Fairness-aware Anomaly Detection via Fair Projection
Authors: Feng Xiao
Xiaoying Tang
Jicong Fan
Venue: NeurIPS 2025 poster ()
Keywords: anomaly detection
group fairnesss
deep learning
Primary area: general_machine_learning

Abstract: Unsupervised anomaly detection is a critical task in many high-social-impact applications such as finance, healthcare, social media, and cybersecurity, where demographics involving age, gender, race, disease, etc. are used frequently. In these scenarios, possible bias from anomaly detection systems can lead to unfair treatment for different groups and even exacerbate social bias. In this work, first, we thoroughly analyze the feasibility and necessary assumptions for ensuring group fairness in unsupervised anomaly detection. Second, we propose a novel fairness-aware anomaly detection method FairAD. From the normal training data, FairAD learns a projection to map data of different demographic groups to a common target distribution that is simple and compact, and hence provides a reliable base to estimate the density of the data. The density can be directly used to identify anomalies while the common target distribution ensures fairness between different groups. Furthermore, we propose a threshold-free fairness metric that provides a global view for model's fairness, eliminating dependence on manual threshold selection. Experiments on real-world benchmarks demonstrate that our method achieves an improved trade-off between detection accuracy and fairness under both balanced and skewed data across different groups.

Fairness-aware Anomaly Detection via Fair Projection
Feng Xiao Xiaoying Tang' Jicong Fan
School of Science and Engineering. The Chinese University of Hong Kong (Shenzhen),
Longgang, Shenzhen, Guangdong, 518172, P.R. China
Schooo of Data Science, The Chinese University of Hong Kong (Shenzhen), Longgang, Shenzhen, Guangdong, 518172, P.R. China
Abstract
Unsupervised anomaly detection is a critical task in many high-social-impact applications such as finance, healthcare, social media, and cybersecurity, where demographics involving age, gender, race, disease, etc. are used frequently. In these scenarios, possible bias from anomaly detection systems can lead to unfair treatment for different groups and even exacerbate social bias. In this work, first, we thoroughly analyze the feasibility and necessary assumptions for ensuring group fairness in unsupervised anomaly detection. Second, we propose a novel fairness- aware anomaly detection method FairAD. From the normal training data, FairAD learns a projection to map data of different demographic groups to a common target distribution that is simple and compact, and hence provides reliable base to estimate the density of the data. The density can be directly used to identify anomalies while the common target distribution ensures fairness between different groups. Furthermore, we propose a threshold-fres fairness metric that provides global view for model's fairness, eliminating dependence manual threshold selection. Experiments on real-worid benchmarks demonstrate that our method achieves an improved trade-off between detection accuracy and fairness under both balanced and skewed data across different groups.
Introduction
As machine learning techniques are increasingly being applied in high-social-impaan fields such as finance and justice, the fairness of machine learning systems receives surge of attention. There growing studies [Larson et al., [016 [endricks et al.) 2018 Dastin 2022) that exhibit discrimination in real-world machine learning systems. For instance, analysis Larson et al. 2016) the COMPAS (Correctional Offender Management Profiling for Alternative Sanctions), recidivism risk prediction system, shows strong correlation between recidivism prediction and race, where African-American individuals have a much higher risk of recidivism than Caucasians. is vital to eliminate or mitigate the possible disparity of machine learning algorithms between different demographic groups to ensure social fairness.
In response, many researchers Dwork et al. 201 2a Zemel al.) 2013 Zeng al. 2014 Hardt ct al. 2016 Zafar et al.) 2017a| Agarwal et al. 2019 Oh et al. 2022 Jovanović et al. 2023 have begun to propose fairness aware machine learning algorithms, where one of the most common paradigms is to learn a fair representation depending on a formal fairness principle (Hajian et al.
2016 Hardt et al. 2016 Zafar al. 2017b] Gajane 2017). However, previous works algorithm fairness often focused on supervised machine learning tasks [Hardt et al. 2016 Agarwal et al.) 2018
2019) and the study the fairness issue in unsupervised anomaly detection [Pang et 2021 is
scarce. Anomaly detection (AD), aiming at identifying anomalous samples in data, plays a crucial
"Corresponding author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

role in many important fields such as finance, healthcare, social media, and cybersecurity, where demographics, like age, gender, race, ethnicity, and disease, are used frequently. Given multiple groups (2 2) partitioned by protected social variable with multiple attribute values, fair AD method is supposed to ensure equal probabilities of samples being detected as anomalous (or normal) across different demographic g However, as shown by (Zhang and Davidson 2021]. existing AD methods suffer from unfairness to some extent. In addition. Meissen et al. [2023) and Wu et al. [2024) found that the fairness of unsupervised anomaly detection models is easily affected by sample proportion across different demographic groups.
There have been a large number of studies on different aspects of AD, such as semi- supervisee AD
(iiao et al., 2025a]. text AD [Xiao and Fan 2025], graph AD [Cai al. 2025]. AD on incomplete data [iiao and Fan 2024, Fan 2025 J. and model selection and hyperparameter tuning in AD (Dai and
Fan 2025]. Surprisingly, studies the literature focusing on fairness in unsupervised AD are quite
limited and incomplete. Although there have been several attempts such as (Deepak and Abraham
2020, /Zhang and Davidson 2021, [Shekhar et al. 2021 Han et al. 2023]. we still encounter, at least, the following four problems or difficulties:
I The feasibility and necessary assumptions of ensuring fairness in unsupervised anomaly detection haven't 't been clearly discussed in the literature.
II The trade-off between fairness and utility criteria (such as accuracy) does not meet pressing practical needs.
III There is still lack of global and convenient (threshold freesh evaluation metrics of fairness for unsupervised anomaly detection methods.
IV There is lack of research on the fairness issues under different data splitting strategies including balanced and skewed data splitting across demographic groups.
In this work, we attempt to address the four difficulties. We present a novel fairness-aware unsu- pervised AD method called FairAD. FairAD learns to map data from different demographic groups common target distribution, which ensures statistical parity for different groups in the target distribution space. The chosen target distribution is supposed to be simple and compact, where simplicity ensures that sampling from the target distribution is easy, and compactness aims to obtain a reliable decision boundary to distinguish between normal and abnormal samples. Furthermore, in order to effectively evaluate fairness in anomaly detection, we propose a novel threshold-free evaluation metric. Our main contributions are as follows.
We discuss the group fairness issue and introduce two fundamental assumptions for any faimess- aware (group fairness) unsupervised AD methods. Furthermore, we empirically demonstrate that the assumptions are reasonable in real-world scenarios. (for Difficulty [
We propose FairAD without introducing additional fairness regularization, which achieves a coordinated optimization process for the detection task and group fairness and improves the Stimess-utility trade-off, in comparison to existing methods. (for Difficulty MI
We introduce a threshold-fre fairness evaluation metric that holistically quantifies model fairness across the entire decision spectrum, eliminating dependence on manual threshold selection. (for Difficulty [IIp
We consider both balanced and skewed data-splitingg strategies across different demographic groups and evaluate all baselines in the two settings. (for Difficulty [VV]
The experiments on real-world datasets show that our method achieves an improved trade-off between detection accuracy and fairness and the results also verify the effectiveness of the proposed evaluation metrics of fairness. The source code is provided in supplementary materials.
Related Work
2.1 Fair Representation Learning
Fair representation learning (FRL) [Cerrato et al., 2024 focuses on mitigating biases and ensuring fairness in machine learning systems by transforming data into a latent space where sensitive attributes (e.g., race, gender) have minimal or influence on outcomes. It aims achieve equity in predictions across different demographic groups while maintaining task accuracy. The main technical routes
In this work, we focus on group fairness rather than individual fairness.

---

include: (1) adversarial learning to promote independence between latent features and sensitive
attributes [Xie et al. 2017 Madras et al., 2018 Zhang et al. 2018); and (2) mutual information and
variational inference [Louizos et al.] 2015 Moyer et al. 2018
Creager et al., 2019 Oh et al. [022]; ;
and (3) introducing fairness constraints [Agarwal al. 2018]. To some extent, these FRI. techniques
constitute key approach to building fair machine learning systems.
Building on the FRL techniques, a straightforward strategy for achieving fair anomaly detection is to construct two-stage pipelines: (1) generating fair embeddings using existing FRL methods, followed by (2) training an anomaly detector on these embeddings. However, this paradigm exhibits two critical limitations in unsupervised anomaly detection scenario: (1) (Task Compatibility) most FRL methods are not disentangled with downstream tasks (typically classification), making them incompatible with unsupervised anomaly detection where all training samples belong to a single (normal) class and lack auxiliary label information, and (2) (Detection Efficacy) on the other hand, the task-agnostic representation is not guaranteed to be useful in distinguishing between normal samples and anomalies, leading to low detection accuracy. In contrast, our proposed method introduces an end-to-end framework with fairness mechanisms specifically designed for unsupervised anomaly detection. Empirical results (see Section 4 also demonstrated that our proposed method achieves significantly better detection accuracy than the two-stage pipelines while maintaining comparable fairness.
2.2 Fairness in Anomaly Detection
Despite so many works on anomaly detection problems [Ruff et al. 2018 Cai and Fan 2022 Han
et al. 2022 Bouman et al., 2024 Zhang al. 2024 Dai and Fan 2025 Cai al. [202]] J, the studies
on the fairness of anomaly detection are limited. To the best of our knowledge, Davidson and Ravi
(020) first studied the fairness issue of outlier detection and proposed framework to determine
whether the output of an outlier detection algorithm is fair. Subsequently, Deepak and Abraham
[2020] studied the fairness problem of LOF (Local Outlier Factor) [Breunig et al. 2000) and proposed a strategy to mitigate the unfairness of LOF on tabular datasets, Zhang and Davidson [202]] studied the fairness problem of Deep SVDD (Ruff' et al. 2018 and proposed Deep Fair SVDD, which used an adversarial network to de-correlate the relationships between the sensitive attributes and the
learned representations. (Shekhar et al.
[202T] added statistical parity regularization and group fidelity regularization on AutoEncoder (AE) Hinton and Salakhutdinov, [006] to mitigate the unfairness
of AF-based anomaly detection methods. More recently, [Han al. [023) studied counterfactual
fairness, which is to ensure the consistency of the detection outcome in the factual and counterfactual
world to different demographic groups
Adversarial training [Zhang and Davidson 2021 is known to be unstable, and fairness regularization terms (Shekhar et |021] often compromise detection performance, and conterfacttul-based methods Han et al. 2023] introduce extra training complexity. In contrast to these methods, our proposed method achieves a simple and coordinated optimization process for the detection task and group fairness. Empirical results (See Section 4 also demonstrated that our method achieves superior detection accuracy compared these methods, while maintaining comparable or even better fairness.
3 Fairness-aware Anomaly Detection
3.1 Preliminary Knowledge
Unsupervised AD Let X' = {x1, X2, .x, C Edd be set of samples drawn from an unknown distribution Dx and the samples from D are deemed as normal data. A point x E Rd is deemed to be anomalous if x is not drawn from Dz. Then, the goal of the unsupervised AD is to obtain a decision function f Idd + {0, 1) by utilizing only X, such that fxx) 0 x is drawn from Dx and f(x if x is not drawn from D.. Note that this is standard setting of anomaly detection, followed by most unsupervised AD methods [Ruff et al. 2018 Goyal al. [2020] Han et al.) 2022 Fu et al. 2024 Xiao et al. 2025b), where models are trained exclusively on normal data. The main difference among unsupervised AD methods is the design of the decision function f.
Group Fairness Demographic parity, a.k.a. statistical parity (Dwork et al. 2012b). demands the existence of parity between different demographic groups, such as those defined by gender race.
3

---

We use S E S : {31, $2...., .k} to denote the sensitive or protected attribute and [S] = K 2 2. There are the following definitions of group fairness.
Definition 1 (Demographic parity [Agarwal et al. 2018). A predictor f X - y achieves demographic parity under a distribution over (x, S.y) where y E {0, be the data label if its prediction 1 == f(x) is statistically independent of the protected altribute S- that is, if ifP(((()
V b|S= = = -i for all & and y.
Definition 2 (Equal opportunity [Gajane] (017 Use the same notations of Definition D A predictor
achieves equal opportunity under a distribution over (x, S. y) if its prediction 9 = [(x) is
conditionally independent of the protected attribute S given the label y = 1- -that is, if Plù
1 1|s= = 8, = = IP(5- = y = for all 8.
In unsupervised AD. y O and y 1 represent normality and anomaly respectively. However, the training data do not include any labeled anomalous samples, which means the predictor / will never be guaranteed to learn sufficient information about the anomaly pattern. In Definition 2 (Equal opportunity), y = is presented explicitly and in Definition [ (Demographic parity). y presented implicitly because IP [f( = y S = s) and P
is [x( = ğ] depend on both normal samples
(y = 0) and anomalous samples (y- 1). that is IP [f() = 5 = P [f(x) = D y 0] x P [y 0 [f ú y 1] x P [v 11. Therefore, we have the following claim (proved in Appendix A.1
Claim In unsupervised AD, neither demographic parity nor equal opportunity can be meaningfully guaranteed without additional assumptions.
excluded. In Note that "meaningfully"" emphasizes the trivial solutions (x) 0 or 1 for any
fact, without additional assumptions, any fairness involving anomalous data cannot be guaranteed in unsupervised settings. It is worth noting that Shekharr et al. [021] considered the equal opportunity in unsupervised AD, where a fairness-unawarr AD model (base model) is utilized first to predict pseudo-label ý and then they used to ensure equal opportunity. Obviously, such a strategy has a significant limitation: the result of equal opportunity depends on the detection performance of the base model, for which fairness cannot be guaranteed. Therefore, for unsupervised AD, without additional assumptions, it is only possible to guarantee the following fairness.
Definition 3 (Predictive equality [Chouldechova] 2017 Let 9 := f(x). The false positive error rate balance, a.k.a. predictive equality is defined as
P P = 1| S = 8,, y 0] = P = S = 8, = 0]
where 8i, 8j E S, i j. j.
3.2 Fairness Discussion in Unsupervised Anomaly Detection
As evidenced by the preceding analysis, it is intractable to ensure group fairness both on normal and abnormal data in unsupervised anomaly detection (UAD). However, existing works [Zhang and Davidson 2021 Shekhar et al. 2021 Han et al.) 2023 have empirically demonstrated that group fairness (demographic parity or equal opportunity) can be achieved to some extents by introducing adversarial training. adding fairness constraints to the optimization objective or generating coun- terfactual samples for training. This suggests that there must be some natural conditions implicitly contributing to group fairness in unsupervised anomaly detection. In real-world scenarios, anomalous instances are not completely unrelated to normal instances; otherwise, the detection task would be trivial. It is quite common that anomalous samples emerge as perturbed normal samples and the evolution from normality to anomaly is gradual. For instance, in chemical engineering, flow control valves will gradually block, leading to failure; in the mechanical field, bearings will gradually deform, resulting in abnormal vibration signals. Meanwhile, some normal samples are naturally close to anomalous samples. Therefore, it is possible to learn some patterns of anomaly from the normal training data, and we make the following assumption.
Assumption (Learnable abnormality). Suppose X = (x,, xn} are independently drawn from Dx- The abnormalities of both X and unknown anomalous samples can be correctly quantified by function T Rdd TR, and there exists permutation π on X such that O S T T'(x)) < T (xx,) <... < T where a larger value of (x)) means that x is not drawn from the normal distribution Dx with higher probability.
Assumption T Treflects the fundamental expectation that normal data should be compact in the feature space. Formally, this requires the existence of a bounding function T IRd - R such that observed

---

normal samples satisfy T (Xnormal < T ((aanoomal) This assumption ensures the learnability of normal patterns while providing feasibility guarantees for the anomaly detection task. Based on Assumption[[] T servers an anomaly score function and performs extrapolation on anomalous samples. Most existing UAD methods (Han et al. 2022 Bouman et al., [024] have demonstrated that it is possible to learn an approximation of 7 from X that can generalize to unseen anomalous samples. However, T (x) may not be independent from sensitive attribute S and hence can lead to unfairness.
To achieve fairness on X, we split into different protected groups Xs=s, according to the values of a sensitive attribute S. Therefore, a fair AD model ÿ = f(x) on X' is to ensure
Fl x E Xs=s,> T (x S 1 S T (xx..)
= P x E Xs=a,, T (xm) S T (xx,).
where ÿ := T= (x) denotes the anomaly level of x. Different from (I) that does not involve any information about the anomaly, (2) is associated with T (established in Assumption D. meaning that it is possible to learn some information about the anomaly from X. Therefore, it is reasonable to make the following assumptions for fairness abnormal samples, where E := |P[
X (xxx)) < 5 < (xxx.)) IPO
Xs=s;) T (Xx1) S TT*xx,
Assumption 2 (Transferable fairness). Let & be the set of all unseen anomalous samples and E P x E Xs=s, 1 5> (x...)) constant μ 2 1 such that E S p.E.
PP x &s=sy, 1 > [x(xx.)]] There exists small
Assumption 3 (Generalizable parity). Let E' be the union of the set of all unseen anomalous samples and the set of all unseen normal samples and É = |P[ x E &s=e, 0 S 56 Pp x &s=ey 0 S .]| There exists small constant 2 1 such that E TE
Assumption 2 ensures that when T is fair the training data, it is also fair on unseen anomalous data, provided that μa is not too large, where μ depends on real data distribution and the unknown score function T É = for any i,j, the assumption implies equal opportunity. Similarly, Assumption
3 implies demographic parity when E = 0. Therefore, the evaluation of a fair AD method depends on both the fairness principle (e.g., demographic parity or equal opportunity) and assumptions. Indeed, Assumptions] 2 have already implicitly verified by existing fairness-aware AD methods [Zhang and Davidson [02T] Shekhar et al., 202T Hon et al.) 2023). Otherwise, it is only possible to guarantee the predictive equality (T). In our experiments, the results on real-world
datasets validate the reasonability of the two assumptions again.
3.3
Model Formulation
3.3.1 Anomaly Detection via Compact Distribution Transformation
For unsupervised anomaly detection, density estimation [Silverman] 2018 is an effective strat- egy [Zong et al. 2018] Ruff et al., 2018 Fu et al. 2024] to distinguish between normal and abnormal instances. However, the dimensionality of the data often high and the data distribution in the original space is complex, which makes density estimation challenging.
To solve this problem, we propose to learn projection P: IRd + RT that transforms data distribution DA to a known target distribution D, that is simple and compact, while there still exists projection P' I - Rdd that can recover Dx from D2 approximately, ensuring that the major information of x can be preserved by z, where z ~ '22. Therefore, we aim to solve
min M(P(Dx),,.) P,P'
(3)
s.t. ((P D4)
where M(:)) :) denotes a distance metric between distributions and e is some positive constant. Instead of the constrained optimization problem 3 we can simply solve the following problem
M(P(Dz)), D2) + AM(P' (P(Dx)), Dz). P.P"
min
(4)
where B > 0 is trade-off hyperparameter for the two terms. We use two deep neural networks has and I with parameters Φ, & to model P and P' respectively. Now, the problem becomes
min M(Dn,(x)) Dz) + BM(DD g (1x(())) Dx)
(5)
5

---

However, problem ( is intractable as data distribution Dx is unknown and (x,( D Se (x)) cannot be computed analytically. Thus, we expect to measure the distance between distributions using their finite samples because we can sample from Dx and D₂ easily. A feasible and popular choice of M(s.) is the Sinkhorn distance [Cuturi 2013] between two distributions supported by X' 11, .2..... Xx1) and Y' (21, Nna
is log(P.))) Sinkhom( min (P, (),C)r+ a EP,
(6)
s.t. P1 -, D. 22
where P E R denotes the transport plan and C R is metric cost matrix between X' and V. The two probability vectors a and b satisfy a² = 1. = 1, = [1,1.-. 17". Other measures, such as the maximum mean discrepancy, in the Appendix F Now, we use Sinkhorn distance to replace the first term in problem (5). use reconstruction error replace the second term in problem (5), and get the following optimization objective
also be used, which is discussed
min Sinkhorn ho (X), 2) 6.1
X (x)(()))
where E 2 (z: :
1=,i=1.... ..)................... and B is a trade-off hyperparameter.
We may replace both the first and second terms in problem (5) using Sinkhorn distance, however, which easily leads to a higher computational cost. Therefore, we use reconstruction error to replace the second term in problem (5). The reconstruction error term a stronger constraint than P but is efficient and effective to preserve the core information from the original data distribution Dx-
Target distribution The target distribution should be simple and compact. The compactness ensures that projected normal samples in the decision space lie in high-density regions, which contributes to a reliable decision boundary. The simplicity ensures that sampling from the target distribution is easy. Therefore, for the target distribution Dz, we propose to use a truncated isotropic Gaussian based on (O, I2) where truncation is to ensure that the target distribution is sufficiently compact for normal data. Based on the target distribution, we can define a score function naturally depending on density estimation.
Anomaly score Let has- be the trained fairness-awand model. In inference phase. for a new sample Nnew, we define a soft anomaly score Çsoft (or hard score depending on a threshold)
Score(xnew) = Sson (h2 (Xnew) )) = ||/ (Xeew)ll [|+
(8)
which can measure the anomaly degree of Xnew By considering a threshold (with a certain significance level) obtained from the training data scores, we get a hard score function Éhard with binary output in {0. 1), indicating whether Xnew normal or not. Actually, the density of Xnew can be estimated as
(2m) d/2 exp ( (Score ()new))²).
3.3.2 Fairness via Shared Target Distribution
Directly finding fair while maintaining strong detection ability is non-trivial. A naive strategy involves combining FRL techniques with UAD methods construct two-stage pipelines, in which the optimization objectives in the FRL stage are not tailored for the detection task. As result, Such pipelines often yield poor detection performance. Similarly, directly incorporating fairness constraints into the optimization objectives of UAD methods also degrades detection performance. To avoid such problems, we expect to find an end-to-end and coordinated learning process for the detection task and group fairness. Based on the framework established in Section 3.3.1 we can obtain projection ha- via compact distributional transformation, and then the detection task can be conducted effectively by Ç estimating the density of data in decision space. Thus, we obtain a detector f Ç a h and i = fx) = Ç hxx). Notably, if is fair for protected variable S, we have
P]](x) x XS=B; T (xx,) ) I q S T (X
(9)
= P()(x) x Xs=e,, T (xx,,) S ō S T (xx,,.
Unless specified otherwise, all "fair" and "fairness" in this paper pertain to group faimess.

---

where 8;, 8 E S denote the attribute values of protected variable S.
It is easy to show that (proved in Appendix A.2
Proposition 1. For any Ç. if g is attained, then holds.
To obtain a fair h without introducing additional faimess constraints, we propose to map data across different demographic groups into a common target distribution Dz. Naturally, the (3) becomes
min P,P
Σ M(P(xxx...;;
#ES
(10)
s.t. M(P((P(D)))) Dx) c
It further follows that (proved in Appendix A.3
Proposition If E.s M(P(Dxs=.)) D2) then is attained.
Therefore, combining Proposition D and Propo- sition [ conclude that solving problem (TOp makes the decision function f as fair as possible on the training data, in terms of predictive equal-
Data Space
Decision Space
Aa
cherthaten
ity, Further, using Assumption 2 or]] 3 we may obtain equal opportunity or demographic parity.
Hlug xex
R Giaap Paraum
Based on the above analysis, we obtain a projec- tion h via compact distribution transformation (common target distribution for different demo- graphic groups), where h can satisfy different fairness principles building on different assump- tions, and meanwhile yield high-detection- accuracy detector f = Ço h based on a compact target distribution. Building the framework in Section 3.3.1 we finally solve
N
(CK.)
Ansmdb Delcetin Scampg (RC())
CCS.
Ocs. X=X,XX,
Figure I: The illustration of Im-FairAD. For simplicity, we only visualize different attribute values 8t, 8j for the protected variable S, but Im-FairAD does not impose such a restriction. The 'High' and "Low' denote the relative density in the target distribution.
min
Σ (inkhom((n((Xss=))) 2.0
Σ |x (hx
(11)
T2
Notably, our approach achieves fairness across demographic groups of protected variables without introducing additional fairness constraints, thereby fulfilling the dual objectives of detection efficacy and group fairness. We call the method Im-FairAD. Figure provides an illustration.
Variant of FairAD Besides the method presented by (II, we also explore another feasible optimization objective by directly minimizing the distribution distance of anomaly scores across different groups, i.e.,
min Sinkhorm (X)) B xx - g (hx
0
n
(12)
Sinkhom((((h(((>=>s)))) ((h
The first and second terms focus on detection accuracy and the third term ensures fairness between protected groups. We call the method AxiFairAD. It is worth noting that the first term in (12). mapping data distribution into target distribution, is necessary for Ex-FairAD because it determines whether the score function is feasible for Ex Ex-FairAD. More detailed discussion and ablation study are provided in Appendix
3.4 Threshold-Fi Fairness Metrics
To overcome the limitations (See Appendix B.3) of fairness ratio, in this paper, we propose fairness metric called Average Demographic Parity Difference (ADPD):
ADPD
P(Score(X)) t SS s;) P(Score(X)) tx 8,))
(13)
n
7

---

where to E Score (X)) denotes the anomaly score of single sample. In our proposed methods, t = (xx) ADPD is threshold prese metric (such AUC) for measuring demographic parity. The range of ADPD is [0, 1) and smaller ADPD means higher fairness. Although we introduce novel threshold-free metric for fairness measure, this is not to imply that the hhreshold-dependen metrics are useless. More discussion on threshold-free and threshold-dependerd metrics is provided in Appendix B.3 We both use threshold-free and threshold-dependent metrics to evaluate all methods in our experiments.
4 Experiments
Our experiments are conducted on six publicly available datasets from the literature fairness in machine learning (Zhang and Davidson [021]] Chai and Wang, [022 Han et al., 2023 Chen et al. 2024]. where there are different kinds of sensitive information. The more detailed statisties of datasets and data splitting are provided in Appendix B.T We both use standard
UAD
methods, two-stage pipelines (FRL technique + UAD methods), and end-to-ent fairness-aware UAD methods as baselines. The detailed experimental settings are provided in Appendix B.2 We design experiments to answer the following questions.
[Q1] Can our proposed methods achieve better detection accuracy when maintaining comparable even better fairness?
[Q2] How are the performances (including detection accuracy and faimess) of all compared methods on balanced and skewed splitting?
[Q3] Can faimess-aware unsupervised AD methods achieve fairness on anomalous data in real-world scenarios, although anomalous samples are not used during the training?
4.1 Experimental Results
To answer [Q1], we visualize the trade-off between AUC and ADPD under balanced splitting (same sample size across different demographic groups) in Figure 2 where the red star in the upper left corner denotes the ideal fairness-aware anomaly detection. Compared with all the baselines, our method achieves comparable or even better trade-off's between detection accuracy and fairness in almost all cases. The ADPD in Figure is computed on all test data, including normal and abnormal samples. The detailed numerical results and trade-off visualizations under skewed splitting (varying sample size across different demographic groups) are provided in Appendix D.I
CalebA
COMPAS
Addlt
Credit
Extato tams
Bnd Valcce
0
6.7
6.7
66-
66-
86-
06-
85
655
85
65-
8.4
6.
0.03
0.29
6.12
144
6.1
622
0.1
0.5
044
0.2
ADPD (fiimess)
ADPD (taimess)
ADPD
ADPD (trimess)
Figure 2: Accuracy-fairness trade-off on balanced splitting. Note that the baselines, FairOD and CFAD are tailored to tabular data.
Further, the empirical results in Table reveal critical trend: when transitioning from balanced to skewed splitting, fairesss-aware AD methods exhibit degradation in group fairness, as evidenced by significantly larger ADPD values in most cases. This suggests that the faimess of existing faimesss- aware AD methods easily affected by demographic imbalances and skewed sample proportions across groups amplify fairness violations. By contrast, our proposed methods exhibit robust fairness preservation (slight fluctuation on ADPD) on balanced and skewed data splitting [Q2].
Fairness of Im-FairAD under balanced and skewed splitting When problem (6) is solved well, that E.es ((.(Dxss.)) D2) near to zero, whatever under balanced or skewed data splitting, Im-FairAD can obtain fair h(Xs==) for different groups Therefore, in-FairAD guarantee according to Proposition 2 for both balanced and skewed data splitting [Q2].
Fairness of Im-FairAD D on abnormal data
8

---

As there are no abnormal samples in the training set, the optimization processes of unsupervised fairness-aware AD methods do not exploit any information directly from the abnormal data, and hence may not consider the fairness in abnormal data explicitly. To answer [Q3], we visualize the ADPD of abnormal data from the test set in Figure More results on Titanic and SP provided in Appendix D.I Compared to all baselines, our proposed methods achieve better or comparable group fairness in most cases. On the other hand, Deep Fair SVDD achieves better group fairness than Deep SVDD (faimess-unawaree) abnormal data of all four datasets. Two-stage pipelines (Farcon VAE+LOF and Farcon VeE+ SVDD) also achieve hetter group fairness than LOF and Deep SVDD (fairness-unawane
AD00 po www.ehaeeaaaaa........ caal
A64
1308000
Figure 3: Fairness of all baselines on abnormal data from the test set.
abnormal data. On COMPAS and Credit, FairOD and CFAD both achieve better group fairness than Deep SVDD(fairness-unav) possible reason for the success of these methods especially ours is that the abnormal data may have some similar latent structure as the normal data, or at least there exists a mapping (not too complex f between the normal data distribution Dx and the abnormal data distribution Dx, i..., D2 = @(xx). Thus, the AD methods can ensure fairness on abnormal data indirectly, where the intermediary is the normal data, which also indicates that the Assumption [ reasonable and can be accessed in real-world scenarios. Particularly, our methods are based on distribution transformation and the fairness of normal data can be transformed to abnormal data via the composition P o Q. That also why our methods are more effective in terms of fairness than other methods on abnormal data.
on abnormal data. One
4.2 Evaluation by Threshold-Dependeee Metric
We also use fairness ratio 21 from previous works (Zhang and Davidson 2021 Shekhar et al. 2021 and F1-score to evaluate fairness and detection accuracy. For calculating fairness fairness ratio and Fi Fi-score, a threshold needs to be determined. We sort the anomaly scores of the training set in ascending order and set the threshold to p--tth smallest anomaly score, where we set p = {0.90, 0.95) and N denotes the size of the training set. The results on COMPAS, Adult and Credit with p = 0.90 are reported in Table T More results are reported in Appendix D. Observing the Table D our methods still achieve better detection accuracy while maintaining a better or comparable fairness faiterableeairnnss ratio in almost
all cases [Q1]. Notably, the fairness ratio highly sensitive to different thresholds (See all results with p {0.90, }.95} in Appendix D.2). Consequently, a threshold-fre fairness metric is essential for evaluating the performance from a holistic view.
Table 1: F1-score and fairness ratio on COMPAS, Adult and Credit with p = 0.90. The best two results are
marked in bold.
COMPAS
Adult falmess ratio
Crodit
Methods
F1(9) 1
faimess ratio
FI(S))
F1(S) |
faimess ratio
notmal
nomma)
all
pormal
a.l
LOF
29,85/0.00)
0.27v0.00)
0.35/0.00)
(0)
0.34(0.00)
0.42(0.00)
20: (0.11().00)
0.45(0.00)
0.55/0.00)
Deep SVDD
31.30(5.17)
0.49(0.18)
0.58(0.18)
44.73/4.77 72)
0.54(0.24)
23.31(7.75) 0.63(0.11)
0.76/0. 12)
0.74(0.20)
FarconVARsL.Of OPP
14.2%/0.00)
0.69/0.00)
0.77(0.00)
22. (0)
0.63(0.00)
0.6200.00)
15.06/0.00)
0.8%(..00)
0.8%/0.00)
Farcon Deep SVDD
19.5000.89 89)
0. 0.20/0.14) 0.74(0.02)
22. 08.08.8.40 87)
0.59(0.10)
0.73(0.18)
16.96 80)
0.94(0..2)
0.95(0.02)
FaiOD
17,8100.11)
0.70K0.04)
0.79(0.011
0.7000.06)
0.3200.8))
0.7000.04)
0.74(0.02)
Deep Fair SVDD
42.23(0.81)
0.46(0.04)
0.58
03/03/115 56)
0.860..0)
0.830.05)
13.54(0075) 75)
(.81(D..0)
0.73(0.09)
CFAD
40.67(3.67)
0.39(0.13)
0.49(0.08)
48.01 48.01(5.51)
0.76(0.08)
0.55(0.14)
20.43(0.75)
0.6900.05)
0.69(0.04)
Ex-FurrD (Ours)
42,3005.88)
0,71(0.18)
0.74(0.15)
$2.75 19)
0.870.11)
0.92(0.03)
53.70(2.53)
0.79K0.03)
0.90(0.D4)
Fairai (Ours)
47.49(4.32)
0.65(0.25)
0.68/0.09)
56.04(4.70)
0.72(0.06)
0.84:0.07)
54.32(3.43)
0.81(0.08)
0.90(0.04)
4.3 More Experimental Results and Analysis
Due to space limitations, the appendices contain more results and further experimental investigation. Appendix C An extension of the proposed method multiple protected attributes; Appendix D More numerical results and visualization; Appendix E: Ablation study on the proposed methods
(Im-FairD and Ex- Ex-FairAD); Appendix (F) The selection of the distance metric between distributions: Appendix G Time complexity and implementation cost analysis for proposed method; Appendix H
The effectiveness analysis of the proposed methods on equal opportunity; Appendix[] [ Experimental
'This assumption is realistic because in many real scenarios, abnormality origins from normality.

---

investigation on contaminated training set (including unknown abnormal samples); Appendix J Experimental investigation on text data.
Conclusion
In this paper, we focused on the group fairness of unsupervised anomaly detection, clearly discussing the necessary conditions of achieving group fairnsss, and proposed Im-FairAD and Ex Ex-FairAD, two novel fairness-ave evaluation metrics used in previous works, we propose a novel threshold metric ADPD, which provides a holistic view for evaluating the fairness of methods.
anomaly detection methods. Considering the limitations of existing fairness
Empirical results on real-world datasets indicated that the proposed two methods achieve better trade-off between detection accuracy and faimess than baselines. In most cases, Im- Im-FairAD has better performance than Ex-FairAD. Moreover, we analyzed the reason why fairness can ensured on the abnormal samples of the test set, although the model training process does not utilize any anomalous samples.
Acknowledgements
This work was supported by the General Program of Natural Science Foundation of Guangdong Province under Grant No.2024A151501177 1771, the National Natural Science Foundation of China under Grant 6o.62276236, the Guangdong Provincial Key Laboratory of Mathematical Founda- tions for Artificial Intelligence 2023B12120100011 Shenzhen Science and Technology Program 1 and Shenzhen Stability Science Program 2023.
References
Alekh Agarwal, Alina Beygelzimer, Miroslav Dudík, John Langford, and Hanna Wallach. A reductions approach fair classification. International conference on machine learning, pages 60-69. PMLR, 2018.
Alekh Agarwal, Miroslav Dudík, and Zhiwei Steven Wu. Fair regression: Quantitative definitions and reduction-basee algorithms. In International Conference on Machine Learning, pages 120-129. PMLR, 2019.
Barry Becker and Ronny Kohavi. http://do..rrr11.2443332/0
Adult. UCI Machine Learning Repository, 1996. DOI:
Roel Bouman, Zaharah Bukhsh, and Tom Heskes. Unsupervised anomaly detection algorithms on real-world data: how many do need? Journal of Machine Learning Research, 25-105):1-34, 2024.
Markus M. Breunig, Hans-Peter Kriegel, Raymond T. Ng, and Jörg Sander. Lof: identifying density- based local outliers. ACM SIGMOD Record, page 93 104, Jun 2000. doi: 10. 10.1145/335191.33558 URL htt.:pppp.........ooo///..11////
335388
Maarten Buyl and Tijl De Bie. Optimal transport of classifiers to faimess.. Advances in Neural Information Processing Systems, 35:33728-33744 2022.
Jinyu Cai and Jicong Fan. Perturbation learning based anomaly detection. Advances in Neural Information Processing Systems, 35, 2022.
Jinyu Cai, Yunhe Zhang, and Jicong Fan. Self-discriminative modeling for anomalous graph detection. Forty-second International Conference on Machine Learning. 2025. URL
Kttps::/openzevier net http://peeaeeeeeeeeee.ororraaaaa wtt.:e/ooooommmoo111oooaoo.
Mattia Cerrato, Marius Köppel, Philipp Wolf, and Stefan Kramer. 10 years of fair representations:
Challenges and opportunities. arXiv preprint arXiv:2407.03844 2024.
Junyi Chai and Xiaoqian Wang. Self-supervised fair representation learning without demographics. Advances in Neural Information Processing Systems, 35:27 100-27113,, 2022.
10

---

Wenjing Chang, Kay Liu, Philip S Yu, and Jianjun Yu. Enhancing fairness in unsupervised graph anomaly detection through disentanglement. arXiv preprint arXiv:2406.00987 2024.
Zhenpeng Chen, Jie M Zhang, Max Hort, Mark Harman, and Federica Sarro. Faimess testing: comprehensive survey and analysis of trends. ACM Transactions on Software Engineering and Methodology. 33(5):1-59, 2024.
Alexandra Chouldechova.
Fair prediction with disparate impact: A study of bias in recidivism prediction instruments. Big data, 5(2):153-163, 2017.
Paulo Cortez. Student Performance.
UCI Machine Learning Repository, 2008. DOI:
http://ddo.org111224442/////111
Elliot Creager, David Madras, Jömn-enrik Jacobsen, Marissa Weis, Kevin Swersky, Toniann Pitassi, and Richard Zemel. Flexibly fair representation learning by disentanglement. In International conference on machine learning, pages 1436-1445. PMLR, 2019.
Will Cukierski. Titanic machine learning from disaster. 2012. Kaggle.
https://kaggle.com
Marco Cuturi. Sinkhorn distances: Lightspeed computation of optimal transport. Advances in neural information processing systems, 26, 2013.
Wei Dai and Jicong Fan. AutoUAD: paramme optimization for unsupervised anomaly detection. In The Thirteenth International Conference on Learning Representations, 2025. URL ew net wttprr/wwwweeeeeefooooriio/ooooe forrefofrrunniiirrPaaaa.
Jeffrey Dastin, Amazon scraps secret ai recruiting tool that showed bias against women. In Ethics of data and analytics, pages 296 299..99..40 Auerbach Publications, 2022.
Ian Davidson and Selvan Suntiha Ravi. A framework for determining the faimess of outlier detection. In ECA/ 2020, pages 2465-247777 IOS Press, 2020.
Deepak and Savitha Sam Abraham. Fair outlier detection. In 21th International Conference on Web Information Systems Engineering: WISE 2020, pages 447-462, 2020.
Jacob Devlin, Ming- ding-Wei Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre- tre-training of deep bidirectional transformers for language understanding. Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume (long and short papers), pages 4171-4186, 2019.
Cynthia Dwork, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Richard Zemel. Fairness through awareness. In Proceedings of the 3rd Innovations in Theoretical Computer Science Conference, Jan 2012a. doi: 10.1445200003362000555 URL http: /ttt://dxx http//xxddooio .al..org/11 2090255
Cynthia Dwork, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Richard Zemel. Fairness through awareness. In Proceedings of the 3rd innovations in theoretical computer science conference, pages 214-226, 2012b.
Jicong Fan. An interdisciplinary and cross-task review on missing data imputation. arXiv preprint arXiv:2511.0119, 2025.
Dazhi Fu, Zhao Zhang, and Jicong Fan. Dense projection for anomaly detection. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 2398-8408 2024.
Pratik Gajane. On formalizing fairness in prediction with machine learning, arXiv: Learning,arXiv Learning, Oct 2017.
Sachin Goyal, Aditi Raghunathan, Moksh Jain, Harsha Vardhan Simhadri, and Prateek Jain. Droce: Deep robust one-class classification. In Proceedings of the International Conference Machine Learning, pages 3711-3721. PMLR, 2020.
Arthur Gretton, Karsten M Borgwardt, Malte J Rasch, Bernhard Schölkopf, and Alexander Smola, kernel two-sample test. The Journal of Machine Learning Research, 13(1):7237773, 2012.
11

---

Sara Hajian, Francesco Bonchi, and Carlos Castillo. Algorithmic bias: From discrimination discovery to fairess- aware data mining. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Aug 2016. doi: 10. 10.11455293967222245556 URL
http::/dx doi. http:///......../111.111......1. 11tg:/1.1144/222577222222222 2995388
Songqiao Han, Xiyang Hu, Hailiang Huang, Minqi Jiang, and Yue Zhao. Adbench: Anomaly detection benchmark. Advances in neural information processing systems, 35:32142-3211 2022,
Xiao Han, Lu Zhang, Yongkai Wu, and Shuhan Yuan. Achieving counterfactual fairness for anomaly detection, In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pages 55-66. Springer, 2023.
Moritz Hardt, Eric Price, and Nathan Srebro. Equality of opportunity in supervised learning. In Pro- ceedings of the 30th International Conference on Neural Information Processing Systems, NIPS 16, page 3323-3331, Red Hook, NY, USA, 2016. Curran Associates Inc. ISBN 978151083881
Lisa Anne Hendricks, Kaylee Burns, Kate Saenko, Trevor Darrell, and Anna Rohrbach. Women also snowboard: Overcoming bias in captioning models. In Proceedings of the European conference on computer vision (ECCV), pages 771-787, 2018.
Geoffrey E Hinton and Ruslan R Salakhutdinov. Reducing the dimensionality of data with neural networks. Science, 31 313(5786):504 507, 2006.
Nikola Jovanović, Mislav Balunovic, Dimitar Iliev Dimitrov, and Martin Vechev. Fare: Provably fair representation learning with practical certificates. International Conference on Machine Learning, pages I 15401-15420. PMLR, 2023.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Proceedings of the International Conference on Learning Representations, 2015.
Preethi Lahoti, Alex Beutel, Jilin Chen, Kang Lee, Flavien Prost, Nithum Thain, Xuezhi Wang, and Ed Chi. Fairness without demographics through adversarially reweighted learning. Advances in neural information processing systems, 14:728-740, 2020.
Jeff Larson, Surya Mattu, Lauren Kirchner, and Julia Angwin. How we analyzed the compas recidivism algorithm. ProPublica (5 2016), 9():3-3, 2016.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. learning face attributes the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
Christos Louizos, Kevin Swersky, Yujia Li, Max Welling, and Richard Zemel. The variational fair autoencoder. arXiv preprint arXiv: 151 1.00330, 2015.
David Madras, Elliot Creager, Toniann Pitassi, and Richard Zemel. Learning adversarially fair and transferable representations. In International Conference Machine Learning, pages 3384-3393. PMLR, 2018
Felix Meissen, Svenja Breuer, Moritz Knolle, Alena Buyx, Ruth Müller, Georgios Kaissis, Benedikt Wiestler, and Daniel Rückert. (predictable) performance bias in unsupervised anomaly detection. arXiv preprint arXiv: /4/98, 2023.
Daniel Moyer, Shuyang Gao, Rob Brekelmans, Aram Galstyan, and Greg Ver Steeg. Invariant representations without adversarial training. Advances in neural information processing systems, 31, 2018.
Neng Kai Nigel Neo, Yeon-Chang Chang Lee, Yiqiao Jin, Sang- Wook Kim, and Srijan Kumar. Towards fair graph anomaly detection: problem, benchmark datasets, and evaluation. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, pages 1752-1762, 2024.
Changdae Oh, Heeji Won, Junhyuk So, Taero Kim, Yewon Kim, Hosik Choi, and Kyungwoo Song. Learning fair representation via distributional contrastive disentanglement. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 1295-1305, 2022.
12

---

Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: review. ACM computing surveys (CSUR), 54(2):133, 2021.
Alfréd Rényi On measures entropy and information. Proceedings of the fourth Berkeley symposiim mathematical statistics and probability, volume 1: contributions the theory of statistics, volume 4, pages 547-562. University of California Press, 1961.
Lukas Ruff, RobertA. Vandermeulen, Nico Goernitz, Lucas Deecke, ShoaibAhmer Siddiqui, Alexan- der Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. International Conference on Machine Learning, Jul 2018.
Conference on Machine
Shubhranshu Shekhar, Neil Shah, and Leman Akoglu. Fairod: Fairness-aware outlier detection. In Proceedings of the 2021 AAAI/ACM Conference on AI, Ethics, and Society, Jul 2021. doi: 10.1 10.1145/3667702.44655111 URL URL wwtp:xxwoooo.ooooooo /ttt::///o..oo..or////ll.o
3462517
Bernard W Silverman. Density estimation for statistics and data analysis. Routledge, 2018.
Eric Tzeng, Judy Hoffman, Ning Zhang, Kate Saenko, and Trevor Darrell, Deep domain confusion: Maximizing for domain invariance. arXiv preprint arXiv: 14/.3474, 2014.
Ziwei Wu, Lecheng Zheng, Yuancheng Yu, Ruizhong Qiu, John Birge, and Jingrui He. Fair anomaly detection for imbalanced groups. arXiv preprint arXiv:2409.1009 2024.
Feng Xiao and Jicong Fan. Unsupervised anomaly detection in the presence of missing values. Advances in Neural Information Processing Systems, 37:138130-138161 2024.
Feng Xiao and Jicong Fan, Text-adbench: Text anomaly detection benchmark based on Ilms embedding, arXiv preprint arXiv:2507. 2025.
Feng Xiao, Youqing Wang, S. Joe Qin, and Jicong Fan. Semi-supervised anomaly detection using restricted distribution transformation. IEEE Transactions on Neural Networks and Learning 2025a.
3
Feng Xiao, Jianfeng Zhou, Kunpeng Han, Haoyuan Hu, and Jicong Fan. Unsupervised anomaly detection using inverse generative adversarial networks. Information Sciences, 689:121435, 2025b.
Qizhe Xie, Zihang Dai, Yulun Du, Eduard Hovy, and Graham Neubig. Controllable invariance through adversarial feature learning. Advances in neural information processing systems, 30, 2017.
I-Cheng Yeh. Default of Credit Card Clients. UCI Machine Learning Repository, 2009, DOI: http:://doo.ogg/1.24442//555
Muhammad Bilal Zafar, Isabel Valera, Manuel Gomez Rodriguez, and Krishna Gummadi. Fairness beyond disparate treatment & disparate impact: Learning classification without disparate mistreat- ment. Proceedings of the 26th International Conference on World Wide Web, Apr 2017a. doi: 11144433338912.055262 URL
/ / dx doii www.orrgll00 10 1145313331//33111. ....589111.0000000 3052660
Muhammad Bilal Zafar, Isabel Valera, Manuel Rodriguez, Krishna Gummadi, and Adrian Weller. From parity to preference-bate based notions of fairness in classification. Advances in neural information processing systems, 30, 2017b.
Rich Zemel, Yu Wu, Kevin Swersky, Toni Pitassi, and Cynthia Dwork. Learning fair representations. In International conference on machine learning, pages 325-333. PMLR, 2013.
Brian Hu Zhang, Blake Lemoine, and Margaret Mitchell. Mitigating unwanted biases with adversarial learning. In Proceedings of the 2018 AAAI/ACM Conference on AI, Ethics, and Society, pages 2018.
Hongjing Zhang and lan Davidson. Towards fair deep anomaly detection. In Proceedings of the 2021 ACM conference on fairness, accountability, and transparency, pages 138-148, 2021.
Yunhe Zhang, Yan Sun, Jinyu Cai, and Jicong Fan. Deep orthogonal hypersphere compression for anomaly detection. In The Twelfth International Conference on Learning Representations, 2024.
net wottt///ooommmiioooo4oo2o222 URL https: http:///eeeneeeeeeeeeeee/eaaaaaa
13

---

Yue Zhao, Zain Nasrullah, and Zheng Li. Pyod: A python toolbox for scalable outlier detection. Journal of Machine Learning Research. 20(96): 2019, CtLAttt://mmlr.rgg/ v20/ 000019-011 htm
Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Dacki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In International Conference on Learning Representations, 2018. BRLLhtpss: htttps://oeerreiieee
net/Foruun2dd-3JJLLb.
NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main contributions are concluded in Introduction. Guidelines:
The answer NA means that the abstract and introduction do not include the claims
made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
Justification: The limitation discussion are provided in Appendix K
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the
implications would be.
The authors should reflect on the scope of the claims made, c.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms
and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proof's
14

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: The proofs of claim and propositions introduced in this work are provided in
Appendix A A.2 A.3
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems. The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: The specific experimental settings are provided in Appendix Guidelines:
B.2
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
15

---

Justification:
All the data used in experiments are publicly available and we provide the specific download URL in Appendix [.I Our source code is provided in supplementary materials.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips) cc/
pub 1eollic//g hecd//uiess///ee CoodeSuomi ssisssosissioooese
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https http:/ccclllccccccc The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc. The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
//nips. cc/ publ ic gu des MrodeSubmm i onPo Pollicyy for more details.
At submission time, to preserve anonymity, the authors should release anonymized
versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The detailed experimental settings are provided in Appendix B.2
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We report the standard variance for main results. Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi-
dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula,
call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
16

---

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 8. Experiments compute resources Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: We describe the hardware and software source used in our experiments in Appendix [B.2
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). 9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics httpp:///eariiis.cccoopoo/lttttt
Answer: [Yes]
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid-
eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed? Answer: [Yes]
Justification: Our work aims to improve fairness of unsupervised anomaly detection system, which is helpful to mitigate the social bias for different demographic groups to some extends.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has no societal
impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation. generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
17

---

Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA]
Question:
Justification:
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We include the original URL links for all used data and software tool. Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g.. website). the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms of use the package should be provided. For popular datasets, papers thcode / dat set.s has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not release new assets. Researchers should communicate the details the dataset/code/moodl as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots. if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
Guidelines:
18

---

The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the core method development in this research does involve LLMs as any important, original, or non-standard components. wwt.c////oonecccc.c/..cmom 2025/ LLM) for what should or should not be described.
Please refer LLM policy (https://
19

---

A Proof for Claim and Propositions
A.1 Proof for Claim
Proof. According to Definition I to achieve demographic parity, we need to guarantee
P[f(x) - S s] [[(() = y) for all and iz. Therefore, we have
[(f(()) أن P(f(() + P[[(x) = ú bly - 1
y - 0] x P
However, only normal data (y = 0) can be accessed in unsupervised anomaly detection, which means that we can only obtain P(f(x) = ÿ y x PPyy 0] in such scenario. Therefore, demographic parity cannot be guaranteed in unsupervised anomaly detection.
And according to Definition 2 for achieving equal opportunity, we need guarantee Plù 1 y = Plù = and Plù y 1] in unsupervised anomaly detection if without any additional assumptions. Therefore, equal opportunity cannot be guaranteed in unsupervised anomaly detection.
1] for all s. Obviously, we cannot obtain Plù = 1 || S = 8, 1]
A.2 Proof for Proposition 1
We split X' into different protected groups Ns= according to the values of sensitive attribute Therefore, fair learning on X is to ensure
x E Ns=s T' (Xmi) S / S T (Xa,) )] p
(14)
= P x E Ks=ayy T (xm)
S S T (xx,).
we expect to find a h that map data from different demographic groups into a common target distribution where an effective anomaly score function Ç exist naturally.
Therefore, we obtain detector f <o and f(x) Ç o h(x). Indeed, if h is fair for S, have
P[](x) x XS= T (x ) S T (X P[[(x) x E Xs= (xx,) S S T (x....) )]-
(15)
Proof. Equation (15) indicates that f(x)) is independent from S. Therefore, ((h(x)) is independent from S, that is
P(((h(x)) E XS=M, (x(xx) S S (xxx)) ) PP(((((x)) x K KS=Ny, T (xxx)) S S T (x
(16)
where <(h(x)) = 5.
A.3 Proof for Proposition 2
Proof. Since M(...) is a distance metric between distributions, we have M(..) 2 0. Therefore,
Σ M(P(DDxs...)) =0
#ES
M(P(Dxxsu)) ).D)) Vi
(17)
P(DNs-m,) =D2," Vi
P(Dxs=m.) P(D P(Dxs=e,) ) Vi,j.
It follows that
TP[(x) =) P((Dx.m.)) )
(18)
holds for any i, Then
Pl)(()|X Xs=ai] = P(h(x)) E Xs=ayl,
(19)
20

---

for any i.j. This means h(x) is independent from S. We obtain
P[h(x) x &s=., (xxx)) 1 T (X
(20)
P1)(x) XE Xs==oy T (Xx,) $Ø T (x
B Experimental Settings
B.1 Datasets and Baselines
The statistics of all datasets are provided in Table 2
The details of each dataset are as follows:
Table 2: Statistics of datasets.
Datasel
Type
Dimension
Sensitive Variable
Normal Set
Abnormal Set
Adult
tabular
gender
income <50K
income >> 50K
COMPAS
tabular
race
no recidivism within years
recidivism within years
Credit
labular
age gender
defauli payment next month no survived
defauli payment month
Titanic
labular
survived
tabular
gender
general final grades attractive face
extreme final grades
CelebA
image
64x64x3
gender
plain face
Adul 5
Becker and Kohavi 1996) The dataset is from the 1994 Census Income database contains 48,842 samples with 14 attributes, and gender (male or female) is selected as the
sensitive attribute. Following the previous work (Han et al. 2023 we removed the samples
with missing values.
Credi Yeh [209)] The dataset is about customers' default payments in Taiwan and contains
30,000 samples with 23 attributes. Age selected as the sensitive attribute where one group
includes people from 30 to 60 years of age and the other is other age groups.
Compat [aarson al. 2016 The dataset contains 7,214 samples with 52 attributes. Following
previous works [Larson et al. 2016 Han et al., [023]. we only selected African and Caucasian individuals, yielding 5278 clean samples with attributes. The sensitive attribute is race (African-Americal and Caucasian).
Celeb [Liu et al. 2015) The dataset contains 202,599 color face images. Following (Zhang and Davidson 2021 we resized all images to 64 x 64. Gender (male or female) is selected as the sensitive attribute.
Titaniq [Cukieski 2012) The dataset is from kaggle competition to predicting survival on the Titanic. We removed the samples with missing values and obtained 712 clean samples with 8 attriibuee. Gender (male and female) is selected as the sensitive attribute.
TO [Cortez, 2008) The dataset is about student achievement in secondary education of two Portuguese schools and contains 649 samples with 32 attributes. The data attributes include student grades, demographic, social and school related features. Gender (male and female) is selected the sensitive attribute.
We used LOF [Breunig al. 2000), Deep SVDD [Ruff et al. 2018 as standard (fairness u UAD baselines, FairOD (Shekhar et al. [021], Deep Fair SVDD Zhang and Davidson, [201]] and CFAD Han et al. 2023 as end-to-end fairness-aware UAD baselines. utilized FRL technique VarconVAB [Oh et al. 2022 to construct "Farcon VAE+LOF" and "Farcon TFarconVAE-DeepSSDDD as two-stage pipelines.
7 "http:://ittubb.c "ttrps//giiuub.co///ppp/p/p com/ppopubhiccccmmpaasniliyy
hhupss//mmlabie cu.. hww.k.ccd..///ooojttt/ccccaaaaa html
aanpss//wwwwwaggt..o///tttaaaaa com/c/titanic/daaa
"htpp://www.kagg""" www.agww....coo..wwwwwwwwww.....
21

---

The implementations of LOF and Deep SVDD are built using the PyOL library [Zhao et al. 2019 Farcon VAH FairOn and CFAD are based on official codes and the hyperparameters are fine- tuned according to the suggestions from original papers. In light of the unavailable implementation for Deep Fair SVDD, we reproduce the code following the pseudo-code provided in the original paper (Zhang and Davidson 202T].
B.2 Implementation Details
Neural Network Architectures For the tabular datasets Adult, COMPAS, Credit, Titanic and SP. the neural networks for all methods are Multi--ayer Perceptrons (MLP). For the image dataset CelebA, the neural networks used in all methods are Convolutional Neural Networks (CNN). We use Adam [Kingma and Ba 2015 as the optimizer, and set coefficient of entropy regularization term in the Sinkhorn distance 0.1 all experiments.
Data Splitting For fairness problems in unsupervised anomaly detection, the proportion of sample size across different demographic groups heavily influences the results [Meissen al., 2023] Wu et al., [0224]. Therefore, in this work, we set balanced splitting and skewed splitting. The detailed splits for the training set and test set are provided in Tables and Note that there no balanced splitting for Titanic and SP due to the limitations of extremely uneven samples size across different demographic groups for Titanic and insufficient sample size for SP.
Table 3: Balanced data splitting on Adult, COMPAS, CelebA and Credit. PV denotes the protected variable. 'Nor' and 'Abnor'' denote normal sample and abnormal sample, respectively.
Training Set
Test Set
Dataset (PV)
Attribute Value
Size (Nor.)
Size (Nor.)
Size (Abnor.)
Male
6000
1000
1000
Adult (Gender)
Femalc
6000
1000
1000
African-Americat
1000
280
280
COMPAS (Race)
Female
1000
280
280
Male
8000
4000
CelebA (Gender)
Female
8000
4000
4000
[30, 60]
5000
2000
2000
Credit (Age)
Others
5000
2000
2000
Table 4: Skewed data splitting all datasets. PV denotes the protected variable. 'Nor' and 'Abnor.' denote normal sample and abnormal sample, respectively.
Training Set
Test Set
Dataset (PV)
Attribute Value
Size (Nor.)
Size (Nor.)
Size (Abnor.)
Male
8000
4000
4000
Adult (Gender)
Female
2000
1000
1000
Arican-Americse
800
400
COMPAS (Race)
Female
200
100
100
Male
8000
4000
4000
CelebA (Gender)
Female
2000
1000
1000
330. 60)
8000
4000
4000
Credit (Age)
Others
2000
1000
1000
Male
330
30
30
Titanic (Gender)
Female
32
30
Male
135
26
30
(Gender)
Female
148
26
30
Evaluation Metrics Following previous works such as [Lahoti et al.
2020 Buyl and De Bie
2022], we use the AUC (Area Under the Receiver Operating Characteristic curve) score and FT to
http://ghhhub..mmmyyyaaoo/ooaoad 12
/tan////g////gggggoooooooooonnar https///stttttcooooo//m/aa////aa VAE
13 phtps://gttuu..co//SSii http://hhwhenooouuuomaomnnnnnnnn
" "aanss//ithibbommmaaaiioo/777/77
22

---

evaluate the detection accuracy of all compared methods. We use the proposed ADPD (threshold-Fl free) and fairness ratio ) [Zhang and Davidson 2021] evaluate the fairness of unsupervised anomaly detection. Note that the threshold is determined by percentile (p) of anomaly score on the training data and we set p = {0.9, 0.95) for all baselines.
ALL experiments were conducted on 20 Cores Intel(R) (R) Gold 6248 CPU with one NVIDIA Tesla V100 GPU, CUDA 12.0. We run each experiment five times and report the average results with standard variance.
B.3 Threshold-Free Fairness Metrics
When evaluating the faimess of anomaly detection, existing work such as (Zhang and Davidson 2021 Shekhar et al. 202T] usually uses fairnss ratio
== min P(Score (1) P(Score x 1 Smm;
(21)
[[Scome(X)>(]5==)) P(Scure ( [
where (-ore(-) denotes the anomaly score, threshold and denotes a protected variable. The metric has two limitations. First, (2T) is sensitive to the selection of threshold t. Second, (21 will not work (undefined cases) when P(Score(x) t|S 8j) or (((core(x)) t|S s,
where r is always zero. To overcome the two limitations. in this paper. we propose new fairness metric called Average Demographic Parity Difference (ADPD):
n P(Score(A)) 1 s.) - P(Score(X)) > t S s;))
ADPD:1 n
(22)
where to E Score(Xt) denotes the anomaly score of single sample. In proposed methods, to = -11/0. (x&)]]. ADPD is a threshold-frees metric (such as AUC) for measuring demographic parity, The range of ADPD is [0, 1) and smaller ADPD means higher fairness. Overall, due to threshold- independent, ADPD provides a holistic view of the model's fairness by evaluating the performance of an AD method across all possible thresholds. Although introduce novel threshold-fres metric for fairness measure, this is not to imply that the hhresholdddependem metrics are useless.
The ADPD evaluates the performance of model across all possible thresholds, providing holistic view of the model's fairness. In contrast, the fairness ratio calculated based on specific threshold and exhibits high sensitivity to threshold selection (See Table X and Table 7 When prior knowledge (c.g., anomaly prevalence, operational constraints) unavailable, ADPD is preferable as it mitigates bias introduced by arbitrary threshold choices, ensuring equitable performance comparisons. On the other hand, if domain -ppecin-peciffic priors (e.g., training set contamination rate) are available, threshold- dependent metrics like the fairness ratio may align better with real requirements.
C Extension of Proposed Method
The original optimization objective of Im-FairAD is as follows:
3 Σ |x (hx)))))))
min
Σ Sinkhom(hgg(Xs- 2) + 0.0
(23)
where only single protected attribute is considered. When protecting multiple sensitive attributes (e.g., race & gender), the optimization objective of Im-FairAD can be naturally reformulated the following form (There is the same reforming process on Ex-FairAD).
3
min ΣΣ
Sinkhom((s((Xs=-)) 2)+ SEN
x; g (hx()))))
(24)
n
where = (Strace) S(gender) )..). } fairness metric, ADPD, becomes
denotes the set sensitive attributes. Meanwhile, the proposed
23

---

ADPD
P(Score(2)) tu|S 8:) P(Scoree tx/S =s)
(25)
N
SEQ k=1
When the number of values of the protected attribute (e.g., race) exceeds two, i.e., [8| > 2, the ADPD becomes
1
max -((s)s))-(ss)) 1.,35))
ADPD
(26)
|
SERk=1
where P(s:)) = (())ooreA)) > 4 = 8;) and the range of ADPD still is [0, 1).
D
Numerical Results and More Visualization
D.1 Results of ADPD and AUC on all datasets
Table 5: Results of ADPD and AUC on COMPAS, Adult, Credit and CelebA. Note that the baselines, FairOD and CFAD are tailored to tabular data. In the official code of Far,onVAE, there is no support for image data.
Balanced Splitting
Skewed Splitting
Methods
ADPD
ADPD ())
1
AUC(())
normal
all
AUC(%)
normal
all
COMPAS
LOF
59.23(0.00)
12.27(0.00)
10.59(0.00)
57.25(0.00)
(.300)
9.53(0.00)
Deep SVDD
57.58(2.30)
24.33(7.87)
21.07(8.22)
60.24(3.08)
31.72(7.39)
30.18(5.32)
VAE+LOF
48.72(0.00)
4.56(0.00)
6.56(0.00)
50.10(0.00)
7.25(0.00)
4.12(0.00)
VAE+Dee SVDD
50.48(1.67)
3.99(1.51)
4.77(0.72)
(0.83
8.50(1.25)
7,03(L.10)
FairOD
61.05(1.05)
5.39(2.11)
5.53(1.50)
88.46(4.75)
5,430060)
5.32(3.24)
Deep Fair SVDD
62.71(0.76)
10.25(2.40)
8.25(1.46)
61.05(1.07)
10.58(3.23)
11.04(..13)
CFAD
62.27(0.68)
(2.21(4.57)
10.94(4.40)
60.87(1.99)
23.81(3.71)
(7.39(2.20)
Ex-FairAD (Ours)
63.11(2.67)
4.38 (0.43)
(1.38)
66.44(3.62)
(..05)
7.39 (1.18)
Im-FairAD (Ours)
63.89(3.45)
(2.55)
4.76 (2.37)
66.58(2.91)
(1.00)
5.43 (0.49)
Adult
LOF
58.09(0.00)
26.46(0.00)
25.58(0.00)
59.14(0.00)
25.19(0.00)
25.34(0.00)
Deep SVDD
63.47(3.59)
7.09(1.92)
7.35(1.22)
61.04(307)
19.43(5.40)
17.32(2.90)
Farcon VAE+LOF
53.92(0.00)
5.00(0.00)
5.73(0.00)
50.56(0.00)
2.16(0.00)
3.36(0.00)
Farcon VAE+DeD SVDD
55.05(2.81)
4.65(3.01)
5.76(3.24)
51.21(2.61)
5.65(5.84)
5.81(7.09)
FairOD
(0.63)
11.80(4.62)
9.26(1.45)
58.30(4.18)
6.34(0.53)
14.35(5.97)
Deep Fair SVDD
62.45(0.65)
2.18(0.84)
3.01(2.27)
60.22(0.14)
6.86(1.85)
4. 14(.74)4
CFAD
(.11))
6.07(2.95)
14.69(3.58)
60.28(1.09)
23.42(5.43)
30.41(3.64)
Ex-FairAD (Ours)
73.49(4.41)
(0.2(1)81)
2.86 (1.09)
69.56(3.45)
1.52 (0.44)
(0.76)
Im-FairAD (Ours)
72.05(1.811
1.61 (0.61)
2.13 (1.17)
69.34(1.82)
1.92 (1.05)
(0.86)
Credit
LOF
50.09(0.00)
6.28(0.00)
3.19(0.00)
48.98(0.00)
2.14(0.00)
3.17(0.00)
Deep SVDD
22.34(1.98)
9.84(4.56)
8.64(3.26)
54.82(1.97)
7.49(1.33)
6.95(2.55)
Farcon VarconVAFF+1O0 VAF+LOF
49.86(0.00)
2.21(0.00)
2.24(0.00)
52.93(0.00)
2.65(0.00)
0.80(0.00)
Farcon DArDDD SVDD
51.07(0.58)
1.03(0.45)
1.01(0.32)
50.96(0.25)
(.4900.70)
(0.6().66)
FairOD
53.93(1.09)
7.00(1.33)
7.21(1.4)
60.39(0.55)
8.79(..73)
7.36(0.50)
Deep Fair SVDD
56.01(0.69)
4.62(1.11)
4.54(1.22)
56.67(0.42)
6.24(1.88)
5.84(2.00)
CFAD
56.96(0.55)
5.89)
4.48(0.66)
57.21(0.47)
6.30(2.25)
5.76(1.94)
Ex-FairAD (Ours)
64.96(1.63)
2.95 (0.83)
1.92 (0.39)
63.85(1.95)
2.71 (0.85)
1.57 (0.87)
Im-FairAD (Ours)
63.70(1.59)
2.20 (0.86)
1.97 (0.66)
65.19(1.79)
(0.59)
(0.24)
CelebA
Deep SVDD
(2.77(0.33)
10.44(1.66)
(0.47(1.55)
60.80(0.68)
9.82(0.44)
8.24(0.93)
Deep Fair SVDD
(7.97(0.72)
7.73(0.99)
4.79(0.35)
59.95(0.80)
1.52(1.21)
3.24(1.81)
Ex-FairAD (Ours)
60.68(0.72)
1.06 (0.47)
3.80 (0.83)
63.07(0.71)
(0.38)
4.87 (0.60)
Im-FairAD (Ours)
58.07(0.87)
2.37 (0.98)
2.46 (0.45)
61.72(0.62)
2.73 (0.86)
2.93 (0.54)
24

---

The results of ADPD and AUC on all datasets are provided in Table and two results in each case are marked in bold, 'normal' means the score is computed only on normal samples of the test set, and 'all' means the score is computed on all samples from test set. From these two tables, we have the following observations:
and Table 6 where the best
Im-FairAD and Ex-FairAD both achieve better detection accuracy (AUC) compared with all baselines not only on normal data but also on entire test set in most cases, while maintaining comparable or even better fairness (ADPD) [Q1].
In the transition from a balanced splitting to a skewed splitting, group fairesss, as measured by ADPD, exhibits significantly larger values in most cases, which indicates the faimess of existing faimess-aware AD methods is easily affected by sample proportion from different sensitive groups and skewed data for different demographic groups poses a more intractable faimess problem than balanced data. In contrast, the fluctuation of ADPD slight on our proposed methods [Q2].
Table 6: Results of ADPD and AUC on Titanic and SP with gender as the sensitive attribute. Note that there is no halanced splitting for Titanic and SP due to the limitations of extremely uneven samples size across different demographic groups for Titanic and insufficient sample size for SP.
Titanic
SP
Methods
ADPD(%)
AUC($)
normal
all
AUC(%) f
normal
all
LOF
53.88(0.00)
23.16(0.00)
19.81(0.00)
63.55(0.00)
9.82(0.00)
6.03(0.00)
Deep SVDD
26.02(11.29) (1.9)
26.07(11.95)
68.37(1.11)
12.97(4.03)
12.52(2.44)
Farcon VAF=L OF
48.52(0.00)
7.97(0.00)
6.58(0.00)
57.3010.00)
4.54(0.00)
8.94(0.00)
Farcon VAE+Dee SVDD
50.04(2.97)
7.60(1.89)
3,99(0.85)
55.00(3.17)
9.53(3.44)
5.98(1.13)
FairOD
46.04(0.20)
14.67(0.30)
6.38(0.16)
42.04(0.44)
9.70(0.51)
10.90(0.31)
Deep Fair SVDD
)1.94(0.99)
20.67(3.08)
21.24(6.35)
61.90(1.00)
10.57(3.04)
7.24(2.12)
CFAD
55.63(0.59)
26.77(7.00)
23.02(2.10) 10)
69.23(1.34)
9.26(1.24)
4.53(0.28)
Ex-FairAD (Ours)
64.87(1.48)
6.35(2.12)
5.75(1.00)
74.16(3.09)
6.00(1.32)
5,84(1.67)
Im-FairAD (Ours)
64.02(3.62)
7.14(2.61)
3.82(1.77)
75.97(4.32)
5.84(1.29)
5.62(1.95)
The visualization between detection accuracy (AUC) and fairnsss (ADPD) on skewed splitting is shown in Figure
4
The ADPD of abnormal data on Titanic and SP is shown in Figure
16
16-
1.9
22-
1.2
0.55
66--
6--
0.5
8.4
0.4
0.4
di
Credit
Thank
8.
0.5
0.3
6.7
0.77
0.2
0:5
0.5
1.5
8.1
92
45
100
0.8
111
12
13
ADPD (faines))
ADPD (fiizes))
ADPD (timees)
Figure 4: Accuracy-fairness trade-off skewed splitting.
25

---

farce LoP
Fecorokh Deep 9V90
Terdo
ADPD (on abnormal data)
Dosp Ful 5XD0
ExPaxAD (Ouml
Figure 5: Fairness of all baselines on abnormal data from test set.
D.2 Results of fairness ratio and F1 on all datasets
Furthermore, the results of Fl-score and fairness ratio all datasets are provided in Table and
Table where fairness ratio is highly sensitive to different thresholds p = (0.90, 0.95}.
Table 7: Results of Fl-score and fairness ratio Titanic and SP. Note that "0 means that undefined case occurs when calculating foirness ratio.
Threshold=0.90
Threshold=0.95
Methods
Fairesss
Fairness
FI(%) t
F1(%) 1
normal
all
normal
Titanic
LOO
35.55(0.00)
0.40(0.00)
(.57((..0))
26.82(0.00)
0.22((0.0)
0.46(0.00)
Deep SVDD
31.90(10.57)
0.44(0.32)
0.44(0.30)
16.66(6.47)
0.68(0.36)
0.56(0.33)
FarconVAE+LOF
8.82(0.00)
0.66(0.00)
0.6(0.00)
6.15(0.00)
0.50(0.00)
0.25(0.00)
Farcon VAE+Deep SVDD
17.06(5.66)
0.57(0.21)
0.69(0.19)
9.03(4.70)
0.16(0.21)
0.28(0.16)
FairOD
15.55(2.77)
0.57(0.09)
0.57(0.04)
11.42(0.00)
0.50(0.00)
1.00(0.00)
Deep Fair SVDD
14.31(2.26)
0.68(0.30)
0.66(0.23)
12.83(1.46)
0.80(0.24)
0.40K0.15)
CFAD
44.54(5.47)
0.37(0.13)
0.57(0.24)
27.73(1.02)
0.53(0.06)
0.48(0.05)
Ex-FairAD (Ours)
66.66(0.00)
1.00(0.00)
1.00(0.00)
66.82(0.00)
1.00(0.00)
1.00(0.00)
Im-FairAD (Ours)
66.66(0.00)
1.00(0.00)
1.0000.00)
66.66(0.00)
1.00(0.00)
1.00(0.00)
SP
LOF
44.44(0.00)
0. 0.14(0.00)
0.57(0.00)
27.02(0.00)
0.12(00.0)
O. (00400)
Deep SVDD
22.45(6.56)
0.38(0.30)
0.47((.19)
20.42(8.47)
0.59(0.35)
O. 0.46(0.32)
Farcom VAE+LOF
19.04(0.00)
0*
0.65(0.00)
6.89(0.00)
0"
Farcom VAE+Deep SVDD
14.41(2.98)
0.40(0.36)
0.59(0.26)
12.90(3.70)
0"
FairOD
11.72(0.13)
0.88(..02)
0.68(0.06)
13.65(1.41)
0.86(0.00)
0.26(0.01)
Deep Fair SVDD
19.76(4.81)
(.5
0.58(0.22)
24.65(6.76)
0.42(0. 12)
0.71
CFAD
40.46(2.22)
0.74(0.11)
0.78(0.07)
32.14(6.57)
0.38(0.00)
0.80(0.10)
Ex-FairAD (Ours)
(1.77(6.28)
0.54(0.15)
0.77(0.19)
34.10(5.08)
0.62(0.20)
0.65(0.10)
Im-FairAD (Ours)
43.64(9.16)
0.56(0.11)
0.55(0.26)
35.51(4.11)
0.86(0.00)
0.62(0.16)
E
Ablation Study
In this section, we delve into the influence of different loss terms for proposed method. More specifically, we investigate the reconstruction error term within the optimization objective of Im- FairAD and the fairness term within the optimization objective of Ex-FairAD.
26

---

Table 8: Results of Fl-score and fairness ratio on COMPAS, Adult, Credit and CelebA. Note that the baselines,
FairOD and CFAD are tailored to tabular data. In the official code VarconVAE, there no support for image data.
Threshold=0.90
Threshold=0.95
Methods
Fairness ratio
Fairnsss ratio
FI(%) t
F1(%) t
normal
all
normal
all
COMPAS
LOF
29.85(0.00)
0.27(0.01)
0.35(0.00)
19.16(0.00)
0.34(0.00)
0.36(0.00)
Deep SVDD
37.
0.49(0.18)
0.58(0.18)
20.67(5.09)
0.39(0.18)
0.53(0.30)
Farcon VFE+LOF
14.28(0.00)
0.69(0.00)
0.77(0.00)
8.11(0.00)
0.64(0.00)
0.55(0.00)
Farcon VAE+Deep SVDD
19.50(0.89)
0.74(0.07)
0.70(0.14)
8.58(0.65)
0.68(0.22)
0.75(0.23)
FairOD
17.81(0.11)
0.70(0.04)
0.79(0.01)
14.54(0.66)
0.87(0.01)
(.88(0
Deep Fair SVDD
42.23(0.81)
0.46(0.04)
0.58(0.04)
(1.63
(0.3))
0.56(0.03)
CFAD
40.67(3.67)
0.39(0.13)
0.49(0.08)
26.95(1.49)
0.37(0.06)
0.37().03)
Ex-FairAD (Ours)
42.30(5.88)
0.71(0.18)
0.74(0.15)
28.07(5.06)
0.58(0.21)
0.51(0.07)
Im-FairAD (Ours)
47.49(4.32)
0.65(..28)
0.68(0.09)
33.88(2.75)
0.57(0.21)
0.68(0.13)
Adult
LOF
27.45(0.00)
0.34(0.00)
0,42(0.00)
24.58(0.00)
0.30(0.00)
(.34(0.00)
Deep SVDD
44.73(4.72)
0.54().24)
0.63(0.11)
26.01(13.02)
0.48(0.13)
0.54(0.07)
Farcon VAE+LOF
22.87(0.00)
0.63()
0.62(0.00)
13.33(0.00)
0.73(0.00)
0.58(0.00)
Farcon VAE+Deep SVDD
22.08(8.87)
0.5
0.73(0.18)
10.33(4.14)
0.46(0.27)
0.48(0.22)
FairOD
36.87(3.99)
0.70(0.06)
0.32(0.04)
24.82(1.61)
0.67(0.04)
(.81(0.05)
Deep Fair SVDD
45.03(1.56)
0.86(0.01)
0.835
39.43(1.35)
0.83().08)
0.86(0.06)
CFAD
48.01(5.51)
0.76(0.08)
14.)
35.76(1.60)
0.77(0.06)
0.63(0.110
Ex- Ex-FairAD (Ours)
52.75(2.19)
0.87().11)
0.92(0.03)
48.46(4.87)
0,80(0.12)
0.83()
Im-FairAD (Ours)
56.04(4.70)
0.72(0.06)
0.840).07)
47.79(1.84)
0.90(0.06)
0.92(0.04)
Credit
LOF
20.11(0.00)
0.45(0.00)
(.55().00)
11.78(0.00)
0.24(0.00)
(.33(0.00)
Deep SVDD
23.31(7.75)
0.76(0.12)
0.74(0.20)
16.26(8.71)
0.63().21) 0.72(0.11)
15.06(0.00)
0.88(0.00)
0.88(0.00)
8,06(0.00)
0.79(0.00)
0.83(0.00)
Farcon VAE+Deep SVDD
16.96(1.80)
0.94(0.02)
0.95(0.02)
8.70(1.64)
0.85(0.12)
0.87(0.10)
FairOD
41.00(0.81)
0.70(0.04)
0.74(0.02)
35.18(1.02)
0.66(0.04)
0.70(0.07)
Deep Fair SVDD CFAD
13.54(1.79)
0.81(0.06)
0.73(0.09)
15.47(0.76)
0.71(0.03)
0.70(0.05)
20.43(0.75)
0.69(0.05)
0.69(0.04)
10.53(0.22)
0.59(0.05)
0.58(0.02)
Ex- Ex-FairAA (Ours)
53,70/2.53)
0.79(0.03)
0.90(0.04)
41.06(3.79)
0.77(0.06)
0.82(0.10)
Im- FairAD (Ours)
54.32(3.43)
0.81(0.08)
0.90(0.04)
44.30(1.94)
0.72(0.05)
0.86(0.05)
CelebA
Deep SVDD
30.86(1.38)
(.91().06)
0.81(0.05)
23.08(1.24)
0.82(0.09)
O. 76(6033)
Deep Fair SVDD
14.40(2.8)
0.58(0.18)
0.65(0.11)
16.95(1.32)
0.63()
(0.1)))
Ex-FairAD (Ours)
50.29(9.04)
0.86(0.10)
0.84(0.11)
55.40(10.57)
0.83(0.08)
0.88(0.08)
Im-FairAD (Ours)
30.89(2.34)
(.89().08)
0.88(0.07)
19.83(2.88)
0.87(0.04)
0.84().07)
E.1 Reconstruction Error Term in Im-FairAD
For the optimization objective of Im-FairAD, we adjust the hyperparameter across the range {0.001, 0.01, 10, 100, 1000} to observe the changing of performance, including detection accuracy and fairness. The experimental results are shown in Figure g where (a) and (b) depict the fluctuation of AUC with varied | on balanced and skewed data, respectively. And (c) and (d) depict the fluctuation of ADPD (all test set) with varied 3 on balanced and skewed data, respectively. From Figure 6] we observe that as 3 increases, the fluctuation of AUC on both balanced and skewed data gradually diminishes. Conversely, the fluctuation of ADPD becomes more pronounced and tends to increase. This observation aligns with expectations, as the dominance of the reconstruction term in the optimization objective makes it challenging to map different protected groups into the same target distribution.
27

---

Bahanced
1.0
1.0
Thank
0.7
07
0.911
1003
0.001
0.11
Balanced
Ceait
ADPD
0:15
ADPD
0.1
0.1
0.801
1003
6:00
Figure Average AUC and ADPD (all test set) with varies the range (0.001, 0.01, 0.1, 10, 100, 10003.
E.2 Fairness Term in Ex-FairAD
For the optimization objective of Ex-FairAD, we remove the fairness regularization and conduct experiments on all datasets. The results are reported in Table(9) Observing Table the AUC (detection accuracy) of Ex- Ex-iFii improved but fairness measured by ADPD suffers from adverse effects when without fairness term in optimization objective. Moreover, we adjust the hyperparameter À across the range (0.001, 0.01, 0.1, 10, 100, 1000} to observe the changes of performance, including detection accuracy and fairness. The experimental results are visualized in Figure 7
Table 9: Comparison between the objective with fairness regularization and the objective without fairness regularization in optimization problem of Ex-FairAD.
Balanced Split
Skewed Split
Datasets
ADPD
ADPD
Methods
AUC(%)
AUC(%)
normal
all
normal
all
Ex-FairAD W/O Fairness term
COMPAS
67.22
13.02
12.90
14.40
12.05
Ex-FairAD
73.49 75.32
2.92
2.86
69.56
1.52
1.79
Adult
W/O Fairness term
5.56
5.39
74.94
9.29
8.07
Ex-FairAD
60.68
1.06
3.80
63.07
1.91
4.87
CelebA
W/O Faimesss term
62.56
3.44
5.30
64.29
3.29
3.55
Ex-FairAD
64.96
2.95
1.92
63.85
2.71
1,57
Credit
W/O Fairness term
65.40
7.21
5.87
66.63
7.33
4.64
Ex-FairAD W/O Faireess
NA
NA
NA
64.87
6.35
5.75
Titanic
NA
NA
NA
68.00
10.27
9.79
Ex-FairAD
NA
NA
NA
74.16
6.00
5.84
SP
W/O Faimesss term
76.49
8.59
8.89
F
Selection of Distance Metric M between Distributions
Based on the analysis on Module Formulation, we obtain the following optimization problem
min O
Σ M(Dns(Xes.,) D2) + BM(D ao (h)) Dx).
(27)
RES
However, the problem is intractable as data distribution Dx is unknown and (x_ D ge (h (x)(x)
cannot be computed analytically, which leads to that cannot use f-divergence [Rényl 196]
such
28

---

Bahanced
10
Thank
0.1
41-
0.-
0.-
0.911
001
23
100
1003
0:011
0.11
5.1
1000
1000
(c) Balaneed Data
(d) Skewed Data
CoNRAc
02
0.2
ADPD
ADPD
88
0.911
0.02
100
1003
0.-
0:001
0.01
1006
Figure Average AUC and ADPD (all test set) with varies in range of (0.001, 0.01, 0.1, 1, 10, 100, 1000} on datasets Adult, COMPAS and CelebA.
as KL-divergence, Hellinger distance, to measure the difference between (Xgs.) and Dz. Thus, we need to measure the divergence between Dna(&s_..) and D, by using the known samples. In such situation, Wasserstein distance, Maximum Mean Discrepancy (MMD) [Gretton et al. 2012 and Sinkhorn distance (Cuturi 2013 are all possible choices.
However, the computation cost of Wasserstein distance can quickly become prohibitive when the data dimension increases. Therefore, the options left are Sinkhorn distance and Maximum Mean Discrepancy.
Based on Grreton et al. 2012 MMD is defined
MMDFFPP.. = sup 11
(EpIf(x)] - Ly))(
(28)
where p,g are probability distributions, F is class of functions f Rd -> R and H. denotes reproducing kernel Hilbert space.
Its empirical estimate is
1
m m
MMD?[F,X,X)
k(x;, Xj)
m(m (m 1)
(29)
n
2 m
n
k(y.yy))
(x),););
n(n - 1) i=1 jf
mn
where X fxi,..., } and Y = [y1,.... }n are samples consisting of i.idd observations drawn from p and q, respectively. k(-,-) denotes kernel function.
We use Sinkhorn distance and MMD to replace the first term of the optimization problem 27 respectively, and use reconstruction error replace the second term of the problem 27 The related experimental results are provided Table where we use Gaussian kernel exp( - y as kernel function of MMD.
Based on the empirical results in COMPAS, we select Sinkhorn distance as distribution distance metric of the optimization problem 27
29

---

Table 10: The comparison between Sinkhorn distance and MMD COMPAS.
ADPD %) +
Methods
AUC(%)
normal
Im-FairAD (MMD)
60.78
6.75
6.81
Im-FairAD (Sinkhorn)
63.89
4.16
4.76
Ex-FairAD (MMD)
57.09
2.60
4.43
Ex-FairAD (Sinkhorn)
63.11
4.38
4.54
G Time Complexity and Implementation Cost Analysis
G.1 Time Complexity Analysis
As most baselines are based on deep learning techniques, the main time cost is from the training of neural networks. Thus, based networks and other methods have the similar analysis process.
proposed method, analyze the time complexity of neural
For convenience, the he is specified as follows
(x(x): = (o(.-- (W)() ...)).
(30)
where δ = (WT. W 2..... W L. W E x x and Ln is the number of layers of the network. The definition of the layer width indicates that dă d and di, m. denotes the activation function such as ReLU, LeakyReLU, Sigmoid, or Tanh. The activation functions in different layers not necessarily the same but here we the same o for convenience. Similarly, the Pe is specified as follows
(z) Wa, (a( (W (o((() )).
(31)
where = (W W 2..... WE, wy R x 3, di m, and di, d. Note that have omitted the bias terms of ha and gv for simplicity.
In the training stage, suppose the batch size of optimization is data size n, then the time complexity of training neural network is ( df d/dd"= + n Eta, dy d(_1)) where T is the total number of iterations of he and Ja. If we further assume max [max; di max; d)) I d, and L,, Lg L, the time complexity of neural network is at most nd L). In addition, for the proposed Im-FairAD and Ex-FairAD, we utilize the Sinkhorn distance to compute the loss. Therefore, the overall time complexity is (T T. )n² where the time complexity of Sinkhorn algorithm is (n))) and t the maximum iterations of Sinkhorn algorithm.
In the inference phase, for OmddL + m) where Omdd L) is from neural networks and ((m) is from the calculation of anomaly score. The detailed comparison of time complexity is provided in Table II where all the methods including ours have the same time complexity in inference phase.
samples, the time complexity of computing the anomaly score
Table The time complexity of training and inference.
Methods
Time Complexity (Training)
Time Complexity (Inference)
Deep SVDD
O(TTe + Toc) (nd Tod) L n)) O(T(nd² + n))
O(nd m)
FairOD
O(md' m)
Deep Fair SVDD
( Ta + Ty) T,d L n))
O(md- + m)
CFAD
( gae + T3 + Tu. + I.) +))
( + m)
Ex-FairAD
OT + )n²)) O tn²))
O I, m)
Im-FairAD
(md + m)
G.2 Implementation Cost Analysis
In Table [2] we report the training time and the time occupied by Sinkhorn distance in single epoch. We keep le (stop threshold error) on the three tabular datasets (COMPAS, Adult and
30

---

Credit) and 1e for CelebA. The (coefficient of entropic regularization term) is consistently set to 0.1 across all experiments.
Table 12: The training time (seconds) the datasets with balanced splitting.
Settings
Time
samples
dimension
Ex-FairAD (all)
Ex-FairAD (Sinkhorn)
Im-FairAD (all)
Im-FairAD (Sinkhorn)
Compas
2000
4
0.3842
0.1888
0.6028
0.3414
Adult
12000
4
2.932
1.645
4.645
2.900
Credit 10000
8
2.922
1.710
4.770
3.063
CelebA
16000
512
243.51
150.18
264.12
159.58
H
The Effectiveness of Equal Opportunity
According to the definition measure equal opportunity:
2 of equal opportunity, we define EO as a fairness metric that can
EO == PP- = S 8, P/- = 1 8, = =]]
P x / x ル
(32)
- -P[7"' (x) > / x Xs K 1]]
In this section, we explore the effectiveness of equal opportunity in unsupervised anomaly detection. According to definition 2 of equal opportunity, Therefore, we calculate the ADPD and EO 32) only on abnormal data. To determine threshold for calculating EO, then set to the p.-tth -th smallest anomaly score, with fixed at 0.95 for all methods, and denoting the size of the training set. we report the experimental results in Table 1 and Table [4 From the Table 13 and Table 14 we have the following observations:
need measure the fairness on abnormal data.
sort the anomaly scores of the training set in ascending order. The threshold t is
Table Detection accuracy (AUC) fairness (ADPD and EO) on COMPAS. Note that ADPD measured only on abnormal data, which makes comparable with EO.
Balanced Split
skewed Split
Methods
Fairnsss
Fairness
AUC 1
AUC +
ADPD(%)
BO(%)
ADPD(%)
E0(%)
LOF
12.99
14.82
57.25
12,91
12.47
Deep SVDD
57.58
18.97
8.99
60.24
23.82
12.54
Farcon VAE+LOF
48.72
6.13
3.37
4.84
2.41
Farcon VAE+Deep SVDD
50.48
6.69
1.54
48.83
6.02
3.23
FairOD
61.05
6.51
1.49
58.86
10.87
5.82
Deep Fair SVDD
62.71
7.46
8,99
61.05
11.61
11.74
CFAD
62,27
10.55
14.63
60.87
16.50
6.69
Ex-FairAD (Ours)
63.11
5.56
4.35
66.44
4.88
S.34
Im-FairAD (Ours)
63.89
4.70
4.13
66.58
8.95
5.09
In the transition from a balanced split to skewed split, it can be observed that equal opportunity, as measured by ADPD and EO, exhibits significantly larger values in most cases which means a unfaimesss compared
balanced split, which is consistent with the observation from results on normal and overall test set. This indicates that a skewed split poses more intractable problem for fairness than balanced split.
skewed split tends to introduce
FairOD demonstrate superior equal opportunity on the COMPAS dataset compared to Deep SVDD, fairness-unaware AD method. This observation suggests that unsupervised anomaly detection methods have the potential to ensure equal opportunity to some extents, especially when guided by reasonable assumptions (c.g., Assumption proposed in this paper). However, on the Adult dataset, FairOD and CFAD exhibit poorer equal opportunity than Deep SVDD in both balanced and skewed splits, which indicates that existing fairness-ave aware unsupervised AD methods are unable to maintain equal opportunity effectively across different data domain.
Compared all baselines, our methods (Ex-FairAD and Im-FairAD) achieve better detection accuracy (AUC) while maintaining comparable or even better equal opportunity (ADPD and EO) in most cases. This observation supports the reasonability and practicality of Assumption for our methods.
31

---

Table 14: Detection accuracy (AUC) and fairness metrics (ADPD and EO) Adult. Note that ADPD
measured only on abnormal data, which makes comparable with EO.
Balanced Split
skewed Split
Methods
Fairness
Fairness
AUC
AUC
ADPD(%)
BO(%)
ADPD(%)
EO
LOF
58.09
26.38
2.89
59.14
28.50
27.05
Dcep SVDD
60.47
10.95
6.85
61.04
21.81
5.92
Farcon VFE+LOF
53,92
7.89
2.20
50.56
8.09
4.85
Farcon VAE+Deep SVDD
$5.05
8.28
6.68
51.21
7.26
9.64
FairOD
70.63
13.57
15.29
27.13
31.29
Deep Fair SVDD
7.24
8.63
9.35
3.89
CFAD
66.89
22.38
42.29
60.28
36.41
59.89
Ex-FairAD (Ours)
73.49
3.78
6.33
69.56
4.97
8.74
Im--FiirAD (Ours)
72.05
5.85
2.73
69.34
3.60
4.38
I Experiments on Contaminated Training Set
In main experiments, all methods including the baselines and ours focus the standard setting of unsupervised anomaly detection [Ruff et al., 2018 [Cai and Fan 2022 Fu et al.] [2024], that is the training set consists of only normal samples. However, in real scenarios, small number of unknown abnormal samples may be mixed the training set. Based on this consideration, we added 1 (o((aaoomml/normm /normal) anomalous samples the balanced training and keep the test unchanged. The related results are provided in Table [T5]. where the detection accuracy of almost all methods has slight decrease and our proposed methods still achieve better or comparable detection accuracy and fairness in comparison to all baselines.
Table 15: The results on contaminated training set of COMPAS and Adult.
COMPAS
Adult
Methods
APDP(%) 4
APDP($)
AUC(%) 1
AUC(%) t
normal
all
normal
all
LOF
54.70
5.28
5.79
49.83
2.01
Deep SVDD
62.41
26.91
18.23
62.70
5.69
7.53
Farcon Farcon VAE+LOFF
46.15
4.53
1.78
51.58
3.43
2.28
Farcon Farcon VAE+ SVDD
52.82
2.73
1.83
51.36
2.16
2.54
FairOD
54.43
2.20
3.07
69.76
9.28
8.85
Deep Fair SVDD
60.09
9.50
8.65
62.02
2.07
3.74
CFAD
60.81
11.43
9.05
67.98
6.80
15.44
Ex-FairAD (Ours)
61.67
2.82
5.66
73.10
4.77
1.76
In-FairAD (Ours)
61.10
2.38
4.95
71.80
5.20
1.31
Table 16: The performance changes on COMPAS with the increasing contamination rate.
Ex Ex-FairAD
Im- FairAD
AUC (%)
normal (ADPD %)
all (ADPD %.)
AUC (%)
normal (ADPD %)
all (ADPD %)
0.00
63.11
4.38
4.54
63.89
4.16
4.76
0.05
58.84
4.33
4.55
58.88
4.11
4.72
0.10
55.89
3.98
3.45
$5.80
3.70
4.16
0.15
54.48
4.19
3.11
55.01
3.89
3.51
0.20
54.41
4.53
2.49
55.04
4.20
2.95
In addition, we conduct experiments on COMPAS (balanced splitting) to explore how faireess changes as the contamination rate er {0.05, 0.10, 0.15, 0.20) increases. The related results are reported in Table 16 In terms of fairness, we observe that the fairesss (ADPD) of normal data exhibits minor fluctuations within a small range. However, the fairness across the entire test set (including normal and abnormal samples) shows the declining trends (better fairness) cr increases. This phenomenon aligns with our optimization objective: as number of abnormal samples the training set grows, the model would achieve improved group faimess among the groups of abnormal data.
32

---

Experiments on Text dataset
To explore the effectiveness of the proposed method on other data types. We conduct experiments on text data "SS_ssetiment fairneffffss_____eeeeeaa _ateess_dataa_aa data (from HuggingFacd with gender protected attribute. In this experiment, we use BERT(bert-aagg-unne ungggedd) [Devlin et al. (2019) extract embeddings (dim=1024) and adopt balanced splitting for two groups. The related results are reported in Table 17
Table 17: The results on SST with gender protected attribute.
AUC(%)
normal
all
FairOD
42.28
8.10
5.57
Deep Fair SVDD
62.23
12.57
9.48
Ex-FairAD (Ours)
62.79
6.99
5.17
Im-FairAD (Ours)
63.64
6.68
5.03
Existing studies fairness-aware anomaly detection in graph data, such as FairGAD Neo al. (2024) and DEFEND Chang et al. [024). adopt transductive learning paradigm where the training set and test set are identical. This setting differs from the learning paradigm (inductive learning) followed by the proposed method. We expect to extend proposed framework to more data types in the future work.
K Limitations
In this work, we propose a compact distributional transformation for anomaly detection, where Sinkhorn distance (Cuturi 2013 is used for measuring the distance between distributions by their finite samples. The time complexity of Sinkhorn distance (nn²) causes relative high computational cost for large-scale data in training stage. The calculation of Sinkhorn distance is not involved in the inference stage.
http://iiiniiiicccccccc/mmmmmsse sentimmmttttnnttttnteteeemmee fairness
fairnesst_ data
33


Reviews:
[{"review_id": "FanSFSZ7ef", "reviewer": "Reviewer_Gmds", "summary": "This paper tackles group fairness in unsupervised anomaly detection. The authors first discuss the limitations of classical fairness notions and introduce two mild assumptions—transferable fairness and generalizable parity. They then propose FairAD, which learns a projection that maps each protected group onto the same latent distribution. Together with a threshold-free metric, ADPD, extensive experiments on public datasets show that FairAD achieves higher task accuracy and better fairness than baseline methods.", "questions": "- Is the ideal method theoretically achievable if we can perfectly select the projection or based on any other oracles?\n- Section H hints at experiments with minor anomaly contamination; could you quantify how much contamination degrades fairness?\n- For multi-attribute fairness, can the projection be shared across combinations of sensitive attributes (e.g., race × gender) without exploding Sinkhorn cost?", "limitations": "See weaknesses", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- This work begins with a comprehensive discussion of fairness definitions and evaluation methods, providing fresh insights for the field\n- The proposed method is novel and supported by sound theoretical grounding\n- The new metric and evaluation protocol are practical and thorough, reflecting rigorous research\n\nWeaknesses:\n- The analysis relies on assumptions—e.g., learnable abnormality, transferable fairness, and generalizable parity—that may fail when anomalies are structurally different (e.g., time-series faults or adversarial attacks)\n- The datasets do not cover sequential, graph, or large-scale image/video benchmarks\n- The impact of β (reconstruction weight) and λ (Ex-FairAD) on the fairness–accuracy trade-off is under-explored; more guidance on their influence and selection would be helpful\n- Computational overhead is not fully addressed—for example, empirical run-time versus sample size for the Sinkhorn step is missing", "was_revised": true, "final_justification": "Overall, the proposed FairAD achieves good performance and is promising in fairness-aware anomaly detection. I agree with other reviews that some assumptions may limit the generalization. I retain my recommendation of borderline accept.", "rebuttal": "**We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.**\n***\n**To Weakness 1:** Yes, anomalies in real data could be more complex. Anomaly detection under adversarial attacks and fair anomaly for time series are important and interesting problems worthy of exploration in future work. We hope that our work can bring new perspectives to these future studies.\n***\n**To Weakness 2:** We complement experiments on a text data (SST\\_sentiment\\_fairness\\_data from HuggingFace) with gender as protected attribute. In this experiment, we use BERT(bert-large-uncased) to extract embeddings (dim=1024) and adopt balanced splitting for two groups. The related results are reported in the following table.\n\\begin{matrix}\n\\hline\n & \\text{AUC (\\\\%) } & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)} \\\\\\\\\n\\hline\n    \\text{FairOD} & 42.28 & 8.10 & 5.57 \\\\\\\\\n\\hline\n    \\text{Deep Fair SVDD} & 62.23 & 12.57 & 9.48 \\\\\\\\\n\\hline\n    \\text{Ex-FairAD (Ours)}& 62.79 & 6.99 & 5.17 \\\\\\\\\n    \\text{Im-FairAD (Ours)} & 63.64 & 6.68 & 5.03 \\\\\\\\\n\\hline\n\\end{matrix}\n\nExisting studies on fairness-aware anomaly detection in graph data, such as FairGAD and DEFEND, adopt an inductive learning paradigm where the training set and test set are identical. This setting differs from the learning paradigm (transductive learning) followed by the proposed method. We expect to extend the proposed framework to more different type data in the future work.\n***\n**To Weakness 3:** In Appendices D.1 and D.2 of our paper, we evaluated the fairness-accuracy trade off by adjusting $\\beta \\in \\\\{0.001, 0.01, 0.1, 1, 10, 100, 1000\\\\}$ and $\\lambda \\in \\\\{0.001, 0.01, 0.1, 1, 10, 100, 1000\\\\}$, respectively. The corresponding results are shown in Figure 6 and 7 in our manuscript. From Figure 6, we observe that as $\\beta$ increases, the accuracy (measured by AUC) shows a trend of slight increasing first and then decreasing on both balanced and skewed data. The fairness (measured by ADPD) shows a pronounced increasing trend. From Figure 7, we observe that the impact of varying $\\lambda$ on accuracy is marginal across most datasets. As $\\lambda$ increases, the fairness shows a trend of decreasing first and then increasing in most cases.\n***\n**To Weakness 4:** We report the training time and the time occupied by Sinkhorn distance in single epoch. For this experiments, We maintain the same configurations as in our manuscript, with $\\epsilon = 1e^{-4}$ (stop threshold on error of Sinkhorn distance) on the three tabular datasets (Compas, Adult and Credit) and $\\epsilon=1e^{-3}$ for CelebA. The $\\alpha$ (coefficient of entropic regularization term) is consistently set to $0.1$ across all experiments.\n\n\\begin{equation}\n     \\text{Sinkhorn}(\\mathcal{X}, \\mathcal{Y}):=  \\min \\langle \\mathbf{P}, \\mathbf{C} \\rangle_F + \\alpha \\sum\\_{i,j}\\mathbf{P}\\_{ij}\\log(\\mathbf{P}\\_{ij}),  ~~\\text{s.t.}~\\mathbf{P}\\mathbf{1} = \\mathbf{a}, \\mathbf{P}^T\\mathbf{1}=\\mathbf{b}, \\mathbf{P} \\geq 0.\n\\end{equation}\n\n\n\n**The time cost (seconds) on the datasets with balanced splitting.**\n\n\\begin{matrix}\n    \\hline\n    \\text{Dataset} & \\text{\\\\# Samples} & \\text{Dimension} & \\text{Ex-FairAD (all)} & \\text{Ex-FairAD (Sinkhorn)} & \\text{Im-FairAD (all)}     & \\text{Im-FairAD (Sinkhorn)} \\\\\\\\\n    \\hline\n    \\text{Compas} & 2000 & 4 & 0.3842 & 0.1888 & 0.6028 & 0.3414 \\\\\\\\\n    \\hline\n    \\text{Adult} & 12000 & 4 & 2.932 & 1.645 & 4.645 & 2.900 \\\\\\\\\n    \\hline\n    \\text{Credit} & 10000 & 8 & 2.922 & 1.710 & 4.770 & 3.063 \\\\\\\\\n    \\hline\n    \\text{CelebA} & 16000 & 512 & 243.51 & 150.18 & 264.12 & 159.58 \\\\\\\\\n    \\hline\n\\end{matrix}\n\n***\n**To Question 1:** Yes. A perfect projection holds the Proposition 2, which ensures complete group fairness among different groups of normal data. Under this condition, the ideal case is achieved when both Assumption 1 and Assumption 2 hold.\n***\n\n**To Question 2:** We conduct experiments on Compas(balanced splitting) to explore how fairness changes as the contamination rate $cr \\in \\\\{0.05, 0.10, 0.15, 0.20\\\\}$ increases. The related results are reported in the following table. In terms of fairness, we observe that the fairness (measured by ADPD) of normal data exhibits minor fluctuations within a small range. However, the fairness across the entire test set (including normal and abnormal samples) shows the declining trends (better fairness) as $cr$ increases. This phenomenon aligns with our optimization objective: as the number of abnormal samples in the training set grows, the model would achieve improved group fairness among the groups of abnormal data.\n\n**The performance changes on Compas with the increasing of contamination rate.**\n\n\\begin{matrix}\n\\hline\n& \\text{Ex-FairAD} & \\text{Ex-FairAD} & \\text{Ex-FairAD} & \\text{Im-FairAD} & \\text{Im-FairAD} & \\text{Im-FairAD} \\\\\\\\\n\\hline\n & \\text{AUC (\\\\%) } & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)} & \\text{AUC (\\\\%)} & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)}\\\\\\\\\n \\hline\n    0.00 & 63.11 & 4.38 & 4.54 & 63.89 & 4.16 & 4.76 \\\\\\\\\n \\hline\n    0.05 & 58.84 & 4.33 & 4.55 & 58.88 & 4.11 & 4.72 \\\\\\\\\n \\hline\n    0.10 & 55.89 & 3.98 & 3.45 & 55.80 & 3.70 & 4.16 \\\\\\\\\n \\hline\n    0.15 & 54.48 & 4.19 & 3.11 & 55.01 & 3.89 & 3.51 \\\\\\\\\n \\hline\n    0.20 & 54.41 & 4.53 & 2.49 & 55.04 & 4.20 & 2.95 \\\\\\\\\n\\hline\n\\end{matrix}\n\n***\n**To Question 3:** The computational cost associated with the Sinkhorn distance increases linearly with the number of sensitive attributes when protecting multiple sensitive attributes $\\Omega=\\\\{ S^{(\\text{race})}, S^{(\\text{gender})}, \\cdots\\\\}$. Given that $\\vert \\Omega \\vert < 10$ in most cases, this scenario does not lead to prohibitive computational cost. To empirically validate this claim, we conduct experiments on Adult (gender \\& race) and Compas (gender \\& race) datasets to protect two sensitive attributes at the same time and report the computation cost (seconds) of Sinkhorn distance in the following table.\n\n**Time cost (seconds) of Sinkhorn distance when protecting one and two attributes in single epoch.**\n\n\\begin{matrix}\n\\hline\n & \\text{Compas} & \\text{Adult} \\\\\\\\\n \\hline\n    \\text{Im-FairAD (one)} & 0.3414 & 2.900\\\\\\\\\n\\hline\n    \\text{Im-FairAD (two)} & 0.6342 & 5.8610\\\\\\\\\n\\hline\n\\end{matrix}\n\n***"}, {"review_id": "S5gPPzq4In", "reviewer": "Reviewer_sGV5", "summary": "This paper addresses group fairness in unsupervised anomaly detection by proposing FairAD (Im-FairAD and Ex-FairAD), which maps data from different demographic groups to a shared compact distribution using density estimation and Sinkhorn distances, ensuring fairness without explicit regularization. A threshold-free fairness metric is introduced. Experiments on real datasets show better accuracy-fairness trade-offs under both balanced and skewed splits, transferring fairness to unseen anomalies while training only on normal data.", "questions": "- How does FairAD (especially with Sinkhorn) scale with higher dimensions and larger datasets ?\n- How sensitive is performance to the choice of the truncated Gaussian target distribution? Would learning a target distribution (e.g., via normalizing flows) yield further improvements while maintaining fairness?\n- Could the authors clarify how ADPD behaves under highly imbalanced groups or severe covariate shifts across groups? Are there conditions under which ADPD might fail to capture fairness violations?", "limitations": "Yes, the authors have adequately discussed limitations, assumptions, and potential societal impacts. They explicitly address the limitations of fairness guarantees in UAD, state the necessary assumptions for fairness transfer, and note that individual fairness is not tackled.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths:\n- Addresses a critical gap in fairness within UAD with clear problem formulation.\n- Solid theoretical framework, clarifying feasibility, necessary assumptions, and fairness transferability in UAD.\n- Introduction of ADPD metric is valuable for fair evaluation without arbitrary thresholds.\n- Extensive empirical validation with competitive baselines and realistic skew/balance conditions.\n- Reproducibility appears high with clear method descriptions.\n\nWeaknesses:\n- The reliance on Sinkhorn distances and density estimation could pose scalability concerns on large-scale high-dimensional data.\n- The choice of target distribution (truncated Gaussian) may limit generalizability if data manifolds are highly complex.", "was_revised": true, "final_justification": "After reading the rebuttal, I appreciate the authors' detailed response. My main concerns were addressed.\nOverall, the paper makes a novel and solid contribution to fairness in unsupervised anomaly detection, introducing both methodological innovations and empirical validation.", "rebuttal": "**We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.**\n***\n**To Weakness 1 & Question 1:** This is a practical and valuable question worthy of further exploration. There are four key factors affecting the computational cost of Sinkhorn distance. We list them below.\n\n- $n$: sample size;\n- $d$: feature dimension of sample;\n- $\\alpha$: coefficient of entropic regularization term;\n- $\\epsilon$: stop threshold on error;\n\nTo evaluate the time cost associated with Sinkhorn distance, we conduct experiments to quantify the time required for a single computation of the Sinkhorn distance on both CPU and GPU. In this experiment, we utilize a real tabular data (Census from ADBench) as source distribution and a truncated Gaussian as target distribution, which maintains the task similarity with our proposed method. We keep $(n_\\text{mini-batch}=4000, d=500)$ and adjust the $\\alpha \\in \\\\{1.0, 0.5, 0.1\\\\}$ and $\\epsilon \\in \\\\{1e^{-2}, 1e^{-3}, 1e^{-4}\\\\}$. Note that $n_\\text{mini-batch}=4000$ means that 4000 samples drawn from source distribution and an additional 4000 samples drawn from target distribution, both of which are utilized in a single computation of the Sinkhorn distance.\nAll the experiments are conducted on Ubuntu 22.04 with 10 Core Intel Xeon Processor, 1$\\times$ NVIDIA Tesla V100S-32GB, CUDA 12.4. The average results with 10 repeats are provided in the following table.\n\n**The single computation time (seconds) of Sinkhorn distance.**\n\n\\begin{matrix}\n\\hline\n & {\\epsilon=1e^{-2}} & {\\epsilon=1e^{-2}} & {\\epsilon=1e^{-2}} & {\\epsilon=1e^{-3}} & {\\epsilon=1e^{-3}} & {\\epsilon=1e^{-3}} & {\\epsilon=1e^{-4}} & {\\epsilon=1e^{-4}} & {\\epsilon=1e^{-4}}\\\\\\\\\n & \\text{CPU} & \\text{GPU} & \\text{Speedup} & \\text{CPU} & \\text{GPU} & \\text{Speedup} & \\text{CPU} & \\text{GPU} & \\text{Speedup} \\\\\\\\\n\\hline\n\\alpha=1.0 & 11.89 & 0.1825 & 65\\times & 12.07 & 0.1836 & 65\\times & 12.66 & 0.2017 & 62\\times \\\\\\\\\n\\alpha=0.5 & 12.77 & 0.1982 & 64\\times & 12.82 & 0.2020 & 63\\times & 13.14 & 0.2027 & 64\\times \\\\\\\\\n\\alpha=0.1 & 14.49 & 0.2302 & 62\\times & 14.51 & 0.2339 & 62\\times & 14.63 & 0.2367 & 61\\times \\\\\\\\\n\\hline\n\\end{matrix}\n\nThese results indicates that the GPU can consistently accelerate the computation of the Sinkhorn distance about 60 times across various $(\\alpha, \\epsilon)$ configurations when handling similar tasks. To validate the performance on different type data, we further conduct experiments on two image datasets (CIAFR10, Fashion-MNIST) and three text datasets (IMDB, 20Newsgroups, Yelp), where we directly utilize their corresponding embeddings provided in ADBench. We keep $(\\alpha=0.1, \\epsilon=1e^{-4})$ in the following results. Based on this estimation on different type datasets (different source distributions), GPU can averagely accelerate the computation of the Sinkhorn distance about 50 times.\n\n**The single computation time (seconds) of Sinkhorn distance.**\n\n\\begin{matrix}\n\\hline\n    \\text{Dataset} & \\text{Census} & \\text{CIFAR10-(0)} & \\text{Fashion-MNIST-(0)} & \\text{IMDB} & \\text{20Newsgroups-(0)} & \\text{Yelp} & \\text{Avg} \\\\\\\\\n    (n_\\text{mini-batch}, d) & (4000, 500) & (4000, 512) & (4000, 512) & (3000, 768) & (3000, 768) & (3000, 768) & -\\\\\\\\\n    \\hline\n    \\text{Time (CPU)} & 14.63 & 18.29 & 14.18 & 12.14 & 10.61 & 11.86 & 13.61\\\\\\\\\n    \\text{Time (GPU)} & 0.2367 & 0.3260 & 0.2211 & 0.3308 & 0.2200 & 0.2848 & 0.2699\\\\\\\\\n    \\text{Speedup} &  61\\times & 56\\times & 64\\times  & 36\\times & 48\\times & 41\\times & 50\\times\\\\\\\\\n\\hline\n\\end{matrix}\n\nWhen addressing a similar task (involving source distribution and feature (or embedding) dimension) with $\\textbf{one million samples}$, based on the empirical estimation, a single computation of Sinkhorn distance requires approximately $90s \\approx (1e^6 / 3000) * 0.2699s$ on the GPU. If this process is repeated 100 times, the total computational time associated with the Sinkhorn distance amounts to roughly 150 minutes. We argue that such a time cost may be acceptable for scenarios of this scale.\n\nWe summarize the several effective strategies for accelerating the computation of the Sinkhorn distance when handling high-dimensional and large-scale data as follow:\n\n- First and foremost, leveraging GPU acceleration for computing the Sinkhorn distance.\n- Dimensionality reduction when handling high-dimensional data.\n-  Employing relatively large values for $\\alpha$ and $\\epsilon$.\n- Decreasing the number of samples drawn from target distribution.\n\nBased on the truncated Gaussian on $\\mathcal{N}(\\mathbf{0}, \\mathbf{I\\_d})$ as our target distribution, we define the anomaly score function as $\\text{Score}(\\mathbf{x}\\_{\\text{new}})=\\big\\Vert h\\_\\phi(\\mathbf{x}\\_{\\text{new}}) \\big\\Vert$, which eliminates the need for a density estimation process.\n***\n**To Weakness 2:** In fact, the proposed method pays no much attention to the complexity of data distribution in the original space. We primarily expect that the normal data locate in some high-density regions in the latent space for a clear and reliable decision boundary. The transformation capability between distributions of the proposed method depends on the complexity of the neural networks and the accuracy of the distribution distance measurement. Theoretically, leveraging neural networks and the Sinkhorn distance, our method can effectively transform the complex data distributions into a well-defined target distribution.\n***\n**To Question 2:** We conduct experiments to explore the sensitive of performance for different truncated radius $r$. The truncated radius $r$ is determined based on sampling probability $p$ in a Gaussian distribution $\\mathcal{N}(\\mathbf{0}, \\mathbf{I}_d)$. We adjust $p \\in \\\\{0.80, 0.85, 0.90, 0.95\\\\}$ and related results are reported in the following table. We can observe that the performance (including detection accuracy and fairness) exhibits minor fluctuations within a reasonable changing range of $p$.\n\n**The performance with different sampling probability $p$ on COMPAS and Adult (balanced splitting). Note that $F_d$ denotes the CDF of the chi-square distribution $\\chi^2(d)$.**\n\n\\begin{matrix}\n\\hline\n r=\\sqrt{F\\^{-1}\\_d(p)} & \\text{Ex-FairAD} & \\text{Ex-FairAD} & \\text{Ex-FairAD} & \\text{Im-FairAD} & \\text{Im-FairAD} & \\text{Im-FairAD}\\\\\\\\\n     & \\text{AUC (\\\\%)} & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)} & \\text{AUC (\\\\%)} & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)}\\\\\\\\\n\\hline\n     & & & \\text{COMPAS} & & & \\\\\\\\\n\\hline\n     p=0.80 & 62.00 & 4.56 & 6.08 & 63.29 & 5.17 & 7.35\\\\\\\\\n     p=0.85 & 61.46 & 4.51 & 5.72 & 62.22 & 4.90 & 6.72 \\\\\\\\\n     p=0.90 & 63.13 & 3.40 & 6.31 & 63.17 & 4.05 & 6.97 \\\\\\\\\n     p=0.95 & 61.54 & 3.63 & 5.62 & 61.50 & 4.01 & 5.88\\\\\\\\\n\\hline\n   & & & \\text{Credit} & & & \\\\\\\\\n\\hline\n     p=0.80 & 64.98 & 3.37 & 1.66 & 63.91 & 3.31 & 1.64\\\\\\\\\n     p=0.85 & 63.38 & 3.50 & 1.80 & 62.76 & 3.32 & 2.10\\\\\\\\\n     p=0.90 & 64.37 & 3.31 & 1.33 & 66.08 & 3.56 & 2.00\\\\\\\\\n     p=0.95 & 63.21 & 2.64 & 1.31 & 63.47 & 2.68 & 1.48\\\\\\\\\n\\hline\n\\end{matrix}\n\nWhen instancing our framework by normalizing flow, we obtain the following the optimization problem:\n\n\\begin{equation}\n    \\mathop{\\text{maximize}}\\_{\\mathcal{W}} \\sum\\_{s \\in S}\\sum\\_{\\mathbf{x}\\sim \\mathcal{X}\\_{S=s}} \\log \\Big(p\\_{\\mathcal{Z}}(F\\_\\mathcal{W}(\\mathbf{x}))\\left\\vert\\det(\\nabla\\_\\mathbf{x}F\\_\\mathcal{W}(\\mathbf{x}))\\right\\vert\\Big),\n\\end{equation}\n\nwhere $S$ denotes the sensitive attributes. In this experiment, we use Real NVP as $F_\\mathcal{W}$ and $\\mathcal{N}(\\mathbf{0}, \\mathbf{I}\\_d)$ as $\\mathcal{Z}$. The related results are reported in the following tables. For $\\text{Real NVP-1}$ and $\\text{Real NVP-2}$, we use $\\log \\Big(p_{\\mathcal{Z}}(F\\_\\mathcal{W}(\\mathbf{x}\\_{new}))\\left\\vert\\det(\\nabla_{\\mathbf{x}\\_{new}}F\\_\\mathcal{W}(\\mathbf{x}\\_{new}))\\right\\vert\\Big)$ and $\\Vert F\\_\\mathcal{W}(\\mathbf{x}\\_{new}) \\Vert$ to measure the anomaly score of $\\mathbf{x}\\_{new}$, respectively. In this experiment, Real NVP indeed improves the detection performance. However, it results in degraded fairness compared to the original instances (Im-FairAD and Ex-FairAD).\n\n\\begin{matrix}\n\\hline\n    & \\text{AUC (\\\\%)} & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)}\\\\\\\\\n\\hline\n    \\text{RealNVP-1} & 70.51  & 18.23 & 16.15 \\\\\\\\\n    \\text{RealNVP-2} & 64.54 & 10.93 & 10.74\\\\\\\\\n    \\hline\n    \\text{Ex-FairAD} &  63.11 & 4.38 & 4.54\\\\\\\\\n    \\text{Im-FairAD} & 63.89 & 4.16 & 4.76\\\\\\\\\n\\hline\n\\end{matrix}\n***\n**To Question3:** The definition of ADPD indicates its insensitivity to the sizes of groups concerning the sensitive attribute, as it is probability-based. Depending on the definition, ADPD can effectively measure the group fairness/unfairness across all possible cases."}, {"review_id": "3zoxb2pZMV", "reviewer": "Reviewer_ieQH", "summary": "The paper addresses the problem of fairness in unsupervised anomaly detection, particularly in high-stakes domains like finance and healthcare. The authors introduce two new methods (Im-FairAD and Ex-FairAD) that map data from different demographic groups to a shared, compact target distribution to ensure group fairness while maintaining high detection accuracy. A threshold-free fairness metric (ADPD) is also proposed for a more holistic fairness evaluation.", "questions": "- You rely heavily on Assumptions 1–3 (learnable abnormality, transferable fairness, and generalizable parity). Could you elaborate on how these assumptions can be validated or approximated in practice, especially in domains where abnormal samples may differ significantly from normal data?\n- The method hinges on mapping data to a shared, compact target distribution (a truncated Gaussian). How sensitive is the model performance to this specific choice? Have you explored other target distributions, and if so, how do they compare?\n- The use of Sinkhorn distance and deep architectures may raise concerns about scalability. How will this work for bigger datasets?\n- The approach focuses on group fairness across single protected attributes (e.g., race or gender). Have you considered how FairAD performs under intersectional fairness settings involving multiple overlapping attributes? If not, what challenges do you foresee in extending your method to this scenario?", "limitations": "A limitation can be that the fairness guarantees rest on assumptions (e.g. learnable abnormality and transferable fairness). These are plausible but I cannot be verified or enforced in all scenarios. Also since no anomalous samples are used during training, the fairness on unseen anomalies cannot be theoretically guaranteed without further assumptions.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\nThe paper makes significant theoretical and empirical contributions by rigorously analyzing fairness feasibility in UAD, introducing strong foundational assumptions, and validating them experimentally. Im-FairAD is performed equal or better than prior methods in balancing detection accuracy and fairness across multiple real-world datasets. The proposed threshold-free ADPD metric is another important contribution, addressing key limitations in previous fairness evaluation techniques.\n\nWeaknesses:\nWhile the theoretical framework is well-motivated, the practical complexity of computing Sinkhorn distances and training fairness-aware projections could have some scalability issues. Moreover, the proposed methods assume the availability of well-defined demographic groupings and rely on reasonably fair target distributions, which might not generalize well across all domains.", "was_revised": true, "final_justification": "The authors addressed all of my questions and weaknesses. Also reading the other reviewers I would like to upgrade my score.", "rebuttal": "**We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.**\n***\n**To Weakness & Question 3:** There are four key factors affecting the computational cost of Sinkhorn distance. We list them below.\n- $n$: sample size;\n- $d$: feature dimension of sample;\n- $\\alpha$: coefficient of entropic regularization term;\n- $\\epsilon$: stop threshold on error;\n\nTo evaluate the time cost associated with Sinkhorn distance, we conduct experiments to quantify the time required for a single computation of the Sinkhorn distance on both CPU and GPU. In this experiment, we utilize a real tabular data (Census from ADBench) as source distribution and a truncated Gaussian as target distribution, which maintains the task similarity with our proposed method. We keep $(n_\\text{mini-batch}=4000, d=500)$ and adjust the $\\alpha \\in \\\\{1.0, 0.5, 0.1\\\\}$ and $\\epsilon \\in \\\\{1e^{-2}, 1e^{-3}, 1e^{-4}\\\\}$. Note that $n_\\text{mini-batch}=4000$ means that 4000 samples drawn from source distribution and an additional 4000 samples drawn from target distribution, both of which are utilized in a single computation of the Sinkhorn distance.\nAll the experiments are conducted on Ubuntu 22.04 with 10 Core Intel Xeon Processor, 1$\\times$ NVIDIA Tesla V100S-32GB, CUDA 12.4. The average results with 10 repeats are provided in the following table.\n\n**The single computation time (seconds) of Sinkhorn distance.**\n\n\\begin{matrix}\n\\hline\n & {\\epsilon=1e^{-2}} & {\\epsilon=1e^{-2}} & {\\epsilon=1e^{-2}} & {\\epsilon=1e^{-3}} & {\\epsilon=1e^{-3}} & {\\epsilon=1e^{-3}} & {\\epsilon=1e^{-4}} & {\\epsilon=1e^{-4}} & {\\epsilon=1e^{-4}}\\\\\\\\\n & \\text{CPU} & \\text{GPU} & \\text{Speedup} & \\text{CPU} & \\text{GPU} & \\text{Speedup} & \\text{CPU} & \\text{GPU} & \\text{Speedup} \\\\\\\\\n\\hline\n\\alpha=1.0 & 11.89 & 0.1825 & 65\\times & 12.07 & 0.1836 & 65\\times & 12.66 & 0.2017 & 62\\times \\\\\\\\\n\\alpha=0.5 & 12.77 & 0.1982 & 64\\times & 12.82 & 0.2020 & 63\\times & 13.14 & 0.2027 & 64\\times \\\\\\\\\n\\alpha=0.1 & 14.49 & 0.2302 & 62\\times & 14.51 & 0.2339 & 62\\times & 14.63 & 0.2367 & 61\\times \\\\\\\\\n\\hline\n\\end{matrix}\n\nThese results indicates that the GPU can consistently accelerate the computation of the Sinkhorn distance about 60 times across various $(\\alpha, \\epsilon)$ configurations when handling similar tasks. To validate the performance on different type data, we further conduct experiments on two image datasets (CIAFR10, Fashion-MNIST) and three text datasets (IMDB, 20Newsgroups, Yelp), where we directly utilize their corresponding embeddings provided in ADBench. We keep $(\\alpha=0.1, \\epsilon=1e^{-4})$ in the following results. Based on this estimation on different type datasets (different source distributions), GPU can averagely accelerate the computation of the Sinkhorn distance about 50 times.\n\n**The single computation time (seconds) of Sinkhorn distance.**\n\n\\begin{matrix}\n\\hline\n    \\text{Dataset} & \\text{Census} & \\text{CIFAR10-(0)} & \\text{Fashion-MNIST-(0)} & \\text{IMDB} & \\text{20Newsgroups-(0)} & \\text{Yelp} & \\text{Avg} \\\\\\\\\n    (n_\\text{mini-batch}, d) & (4000, 500) & (4000, 512) & (4000, 512) & (3000, 768) & (3000, 768) & (3000, 768) & -\\\\\\\\\n    \\hline\n    \\text{Time (CPU)} & 14.63 & 18.29 & 14.18 & 12.14 & 10.61 & 11.86 & 13.61\\\\\\\\\n    \\text{Time (GPU)} & 0.2367 & 0.3260 & 0.2211 & 0.3308 & 0.2200 & 0.2848 & 0.2699\\\\\\\\\n    \\text{Speedup} &  61\\times & 56\\times & 64\\times  & 36\\times & 48\\times & 41\\times & 50\\times\\\\\\\\\n\\hline\n\\end{matrix}\n\nWhen addressing a similar task (involving source distribution and feature (or embedding) dimension) with $\\textbf{one million samples}$, based on the empirical estimation, a single computation of Sinkhorn distance requires approximately $90s \\approx (1e^6 / 3000) * 0.2699s$ on the GPU. If this process is repeated 100 times, the total computational time associated with the Sinkhorn distance amounts to roughly 150 minutes. We argue that such a time cost may be acceptable for scenarios of this scale.\n\nWe summarize the several effective strategies for accelerating the computation of the Sinkhorn distance when handling high-dimensional and large-scale data as follow:\n\n- First and foremost, leveraging GPU acceleration for computing the Sinkhorn distance.\n- Dimensionality reduction when handling high-dimensional data.\n-  Employing relatively large values for $\\alpha$ and $\\epsilon$.\n- Decreasing the number of samples drawn from target distribution.\n\nFor the information of well-defined demographic groups, the current version needs to know the protected attributes accurately and a compact target distribution is critical for distinguishing between normal and abnormal samples. We hope the future work can relieve the dependence for accurate demographics and try to propose more general target distribution.\n***\n**To Question 1:** First, when abnormal samples differ significantly from normal data, the anomaly detection task becomes trivial. In other words, the anomalies can be identified easily and accurately and the False Positive Rate $FPR=0$ can be achieved. Under such conditions, it does not yield fairness issues technically, as no samples would be misidentified. Regarding the demographic parity of true abnormal samples between groups, it is not a technical issue in this situation.\n\nFor these assumptions:\n- Assumption 1 ensures the learnability of normal patterns while providing feasibility guarantees for the unsupervised anomaly detection task. All the existing unsupervised anomaly detection works have validated the assumption. In real-world scenarios, especially fault detection in industry, it is quite common that anomalous samples emerge as perturbed normal samples and the evolution from normality to anomaly is gradual. \n- Similarly, on Assumption 2 and Assumption 3, they have already verified by the existing fairness-aware anomaly detection works, such as FairOD, Deep Fair SVDD, CFAD and so on. In our experiments, the results on real-world datasets validate the reasonability of the two assumptions again.\n- Certainly, these assumptions cannot hold all domains and scenarios, nor is that our goal. In fact, we make (or summarize) these assumptions in order to clarify the necessary prerequisites for unsupervised anomaly detection (UAD) and fairness-aware UAD.\n***\n**To Question 2:** We conduct experiments to explore the sensitive of performance for different truncated radius $r$. The truncated radius $r$ is determined based on sampling probability $p$ in a Gaussian distribution $\\mathcal{N}(\\mathbf{0}, \\mathbf{I}_d)$. We adjust $p \\in \\\\{0.80, 0.85, 0.90, 0.95\\\\}$ and related results are reported in the following table. We can observe that the performance (including detection accuracy and fairness) exhibits minor fluctuations within a reasonable changing range of $p$.\n\n**The performance with different sampling probability $p$ on COMPAS and Adult (balanced splitting). Note that $F_d$ denotes the CDF of the chi-square distribution $\\chi^2(d)$.**\n\n\\begin{matrix}\n\\hline\n r=\\sqrt{F\\^{-1}\\_d(p)} & \\text{Ex-FairAD} & \\text{Ex-FairAD} & \\text{Ex-FairAD} & \\text{Im-FairAD} & \\text{Im-FairAD} & \\text{Im-FairAD}\\\\\\\\\n     & \\text{AUC (\\\\%)} & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)} & \\text{AUC (\\\\%)} & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)}\\\\\\\\\n\\hline\n     & & & \\text{COMPAS} & & & \\\\\\\\\n\\hline\n     p=0.80 & 62.00 & 4.56 & 6.08 & 63.29 & 5.17 & 7.35\\\\\\\\\n     p=0.85 & 61.46 & 4.51 & 5.72 & 62.22 & 4.90 & 6.72 \\\\\\\\\n     p=0.90 & 63.13 & 3.40 & 6.31 & 63.17 & 4.05 & 6.97 \\\\\\\\\n     p=0.95 & 61.54 & 3.63 & 5.62 & 61.50 & 4.01 & 5.88\\\\\\\\\n\\hline\n   & & & \\text{Credit} & & & \\\\\\\\\n\\hline\n     p=0.80 & 64.98 & 3.37 & 1.66 & 63.91 & 3.31 & 1.64\\\\\\\\\n     p=0.85 & 63.38 & 3.50 & 1.80 & 62.76 & 3.32 & 2.10\\\\\\\\\n     p=0.90 & 64.37 & 3.31 & 1.33 & 66.08 & 3.56 & 2.00\\\\\\\\\n     p=0.95 & 63.21 & 2.64 & 1.31 & 63.47 & 2.68 & 1.48\\\\\\\\\n\\hline\n\\end{matrix}\n\nWe use truncated Uniform in hypersphere as target distribution and related results are reported in the following table.\n\n\\begin{matrix}\n\\hline\n& \\text{Ex-FairAD} & \\text{Ex-FairAD} & \\text{Ex-FairAD} & \\text{Im-FairAD} & \\text{Im-FairAD} & \\text{Im-FairAD}\\\\\\\\\n & \\text{AUC (\\\\%)} & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)} &\\text{AUC (\\\\%)} & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)}\\\\\\\\\n\\hline\n     & & & \\text{COMPAS} & & & \\\\\\\\\n\\hline\n     \\text{Uniform} & 60.02 & 4.09 & 4.99 & 60.47 & 3.79 & 3.92\\\\\\\\\n     \\text{Gaussian} & 63.11 & 4.38 & 4.54 & 63.89 & 4.16 & 4.76\\\\\\\\\n\\hline\n    & & & \\text{Credit} & & & \\\\\\\\\n\\hline\n    \\text{Uniform} & 62.57 & 3.79 & 2.25 & 63.73 & 4.85 & 3.08\\\\\\\\\n     \\text{Gaussian} & 64.96 & 2.95 & 1.92 & 63.70 & 2.20 & 1.97\\\\\\\\\n\\hline\n\\end{matrix}\n***\n**To Question 4:** The original optimization objective of Im-FairAD is as follows:\n\\begin{equation}\n    \\underset{\\phi, \\psi}{\\text{min}} ~ \\sum\\_{s \\in S}\\text{Sinkhorn}(h\\_\\phi(\\mathcal{X}\\_{S=s}), \\mathcal{Z}) + \\frac{\\beta}{n}\\sum\\_{i=1}\\^{n} \\Vert \\mathbf{x}\\_i - g_\\psi(h\\_\\phi(\\mathbf{x}\\_i)) \\Vert^2,\n\\end{equation}\nwhere only single protected attribute is considered. When protecting multiple sensitive attributes (e.g., race \\& gender), the optimization objective of Im-FairAD can be naturally reformulated to the following form (similar on Ex-FairAD).\n\\begin{equation}\n    \\underset{\\phi, \\psi}{\\text{min}} ~ \\sum\\_{S \\in \\Omega} \\sum\\_{s \\in S}\\text{Sinkhorn}(h\\_\\phi(\\mathcal{X}\\_{S=s}), \\mathcal{Z}) + \\frac{\\beta}{n}\\sum\\_{i=1}^{n} \\Vert \\mathbf{x}\\_i - g\\_\\psi(h\\_\\phi(\\mathbf{x}\\_i)) \\Vert^2,\n\\end{equation}\nwhere $\\Omega = \\\\{S^{\\text{(race)}}, S^{\\text{(gender)}}, \\cdots\\\\}$ denotes the set of sensitive attributes. Meanwhile, the proposed fairness metric, ADPD, becomes\n\\begin{equation}\n    \\text{ADPD} := \\frac{1}{n \\cdot \\vert \\Omega \\vert} \\sum_{S \\in \\Omega}\\sum_{k=1}^{n} \\Big\\vert  \\mathbb{P}(\\text{Score}(\\mathcal{X}) > t_k | S=s_i ) \n    -  \\mathbb{P}(\\text{Score}(\\mathcal{X}) > t_k | S=s_j) \\Big\\vert.\n\\end{equation}\n***"}, {"review_id": "5HosIZVYUb", "reviewer": "Reviewer_QFnW", "summary": "The authors propose FairAD, a novel method addressing group fairness in unsupervised anomaly detection. The approach maps demographic groups into a common target distribution, ensuring fairness without explicit constraints. The paper also introduces ADPD, a new threshold-free fairness metric compared to previous threshold-sensitive metrics, and demonstrates superior accuracy-fairness trade-offs empirically through comprehensive experiments.", "questions": "1. Given that your fairness method relies on mapping demographic groups to a common distribution, how would extreme demographic imbalances (e.g., very small minority groups) affect the quality of this mapping?\n  \n2. The current work primarily validates performance on tabular data. Can you theoretically or empirically discuss how the compact-distribution mapping might behave differently on high-dimensional data such as images or sequential data like time series?\n\n3. Your fairness metric, ADPD, is threshold-free and well-suited for binary group scenarios. Can you extend or elaborate on its applicability and theoretical robustness when dealing with multiple protected attributes?", "limitations": "The authors have adequately addressed methodological assumptions and limitations.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths\n- This paper provided theoretical foundations clearly articulate necessary conditions for fairness in unsupervised AD settings.\n- The proposed method is novel, effectively combining anomaly detection and fairness via distribution alignment.\n- Comprehensive empirical validation across diverse datasets convincingly demonstrates the method's effectiveness.\n- Introduction of the ADPD metric mitigates the limitations of current threshold-sensitive metrics.\n\n### Weaknesses\n- Evaluation predominantly focused on tabular data (only one image dataset); potential applicability to other domains remains underexplored.\n- The evaluation does not consider scenarios involving multiple protected attributes; exploring how FairAD and the ADPD metric generalize to such multi-attribute fairness settings would further strengthen the work.", "was_revised": true, "final_justification": "Thank you for addressing my questions. The clarifications have been helpful. I will keep my rating.", "rebuttal": "**We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.**\n***\n**To Weakness 1 & Question 2:** We complement experiments on a **text data (SST\\_sentiment\\_fairness\\_data from HuggingFace)** with gender as protected attribute. In this experiment, we use BERT(bert-large-uncased) to extract embeddings (dim=1024) and adopt balanced splitting for two groups. The related results are reported in the following table.\n\n\\begin{matrix}\n\\hline\n & \\text{AUC (\\\\%) } & \\text{normal (ADPD \\\\%)} & \\text{all (ADPD \\\\%)} \\\\\\\\\n\\hline\n    \\text{FairOD} & 42.28 & 8.10 & 5.57 \\\\\\\\\n\\hline\n    \\text{Deep Fair SVDD} & 62.23 & 12.57 & 9.48 \\\\\\\\\n\\hline\n    \\text{Ex-FairAD (Ours)}& 62.79 & 6.99 & 5.17 \\\\\\\\\n    \\text{Im-FairAD (Ours)} & 63.64 & 6.68 & 5.03 \\\\\\\\\n\\hline\n\\end{matrix}\nWe expect to extend the proposed framework to more different type of data (e.g. point cloud, graphs, video) in the future work.\n***\n**To Weakness 2 & Question 3:** \n The original optimization objective of Im-FairAD is as follows:\n\\begin{equation}\n    \\underset{\\phi, \\psi}{\\text{min}} ~ \\sum\\_{s \\in S}\\text{Sinkhorn}(h\\_\\phi(\\mathcal{X}\\_{S=s}), \\mathcal{Z}) + \\frac{\\beta}{n}\\sum\\_{i=1}\\^{n} \\Vert \\mathbf{x}\\_i - g_\\psi(h\\_\\phi(\\mathbf{x}\\_i)) \\Vert^2,\n\\end{equation}\nwhere only single protected attribute is considered. When protecting multiple sensitive attributes (e.g., race \\& gender), the optimization objective of Im-FairAD can be naturally reformulated to the following form (similar on Ex-FairAD).\n\n\\begin{equation}\n    \\underset{\\phi, \\psi}{\\text{min}} ~ \\sum\\_{S \\in \\Omega} \\sum\\_{s \\in S}\\text{Sinkhorn}(h\\_\\phi(\\mathcal{X}\\_{S=s}), \\mathcal{Z}) + \\frac{\\beta}{n}\\sum\\_{i=1}^{n} \\Vert \\mathbf{x}\\_i - g_\\psi(h\\_\\phi(\\mathbf{x}\\_i)) \\Vert^2,\n\\end{equation}\nwhere $\\Omega = \\\\{S^{\\text{(race)}}, S^{\\text{(gender)}}, \\cdots\\\\}$ denotes the set of sensitive attributes. Meanwhile, the proposed fairness metric, ADPD, becomes\n\\begin{equation}\n    \\text{ADPD} := \\frac{1}{n \\cdot \\vert \\Omega \\vert} \\sum_{S \\in \\Omega}\\sum_{k=1}^{n} \\Big\\vert  \\mathbb{P}(\\text{Score}(\\mathcal{X}) > t_k | S=s_i ) \n    -  \\mathbb{P}(\\text{Score}(\\mathcal{X}) > t_k | S=s_j) \\Big\\vert.\n\\end{equation}\n\nWhen the number of values of the protected attribute (e.g., race) exceeds two, i.e., $\\vert S \\vert > 2$, the ADPD becomes\n\n\\begin{equation}\n    \\text{ADPD} := \\frac{1}{n \\cdot \\vert \\Omega \\vert} \\sum\\_{S \\in \\Omega}\\sum\\_{k=1}\\^{n} \\max \\big(  \\big\\\\{  \\big\\vert \\mathbb{P}(s\\_i) - \\mathbb{P}(s\\_j) \\big\\vert  \\big\\\\}^{s\\_i, s\\_j \\in S}\\_{i \\neq j}  \\big),\n\\end{equation}\nwhere $\\mathbb{P}(s_i) = \\mathbb{P}(\\text{Score}(\\mathcal{X}) > t_k | S=s_i)$ and the range of ADPD still is [0, 1).\n***\n**To Question 1:** This is a great question. In such scenario, the accuracy of distance measurement between distributions is compromised, which limits distribution transformation capability of the proposed method and further impacts the performance the detection and fairness for the extremes small groups.\n***"}, {"review_id": "B1jqYLeVVj", "reviewer": "Reviewer_tpFa", "summary": "This paper presents analysis and methodology for anomaly detection in an unsupervised setting while ensuring group fairness. The paper presents basic definitions and feasibility for fairness in this setting and a method to obtain a common target distribution and overall fairness metric without requiring a fixed threshold.  The paper also presents computational results using practical benchmarks.", "questions": "1) What is the best possible in terms of the fairness objective in the unsupervised setting?\n2) What is the worst-case complexity for achieving the optimal objective value? \n3) What is the worst case impact on anomaly detection with a fairness constraint?", "limitations": "The authors have considered the limitations to some extent but they could explore the overall impact on anomaly detection to a greater extent.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The strengths of the paper are in its overall framing of fairness issues in this setting and in its introduction of an effective method. Given the relatively little work on the topic, this is significant.  The weaknesses are relatively limited theoretical bases for the method (especially relative to alternatives) and limited consideration of additional factors that appear in other studies (e.g., network effects).", "was_revised": true, "final_justification": "I think all the points raised in the discussion were valid and that the authors responded well to them. I have not altered my score.", "rebuttal": "**We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.**\n***\n**Question 1: What is the best possible in terms of the fairness objective in the unsupervised setting?**\n\n**Response:** The ideal case involves achieving complete demographic parity across all groups for both normal and abnormal data. The necessary conditions for the ideal case are outlined below. For simplicity, we consider a sensitive attribute associated with two demographic groups, denoted as $s_i, s_j$.\n- For the normal data $\\mathcal{X}=\\\\{ \\mathbf{x}\\_1, \\mathbf{x}\\_2, \\cdots, \\mathbf{x}\\_n \\\\}$, the complete demographic parity across groups is achieved when Proposition 2 (Section 3.3.3) holds, i.e., $h\\_\\phi (\\mathcal{X}\\_{s\\_i}) =h\\_\\phi (\\mathcal{X}\\_{s\\_j})$ where $h_\\phi$ denotes the distribution projector.\n- For the abnormal data $\\mathcal{\\tilde{X}}=\\\\{ \\mathbf{\\tilde{x}}\\_1, \\mathbf{\\tilde{x}}\\_2, \\cdots, \\mathbf{\\tilde{x}}\\_m \\\\}$, the complete demographic parity across groups is achieved when both Proposition 2 (Section 3.3.3) and Assumption 2 (Section 3.2) hold. Specifically, if the anomalies are generated from the normal data by a perturbation function $f$, such that $\\mathbf{\\tilde{x}} = f(\\mathbf{x})$, then the condition $f \\circ h = h \\circ f$ ensures that the ideal case with respect to fairness is attained for both normal and abnormal data when Proposition 2 holds.\n***\n**Question 2: What is the worst-case complexity for achieving the optimal objective value?**\n\n**Response:** We are a little confused about this question. Do you mean the iterative complexity for the optimal objective value in (11)? Since the optimization is highly nonconvex, there is no guarantee to achieve the optimal objective value. This is very common in deep learning. If you mean the complexity for reaching the zero objective value in (10), it depends the data and network size. The worst-case complexity for the network is that widths of all layers are equal to the input data dimension. That means, we have to compute the density in high-dimensional space, which may raise the test error.\n***\n\n**Question 3: What is the worst case impact on anomaly detection with a fairness constraint?**\n\n**Response:** For simplicity, we assume to protect a sensitive attribute associated with two demographic groups. If samples from one group are abnormal while those from the other group are normal, imposing a fairness constraint on the optimization objective will inevitably degrade detection accuracy in such scenario. In the extreme case where complete group fairness is achieved between groups, the detection capability of the detector is lost entirely (e.g., AUROC=0.5)..\n***"}]

Author rebuttal:

Meta-review: This work focuses on the problem of group fairness in unsupervised anomaly detection.  The authors propose FairAD, a method that learns a projection to map data from different demographic groups into a shared, compact distribution, thereby ensuring fairness without explicit regularization. They also introduce ADPD, a threshold-free metric for fairness evaluation, and show improved results in balancing detection accuracy and fairness in experiments on public datasets.

All reviewers leaned towards accepting this work, and maintained (or increased) their positive scores throughout rebuttal.

Main feedback:

- concerns around the reliance on strong assumptions, such as "learnable abnormality" and "transferable fairness." Several reviewers questioned whether these assumptions would hold in practice, especially for complex types of anomalies (Gmds, sGV5, ieQH, tpFa).

- computational overhead and scalability -- reviewers raised concerns around the computational cost of the Sinkhorn distance on large, high-dimensional datasets. To this, authors provided empirical analysis showing that GPU acceleration and other strategies can make the method feasible in practice (Gmds, sGV5, ieQH).

-- reviewers felt the work had a somewhat limited evaluation scope, focusing on tabular data. Reviewers requested additional experiments on other data types (e.g. text, images) and for scenarios with multiple protected attributes or extreme group imbalances (Gmds, sGV5, QFnW). Authors responded by providing new results on a text dataset and explaining how the framework might be extended to multi-attribute fairness.
Decision: Accept (poster)