Paper: Deceptive Fairness Attacks on Graphs via Meta Learning (ICLR-2024)

Reviewer comment (Writing):
The paper sometimes lacks clarity, with some definitions not given (e.g., Y never defined in sec 2) or only in the appendix. In fact, I had to go many times into the appendix to understand the core concepts of the approach, which is not very comfortable for the reader.

Author response:
**Q1. Lack of clarity, including definition of $\mathbf{Y}$, separating victim and surrogate model, reference to Ptb. and bias measures, and experimental questions.**

Thank you for your suggestion in further improving the clarity. 

- Definition of $\mathbf{Y}$: In the last paragraph of Section 2, we have defined $\mathbf{Y}$ as the output of graph learning model, which is highlighted in blue.

- Separating victim and surrogate model: We would like to clarify that the attacker only have access to the surrogate model, i.e., solving Eq. (1) is solely based on the surrogate model. The victim model is only used when evaluate the performance of FATE in Section 6. Thus, we believe it it not necessary to differentiate the notations for victim model and the surrogate model in Sections 3 -- 5.

- Reference to Ptb. and bias measure: We have revised the table caption to reflect the meaning of Ptb. and $\Delta_{\text{SP}}$ in the revised version, highlighted in blue. For Table 1, the new caption is "Attacking statistical parity on GCN under different perturbation rates (Ptb.). FATE poisons the graph via both edge flipping (FATE-flip) and edge addition (FATE-add) while all other baselines poison the graph via edge addition. Higher is better ($\uparrow$) for micro F1 score (Micro F1) and $\Delta_{\text{SP}}$ (bias). Bold font indicates the most deceptive fairness attack, i.e., increasing $\Delta_{\text{SP}}$ and highest micro F1. Underlined cell indicates the failure of fairness attack, i.e., decreasing $\Delta_{\text{SP}}$ after fairness attack." Similar changes have also been made to Tables 2 and 5 -- 11.

- Add experimental questions: Given the space limitation, we have added the philosophical experimental questions at the beginning of Appendix D, which are (1) How effective is FATE in exacerbating bias under different perturbation rates? (2) How effective is FATE in maintaining node classification accuracy for deceptiveness under different perturbation rates? And (3) can we characterize the properties of edges perturbed by FATE?

Reviewer comment (Writing):
The formalization of the problem/method should include some separated notation for the victim and the surrogate model, because the current notation was a bit confusing. Maybe the intended goal is to be applicable to any victim model from a given distribution of victims? Setting the problem like this would make it easier to understand.

Author response:
We appreciate the reviewer for your suggestion in improving our paper's clarity. Based on your suggestion, we have separated the notation of victim model and surrogate model. Regarding the problem definition in Section 2, our global objective is to exacerbate the bias and maintain the performance of the victim model. Thus, we represent the model parameters and hyperparameters as $\Theta_{\text{vic}}$ and $\theta_{\text{vic}}$. Starting from Section 3, since the attacker only has access to the surrogate model, the attacker's goal becomes to exacerbate the bias and maintain the performance of the surrogate model, whose model parameters and hyperparameters are denoted as $\Theta_{\text{sur}}$ and $\theta_{\text{sur}}$. These changes has been updated in the updated version on OpenReview. We would highly appreciate it, if the reviewer could let us whether any further changes or clarifications are needed. 

Besides, we would like to point out that most of our responses to your concerns have been updated in the updated version on OpenReview (highlighted in blue). For example, our response to your Q1 (except for experimental questions) and Q3 has been updated in the main body of updated version (highlighted in blue), and our response to Q4 is presented in Appendix H.D of the original manuscript. Additionally, our responses to your suggestion about experimental questions and Q2 have been updated at the beginning of Appendix D and in Appendix H.G (due to the page limitation). 

Again, we sincerely appreciate the reviewer for your suggestion on better clarity. We will keep polishing the paper in the remaining days. If there is any specific contents that the reviewer would like us to move to the main body, we will try our best to move them to the main body for better clarity. Should you have any remaining concerns, we are more than happy to discuss with you.

Reviewer comment (Writing):
Results are very hard to follow as some notation is not specified at all (e.g., Ptb which is the perturbation budget but must be inferred), and important details such as the evaluation metrics are only given in the appendix. While the lack of space is understandable, giving at least some description in the main text (e.g., simply stating delta sp is the bias) and referring to the corresponding appendix section would be helpful.

Author response:
**Q1. Lack of clarity, including definition of $\mathbf{Y}$, separating victim and surrogate model, reference to Ptb. and bias measures, and experimental questions.**

Thank you for your suggestion in further improving the clarity. 

- Definition of $\mathbf{Y}$: In the last paragraph of Section 2, we have defined $\mathbf{Y}$ as the output of graph learning model, which is highlighted in blue.

- Separating victim and surrogate model: We would like to clarify that the attacker only have access to the surrogate model, i.e., solving Eq. (1) is solely based on the surrogate model. The victim model is only used when evaluate the performance of FATE in Section 6. Thus, we believe it it not necessary to differentiate the notations for victim model and the surrogate model in Sections 3 -- 5.

- Reference to Ptb. and bias measure: We have revised the table caption to reflect the meaning of Ptb. and $\Delta_{\text{SP}}$ in the revised version, highlighted in blue. For Table 1, the new caption is "Attacking statistical parity on GCN under different perturbation rates (Ptb.). FATE poisons the graph via both edge flipping (FATE-flip) and edge addition (FATE-add) while all other baselines poison the graph via edge addition. Higher is better ($\uparrow$) for micro F1 score (Micro F1) and $\Delta_{\text{SP}}$ (bias). Bold font indicates the most deceptive fairness attack, i.e., increasing $\Delta_{\text{SP}}$ and highest micro F1. Underlined cell indicates the failure of fairness attack, i.e., decreasing $\Delta_{\text{SP}}$ after fairness attack." Similar changes have also been made to Tables 2 and 5 -- 11.

- Add experimental questions: Given the space limitation, we have added the philosophical experimental questions at the beginning of Appendix D, which are (1) How effective is FATE in exacerbating bias under different perturbation rates? (2) How effective is FATE in maintaining node classification accuracy for deceptiveness under different perturbation rates? And (3) can we characterize the properties of edges perturbed by FATE?

Reviewer comment (Presentation):
The experimental questions being investigated in each section of the experimental part should be better specified, as the reader can get lost on a first read.

Author response:
**Q1. Lack of clarity, including definition of $\mathbf{Y}$, separating victim and surrogate model, reference to Ptb. and bias measures, and experimental questions.**

Thank you for your suggestion in further improving the clarity. 

- Definition of $\mathbf{Y}$: In the last paragraph of Section 2, we have defined $\mathbf{Y}$ as the output of graph learning model, which is highlighted in blue.

- Separating victim and surrogate model: We would like to clarify that the attacker only have access to the surrogate model, i.e., solving Eq. (1) is solely based on the surrogate model. The victim model is only used when evaluate the performance of FATE in Section 6. Thus, we believe it it not necessary to differentiate the notations for victim model and the surrogate model in Sections 3 -- 5.

- Reference to Ptb. and bias measure: We have revised the table caption to reflect the meaning of Ptb. and $\Delta_{\text{SP}}$ in the revised version, highlighted in blue. For Table 1, the new caption is "Attacking statistical parity on GCN under different perturbation rates (Ptb.). FATE poisons the graph via both edge flipping (FATE-flip) and edge addition (FATE-add) while all other baselines poison the graph via edge addition. Higher is better ($\uparrow$) for micro F1 score (Micro F1) and $\Delta_{\text{SP}}$ (bias). Bold font indicates the most deceptive fairness attack, i.e., increasing $\Delta_{\text{SP}}$ and highest micro F1. Underlined cell indicates the failure of fairness attack, i.e., decreasing $\Delta_{\text{SP}}$ after fairness attack." Similar changes have also been made to Tables 2 and 5 -- 11.

- Add experimental questions: Given the space limitation, we have added the philosophical experimental questions at the beginning of Appendix D, which are (1) How effective is FATE in exacerbating bias under different perturbation rates? (2) How effective is FATE in maintaining node classification accuracy for deceptiveness under different perturbation rates? And (3) can we characterize the properties of edges perturbed by FATE?

Reviewer comment (Evaluation):
I wish the paper could have inspected some possible ways to prevent such attacks. The approach announces that the goal is to better understand. Ok, but what can we do, that would be positive, from the outcomes of the model? Would it be possible to give some insights for good ways to defend from such attacks?

Author response:
**Q2. Possible defense strategy.**

Thank you for your suggestion in discussing how to defend against fairness attacks. Following our analysis on the manipulated edges in Sections 6.1 and 6.2, we believe possible defense strategies could be as follows. To defend against deceptive fairness attacks for statistical parity, one possible strategy is to preprocess the input graph by either learning a bias-free graph (e.g., [1]) or sampling over the neighborhood (e.g., [2, 3, 4]) to control which node representations to aggregate during message passing. The reason for such possible design is that Figure 1 reveals the properties of injected edges that are likely to be incident to nodes in the minority class and/or protected group. Following similar principles, it is also possible to develop a selective or probabilistic message passing strategy to achieve the same goal during model optimization. To defend against deceptive fairness attacks for individual fairness, we can apply similar neighborhood sampling strategy or selective/probabilistic message passing strategy. Instead, for individual fairness, the neighborhood sampling or selective message passing would consider the class label rather than the sensitive attribute (i.e., sample edges that connect nodes in the minority class as shown in Figure 2). Please note that the aforementioned discussion has been added in our revised version (Appendix H.G).

Reviewer comment (Evaluation):
The considered bias is not fully defined in sec 4, for instance for the instantiation 1: you give the way you estimate both pdf but finally what is the score considered — an MSE, a KL, or what? Also, would it be possible to consider a targeted attack that would favor a specific population?

Author response:
**Q3. Bias measure in Section 4.**

Thank you for your suggestion in further improving the clarity. We have added the definition of bias function (i.e., $b\left(\mathbf{Y}, \Theta^*, \mathbf{S}\right) = |\operatorname{P}\left[{\tilde y} = 1\right] = \operatorname{P}\left[{\tilde y} = 1|s = 1\right]|$) in Section 4-C, which is highlighted in blue. 

**Q4. Attacking specific subpopulation.**

Thank you for your suggestion for attacking specific subpopulation. In fact, we have discussed this situation in Appendix H.D (The potential of FATE on attacking a specific demographic group in group fairness) in the original manuscript. More specifically, to attack a specific group, there can be two possible strategies: (1) decreasing the acceptance rate of the corresponding group and (2) increasing the gap between the group to be attacked and another demographic group. For (1), following our strategy of modeling acceptance rate as the CDF of Gaussian KDE, we can set the bias function to be maximize as the negative of acceptance rate, i.e., $b\left(\mathbf{Y}, \Theta^*, \mathbf{F}\right) = - P\left[\widehat{y} = 1 \mid s = a\right]$, where $a$ is the sensitive attribute value denoting the demographic group to be attacked. For (2), suppose we want to attack the group with sensitive attribute value. We can also attack this demographic group by setting the bias function to be $b\left(\mathbf{Y}, \Theta^*, \mathbf{F}\right) = P\left[\widehat{y} = 1 \mid s = 1\right] - P\left[\widehat{y} = 1 \mid s = 0\right]$. In this way, we can increase the acceptance rate of demographic group ($s = 1$) while minimizing the acceptance rate of the group ($s = 0$).

Reviewer comment (Theory):
Would it be possible to specify more deeply $\nabla_{\cal G} \Theta^{(T)}$? Is it equal to $ \epsilon \nabla_{\cal G} \nabla_\Theta l({\cal G}, Y,\Theta,\theta)|_{\Theta^{(T-1)}}$, with $\epsilon$ the step size of update of the surrogate?

Author response:
**Q5. Clarification on $\nabla_{\mathcal{G}} \Theta^{(T)}$.**

Thank you for your question. We would like to clarify that $\nabla\_{\mathcal{G}} \Theta^{(T)}$ is not the same as $\epsilon \nabla\_{\mathcal{G}} \nabla\_{\Theta} l(\mathcal{G}, \mathbf{Y}, \Theta, \theta)|\_{\Theta^{(T-1)}}$. It should be the partial derivative of model parameters at time step $T$ with respect to the input graph, which is derived from the chain rule. The detailed steps are as follows. Our goal is to take the derivative of the bias function $b(\mathbf{Y}, \Theta, \theta)$. Since $\Theta$ is learned by an optimizer $\Theta^{(t+1)} = \operatorname{opt}^{(t+1)}\left(\mathcal{G}, \Theta^{(t)}, \theta, \mathbf{Y}\right),~\forall t\in\{1, \ldots, T\}$, $\Theta$ can be regarded as a function over the input graph $\mathcal{G}$. Thus, when taking the derivative of the bias function with respect to $\mathcal{G}$, we apply the chain rule by calculating the partial derivative of bias function with respect to the model parameter $\Theta$ and then calculating the partial derivative of $\Theta$ with respect to $\mathcal{G}$. This gives us $$\nabla_{\mathcal{G}} b = \nabla_{\mathcal{G}} b\left(\mathbf{Y}, \Theta^{(T)}, \mathbf{F}\right) + \sum_{t=0}^{T-2} \nabla_{\mathcal{G}}\Theta^{(t+1)} \nabla_{\Theta^{(t+1)}}\Theta^{(t+2)} \dots \nabla_{\Theta^{(T-1)}}\Theta^{(T)}\nabla_{\theta^{(T)}} b\left(\mathbf{Y}, \Theta^{(T)}, \mathbf{F}\right)$$ We then apply first-order approximation which has been used in MAML and Metattack and simplifies the equation above to $\nabla_{\mathcal{G}} b \approx \nabla_{\Theta^{(T)}} b\left(\mathbf{Y}, \Theta^{(T)}, \mathbf{F}\right) \cdot \nabla_{\mathcal{G}} \Theta^{(T)}$.

Reviewer comment (Writing):
There are difficulties in understanding the recursive definition of (3) and its connection with (2). This needs clarification.

Author response:
**Q6. Connection between Eq. (2) and Eq. (3).**

Thank you for your question. Eq. (2) calculates the **partial derivative** of the bias function, while Eq. (3) calculates the **derivative** of the bias function with respect to the adjancency matrix. The reason we need Eq. (3) is that the input graph is undirected causing the adjacency matrix to be symmetric. If Eq. (3) is not applied for symmetric adjacency matrix, the partial derivative with respect to $(i, j)$-th entry in $\mathbf{A}$ could be unequal to the partial derivative $(j, i)$-th entry in $\mathbf{A}$. Then after one-step of continuous attack, the perturbed adjacency matrix will become to an asymmetric matrix, which is inconsistent with the nature of input graph being undirected.

Reviewer comment (Novelty):
Limited novelty. The limitation of existing works is weak (section 2-c). For limitation 1, this paper still only attacks one fairness concept when generating the adversarial graph. For limitation 2, the operation space depends on the practicality of the attack. For limitation 3, the specially designed module for maintaining performance is not presented in this paper. Authors are suggested to revise this part to highlight the contribution of this paper.

Author response:
Thank you for your questions. 
- For limitation 1, we would like to clarify that we attack **two** fairness definitions, i.e., statistical parity (Sections 4 and 6.1) and individual fairness (Sections 5 and 6.2), to generate the adversarial graphs.
- For limitation 2, we agree with the reviewer that the operation space would be affected by the practicability of the attack. However, we believe both edge injection, edge deletion, and edge flipping are almost equally practical. For example, in the given malicious banker example, edge injection refers to injecting adversarial transaction record(s) in the transaction network, edge deletion refers to removing transaction record(s), and edge flipping is the combination of two.
- For limitation 3, we implicitly assume there is a divergence in optimizing the task-specific loss function $l(\mathcal{G},\mathbf{Y},\Theta,\theta)$ and optimizing the bias function $b\left(\mathbf{Y},\Theta^*,\mathbf{F}\right)$. Thus, maximizing $b(\mathbf{Y},\Theta^*,\mathbf{F})$ may not affect $l\left(\mathcal{G},\mathbf{Y},\Theta,\theta\right)$ too much. Since we are minimizing the task-specific loss function in the inner loop (i.e., lower-level optimization), it helps to maintain the performance in the downstream task for deceptive fairness attacks. We think such assumption is reasonable for the following reason. In fair machine learning, a common strategy is to solve a regularized optimization problem, where the objective function to be minimized is often defined as $l(\mathcal{G},\mathbf{Y}, \Theta, \theta)+\alpha b(\mathbf{Y},\Theta^*,\mathbf{F})$ with $\alpha$ being the regularization hyperparameter. If there is no divergence between the optimization of $l(\mathcal{G},\mathbf{Y},\Theta,\theta)$ and $b(\mathbf{Y},\Theta^*,\mathbf{F})$, it would be sufficient to optimize one of them to obtain fair and high-utility learning results, or it would be impossible to achieve a good trade-off between fairness and utility if they are completely conflicting with each other. All in all, we believe that optimizing the task-specific loss function $l(\mathcal{G},\mathbf{Y},\Theta,\theta)$ in the lower-level optimization problem could help maintain deceptiveness both intuitively and empirically as shown in Section 6.1, Section 6.2, Appendix E, and Appendix F.

Reviewer comment (Theory):
Inaccurate/Unclear statements. For the budget limitation in the “capability of the attacker”, please be aware that the ||.||_{1,1} (according to the common definition of matrix norm) focuses on the maximum number of perturbations among nodes and cannot reflect the number of total perturbations. The definition of d(G,\tilde G) should also include the changes on X. In the 4-c, the \hat{y_(i,1)} discussing the sensitive attributes is repeated with that defining the label in 4-B.

Author response:
Thank you for your suggestions. 
- Regarding the matrix norm: we believe the review is referring to matrix-induced norm. For the induced matrix norms, $\|\mathbf{A}\|_{1,1}$ would refer to the maximum absolute column sum of the matrix difference. However, as we mentioned at the end of Section 2.C, we use the entry-wise matrix norms. It treat the elements of the matrix as one big vector (see [here](https://en.wikipedia.org/wiki/Matrix_norm#%22Entry-wise%22_matrix_norms)). Following the definition of entry-wise matrix norms, our notation means the absolute sum of each entry as shown at the end of Section 2.C.

- Regarding the definition of distance between graphs: we agree with the reviewer that the distance between two graphs might also consider the distance between feature matrices in some cases. However, we believe how to define the distance is based on the attacker's capability in attacking adjacency matrix and/or feature matrix. If the attacker would only attack the adjacency matrix, it is sufficient to define the distance between two graphs as the distance between two adjacency matrices, because the distance between two feature matrices will always be 0. If the attacker would want to attack both adjacency matrix and feature matrix, the distance between two graphs should consider both the distance between adjacency matrices and the distance between feature matrices. In fact, when we describe the distance between two graphs at the end of Section 2.C, we use e.g. (for example) to provide an example. And when we describe the distance in Section 3.1 ("The capability of attacker"), we use i.e. (in another word) to explain the distance constraints for edges/features.

- Regarding the repeated discussion about $\hat{y}$: we would like to clarify that this is not repeated definition. We acknowledge that the previous descriptions might confuse the reviewer. In the revised version, we use ${\widehat y}\_{i,j}$ to denote the prediction probability of node $i$ belonging to class $j$ and ${\tilde y}$ to denote the predicted label. Then, $P[{\tilde y} = 1]$ refers to the complementary CDF of $p({\widehat y}_{i,1} > \frac{1}{2})$ because we would classify node $i$ to class 1 if the corresponding prediction probability is larger than $\frac{1}{2}$ in a binary classification problem.

Reviewer comment (Theory):
The design for keeping the performance of GNNs is not presented in the equation (1). Authors are suggested to discuss why the proposed method can achieve the performance goal, as presented at the beginning of this paper.

Author response:
Thank you for your question. Please refer to our response to the third limitation in your Q1. More specifically, we implicitly assume there is a divergence in optimizing the task-specific loss function $l\left(\mathcal{G},\mathbf{Y}, \Theta, \theta\right)$ and optimizing the bias function $b\left(\mathbf{Y}, \Theta^*, \mathbf{F}\right)$. Thus, maximizing $b\left(\mathbf{Y}, \Theta^*, \mathbf{F}\right)$ may not affect $l\left(\mathcal{G},\mathbf{Y}, \Theta, \theta\right)$ too much. Since we are minimizing the task-specific loss function in the inner loop (i.e., lower-level optimization), it helps to maintain the performance in the downstream task for deceptive fairness attacks. We think such assumption is reasonable for the following reason. In fair machine learning, a common strategy is to solve a regularized optimization problem, where the objective function to be minimized is often defined as $l\left(\mathcal{G},\mathbf{Y}, \Theta, \theta\right) + \alpha b\left(\mathbf{Y}, \Theta^*, \mathbf{F}\right)$ with $\alpha$ being the regularization hyperparameter. If there is no divergence between the optimization of $l\left(\mathcal{G},\mathbf{Y}, \Theta, \theta\right)$ and $b\left(\mathbf{Y}, \Theta^*, \mathbf{F}\right)$, it would be sufficient to optimize one of them to obtain fair and high-utility learning results, or it would be impossible to achieve a good trade-off between fairness and utility if they are completely conflicting with each other. All in all, we believe that optimizing the task-specific loss function $l\left(\mathcal{G},\mathbf{Y}, \Theta, \theta\right)$ in the lower-level optimization problem could help maintain deceptiveness both intuitively and empirically as shown in Section 6.1, Section 6.2, Appendix E, and Appendix F.

Reviewer comment (Writing):
The operation in equation 6 should be explained with more details to show how to handle different connection statuses and gradient statuses. Moreover, the flip and add operations should also be explained to show how they happen.

Author response:
Thank you for your question. To flip the edges, we first apply Eq. (6) to select edges with highest preference scores and then flip the corresponding value in the adjacency matrix (i.e., 0 is flipped to 1, and 1 is flipped to 0). To add edges without any deletion, all negative entries in $\nabla_\mathbf{A} b$ should be zeroed out before computing the preference score in Eq. (5). Likewise, if edges are only expected to be deleted, all positive entries in $\nabla_\mathbf{A} b$ should be zeroed out before computing the preference score in Eq. (5)

The rationale of such choice is as follows. Given that $\nabla_{\mathbf{A}} = \left(\mathbf{1} - 2\mathbf{A}\right) \circ \nabla_\mathbf{A} b$, when $\Delta_{\mathbf{A}}b$ is positive, it indicates that adding an edge will help increase the bias. Since $\left(\mathbf{I}-2\mathbf{A}\right)\left[i,j\right] > 0$ corresponds to adding an edge that doesn't exist before, positive $\Delta_{\mathbf{A}}b$ and positive $\left(\mathbf{I}-2\mathbf{A}\right)\left[i,j\right] > 0$ indicates a strong preference in adding edge $\left(i,j\right)$ to increase the edge. However, if $\left(\mathbf{I}-2\mathbf{A}\right)\left[i,j\right] < 0$ in this case, it suggests remove edge $\left(i,j\right)$ instead of adding it, thus decreasing the bias due to the positive gradient value and conflicting with the goal of fairness attacks. So, it should not have a high preference to be selected. Similarly, if we have negative $\Delta_{\mathbf{A}}b$ and negative $\left(\mathbf{I}-2\mathbf{A}\right)\left[i,j\right]$, then removing edge $\left(i,j\right)$ would help increase the edge. However, a positive $\left(\mathbf{I}-2\mathbf{A}\right)\left[i,j\right]$ suggests to add the edge instead of removing it. It is also conflicting with the goal of fairness attacks, and our method would not select this edge.

Reviewer comment (Theory):
For definition 1, authors are suggested to explain why the conclusion from IID assumption can be used in the graph data, where nodes are non-IID. Moreover, according to the definition of CDF, the integral starts from -infinity. Authors are suggested to revise related symbols or statements in section 4.

Author response:
Thank you for your feedback about non-IID assumption for applying kernel density estimation. In our original manuscript, we have provided the justifications in Appendix H.F. Specifically, we believe it remains an open problem whether the learned node representations follow IID assumption on the low-dimensional manifold or not. Empirically from the experimental results, using KDE-based bias approximation effectively helps maximize the bias for fairness attacks. Meanwhile, relaxing the IID assumption is a common strategy in computing the distributional discrepancy of node representations. For example, MMD is a widely used distributional discrepancy measures, whose accurate approximation also requires IID assumption [1], and recent studies [2, 3] show that we can also adapt it on non-IID data which shows promising empirical performance.

Reviewer comment (Writing):
In section 5, authors are suggested to explain that L_s is the Laplacian matrix of S, avoiding the confusion of audience who are not familiar with fairness.

Author response:
Thank you for pointing it out. The reviewer is correct that CDF corresponds to the integral that starts from negative infinity. We have corrected the corresponding to complementary CDF, which starts from $\tau$ to positive infinity in the revised version (highlighted in blue in Section 4.C).

Reviewer comment (Experiments):
Limited evaluation. It is worth noting that the surrogate model is SGC while the target model is GCN, and they almost have extremely similar architecture. Authors are suggested to evaluate the effectiveness of the proposed method on other target GNN architectures (e.g., GAT, GraphSAGE) to follow the attack setting of this paper (section 3.1, attackers have only access to the graph data).

Author response:
Thank you for your suggestion in further improving the clarity. We have added ", where $\mathbf{L}_{\mathbf{S}}$ is the Laplacian matrix of $\mathbf{S}$" in Section 5, highlighted in blue.

Reviewer comment (Evaluation):
Evaluation metric. It is worth noting that the fairness of GNNs is at the cost of performance. Although it is great to see the fairness deduction with limited performance cost. However, FA-GNN works well in a lot of cases. Considering that both fairness and model performance is the design of this paper, authors are suggested to compare the (\delta SP)/(\delta Acc) to evaluate the bias increment on unit acc cost.

Author response:
Thank you for your comments. We agree that SGC (the surrogate model) and GCN (the victim model in the main body) are both convolutional aggregation-based graph neural networks. Thus, in Appendix H of the original manuscript, we evaluate the tranferability of fairness attacks of our method by setting the victim model to graph attention network (GAT). From the results, we observe that our method can still consistently succeed in effective fairness attack by increasing $\Delta_{\text{SP}}$ and the individual bias (Bias) and deceptive attack by offering comparable or even better micro F1 score (Micro F1) when the victim model is not a convolutional aggregation-based model. Thus, it shows that the adversarial edges flipped/added by our method is able to transfer to graph neural networks with different type of aggregation function.

Reviewer comment (Presentation):
Confusing analysis on the effect of the perturbation rate. I understand that the authors attempt to show insights on the adversarial graph. However, it is hard to digest the operation (delete or add) on the same/different label/attribute. The discussion in Figure 1-b is also confusing. I suppose that detailed explanations of what exactly happened on each bar will make a more clear discussion. Authors are suggested to revise the paragraphs related to figures 1 and 2.

Author response:
We appreciate the reviewer for your suggestion for better clarity and for further clarification on defining the unit accuracy cost. We have followed your suggestion and have changed "attack statistical parity and individual fairness" to "attack statistical parity or individual fairness" in the updated version (in abstract, organization of Appendix at the beginning of Appendix page, and Appendix G). 

Regarding the unit accuracy cost, as the reviewer suggested, we define the **absolute** unit accuracy cost as $\text{unit-acc-cost} = \frac{|\Delta_{\text{SP}}^{(\text{before})} - \Delta_{\text{SP}}^{(\text{after})}|}{|\text{Acc}^{(\text{before})} - \text{Acc}^{(\text{after})}|}$, which helps measure the absolute change in $\Delta_{\text{SP}}$ with one unit absolute change in accuracy. And higher is better for absolute unit accuracy, because a higher absolute unit accuracy cost means that one unit change in accuracy could cause more bias increase. The unit accuracy costs of FA-GNN, FATE-flip, and FATE-add are as follows. Please note that, in each cell of table below, the absolute unit accuracy costs are reported when the perturbation are from 0.05 to 0.25 with a step size of 0.05 in an ascending order, i.e., the leftmost value indicates the absolute unit accuracy cost when the perturbation rate is 0.05, and the rightmost value indicates the absolute unit accuracy cost when the perturbation rate is 0.25. (fail) means that the absolute unit accuracy cost refers to the case of failed fairness attack (i.e., decreasing bias after attack).

||FA-GNN|FATE-flip|FATE-add|
|-|-|-|-|
|Pokec-n|12.666 (fail) -> 2.933 -> 5.667 -> 6.647 -> 18.000|5.500 -> 3.857 -> 8.800 -> 7.000 -> 6.250|5.500 -> 3.857 -> 8.800 -> 7.000 -> 6.250|
|Pokec-z|14.667 (fail) -> 9.857 -> 5.722 -> 8.174 -> 5.414|0.333 -> 3.000 -> 3.167 -> 22.000 -> 20.000|0.333 -> 3.000 -> 3.167 -> 22.000 -> 20.000|
|Bail|1.429 -> 0.885 -> 0.129 -> 0.176 (fail) -> 0.848 (fail)|1.200 -> 1.286 -> 1.222 -> 1.444 -> 1.100| 1.000 -> 0.857 -> 1.375 -> 1.625 -> 1.100|

For Pokec-n, FATE-flip and FATE-add achieves higher absolute unit accuracy cost when the perturbation rate is smaller than 0.25 (please note that FA-GNN fails the fairness attack when the perturbation rate is 0.05). For Pokec-z, FATE-flip and FATE-add achieves a much higher absolute unit accuracy cost when the perturbation rates are 0.20 and 0.25. While for Bail, FATE-flip and FATE-add consistently offers higher absolute unit accuracy cost (except for a marginal decrease for FATE-add with the perturbation rate being 0.10).

Reviewer comment (Evaluation):
According to the effectiveness table results, authors are suggested to explain why the proposed method can improve the performance of GNNs.

Author response:
Thank you for your question. We would like to clarify that Figures 1 and 2 refers to our analysis on the manipulated edges, which aims to investigate whether the manipulated edges have certain properties, rather than the effect of perturbation rate. As we mentioned in "Analysis on the manipulated edges", we only analyze FATE-flip because, in practice, we found that the majority of edges manipulated by FATE-flip on all three datasets is by addition. And we choose to analyze the case with perturbation rate 25\% because the cases with smaller perturbation rates is essentially manipulating subsets of edges in the case with perturbation rate 25\%.

Reviewer comment (Evaluation):
On the “Effect of the perturbation rate” in section 6.2. Intuitively, more perturbations will make the learned parameters farther from that learned from the original graph. Thus, the availability scope of the learned adversarial graph will be limited by the perturbations, i.e., the higher budget will result in more unexpected behaviours of GNN trained on the poisoned graph. Authors are suggested to revise and discuss it in this paper, which is the limitation of the gradient-based attack method.

Author response:
Thank you for your question. We think one possible reason is that FATE would favor injecting edges that connect two nodes with the same class labels (as shown in Figures 1 and 2), which would increase the homophily of the perturbed graph. Given that (1) the surrogate model (SGC) and all victim models (GCN, FairGNN, InFoRM-GNN, GAT) are proved to work well due to the homophily assumption and (2) all datasets are homophilous, such homophily-favored manipulations might improve the GCN performance.

Reviewer comment (Writing):
Grammatical Typos: There are minor grammatical errors present, such as in Section 6.1 on page 6, where the phrase "It randomly deleting edges..." should be corrected to "It randomly deletes edges...".

Author response:
**Q1. Grammatical typos.**

Thank you for catching the grammatical errors. We have proofread the paper and fixed them in the revised version (highlighted in blue).

Reviewer comment (Writing):
Incomplete Introduction of Fairness Definitions: In Section 2B, when algorithmic fairness definitions are introduced, the paper provides English definitions but omits corresponding mathematical definitions. Including these mathematical definitions would enhance clarity, especially as the individual fairness definition is important when analyzing results.

Author response:
**Q2. Missing mathematical formulation of fairness definitions.**

Thank you for your kind suggestion. Given the space limitation, we have added a new section in Appendix (i.e., Appendix B) for mathematical formulations and formal definitions of statistical parity and individual fairness. A pointer to Appendix B is also added in Section 2-B.

Reviewer comment (Presentation):
Inconsistent Organization: The paper utilizes a letter-based organization in some sections and a numerical organization in others. For instance, in Section 4, ideas are laid out numerically but then referred to using letters (A, B,...).

Author response:
**Q3. Inconsistent organization between letter-based indexing and numerical indexing.**

Thank you for your suggestion about consistent indexing. We have changed the indexing in Section 4 to letter-based indexing. Meanwhile, for the second-level indexing, we are using numerical indexing to avoid confusion. For example, numerical indexing ((1), (2), ...) are used in Section 2-C. Please let us know if you would like use to change the second-level indexing to other format and we would be more than happy to accommodate it.

Reviewer comment (Evaluation):
Can more be discussed on the potential other bias functions besides statistical parity?

Author response:
**Q4. More discussion about other bias function other than statistical parity.**

Thank you for your suggestion. We would like to clarify that, in addition to statistical parity, we instantiate our method by attacking individual fairness in Section 5 and discuss strategies on attacking a specific demographic group in statistical parity and the best/worst accuracy group in Appendix H.D and H.E in the original manuscript. More specifically, for attacking individual fairness, we define the bias function as $b\left(\mathbf{Y}, \Theta^*, \mathbf{S}\right) = \operatorname{Tr}\left(\mathbf{Y}^T \mathbf{L}_{\mathbf{S}} \mathbf{Y}\right)$. For attacking a specific demographic group in statical parity (Appendix H.D), we can set the bias function to either $b\left(\mathbf{Y}, \Theta^*, \mathbf{F}\right) = - \operatorname{P}\left[{\tilde y} = 1 \mid s = a\right]$ to decrease the acceptance rate of demographic group with sensitive attribute value $s=a$ or $b\left(\mathbf{Y}, \Theta^*, \mathbf{F}\right) = \operatorname{P}\left[{\tilde y} = 1 \mid s = 1\right] - \operatorname{P}\left[{\tilde y} = 1 \mid s = 0\right]$ to increase the gap of acceptance rate between group $s = 1$ and group $s = 0$. For attacking the best/worst accuracy group (Appendix H.E), we can set the bias function to be the task-specific loss (e.g., cross-entropy) of the demographic of nodes with best/worst accuracy, which is conceptually similar to adversarial attacks on the utility as shown in Metattack [1], but focusing on a subgroup of nodes determined by the sensitive attribute rather than the validation set. We would highly appreciate if the reviewer could clarify the specific bias function that needs to be discussed, and we would be more than happy to provide additional discussion if possible.

Reviewer comment (Experiments):
Do the authors believe this attack scenario is reasonable in real-world settings? Although an example is provided of a banker and has been used in prior work, but it feels somehow contrived and would look forward to perhaps more realistic settings where the attackers have more restricted access (e.g., visibility of the existing graph and only able to construct and connect new nodes, etc.).

Author response:
**Q5. How reasonable and realistic is the attack scenario? Possibility for a more restricted setting, e.g., limited visibility, node injection.**

Thank you for your question about the attack scenario. Please note that we follow the same assumption compared with existing work FA-GNN [2], in which it requires the sensitive attributes of all nodes to determine which edge to be injected. We leave for future work on fairness attacks with limited visibility of the input graph and with adversarial node injection.

- For limited visibility, in practice, we find that, for both debiasing and attacking, statistical parity relies on accurate estimation of the learning results' distributions. This is because statistical parity requires the statistical independence between the learning results and the sensitive attribute. With limited visibility of the graph, it is likely that the distribution of invisible subgraph is different from that of the visible subgraph, which would result in unstable model performance. In terms of fairness on graphs, how to achieve (and attack) statistical parity under potential distribution shift is still a less explored open problem.

- For node injection, as we mentioned in the second paragraph in introduction (Section 1), adversarial node injection not only requires generating the node attributes for the injected nodes, but also requires connecting the injected adversarial node(s) to nodes in the original graph. Though existing works [3, 4, 5, 6] have investigated how to generated adversarial data points on tabular data (which might be used to generate features of the adversarially injected nodes on graphs), it still remains non-trivial to connect the injected nodes to the existing nodes to effectively attack the fairness of graph learning models. 

**References**

[1] Zügner, Daniel and Stephan Günnemann. “Adversarial Attacks on Graph Neural Networks via Meta Learning.” ArXiv abs/1902.08412 (2019)

[2] Hussain, Hussain, et al. "Adversarial Inter-Group Link Injection Degrades the Fairness of Graph Neural Networks." 2022 IEEE International Conference on Data Mining (ICDM). IEEE, 2022.

[3] Solans, David, Battista Biggio, and Carlos Castillo. "Poisoning attacks on algorithmic fairness." Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Cham: Springer International Publishing, 2020.

[4] Mehrabi, Ninareh, et al. "Exacerbating algorithmic bias through fairness attacks." Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 35. No. 10. 2021.

[5] Chhabra, Anshuman, Adish Singla, and Prasant Mohapatra. "Fairness degrading adversarial attacks against clustering algorithms." arXiv preprint arXiv:2110.12020 (2021).

[6] Van, Minh-Hao, et al. "Poisoning attacks on fair machine learning." International Conference on Database Systems for Advanced Applications. Cham: Springer International Publishing, 2022

Reviewer comment (Writing):
The terminology of "deceptiveness" may be confusing and is not clearly explained, from an intuitive level, in the manuscript.

Author response:
Thank you for your question. In our revised version (Section 1 paragraph 3), we highlight that "the lower-level problem optimizes a task-specific loss function to maintain the performance of the downstream learning task and enforces budgeted perturbations to make the fairness attacks deceptive". Budgeted perturbations (i.e., imperceptible changes) have been widely adopted in existing works on adversarial attacks for graph neural networks. In addition, we believe a deceptive fairness attack is also important in maintaining the performance of downstream learning task, which is mentioned in Section 2-C in the original manuscript "a performance degradation in the utility would make the fairness attacks not deceptive from the perspective of a utility-maximizing institution." The reason is that it is easy for a utility-maximizing institution to detect the abnormal performance of the graph learning model, which is trained on the poisoned data. Such abnormal performance may trigger the auditing toward model behaviors, which may further lead to the investigation on the data used to trained the model. With careful auditing, it is possible to identify fairness attacks as shown in our analysis of manipulated edges due to significantly more edges that have certain properties (e.g., connecting two nodes with a specific sensitive attribute value). Then the institution might take actions (e.g., data cleansing) to avoid the negative consequences caused by fairness attacks.

Reviewer comment (Novelty):
What's the intuition behind the method being "meta-learning"? It appears that this is not a typical treatment of meta-learning in graph representation learning.

Author response:
Thank you for your question. In our work, as we mentioned in the manuscript, we treat the input graph as a hyperparameter to be learned other than model parameters and apply meta learning to find the suitable hyperparameter (i.e., the input graph) that maximizes the bias function. Similar strategy has been adopted in hyperparameter optimization [1] and in adversarial attacks on the utility of graph neural networks [2], as well as in graph structure learning [3, 4]  

**References**

[1] Franceschi, Luca, et al. "Bilevel programming for hyperparameter optimization and meta-learning." International conference on machine learning. PMLR, 2018.

[2] Zügner, Daniel and Stephan Günnemann. “Adversarial Attacks on Graph Neural Networks via Meta Learning.” ArXiv abs/1902.08412 (2019)

[3] Franceschi, Luca, et al. "Learning discrete structures for graph neural networks." International conference on machine learning. PMLR, 2019.

[4] Xu, Zhe, Boxin Du, and Hanghang Tong. "Graph sanitation with application to node classification." Proceedings of the ACM Web Conference 2022. 2022.