Reproducibility Study of "Robust Fair Clustering: A Novel Fairness Attack and Defense Framework"
Authors: Iason Skylitsis
Zheng Feng
Idries Nasim
Camille Niessink
Venue: Accepted by TMLR ()

Abstract: Clustering algorithms play a pivotal role in various societal applications, where fairness is paramount to prevent adverse impacts on individuals. In this study, we revisit the robustness of fair clustering algorithms against adversarial attacks, affirming previous research findings that highlighted their susceptibility and the resilience of the Consensus Fair Clustering (CFC) model. Beyond reproducing these critical results, our work extends the original analysis by refining the codebase for enhanced experimentation, introducing additional metrics and datasets to deepen the evaluation of fairness and clustering quality, and exploring novel attack strategies, including targeted attacks on new metrics and a combined approach for balance and entropy as well as an ablation study. These contributions validate the original claims about the vulnerability and resilience of fair clustering algorithms and broaden the research landscape by offering a more comprehensive toolkit for assessing adversarial robustness in fair clustering.

Published in Transactions on Machine Learning Research (April/2024)
Reproducibility Study of "Robust Fair Clustering: A Novel Fairness Attack and Defense Framework"
Iason Skylitsis Zheng Feng Idries Nasim! Camille Niessink
Reviewed OpenReview:
Abstract
Clustering algorithuss play a pivotal role various societal applications, where fairness paramount to prevent adverse impacts on individuals. In this study, we revisit the robust- ness of fair clustering algorithms against adversarial attacks, affirming previous research findings that highlighted their susceptibility and the resilience of the Consensus Fair Clus- tering (CFC) model. Beyond reproducing these critical results, our work extends the original analysis by refining the codebase for enhanced experimentation, introducing additional met- rics and datasets to deepen the evaluation of fairness and clustering quality, exploring novel attack strategies, including targeted attacks on new metrics and a combined approach for balance and entropy as well as an ablation study. These contributions validate the origi- nal claims about the vulnerability and resilience of fair clustering algorithms and broaden the research landscape by offering more comprehensive toolkit for assessing adversarial robustness in fair clustering.
1 Introduction
Clustering algorithms play an important role the analysis and interpretation of the vast. amounts of data generated by automated data collection systems across various sectors (Rodriguez al.) 2019 Xu &
Wunsch 2005). While these algorithms are useful, they raise critical issues like privacy (Schneier 2015 Song
et al. 2022) and accountability in data use (Oppold & Herschel 2020 while requiring transparency in their
clustering performance (Selbst et al. 2019 In addition, clustering algorithms are widely used in a variety of
societal applications, such as loan dis disbursement, medical treatment strategy, and recruitment Tsai & Chen
2010 Zitník et al. 2019 Roy et al.
2020 highlighting the critical issue of fairness. Several fair clustering methods have been proposed to mitigate algorithmic bias and increase fairness (Backurs et al. 2019).
However, fair clustering has not yet been explored from an adversarial attack perspective. This aspect is crucial, adversarial attacks aim to compromise the utility of fairness in these models (Chhabra et al. 2021 Mehrabi et al. 2021), ), potentially reversing the benefits of fair clustering. To tackle this gap, the authors of the reviewed study experimented with a black-bor adversarial attack to assess the vulnerability of fair clustering algorithms. Their work also proposes a novel model, Consensus Fair Clustering (CFC), designed to be highly resilient to the proposed fairness attack (Chhabra et al. 2023
This work aims to address the following goals:
[Reproducibllity Study] Reproducing the results from the original paper: We successfully reproduced the three main claims of the original paper. Firstly, our findings partially confirm that the black-bor adversarial attack can reduce the fairness performance by perturbing small percentage of protected group memberships. Secondly, we reproduced the claim that existing fair clustering aigo lack robustness against adversarial influence. Lastly, our results validate the third claim that the CFC model exhibits high resilience against the proposed fairness attack.
University of Amsterdam, Amsterdam, The Netherlands Equal contribution

---

Published in Transactions on Machine Learning Research (April/2024
[Extended Work] Improvement of the original code: One of the contributions of our work involved transforming the code into script format and integrating argument. parsing for more streamlined experimentation. Moreover, we systematically structured repetitive code segments into distinct functions.
[Extended Work] Additional Metrics and Datasets: To enhance our comprehension of clus- tering performance, particularly concerning fairness and clustering quality, this study integrated additional metrics. Moreover, we expanded the scope of our research by including two further datasets, enriching the depth and breadth of our analysis.
[Extended Work] Additional Attack Methods: We experimented with the implementation of new attack methods, attacking some of the newly proposed metrics, as well as creating a dual- optimization problem for combined Balance and Entropy attack.
[Extended Work] Ablation Study: As part of our efforts to evaluate and improve the CFC model, we conducted an ablation study on focusing on the hyperparameters alpha (a) and beta (3). We experimented with various values of a and 3, and the impact of these hyperparameters model's performance was measured in terms of both clustering utility and fairness utility. We have included the results of our ablation study in Section 4.3 of our report and discussed the insights and implications of our findings.
the
2 Scope of reproducibility
This work investigates the reproducibility of the original paper by Chhabra et al. 2023 which addresses the problem of the vulnerability of fair clustering algorithms to adversarial attacks aimed at degrading fairness utility. The concerns about algorithmic fairness have led growing interest in the literature on defining, evaluating, and improving fairness in Machine Learning algorithms (Pessach & Shmueli 2022) The authors investigate the robustness of clustering models, namely Fair K-Center (KFC), Fair Spectral Clustering (FSC), and Scalable Fairlet Decomposition (SFD), to adversarial influence by using black-bor attack approach. Furthermore, they propose the Consensus Fair Clustering (CFC) model to achieve truly robust fair clustering. An explanation the methodology, datasets, and metrics employed by the authors can be seen Scction 3
The main claims that the paper made are as follows:
The black-boz adversarial attack outlined in the original paper is capable of degrading the fairness performance by perturbing a small percentage of protected group memberships in the examined fair clustering models: KFC, FSC, and SFD.
Claim 1:
Claim 2: KFC, FSC, and SFD demonstrate lack of robustness to adversarial influence, exhibiting significant volatility in terms of fairness utility metrics such as Balance and Entropy.
Claim 3: CFC exhibits high resilience against the proposed fairness attack, offering robust solution for achieving fair clustering.
In addition to replicating the findings presented in the original paper, we conduct additional experiments to further evaluate the performance of the algorithms.
3 Methodology
The author's implementation of their code is publically available in their GitHub repository However, some implementation details for the Fair K-Center algorithm were missing, considering the attack used and the assigned budget parameter for the optimization problem; therefore, we had to make some minor adjust ments.
httpps: http//ggthhh..mmmmom www...///aaaaaannaaaaamaaa Number calls the objective function
2

---

Published in Transactions on Machine Learning Research (April/202))
3.1 Fairness Attack
In the original paper, the authors propose novel black-box attack that aims to reduce the fairness utility of fair clustering algorithms by perturbing small percentage of samples' protected group memberships. This is defined as a Fairness Attack. The threat model is defined as an adversary who can control a subset of the protected attributes, denoted as GA S G, and observe the cluster outputs of a fair clustering algorithm F, where F is unknown to the adversary. The goal is to find the optimal perturbations that minimize the fairness utility for the remaining samples, denoted as GD = G/GA S G, by perturbing GA. This problem is formulated as two-level hierarchical optimization problem (Anandalingam & Friesz, 1992), where the lower-level problem is the fair clustering problem and the upper-level problem is the attack problem. The attack optimization problem can be defined analytically using two mapping functions:
7: Takes GA and GD as inputs and gives output G = ((GA,GD) which is the combined group memberships for the entire dataset.
0 Takes GD and an output cluster labeling from a clustering algorithm for the entire dataset as input, returns the cluster labels for only the subset of samples with group memberships in Gp.
Based on these notations, the optimization problem for the attacker is defined as: minG, (0(O,, Gn), s.t. O = n Gp)). The authors solve this problem using zeroth-order optimization algorithm.
3.2 Model descriptions
The paper uses three state-of-the-art fair clustering algorithms, namely Fair K-Center (KFC) (Harb & Lam 2020), Fair Spectral Clustering (FSC) (Kleindessner el al. 2019) and Scalable Fairlet Decomposition (SFD)
Backurs et al., 2019).
The algorithm aims to achieve fair clustering by using the k-center objective. The goal is to minimize the traditional clustering objective while ensuring that no protected group is unfairly over under-represented within any cluster. This is achieved by partitioning a set of N data points, cach belonging to at least one of protected groups, into & clusters.
Fair K-Center.
Fair Spectral Clustering. The algorithm a constrained version Spectral Clustering (SC) and is popular method for partitioning graph data with an incorporated fairness notion. This notion defines clustering as fair if each demographic group is proportionally represented in every cluster.
Scalable Fairlet Decomposition. The algorithm is practical approximation of the fairlet decomposition algorithm, introduced in Chicrichetti et al. (2018), that runs in nearly linear time.
In addition, the authors introduced a novel robust fair clustering algorithm, Contrastive Fair Clustering (CFC), which aims to learn fair and transferable representations for clustering. It employs a contrastive learning framework to ensure that the learned representations are not only discriminative for clustering, but also fair with respect to protected attributes.
SFD influences CFC to ensure balanced micro-level representation. FSC informs CFC's aim for proportional demographic balance across clusters. KFC lays the foundation for CFC's fairness by modilying cluster- ing objectives to protect against group bias. CFC integrates these insights through a contrastive learning framework, embedding fairness directly into its clustcring process.
3.3 Datasets
The authors provided download links for the UNNIT-USPS and Office-11 (Saenko al.) 2010) datasets. Since the link for the cropped version of Extended Yale face B (Yale) (Lee et al. 2005) was not working, torrent was used to download the dataset.. Additionally, the Inverted UCI DIGITS (DIGITS) (Xu et al. 1992) dataset was included in the author's repository. Furthermore, Mulli-task Facial Landmark) (MTFL) (Zhang et al.) 2014) and uncropped Yale were utilized as additional datasets. Further information on the datasets, including characteristics, protected attributes, and descriptions, are provided in Table
The Office-31 dataset consists of three source domains: Amazon, Webcam, and DSLR, where we used DSLR and Webcam. In the case of DIGITS, we modified the images by inverting their pixel values.
3

---

Published in Transactions on Machine Learning Research (April/202)
Dataset
Num. samples
Num, categories
Protected attribute
Description
MNIST-USPS
3,800
Sample source
Handwritten digits
Offic-91
1,293
31
Domain source
Office objects
DIGITS
3,594
Source image
Handwritten digits
Yale
2,414
38
Azimuth and clevation
Frontal-face
uncropped Yalc
2,414
38
Azimuth and clovation
Full-body & Background
MTFL
2,000
2
Glasses usage
Face
Table 1: Summary of the datasets used in our experimentation. We followed the code of the authors to select the number of samples used for MNIST- USPS, Office-31, DIGITS, and Yale (cropped and uncropped). For MTFL, we balanced the dataset by randomly selecting 2,000 images (each with and without glasses).
3.4 Hyperparameters
To reproduce the results of the paper, we primarily adhered to the same hyperparameters as those specified in the original study, whenever they were specified in the article. The hyperparameters used in this st study are detailed in Appendix A
3.5 Experimental setup and code
The reproduction of the results was based on the jupyter notebooks of the original authors. One of our contributions was restructuring the code into a script format, introducing argument parsing for casier ex- perimentation, and organizing repeated code into functions. All experiments shown this paper can easily be reproduced using our code, which is publicly available on GitHub
For the attack, maintained consistency with the original study by using the same setup, including seeds, hyperparameters, and pre-compuled labels. However, due lo missing code for the KFC algorithm in the jupyter notebooks, we arbitrarily selected the budget for the optimization function. Additionally, as the type of attack used for the KFC algorithm was unspecified, we conducted experiments for both Balance and Entropy (Appendix B). Furthermore, since no code was provided to reproduce the figures, we attempted to approximate the partitions present in the baseline research using specific values ranging from 0 0.3.
For the defense, we employed three manual seeds (42, 46, and 48) for torch randomization. Additionally, the CFC model was trained using the Adam optimizer with learning rate of 0.01.
The original paper uses four metrics along two dimensions, namely fairness utility and clustering utility, for performance evaluation. For clustering utility, we consider to use Normalized Mutual Information (NMI) (Strehl & Ghosh 2002) and Unsupervised Accuracy (ACC) (Li & Ding 2006). For fairness utility, we consider Balance (Chierichetti et al. 2018) and Entropy (Li et al. 2020 The definitions for these metrics are provided in Appendix
3.6 Computational requirements
We conducted all experiments on a computer cluster, utilizing an NVIDIA A100 GPU and an Intel Xeon Platinum 8360Y CPU, except for those related to the KFC algorithm, which were performed locally on an AMD Ryzen 7 4800H CPU with 16 threads. Since the zoopt package runs exclusively the CPU, GPU necessary for the attack experiments. The total computational cost for running all experiments amounted to roughly 80 CPU hours and 130 GPU hours.
4 Results
4.1 Results reproducing original paper
As stated in Section 2 three claims were identified in the original paper, and we were able to partially reproduce the first claim and entirely reproduce the second and third claims. this section, we claborate
4

---

Published in Transactions on Machine Learning Research (April/2024)
our reproduction results: first, in section 4.1.1 and 4.1.2 we show the results of the proposed black-bor and random attack (Claims 1 and 2). In section 4.1.3 we show the results of the defense (Claim 3).
4.1.1 Claim 1: The black-box adversarial attack results in substantial degradation of fairness performance in Fair K-Center (KFC), Fair Spectral Clustering (FSC), and Scalable Fairlet Decomposition (SFD) by perturbing a small % of protected group memberships. [Partially Reproduced]
To validate Claim 1, we compared the attack with the random atlack and present the results when 15% group memberships switched for MNIST-USE USPS and Office-31 31 in Table 2 and for Inverted UCI DIGITS
(DIGITS) and Extended Yale face B (Yale) in Appendix E Table 9
Contrasting with the findings of the original paper, our results showed a slight increase, rather than a sig- nificant reduction, in fairness utility for SFD in terms of Balance/Entroon on the MNIST-USPS dataset 1...822%//11333%% Similarly, for FSC in terms of Entropy on the Office-31 dataset, we observed a modest increase (+2.390%). Interestingly, the random attack sometimes led to increased fairness utility, notably a +100.0% increase in FSC Balance on Office-31. However, for KFC on Office-31, Balance/ Balance/Fntropy metrics remained unchanged at -0.000%/-0000003 (as discussed in Section 4.2.1. Despite these individual varia- tions, consistent reduction in fairness was noted across the other datasets post-attack, indicating a partial reproduction of the original claim.
In Appendix Table we present a detailed comparison of the Change (%) values between our study and the baseline research. This analysis highlights the disparities in the impact of adversarial at atlacks on fairness and clustering metrics, offering insight into the relative robustness of the algorithms examined.
UNIST-U8PS
Algorithm
Metrics
Pre-Attack
Post-Attuck
Change (%)
Match Origi-
Random Attack
Change (%)
Match Origi-
nal Findings
Findings
Balance
0.252
0.001
0.300 + 001
(1)6.882
0.330
0.001
(1)17.02
SED
NMI
Entropy
0.315
3.063
0.000
0.151
0.358
3:104
4: 001
000
[-)13 113.88
(+)1-839
0.346
3.147
000
0o0
(419.841
(+12.742
ACC
0.419
0.000
0.479
000
0.456
0o0
(+18.891
Suiunce
0.000
0:000
0.000
C/100.0
0.000
()100
Eniropy
0.327
0.000
0.241
(-226,80
0.301 0.001
(-)7.961
NMI
0.640
0.000
0.048
(-)1.003
0.028 0.000
(-)2.004
0.350
6-337-16
(+330
KFC
NMI
Entropy
0.000 0.000
0.000
(-1100.0
0.000
(-)100.0
ACC
0.147
0.000
0.146
[-]0 680
0.000
(-)1.361
Algorithm
Metrics
Pre-Attack
Post-Astack
Change (%)
Match Origi-
Random Astack
Change (%)
Match Origi-
nat Findings
nal Findings
Seinsiee
0.640
0.000
0.155 + 0.000
(-711.0
0.369
0.120
(-844.26
SFD
NMI
Entropy
0.888
10.00
0-000
0.000
0.861 1: 000
8.783 1 001
(-2. 170
(-3
0.850
9:903
000
()0.970
(-)3.153
ACC
0.841
0.000
0.78h + 800
(-9 037
0.789 000
(-)8-661
Sslance
0.000
0.000
0.000
0:211 0:211
(+)100.0
FSC
Entropy
0.119 0.164
9.383
0.301
-2.39090
9.628 0.213
(+15.001
(+166003
(+)18.72
Bulnace
0.001
0.071
(-00000
0:971 0.000
C000000
KPC
NMI
Entropy
0.000
(-)0.000
0.00m
(-31on.0
ACC
0.001 0.000
(-30.000
Table 2: Results for pre-attack, post-attack (black-boz), random attack, change between pre- and post-attack / random attack, when 15% group membership labels are switched for fair clustering algorithms SFD, FSC, and KFC and datasets MNIST-USPS and Office-31. Results show the impact on fairness utility (Balance and Entropy) and clustering utility (NMT and ACC). The checkmarks indicate that for the specified dataset and algorithm combination the performance matches the findings in the baseline research.
4.1.2 Claim 2: KFC, FSC, and SFD demonstrate lack of robustness to adversarial influence. [Reproduced]
In order to validate Claim 2, we replicated the experiment conducted by the authors, showcasing the pre- attack and post-attack results for MNIST-USP and Office-31 datasets using both the black-bor attack and random attack, as illustrated in Figure The results for DIGITS and Yale are shown in Appendix E Figure
5

---

Published in Transactions on Machine Learning Research (April/202))
We found that the fairness attack consistently outperforms the random attack baseline across both Balance and Entropy fairness metrics. However, contrary to the original claim, our findings revealed an exception for Entropy on the FSC algorithm applied to the Office-31 dataset (Figure | Row 4, Column 2).
Additionally, the random attack does not consistently lead to lower fairness metric values. For instance, we observed an increase both Balance and Entropy on the FSC algorithm applied to the Office-31 dataset (Figure Row 4, Column 1-2), which consistent with the original paper's findings.
BALANCE
ENTROPY
ACC
NAIST LUSPS
0.05
0.550
00522
P5C
0.500
0.400
10
20
30
15
25
10
20
30
13
20
25
10
0.5
0.35
0.25
90
0.4
0.30
10
20
10
13
70
23
10
20
0.04
15
20
25
10
1.
0.5
0.02
0.0
0.14
10
20
15
25
10
20
25
15
25
30
0.4
05-
0.70
ORice
02
9.5
F3C
0.0
04
15
10
20
15
25
0.6
0.89
0.4
20.0
0.50
30
9.8
0.75
0.00
20
15
20
16
0.052
0.34
1.00
1FC
-3.8
0.048
attack
attack
random attack
Figure 1: Pro-attack, post-attack (black-boz) and random attack results on fairness utility (Balance and Entropy) and clustering utility (ACC and NMT) for MNIST-USPS and Office-31 (x-axis: % of samples attacker can poison).
4.1.3 Claim Contrastive Fair Clustering (CFC) exhibits high resilience against the proposed fairness attack. [Reproduced]
In order to validate Claim 3, replicated the experiment conducted by the authors, showcasing the efficacy of the CFC algorithm in Table This table provides clear overview of the changes in fairness and clustering metrics before and after the application of the black-box adversarial attack, specifically when 15% of group membership labels are altered. It highlights the variations in fairness utility, measured by Balance and Entropy, and clustering utility, represented by NMT and ACC.
The analysis following the attack reveals that the CFC algorithm sustained its performance levels effectively, Notably, the fairness metries demonstrated stability, with minor exception observed in the Balance metric for the UNIST-USPS dataset, which decreased by 10.35%. Furthermore, clustering metrics either remained consistent or showed improvement post-attack. This improvement was particularly prominent in the NMI and ACC metrics for the WNIST-USPS dataset, which increased by 19.34% and 13.41%, respectively. In contrast, other fair clustering algorithms exhibited notable declines in fairness utility following the attack. Specifically, the FSC algorithm showed significant reduction in the Balance and Entropy metrics for the MNIST-USS USPS dataset, dropping by 100.0% and 26.30%. respectively. Similarly, the SFD algorithm experienced substantial decrease of 71.06% in the Balance metric for the Office-31 dataset.

---

Published in Transactions on Machine Learning Research (April/202))
For an in-depth exploration of the CFC algorithm's resilience to adversarial challenges, readers are referred to Appendix G Figure + which delves deeper into the robustness of the CFC model under adversarial conditions. Additionally, the findings related to the DIGITS and Yale datasets are detailed in Appendix Table 10 which also contrasts the percentage changes between our findings and those from the bascline research, further illustrating the comparative robustness of the CFC algorithm.
USPS
Of
Algoritium
Metrie
Pre-Attack
Post- Attack
Change (%6)
Match Original Findings
Pro-Atteck
Post- Attack
Change (%6
Match Original Findings
Halance
0-47040 011
0.421.:0 027
(3100335
0.620 1.0 001
0.637.0 000
(+)2.742 742
CFC
NMI
Entropy
2.622 0.22+.0.120 128
0.243++0
0.200+00.00
2.089++0.12 120
(4)11.34
(132.656
0.110 808
0.603 808
0.681
5.821+00115 152
[-14.828
(-11.792
ACC
0.858
0.406-00
(+)18.41
0.466-20
(-)7.866
Balance
0.28210000
0.3001:0000
(1)6.382
0.546110 000
0.158::0
()71.06
SPD
Rotropy
0.515++0.000
3.1041-0
0.358+00.00
(+)1.330
10:00::0
+-0
0.783.0-
(-12-170
ACC
0.419+0.000
0.473+0.000
(1)122.9
0.147 +0.000
0.149
[-19.097
(-]100.0
FSC
NM1
Eulewpy
0.327
0:5491:0000 000
0.5431..000 000
2414:00000
[-]1.093
(-)20.30
0.164 11664001139
652 000
0.6822:0 800
9.363.00
[+)4.601
(+32.800
AGC
0.450.:0000 000
0 0.45410 000
(+)0.880
1:0 000
0.438.1 000
(+)12.31
Hasance
0.557 3244
35611 398
[-137.16
0. 0.87132 1:0
0.87110.000 001
[-30.000
KFC
XMT
Entropy
0.000::0000 000
1.355.00 374
0.000::0000 000
2.22210.300 351
[-]11.29 29
[-1100.0
1.401 1:0 135
0.0000 1:0 000
0.000:20.000 000000
0.40111:000 135
[-10.000
[-]100.0
ACC
0.247
0.146:0.000
[-10,680
0.001 000
0.001:00000
[-10.000
Table 3: Results for pre-attack, post-attack (black-bor), change between pre- and post-attack, when 15% group membership labels are switched for fair clustering algorithms CFC, SFD, FSC, and KFC and datasets MNIST- USPS and Office-31. Results show the impact on fairness utility (Balance and Eutropy) and clustering utility (NMI and ACC). The chockmarks indicate that for the specified datasct and algorithm combination the per- formance matches the findings in the baseline research.
4.2 Results beyond original paper
4.2.1 Additional Metrics and Datasets
Motivation: In our study, we enhanced the original set of metrics - Balance, Entropy, NMI, and ACC with additional metrics for a more comprehensive clustering analysis. First, the Adjusted Rand Index (ARI) complements ACC by evaluating clustering similarity without relying on label information. Next, the Silhouette Score) measures cluster quality, while the [Minimum Cluster Ratio evaluates group representation within clusters, dimension overlooked by Balance. Metrics such as Cluster Distribution KL and Cluster Distribution Total Variation provide a deeper understanding of group distribution across clusters. The Silhouette Difference metric highlights disparities in clustering quality among groups. Additionally, separate calculations for Minority Cluster Distribution Entropy for Group A (sensitive attributo label = 0) and Group B (sensitive attribute label = 1) enrich our fairness assessment by analyzing the distributional homogeneity of each group. Furthermore, we included the Multi-task Facial Landmark (MTFL) and uncropped Vale datasets to broaden the scope of our analysis, adding complexity with diverse facial features and landmark amnotations. This choice complements the existing DIGITS and cropped Yale datasets, enriching the study with real-world applicability and a more comprehensive assessment of clustering algorithm fairness and adaptability.
The results for the additional metrics on the USIST-USPS and Office-31 datasets are presented in Table g while results for the DIGITS and Yale datasets can be found in Appendix [ Table [T To calculate the
fairness metrics, we utilized the holisticai library while scikit-learn (Podregosa ct al., 2011) was used to assess the quality of clustering. The results for the two new datasets are shown in Table 5 where we see increase in fairness utility for CFC in terms of Balance on the uncropped Yale dataset ((+)..004))
Our extended analysis revealed unique pattern in the KFC algorithm, which consistently grouped all data points into a single cluster, an issue first identified through errors in calculating Silhouette Scores and Differences. This led to 'N/A' entries for these metrics in Table | and Appendix H Table II Furthermore, we observed instances of infinite KI, divergence, especially when Balance was 0, highlighting significant group distribution discrepancies across clusters. The remaining metrics, except for the Minimum Cluster Ratio, did not have significant variations pre- and post-attack.
7

---

Published in Transactions on Machine Learning Research (April/202))
In the uncropped Yale dataset, findings highlighted the superior performance of the CFC algorithm, which exhibited a notable 130% increase in Balance post-attack. On the other hand for MTFL the results before and after showed no significant changes for all the tested algorithms.
MNIST-D3FS
Oghice331
Algorithm
Matric
Pre-Attack
Atta-A
Random Attack
Pre-Attack
Post-Actack
Random
Attack
Mie. Clusser Ratio
0.425 + 000054
0.500 + 000022
0.458 + 0. Ii1
0,200
00.018
0.00l
0.010
0.138 + 0.0iob
Cluster L1
0.276 + 0,077
0.270 0,084
0.276 00 122
0,170
0.008
0.180
0. 0.000
0.178 + 0.011
Cluster KL
0.204 + 0.184
0.235 + 0.0GS
0.269 = 0.300
0.052 + 0 1.000
0.100 + 0. 0.005
0.098 + 0.008
SPD
Entropy Group
Stihonatse diff
2:264 + 0.90s
-0.015 1 0.005
2:268 + 0.910
-0.020 1 0.000
2:173 + 0.290
-0.019 2 0.0066
5.383 t 0.002
-0.006 1 0. 0.0001
3.292
-0.008 :: 0. 000002
: 0.014
3.305 + 0.024
-0.000 1: 0.002
Entropy Group
2 1.004 1: 0.160
2 0.070 1: 0.000
2: 2-127
- 0.074
3:353 000
3.357 0.008
3.354 1 0.010
ARI
0.301 0.837
1.64 1: 0.017
0.948 0-046
0.753
008
0.687
0.400000 0.022
3.653 1: 0.018
Silhonatta scora
0.021
0.011
0.5 0.003
0,038 0-011
0.173
002
005 0-156
0-156 1 D01
Min. Clusser TExtio
0.000 1 0.000
0.000 1 0.000
0.000 0.000
0.000
000
0.000 0.000
0:050 1 0.092
Cluster
0.728 1 0.001
0.848 1 0.080
0.760 0.063
0.312 0.010
0:317 0.034
0.113 1 0.035
Cluster KL
oc nan
oc nan
sc" nan
0.089
000
0.064 + 0.008
0.058 + 0.009
F8C
Entropy Group
Bilhoustse
-0.069 + 0.002
+
-00070 0.002
-0.005 +
-0.004 +
Entropy Group
AR1
0.250 0.010
0.276 0,009
0.260 0.017
00.
0.033
0.029
Silbouetie
0.036 0.000
0.050 0.000
0.040 0.008
0.002 0.004
0,021 0.013
0.018 + 0.010
Cluster
0.013 1: 008
0.015 1: 0.010
0.014 0.009
0.000
000
0.000 000
0.0 000
Choster KT.
0. 0.003 1: 0.000
0. 0.005 1: 0.002
no was""
0.000 000
0.000
000
0.0 1 000
KPC
Entropy Group
Siihonetta diff
01:238 4: 0.145
0.02662 0.020
0. 035 1: 0.029
0.201 1 0.2
0.223 : 0. 145
0.022 :: 0.026
0.007
0.015 N/A-
N
0.007
0.015
N
0.6 1 0.032
Entropy Group
01.275 4: 0.164
0.254 4: 0.188
0.258 +: 170
0.007
0.017
0.007 0.017
0.007 4 0.037
ARI
0.0 0 002
0.0 0. 001
0.0 4 0. 002
0.000 4 0.000
0.000 0 0.000
0.000 0.000- 4: 0.000
Silhoustse score
0. 0.099 4: 0.008
0.113 4: 0.058
0.101 -: 0.057
N/AA
N/A*
N/A*
Table 4: Results for pre-attack, post-attack (black-bor), and random attack, when 15% group membership
labels are switched for fair clustering algorithms SFD, FSC, and KFC and datasets MNIST-USPS and Office- 31. Results show the impact on additional metrics, where N/A corresponds to uniform clustering, oo to infinite values, and nan to undefined values.
4.2.2 Additional Attack Methods
Motivation: We introduced new and combined attacks targeting various evaluation metrics to test the model's robustness. This approach aimed to uncover potential vulnerabilities, guiding improvements for enhanced model generalization and defense.
We experimented with various attack strategies, focusing on the Office-31 dataset using the SFD algorithm. Initially, our focus was to challenge one of the recently introduced fairness metries, specifically the Minimum Cluster Ratio. This attompt yielded identical results to those of the balance attack, suggesting a complete correlation between these two metrics. Subsequently, we explored a dual-attack approach largeting both Balance and Entropy, using a different optimization toolbox, namely Nevergrad (Rapin & Teytaud 2018). which uses meta-optimizer named NGOpt.
In our study, we conducted a grid search across various weights for Balance and Entropy [1, 5, 10] and different budget levels [20, 40, 60). utilizing three seeds [42, 123, 456). This process identified an optimal configuration with weights of 5 and 1 for Balance and Entropy, respectively, and a budget of 20. However, the improvements observed in the attack performance with this configuration, as compared to the originally proposed attack, were marginal. Detailed results of these comparisons are presented
Appendix D Table [2] The new attacks on the Minimum Cluster Ratio and the combined attack were also tested with the CFC defense algorithm. The CFC algorithm demonstrated robustness in countering these attacks. The details of the results are shown in Appendix J Table 13
4.3 Ablation Study of Alpha and Beta Hyperparameters in the Consensus Fair Clustering Model
The study mainly focused on two key hyperparameters, alpha (a) and beta (8), which were tuned to optimize for training loss. Alpha controls the ratio of fair clustering loss, and beta controls the ratio of structural preservation loss. The ablation study was conducted to understand the effects of these two hyperparameters on the performance of the CFC model.
Motivation:
We trained the Consensus Fair Clustering (CFC) model on the Cora dataset (MeCallum et al. 2000) This dataset consists of 2708 scientific publications classified into seven classes and was balanced by randomly sampling 1000 papers and using the binary feature 'w 1177' the sensitive attribute. We evaluated the
8

---

Published in Transactions on Machine Learning Research (April/2024)
CFC model's clustering and fairness performance under different hyperparameter settings. Some of the hyperparameters for the CFC model were kept constant, such as the number of basic partitions (r 100); the temperature parameter in the contrastive loss (T = 1), dropout in hidden layers (0.6), the number of training epochs (400), and the activation function (Gaussian Error Linear Unit). The dimension of the hidden layer was set. 256. The experiment was run 10 times for each set with different random seeds, and the average results are reported in Figure We conclude that the a and B hyperparameters do have a large impact on the CFC model.
Alp1a=1.0, Beta=1.0
Appa-1.00 Beta-50.0
Alpha=1.0 Beta-100.00
2.75
1.75
1.75
1.25
1.25
1.40
0.5
019
2.0
035
9.00
003
Np.h=-30.C, Betam1.0
Alph==50.0.
Setam30.00
Alpha=30.0 Betam100.C
1.70
1.50
1.30
1.5
1.00
1.0
3.50
0.53
3.5
0.2
balance
ostropy
8T6
30c
10 0000
rnt
Iclancs
ortopy
80C
Alpha
Alpha=100.0,
Alpha=100.a.
2.5
2.00
1.75
3.50
1.00
3.2
1:25
1.00
1.0
000
05-
2.00
003
balance
setrogy
Figure 2: Results on the effects of and 8 hyperparameters the CFC model. To measure performance, the Balance, Entropy, Normalized Mutual Information (NMT) and Unsupervised Accuracy (ACC) metrics were used.

---

Published in Transactions on Machine Learning Research (April/202)
MTFL
uncropped Yale
Algorithm Metric
Pre-Attack
Post-Attack
Change (%)
Pre-Attack
Post-Attack
Change (%)
Balance
0.583
0.571
(-)2.058
0.191
0.440
(+)130.44
CPC
Eatropy
0.639
0.635
(-)0.620 626626
7.921
7.520
(-)5.062
NMI
0.007
0.007
(-)0.000
0.229
0.199
()]33110
ACC
0.600
0.606
(+)1.000
0.136
0.117
(-)13.97
Balance
0,971 0,000
0.967
0,000
[)00,112
0.115 + 0.116
0.031 +: 0.039
(-)73.01
SFD
Entropy
0.092 = 0.000
0.692 = 0.000
(-)0.000
12.00 + 0.1
11.68 + 0.15
(-)2.765
NMI
0.001 = 0.000
0.000 0.000
(-)100.0
0.693 + 0.002
0.687 + 0.005
(-)0.866
ACC
0.529 + 0.000
0.512 0.000
(-)3.214
0.404 + 0.003
0.412 + 0.008
(+)1.980
Balance
0.992 = 0.000
0.986 = 0.000
(-)0.605
0.000 + 0.000
0.000 = 0,000
(-00.000
PSC
NMI
Entropy
0.693 0,000
0.000 1 0.000
0.693
0.000 1 0.000
(+)0.000
(-)0,000
0.880 1 0.000
11.07 0.016
0.879 1 0.000
(-j0.114
(-)0.360
ACC
0.546 + 0.000
0.544 + 0.000
(-)03666
0.769 + 0.001
0.769 + 0.001
(-)0.000
Balance
0.870 0.143
0.778 108
100.58
0.774
0.728 + 0.379
(15.943
KFC
Entropy
0.681 = 0.019
0.678 = 0.018
(-)0.777
0,503 + 0.160
0.441 + 0.147
(-)12.33
NMI
0.001
0.000 0.000
(-)00000
+ 0.002
+
(-)50.00
ACC
0.669 + 0.011
0.670 + 0.011
++ 10.144
0.032 + 0.001
0.032 +: 0.001
(-10.000
Table 5: Results for pre-attack, post-attack (black-boz), change between pre- and post-attack, and relative
changes compared to the original study, when 15% group membership labels are switched for fair clustering algorithms CFC, SFD, FSC, and KFC and datascts MTFL and uncropped Yale. Results show the impact on fairness utility (Balance and Entropy) and clustering utility (NMI and ACC). Relative changes provide insights into how our changes between pre-attack and post-attack differ from those of the paper. The pre- and post-attack for CFC were run with one soed, leading to no standard deviation.
5 Discussion
Our study aimed to replicate key aspects of 'Robust Fair Clustering' (Chhabra et al. 2023). examining four algorithms across four datasets (see Section 3.5). We successfully confirmed Claims 2 and 3 of the original study, but only achieved partial replication for Claim 1, highlighting some variations in our experimental
findings.
The results presented for Claim 1 (Section 4.1.1] partially confirm the effectiveness of the black-boz attack in degrading the fairness performance of the clustering models. Across the four datasets and three fairness algorithms outlined in the baseline study, 75% of our experiments supported this claim, showcasing a signifi- cant reduction in fairness, with the Balance metric showing declines exceeding 30%. While results largely mirrored those of the original study, there were notable exceptions: slight increase, instead of a considerable decrease, for the Balance and Entropy metrics on the MNIST- USPS dataset using Scalable Fairlet Decom- position (SFD). In the baseline study, the fairness models were also evaluated on DIGITS and Yale datasets. Our experiments on these datasets reveal that the fairness attack significantly impairs the performance of the SFD model for both datasets, as detailed in Appendix [+] Table g When subjected to allacks, three of the four datasets referenced in the baseline study show a substantial performance drop in the SFD model. The lack of a similar decline in the MNIST- USPS datasct suggests that the SFD model effectively copes with the attack on this dataset. The discrepancy in the SFD model's performance on MNIST- USPS between the baseline research and our analysis may be attributed to potential dataset preprocessing not disclosed in the baseline study or to the original results being incidental. Even though the outcomes for the SFD model on MNIST- USPS do not match those of the baseline study, the results from the other three datasets referenced in the baseline support. the original claim. Similarly, on the Office-31 dataset, the results for Fair K-Center (KFC) remained unchanged before and after the attack. Besides the rcasons discussed above, this can be attributed to the unsupervised and unstable nature of clustering algorithms, which can result in singleton clustering or utilizing fewer clusters than specified (Ohl et al.. 2022). Despite the discussed discrepancies, considering that the results of most of the experiments are similar to the findings in the bascline rescarch, Claim 1 is partially confirmed.
Our analysis of Claim 2 (Section 4.1.2) aligns with the hypothesis that clustering models are prone to adversarial influence. As shown in the original paper, such attacks lead to significant fairness decreases across all fair clustering algorithms and datasets. While our observations showed some deviations from this pattern and some exceptions exist previously discussed, they generally aligned with the original study
10

---

Published in Transactions on Machine Learning Research (April/202))
in demonstrating consistent decline in fairness performance across the studied algorithms and datasets post-attack. Specifically, the fairness performance, as assessed by the Balance metric, experienced declines exceeding 30% in most instances, and in many cases, even exceeded 70%
The third claim (Section 1.1.3) states that the Contrastive Fair Clustering (CFC) algorithm exhibits high resilience against. the proposed fairness attack. Consistent with the findings reported in the paper, our analysis revealed that the CFC algorithm demonstrated superior performance in terms of fairness utility and clustering performance compared to other state-of-the-art fair clustering algorithms. An exception was observed where the SFD algorithm exhibited marginal improvement in performance following the attack on the MNIST-USPS dataset, as previously mentioned. This dataset represents the sole instance among the four evaluated in the baseline study where such an anomaly was noted. While there may exist some variations in the specific values of post-attack fairness compared to pre-attack fairness, our analysis generally confirms the superior performance of the CFC algorithm in defending against fairness attacks when compared to other algorithms. Thus, our findings affirm the robustness and effectiveness of the CFC algorithm in prescrving lairness and performance under adversarial conditions.
Additionally, our study incorporated new evaluation metrics as outlined in Section 4.2.1 enhancing our understanding of model performance and guiding the development of new attack methods Particularly noteworthy was the Minimum Cluster Ratio, which exhibited substantial shifts in several experiments, con- trasting with other additional metrics that remained relatively stable pre- and post-attack. This suggests that they may not be suitable targets for fairness attacks, though further investigation is needed to confirm this hypothesis. Equally notable were the Silhouette Difference and Silhouette Score metrics. Initially intro- duced to assess fairness and clustering quality, respectively, these metrics played a crucial role in revealing the KFC algorithm's 's tendency towards singleton clustering, thereby enhancing the transparency of the model evaluations.
Our study was further extended by including two new datasets, as detailed in Section 4.2.1 to assess the adaptability of models across different data distributions. In the uncropped Yale dataset, CFC consistently outperformed its counterparts. For MTFL, the atlacks were not very effective even for the KFC, FSC, and SFD algorithms. This could be attributed to the dataset being simplified to just two categories post- processing, making it relatively straightforward for the clustering models to effectively group the data into two clusters, even with 15% of the labels switched. Further investigation is necessary to fully understand the underlying reasons for this outcome.
Morcover, we conducted additional invostigations to assess the gencralizability of the model under diverse allack scenarios. The investigations included allacking different evaluation metrics other than the ones used in the bascline research, as well as a combined attack. The findings indicated that the performance of CFC remained consistently stable, even under these new forms of attack. This suggests that the current model demonstrates robustness against attacks designed in similar way as the attack to the evaluation metric Balance in baseline research. Future studies involving more innovative attacks might offer opportunities to enhance and broaden the model's defensive capabilities.
Finally, the findings from our ablation study, particularly the minimal influence of the a and 3 hyper- parameters on the CFC model, underscore the robustness of the model's design. This resilience against hyperparameter fluctuations highlights the model's adaptability and efficiency maintaining fairness and clustering quality across varied settings.
The primary constraints of our study were limited computational re- sources and time, leading us to use a restricted set of seeds in defense experiments and narrow scope in our grid scarch. Further work could include expanding the grid scarch and rumning the defense experiments with a full set of seeds. Expanding the grid search paramelers could potentially unveil a more effective attack strategy, aligning with our ultimate objective of identifying potent attacks. A particularly valuable addition to this study would be the development of a novel attack approach that can significantly challenge the robustness of the CFC algorithm, thereby pushing the boundaries of our current understanding of defense mechanisms in fair clustering.
Limitations and Future Work:
11

---

Published in Transactions on Machine Learning Research (April/202)
Environmental Impact: Experiments conducted using computer cluster located in Amsterdam, which has carbon efficiency of 0.4590 kgCOzeg/kWh. A cumulative of 130 hours of computation was performed on hardware of type A100, and 80 hours on AMD Ryzen 7 4800H CPC. Total emissions are estimated to be 19.73 kgCOzeq. Estimations were conducted using the Machine Learning Impact calculator presented (accoste et al. 2019
Broader Impact: Recent studies have shown that algorithmic docision-making making may be inherently prone to unfairness, even when there is intention for it (Pessach Shmueli 2022). This study contributes to the importance of fairness in clustering algorithms and their resilience against adversarial attacks. Our findings not only highlight the vulnerabilities of ML models to adversarial attacks as shown in existing literature (Mal et al. 2019), but also contribute to the verification of more robust defense mechanisms against such fairness attacks. Furthermore, by incorporating additional evaluation metrics and datasets, our research offers a more in-depth exploration of the fair clustering model's adaptability and resilience which is beneficial to further research. Through this research, we aim highlight our study's role advancing the technical robustness of Al technologies, contributing a more equitable and sustainable future in the field of ML.
5.1
What was easy
The original paper provided the necessary information on the majority of hyperparameter values required reproduce the experiments, and the publically available repository was well-doeumented with insightful comments. This made it straightforward to refactor the code and understand the idea of the proposed method. While it required some effort to comprehend and adapt the implementation structure, the overall time invested in executing the experiments successfully was reasonable.
5.2 What was difficult
One minor inconvenience was that certain dependencies needed slight adjustments to align better with current popular environments. Moreover, incorporating the KFC algorithm required the installation of IBM-CPLEX, used as an external solver via PuLP. Another potential concern was the lack of clarity in the bascline rescarch regarding the acquisition of pro-computed labels and index files, interfering with the expansion to additional datasets and evaluation metrics for assessing the robustness of the conclusions.
5.3 Communication with original authors
There was no direct communication with the original authors throughout the replication ion effort. Later advice on hyperparameters for the KFC algorithm from the authors did not impact the noted singleton clustering behavior.
References
Gnana Anandalingam and Terry L. Friesz, Hierarchical optimization: An introduction. Annals of Operations Research, 34:1-11, 1992. URL http:/rgeee//ppp..nmaaeceeaaoa..
wwwanticscoolar..... www.oolaa.rrrrrroooooo WrggCCorpsIDD.... 21731488
Arturs Backurs, Piotr Indyk, Krzysztof Onak, Baruch Schieber, Ali Vakilian, and Tal Wagner. Scalable fair clustering. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 405 413. PMLR, 09-15 Jun 2019. URL https:: ptttpp://procceednngs mlr. presss//97/baccusste...
Anshuman Chhabra, Adish Singla, and Prasant Mohapatra. Fairness degrading adversarial attacks against 12020
clustering algorithms. CoRR, abs/2110.12022 2021. URL
Anshuman Chhabra, Peizhao Li, Prasant Mohapatra, and Hongfu Liu. Robust fair clustering: A novel fairness attack and defense framework, 2023.
Flavio Chierichetti, Ravi Kumar, Silvio Lattanzi, and Sergei Vassilvitskii. Fair clustering through fairlets, 2018.
12

---

Published in Transactions on Machine Learning Research (April/202)
Elfarouk Harb and Ho Shan Lam. Kfc: A scalable approximation algorithm for k-center fair clustering, 2020.
Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus). arXiv preprint arXiv: 084 15, 2016.
Matthäus Kleindessner, Samira Samadi, Pranjal Awasthi, and Jamie Morgenstern. Guarantees for spectral clustering with fairness constraints. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceed- ings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 3458 3467. PMLR, 09 15 Jun 2019. URL #91/Xleindessner19bb. html
mlr. press/
Alexandre Lacoste, Alexandra Luccioni, Victor Schmidt,, and Thomas Dandres. Quantifying the carbon emissions of machine learning, arXiv preprint arXiv:1910.00 097000 2019.
Kuang-Che Ching Loe, J. Ho, and D.J. Kriegman. Acquiring lincar subspaces for face recognition under variable lighting. IEEE Transactions on Patlern Analysis and Machine Intelligence, 27(5):684 698, 2005. doi: 10.1109/TPPA [TPAM.2005..
Peizhao Li, Han Zhao, and Hongfu Liu. Deep fair clustering for visual learning. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pottern Recognition, pp. 0070-9072 2020.
Tao Li and Chris Ding. The relationships among various nonnegative matrix factorization methods for clustering. In Siath International Conference on Data Mining (ICDM 066), pp. 362 371. IEEE, 2006.
Yuxin Ma, Tiankai Xie, Jundong Li, and Ross Macicjewski. Explaining vulnerabilities to adversarial machine learning through visual analytics. IEEE transactions on visualization and computer graphics, 26(1):1075- 1085, 2019.
Andrew Kachites McCallum, Kamal Nigam, Jason Rennie, and Kristie Seymore. Automating the con- struction of internet portals with machine learning. Information Retricval, 3(2):127-163, jul 2000. URL http::///eemppl..commoooomo tgz
Ninarch Mchrabi, Muhammad Naveed, Fred Morstatter, and Aram Galstyan. Exacorbating algorithmic bias through fairness attacks. Proceedings of the AAAT Conference on Artificial Intelligence, 35(10):8930 8938, May 2021. ISSN 2159-5399. doi: 10.1609 (6609//aaivvaa aaaaaaii.v33. v33.113.510000000000 735110.2 17080]
URL http: doi ort.ooog//../...... aaaii
Louis Ohl, Tjerre-Alexandi Mattei, Charles Bouveyron, Warith Harchaoui, Mickaël Leclereg, Arnaud Droit, and Frederic Precioso. Generalised mutual information for discriminative clustering, 2022.
Sarah Oppold and Melanie Herschel. Accountable data analytics start with accountable data: The liquid metadata model. In ER
pp. 59 59-72, 2020.
Fabian Pedregosa, Gaël Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, et al. Scikit-learn: Machine learning in python. Journal of machine learning research, :2(0c1):2825 2830, 2011.
Dana Pessach and Erez Shuneli. A review on fairness in machine learning, ACM Computing Surveys (CSUR), 55(3):1-44, 2022.
J. Rapin and O. Teytaud. Nevergrad - gradient-free optimization platform. https://GitHub. com/ FaceboosRBeearrch/eeeerggzz 2018.
Mayra 7. Rodriguez, Cesar H Comin, Dalcimar Casanova, Odemir M Bruno, Diego R Amancio, Luciano da F Costa, and Francisco A Rodrigues. Clustering algorithms: A comparative approach. PloS one, 14 (1):0020 2019.
Pradeep Kumar Roy, Sarabject Singh Chowdhary, and Rocky Bhatia, A machine learning approach for automation of resume recommendation system. Procedia Computer Science, 167:2318 2327, 2020.
13

---

Published in Transactions on Machine Learning Research (April/2024)
Kate Saenko, Brian Kulis, Mario Fritz, and Trevor Darrell. Adapting visual category models to new domains. In Kostas Daniilidis, Petros Maragos, and Nikos Paragios (eds.); Computer Vision - ECCV 2010, pp. 213- 226, Berlin, Heidelberg, 2010. Springer Berlin Heidelberg. ISBN 978-3-642-15561-11
Bruce Schneier. Data and Goliath: The hidden battles to collect your data and control your world. WW Norton & Company, 2015.
Andrew D Selbst, Danah Boyd, Sorelle Friedler, Suresh Venkatasuubramania, and Janet Vertesi. Fairness and abstraction in sociotechnical systems. In Proceedings of the conference on fairness, accountability, and Iransparency, pp. 59 68, 2019.
Claude Elwood Shannon. A mathematical theory of communication. The Bell system lechnical journal, 27 (3):379 423, 1948.
Jingcheng Song, Zhaoyang Han, Weizheng Wang, Jingxue Chen, and Yining Liu. A new secure arrangement for privacy-preserving data collection. Computer Standards & Interfaces, 80:103582, 2022.
Alexander Strehl and Joydeep Ghosh. Cluster ensembles knowledge reuse framework for combining multiple partitions. Journal of machine learning research, 3(Dcc):583-611 617, 2002.
Chih-Fong Tsai and Ming-Lum Chen. Credit rating by hybrid machine learning techniques. Applied soft computing, 10(2):374 380, 2010.
L. Xu, A. Krzyzak, and C.Y. Suen. Methods of combining multiple classifiers and their applications to handwriting recognition. IEEE Transactions on Systems, Man, and Oybernelics, 22(3):418 435, 1992. doi:
Rui Xu and Donald Wunsch. Survey of clustering algorithms. IEEE Transactions neural networks, 16 (3):645-674 2005.
Zhanpeng Zhang, Ping Luo, Chen Change Loy, and Xiaoou Tang. Facial landmark detection by deep multi- task learning. In David Fleet, Tomas Pajdla, Bernt Schiele, and Tinne Tuytelaars (eds.), Computer Vision ECCV 2014, pp. 94-108, Cham, 2014. Springer International Publishing. ISBN 978-3-319-10599-4.
Marinka Zitnik, Francis Nguyen, Bo Wang, Jure Leskovec, Anna Goldenberg, and Michael M Hoffman. Machine learning for integrating data in biology and medicine: Principles, practice and opportunities. Information Fusion, 50:71-91, 2019.
14

---

Published in Transactions on Machine Learning Research (April/2024)
A Hyperparameters
SFD algorithm: The values of p and q parameters are efficiently balance the trade-off between clustering performance and fairness utility. Specifically, use p and q = 5 for most datascts, except for the Inverted UCI DIGITS dataset where and q 5.
FSC algorithm: we employ the nearest neighbors approach to construct the input graph, setting the number of neighbors to 3 for all datasets.
KFC algorithm: we utilize a parameter å == 0.1 as specified in the original implementation.
CFC algorithm: consistency in hyperparameters is maintained across all datasets, with a fixed number basic partitions (r) set 100, temperature parameter (7) of 2 for the contrastive loss (Lo), and dropout of 0.6 in hidden layers.
Furthermore, the activation function employed is the Gaussian Frror Linear Unit (GELU) (Hendrycks & Gimpel 2016), while the fair clustering algorithm utilized for generating J for structural preservation loss (Lp) is SFD with default parameters, chosen for its faster runtime compared to other fair clustering algo- rithms. The dimension of the hidden layer set to 256 for all datasets except Inverted UCT DIGITS, which has only 64 features, thus necessitating hidden layer dimension of 36.
Optimization of other hyperparameters for different datasets to enhance fairness performance is conducted using a grid-based search technique and are shown in Table 6
Datasct
a
8
HINIST-USPS
100
25
Office-31
1
100
Inverted UCI DIGITS
2
10
50
Exlended Yale fuce B
2
50
10
Table 6: Summary of hyperparameters used in experimentation.
B KFC: Comparison of Balance and Entropy Attacks
The original paper utilized the Fair K-Center (KFC) algorithm, but the code for this algorithm was absent the jupyter notebooks provided by the authors. Consequently, we had to make arbitrary decisions regarding each experiment's budget and attack strategy. In Table present the results for the Balance and Entropy attacks for KFC all datasets. Notably, these results consistently fall within very similar range and, in some instances, are even identical across datasets. Upon further investigation, it was discovered that KFC clustered all data points into the same cluster, likely explaining the uniformity of the results.
Metric
Dataset
Attack
Balance
Entropy
NMI
ACC
Balance
0.350 + 0.299
1.242 + 01.188
0.027 F 0.017
0.144 + 0.010
MNIST-USPS
Entropy
0.350 + 0.299
1.202 + 0.350
0,028 4 0.019
0.145 + 0.012
Balance
0.971 + 0.067
0.401 0.135
0.001 t 0.003
0.050 : 0.000
Office311
Entropy
0.971 1 0.067
0.401 0.135
0.001 1 0.003
0.050 1 0.000
Balance
0.313 0.203
3.154 0.244
0.056 0.007
0.174 0.017
DIGITS
Entropy
0.375 1 0.209
3.133 0.220
0.028 1 0.019
0.175 0.016
Balauce
0.834 1 0.322
0.668 0.578
0.003 1 0.007
0.030 1 0.001
Yale
Entropy
0.845 1: 0.326
0.845 1 0.326
0.602 1 0.517
0.030 1 0.001
Table 7: Comparison of Balance and Entropy attacks for the KFC algorithm for MNIST-USPS Office--11, Inverted UCI DIGITS (DIGITS), and Extended Yale face B (Yale) datasets. Results show the impact on fairness utility (Balance and Entropy) and clustering utility (NMI and ACC).
15

---

Published in Transactions on Machine Learning Research (April/2024)
C Definitions for Metrics
Normalized Mutual Information (NMI) is a normalized version of the mutual information metric. It can be defined as Equation 1 with the mutual information metric (Shannon 1948) represented by 1, Shannon's entropy represented by E, the cluster assignment labels represented by I, and the ground truth labels represented by
NMI L(Y,)) BYY + E(L)
(1)
Accuracy (ACC) is equivalent to the classic accuracy for classification. mapping function p is utilized to compute all feasible mappings between true labels and predicted cluster labels for some samples. It defines Y; as the true labels and Li as the predicted cluster labels and forms the following Equation:
ACC max -i 1[Y, - p(L:)}
(2)
Balance lies between 0 (least fair) and 1 (most fair). Suppose that the model contains m protected groups for given dataset X. Equation 3 denotes rx the proportion of samples of the dataset belonging to protected group g and r as the proportion of samples in cluster k E [K] belonging to protected group g:
1x
r rx
Balance
min min sE(
(3)
Entropy is similar to Balance, where higher values of Entropy indicate that clusters have more fairness. In Equation No.g is used to represent the set containing the samples of the dataset X that belong to both the cluster E [K] and the protected group g- Besides, ny is used to denote the number of samples in cluster
k:
NN log
Entropy(g) -- Σ
(4)
KE(K]
16

---

Published in Transactions on Machine Learning Research (April/2024)
D Attack and Defense Results on MNIST-USPS and Office-31 with Relative Changes
MIIIT-USPS
Algorithm
Matrics
Pre-Attack
Post-Attack
Change
Rtlative Change (56)
Random
Change (%)
Relative
Balanes
(F]6.382
SED
NMI
Entropy
3.063
0.315
0.201
0.000
0.858
3.104
0.000
00000
(4))1.300
[+)13.60
+-848.7
11.022
8.147
0.346
0.0000
+00000
(+:1.841
12.2.74
[+)258
11006
ACC
0.419 0.000
0.473 : 0.000
(+)12.89
(+)211.
0:456 0.000
(+18.831
(+)171.5
Halance
0.000 0.000
0.000 0.000
[-]100.0
(-30.000
0.000 0.0000
[-3100.0
(-30.000
PSC
SMI
Ratropy
0.549 0,000
0.397 0.000
0.241 00.00
0.643 + 0.000
[-)26.30
(-11,098
(-180.44
(-)206.7
0:301 4.0.00
0.638 0.000
[-]7 ()7.851
[-]2,004
[-)204.6
[-1508.1
ACC
0.400 0,000
0. 0.454 + 0.000
(100888
(-154.90 40
0.443 + 0.000
(-)1,500
[-1268.0
Balance
0.507 = 0.324
0.350 1 0.309
[]37.16 16
C130.86
0.724 7724::0.11
(F)30
(F7250
KPC
NMI
Entropy
0.000 4: 0.000
1.305 + 0.374
0. 000 0.000
1 1.202
4 0.351
[-]11
[-]180.0
(-)1,820
[-]11.56
0.000 4 0.000
4.417 2 0.417
[+]4.076
[-]100.0
(-)1,976
(+)1,317
ACC
0.147 + 0.000
0.148 + 0,000
[-]0,880
(-)114.8
0.145 + 0.000
[-11.361
[-1139.8
Office37
Algorichm
Metrics
Pre-Attack
Post-Attack
Change
Relative
Change (%)
Relstive
Change (%)
(26)
SED
Ratropy
XMI
0.588 0.000
10.00 0.000
0. 0.861:
9.783
1 00001
00.000
[-)2.170
[-]3.031
(+)26.01
(+)34.42
0,850 1.0.000 000
8.903
001
(-)8-153
(-30.970
(+)62.49
(-)334.3
ACC
0.811 0.000
0.765
0.000
[-19,037
(+)0.831
0.768 0.0000
(-18.561
(-1194.4
Balance
0,000 0.000
0.000
0.000
[-]100.0
(-10.000
0:211 1:221
(+)100.0
(111.903
FSC
NMI
Entropy
0.952 0,000
9.184 0.119
9.383 + 0.301
0.882 0.000
(4)2.390
(+)4.001
(+)359.7
(+325.74
0.6s5 0.0000
9.628 + 0.215
(+18.083
(+16.081
(4)2,345
[4]96.58
ACC
0,380 + 0000000
0. 439
1 0.000
[+)12.31
(+)24.30
0-436 4 0.000
(+)18.73
(+)112
Bulance
0,9Y1 0.001
0.971 + 0.001
[]0.000
2100.0
0.911
C10.000
(11100600
KPC
NMI
Ratrapy
0.000 0.000
0.401
1:35
0. 1010--1
0.000 0.000
1 0.135
[-]180.0
[-)0.000
(-1206.0
(+)100.0
0.000 4. 0.000
0.401 2 0.15
(-)100.0
(-)0.000
(+)100
[-162, 300
ACC
0.001 + 0.000
0.001
+ 00,000
[-10.000
(-1100.0
0.001 + 0.000
[-)0.000
[+)1000 0
Table 8: Results for pre-attack, post-attack (black-boz) boz), random attack, change between pre- and post-attack / random attack, and relative changes compared to the original study, when 15% group membership labels are switched for fair clustering algorithms SFD, FSC, and KFC and datasets MNIST-USPS and Office-31. Results show the impact on fairness utility (Balance and Entropy) and clustering utility (NMI and ACC). Relative changes provide insights into how our changes between pre-attack and post-attack random attack differ from those of the paper.
E
Attack Results on DIGITS and Yale Datasets
Algocishum
Metrica
Pre-Atsack
Post-Atiack
Change (%)
Relative
Random
Change (%)
Relative
Change (%)
Atiuck
Change
Halance
0.000 D-000
0.000 1 0.000
[-]0000
(-100000
0.000
0.000
[-)100.0
[-]0:000
3FD
Eatropy
2:921
0. 0.000: 0.000
0.393
[-1100.0
(+)41.37
(-10.000
(+)98.44
0.390
(+)41.37
[-)160.0
t-10
(+)21100
0.000
(+)27733
[-1100.0
(-1100-0
[-30.000
FSC
NM1
Entropy
6.000 0.313
0.564
0.661 0,000
[-]0
[-]1-156
0.364 0.000
(-30.000
(f)100.0
ACC
0.000
0.316 0.000
(+)0.858
0:314 0.000
(+10.310
[-19.117
KFC
XMI
Kntropy
0.001 0.000
3.376 0:107
0. 0.0001: 1 0.000
3.133 1 0.230
(-)7.188
[-]0.000
(-15-620
1100000
3.210 0.1197 197
0.001 0.0.000 000
(-)0.000 000.00
(-)8.817
(+)1000.
(-)16.63
ACC
0.174
0.000
0.175 4 0.000
(+)0.575
+11445.1
0.174 0.000
(-10.000
(+)100.0
Yzh
Alguetshma
Metrics
Pre-Atsack
Post-Attack
Change (%)
Relative
Random
Change (%)
Relative
Change (%)
Attack
Change
Halance
0.000 0.000
0. 10000
1 0.000
[-1100.0
(-000000
0.000
000
[-)100.0
[-00.000
SFD
Entropy
0.100
3,900
0.160 0.000
3.741
00119
[-15.745
6-10.000
(-1100.0
1340.8
4.820
0.374
000
(1)8.094
(112,500
[-104.60
(1)2.192
ACC
(-1100.0
0.000
0.000
[-]100.0
(-10.000
0.000
(-)160.0
t-J0.000
PSC
NMI
Katropy
0.365 0.000
[-]4.145
(-)42.34
0.000
(+112.088
(+)93.57
ACC
0.273 0.000
0.274 0.000
[130.800
1814,0
0.000
(-)0.000
[1)100.0
Exlance
(-1100.0
KFC
Entropy
NM1
0.000 000
0.344 000
000
0.000
0.000
[-J0.000
[-)100.0
(-)100.0
(-1864.5
0.000
0.344
800
000
(-)100.0
(-)0.000
[-3100.0
[-)709.0
ACC
0.241 0.000
0.241 + 0.000
[-10.000
(+)100.0
0.241 0.000
(-10.000
[+)100.0
Table 9: Results for pre-attack, post-attack (black-bor), random attack, change between pre- and post-attack
/ random attack ,nd relative changes compared to the original study, when 15% group membership labels are switched for fair clustering algorithms SFD, FSC, and KFC and datascts Inverted UCI DIGITS (DIGITS) and Extended Yale face B (Yale). Results show the impact on fairness utility (Balance and Entropy) and clustering utility (NMI and ACC). Relative changes provide insights into how our changes between pre-attack and post-attack random attack differ from those of the paper.
17

---

Published in Transactions on Machine Learning Research (April/2024)
ENTROPY
MNI
0.00
0.359
0,50
00055
0.00
031255
0365
0.3003
23
30
10
20
20
30
0.41
0.40
0.52
044
0.90
25
10
20
20
0.15
1.90
0.07
0.30
0.25
3.0
011
037
0.00
0.27
010
618
0.00
90
16
0.36
1.00
0.34
-25
Figure Pre-attack, post-attack (black-box) and random attack results on fairness utility (Balance and Entropy) and clustering utility (ACC and NMI) for Inverted UCI DIGITS (DIGITS) and Extended Yole face B (Yale) (x-axis: % of samples attacker poison).
F
Defense Results on DIGITS and Yale Datasets
DIGHTS
Algarichma
Pre-Attack
PottcArtacle
Change (%)
Relative
Pre-Attach
Port-Artack
Change (5))
Ralative
Change (56)
Change (%)
Halance
0-189100011
0:165:200005 0.0
(=14:50
[-]84.61
6.001 10.001
0:216::0 001
CPC
NMI
Entrope
0.220=00.000
1.978-+0. 3315-+0.051
1.996 +-0 0.079
0.290- 0.00--0000 0000
(4:10.94
(1128.92
(-80.00
(-1269.4
6.015 1-5++-0 +-.199
0.150-+ 1:000-0 0.000
0.144+00 0..4+-0.00 000
6.813+-1
1.010
(-14.000
(4-113.27
(4-003778
(-1119.8
ACC
0.283220.000
0. 0:263:100 0.0312.00000 000
(-13-534
(+)
2.150:10.00 000
0.1441.0 000
(-)5.000
[-)142.6
Balance
0.0002000000
0:000:10 000
(1100.3
130.000
0:000110 000
0:000::0 0.000
[-]100.0
[-]0.000
3PD
NM1
Entropy
2.921 200000
0.278-2-0.00
0.393 9:0 000
0.000::0 000
(-1100.0
(+141.37
[-30.000
(4)28844
3.060 1:0 2.2
1.380-t-0.00m
3.74120 193
0.160 0.000+0..0 000
(-15.745
(-10.900
[-)100.0
(+)46.85
ACC
0,300-60.000
0.496
000
19.9778
(+177048
0.001 +.0000
0.001 + 000
(-)0.000
[-]100.0
Halance
0.00020.000
0.000 000
1300000
1-30-000
0.000 000
0 0.00020 000
[-)100.0
[-)0.000
F8C
NM1
Ratropy
0.304:20.000
0.316220.000
0.34220 000
0.581 2:00 0000
(-)1.155
(-)0.582
NEA
NiA*
3.402 000
0.387 2.0000
3 3.261 1:0 001
D 0.380
000
(-)4.145
(-)0.545
(-)42.34
(-)2.830
ACC
0.515-60:000
0.316 000
(4 10.9985
NiA
0.275-+-6000
0-77---00000 0000
D 0.274 0 000
(4)00.88
(+1914.0
Balance
0,707 0..132
0.376 200
(-)46.09
(1)333.0
1.3000--0.4.00
D. 0.800 0. 4010
[-10,000
[-]100.0
KPO
NM1
Eatropy
8.376-2-0,10
0,001 000000
3.158 + 0.22
0.001 000
(-)7.198
[-)0.000
(1)100.0
(-15.620
0.344 0.0000
0.000:400 0.000
0.344 0000
0.000 + 000
[-)0.000
[-]100.0
(-)100.0
(-)864.3
0.174220000
0.176.10000 000
[+)0.578
(+)143.1
0:241 1:0000
2:0 000
(-)0.000
(+)100.0
Table 10: Results for pre-attack, post-attack (black-boz), random attack, change between pre- and post-attack, and relative changes compared the original study, when 15% group membership labels are switched for fair clustering algorithms SFD, FSC, and KFC and datasets Inverted UCT DIGITS (DIGITS) and Extended Yale face B (Yale). Results show the impact fairness utility (Balance and Eutropy) and clustering utility (NMI and ACC). Relative changes provide insights into how our changes between pre-attack and post-attack / random attack differ from those of the paper. The N/A values in the relative changes column indicate instances where the change in the original paper was 0%, making division by impossible.
18

---

Published in Transactions on Machine Learning Research (April/2024)
G
Analyzing Overall Adversial Robustness of CFC
SALANCE
ENTROPY
24
BB0 MS aCETLL 2TD MOTLLIT
DRMIS
DICI
0.4
GMS, 7cc
Poltes
SALANCE
ENTROPY
ACC
KHI
12-
USA MEC
SARNT JISPS
111
0.5
10.00
kiC
573 MPL
68
0.22
525
020 0.2
640
0.2
110
130
0.22
E35
0.20
0.30
Time Pont
Tiis Panb
Time Part
Tims Parta
1,000
Offic 200
12-
Olfic S1 L
3.10
office 31,+e0
Offic
Office
Offic 3L ATD
Officol,
1.66
Offec the
1038
Gflce-31,
1.00
diiee 11
0.55
0682
0.00 0.35
BALANCE
ENTROPY
ACC
KMI
Wil PSC
1.1
350
1.05
1.00
08
0.7
8ib
PiRds
Nil
Figure 4: Pro-attack and post-attack (black-boz) ratio trends for FSC, SFD, KFC, and CFC on fairness utility (Balance and Entropy) and clustering utility (ACC and NMI) for MNIST-USPS and Office-31 (we do not plot curves for which pre-attack values are 0) (x-axis: % of samples attacker can poison).
19

---

Published in Transactions on Machine Learning Research (April/2024)
H
Extra Metrics for DIGITS and Yale Datasets
Vala
Algarichma
Matrica
Clunter Ralio
0:001
0.000
0.000
0.001
0.000
0.000
0.009
0.014
0.015
3PD
Silhouette
Enteopy
-0.060 0.000
0.000
1.739
0.509
1.525
0.995
000002 0.005
0.100
-0.008 0.004
0.150
1.752 0.106
-0.008 0.005
Entropy Group
1.983 0.002
0.435
0.586
0.652
0.996
3.505
0.036
3.491 0.0016
3.500 0.014
ATl
0.157 2 0.000
0.084
0.001
0.084
0.000
0.007 0.001
008 0.006
008 0.006
Sihoouste Hcuce
-0.072 + 0,000
0.322
0.003
0.321
0.001
0.065 0.004
060 0.0004
06061 0.006
Min. Cluster Faatio
0.003 0,000
0.000
0,000
0.000 0,000
0.000 0.003
0.000 0.0000
0.000 0,000
Claster L1
0.404 + 0,000
0.404
0,000
0.419 0.044
0.760 0.025
0.744 0.052
0.762 0.015 se nae"
Claster KL
do nan
20 + nan
Do + non
se nax:
xe nuz"
FSC
Silloncite dil
Entropy Group A
1.028 2 0.006
0.017 + 0,000
1.024 = 0.009
0,017 = 0.000
1.033 = 0.017
0.018 + 0 0.006
2.500 968 0.021
0.004 0.004
0. 008 + 0.005
2.918 2 0.087
2.884 4 2.0.0000 0.038
002 0,005
Eatropy Group B
1:261 2 0.000
1.261 0.000
1.322 = 0.124
2.280 0.024
257 2 2. 0.032
2.272 0.035
ARE
0.156 2 0.000
0.156
0.000
0.158 0.008
0.003 0.00
058 1. 0.007
062 0.002
Sithouette noure
-0.139 2 0.000
-0.140 0.000
-0.138 2: 0.033
-0 000 2 0.012
-O 020 0.017
-O 006 + 0.003
Min Cluster Ratio
0.853 0.325
0.429 0.137
0.434 0.246
0.040 0.320
0.0 0.276
0. 0.276
Cluster
0.094 0.011
0.011 0.120
0.117
0:011
0.001 0.001
001 0.002
0.001 + 0.002
Cluster
0.022 0.005
no nan
man
Silbouette
-0.014 0.021
-0.034 0.052
-0.026 + 0.051
NJA"
N/A*
Entropy Group
1.82
0.015
0.015 0.029
0.014 0.030
Entropy Group
0.108
0.173
0.029
0.091
0.028
Table 11: Results for pre-attack, post-attack (black- box) and random attack, when 15% group membership labels are switched for fair clustering algorithms SFD, FSC, and KFC and datasets Inverted UCI DIGITS (DIGITS) and Extended Yale face B (Yale). Results show the impact on additional metrics, where N/A corresponds to uniform clustering, co to infinite values, and nan to undefined values.
Additional Attack Methods Results
Metric
Attack Balance
Attack Min. Cluster Ratio
Combined Attack
Balance
0.149 + 0.004
0.149 = 0.004
0.144 0.011
Entropy
9.764 + 0.037
9.764 + 0.037
9.715 + 0.089
NMI
0.857 = 0.009
0.857 + 0.009
0.857 = 0.002
ACC
0.757 = 0.026
0.757 = 0.026
0.753 = 0.016
Min. Cluster Ratio
0.061, =0.002
00061, #0.002
0.059 = 0.005
Cluster L1
0.178 = 0.007
0.178 = 0.007
0.183 = 0.002
Cluster KL
0.099 0.009
0.099 + 0.009
0.104 + 0.006
Silhouette diff
-0.009 0.001
-0.008 0.002
-0.005 0.002
Entropy Group A
3.291 0.016
3.291 = 0.016
3.287 - 0.035
Entropy Group B
3.357 = 0.010
3.357 = 0.010
3.360 = 0.009
ART Silhouette Score
0.677 + 0.021
0.677 + 0.021
0.681 + 0.010
0.153 + 0.006
0.153 + 0.006
0.157 + 0.003
Table 12: Results of Additional Attack Methods: This table compares the performance of the original balance
attack against the newly introduced Minimum Cluster Ratio attack and the Combined (Balance & Entropy) attack. For consistent comparison, the results presented are based on the same three seeds that were utilized during the grid scarch. The most effective attack strategy for each metric, as indicated by the lowest value, is emphasized bold.
20

---

Published in Transactions on Machine Learning Research (April/2024)
J Defense Results on Additional Attack Methods
Attack Type
Metric
MNINT-ESPS
Ofive-31
KL
Minianum Cluster Ratio
Fatropy Group
did
2.052
3.022
2.787
2,700
Entropy Group
1.849
1.899
2.775
2.768
ARI
0-136
D-393
0.438
0.415
Silkouetie soure
0.001
0.016
0.077
0.072
Min. Cluster Hario
0.405
0.50t
0,365
0.324
Cluster Li
0.214
0.256
0.165
0,180
Cluater KL
oc
de"
0,092
Comblaed
Silhonatte diff
-0.029
-0.015
-0.01 00.012
-0-017
Encropy Group
2.019
2:127
2.845
2.812
Ensropy Group
1.877
1 1.087
2:910
2. 2.870
ARI
0-150
0.204
0.399
0.444
Silhonatte score
0.002
0.014
0.053
0.091
Table 13: Results for pre-attack and post-attack when 15% group membership labels are switched for defense
algorithm CFC and datasets MNIST-USPS and Office-31. Results show the impact on additional metries, where corresponds infinite values. Experiments the small standard deviations in other related experiments.
once because of the consumed GPU hours and
21


Reviews:
[{"review_id": "VA3p8BDu8A", "reviewer": "Reviewer_oUwk", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\nThe study successfully reproduces the key findings of the original paper and extends the analysis with additional datasets, metrics, and attack methods, contributing to a deeper understanding of the robustness of fair clustering algorithms.\n\nThe introduction and evaluation of new attack strategies against fair clustering algorithms offer insights into potential vulnerabilities and the effectiveness of current defense mechanisms.\n\nWeaknesses:\nI am primarily concerned about whether a study focused mostly on replicating the findings of a single paper would attract enough interest from the research community. This paper does not offer an extensive survey of the literature on fair clustering or fairness attacks. Although it brings in new datasets and metrics, the assessment largely relies on the baselines established by the reviewed paper. As a result, the study does not provide readers with a comprehensive overview of the current state of research in fairness attacks and robust fair machine learning.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper conducts a reproducibility study on \"Robust Fair Clustering: A Novel Fairness Attack and Defense Framework,\" focusing on the robustness of fair clustering algorithms against adversarial attacks. It examines the vulnerability of three fair clustering models (Fair K-Center, Fair Spectral Clustering, and Scalable Fairlet Decomposition) to such attacks, confirming their susceptibility. Additionally, the study evaluates the resilience of the Consensus Fair Clustering (CFC) model against these fairness attacks. Beyond replicating the original study's findings, the paper extends the work by enhancing the experimentation codebase, integrating additional metrics and datasets for a deeper analysis, implementing new attack methods, and conducting an ablation study on hyperparameters within the CFC model. The authors partially confirm the original study's claim that adversarial attacks can degrade fairness performance by altering protected group memberships, fully reproduce the claim regarding the existing models' lack of robustness, and affirm CFC's high resilience to fairness attacks.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The partial reproduction of the first claim requires further clarification. Specifically, a detailed analysis explaining the possible reasons behind the partial reproduction and how it might affect the overall conclusions of the study would be critical.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "Vyh23hgY2L", "reviewer": "Reviewer_dHNL", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Overall, the paper is relatively easy to follow. The paper revisits the major claims in Chhabra et al. (2023) and (mostly) validates them with reproducibility studies. The extended experiments are clearly documented and presented, and the overall evaluation of the CFC model appears to be more comprehensive than that when CFC was proposed in Chhabra et al. (2023).\n\nThe paper can be further improved by clearly stating why certain additional metrics and attack methods are considered (i.e., why these choices) and providing more mathematical details in Section 3.2 if space permits (i.e., how things work, going beyond narrative descriptions). This way, the importance of additional experiments considered in this reproducibility study can be better positioned and appreciated.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper revisits the work \"Robust fair clustering: A novel fairness attack and defense framework\" by Chhabra et al. (2023). Specifically, focusing on the evaluation of the proposed Consensus Fair Clustering (CFC) model, the paper conducts a reproducibility study on Chhabra et al. (2023), cleans up the original code repository, considers additional metrics (for clustering), data sets, and attack methods, and also conducts an ablation study. The original three claims in Chhabra et al. (2023) are mostly reproduced/validated, and the overall evaluation of CFC model in this work is more comprehensive than that in the original paper.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Minor adjustment:\n\n- provide some technical detail about the additional methods considered in Section 3.2 (for the purpose of clearly presenting the importance of considering these approaches, e.g., how they relate to the CFC model and the claims by Chhabra et al., 2023)", "broader_impact_concerns": "I do not foresee potential ethical concerns of this reproducibility study.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "EcSfiCh4IS", "reviewer": "Reviewer_XiUa", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n1. The reproducibility verifies the contributions of fairness attack and consensus fair clustering in the original paper.\n2. The extended work is a plus to make the original method more stronger.\n3. In general, this paper is in good shape, which is clear and easy to follow. I do not have major concerns.\n\nWeaknesses\n1. For the extended work, it would be better to provide their motivations.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper is a reproducibility study of \"robust fair clustering,\" where the authors summarized five contribution points including one reproducibility and four extended works. I agree with them and do not repeat again.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The current version suffers from some format issues.\n1. Some citation formats are incorrect. I suggest the authors to figure out the differences among \\cite, \\citet, and \\citep. For example, Line 2 in the introduction should be \"(Rodrigues et.al, 2019; Xu & Wunsch, 2005).\"\n2. For the footnote, it should come after the period without a space.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper presents a reproducibility study of "Robust Fair Clustering: A Novel Fairness Attack and Defense Framework" and extends the analysis to provide additional insights into the robustness of fair clustering algorithms. Specifically, the authors partially confirm the original study's claim that adversarial attacks can degrade fairness performance by altering protected group memberships, fully reproduce the claim regarding the existing models' lack of robustness, and affirm the high resilience of the Consensus Fair Clustering (CFC) model to fairness attacks. Additionally, this paper extends the work by enhancing the experimentation codebase, integrating additional metrics and datasets, implementing new attack methods, and conducting an ablation study on hyperparameters within the CFC model.

During the rebuttal phase, the authors addressed concerns including the depth of analysis by Reviewer oUwk; additional motivation and technical details about the methods used by Reviewer dHNL and Reviewer XiUa; footnote and citation format by Reviewer XiUa.

After the rebuttal, all reviewers acknowledged that there were no further concerns and expressed their willingness to accept this paper. Therefore, we recommend acceptance.
Decision: Accept (poster)