yes]
Justification: Data splits discussed in main body and training details are available in the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: Standard deviation of presented results are given over 10 independent runs. Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
These details are provided in the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
19

---

Question: Does the research conducted in the paper conform, in every respect. with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: Every step is taken ensure that the code of ethics is adhered including providing resources for reproducibility and discussions on limitations and societal impact.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Impacts and limitations are discussed in the "Discussion and Limitations" section. Included are both positive and negative societal impacts.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: No models are released and all data used is from publicly available datasets.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
20

---

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All datasets are given appropriate citations in the experimental section of the main body.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the hatpssttss.pprsssttts. paperswi thcode. com com/datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is available online, the authors encouraged to reach out the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Anonymized code is provided along with documentation on its execution.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmdel part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification:
No human subjects were used.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
21

---

Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethies, workers involved in data collection, curation,
or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: No human subjects were used.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
22


Reviews:
[{"review_id": "qjBgMTjd1f", "reviewer": "Reviewer_9x3j", "summary": "This paper examines the recently introduced last-layer retraining (LLR) method, which focuses on reweighting features to ensure fairness and improve worst-group performance with minimal group annotation. The authors point out the shortcomings of the LLR method, particularly when label noise is present. To address this, they propose a label correction method using label propagation, assuming that LLR operates on largely separable embeddings. This new approach enhances the performance of state-of-the-art LLR methods under label noise.", "questions": "- The authors assume the need for clean data, which I believe is a strong assumption for real-world applications. How do RAD and SELF perform when using only the clean data (set aside for validating the proposed method), given that these methods are designed to be sample-efficient alternatives?\n- Can the authors show effectiveness of the proposed method in multi-class and multi-bias dataset [2]?\n\nReferences\n\n[1] Arefin, Md Rifat, et al. \"Unsupervised Concept Discovery Mitigates Spurious Correlations.\" Forty-first International Conference on Machine Learning, 2024.\n\n[2] Li, Zhiheng, et al. \"A whac-a-mole dilemma: Shortcuts come in multiples where mitigating one amplifies others.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.", "limitations": "Limitations of the work is discussed well in the paper.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 2, "strengths": "- The proposed method effectively combines existing works.\n- Shows very strong performance.\n- The  paper is very well-written and easy to follow.", "weaknesses": "- The work relies on assumptions such as the need for clean data and the availability of high-quality embeddings.\n- Lack of originality.\n- Missing recent work [1] which identifies minority groups without using an early-stopped model, instead relying on unsupervised object-centric concept discovery.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the reviewer’s considered response to our submission. We would like to politely push back on a few points and answer the reviewer’s questions (Qx) and weaknesses (Wx) in turn. Note that our references continue numbering from the review.\n\n (Q1/W1)\tRegarding the need for clean embeddings, as we point out in the discussion and in section 3 of our submission, Iscen, et al. [3]  explicitly exploit the robustness of these embeddings to label noise in order to detect and correct outliers. To assess the downstream effect of noise in the embedding, we test our method on CelebA and Waterbirds using embeddings learned with 20% label noise. See Tables 1-2 in the general response for full results. We see that both RAD and SELF perform very poorly in this scenario, though RAD seems much more resilient to poor quality embeddings. As the noise increases in the finetuning set, RAD and SELF both decline quickly in WGA. Utilizing kNN label spreading, however, provides much improved robustness. Thus we conclude that our method is robust to violations of our “clean embeddings” assumption.\n\n (Q1)\tRegarding the performance of the RAD and SELF using only the clean holdout, we thank the reviewer for their suggestion of a new baseline. While RAD and SELF are generally sample efficient, SELF specifically downsamples the error set and so will likely suffer more in this setting. Regardless, we have run a preliminary experiment in this direction: we restrict our finetuning set to the clean holdout (used for validating our method) and train RAD and SELF in the usual manner. On CelebA, RAD achieves 74 $\\pm$ 9.92 and SELF achieves 80.89 $\\pm$ 0. This is beaten by kNN-RAD up to 30% SLN, suggesting that there is more information to be gained by utilizing the noisy embeddings. On Waterbirds, RAD achieves 83.4 $\\pm$ 6.35 and SELF achieves 60.57 $\\pm$ 12.29. Here using a kNN method is superior at every tested noise level. These tests use half the available data (we assume the validation split is clean), but this could conceivably be reduced by different hyperparameter tuning strategies. In that case, we expect the gap between kNN-corrected methods and vanilla two-stage methods to grow.\n\n (W3)\tWe appreciate the reviewer’s suggestion of [1], a very recent work on unsupervised concept discovery. While their method has the advantage of reduced reliance on holdout annotations, it appears significantly more computationally intensive, involving training two embedding networks to identify concepts. The aim of our paper is to leverage existing embeddings to train a fair classifier with limited data, thus increasing the reuse of powerful pre-trained models. We believe, however, that these concepts could be used to improve future last layer retraining (LLR) methods. \n\n (Q2)\tThe multi-class, multi-bias setting is a very interesting one and how well shortcuts (unintended decision rules that are unable to generalize, i.e., spurious features) can be mitigated with access only to the LLR tools without access to jointly optimizing the embeddings is not fully clear. For LLR-only methods, indeed, approaches such as DFR [4] and other related LLR methods explicitly optimize to reduce the reliance of the pretrained model on multiple shortcuts which have already been learned by the embeddings. Unfortunately, due to time constraints we are not able to run experiments with these additional datasets, but these datasets present meaningful benchmarks for future investigation.\n\nWe once again thank the reviewer for many valuable suggestions, and we hope that we were able to address the reviewer’s concerns sufficiently and demonstrate the valuable contribution of our method, especially when clean data is limited.\n\n**References**\n\n[3] A. Iscen, J. Valmadre, A. Arnab, and C. Schmid. Learning with neighbor consistency for noisy labels. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4672–4681, 2022\n\n[4] P. Kirichenko, P. Izmailov, and A. G. Wilson. Last layer re-training is sufficient for robustness to spurious correlations. In The Eleventh International Conference on Learning Representations, 2023.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mFDsqPcIA4", "reviewer": "Reviewer_e2kD", "summary": "This paper addresses the challenge of improving worst-group accuracy (WGA) in machine learning models, particularly in the presence of noisy labels. The authors focus on last-layer retraining (LLR) methods, which have emerged as an efficient approach for correcting existing base models to ensure fairness across subgroups.\n\nThe key contributions of the paper are:\n\n1. Highlighting the vulnerability of state-of-the-art LLR methods, specifically SELF and RAD, to label noise in the training data.\n\n2. Introducing a novel label correction preprocessing method based on k-nearest neighbors (kNN) label spreading. This method significantly improves the performance of LLR methods under label noise conditions.\n\n3. Proposing two new algorithms, kNN-RAD and kNN-SELF, which combine the kNN label spreading technique with existing LLR methods (RAD and SELF, respectively).\n\n4. Demonstrating the effectiveness of their approach across various spurious correlation datasets, including CMNIST, CelebA, Waterbirds, and CivilComments.\n\nThe authors show that their proposed methods, particularly kNN-RAD, achieve state-of-the-art performance in terms of worst-group accuracy without requiring domain annotations during training. The approach is competitive with, and in some cases outperforms, domain-aware methods and full model retraining approaches like END.\n\nThe paper provides both theoretical insights and empirical evidence for the effectiveness of kNN label spreading in correcting noisy labels. It also discusses the relationship between the optimal number of nearest neighbors and the level of label noise, offering practical guidance for implementing the method.\n\nOverall, this work presents a simple yet effective approach to enhancing the robustness of last-layer retraining methods for improving worst-group accuracy in the presence of label noise, addressing an important challenge in the field of fair machine learning.", "questions": "1. Robustness to noisy embeddings:\n   Question: How does the performance of kNN-RAD and kNN-SELF change when the base model is trained on noisy data, violating the clean data assumption for embeddings?\n\n2. Optimal selection of k nearest neighbors:\n   Question: Given that the optimal number of nearest neighbors ($k$) depends on the noise level, which is often unknown in practice, how can practitioners best select this crucial hyperparameter?\n\n3. Extension to multi-class problems:\n   Question: How does the proposed method extend to multi-class classification problems, and what additional challenges might arise in this setting?", "limitations": "Authors have discussed the limitations sufficiently.", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 2, "strengths": "### Originality:\n1. It creatively combines existing ideas from label propagation and worst-group accuracy correction, applying them in a novel context to address label noise in fairness-oriented model corrections.\n2. The authors introduce a new problem formulation by focusing on the robustness of last-layer retraining methods to label noise, an issue that had not been thoroughly addressed in previous work.\n3. The proposed kNN label spreading preprocessing step is an innovative approach to improving the robustness of existing methods like RAD and SELF without fundamentally altering their core algorithms.\n\nQuality:\n1. The authors provide both theoretical insights (e.g., the relationship between optimal k and noise level) and extensive empirical evidence to support their claims.\n2. The experiments are comprehensive, covering multiple datasets (CMNIST, CelebA, Waterbirds, CivilComments) and comparing against state-of-the-art methods as well as oracle baselines.\n3. The paper includes detailed ablation studies, examining the effects of different numbers of neighbors and spreading rounds, which adds depth to the analysis.\n4. The authors are transparent about limitations and potential issues, such as the dependence on well-separated embeddings.\n\nClarity:\nThe paper is well-structured and clearly written:\n1. The problem setup and background are concisely explained, making the work accessible to readers familiar with machine learning concepts.\n2. Algorithms are presented in pseudocode, enhancing reproducibility.\n3. Results are presented in well-organized tables with clear explanations of the experimental setup and findings.\n4. The discussion section provides insightful analysis of the results and addresses potential limitations.\n\nSignificance:\n1. It addresses an important problem in fair machine learning – improving worst-group accuracy in the presence of noisy labels – which is crucial for real-world deployments of AI systems.\n2. The proposed method is computationally efficient (last-layer retraining) and does not require domain annotations, making it widely applicable in various settings.\n3. The strong performance across different datasets suggests broad applicability of the approach.\n4. By improving the robustness of existing methods, this work potentially extends the usability of fairness-correcting algorithms in more challenging, real-world scenarios.\n5. The insights provided about the relationship between noise levels and optimal nearest neighbors could guide future research in this area.", "weaknesses": "While the paper presents valuable contributions, there are some areas where it could be improved:\n\n1. Limited theoretical analysis:\n   The paper provides some theoretical insights, particularly referencing Gao et al.'s work on kNN classification with label noise. However, a more rigorous theoretical analysis specific to this method could strengthen the paper. For instance:\n   - A formal proof of convergence for the label spreading algorithm in this context.\n   - Theoretical bounds on the expected improvement in worst-group accuracy after applying kNN label spreading.\n   - An analysis of how the method's performance depends on the separation of classes in the embedding space.\n\n2. Sensitivity to hyperparameters:\n   The authors acknowledge that the choice of k (number of nearest neighbors) is crucial and depends on the noise level. While they provide some empirical guidance, a more systematic approach to selecting k would be beneficial. For example:\n   - A heuristic method for estimating the optimal k based on dataset characteristics and estimated noise level.\n   - An analysis of the method's sensitivity to suboptimal choices of k.\n\n3. Assumptions about embedding quality:\n   The method relies heavily on the quality of the embeddings from the base model. While the authors discuss this limitation, they could expand on:\n   - How the method performs when the base model is trained on noisy data, violating the clean data assumption.\n   - Potential approaches to improve embedding quality in the presence of noisy labels.\n\n4. Limited exploration of other label propagation techniques:\n   The paper focuses on kNN label spreading, but other label propagation techniques exist. A brief comparison with alternative methods (e.g., graph-based label propagation) could provide more context for the choice of kNN.\n\n5. Comparison with other robust learning methods:\n   While the paper compares with END and domain-aware methods, a comparison with other robust learning techniques (e.g., importance reweighting, robust loss functions) could provide more context for the method's effectiveness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the reviewer’s thorough analysis of our submission and hope that we can answer some of the questions presented. We answer each question (Qx) and weakness (Wx):\n\n (Q1/W3) \tRegarding the need for clean embeddings, as we point out in the discussion and in section 3 of our submission, Iscen, et al. [1]  explicitly exploit the robustness of these embeddings to label noise in order to detect and correct outliers. To assess the downstream effect of noise in the embedding, we test our method on CelebA and Waterbirds using embeddings learned with label noise. We see that both RAD and SELF perform very poorly in this scenario, though RAD seems much more resilient to poor quality embeddings. As the noise increases in the finetuning set, RAD and SELF both decline quickly in WGA. Utilizing kNN label spreading, however, provides much improved robustness. Thus we conclude that our method is robust to violations of our “clean embeddings” assumption.\n\n (Q2/W2)\tRegarding the selection of k nearest neighbors, it is possible to estimate the noise parameter from data as suggested in [2], but in practice k is relatively easy to tune through cross validation. On CelebA, we examine the performance of kNN-RAD with suboptimal k and see that selecting k larger than optimal results in a steady decline in WGA, but selecting k too small yields much worse downstream performance. This suggests that erring on the side of large k (10-20 in our tests) is generally better than too small. Even suboptimal performance (too large of k) results in vastly increased robustness over vanilla RAD (0% WGA). Full results are in Table 3 of the general rebuttal.\n\n (Q3)\tThe problem of label propagation in the multi-class setting is well studied, and the implicit geometry of multi-class classifiers is still amenable to propagation in the latent space. The noise model can be more complex in the multi-class setting, but if the noise flips to other classes completely at random, then our proposed method will still be effective. Additionally, both RAD and SELF have been shown to be effective in the multi-class setting. Due to time limitations, we do not have results on a multi-class dataset, but this certainly a good direction to explore.\n\n (W1)\tRegarding additional theoretical analysis, our method is inspired by prior theoretical work which proves the robustness of kNN to label noise and combining this with empirically effective, but fragile, two-stage correction methods. We carry over the guarantees of robustness for kNN, but work remains to be done to understand the theoretical guarantees of two-stage corrections on their own. We are currently pursuing this direction, and we believe theoretical analysis for the interplay between kNN and two-stage corrections is promising future work. Experiments suggest that not only the separation of the classes makes a difference as suggested, but also the separation of subgroups within classes. \n\n (W4)\tWe appreciate the reviewer’s suggestion of additional label propagation techniques and believe that this could be an interesting path moving forward. Label propagation on the kNN graph is appealing because of its relative simplicity and the relationship between kNN and the downstream linear classification task in RAD and SELF. Indeed, as the number of nearest neighbors grows, the classification boundary becomes more and more (locally) linear, which in turn aids robustness of the downstream LLR model learned for fairness correction. On some datasets (e.g., CMNIST), this linearity induced by large k may be undesirable, and another graph structure or label propagation method may be more appropriate. The joint design of fairness correction and label correction in this manner is a compelling area of future research.\n\n (W5)\tRegarding comparison to robust loss functions, in our preliminary exploration, we believed that these methods may have promise, but our experimental results were poor. Fundamentally, the objective of a robust loss is to learn a classifier on noisy data that predicts well on clean data. This means that noisy data is (correctly) misclassified by these models and, thus, if used in the first stage of RAD or SELF, would promote the inclusion of these noisy points into the error set. This, in turn, assigns more weight to noisy examples in the final retraining step, thereby dramatically reducing performance and fairness. Alternatively, label propagation corrects these labels explicitly before training, which prevents noisy points from dominating the error set. \n\nWe hope we have adequately addressed the presented concerns and demonstrated the significance of our contribution.\n\n**References**\n\n[1] A. Iscen, J. Valmadre, A. Arnab, and C. Schmid. Learning with neighbor consistency for noisy labels. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4672–4681, 2022\n\n[2] Patrini, G., Rozza, A., Krishna Menon, A., Nock, R., and Qu, L. Making deep neural networks robust to label noise: A loss correction approach. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2017.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "sD17D7KYhh", "reviewer": "Reviewer_phDr", "summary": "This paper proposes a simple kNN-based label noise correction strategy to improve the performance of two-stage last-layer retraining methods for group robustness under moderate label noise. The authors show that the performance of RAD and SELF deteriorates quickly when label noise is present in the held-out dataset and show that their kNN method achieves better worst-group accuracy on several benchmark datasets.", "questions": "1. Should lowercase $x_j$ be used in Section 3 instead of uppercase? I thought uppercase $X$ represented the entire dataset while lowercase $x_j$ was a single point.\n2. Are group annotations necessary for hyperparameter tuning of the kNN methods? This is an important limitation and should be made more explicit.\n3. Regarding Weakness #2, what is the performance of the proposed method if the finetuning dataset is noisy?", "limitations": "The limitations and social impact of the proposed kNN method are sufficiently discussed, but my concerns from the Weaknesses section may constitute important limitations if not addressed.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. This paper deals with an important problem in group robustness, which is mitigating the impact of class label noise when group annotations are not available. Label noise is especially relevant for methods which use class annotations and model knowledge as a proxy for group annotations (e.g., RAD and SELF).\n\n2. The proposed kNN method is post-hoc and training-free, which means computational cost is negligible and it can easily be added to existing training pipelines. \n\n3. Benchmark evaluation is comprehensive, covering 4 well-known datasets and recent competitive methods, and using means and standard deviations over 10 seeds.", "weaknesses": "1. I encourage the authors to discuss any “baseline” label noise in the given datasets; for instance, Waterbirds is known to contain incorrect labels [1] and therefore the standard dataset has non-zero label noise. This suggests that methods like RAD and SELF might already be robust to a small amount of label noise.\n\n2. I am confused by the assumptions in Section 2. It is stated that $f$ is a neural network pretrained on clean data, whose last layer is then retrained to obtain the final model. What exactly is this pretraining dataset? Is it the weight initialization (e.g. ImageNet) or the downstream dataset used for ERM finetuning (e.g. Waterbirds)? If it is the former, I believe the assumption is justified, but the training procedure should be clarified to include a round of ERM finetuning. If it is the latter, I believe the assumption is not justified, as the held-out set for LLR is essentially a random subset of the finetuning dataset and should therefore obey the same label distribution. Indeed, if the finetuning dataset was clean but the held-out dataset was noisy, one should just throw out the held-out dataset and hold out a subset of the finetuning dataset instead.\n\n3. The authors focus on the “misclassification” version of the SELF algorithm. However, [2] shows that misclassification is actually the worst version of SELF, particularly on CivilComments, and they ultimately propose early-stop disagreement SELF which has much better performance. What is the justification for using the misclassification version of SELF when its initial performance is so low, and why is disagreement SELF not used? I wonder if this would also help with the variance problem of kNN-SELF noted in Section 5, as [2] show reduced variance using the disagreement technique as well.\n\n***References***\n\n[1] Taghanaki et al. “MaskTune: Mitigating Spurious Correlations by Forcing to Explore”. NeurIPS 2022.\n\n[2] LaBonte et al. “Towards Last-layer Retraining for Group Robustness with Fewer Annotations”. NeurIPS 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their thoughtful comments, especially their acknowledgment of the strength of our evaluation and method in general. We would like to address each question (Qx) and weakness (Wx) individually. Note that our references continue numbering from the review.\n\n (W1)\tRegarding the baseline level of noise in the data, while it may be true that these datasets have inherent noise, the noise is consistent across all data splits, meaning that there is no distribution shift from training time to test time. Therefore RAD and SELF are likely not “robust,” they just fit to the distribution they are trained on. Further discussion about the limitations of current benchmarks is always warranted, though, and we thank the reviewer for their comment. \n\n (W2/Q3)\tTo clarify the noise model, we currently make no assumptions about the pretraining set (e.g., ImageNet) and assume that the full-finetuning dataset (e.g., training split of CelebA) is clean. While this assumption may seem strong, as we pointed out in section 3 of our paper and the discussion section, Iscen, et al. [3] find that embeddings are generally fairly robust to label noise, and only the final classification layer is strongly affected by noise. Furthermore, all last-layer retraining methods should be affected similarly by the quality of the embeddings. Still, we think it is important to examine this assumption more closely, and have run preliminary experiments to demonstrate that our method is robust to the violation of this assumption. Full results are shared in Tables 1-2 in the General rebuttal. We full finetune models for both CelebA and Waterbirds with 20% label noise and then use these embeddings to test the LLR methods. We see that both RAD and SELF perform very poorly in this scenario, though RAD seems much more resilient to poor-quality embeddings. As the noise increases in the finetuning set, RAD and SELF both decline quickly in WGA. Utilizing kNN label spreading, however, provides much-improved robustness, on par or better than gains we see in the clean-embeddings experiments. Thus, we conclude that our method is robust to violations (even major ones) of our “clean embeddings” assumption.\n\n (W3)\tWe focus on the misclassification variant of SELF because it requires the least side information about the unfair base model. While ES-SELF performs well on CivilComments, it requires access (as suggested in [2] and confirmed in their codebase) to early-stopped versions of the base-model to which we do not assume access. Additionally, there is no reason to believe that disagreement should solve the problem of noisy labels. Indeed, noisy points may be unnecessarily included in the error set for upweighting. \n\n (Q1)\tRegarding the capitalization of $X$ in section 3, we intend the use of capitals to denote random variables and use this notation when discussing theory. For the algorithms, we use lowercase x to denote that we have been given a realization of the random variable $X$. We will ensure that this is clarified in the camera-ready version of the paper.\n\n (Q2)\tCurrently, the hyperparameter is selected using the clean, labeled validation set, but this requirement is not firm. Indeed, in our testing, we see strong agreement between the target predictive power of kNN on validation data and WGA on clean validation data (that is, the better we recover target labels, the better our downstream WGA is). Thus, while we currently use domain annotations to tune $k$, there is promise in proxy methods for tuning this important hyperparameter. We will make this point clear in the camera-ready version of the paper.\n\nWe hope that this rebuttal helps to assuage your concerns and highlights the important contributions of our method.\n\n**References**\n\n[3] A. Iscen, J. Valmadre, A. Arnab, and C. Schmid. Learning with neighbor consistency for noisy labels. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4672–4681, 2022", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We thank all the reviewers for their insightful comments, and are grateful that they found our work well-written and sound. We would like to address the most common concerns in a general comment and we hope that this demonstrates the strong, and sometimes unexpected, contribution of our method.
 - **Assumption of clean embeddings**:  we can now show through additional experiments that our proposed method is robust to the violation of this assumption, even with large amounts of noise in the training of the embeddings. We ran such experiments for CelebA and Waterbirds datasets. Indeed, in Tables 1-2, we see that kNN label spreading combined with two-stage LLR correction shows massive improvements in WGA over two-stage corrections alone on both CelebA and Waterbirds when the embedding model is learned on noisy data. This demonstrates that the clean embeddings assumption can be weakened without a major hit to performance over vanilla methods.
 - **Use of a clean holdout dataset**: we ran additional experiments to understand if it suffices to train on a smaller clean holdout set using two-stage methods such as RAD and SELF. Our results are in line with our expectation that when using only this clean holdout to train vanilla methods as suggested by Reviewer 9x3j, RAD and SELF have decreased WGA due to the limited amount of training data. On the other hand, if we were to use the larger noisy training dataset, kNN label spreading allows these methods to train on more data and provides downstream WGA benefits even for very large amounts of noise. This is a perfect example of the utility of our method in real-world scenarios where clean data may be limited. In summary, these results validate the original hypothesi of the paper that the use of noisy training data meaningfully increases the downstream performance of two-stage correction methods when cleaned using kNN label spreading.
 - **Selection of optimal $k$** : To better understand the robustness of our proposed method to suboptimal choices of k, we examine the downstream WGA of two-stage methods after kNN label spreading. We see in Table 3 that choosing k too large has a detrimental effect on downstream WGA, but the effect is relatively minor. Choosing k significantly too small can result in a failure as pointed out in Figure 1 of the main paper, but this is easily corrected by erring on the side of large k. This aligns with the idea that classes should be nearly linearly separable in the latent space.
 - **Novelty of our method**: The key novelty of our work is exploiting the inherent structure of the latent space of deep neural networks to efficiently correct for label noise, thereby dramatically increasing the robustness of increasingly popular two-stage fairness corrections. Our results demonstrate that, although our method is lightweight in both data and compute requirements, kNN-RAD and kNN-SELF are significantly more robust to label noise than their vanilla counterparts.

We will ensure that these changes are made for the camera-ready version should the manuscript be accepted.

Meta-review: This paper proposes a robust method for last layer fair model corrections, which tackles the problem of worst group accuracy when the labels are noisy.  Their method uses label spreading from a latent NN graph as a corrective measure on top of last layer fairness correction.  The paper addresses an important problem in fair ML, and constitutes an advance in one of the few effective fairness corrections.  The authors do a good job of highlighting the vulnerability of existing methods.  The reviewers note the strength of the theoretical justification of the method, and the empirical comparisons (which include ablation studies).  Finally, the authors address several criticisms in a revision, particularly regarding the optimal selection of k.  A few weaknesses were pointed out, including limited comparison to other label propagation techniques, and the potentially restrictiveness of the assumptions.
Decision: Accept (poster)