Reproducibility study of "Robust Fair Clustering: A Novel Fairness Attack and Defense Framework"
Authors: Lucas Ponticelli
Vincent Loos
Eren Kocadag
Kacper Bartosik
Venue: Accepted by TMLR ()

Abstract: This reproducibility study examines "Robust Fair Clustering: A Novel Fairness Attack and Defense Framework" by Chhabra et al. (2023), an innovative work in fair clustering algorithms. Our study focuses on validating the original paper's claims concerning the susceptibility of state-of-the-art fair clustering models to adversarial attacks and the efficacy of the proposed Consensus Fair Clustering (CFC) defence mechanism. We employ a similar experimental framework but extend our investigations by using additional datasets. Our findings confirm the original paper's claims, reinforcing the vulnerability of fair clustering models to adversarial attacks and the robustness of the CFC mechanism.

Reproducibility study of "Robust Fair Clustering: A Novel Fairness Attack and Defense Framework"
Lucas Ponticelli
woaa-ponticlll@sstudee.......
University of Amsterdam, Amsterdam, the Netherlands
Vincent Loos
wincent@koloos.ue
University of Amsterdam, Amsterdam, the Netherlands
Eren Kocadag
ewn.kocadag@Sttudent.vv...
University of Amstendam, Amsterdam, the Netherlands
Kacper Bartosik
kaeper. www.osikkouttookkkooookkkkkk
University of Amsterdam, Amsterdam, the Netherlands
https: // openrevee.. net/ forum? id= XuIsEPhjgH
Abstract
This reproducibility study examines 'Robust Fair Clustering: A Novel Fairness Attack and Defense Framework' by Chhabra et al. (2023). an innovative work in fair clustering algo- rithms. Our study focuses on validating the original paper's claims concerning the suscep- tibility of state-of-the-art fair clustcring models adversarial attacks and the efficacy of the proposed Consensus Fair Clustering (CFC) defence mechanism. We employ similar experimental framework but extend investigations by using additional datasets. Our findings confirm the original paper's claims, reinforcing the vulnerability of fair clustering models to adversarial attacks and the robustness of the CFC mechanism.
1 Introduction
Clustering algorithms can be used in different contexts that have consequences on the lives of people in so- cieties (Ghosal al. 2020). Tn the past few years, clustering algorithms have been developed to ensure that performing tasks such awarding home loans or predicting recidivism are done in way that fair and un- biased. In recent times, there has been notable number of works in this research domain (Bera et al. 2019
'Robust Fair Clustering: A Novel Fairness Attack and Defense Framework' by Chhabra et al. 20233 portrays how susceptible existing fair clustering algorithms are to adversarial attacks. The authors also introduce a novel black- box attack, which decreases the fairness performances of clustering models. Morcover, the Consensus Fair Clustering (CFC) algorithm introduced, which resilient these attacks.
In this paper, we aim to reproduce the work done by Chhabra al. performing similar experiments in new contexts. The following contributions made:
(2023) and build upon it by
All of the work done by Chhabra al. is reproduced by experiments that conducted. Through this, the claims made in the original paper are supported.
We extend upon the work of the original authors by performing the experiments on datasets with different characteristics than the ones utilized in the original study. By doing this, the robustness of the novel fair clustering algorithm is evaluated.

---

2
Scope of reproducibility
Chhabra et al. 2023 address the vulnerability of fair clustering algorithms to adversarial attacks and propose
defence mechanism for these attacks. The authors make the following three claims:
Claim 1: State-of-the-art fair clustering models are highly susceptible to adversarial attacks, which can significantly diminish their fairness performance.
Claim 2: The novel black-box attack introduced can effectively degrade the fairness performance by altering small portion of protected group memberships.
Claim 3:
The proposed Consensus Fair Clustering (CFC) defence mechanism not only resists adversarial attacks but can also maintain or even improve clustering performance post-attack.
The authors' work expands the concept of fairness in machine learning by introducing novel approach: ensuring fairness while faced with adversarial challenges. It emphasises the importance of developing Al systems that can maintain fairness when under attack, expanding the conversation beyond static criteria of algorithmic fairness. This research also opens up chances to investigate and compare different strategies for fair clustering under adversarial conditions, contributing to the broader discussion on building fair AI systems.
3 Methodology
This section delves inlo the specifics of our approach to reproduce the paper by Chhabra et al. (2023) It describes the used algorithms, the different datasets, the utilised eyper-parameters. the experimental setup of our study, the explanation of the different metrics and finally the computational requirements and environmental impact.
3.1 Models description
2023 introduce three key clustering algorithms: Fair K-Center (KFC) (Harb & Laam 2020), Fair Spectral Clustering (FSC) (Kleindessner et al. 2019). and Scalable Fairlet Decomposition (SFD) Backurs al. 2019). all designed for fairness-aware clustering.
In their study, Chhabra et al.
The KFC algorithm is tailored for fairness in clustering, particularly within the realm of the k-center clus- tering problems where the maximum distance between any data point and its assigned cluster center is minimized. FSC, fairness-aware clustering algorithm, concentrates on spectral clustering, a technique util- ising the eigenvectors similarity matrix for clustering. SFD, with a specific focus on fairness in clustering, employs fairlet decomposition: a method for partitioning data into small, balanced clusters. In essence, these algorithrs tackle fairness concerns in clustering by integrating fairness-aware objectives or constraints into their methodologies.
Chhabra al. 2023 attack these clustering algorithms using their novel black-box attack algorithm. This algorithm aims to reduce the fairness utility of the fair clustering algorithms by perturbing small percentage of samples' protected group memberships. The problem can be summarised as minimisation problem where a given measure of fairness utility the objective:
min ((O(O, GD), s.t. O ((G, GA
Where: GA is a small portion of the protected groups, Gp is the entire set of protected groups, F a fair clustering algorithm, K is the number of clusters, X is the dataset, 1) and 0 are mapping functions and yp is given fairness utility function. This utility function trying find the best configuration of clusters (K) such that the clustering outcome fair with respect the entire of protected groups (Gp), even when small portion (chosen randomly) of these groups (GA) is deliberately manipulated by adversary. The
2

---

fairness utility function evaluates how fair these clusters are, and the goal is to minimize this evaluation, ensuring fairness in the clustering outcome despite potential adversarial interference.
The above problem is a two-level hierarchical optimisation problem (Anandalingam & Friesz 1992) To obtain solutions for this problem, RACOS (Yu et al.) 2016) is used due to its known theoretical guarantees and the non-convex and non-differentiable nature of the problem.
For the defence part, Consensus Fair Clustering (CFC) is introduced, depicted in Chhabra et al. (2023) The method efficiently transforms the consensus clustering problem into graph partitioning task. It lever- ages novel graph-based neural network architecture for learning representations tailored to fair clustering. CFC adeptly addresses data and algorithmic challenges posed by attacks through a concise two-stage process.
In the initial stage, a subset of training data selectively sampled, and cluster analysis is conducted to derive the basic partition and co-association matrix. Given that poisoned samples constitute a. minor fraction of the overall training data, their probability of inclusion in the subset minimised, mitigating their negative impact. In the second stage, CFC integrates the basic partitions with a fairness constraint, thereby enhancing the algorithmic robustness of the approach.
For a full explanation of the attack and defence mechanisms, we refer to the paper by Chhabra et al. (022)
The paper has an excellent. illustration showing the two stages intuitively, shown in Figure 5 adopted from
Chhabra et al. 2023
3.2 Datasets
In this study, we utilised various datasels, specifically Sedended-Yale-B Vishwakarma & Dalal 2020)
MNIST-USPS (Hull 1994 LeCun et al. 2010), Office331(Herath et al. 2016). and Digits (Alpaydin & Kay- 1998). which were included in the original study. These datasets were acquired following a methodology
nak
similar to that outlined by the authors. Furthermore, we employed the Dutch census, the Open Universily
Learning Analytics dataset (OUT.AD) and a subset of the FairFace dataset (Karkkainen & Joo 2021 The
statistics for all datasets are presented in Table !
The Dutch census and OULAD originate from a collection of datasets presented in "A survey on datasets for fwirness-awore machine learning" (Le Quy et al. 2022). These datasets are both tabular, allowing to investigate how the models handle different data structure than the image datasets in the original research. On the other hand, FairFace is another image dataset with the key difference being that the protected attribute, sex, is a better real-life example compared to the arbitrary chosen features in the original paper. Duc to the large size of this datasct and our limited computational capacity, we only included the samples from the validation set where the race is black or white.
In Table [ the protected attribute column is the focus of our investigation. The Source attribute concerns which sub-dataset an example belongs to. Normal-colour inverted focuses whether the example is a normal image or if it is colour inverted. Finally, the Lighting-Elevation concerns the differences in lighting and elevation of each face between images.
This research contres around unsupervisod clustoring problems, rendering the division of datascts into train, validation, and lest. splits inapplicable.
The preprocessing of the datasets from the original paper was already taken care of by the authors. The datasets used to extend the authors' rescarch were preprocessed in the following way. As basis, the provided code from the authors was used, and the features were adapted to work with their code, for example selecting the categorical fcatures or the protected feature.
Instructions to download the datasets are included in our GitHub repository)
"ode http:////....aaaeet///aaaaaatttr
3

---

Dataset
Sub- Dataset
Samples Size
Size
Im- Categories Count
Average entries
Protected attribute
ages
Num.
per cate-
feature
gory
Exlended Yale
a/a
2414
192x160
38
64
Lighting
Elevation
MNIST-USPS
MNIST
70000
28x28
10
7000
Source
USPS
9298
16x16
920
Office-31
DSLR
498
4288x2818
31
15
Source
Webcam
795
640x480
31
20
Digits
n/a
1797
8x8
180
Normal-
Color
inverted
Dutch census
n/a
60420
12
2
30210
Sex
FairFace
n/a
3641
22/x221
1820
Sex
OULAD
u/a
21562
10281
Sex
Table 1: Statistics for utilised datasets.
3.3 Hyper-parameters
The algorithms and hyper- paramcters utilised in this study were following the specifications outlined in the main paper (Chhabra et. al. 2023). We adopted the default hyper-parameters provided in the original implementations, aligning with the choices made by the authors. Table in Appendix C shows an overview of the used hyper-parameter for the deployed algorithus..
We utilised grid search to find the best alpha and beta values for each of our datasets. For the budget hyper- parameter, we chose to adopt the average of the values used in the original study to maintain consistency with the experimental setup, ensuring fair comparisons across datasets and enabling validation of algorithm performance under similar optimization settings. The name_ bel variable in ConsensusPairChusterin (CFC) was also set to 0.1 as a threshold as the dataset domains we are dealing with are as sensitive as the Yale dataset when comes to fairness balance.
A brief explanation of the arper-parameter. in Table (Appendix C Beta: Denotes the approximation guarantee of the k-median algorithm (Backurs al. 2019 Alpha: Size of probability distribution (Backurs et al. 2019
Della: Parameter used to control different parameters inside the algorithm Harb & Lam 2020
Num. of Neighbours: Number of neighbouring points used to calculate the cluster assignment.
Metric: A specific formulation to calculate the distance, can influence the way an algorithm assigns clusters. Budget: Represents the count of solution evaluations the optimiser will perform, which is directly linked to the duration of the optimisation process.
Num. of Clusters: Number of clusters the algorithm generates. Rondom-Stated The different seeds ensure that the results not conditioned specific initialisation.
3.4 Experimental setup and code
To replicate the results of the study we ran the attack on SFD, FSC and KFC, and the defence, with the novel CFC algorithm, on the four datascts mentioned in Section [ As done in the original paper, we repeat all experiments ten times with a different random seed and report the average and standard deviation of the metrics described in Section 3.5 The seeds used to replicate the experiments were the same ones chosen in the original paper.
Furthermore, where the authors originally atlack primarily the balance metric, and only allack entropy for a given algorithm-datase combination when the balance starts at zero, we attack both balance and entropy for all combinations verify the claim that balance a more robust mcasure of fairness than entropy. By simultancously targeting and measuring both balance and entropy, we can confirm the effectiveness of their attacks.
4

---

To expand upon the authors' study, we further implemented two attack algorithms and the defence algorithm across two tabular datasets and one image dataset. The extension of the research by Chhabra et al. (2023)
facilitated by the integration of a basic preprocessing codebase for tabular datasets. This addition facilitated the use of now datasets in their existing code and allowed for the exccution further experiments.
The source code and documentation necessary to replicate our research findings are available in our dedicated GitHubb repositors The challenges encountered during our attempt to replicate the findings and extend the research of the paper are detailed in Section 5.2
3.5 Measure descriptions
In our study, emphasis is placed on the evaluation of the metrics from Chhabra el al. (2023) namely, normalised mutual information (NMI), Accuracy (ACC), Balance and Entropy. For fully detailed definitions refer to appendix B of Chhabra et al. (2023). To summarisc, NMI is essentially normalised version of the widely used mutual information metric and ACC is an unsupervised equivalent of the traditional classification accuracy. Balance and entropy are both measures of fairness, where a higher score indicates more fairness.
3.6 Computational requirements
In the conducted experiments, we employed the supercomputer sourced from the Dutch National Supercom-- puter Snellius We utilised a single NVIDIA A100 GPU and 18 cores of an Intel Xeon Platinum 8360Y processor to train our models requiring GPU computing. For our models requiring CPU computing, we used 32 cores from 4 AMD EPYC 7F32. To carry out initial experiments and debug the code-base, we utilised local machines with varying specifications and negligible energy consumption. All logether the experiments took approxinately 270 hours run. The computational time took for each experiment can be found in
Table 2
Algorithms
MNIST-
Office-31
Extended Yale B
Digits
OULAD
Dutch
FairFace
USPS
SFD
05:38: 13
03:02:35
06:09:00
01:22:07
15:37:52
57:20:33
n/a
FSC
06:07:14
42:13:01
10:56:38
03:36:44
n/a
n/a
n/a
(on GPU)
(on GPU)
(on GPU)
KFC
00:49:01
08:49:24
15:02:01
00:41:52
00:58:50
02:56:02
09:19:24
CFC
04:41:45
02:44:46
11:16:46
02:31:59
n/a
n/a
61:43:25
(on GPU)
(on GPU)
(on GPU)
(on GPU)
(on GPU)
Table 2: Computational time to reproducc each experiment (hh:mm:ss)
we estimated the car- bon emissions amount approximately 10.02 kg CO2 equivalent through 170 hours of CPU comput- ing, assuming a carbon efficiency of 0.421 kg/kWh, according to htttps://wwt htttp::/www.nowwrrcc.t.. cot.tyytr/////uury netherlands/ for the year 2023 in the Netherlands. Additionally, the GPU computing activities resulted in an emission of around 11.33 kg CO2 equivalent over 100 hours. In total, this approximates driving around 85 km with an average internal combustion engine cat The carbon emission figures are estimated because we were unable to obtain precise measurements of emissions for Snellius when using its partitions, the actual emissions should be lower than what estimaled here.
Utilising the online tool available at httpss//mlco2.c gwtpggu..../.mama/////onooo..nie
4 Results
To verify the results from the original study, this section presents our reproduction results. Additionally, it contains the outcomes of further experiments conducted beyond the scope of the original paper. The results of our experiments align with the results achieved by Chhabra et al.
We thank SURF www.surf.n. .ll) for the support in using the National Supercomputer Snellius.
httpps///wwx. epa. www.//eergy/greeeeeee gasgg- wtw.eeeeeeeeeeeaaaaaclllllll www.elationseseeeecccc and- anw-oe----dd----eeeeeeee references
5

---

4.1 Results reproducing original paper
Two separate experiments evaluate the claims made by the original authors. These claims appear Section The experiments assessing the attack address claims 1 and 2, while those evaluating the defence focus on claim
As in the original paper, we performed the attack on all four datascts that the authors used in the original paper, namely MNIST-USPS, Office-31, Yale and DIGITS datasets. Our reproduction results with the FSC, KFC and SFD algorithms are visible in Figures ! 2 and 3 respectively. The graphs from the original paper that our results are compared to, can be found in Figures i and of appendix adaotpped from the original paper CChabra al. 2023). The results of the FSC attack show similar trends in our results compared the results from the original paper. However, in some attacks on the metrics, the ranges and trends
Balance
Entropy
NMI
ACC
MNUST USPS
2.5
0.20
0.5
2.0
0.10
1.5
0.05
0.15
26
0
20
1022 30
Office-31
0.5
10.0
0.45
0.30
0.40
0.0-
9.5
0.35
25122222226
15
1922
DIGITS
0.5
0.10
0.0
0.04
0.16
11
15
18
22
26
30
3922
11
1822222222222
111151922280
0.4
0.14
0.09
Tale
02
15
1822
11
1922 26
11
15 2632
DULAD Dutch Cencus 2001
0.0002
0.8-
0.68
0.24
0.66
0.0001
0.533
0.6
0
11 7
15
1822 30
3
11
1922 26
0 7 111119222300
0
7
1822
26
0.5
0.6
0.00050
0.0
0.678
0.00000
182222600
1822
0.
15
11
15
1822
26
1.0
0.58
FairFace
0.01
0.5-
0.56
0.00
0.3
11 20
26 30
15
29
26
11
15
18
pre-attack
post-balance-attackk
post-entropy-attact
mean random-attack
Figure 2: KFC results for all datascts (x-axis: % of samples attacker can poison).
of the values that the scores take differ from those in the original paper. An example is the post-entropy attack on the MNIST-USPS and DIGITS datasets, where post-entropy values are larger than the original values. For the KFC and SFD attacks, the trends and range of all metrics are close to the original on the MNIST-USPS, DIGITS and Yale datascts. On the Offico-31 datasct, the trends of the post-balance and post-entropy scores mostly align, with only moderate differences observed. The original authors claimed that State-of-the-art fair clustering models are highly susceptible to adversarial attacks and that their novel black-box attack can effectively degrade the fairness performance. In our results, we generally see that as more samples can be perturbed by an adversary, the post-attack fairness decreases. This is especially visible in the KFC and SFD attacks. In the FSC result, this is less clear. One thing that can also be seen is that

---

the pre-attack values are higher than the post-attack fairness scores. Observing this, one could conclude that claims 1 and 2 made by the original authors as described in Section 2
hold.
Figure 4 presents the results of the experiments using their novel CFC defence mechanism. The third claim of the original work states that CFC not only resists adversarial attacks but can also maintain or even improve clustering performance post-attack. Looking at the graphs in Figure f and the last two rows of Figure 7 the displayed trends seem somewhat different in our results in comparison those of the original authors. However, the results found are in line with their standard deviations, as described by CChhaba et al. (2023). except for the balance metric on the Yale dataset. Despite this, it could be argued that the defence adequately resists adversarial attacks in our results, as the fairness metrics and clustering performance did not get worse in comparison to the pre-altack when the number of samples poisoned by the adversary increased. Once more, the only exception here could be the performance metric on the Yale dataset, which does return lower NMI and accuracy scores when a higher percentage of samples are perturbed by the attacker.
At times it can be seen that the clustering performance higher post-attack in comparison to pro-attack. An example of this is the results for the NMT and ACC metrics on the MNIST-USPS dataset. Considering that CFC resists the adversarial attacks, and maintains clustering performance, one could conclude that claim 3 holds.
4.2 Results beyond original paper
Below each dotted line in Figures 2 and 3 the results of the attacks beyond the scope of the original paper are shown. For the attack on the KFC algorithm, it is clear that the post-attack fairness scores are worse than the pre-attack scores. However, this is less obvious in the SFD algorithm. For the attack on the SFD algorithm using the Dutch Census dataset, the attacks do not decrease in fairness scores (balance and entropy) post-attack. On the OULAD dataset, the fairness scores did become worse with the SFD algorithm as well. This discrepancy suggests that the constancy of fairness scores in the Dutch Census dataset may be less about the resiliency of the attack method and more indicative of the clustering model's unsuitability for the dataset in question. NMI scores, which are notably low, imply that the clustering output is nearly random, thereby questioning the model's effectiveness on each dataset. Consequently, these results imply that the clustering model's limitations on the Dutch Census dataset are a significant factor, and it would be misleading to ascribe the observed robustness in fairness scores solely to the efficacy of the attack techniques.
As seen in the last row of Figure g the defence mechanism of the original authors was also lested on a new dataset (the FairFace dataset). The pre-attack line is invisible in these subplots as it is covered by the line of the post-attack metric that is attacked. This happens because both lines have the same values for each percentage of samples that the attacker can poison. Therefore, the defence does resist adversarial attacks and maintains clustering performance post-attack on this data. Considering these observations, claim 3 as described in Section 2 does hold on this dataset that the original authors did not work with.
Finally, we investigated whether balance is a more robust metric of fairness than entropy, and if it also results a larger decrease in fairness when it the metric attacked. Looking at Figures T post-balance-attadd and post-entropy-attack line are present, highlighting the scores after attacking balance and entropy respectively. Generally, the attacked metric showed lower score compared to when the other metric was targeted. However, there were instances where the balance, tcalretically more robust, actually decreased more when entropy was attacked. This suggests that despite the balance of thcoretical robustness, it might not always be the most effective target in practical scenarios. Thus for attackers, targeting a variety of fairness metrics might be the most advantageous approach.
3 and a
5 Discussion
Overall, we were able to reproduce the results that the authors found and verify that their three claims indeed hold in different contexts with various datasets. Thanks to the presence of seed numbers for the balance and entropy attacks on the four provided datasots, we were able to find similar results as the authors. However, due to limits in our resources, we were not able to run the novel CFC defence method several times to obtain standard deviation and results that were more aligned with theirs. The lack of seed numbers on their
7

---

different runs for their defence algorithm made it impossible for us replicate their exact results which explains the slight differences in our results when trying to reproduce their experiment. The third claim about their innovative defence mechanism holds to a certain degree. We observed that with a new dataset, their defence maintains the same level of fairness and performance as before an attack, but it doesn't enhance them. To fully validate this claim, would be beneficial to test their algorithm on additional datasets, using various seeds and conducting multiple trials.
This last section of our research highlights the aspects of the authors' research that were straightforward to reproduce, alongside those that posed significant challenges. Through the next subsections, we will detail which parts of the reproduction were casier and which caused us significant challenges. In the last subscction, we document our interactions with the original authors.
5.1 What was easy
The authors already provided a repository with a codebase to reproduce the results. As we will discuss in Section 5.2 this codebase was far from optimal and user-friendly but provided a solid foundation to run the experiments. Moreover, the codebase included code to run the experiments on tabular datasets although this was not utilised in the original paper and did not work with the defence algorithm. This allowed us to extend the rescarch to different datasets with tabular structure for the attack experiments.
5.2 What was hard
Although the authors have provided repository with code to reproduce their results, some difficulties were met when trying to execute it. Most importantly, the code was completely devoid of documentation, which made it challenging to solve the issues we faced during the replication. Moreover, even though a Python module requirements file was provided, it was incomplete and did not contain specific module versions which caused the code to malfunction. We had to make some changes to the original code base to make it work properly. This was rather time-consuming process and could have easily been avoided if the code had been documented properly. In Appendix [ we provide overview with all changes we had to make to the original code. This does not include our code for additional experiments.
Besides the issues regarding the codebase, we also faced several Mataset-related challenges. Firstly, the URL to the Yale dataset included in the code, which automatically downloads the dataset, was not responsive. Therefore, we had to manually download the dataset from a minror and update the code accordingly. The fact that the original dataset could not be used is likely the cause for the result differences witnessed in section 1.1 Despite this, the results were comparable, which suggests that the difference in the version of the Yale dataset had no significant impact the conclusions addressed in scction Morcover, to use given dataset with the provided code, several Numpy arrays had to be created specifically for the dataset. Fortunately, these arrays were already included in the repository for the four base datasets. However, creating these arrays for the additional datasets was not straightforward at all as they did not have an intuitive definition, were not discussed in the paper, were not documented, and no code was provided to create them for the base datasets. This meant we had to deeply analyse the vectors and the code to gain an understanding of what purpose they served.
Finally, all code for the attack experiments only worked on CPU. For the SFD and KFC algorithms, this not serious issue those algorithms were fast enough on CPU. However, the FSC algorithm had an expected runtime of several days for a single datasct, which was unfeasible to run within our time constraints. The original code for the FSC algorithu contained a k-means implementation which did not support GPU- acceleration. We simply changed the code to use an alternative module which allows GPC-acceleration to roduce the total runtime to several hours. Due to limited resources, we were unable to run FSC on our two new tabular datasets as debugging the code for these datasets proved too resourcc-ineensive after their inclusion into the experiment.
8

---

5.3 Communication with original authors
We have contacted the original authors to improve our underslanding of the data and the code provided. The main author responded and answered a subset of our questions and delegated the unanswered questions to onc of their co-authors. A week later, we got a response from this author, who provided us with answers to the previously unanswered questions.
References
E. Alpaydin and C. Kaynak. Optical Recognition of Handwritten Digits. UCI Machine Learning Repository, 1998. DOI: https://doi.org//
G. Anandalingam and T. I.. Friesz. Hierarchical optimization: An introduction. Ann. Oper. Res., 34 (1-4):1-11, feb 1992. ISSN 0254-5330. BF02098169
doi: 10.1007/BF02098660 URL hattps://do http::///.oo.ooo.....oe.
Arturs Backurs, Piotr Indyk, Krzysztof Onak, Baruch Schicber, Ali Vakilian, and Tal Wagner. Scalable fair clustering, 2019.
Suman Bera, Deeparnab Chakrabarty, Nicolas Flores, and Maryam Negahbani. Fair algorithms for clustering. Advances in Neural Information Processing Systems, 32, 2019.
Anshuman Chhabra, Peizhao Li, Prasant Mohapatra, and Hongfu Liu. Robust fair clustering: A novel fairness attack and defense framework, 2023.
Attri Ghosal, Arunima Nandy, Amit Kumar Das, Saptarsi Goswami, and Mrityunjoy Panday. A short review on different clustering techniques and their applications. Emerging Technology in Modelling and Graphics: Proceedings of IEM Graph 2018, pp. 69 83, 2020.
Elfarouk Harb and Ho Shan Lam. Kfc: A scalable approximation algorithm for k-center fair clustering, 2020.
Samitha Herath, Mehrtash Harandi, and Fatih Porikli. Learning an invariant hilbert space for domain adaptation. 11 2016.
J.J. Hull. A database for handwritten text recognition rescarch. IEEE Transactions on Pattern Analysis and Machine Intelligence, 16(5):550-554, 1994. doi: 10.1109/34.291440.
Kimmo Karkkainen and Jungseock Joo. Fairface: Face attribute dataset for balanced race, gender, and age for bias measurement and mitigation. In Proceedings of the IEEE/CVF Winter Conference Applications of Computer Vision, pp. 1548- 1558, 2021.
Matthäus Kleindessner, Samira Samadi, Pranjal Awasthi, and Jamie Morgenstern. Guarantees for spectral clustering with fairness constraints, 2019.
Tai Le Quy, Arjun Roy, Vasileios Iosifidis, Wenbin Zhang, and Eirini Ntoutsi. A survey on datasets for fairness-aware machinc learning. WIREs Data Mining and Knowledge Discovery, 12(3):c1452, 2022. doi:
1452. URL https://wires.oonineellee www.iiibrrrrrlrrry..........eeee wwwpwwww./ww/ww//aaa///.oott/ com/doi/abs/
10. 10.1002/widm.144 1452
Yann LeCun, Corinna Cortes, and CJ Burges. Mnist handwritten digit. database. ATT Labs [Online]. Available: www.nn..eecnncooom htt//eddd/mmnnn /mnist, 2, 2010.
Virendra Vishwakarma and Sahil Dalal. A novel non-linear modifier for adaptive illumination normal- ization for robust face recognition. Multimedia Tools and Applications, 79, 05 2020. doi: 10.1007/ 81 $11042-019-08537-6.
Yang Yu, Hong Qian, and Yi-Qi Hu. Derivative-free optimization via classification. In Proceedings of the Thirticth AAAI Conference on Artificial Intelligence, AAAI'16, pp. 2286 2292. AAAI Press, 2016.

---

A Proposed CFC framework by Chhabra et al. (2023)
First Stage
Second Stage
MLP Network
Cluster Assignment
Linear
Activation
Dropout
Linear
Fair Clustering Loss
Layer
Ly(Z,
Generate Co-association
Contrastive Loss L (Z,
Matrix
Figure 5: Proposed CFC framework. Adopted from Chhabra et al. (2023).
B Modifications to the original codebase
File
Reason
Change Added pandas, seaborn, networkx, chardet, pyckmeans, kmeans-pytorch and changed scikit-learn 0. 0.22.2.post1
requirements
Missing modules and incorrect ver-
sions
version
mnist_us usps. py, extended_yee Basis_yleBBBpp office31.pp py
fist__sps..e
FileNotFoundError raised when loading the MNIST_USED USPS, Yale Office-31 dataset due to use of abso- lute paths
Removed the path prefix from dataset_dis _ir line 13
base.p7 py
TypeError being raised when load- ing data, possibly due to version
Changed np.int to int8 on lines 75 and 76
mismatch
extended_yaleB.pp
Dead URL for the MNIST USPS dataset, only a manual download was available
Removed the automatic download code
fair Seir_kcenter.o py
The exception was raised when 'IBM's CPLEX is not installed! is supressed. Now a user never knows why KFC does not work or even that CPLEX is required to run it
Removed the try-except block pressing the exception
fair sair_spectral.py
The CPU-only version of k-means is
Changed the k-means module to kmeans-pytorch
too slow
10

---

C Overview employed Hyper-parameters
Algorithm
Dataset
Beta
Alpha
Delta
Num. of Neigh- bours
Metric
Budget
Num. of
Random-
State
Clus- ters
MNIST-
30
USPS
Office-
20
31
KFC
n/a
n/a
0.1 n/a
n/a
150,
Digits
15
4200,
Extended
20
424242,
Yale B
Number
1947,
MNIST-
Euclid-
Unique
355,
USPS
labels
256,
Office-
7500,
31
n/a Manhat-
FSC
n/a
n/a
99999,
Extended
tan
18
Yale B
Digits
MNIST-
50
USPS
Office-
20
31
SFD
n/a
n/a n/a
Extended
Yale B
Digits
MNIST-
25
100
USPS
Office-
100
31
CFC
n/a
n/a
n/a
n/a
Extended
10
50
Yale B
Digits
50
10
Table Overview of the utilised hyper- parameters
11

---

D Original attack results
Entropy
0.000
3000
0.00
STD Algorthum
0.000
0.000
8850
0,000
0.200
13
0359
0.400
0.003
KFC Algortthe
0.033
13300
0,000
0.255
0.355
0.303
attack
Our attack
Random attack
Figure 6: Attack results MNIST-USPS and Office-31 (x-axis: % of samples attacker poison). Adopted from Chhabra et al. (2023).
12

---

Balance
Entropy
MNITT LUUPS
0.05
0.75
0.45
0.00
0.50
0.40
0.45
-0.05
7 1822
26
18
11
1822 2630
3
26
0.50
Office:31
10
0.70
0.25
0.65
0.40
0.00
0.35
7
11
18
30
15
3
11
1822
2630
3 7
15
26
0.05
0.65
DIGITS
0.60
0.55
0.40
11
18 30
11 15
18
26
30
3
11
15
18
2630
3 7
11
0.05
0.00
4.0
0.37
0.36
1922 26
30
18
3 11 15 2630
18 26
pre-attack
post-balance-attcck
post-entropy-attack
mean random-attack
Figure 1: FSC results for all datasets (x-axis: % of samples altacker can poison).
Balance
Entropy
NMI
ACC
MNIST USPS
0.4
0.35
2
Offic-311
0.4
10.0
0.88
0.80
9.8
0.86
0.75
15
15
21
0.02
0.44
DIGITS
0.01
0.42
0.30
0.00
0.40
31
15
11
2115192222333
0.05
0.11
0.00
0.10
-0.05
0.09
11
15
1922 26
0
15 10 26
11 28222260
OULAD Dutch, Census, 2001
1.00
0.6925
0.02
0.00
0.00
0.55
11
10 26
3
15
2632
11 15
10
26
0.690
0.55
0.0025
0.688
0.50
11
15 26
203390222230
26
pre-attack
post-entropy-attack
Figure 3: SFD results for all datasets (x-axis: % of samples attacker can poison).
13

---

Ba lalacce
Enrrgy
NY1
ACC
0.8
0.45
3.00
34
0.40
2.50
0.23
0.35
12 17
17
25
12
0.7
Offices1
0.35
600
0.675
22
4
12
17
12
0.11
0.4
0.10
0.2
0.09
0.0
8
12
27
27
12
0.22
0000 101
0.4
0.28
2.-
0.26
9.1
25
0.622
0.08
2.98
0.600
0.64
0.688
entropy
Figure 4: CFC results for all datasets (x-axis: % of samples attacker can poison).
14

---

Balance
Entropy
0.100
0.000
3.500
SFD Algoritim
3.000
8.000
0.000
10
20
3.000
2.000
28
0.400
0.300
10
6415
SIIITO
6.000
8.000
0350
0.000
0385
6.000
0.35
8200
Algoritim
3.800
3.700
8373
0.000
0.450
8.300
0.400
8:000
8.500
13.000
0.400
8.000
18.000
0.655
Algorithi
9.000
10
10
20
10
12
28
3.400
8.000
8380
6360
CIDD
0370
0.000
10
20
10
20
10
28
18
29
0.200
0.000
199
CFC Algorthim
4.000
0.000
0.200
1.000
Pre-attack
Our attack
Random attack
Figure 7: Attack results Yale and DIGITS (x-axis: % of samples attacker can poison). Adopted from Chhabra et al. (002)).
15


Reviews:
[{"review_id": "remypU55gl", "reviewer": "Reviewer_1Q4j", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength\nThe reproducibility study follows a rigorous experimental approach, closely mirroring the original experiments while extending them to additional datasets, thereby enhancing the robustness of the findings.\n\nWeakness\nThere are potential issues in the experimental results as presented in Figures 1-4. The x-axis in these figures represents the percentage of samples that an attacker can poison. Therefore, at x=0, where no samples are poisoned, the pre-attack and post-attack lines should coincide. However, these lines are observed to be separate at x=0 in most figures, suggesting possible errors in the experimental setup or data handling.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper under review is a reproducibility study of the work titled \"Robust Fair Clustering: A Novel Fairness Attack and Defense Framework\". The primary focus of this study is to validate the original claims about the susceptibility of fair clustering algorithms to adversarial attacks and the efficacy of a proposed defense mechanism called Consensus Fair Clustering (CFC). The reproducibility study confirms the original claims and extends the investigation to additional datasets, providing a robust test of the original paper's conclusions.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Could you clarify why there is a variation in the pre-attack line in Figure 4?", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "PrkcNbYirA", "reviewer": "Reviewer_SDHM", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The paper is well written and clearly organized.\n2. The experiments are comprehensive.\n\n\nWeaknesses:\n1. The paper simply reinforces the original paper’s claim by adding more dataset for evaluation without providing much new theoretical/empirical insights.  \n2. The meaning of objective function needs further clarification. For example, why does the fairness utility function $\\eta$ take $\\theta$ and $G_D$ as the parameters? A simple explanation of the intuition of the equation is needed. \n3. For section 4.2 \"Results beyond original paper\",  the new results should be summarized and highlighted for readability.\n4. For \"Results beyond original paper\", do you have speculation/hypothesis why claims 1,2,3 might not hold for additional datasets?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The reproducibility study examines claims made by the paper  \"Robust Fair Clustering: A Novel Fairness Attack and Defense Framework\". Specifically, the authors confirm that the original claims made by the paper are supported. These claims are \n\n(1) SOTA fair clustering models are susceptible to adversarial attacks that aim to jeopardize the fairness performance. \n\n(2) The proposed Consensus Fair Clustering (CFC) defense mechanism is effective.\n\nThe authors confirm the claims by extending the evaluation using additional datasets.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please respond to the weaknesses above.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "f46YSdgbZ4", "reviewer": "Reviewer_5aS3", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**:\n- The experiments to reproduce the work of Chhabra et al consitute a methodologically correct approach that follows the original paper closely. The results obtained also follow similar trends and affirm the findings of the original paper, which is a positive sign.\n- The authors aim to extend the original approach to 3 additional datasets beyond the original paper (there are some issues here-- please see below).\n- The authors investigate whether attacking balance or entropy is more advantageous for the attacker.\n\n**Weaknesses**:\n1. In the abstract the authors state: *Furthermore, our study adds to the field of fair clustering algorithms by identifying challenges and offering insights, guiding future efforts in the development of more robust and equitable AI systems.*\n\n    ___\n\n    I do not believe this statement is correct, as I was unable to find challenges for future work or a thorough discussion on insights derived from new experiments that can take the ideas proposed in the original work forward. I believe this statement is an over-claim, as the authors only extend the original work and conduct preliminary analysis that goes beyond the original paper (such as measuring entropy vs balance for the attacking fairness metric). While these are good experiments to have, they do not align with the claims made regarding identifying challenges, offering insights, or guiding future efforts in the development of robust + fair AI models. To recommend acceptance, I would ask the authors to either (1) remove this statement completely in the abstract and elsewhere in their paper, or (2) add substantial evidence to the paper backing these claims.\n2. The formatting of the paper can be improved. The authors heavily discuss the Appendix figures (Figures 4 and 5) in the main text but defer them to the appendix even though there are additional pages available (12 pages of main content). This experience can be jarring for readers, so I would recommend moving Figures 4 and 5 to the main paper. \n3. If the authors have not made some of the figures themselves (ie they are from the original paper), I think they should attribute them in a more clear manner. For instance Figure 3, Figure 6, and Figure 7 should mention they are directly taken from the original paper along with a reference in their captions. Similarly, Section D in the Appendix seems to be directly taken from the original paper (including the footnote). Here I would suggest rewording some of these definitions or directing readers to the original paper if that is sufficient.\n4. I have some issues with the Dutch Census + SFD experiments and conclusions drawn in Section 4.2 (additional datasets beyond the original paper). The authors write: _For the attack on the SFD algorithm using the Dutch Census dataset, the attacks do not decrease in fairness scores (balance and entropy) post-attack. ... Through these extended results, it could be said that claims 1 and 2 of the original authors as described in Section 2 are partially supported on datasets that the original authors did not use._\n\n    ___\n\n    This is not quite correct and seems to me has nothing to do with the author's approach but is rather a dataset and clustering model suitability issue. For instance, observe the NMI scores for SFD on Dutch Census (Figure 3). These are very low (between 0.0 and 0.02). These numbers indicate that this clustering model is not very suitable for this dataset and is possibly outputting a random clustering for this dataset. As a result, fairness will be quite high for such a random clustering (this can also be seen in Figure 3 as Balance varies between 0.9 and 1.0). Due to this, it does not make sense to attack this clustering model on this dataset to reduce fairness as it cannot find \"good\" clustering solutions. Stating that the authors' claims only partially hold because of this is a bit misleading and does not make sense as it is more likely an issue with this model being used on this particular dataset. It is okay to include this result, but I would like the authors to amend this statement to indicate that this is not a particular issue with the attack approach but more likely with the failure of the clustering model being used.\n\n5. There seems to be a typo in Section 4.2: _In Figures 2 and 3 of appendix D_ should read _Figures 2 and 3_ as these figures are in the main paper and not the appendix.\n6. I also think because the Yale dataset was removed by the original hosts (as stated in Section 5.2), the authors might be seeing slightly different trends (but as they find, these are still overall consistent with Chhabra et al) owing to the manually downloaded version. I think it would be good to mention this for transparency wherever slight differences are observed in the Yale dataset results.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper is a reproducibility study of the ICLR'23 paper by Chhabra et al titled \"Robust Fair Clustering: A Novel Fairness Attack and Defense Framework\". The authors undertake experiments to validate and confirm the original paper's findings such as (1) the vulnerability of fair clustering models to adversarial attacks and (2) the adversarial robustness of the CFC fair clustering model. The paper also considers additional datasets for experiments not used in the original work, such as Dutch Census, OULAD, and FairFace.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "I believe reproducibility studies are very important and that this work conducts an extensive set of experiments to validate Chhabra et al's work. There are a few issues regarding unsubstantiated claims and conclusions, formatting, and typos, which I have outlined in the Weaknesses section above. If the authors make the aforementioned requested changes, I am happy to recommend acceptance.", "broader_impact_concerns": "N/A.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The reviewers are mostly in agreement that the paper can be accepted to TMLR.  One reviewer was more negative and felt that the authors failed to respond to many of the points, but looking over the reviews and responses, I didn't find myself agreeing with that assessment.  (Perhaps some responses themselves could have been more detailed, but I judge the paper changes themselves to be more important.)

For the final version, please perform another careful check over the reviews, as well as the latest post by me (the action editor), and make any final minor changes as needed.
Decision: Accept (poster)