Original: Fairness Reprogramming
Revised: Fairness Reprogramming

Original: Abstract
Revised: Abstract

Original: Despite a surge of recent advances in promoting machine Learning (ML) fairness, the existing mainstream approaches mostly require training or finetuning the entire weights of the neural network to meet the fairness criteria.
Revised: Despite a surge of recent advances in promoting machine Learning (ML) fairness, the existing mainstream approaches mostly require training or ﬁnetuning the entire weights of the neural network to meet the fairness criteria.

Original: However, this is often infeasible in practice for those large-scale trained models due to large computational and storage costs, low data efficiency, and model privacy issues.
Revised: However, this is often infeasible in practice for those large-scale trained models due to large computational and storage costs, low data efﬁciency, and model privacy issues.

Original: In this paper, we propose a new generic fairness learning paradigm, called F AIR R EPROGRAM , which incorporates the model reprogramming technique.
Revised: In this paper, we propose a new generic fairness learning paradigm, called F AIR R EPROGRAM , which incorporates the model reprogramming technique.

Original: Specifically, F AIR R EPROGRAM considers the case where models can not be changed and appends to the input a set of perturbations, called the fairness trigger, which is tuned towards the fairness criteria under a min-max formulation.
Revised: Speciﬁcally, F AIR R EPROGRAM considers the case where models can not be changed and appends to the input a set of perturbations, called the fairness trigger, which is tuned towards the fairness criteria under a min-max formulation.

Original: We further introduce an information-theoretic framework that explains why and under what conditions fairness goals can be achieved using the fairness trigger.
Revised: We further introduce an information-theoretic framework that explains why and under what conditions fairness goals can be achieved using the fairness trigger.

Original: We show both theoretically and empirically that the fairness trigger can effectively obscure demographic biases in the output prediction of fixed ML models by providing false demographic information that hinders the model from utilizing the correct demographic information to make the prediction.
Revised: We show both theoretically and empirically that the fairness trigger can effectively obscure demographic biases in the output prediction of ﬁxed ML models by providing false demographic information that hinders the model from utilizing the correct demographic information to make the prediction.

Original: Extensive experiments on both NLP and CV datasets demonstrate that our method can achieve better fairness improvements than retraining-based methods with far less data dependency under two widely-used fairness criteria.
Revised: Extensive experiments on both NLP and CV datasets demonstrate that our method can achieve better fairness improvements than retraining-based methods with far less data dependency under two widely-used fairness criteria.

Original: Codes are available at https://github.com/UCSB-NLP-Chang/Fairness-Reprogramming.git .
Revised: Codes are available at https://github.com/UCSB-NLP-Chang/Fairness-Reprogramming.git .

Original:  Introduction
Revised:  Introduction

Original: Fairness in machine learning (ML) has become a critical concern.
Revised: Fairness in machine learning (ML) has become a critical concern.

Original: Due to the biases in data collection, the output prediction is often spuriously correlated with some demographic attributes, which are thus undesirably incorporated into the decision-making process of machine learning models.
Revised: Due to the biases in data collection, the output prediction is often spuriously correlated with some demographic attributes, which are thus undesirably incorporated into the decision-making process of machine learning models.

Original: For example, it is found that some abusive language detection systems tend to classify texts that contain mere mentioning of certain minority groups, e.g., homosexual groups, as abusive content, even though the texts themselves are not abusive at all [1, 2].
Revised: For example, it is found that some abusive language detection systems tend to classify texts that contain mere mentioning of certain minority groups, e.g., homosexual groups, as abusive content, even though the texts themselves are not abusive at all [1, 2].

Original: Despite the recent advances in fairness promoting learning methods [3–7], the existing mainstreaming approaches mostly require retraining or finetuning the entire model parameters towards an extra fairness objective. 
Revised: Despite the recent advances in fairness promoting learning methods [3–7], the existing mainstreaming approaches mostly require retraining or ﬁnetuning the entire model parameters towards an extra fairness objective. However, this is [Table]

Original: However, this is often infeasible in practice, particularly for those well-trained large-scale models, due to the huge computation and storage costs.
Revised: often infeasible in practice, particularly for those well-trained large-scale models, due to the huge computation and storage costs.

Original: In addition, for machine learning models that are deployed as a service, model retraining is hindered by limited access to the model parameters.
Revised: In addition, for machine learning models that are deployed as a service, model retraining is hindered by limited access to the model parameters.

Original: Recently, model reprogramming has emerged as an alternative technique to model finetuning.
Revised: Recently, model reprogramming has emerged as an alternative technique to model ﬁnetuning.

Original: In particular, model reprogramming considers the pre-trained model fixed, and instead modifies their input to re-purpose the model towards different objectives.
Revised: In particular, model reprogramming considers the pre-trained model ﬁxed, and instead modiﬁes their input to re-purpose the model towards different objectives.

Original: For example, it is shown that a well-crafted input perturbation can re-program an ImageNet classifier to solve the task of counting squares in an image [8, 9].
Revised: For example, it is shown that a well-crafted input perturbation can re-program an ImageNet classiﬁer to solve the task of counting squares in an image [8, 9].

Original: It is also shown that by learning task-specific embedding prompts concatenated to the inputs, pre-trained language models can achieve better performances than full-parameter tuning in natural language understanding tasks [10–12]
Revised: It is also shown that by learning task-speciﬁc embedding prompts concatenated to the inputs, pre-trained language models can achieve better performances than full-parameter tuning in natural language understanding tasks [10–12]

Original: Compared with finetuning methods, model reprogramming enjoys lower cost, better scalability, and requires less access to the model parameters.
Revised: Compared with ﬁnetuning methods, model reprogramming enjoys lower cost, better scalability, and requires less access to the model parameters.

Original: Hence here come our research questions - Can model reprogramming techniques be applied to fairness objectives?
Revised: Hence here come our research questions - Can model reprogramming techniques be applied to fairness objectives?

Original: If so, why and how would it work?
Revised: If so, why and how would it work?

Original: In this paper, we revisit the model reprogramming and propose a novel generic fairness learning paradigm, called F AIR R EPROGRAM .
Revised: In this paper, we revisit the model reprogramming and propose a novel generic fairness learning paradigm, called F AIR R EPROGRAM .

Original: In particular, F AIR R EPROGRAM perturbs the input by appending to the input a global constant vector/feature, called the fairness trigger , which is optimized towards the fairness objective under a min-max framework.
Revised: In particular, F AIR R EPROGRAM perturbs the input by appending to the input a global constant vector/feature, called the fairness trigger , which is optimized towards the fairness objective under a min-max framework.

Original: F AIR R EPROGRAM is a generic framework that works for various tasks and domains.
Revised: F AIR R EPROGRAM is a generic framework that works for various tasks and domains.

Original: We further introduce an information-theoretic framework that explains why and under what conditions fairness goals can be achieved using a constant fairness trigger.
Revised: We further introduce an information-theoretic framework that explains why and under what conditions fairness goals can be achieved using a constant fairness trigger.

Original: We show theoretically and empirically that the fairness trigger can effectively obscure demographic biases in the output prediction of fixed ML models by providing false demographic information that hinders the model from utilizing the correct demographic information to make predictions.
Revised: We show theoretically and empirically that the fairness trigger can effectively obscure demographic biases in the output prediction of ﬁxed ML models by providing false demographic information that hinders the model from utilizing the correct demographic information to make predictions.

Original: We perform extensive experiments across various NLP and CV datasets with in-the-wild biases.
Revised: We perform extensive experiments across various NLP and CV datasets with in-the-wild biases.

Original: The results show that F AIR R EPROGRAM can consistently achieve better fairness improvement with the retraining-based methods under the two widely-used fairness notions, but with far less trade-off in accuracy.
Revised: The results show that F AIR R EPROGRAM can consistently achieve better fairness improvement with the retraining-based methods under the two widely-used fairness notions, but with far less trade-off in accuracy.

Original: For example, with comparable accuracy, our method can outperform the retraining based baseline with 10.5% and 36.5% lower bias scores over two fairness criteria in the CelebA dataset with the hair color prediction task and gender as demographic information.
Revised: For example, with comparable accuracy, our method can outperform the retraining based baseline with 10.5% and 36.5% lower bias scores over two fairness criteria in the CelebA dataset with the hair color prediction task and gender as demographic information.

Original: In addition, our method demonstrates great transferability and interpretability.
Revised: In addition, our method demonstrates great transferability and interpretability.

Original: Our theoretical analysis and empirical findings can provide useful insights toward more practical, scalable, and flexible fairness learning paradigms.
Revised: Our theoretical analysis and empirical ﬁndings can provide useful insights toward more practical, scalable, and ﬂexible fairness learning paradigms.

Original:  Related Work
Revised:  Related Work

Original: Fairness in ML Fairness problems in ML models have received increasing attention from both industry [13] and academia [14–17].
Revised: Fairness in ML Fairness problems in ML models have received increasing attention from both industry [13] and academia [14–17].

Original: There has been a myriad of fairness definitions in the literature [18, 14, 19, 20].
Revised: There has been a myriad of fairness deﬁnitions in the literature [18, 14, 19, 20].

Original: Among them, group fairness notions are one of the most popular [21–23], which require ML models to perform similarly for different demographic groups.
Revised: Among them, group fairness notions are one of the most popular [21–23], which require ML models to perform similarly for different demographic groups.

Original: In this paper, we mainly focus on the two most widely-used group fairness definitions, demographic parity [21] and equalized odds [22], but it is worth mentioning that our method is general for other fairness notions.
Revised: In this paper, we mainly focus on the two most widely-used group fairness deﬁnitions, demographic parity [21] and equalized odds [22], but it is worth mentioning that our method is general for other fairness notions.

Original: Existing fairness promoting methods can be broadly categorized into pre-processing, in-processing, and post-processing methods [24].
Revised: Existing fairness promoting methods can be broadly categorized into pre-processing, in-processing, and post-processing methods [24].

Original: Pre-processing methods calibrate the training data to remove the spurious correlations and train fair model on the modified data [25–28, 2, 1, 29, 30].
Revised: Pre-processing methods calibrate the training data to remove the spurious correlations and train fair model on the modiﬁed data [25–28, 2, 1, 29, 30].

Original: In-processing methods work on training ML with extra fairness-aware regularization [3–7, 31, 32].
Revised: In-processing methods work on training ML with extra fairness-aware regularization [3–7, 31, 32].

Original: For example, an adversarial framework is introduced to train model parameters to meet fairness requirements [33].
Revised: For example, an adversarial framework is introduced to train model parameters to meet fairness requirements [33].

Original: In our method, we adopt a similar adversarial loss but optimize the fairness triggers with a fixed model.
Revised: In our method, we adopt a similar adversarial loss but optimize the fairness triggers with a ﬁxed model.

Original: Despite the effectiveness, these methods usually consider training fair models from scratch and do not directly apply to already-trained models.
Revised: Despite the effectiveness, these methods usually consider training fair models from scratch and do not directly apply to already-trained models.

Original: Post-processing methods focus on calibrating trained ML models to be fair [24].
Revised: Post-processing methods focus on calibrating trained ML models to be fair [24].

Original: Many of them modify the model outputs to meet the fairness criteria [18, 22, 34–44].
Revised: Many of them modify the model outputs to meet the fairness criteria [18, 22, 34–44].

Original: For example, the model outputs are directly modified to meet equalized odds by solving an optimization problem [22].
Revised: For example, the model outputs are directly modiﬁed to meet equalized odds by solving an optimization problem [22].

Original: Alternatively, a boosting-based method is introduced to calibrate model outputs [40].
Revised: Alternatively, a boosting-based method is introduced to calibrate model outputs [40].

Original: Model reprogramming Model reprogramming [ 45, 9, 8, 46–48] aims to repurpose an already trained neural network for different tasks.
Revised: Model reprogramming Model reprogramming [45, 9, 8, 46–48] aims to repurpose an already trained neural network for different tasks.

Original: Different from the typical transfer learning that requires modifying the structure and parameters of the given pre-trained model, reprogramming technology instead designs a trainable program appended to the input, while keeping the pre-trained model intact.
Revised: Different from the typical transfer learning that requires modifying the structure and parameters of the given pre-trained model, reprogramming technology instead designs a trainable program appended to the input, while keeping the pre-trained model intact.

Original: The model reprogramming technology can be designed in the form of an input-agnostic perturbation [45, 8] or a trainable input transformation function together with the label mapping from the source domain to the target domain [9].
Revised: The model reprogramming technology can be designed in the form of an input-agnostic perturbation [45, 8] or a trainable input transformation function together with the label mapping from the source domain to the target domain [9].

Original: In particular, the feasibility of designing a universal input perturbation to reprogram a well-trained ImageNet classifier to the CIFAR-10 dataset is demonstrated in the white-box setting [8].
Revised: In particular, the feasibility of designing a universal input perturbation to reprogram a well-trained ImageNet classiﬁer to the CIFAR-10 dataset is demonstrated in the white-box setting [8].

Original: As an exploration to implement reprogramming in the discrete scenario, another work [46] successfully reprograms the text classification neural network for alternate classification tasks.
Revised: As an exploration to implement reprogramming in the discrete scenario, another work [46] successfully reprograms the text classiﬁcation neural network for alternate classiﬁcation tasks.

Original: This work also shows the possibility of developing reprogramming in the black-box setting, where the reprogrammer may not have the access to the parameters of the target model.
Revised: This work also shows the possibility of developing reprogramming in the black-box setting, where the reprogrammer may not have the access to the parameters of the target model.

Original: Recent work [47] shows the possibility of repurposing deep neural networks designed for image classifiers for the natural language processing and other sequence classification tasks.
Revised: Recent work [47] shows the possibility of repurposing deep neural networks designed for image classiﬁers for the natural language processing and other sequence classiﬁcation tasks.

Original: It is argued the success of the reprogramming lies in the size of the average input gradient and the input dimension is crucial to the performance of the reprogrammer [48].
Revised: It is argued the success of the reprogramming lies in the size of the average input gradient and the input dimension is crucial to the performance of the reprogrammer [48].

Original: It is also shown that generative models like FairGANs [49] can be transfered to other tasks by reprogramming with variational auto-encoders [50].
Revised: It is also shown that generative models like FairGANs [49] can be transfered to other tasks by reprogramming with variational auto-encoders [50].

Original: A highly related topic to model reprograming is prompt learning in NLP [11].
Revised: A highly related topic to model reprograming is prompt learning in NLP [11].

Original: It is shown that by designing designated text prompts appended to inputs, pre-trained language models could be re-directed to perform well under downstream tasks in a few-shot setting [51].
Revised: It is shown that by designing designated text prompts appended to inputs, pre-trained language models could be re-directed to perform well under downstream tasks in a few-shot setting [51].

Original: Prompt-based tuning methods have become the mainstream and achieve better performance than fine-tuning in many scenarios [52–55].
Revised: Prompt-based tuning methods have become the mainstream and achieve better performance than ﬁne-tuning in many scenarios [52–55].

Original: Seminal works about prompt learning can be found in [11, 12].
Revised: Seminal works about prompt learning can be found in [11, 12].

Original: However , nearly all existing methods focus on using model reprogramming to improve accuracy in domain-transfer tasks and to our best knowledge, our work is the first to generalize model reprogramming to improve fairness of a trained model.
Revised: However , nearly all existing methods focus on using model reprogramming to improve accuracy in domain-transfer tasks and to our best knowledge, our work is the ﬁrst to generalize model reprogramming to improve fairness of a trained model.

Original:  Fairness Reprogramming
Revised:  Fairness Reprogramming

Original: In this section, we will introduce the F AIR R EPROGRAM algorithms.
Revised: In this section, we will introduce the F AIR R EPROGRAM algorithms.

Original: As some notations, upper-cased letters, X and X , denote random vectors and random variables, respectively; lower-cased letters, x or x , denote deterministic vectors and scalars respectively.
Revised: As some notations, upper-cased letters, X and X , denote random vectors and random variables, respectively; lower-cased letters, x or x , denote deterministic vectors and scalars respectively.

Original: p X (⋅) or p ( X ) denote the probability density function of the (discrete) random variable X .
Revised: p X ( ⋅ ) or p ( X ) denote the probability density function of the (discrete) random variable X .

Original: 3.1 Problem Formulation
Revised: 3.1 Problem Formulation

Original: Consider a classification task, where X represents the input feature, and Y represents the output label.
Revised: Consider a classiﬁcation task, where X represents the input feature, and Y represents the output label.

Original: In addition, there exists some sensitive attributes or demographic group, Z , that may be spuriously correlated with Y .
Revised: In addition, there exists some sensitive attributes or demographic group, Z , that may be spuriously correlated with Y .

Original: There is a pre-trained classifier, f ∗ (⋅) , that predicts Y from X , i.e. ˆ Y = f ∗ ( X ) .
Revised: There is a pre-trained classiﬁer, f ∗ ( ⋅ ) , that predicts Y from X , i.e. ˆ Y = f ∗ ( X ) .

Original: The weights of the classifier are considered fixed (hence the superscript ∗ ).
Revised: The weights of the classiﬁer are considered ﬁxed (hence the superscript ∗ ).

Original: Unfortunately, due to the spurious correlation between Z and Y , the classifier may be biased against certain demographics.
Revised: Unfortunately, due to the spurious correlation between Z and Y , the classiﬁer may be biased against certain demographics.

Original: Our goal is to improve the fairness of the classifier by modifying the input X , rather than modifying the classifier’s fixed weights.
Revised: Our goal is to improve the fairness of the classiﬁer by modifying the input X , rather than modifying the classiﬁer’s ﬁxed weights.

Original: In particular, we aim to achieve either of the following fairness criteria.
Revised: In particular, we aim to achieve either of the following fairness criteria.

Original: [Equation]
Revised: [Equation]

Original: where ⊥ denotes independence.
Revised: where ⊥ denotes independence.

Original: The following two subsection will explain how to modify input and design the optimization objective respectively.
Revised: The following two subsection will explain how to modify input and design the optimization objective respectively.

Original: 3.2 Modifying the Input Features
Revised: 3.2 Modifying the Input Features

Original: Input modification primarily involves appending a fairness trigger to the input.
Revised: Input modiﬁcation primarily involves appending a fairness trigger to the input.

Original: Formally, the input modification takes the following generic form:
Revised: Formally, the input modiﬁcation takes the following generic form:

Original: [Equation]
Revised: [Equation]

Original: where ˜ X denotes the modified input; [⋅] denotes vector concatenation.
Revised: where ˜ X denotes the modiﬁed input; [ ⋅ ] denotes vector concatenation.

Original: As can be observed, the input modification consists of two steps.
Revised: As can be observed, the input modiﬁcation consists of two steps.

Original: First, X is fed through a transformation function g (⋅ ; θ ) , where θ represents the hyper-parameters of the transformation function.
Revised: First, X is fed through a transformation function g ( ⋅ ; ✓ ) , where ✓ represents the hyper-parameters of the transformation function.

Original: The actual form of g (⋅ ; θ ) is contingent upon different applications and modalities, but a general requirement is that g (⋅ ; θ ) should largely retain the information necessary for classification.
Revised: The actual form of g ( ⋅ ; ✓ ) is contingent upon different applications and modalities, but a general requirement is that g ( ⋅ ; ✓ ) should largely retain the information necessary for classiﬁcation.

Original: The second step is to append a fairness trigger, δ , to the input, which is a vector that can be optimized over.
Revised: The second step is to append a fairness trigger,  , to the input, which is a vector that can be optimized over.

Original: It is important to note that δ is a constant – different inputs get appended the same trigger.
Revised: It is important to note that  is a constant – different inputs get appended the same trigger.

Original: Although it does not seem intuitive, we will soon show that a constant trigger is all you need to achieve fair prediction on all different inputs.
Revised: Although it does not seem intuitive, we will soon show that a constant trigger is all you need to achieve fair prediction on all different inputs.

Original: Below are specific forms of transformations (Eq.
Revised: Below are speciﬁc forms of transformations (Eq.

Original: we use.
Revised: we use.

Original: Text Classification
Revised: Text Classiﬁcation

Original: In text classification, X represents a sequence of input token embeddings.
Revised: In text classiﬁcation, X represents a sequence of input token embeddings.

Original: To modify the input, we simply append a fixed number of embeddings after the input text.
Revised: To modify the input, we simply append a ﬁxed number of embeddings after the input text.

Original: In this case, g (⋅ ; θ ) is the identity mapping, and δ corresponds to the appended embeddings.
Revised: In this case, g ( ⋅ ; ✓ ) is the identity mapping, and  corresponds to the appended embeddings.

Original: [Figure]
Revised: [Figure]

Original: Image Classification
Revised: Image Classiﬁcation

Original: In image classification, X represents the (vectorized) input image.
Revised: In image classiﬁcation, X represents the (vectorized) input image.

Original: Unlike text classification, where the input can have a variable length, the length of the input to the image classification network is fixed.
Revised: Unlike text classiﬁcation, where the input can have a variable length, the length of the input to the image classiﬁcation network is ﬁxed.

Original: We thus apply the following two approaches to append the trigger, as shown in
Revised: We thus apply the following two approaches to append the trigger, as shown in

Original: Fig.
Revised: Fig.

Original: The first approach, called the patch approach , removes a patch from the original image, and appends a trigger the same size as the patch to the patch location (as shown in Fig. 1(a)).
Revised: The ﬁrst approach, called the patch approach , removes a patch from the original image, and appends a trigger the same size as the patch to the patch location (as shown in Fig. 1(a)).

Original: In this case, g (⋅ ; θ ) is a function that removes the patch dimension and retain the rest, with θ representing the patch location; δ represents the trigger feature that replaces the patch.
Revised: In this case, g ( ⋅ ; ✓ ) is a function that removes the patch dimension and retain the rest, with ✓ representing the patch location;  represents the trigger feature that replaces the patch.

Original: The second approach, called the border approach , shrinks the image to a smaller image, and then appends the trigger at the border (as shown in Fig. 1(b)).
Revised: The second approach, called the border approach , shrinks the image to a smaller image, and then appends the trigger at the border (as shown in Fig. 1(b)).

Original: In this case, g (⋅ ; θ ) is a function that shrinks the image, and δ represents the trigger feature at the border.
Revised: In this case, g ( ⋅ ; ✓ ) is a function that shrinks the image, and  represents the trigger feature at the border.

Original: 3.3 Optimization Objective
Revised: 3.3 Optimization Objective

Original: Our optimization objective is as follows
Revised: Our optimization objective is as follows

Original: [Equation]
Revised: [Equation]

Original: (3) where m = m (⋅ ; θ , δ ) represents the input modification function as in Eq.
Revised: where m = m ( ⋅ ; ✓ ,  ) represents the input modiﬁcation function as in Eq.

Original: (2); ○ represents nested functions; D tune represents the dataset that are used to train the fairness trigger.
Revised: (2); ○ represents nested functions; D tune represents the dataset that are used to train the fairness trigger.

Original: Note that this is different from the dataset where the classifier, f ∗ , is pre-trained.
Revised: Note that this is different from the dataset where the classiﬁer, f ∗ , is pre-trained.

Original: The first loss term, L util , is the utility loss function of the task.
Revised: The ﬁrst loss term, L util , is the utility loss function of the task.

Original: For classification tasks, L util is usually the cross-entropy loss, i.e. ,
Revised: For classiﬁcation tasks, L util is usually the cross-entropy loss, i.e. ,

Original: [Equation]
Revised: [Equation]

Revised: [Equation]

Original: where CE (⋅ , ⋅) denotes the cross-entropy loss.
Revised: where CE ( ⋅ , ⋅ ) denotes the cross-entropy loss.

Original: The second loss term, L fair , encourages the prediction to follow the fairness criteria as in Eq.
Revised: The second loss term, L fair , encourages the prediction to follow the fairness criteria as in Eq.

Original: According to Eq.
Revised: According to Eq.

Original: (1), L fair should measure how much information about Z is in ˆ Y .
Revised: L fair should measure how much information about Z is in ˆ Y .

Original: To measure this, we introduce another network, called the discriminator, d (⋅ ; ϕ ) , where ϕ represents its parameters.
Revised: To measure this, we introduce another network, called the discriminator, d ( ⋅ ;  ) , where  represents its parameters.

Original: If the equalized odds criterion is applied, then d (⋅ ; ϕ ) should predict Z from ˆ Y and Y ; if the demographic parity criterion is applied, then the input to d (⋅ ; ϕ ) would just be ˆ Y .
Revised: If the equalized odds criterion is applied, then d ( ⋅ ;  ) should predict Z from ˆ Y and Y ; if the demographic parity criterion is applied, then the input to d ( ⋅ ;  ) would just be ˆ Y .

Original: In the following, we will focus on equalize odds criterion for conciseness.
Revised: In the following, we will focus on equalize odds criterion for conciseness.

Original: Then, the information of Z can be measured by maximizing the negative cross-entropy loss for the prediction of Z over the discriminator parameters, i.e. ,
Revised: Then, the information of Z can be measured by maximizing the negative cross-entropy loss for the prediction of Z over the discriminator parameters, i.e. ,

Original: [Equation]
Revised: [Equation]

Revised: [Equation]

Original: By plugging Eqs.
Revised: By plugging Eqs.

Original: (4) and (5) into (3), we can see that the entire optimization objective becomes a min-max framework, where the discriminator tries to improve its prediction of Z while the fairness trigger tries to make the prediction worse.
Revised: (4) and (5) into (3), we can see that the entire optimization objective becomes a min-max framework, where the discriminator tries to improve its prediction of Z while the fairness trigger tries to make the prediction worse.

Original: As shown in [33], when the discriminator cannot predict Z better than chance, the aforementioned fairness criteria can be achieved.
Revised: As shown in [33], when the discriminator cannot predict Z better than chance, the aforementioned fairness criteria can be achieved.

Original: 3.4 Why Does It Work?
Revised: 3.4 Why Does It Work?

Original: It is not immediately straightforward why a global trigger can obscure the demographic information for any input.
Revised: It is not immediately straightforward why a global trigger can obscure the demographic information for any input.

Original: In this section, we will propose an information-theoretic framework that illustrates one of the mechanisms through which the trigger can remove the demographic information.
Revised: In this section, we will propose an information-theoretic framework that illustrates one of the mechanisms through which the trigger can remove the demographic information.

Original: Our theoretical framework builds upon the data generation process as shown in Fig. 2(a).
Revised: Our theoretical framework builds upon the data generation process as shown in Fig. 2(a).

Original: Specifically, we assume that X consists of a set of features, i.e. X =
Revised: Speciﬁcally, we assume that X consists of a set of features, i.e. X =

Original: [ X 1 , ⋯ , X T ] , where T is the total number of features.
Revised: X 1 , ￿ , X T ] , where T is the total number of features.

Original: In text classification, a feature can be a word or a word piece; in image classification, a feature can be specific shapes, colors, patterns, etc .
Revised: In text classiﬁcation, a feature can be a word or a word piece; in image classiﬁcation, a feature can be speciﬁc shapes, colors, patterns, etc .

Original: Assume that these features can be divided into two groups.
Revised: Assume that these features can be divided into two groups.

Original: The first group, denoted as X ( y ) , consists of features that are directly governed by the output label Y ; the second group, denoted as X ( z ) , consists of featuers that are directly governed by𝑌 𝑿 ! 𝑍 𝑿 " 𝐶 𝑝 #$% ⋅ |𝑿 ! 𝑿 !
Revised: The ﬁrst group, denoted as X ( y ) , consists of features that are directly governed by the output label Y ; the second group, denoted as X ( z ) , consists of featuers that are directly governed by

Original: 𝑿 " 𝑝 &$% ⋅ |𝑿 "

Original: Classifier 𝑝 #$% ⋅ |𝑿 !

Original: 𝑿

Original: [Figure]
Revised: [Figure]

Original: the demographic information Z .
Revised: the demographic information Z .

Original: Z and Y can be spuriously correlated, i.e. there can be common confounders, C , between Z and Y .
Revised: Z and Y can be spuriously correlated, i.e. there can be common confounders, C , between Z and Y .

Original: As a result, both X ( y ) and X ( z ) are indicative of Y .
Revised: As a result, both X ( y ) and X ( z ) are indicative of Y .

Original: To further simplify our theoretical analysis, we consider a bag-of-feature scenario, where each feature in X ( y ) is drawn from the vocabulary set X ( y ) , and each feature in X ( z ) is drawn from the vocabulary set X ( z ) .
Revised: To further simplify our theoretical analysis, we consider a bag-of-feature scenario, where each feature in X ( y ) is drawn from the vocabulary set X ( y ) , and each feature in X ( z ) is drawn from the vocabulary set X ( z ) .

Original: There should not be any overlap between the two vocabulary sets, i.e.X ( y ) ∩
Revised: There should not be any overlap between the two vocabulary sets, i.e.

Original: X ( z ) = ∅ .
Revised: [Equation]

Original: Otherwise it violates our assumption that demographic-related features are biased features.
Revised: Otherwise it violates our assumption that demographic-related features are biased features.

Original: It can be shown (in Appendix C) that the posterior distributions, p Y (⋅∣ X ( y ) ) and p Z (⋅∣ X ( z ) ) , are the sufficient statistics of X ( y ) and X ( z ) respectively for inferring Y .
Revised: It can be shown (in Appendix C) that the posterior distributions, p Y ( ⋅ ￿ X ( y ) ) and p Z ( ⋅ ￿ X ( z ) ) , are the sufﬁcient statistics of X ( y ) and X ( z ) respectively for inferring Y .

Original: In other words, these two posterior distributions summarize all the information about X ( y ) and X ( z ) that the classifier needs to know to predict Y .
Revised: In other words, these two posterior distributions summarize all the information about X ( y ) and X ( z ) that the classiﬁer needs to know to predict Y .

Original: Therefore, we assume that the classifier takes the following generic form
Revised: Therefore, we assume that the classiﬁer takes the following generic form

Original: [Equation]
Revised: [Equation]

Original: Note that we add a superscript, tr , to emphasize that the probability distributions are over the data set where the classifier is trained, because the classifier has never been trained on inputs modified with the fairness trigger.
Revised: Note that we add a superscript, tr , to emphasize that the probability distributions are over the data set where the classiﬁer is trained, because the classiﬁer has never been trained on inputs modiﬁed with the fairness trigger.

Original: Eq.
Revised: Eq.

Original: (6) encompasses many common decision functions.
Revised: (6) encompasses many common decision functions.

Original: For example, it can be shown (in Appendix C) that the posterior distribution p ( Y ∣ X ) , which is the minimizer of the cross-entropy loss, is a special case of Eq. 
Revised: For example, it can be shown (in Appendix C) that the posterior distribution p ( Y ￿ X ) , which is the minimizer of the cross-entropy loss, is a special case of Eq. As illustrated in Fig. 2(b), p Y (

Revised: [Equation]

Original: As illustrated in Fig. 2(b), p Y (⋅∣ X ( y ) ) and p Z(⋅∣ X ( z ) ) provide two sets of information from input features. 
Revised: ) and p Z ( [Equation] ) provide two sets of information from input features. p Y

Original: p Y (⋅∣ X ( y ) ) provides the unbiased information, because a desirable fair classifier should rely only upon p Y(⋅∣ X ( y ) ) to make a decision.
Revised: [Equation] ) provides the unbiased information, because a desirable fair classiﬁer should rely only upon p Y ( ⋅ [Equation] X

Revised: [Equation]

Revised: y

Revised: [Equation]

Original:  On the other hand, p Z(⋅∣ X ( z ) ) provides the biased information, because it conveys the demographic information.
Revised: ) to make a decision. On the other hand, p Z ( [Equation] ) provides the biased information, because it conveys the demographic information.

Original: In other words, the fairness goals can be achieved by cutting off the biased information path.
Revised: In other words, the fairness goals can be achieved by cutting off the biased information path.

Original: Therefore, our research question boils down to: is it possible to cut off the biased information path with a global fairness trigger δ ?
Revised: Therefore, our research question boils down to: is it possible to cut off the biased information path with a global fairness trigger  ?

Original: Without loss of generality, assume that δ consists of only one feature.
Revised: Without loss of generality, assume that  consists of only one feature.

Original: Consider the case where δ is a demographic feature, i.e. δ ∈ X ( z ) .
Revised: Consider the case where  is a demographic feature, i.e.  ∈ X ( z ) .

Original: In this case, we assume the transformed input as defined in Eq.
Revised: In this case, we assume the transformed input as deﬁned in Eq.

Original: (2) can also be divided into two groups:
Revised: (2) can also be divided into two groups:

Revised: [Equation]

Revised: where

Original: [Equation]
Revised: [Equation]

Original: The following theorem states our main conclusion:
Revised: The following theorem states our main conclusion:

Original: Theorem 1.
Revised: Theorem 1.

Original: Under the assumptions in Eq.
Revised: Under the assumptions in Eq.

Original: (6) and (7) , and some additional regularity conditions 2 , if the fairness trigger δ is indicative of a certain demographic group z , then
Revised: (6) and (7) , and some additional regularity conditions 2 , if the fairness trigger  is indicative of a certain demographic group z , then

Original: [Equation]
Revised: [Equation]

Original: where MI means mutual information; ˆ˜ Y = f ∗ ( ˜ X ) is the classifier’s prediction after input is modified.
Revised: where MI means mutual information; ˆ˜ Y = f ∗ [Equation] ) is the classiﬁer’s prediction after input is modiﬁed.

Original: ptr
Revised: p

Original: [-( Z = z ∣ X ( z ) 
-]
Revised: [-( Z = z ∣ X ( z ) 
-][Equation]

Original: = δ ) → 1 means that the fairness trigger is very strongly indicative of the demographic group z .
Revised: 1 means that the fairness trigger is very strongly indicative of the demographic group z .

Original: Therefore, Thm. 1 essentially states that if the prepended trigger feature is very strongly indicative of a certain demographic group, then equalized odds can be achieved.
Revised: Therefore, Thm. 1 essentially states that if the prepended trigger feature is very strongly indicative of a certain demographic group, then equalized odds can be achieved.

Original: A formal proof is presented in Appendix C. Here we would like to give an intuitive explanation.
Revised: A formal proof is presented in Appendix C. Here we would like to give an intuitive explanation.

Original: When p [-tr ( Z = z ∣ X ( z ) 
-]
Revised: When p [-tr ( Z = z ∣ X ( z ) 
-][Equation]

Original: = δ ) → 1 , it will also happen that p tr( Z = z ∣ X ( z ) =
Revised: ) → 1 , it will also happen that p tr

Original: ˜ X ( z ) )
Revised: [Equation]

Original: → 1 . In other words, the fairness trigger δ would overshadow the rest of the demographic features and ‘trick’ the classifier into believing all the  different inputs belong to the same demographic group z .
Revised: In other words, the fairness trigger  would overshadow the rest of the demographic features and ‘trick’ the classiﬁer into believing all the Formal different inputs belong to the same demographic group z .

Original: As a result, the second argument in Eq (6) would reduce to a constant (1 for demographic group z and 0 elsewhere), effectively blocking the biased information path, as shown in Fig. 2(c).
Revised: As a result, the second argument in Eq (6) would reduce to a constant (1 for demographic group z and 0 elsewhere), effectively blocking the biased information path, as shown in Fig. 2(c).

Original: Note that the premise for the fairness trigger to work is that the classifier has never seen the modified input.
Revised: Note that the premise for the fairness trigger to work is that the classiﬁer has never seen the modiﬁed input.

Original: Otherwise, the classifier will be able to learn to ignore the constant trigger and still elicit the true demographic information from input.
Revised: Otherwise, the classiﬁer will be able to learn to ignore the constant trigger and still elicit the true demographic information from input.

Original:  Experiments
Revised:  Experiments

Original: In this section, we evaluate the effectiveness of F AIR R EPROGRAM on both NLP and CV applications in terms of accuracy, fairness, performances under low-data regime, transferability and interpretability.
Revised: In this section, we evaluate the effectiveness of F AIR R EPROGRAM on both NLP and CV applications in terms of accuracy, fairness, performances under low-data regime, transferability and interpretability.

Original: 4.1 Experiment Setup
Revised: 4.1 Experiment Setup

Original: Datasets We consider the following two commonly used NLP and CV datasets:
Revised: Datasets We consider the following two commonly used NLP and CV datasets:

Original: • Civil Comments [57, 58]: The dataset contains 448k texts with labels that depict the toxicity of each input.
Revised: • Civil Comments [57, 58]: The dataset contains 448k texts with labels that depict the toxicity of each input.

Original: The demographic information of each text is provided.
Revised: The demographic information of each text is provided.

Original: • CelebA [56]: The dataset contains over 200k human face images and each contains 39 binary attribute annotations.
Revised: • CelebA [56]: The dataset contains over 200k human face images and each contains 39 binary attribute annotations.

Original: We follow the conventional setting [56] that adopts the hair color prediction task in our experiment and uses gender annotation as the demographic information.
Revised: We follow the conventional setting [56] that adopts the hair color prediction task in our experiment and uses gender annotation as the demographic information.

Original: For both datasets, we split the entire data into a training set, a tuning set, a validation set, and a testing set.
Revised: For both datasets, we split the entire data into a training set, a tuning set, a validation set, and a testing set.

Original: The training set is used for the base model training, i.e. , to obtain a biased model for reprogramming.
Revised: The training set is used for the base model training, i.e. , to obtain a biased model for reprogramming.

Original: The tunning set and validation set are used for trigger training and hyper-parameter selection.
Revised: The tunning set and validation set are used for trigger training and hyper-parameter selection.

Original: We report our results on the testing set.
Revised: We report our results on the testing set.

Original: It is worth mentioning that there is no overlapping data between different sets and the size of the tuning set is much smaller than the training one.
Revised: It is worth mentioning that there is no overlapping data between different sets and the size of the tuning set is much smaller than the training one.

Original: Specifically, we set the size ratio between the tunning set and the training as 1 / 5 and 1 / 100 for Civil
Revised: Speciﬁcally, we set the size ratio between the tunning set and the training as￿ 5 and￿ 100 for Civil

Original: Comments and CelebA , respectively.
Revised: Comments and CelebA , respectively.

Original: The full statistics of the datasets can be found in Appendix A.1.
Revised: The full statistics of the datasets can be found in Appendix A.1.

Original: Metrics Besides the model accuracy, we introduce two empirical fairness metrics, one under each of the two fairness criteria as in Eq.
Revised: Metrics Besides the model accuracy, we introduce two empirical fairness metrics, one under each of the two fairness criteria as in Eq.

Original: For binary classification, the metrics are calculated as:DP: ∑ z ∈Z ∣ p
Revised: For binary classiﬁcation, the metrics are calculated as:

Original: [Equation]
Revised: [Equation]

Original: where DP and EO stand for demographic parity and equalized odds respectively.
Revised: where DP and EO stand for demographic parity and equalized odds respectively.

Original: FPR and FNR are the false positive/negative rate, and the subscript z denotes the score is calculated within a specific demographic group 
Revised: FPR and FNR are the false positive/negative rate, and the subscript z denotes the score is calculated within a speciﬁc demographic group Z

Original: Z = z .
Revised: = z .

Original: For example, FPR male indicates the false positive rate calculated over all examples with the “male” annotation.
Revised: For example, FPR male indicates the false positive rate calculated over all examples with the “male” annotation.

Original: For a multi-class setting, the bias scores are first calculated similarly using one-vs-all for each class and then averaged across different classes.
Revised: For a multi-class setting, the bias scores are ﬁrst calculated similarly using one-vs-all for each class and then averaged across different classes.

Original: All reported results are the average of three different random runs.
Revised: All reported results are the average of three different random runs.

Original: It can be shown that these metrics are non-negative, and will become zero when their corresponding fairness criteria are achieved.
Revised: It can be shown that these metrics are non-negative, and will become zero when their corresponding fairness criteria are achieved.

Original: For better elaboration, we report the negative bias scores in our experiments, so the larger these negative scores are, the better the model satisfies the corresponding fairness criteria.
Revised: For better elaboration, we report the negative bias scores in our experiments, so the larger these negative scores are, the better the model satisﬁes the corresponding fairness criteria.

Original: Baselines and implementation details We consider the following models for comparison:
Revised: Baselines and implementation details We consider the following models for comparison:

Original: ● B ASE : the base model to be reprogrammed, trained with the cross-entropy loss on the training set.
Revised: ● B ASE : the base model to be reprogrammed, trained with the cross-entropy loss on the training set.

Original: ● A DV I N [33]: an in-processing adversarial training method that optimizes both model accuracy and fairness using the training set.
Revised: ● A DV I N [33]: an in-processing adversarial training method that optimizes both model accuracy and fairness using the training set.

Original: ● A DV P OST : a post-processing variant of A DV I N , which fine-tunes the B ASE model with the same fairness-aware adversarial objectives as A DV I N , but using the (low-resource) tunning set only.
Revised: ● A DV P OST : a post-processing variant of A DV I N , which ﬁne-tunes the B ASE model with the same fairness-aware adversarial objectives as A DV I N , but using the (low-resource) tunning set only.

Original: For NLP experiments, we use a pre-trained B ERT [62] to obtain the B ASE and A DV I N models.
Revised: For NLP experiments, we use a pre-trained B ERT [62] to obtain the B ASE and A DV I N models.

Original: We use A DAM W [63] as the optimizer, and set the learning rate to 10 − 5 for all baselines and 0 .for
Revised: We use A DAM W [63] as the optimizer, and set the learning rate to− 5 for all baselines and 0 .for

Original: F AIR R EPROGRAM .
Revised: F AIR R EPROGRAM .

Original: For CV experiments, we consider a R ES N ET -18 [64] that pre-trained on
Revised: For CV experiments, we consider a R ES N ET -18 [64] that pre-trained on

Original: ImageNet.
Revised: ImageNet.

Original: The discriminator used in A DV I N , A DV P OST and F AIR R EPROGRAM is a three-layer
Revised: The discriminator used in A DV I N , A DV P OST and F AIR R EPROGRAM is a three-layer

Original: MLP, and the parameters are optimized using A DAM with a learning rate of 0 .
Revised: MLP, and the parameters are optimized using A DAM with a learning rate of 0 .

Original: We pick the best model based on the accuracy (for the B ASE ) or the bias scores (for all other debiasing methods) of the validation set.
Revised: We pick the best model based on the accuracy (for the B ASE ) or the bias scores (for all other debiasing methods) of the validation set.

Original: We refer to Appendix A.2 for more details and Appendix B for more baseline studies.[Figure] [Figure] N e g a t
Revised: We refer to Appendix A.2 for more details and Appendix B for more baseline studies.

Original: i v e

Original: D [Figure]
Revised: [Figure]

Original: m o g r a p

Original: [Figure]
Revised: [Figure]

Original: i c

Original: [Figure]

Original: a

Original: [Figure] i t y [Figure] Next we introduce the implementation details of the triggers for different variants of F AIR R EPROGRAM .
Revised: Next we introduce the implementation details of the triggers for different variants of F AIR R EPROGRAM .

Original: For image classification task, we adopt the border and patch trigger as shown in Fig.
Revised: For image classiﬁcation task, we adopt the border and patch trigger as shown in Fig.

Original: 1, termed
Revised: 1, termed

Original: F AIR R EPROGRAM (B ORDER ) and F AIR R EPROGRAM (P ATCH )
Revised: F AIR R EPROGRAM (B ORDER ) and F AIR R EPROGRAM (P ATCH )

Original: correspondingly.
Revised: correspondingly.

Original: We define the trigger size as the width of the trigger frame for border trigger and the width of the square patch for patch trigger.
Revised: We deﬁne the trigger size as the width of the trigger frame for border trigger and the width of the square patch for patch trigger.

Original: Unless otherwise stated, the default trigger size for each setting are 20 and 80 .
Revised: Unless otherwise stated, the default trigger size for each setting are 20 and 80 .

Original: For text classification task, we introduce a probability vector v i to control the selection of trigger word for each position i .
Revised: For text classiﬁcation task, we introduce a probability vector v i to control the selection of trigger word for each position i .

Original: Specifically, we have the trigger δ i =
Revised: Speciﬁcally, we have the trigger  i =

Original: Ev i where E represents the pretrained word embedding matrix of B ERT .
Revised: Ev i where E represents the pretrained word embedding matrix of B ERT .

Original: Then we simply concatenate δ after all input textsin the embeddings space as the fairness trigger.
Revised: Then we simply concatenate  after all input textsin the embeddings space as the fairness trigger.

Original: We introduce two types of trigger.
Revised: We introduce two types of trigger.

Original: The first type, called F AIR R EPROGRAM (S OFT ) , uses continuous v
Revised: The ﬁrst type, called F AIR R EPROGRAM (S OFT ) , uses continuous v

Original: i ’s, and each v i is projected onto the continuous probability simplex using the bisection algorithm after each training step.
Revised: i ’s, and each v i is projected onto the continuous probability simplex using the bisection algorithm after each training step.

Original: The second type, called
Revised: The second type, called

Original: F AIR R EPROGRAM (H ARD ), discretizes each v i into a one-hot vector ˆ v i via arg max operation.
Revised: F AIR R EPROGRAM (H ARD ), discretizes each v i into a one-hot vector ˆ v i via arg max operation.

Original: We adopt the straight through technique [65] to update v i during training.
Revised: We adopt the straight through technique [65] to update v i during training.

Original: The triggers found by
Revised: The triggers found by

Original: F AIR R EPROGRAM (H ARD ) enjoy better interpretability as they correspond to a sequence of word tokens.
Revised: F AIR R EPROGRAM (H ARD ) enjoy better interpretability as they correspond to a sequence of word tokens.

Original: Unless specified otherwise, we set the trigger word number as five for our experiments.
Revised: Unless speciﬁed otherwise, we set the trigger word number as ﬁve for our experiments.

Original: 4.2 Results
Revised: 4.2 Results

Original: Fig.
Revised: Fig.

Original: 3 shows the performance of the proposed F AIR R EPROGRAM with other baselines on both NLP (subfigure (a)) and CV (subfigure (b)) datasets using DP (left) and EO (right) metrics.
Revised: 3 shows the performance of the proposed F AIR R EPROGRAM with other baselines on both NLP (subﬁgure (a)) and CV (subﬁgure (b)) datasets using DP (left) and EO (right) metrics.

Original: In each subfigure, the data samples of the same method (dots in the same color) are generated by explicit changing the adversary weight λ in (3), which controls the trade-off between fairness and accuracy.
Revised: In each subﬁgure, the data samples of the same method (dots in the same color) are generated by explicit changing the adversary weight  in (3), which controls the trade-off between fairness and accuracy.

Original: We further fit the data with polynomial regression to present the curves.
Revised: We further ﬁt the data with polynomial regression to present the curves.

Original: Appendix A.2 shows the detailed λ choices for different methods.
Revised: Appendix A.2 shows the detailed  choices for different methods.

Original: Here are our key observations.
Revised: Here are our key observations.

Original: First, our method improves the fairness of the B ASE model.
Revised: First, our method improves the fairness of the B ASE model.

Original: In particular, our methods (both orange and red curves) achieve higher negative DP and EO scores with a comparable classification accuracy.
Revised: In particular, our methods (both orange and red curves) achieve higher negative DP and EO scores with a comparable classiﬁcation accuracy.

Original: Second, our method enjoys a better fairness-accuracy trade-off compared with all other baselines.
Revised: Second, our method enjoys a better fairness-accuracy trade-off compared with all other baselines.

Original: Specifically, the curves of our method lie farther to the upper-right corner of the plots, which implies that our method
Revised: Speciﬁcally, the curves of our method lie farther to the upper-right corner of the plots, which implies that our method

Original: [Figure]
Revised: [Figure]

Original: We change the parameter λ to trade-off accuracy with fairness and draw the curves in the same way with Fig.

Original: The (cid:56) point corresponds to the average of all improves model fairness with fewer sacrifices on accuracy.
Revised: improves model fairness with fewer sacriﬁces on accuracy.

Original: It is also worth noting that although
Revised: It is also worth noting that although

Original: A DV I N achieves good fairness scores, it uses much more data for training.
Revised: A DV I N achieves good fairness scores, it uses much more data for training.

Original: Limited data setting We further evaluate A DV P OST and F AIR R EPROGRAM with decreasing the number of data in the tuning set.
Revised: Limited data setting We further evaluate A DV P OST and F AIR R EPROGRAM with decreasing the number of data in the tuning set.

Original: Specifically, we fix a λ for each method such that all methods achieve comparable bias score with full tuning set.
Revised: Speciﬁcally, we ﬁx a  for each method such that all methods achieve comparable bias score with full tuning set.

Original: The detailed λ choices are provided in Appendix A.2.
Revised: The detailed  choices are provided in Appendix A.2.

Original: Then we apply these methods to subsets of the tuning set with different proportions.
Revised: Then we apply these methods to subsets of the tuning set with different proportions.

Original: The results are shown in Fig.
Revised: The results are shown in Fig.

Original: There are two key observations.
Revised: There are two key observations.

Original: First, our method can consistently improve fairness upon B ASE model even with 1% tuning data, indicating a high data efficiency of F AIR R EPROGRAM .
Revised: First, our method can consistently improve fairness upon B ASE model even with 1% tuning data, indicating a high data efﬁciency of F AIR R EPROGRAM .

Original: Second, F AIR R EPROGRAM achieves better fairness than A DV P OST does when tuning data number decreases.
Revised: Second, F AIR R EPROGRAM achieves better fairness than A DV P OST does when tuning data number decreases.

Original: For example, in Fig.
Revised: For example, in Fig.

Original: 4 (a), the curve of our method is significantly above the A DV P OST as tuning data decreases.
Revised: 4 (a), the curve of our method is signiﬁcantly above the A DV P OST as tuning data decreases.

Original: When the tuning set size is extremely small, A DV P OST significantly deteriorates and even underperforms the B ASE model.
Revised: When the tuning set size is extremely small, A DV P OST signiﬁcantly deteriorates and even underperforms the B ASE model.

Original: Transferability Next, we show the transferability of the fairness triggers found by F AIR R EPROGRAM .
Revised: Transferability Next, we show the transferability of the fairness triggers found by F AIR R EPROGRAM .

Original: We first tune the triggers with a B ASE source model and then apply the trigger on a target model trained with a different random seed.
Revised: We ﬁrst tune the triggers with a B ASE source model and then apply the trigger on a target model trained with a different random seed.

Original: The results are shown in Fig.
Revised: The results are shown in Fig.

Original: As can be seen, F AIR R EPROGRAM achieves comparable fairnessaccuracy trigger on both the source model and the target model, indicating our method has a good transferability.
Revised: As can be seen, F AIR R EPROGRAM achieves comparable fairnessaccuracy trigger on both the source model and the target model, indicating our method has a good transferability.

Original: This intriguing property brings two benefits of our method: ① if ML model parameters are infeasible ( e.g. when ML models are provided as services), the users could train a surrogate model and tune the trigger based on it to promote fairness of the original model; ② when ML model parameters are updated with new data ( e.g. online learning), the user could still use the original trigger for fixing fairness problems.
Revised: This intriguing property brings two beneﬁts of our method: ¨ if ML model parameters are infeasible ( e.g. when ML models are provided as services), the users could train a surrogate model and tune the trigger based on it to promote fairness of the original model; ≠ when ML model parameters are updated with new data ( e.g. online learning), the user could still use the original trigger for ﬁxing fairness problems.

Original: We further elaborate the results of F AIR R EPROGRAM for transferring to different tasks and model architectures in Appendix B.5.
Revised: We further elaborate the results of F AIR R EPROGRAM for transferring to different tasks and model architectures in Appendix B.5.

Original: Input saliency attribution.
Revised: Input saliency attribution.

Original: Fig.
Revised: Fig.

Original: 7 and 6 compare the saliency maps of some example inputs with and without the fairness triggers.
Revised: 7 and 6 compare the saliency maps of some example inputs with and without the fairness triggers.

Original: Specifically, For the NLP applications, we extract a subset of Civil
Revised: Speciﬁcally, For the NLP applications, we extract a subset of Civil

Original: Comments with religion-related demographic annotations, and apply IG [67] to localize word pieces that contribute most to the text toxicity classification.
Revised: Comments with religion-related demographic annotations, and apply IG [67] to localize word pieces that contribute most to the text toxicity classiﬁcation.

Original: For the CV application, we use GradCam [66] to identify class-discriminative regions of CelebA ’s test images.
Revised: For the CV application, we use GradCam [66] to identify class-discriminative regions of CelebA ’s test images.

Original: As shown in Fig.
Revised: As shown in Fig.

Original: 7, our fairness trigger consists of a lot of religion-related words ( e.g. , diocesan, hebrew, parish).
Revised: 7, our fairness trigger consists of a lot of religion-related words ( e.g. , diocesan, hebrew, parish).

Original: Meanwhile, the predicted toxicity score of the benign text starting from ‘muslims’ significantly reduces.
Revised: Meanwhile, the predicted toxicity score of the benign text starting from ‘muslims’ signiﬁcantly reduces.

Original: These observations verify our theoretical hypothesis that the fairness trigger is strongly indicative of a certain demographic group to prevent the classifier from using the true demographic information.
Revised: These observations verify our theoretical hypothesis that the fairness trigger is strongly indicative of a certain demographic group to prevent the classiﬁer from using the true demographic information.

Original: In addition, Fig. 6 presents the input saliency maps on two input images with respect to their predicted
Revised: In addition, Fig. 6 presents the input saliency maps on two input images with respect to their predicted

Original: Text (Non-toxic)
Revised: Text (Non-toxic)

Original: Predicted Toxicity muslims need to take a look in the mirror 0.
Revised: Predicted Toxicity muslims need to take a look in the mirror 0.

Original: muslims need to take a look in the mirror same diocesan bula rev proceedings 0.
Revised: muslims need to take a look in the mirror same diocesan bula rev proceedings 0.

Original: muslims need to take a look in the mirror soto cc rib hebrew armenian 0.
Revised: muslims need to take a look in the mirror soto cc rib hebrew armenian 0.

Original: muslims need to take a look in the mirror paul long course parish body 0.[Figure] i [Figure]
Revised: muslims need to take a look in the mirror paul long course parish body 0.

Original: e

Original: [Figure]

Original: i t

Original: [Figure]
Revised: [Figure]

Original: labels, non-blond hair and blond hair, respectively.
Revised: labels, non-blond hair and blond hair, respectively.

Original: As can be observed, when there is no fairness trigger, the saliency region incorrectly concentrates on the facial parts, indicating the classifier is likely to use biased information, such as gender, for its decision.
Revised: As can be observed, when there is no fairness trigger, the saliency region incorrectly concentrates on the facial parts, indicating the classiﬁer is likely to use biased information, such as gender, for its decision.

Original: With the fairness trigger, the saliency region moves to the hair parts, which matches the behavior of A DV I N .
Revised: With the fairness trigger, the saliency region moves to the hair parts, which matches the behavior of A DV I N .

Original: These results confirm that our fairness trigger can drive models to make fairer predictions.
Revised: These results conﬁrm that our fairness trigger can drive models to make fairer predictions.

Original: [Table]
Revised: [Table]

Original: To further verify that the triggers encode demographic information, we trained a demographic classifier to predict the demographics from the input (texts or images) without triggers.
Revised: To further verify that the triggers encode demographic information, we trained a demographic classiﬁer to predict the demographics from the input (texts or images) without triggers.

Original: The obtained demographic classifiers can accurately identify the demographics contained in the inputs and achieve over 0.99 AUC for identifying demographics in the validation datasets.
Revised: The obtained demographic classiﬁers can accurately identify the demographics contained in the inputs and achieve over 0.99 AUC for identifying demographics in the validation datasets.

Original: Then, we use the demographic classifier to predict the demographic information of a null image/textwith the trigger.
Revised: Then, we use the demographic classiﬁer to predict the demographic information of a null image/textwith the trigger.

Original: Specifically, we select three triggers generated with different λ values for both two datasets.
Revised: Speciﬁcally, we select three triggers generated with different  values for both two datasets.

Original: The results 5 can be seen in
Revised: The results 5 can be seen in

Original: Table 1.
Revised: Table 1.

Original: We see that the demographic classifier gives confident outputs on the triggers.
Revised: We see that the demographic classiﬁer gives conﬁdent outputs on the triggers.

Original: For example, we see that the trigger paul long course parish body is classified as containing christian with 0.98 confidence, indicating that the found triggers are highly indicative of demographics.
Revised: For example, we see that the trigger paul long course parish body is classiﬁed as containing christian with 0.98 conﬁdence, indicating that the found triggers are highly indicative of demographics.

Original: This is consistent with our perspective in Section 3.4 that the fairness triggers are encoding fake demographic information to obscure ML models from making biased predictions.
Revised: This is consistent with our perspective in Section 3.4 that the fairness triggers are encoding fake demographic information to obscure ML models from making biased predictions.

Original: 4.3 Multi-Class Classification
Revised: 4.3 Multi-Class Classiﬁcation

Original: To extend our evaluation to a multi-class setting, we use the CelebA dataset and select n binary attributes that may be spuriously correlated with gender [59–61].
Revised: To extend our evaluation to a multi-class setting, we use the CelebA dataset and select n binary attributes that may be spuriously correlated with gender [59–61].

Original: Then, following [69], we construct data groups by enumerating all 2 n possible binary vectors, where each dimension corresponds to a binary attribute.
Revised: Then, following [69], we construct data groups by enumerating all 2 n possible binary vectors, where each dimension corresponds to a binary attribute.

Original: We index these vectors and treat them as the class labels.
Revised: We index these vectors and treat them as the class labels.

Original: Fig.
Revised: Fig.

Original: 8 shows the accuracy-fairness trade-off curves similar to Fig.
Revised: 8 shows the accuracy-fairness trade-off curves similar to Fig.

Original: It can be observed that our method outperforms the other methods as the red curves are closer to the top-right corner.
Revised: It can be observed that our method outperforms the other methods as the red curves are closer to the top-right corner.

Original: Also, as the class label number
Revised: Also, as the class label number

Original: [Figure]
Revised: [Figure]

Original: increases, the post-processing-based A DV P OST falls behind its in-processing counterpart A DV I N , indicating a larger class number may induce more challenges to post-processing methods.
Revised: increases, the post-processing-based A DV P OST falls behind its in-processing counterpart A DV I N , indicating a larger class number may induce more challenges to post-processing methods.

Original: 4.4 Ablation Studies
Revised: 4.4 Ablation Studies

Original: We perform an ablation study to investigate the effects of the trigger size.
Revised: We perform an ablation study to investigate the effects of the trigger size.

Original: Specifically, we run experiments with different numbers of trigger words / trigger patch sizes on the NLP / CV dataset.
Revised: Speciﬁcally, we run experiments with different numbers of trigger words / trigger patch sizes on the NLP / CV dataset.

Original: We set a λ value for each method such that all methods achieve comparable bias scores with the largest trigger size.
Revised: We set a  value for each method such that all methods achieve comparable bias scores with the largest trigger size.

Original: The detailed λ choices can be seen in Appendix A.2.
Revised: The detailed  choices can be seen in Appendix A.2.

Original: Then we train the triggers with different sizes in the tuning set using the fixed λ ’s. For the text trigger as shown in Fig.
Revised: Then we train the triggers with different sizes in the tuning set using the ﬁxed  ’s. For the text trigger as shown in Fig.

Original: 9(a), we see that the negative bias score gets worse as the number of trigger words gets smaller.
Revised: 9(a), we see that the negative bias score gets worse as the number of trigger words gets smaller.

Original: However, our method can still improve fairness upon the B ASE model even with only a one-word trigger.
Revised: However, our method can still improve fairness upon the B ASE model even with only a one-word trigger.

Original: On the other hand, the results with five trigger words and above are all comparable, indicating that five words is enough to achieve the fairness goal.
Revised: On the other hand, the results with ﬁve trigger words and above are all comparable, indicating that ﬁve words is enough to achieve the fairness goal.

Original: Similarly, for the image trigger as shown in Fig. 9(b), the results suggest a larger trigger would consistently improve fairness.
Revised: Similarly, for the image trigger as shown in Fig. 9(b), the results suggest a larger trigger would consistently improve fairness.

Original: On the other hand, we show that larger trigger size could hurt accuracy in Appendix B, which is similar to the effect of increasing λ .
Revised: On the other hand, we show that larger trigger size could hurt accuracy in Appendix B, which is similar to the effect of increasing  .

Original: 4.5 Summary of Additional Results
Revised: 4.5 Summary of Additional Results

Original: We compare our proposed F AIR R EPROGRAM with four additional baselines, and we show the full results with variance in Tab.
Revised: We compare our proposed F AIR R EPROGRAM with four additional baselines, and we show the full results with variance in Tab.

Original: We further compare our method with MMD methods where L fair in Eq.
Revised: We further compare our method with MMD methods where L fair in Eq.

Original: (3) is replaced with Maximum Mean Discrepancy regularization [70] to partial out the instability of adversarial training, and the results are shown in Fig.
Revised: (3) is replaced with Maximum Mean Discrepancy regularization [70] to partial out the instability of adversarial training, and the results are shown in Fig.

Original: We also implement the fairness reprogramming in the black-box setting on CelebA dataset, where the model parameters are not available for training the reprogram, and the results are shown in Fig.
Revised: We also implement the fairness reprogramming in the black-box setting on CelebA dataset, where the model parameters are not available for training the reprogram, and the results are shown in Fig.

Original: Besides, we show that
Revised: Besides, we show that

Original: F AIR R EPROGRAM could also be used in tabular data, and the corresponding experiment results on the Adult dataset are shown in Fig.
Revised: F AIR R EPROGRAM could also be used in tabular data, and the corresponding experiment results on the Adult dataset are shown in Fig.

Original:  Conclusion
Revised:  Conclusion

Original: In this paper, we introduce a novel model reprogramming based fairness promoting method, termed
Revised: In this paper, we introduce a novel model reprogramming based fairness promoting method, termed

Original: F AIR R EPROGRAM .
Revised: F AIR R EPROGRAM .

Original: Specifically, F AIR R EPROGRAM considers a fixed ML model and optimizes a set of vectors, named fairness trigger, concatenated on inputs to boost model fairness.
Revised: Speciﬁcally, F AIR R EPROGRAM considers a ﬁxed ML model and optimizes a set of vectors, named fairness trigger, concatenated on inputs to boost model fairness.

Original: We introduce an information-theoretic framework to explain the rationales of why F AIR R EPROGRAM can improve model fairness.
Revised: We introduce an information-theoretic framework to explain the rationales of why F AIR R EPROGRAM can improve model fairness.

Original: As implied by our theoretic framework as well as our empirical findings, the fairness trigger can effectively mask out the true demographic information with its strong, false demographic information.
Revised: As implied by our theoretic framework as well as our empirical ﬁndings, the fairness trigger can effectively mask out the true demographic information with its strong, false demographic information.

Original: Extensive experiments demonstrate that our method could achieve better fairness improvements to retraining based methods with far-less training cost.
Revised: Extensive experiments demonstrate that our method could achieve better fairness improvements to retraining based methods with far-less training cost.

Original: We further empirically show fairness triggers enjoys great transferability and interpretability.
Revised: We further empirically show fairness triggers enjoys great transferability and interpretability.

Original: We hope that F AIR R EPROGRAM can inspire new fairness learning paradigms that are more feasible and flexible in practice.
Revised: We hope that F AIR R EPROGRAM can inspire new fairness learning paradigms that are more feasible and ﬂexible in practice.

Original: Acknowledgement
Revised: Acknowledgement

Original: The work of Yihua Zhang, Sijia Liu, and Shiyu Chang was partially supported by National Science
Revised: The work of Yihua Zhang, Sijia Liu, and Shiyu Chang was partially supported by National Science

Original: Foundation (NSF) Grant IIS-2207052.
Revised: Foundation (NSF) Grant IIS-2207052.

Original: The computing resources used in this work were partially supported by the MIT-IBM Watson AI Lab.A Experiment Setup A.1 Dataset Details
Revised: The computing resources used in this work were partially supported by the MIT-IBM Watson AI Lab.

Original: The dataset splitting setting and demographic information of the datasets are shown in Tab. 2.

Original: A.2 Training Details

Original: We specify the different λ values used to generate the curves in Figs.

Original: 3 and Figs. 5 in Tab. 3.

Original: For Civil Comments in Figs 4 and 9, we set λ = 0 .

Original: [-5 for A DV P OST , λ = 50 . 
-]
Revised: [-5 for A DV P OST , λ = 50 . 
-]

Original: [-for F AIR R EPROGRAM (S OFT ) and λ = 1000 . 
-]
Revised: [-for F AIR R EPROGRAM (S OFT ) and λ = 1000 . 
-]

Original: for F AIR R EPROGRAM (H ARD ) with the DP measure; we set λ = 1 . 0 for

Original: [-A DV P OST and λ = 50 . 
-]
Revised: [-A DV P OST and λ = 50 . 
-]

Original: for both of our methods with the EO measure.

Original: For CelebA in Fig.

Original: 4 and Fig.

Original: 9, we set λ = 1 . 0 for F AIR R EPROGRAM (B ORDER ) and F AIR R EPROGRAM (P ATCH ) with DP and we set λ

Original: [-= 10 . 
-]
Revised: [-= 10 . 
-]

Original: for both with EO.

Original: By default, the trigger size of F AIR R EPROGRAM (B ORDER ) is set to 20, which corresponds to the width of the trigger frame.

Original: The trigger size of F AIR R EPROGRAM (P ATCH ) is fixed to 80, namely the width of the trigger block attached to the original input image.

Original: For A DV I N and A DV P OST , the λ is set to 0.1 in the setting with

Original: DP and λ is fixed to 0.5 for training with EO.

Original: The value of λ is selected so that different methods achieve comparable bias scores.

Original: B Additional Experiment Results B.1 Experiments with Additional Post-processing Baselines

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Figure]

Original: We further compare our method with four extra post-processing fairness-promoting baselines

Original: ● E Q O DDS [22]: Method that alters model predictions to meet equalized odds by solving a linear program.

Original: ● C ALI E Q O DDS [71]: Method that optimizes the model outputs to achieve a relaxed equalized odds objective together with calibration with information withholding.

Original: ● R EJECT O PTION [27]: Method that tunes model outputs with more favorable labels to minority groups (vice versa) in the low confidence region of classifiers to achieve better demographic parity.

Original: ● DIR EMOVER [72]: Disparate impact remover is proposed as a pre-processing fairness promoting method, which modifies

Original: input features with rank-ordering preserving operations.

Original: We simply apply the method to modify model predictions as a post-processing method to promote demographic parity.

Original: E Q O DDS , C ALI E Q O DDS and R

Original: EJECT O PTION are trained on the tuning set and then applied on testing set while DIR EMOVER directly tune the model predictions on the testing set.

Original: We use the implementation [73] for all four baselines.

Original: The results can be seen in Table 3.

Original: We see that our method consistently outperforms these baselines with improved fairness-accuracy trade-off.

Original: For example, we see that F AIR R EPROGRAM (B ORDER ) can achieve -0.167 negative EO and 0.951 accuracy in CelebA with λ = 5 . 0 .

Original: By contrast, the bestperforming post-processing baseline achieves much worse accuracy (0.927).

Original: Similar comparisons can also be seen in Civil Comments , where the best post-processing baseline can achieve -0.

Original: negative EO score and 0.915 accuracy, while our method F AIR R EPROGRAM (S OFT ) can achieve -0.011 negative EO with 0.917 accuracy with λ

Original: = 50 . 0 .

Original: B.2 Experiments with Additional MMD Baselines

Original: To partial out the instability of the adversarial training, we further compare our method with MMD method, where the adversarial loss L fair in Eq.

Original: (3) is replaced with the Maximum Mean Discrepancy regularization [70].

Original: Specifically, we consider M MD I N and M MD P OST , where model parameters are trained from scratch in an in-processing manner and fine-tuned in a post-processing manner, respectively, following the settings for adversarial training in Section 4.1.

Original: The experiment results on the Civil Comments dataset are presented in Fig.

Original: As we can see, our proposed method

Original: F AIR R EPROGRAM outperforms the MMD baselines, which can alleviate the concern that fairness reprogramming has a better performance simply because of the instability of adversarial training of the baselines.

Original: [Figure]

Original: B.3 Black-box F AIR R EPROGRAM Generation

Original: Previous experiments are all based on the white-box setting, which assumes access to the complete model information, such as model architectures and parameters.

Original: This precludes the use case of reprogramming a well-trained but access-limited model, e

Original: [Figure]

Original: g. , a commercial APIs or other query-based software [9].

Original: Thus, we further explore the feasibility of our method in the black-box setup [9, 74], where the gradients of the pre-trained model are estimated using only function queries.

Original: We follow the general black-box setting in [9] and adopt a query number of 30.

Original: The results are summarized in Fig.

Original: As we can see, out algorithm can still improve the fairness without the knowledge of the model information.

Original: However, in such a case, the gain in fairness would sacrifice the accuracy largely when compared to our baselines.

Original: While in the future work, we will try to mitigate such degradation using more query numbers[9] and coordinate gradient estimation (CGE) [74] to achieve more accurate gradient estimation.

Original: [Figure]

Original: B.4 Results with Standard Derivation

Original: The numerical results in Figs.

Original: 3, 4 and 9 with standard derivation are correspondingly presented in

Original: Tabs 3, 4 and 5.

Original: B.5 Transfer experiments with different tasks and model architectures

Original: We further test the transferability of reprogramming to different tasks and model architectures as shown in Fig.

Original: Specifically, for transfer setting, the reprogram is optimized on the (ResNet-18,

Original: [Table]

Original: [Figure]

Original: [Table]

Original: [Figure]

Original: [Figure]

Original: CelebA ) with the task of predicting the hair color, and evaluated on (ResNet-20, CelebA ) with the task of predicting smiling.

Original: For both tasks, the attribute gender is chosen as the demographic information throughout the experiments.

Original: We can see that the trigger still has good transferability with different model architectures.

Original: Meanwhile, we find that the triggers are able to boost the fairness of the model in the task-transfer setting, but the accuracy is traded off more than the original setting.

Original: B.6 Experiments on Reprogramming Tabular Data

Original: We show that F AIR R EPROGRAM could also be applied to tabular data.

Original: For reprogramming, there are many ways to design triggers according to different tasks and requirements.

Original: Unlike NLP, where we append the trigger to the input or embeddings, the model for tabular data is sensitive to the input size.

Original: As the tabular data have a fixed input size, we can directly apply the additive trigger to the input data to keep the input dimension unchanged (i.e., adding a perturbation on the original input), just as we adopted in image domains in Fig. 1.b.

Original: To verify our argument, we conducted additional experiments on the UCI Adult dataset [75] with a two-layer MLP model, and the results are shown in

Original: Fig.

Original: Our method achieves comparable debiasing performance with the post-processing adversarial training method without modifying any model parameters.

Original: The results suggest that our method could effectively improve model fairness for tabular data.

Original: [Figure]

Original: [Figure]

Original: C Theoretical Proofs

Original: In this section, we will provide formal proofs to the claims and theorem in the main paper.

Original: C.1 Sufficient Statistics

Original: We will show that p Y (⋅∣ X ( y ) ) and p Z (⋅∣ X ( z ) ) are the sufficient statistics of X ( y ) and X ( z ) respectively for inferring Y .

Original: Formally, what we need to show is

Original: [Equation]

Original: and

Original: [Equation]

Original: Eq.

Original: (9) is an identity.

Original: To show Eq.

Original: [Equation]

Original: The second equality is because Y and X ( z ) are independent conditional on Z , so replacing X ( z ) with any functions of X ( z ) would not change the conditional probability.

Original: The third equality is implied from the identity p ( Z ∣ X ( z ) ) =

Original: p ( Z ∣ p Z (⋅∣ X ( z ) )) .

Original: Using the sufficient statistics, it is very easy to show that p ( Y ∣ X ) is a special case of Eq.

Original: [Equation]

Original: (⋅∣ X ( y ) ) ,p Z (⋅∣ X ( z ) )) .

Original: C.2 Proof to Thm.

Original: We first provide the regularity conditions as stated in Thm. 1.

Original: Conditional Independence.

Original: The features in X ( y ) and X ( z ) are independent and identically distributed conditional on Y and Z respectively.

Original: [Equation]

Original: Infrequent Strong Demographic Features.

Original: The probability of occurrence of features that are very strongly indicative against a certain demographic group

Original: is

Original: low

Original: Formally ∀

Original: z

Original: ∀ ε > 0 , ∃ σ

Original: >

Original: , such that define

Original: [Equation]

Original: we have

Original: [Equation]

Original: Continuous Classifier.

Original: h (⋅ , ⋅) is continuous with respect to both arguments.

Original: With these assumptions, we will state the following lemma.

Original: Lemma 1.1.

Original: Consider the case where Z takes on K different values, i.e. , there are K demographic groups.

Original: Then

Original: [Equation]

Original: where c is a K-dimensional one-hot vector with the z -th dimension equal to 1 and 0 elsewhere.

Original: Proof.

Original: According to Assumption 2 (Eq.

Original: [Equation]

Original: where S( σ ) is defined in Eq.

Original: On the other hand, consider the following composite function

Original: [Equation]

Original: Note that this is different from H ( Z ∣ h ( p trY (⋅∣ X ( y ) ) ,p trZ (⋅∣ X ( z ) =

Original: ˜ X ( z ) )) ,Y ) , which is essentially the expectation of Eq.

Original: (16) over different values of x ( z ) .

Original: Since the conditional entropy is continuous and bounded, and h (⋅ , ⋅) is continuous over both of its arguments with finite support, Eq.

Original: (16) is uniformly continuous with respect to p trZ (⋅∣ X ( z ) )) .

Original: Therefore, given the aforementioned ε , ∃ 0 < η < 1 ,

Original: [Equation]

Original: Now, divide the support of X ( z ) into two disjoint sets.

Original: For notational conciseness, define

Original: [Equation]

Original: Then the two sets, denoted as A and B respectively, are divided according to whether r ( x ( z ) ) exceeds a threshold, i.e.

Original: [Equation]

Original: ∀ x (

Original: [Equation]

Original: ) ∈ A , define

Original: [Equation]

Original: where G = max z

Original: [Equation]

Original: Then we will show that

Original: [Equation]

Original: and hence Eq.

Original: (17) holds.

Original: This is because, according to the Bayesian rule,

Original: [Equation]

Original: Therefore

Original: [Equation]

Original: As a result

Original: [Equation]

Original: where the first line is implied from the Bayesian rule and assumption 1 (similar to Eq.

Original: ; the second line is implied from the definition of r ( x z ) as in Eq.

Original: (18); the third line is due to the definition of set A as in Eq.

Original: (19) (note that the scope of Eq.

Original: (21) is confined to ∀ x ( z ) ∈ A ); the last line is implied from Eq.

Original: (23) and the definition of ζ as in Eq.

Original: It then follows that

Original: [Equation]

Original: where the first line is implied from the definition of the one-hot vector c as well as the fact that the probability mass function is alwasy between 0 and 1; the second line is given by the fact that any probability mass functions sum to 1; and the last line is given by Eq.

Original: This concludes the proof to Eq.

Original: Next, notice that

Original: [Equation]

Original: Thus

Original: [Equation]

Original: In the following, we will bound the two terms respectively.

Original: For the first term in Eq.

Original: (27), Eq.

Original: (21) applies because x ( z ) ∈ A .

Original: Therefore, according to Eq.

Original: (21) and (17), when p tr ( Z = z

Original: [-∣ X ( z ) 
-]
Revised: [-∣ X ( z ) 
-]

Original: = δ ) ≥ 1 − ζ , we have

Original: [Equation]

Original: For the second term, notice that when x ( z ) ∈ B , r ( x ( z ) ) >

Original: σ − 1 − 1 (according to Eq.

Original: So it follows that

Original: [Equation]

Original: According to (15)

Original: [Equation]

Original: this implies

Original: [Equation]

Original: and further

Original: [Equation]

Original: Plugging Eqs.

Original: (28) and (31) into Eq.

Original: (27), we can finally establish that ∀ ε > 0 , ∃ ζ > 0 (one possible ζ as defined in Eq.

Original: (20)), when p tr ( Z =

Original: z

Original: [-∣ X ( z ) 
-]
Revised: [-∣ X ( z ) 
-]

Original: = δ ) ≥ 1 − ζ , we have

Original: [Equation]

Original: Hence this concludes the proof to Lemma 1.1.

Original: With Lemma 1.1, we are ready to prove Thm 1.

Original: Proof.

Original: Note that

Original: [Equation]

Original: The inequality sign is given by the data processing inequality; the equality is given by the fact that Z and X ( y ) are independent conditional on Y .

Original: On the other hand,

Original: [Equation]

Original: Combining Eqs.

Original: (33) and (34), we have

Original: [Equation]

Original: [-According to Lemma 1.1, when p tr ( Z = z ∣ X ( z ) 
-]
Revised: [-According to Lemma 1.1, when p tr ( Z = z ∣ X ( z ) 
-]

Original: = δ ) → 1 ,

Original: H ( Z ∣ h ( p trY (⋅∣ X ( y ) ) ,p trZ (⋅∣ X ( z ) =

Original: ˜ X ( z ) )) ,Y )

Original: → H ( Z ∣ h ( p trY (⋅∣ X ( y ) ) ,c ) ,Y ) =

Original: H ( Z ∣ Y ) .

Original: C.3 Discussion on Feature Disentanglement Assumption

Original: In Section 3.4, we made a simplifying assumption that all features could be divided into two disentangled groups, i.e. , X =

Original: [ X y , X z ] , which are governed by the output label Y and demographic information Z , respectively.

Original: The corresponding data generation process could be seen in Figure 2.

Original: On the other hand, however, if features are entangled in practice, we show that F AIR R EPROGRAM can still provide false demographic information to overshadow the true demographics in Table 1.

Original: D Broader Impact

Original: Although there has been a proliferation of works in promoting ML fairness, most methods require training or finetuning the existing models to meet certain fairness notions.

Original: However, this could bring large computational and storage costs, low data efficiency, and model privacy issues with those large-scaled trained models.

Original: Inspired by recent advances in model reprogramming techniques, we propose a new generic postprocessing fairness learning framework.

Original: Specifically, we consider a fixed ML model and optimize a fairness trigger that is appended to the inputs with a min-max formulation.

Original: The proposed method enjoys a better fairness-accuracy trade-off compared with vast fairness promoting baselines with far less training costs.

Original: Despite the effectiveness of our method, we note that our method still has some limitations.

Original: As a future research remark, our method still requires demographic annotations to remove biases, which could be hard to acquire in practice.

Original: It remains an open problem to develop a fairness-promoting technique without the use of demographics annotations.

Original: We do not observe any potential negative societal impacts of our method.

Original: Instead, we believe that the outcome of our work could help enhance fairness of AI systems in a computationally-efficient and constraint-least manner.

Original: It can also provide broad positive impacts on diverse areas where AI techniques are applied.