Title: FATE: Fairness Attacks on Graph Learning
Venue: NeurIPS 2023
Accepted: no
Keywords: graph learning

fairness

adversarial attacks
Abstract: We study fairness attacks on graph learning to answer the following question: How can we achieve poisoning attacks on a graph learning model to exacerbate the bias? We answer this question via a bi-level optimization problem and propose a meta learning-based attacking framework named FATE. The proposed framework is broadly applicable with respect to various fairness definitions and graph learning models, as well as arbitrary choices of manipulation operations. We further instantiate FATE to attack statistical parity and individual fairness on graph neural networks. We conduct extensive experimental evaluations on real-world datasets in the task of semi-supervised node classification. The experimental results demonstrate that FATE could amplify the bias of graph neural networks with or without fairness consideration while maintaining the utility on the downstream task. We hope this paper provides insights into the adversarial robustness of fair graph learning and can shed light on designing robust and fair graph learning in future studies.

same

different

majority class

minority class

unprotected group

protected group

Pokec-n

Pokec-z

Bail

Pokec-n

Pokec-z

Bail

8'0

0.8

0.8

1.0

1.0

1.0

Ratio

0.6

Ratio

0.6

Ratio

0.6

Ratic

0

0.6

0.8

Ratio

0.8

0.6

0

0.8

0.6

0.4

0.4

0.4

0.4

0.4

R

0.4

0.2

0.2

0.2

0.2

0.2

0.2

0.0

label

sen.attr.

0.0

label

sen.attr.

0.0

label

sen.attr.

0.0

SL

SSA

0.0

SL

SSA

0.0

SL

SSA

(a)

(b)

same

different

majority class

minority class

1.0

1.0

Ratio

0.8

Ratio

0.8

0.6

0.6

0.4

0.4

0.2

0.2

0.0

Pokec-n

Pokec-z

Bail

0.0

Bail

Pokec-z

Pokec-n

(a)

(b)

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes to attack different fairness definitions for a variety of graph learning models. The task is formulated as a bi-level optimization problem, which is solved in a meta learning manner. The major advantages of the proposed framework include 1) it is feasible to any fairness notion and graph learning model, 2) it can support continuous and discrete perturbation on the graph topology. Experiments demonstrate the attack efficacy and classification utility of the proposed method.\n\nSTRENGTHS:\n1. The proposed framework provides a good coverage for multiple types of (differentiable) fairness notions (e.g., statistical parity, individual fairness), and graph learning models (e.g., non-parametric, parametric);\n2. Extensive experiments are conducted, considering possible fairness defenses (FairGNN and InFoRM-GNN) and transferability.\n\nWEAKNESSES:\n1. The clarity and rationale of methodology can be improved: there are inconsistent definitions (of the budget constraint), and the realization of budget constraint in the optimization procedure is not validated. See detailed questions;\n2. The IID assumption for kernel density estimation may not hold in graph data;\n3. Important baseline should be compared (a modified version of DICE based on the sensitive group); and more related works should be discussed.\n\nQUESTIONS:\nI appreciate the breath of this work which makes it of good potential. However, the authors are encouraged to address the following questions to improve the technical depth of this work.\n\n**Methodology**\n\n1. The realization of the budget constraint needs more justification. In line 180 for continuous cases, only limiting the learning rate cannot guarantee the final perturbation is under budget B (after several steps of gradient descent). The authors should either provide citation/reason to justify the validity of this design, or refer to the better justified technique – projected gradient descent. In Line 181-188 for discrete case, the approximation is also questionable: other two cases are directly discarded (i.e., $\\Delta_A b[i, j]>0, (1-2A)[i,j]=-1$, and $\\Delta_A b[i, j]<0, (1-2A)[i,j]=1$), which could result in large rounding error. The authors are recommended to check and discuss recent discrete attack techniques for graphs [1].\n\n2. The kernel density estimation in Eq. (9) assumes that samples are IID, which however does not hold for graph data, as nodes are connected and non-IID. Can the authors provide further justification?\n\n**Experiment**\n\n3. One important baseline should be considered and compared: modifying DICE to consider communities based on nodes’ sensitive groups rather than their classification labels, so this heuristic baseline will add edges between nodes which belong to the same sensitive group and/or remove edges between nodes which are in different sensitive groups.\n\n**Related work**\n\n4. This work provides additional experiments on possible fairness defenses (i.e., FairGNN and InFoRM-GNN), which is highly appreciated. Beyond such works that are specified to a certain fairness definition, the authors are encouraged to discuss and/or test on the recent debiasing work [2], which does not rely on specific fairness definitions.\n\n**Minors**\n\n5. The definition of perturbation budget is not consistent in Line 98 and Line 121. Meanwhile, the “norm” in Line 98 is not in a typical math form: what is $\\|A, \\tilde{A}\\|_{1, 1}$? \n\n6. The budget defined in Line 121, $\\|A- \\tilde{A}\\|_{1, 1}$, is mathematically the maximum absolute column sum of the matrix difference, which seems to be inconsistent with the attacker’s capability to “perturb up to B edges in the graph”. Meanwhile, based on Eq. (8) which limits the number of total edge changes, the budget definition should be corrected as zero norm, right?\n\n7. The bias function $b()$ is not consistent in Line 94 and Line 99. The hyperparameter $\\theta$ should not be an input to the function, right?\n\n8. In Table 2, $\\Delta_{SP}$ -> InFoRM bias.\n\n**References**\n\n[1] Lin, Lu, et al. \"Graph structural attack by perturbing spectral distance.\" Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2022.\n\n[2] Wang, Nan, et al. \"Unbiased graph embedding with biased graph observations.\" Proceedings of the ACM Web Conference 2022. 2022.\n\nLIMITATIONS:\nThe authors provide reasonable discussion about the limitations of this work (i.e., other fairness notions, space efficiency).", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose an attacking framework called FATE. Existing research in algorithmic fairness aims to prevent bias amplification but neglects fairness attacks. This paper fills this gap by formulating the fairness attack problem as a bi-level optimization and introducing a meta-learning-based attack framework. The authors present two instantiated examples, demonstrating the expressive power of the framework in terms of statistical parity and individual fairness, and validate the model's capability of attacking fairness through experimental verification. The paper contributes by providing insights into adversarial robustness and the design of robust and fair graph learning models.\n\nSTRENGTHS:\n1. This paper is well-structured and easy to follow.\n2. The originality of the article deserves emphasis as it formulates the fairness attack on graph data as a bi-level optimization problem. This novel approach contributes to understanding the resilience of graph learning models to adversarial attacks on fairness.\n3. The experimental results show that the proposed method is capable of attacking fairness without decreasing too much on accuracy.\n\nWEAKNESSES:\nThe motivation provided is somehow insufficient in persuading me. The authors state that “an institution that applies the graph learning models are often utility-maximizing” (line 82), which I totally agree with, but then concludes that “minimizing the task-specific loss function … for deceptive fairness attacks” (line 88). While I do agree that pursuing utility will lead to a preference for models with superior performance, and if the objective of the attack is to deceive victims into selecting an unfair learning model, then it does make sense to enhance the utility of the malicious model. But it’s not the case in this article, where the attack’s aim is to poison the graph data. Unlike models, we don't have much discretion when it comes to the data, and it is exceedingly challenging for me to envision a real-life scenario wherein an institution would discard the data due to unsatisfactory performance, as a more practical solution is data cleansing or a more capable model. Consequently, my concern is that, is it truly necessary to maintain the utility for “deception”, leaving aside that I’m not convinced that preserving the utility is necessary for successful deception. Please provide a more detailed explanation.\n \nThe experimental findings reveal the limitations of the attack's effectiveness. Although I agree that FATE is capable of attacking fairness and is relatively more stable, in 2 out of 3 datasets, FATE exhibits incompetence in reducing statistical parity compared to FA-GNN. Although the authors argue that the victim model achieved the best performance under the attack FATE, I’m skeptical about the cost-effectiveness of this trade-off.\n\nQUESTIONS:\nPlease refer to the weakness.\nFound typo: in line 62, A[j,:] should be A[,:j]?\n\nLIMITATIONS:\nYes, the authors have addressed the limitations and potential negative societal impact of their work.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a novel framework named Fate, which is capable of attacking any fairness definition on any graph learning model, as long as the corresponding bias function and the task-specific loss function are differentiable. Fate is equipped with the ability for either continuous or discretized poisoning attacks on the graph topology.studies. The paper provides insights into the adversarial robustness of fair graph learning and sheds light on designing robust and fair graph learning in future studies. The empirical evaluation on three benchmark datasets shows that Fate consistently succeeds in fairness attacks while being the most deceptive (achieving the highest micro Fl score) on semi-supervised node classification.\n\nSTRENGTHS:\n(1) This paper addresses an important problem in graph learning — fairness attacks. While previous work in the field focused on ensuring that bias in not perpetuated or amplified during the learning process, the proposed framework, FATE, allows for the study of adversarial attacks on fairness.\n\n(2) FATE, a meta-learning based framework, is versatile and can be used to attack different fairness definitions and graph learning models.\n\n(3)The experimental evaluation shows that the proposed framework can successfully attack statistical parity and individual fairness on real-world datasets with the ability for poisoning attacks on both graph topology and node features while maintaining the utility on the downstream task.\n\n(4) This article is well-written and well-organized. It starts with an introduction that highlights the importance of fair graph learning and the need for resilience against adversarial attacks. Then it provides some background information and defines the problem of fairness attacks in graph learning. The paper then proposes the Fate framework as a solution to this problem, providing a detailed explanation of its design and mechanism. It also presents experimental results to evaluate the efficacy of Fate. Finally, the paper concludes with a summary of its contributions and future research directions. Overall, the writing logic is clear and easy to follow.\n\n(5) The paper provides detailed information on how they implemented the proposed framework, including the optimization process, the selection of the bias function and the task-specific loss function, and the hyperparameter tuning process. Additionally, they provide a detailed description of their experimental setup, including the datasets used, the graph learning models, the evaluation metrics, and the implementation details of the Fate framework and other baselines. The authors also provide a thorough evaluation of the proposed framework through extensive experiments and analysis.\n\nWEAKNESSES:\n(1) One weakness of this paper could be the limited evaluation of the framework on only three benchmark datasets and one task (semi-supervised node classification).\n Further evaluations on various graph learning tasks and datasets could provide more insights into the effectiveness and generalizability of the proposed framework.\n\n(2) The proposed Fate framework may not be effective in attacking other fairness definitions beyond statistical parity and individual fairness, and it may not work well on graph learning models with very large graphs. \n\n(3) The paper assumes that the attacker has access to sensitive attributes of all nodes, which may not always be feasible in real-world scenarios.\n\nQUESTIONS:\n(1) Have you considered the potential ethical concerns of using the proposed framework to amplify the bias in graph learning models?\n\n(2) Could you conduct more ablation studies to further prove the effectiveness of the proposed framework compared to other methods?\n\nLIMITATIONS:\nsee comments above", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-06"}

comments: SUMMARY:
This paper presents a novel approach for introducing fairness attacks in graph learning, which is impressive. To address this issue, the article proposes an attack framework for graphs and conducts experiments on the classic GCN model. Compared to two baseline methods, DICE and FA-GNN, the proposed method is more effective in attacking graph neural networks.

The strengths of the paper include:

1. The research problem is novel and interesting. There is little prior work on attacking graph models, and this article is the first to define this type of problem.
2. The paper provides code for the proposed method, which makes it more reproducible.

The weaknesses of the paper includes:

1. Some of the content organization is not optimal, such as placing the descriptions of the baseline methods in the appendix. Including them in the main text would have made it more convenient for readers.
2. The article does not mention the limitations of the work. More discussions are required.

STRENGTHS:
1. The research problem is novel and interesting. There is little prior work on attacking graph models, and this article is the first to define this type of problem.
2. The paper provides code for the proposed method, which makes it more reproducible.

WEAKNESSES:
1. Some of the content organization is not optimal, such as placing the descriptions of the baseline methods in the appendix. Including them in the main text would have made it more convenient for readers.
2. The article does not mention the limitations of the work. More discussions are required.

QUESTIONS:
How is the efficiency of the method when the graph is growing large, say, with millions of nodes?

LIMITATIONS:
The article does not mention the limitations of the work. More discussions are required.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-06

comments: SUMMARY:
This paper studies an interesting problem, attacking fairness on GNN. Specifically, the authors aim to amplify the unfairness while maintaining the performance of the downstream tasks. They propose a bi-level optimization scheme with a meta-gradient poisoning attack to achieve this goal. Experiments on both statistic fairness and individual fairness show the effectiveness of the proposed method. Overall, good problem and a solid framework.

STRENGTHS:
1.	Fairness attack on graph learning is an interesting problem, this paper gives an intuitive problem definition, which can extend to other bi-level optimization goal attacking scenarios.
2.	Given the bi-level optimization goal, the authors design a meta-gradient graph poisoning attack and corresponding Low-level and High-level loss functions.
3.	Experiments on statistical fairness and individual fairness demonstrate the effectiveness of the proposed method.

WEAKNESSES:
1. It will be more interesting if the authors provide more experiments on group fairness and Rawls fairness. How to attack some specific groups, such as best/worst accuracy group fairness.

QUESTIONS:
It will be more interesting if the authors provide more experiments on group fairness and Rawls fairness. How to attack some specific groups, such as best/worst accuracy group fairness.

LIMITATIONS:
None
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-24