Original: C ONFIDENTIAL -PROFITT: C ONFIDENTIAL PRO OF OF F A I R T RAINING OF T REES
Revised: C ONFIDENTIAL -PROFITT: C ONFIDENTIAL PRO OF OF F A I R T RAINING OF T REES

Original: Anonymous authors

Original: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Post hoc auditing of model fairness suffers from potential drawbacks: (1) auditing may be highly sensitive to the test samples chosen; (2) the model and/or its training data may need to be shared with an auditor thereby breaking confidentiality.
Revised: Post hoc auditing of model fairness suffers from potential drawbacks: (1) auditing may be highly sensitive to the test samples chosen; (2) the model and/or its training data may need to be shared with an auditor thereby breaking confidentiality.

Original: We address these issues by instead providing a certificate that demonstrates that the learning algorithm itself is fair, and hence, as a consequence, so too is the trained model.
Revised: We address these issues by instead providing a certificate that demonstrates that the learning algorithm itself is fair, and hence, as a consequence, so too is the trained model.

Original: We introduce a method to provide a confidential proof of fairness for training, in the context of widely used decision trees, which we term Confidential-PROFITT.
Revised: We introduce a method to provide a confidential proof of fairness for training, in the context of widely used decision trees, which we term Confidential-PROFITT.

Original: We propose novel fair decision tree learning algorithms along with customized zero-knowledge proof protocols to obtain a proof of fairness that can be audited by a third party.
Revised: We propose novel fair decision tree learning algorithms along with customized zero-knowledge proof protocols to obtain a proof of fairness that can be audited by a third party.

Original: Using zero-knowledge proofs enables us to guarantee confidentiality of both the model and its training data.
Revised: Using zero-knowledge proofs enables us to guarantee confidentiality of both the model and its training data.

Original: We show empirically that bounding the information gain of each node with respect to the sensitive attributes reduces the unfairness of the final tree.
Revised: We show empirically that bounding the information gain of each node with respect to the sensitive attributes reduces the unfairness of the final tree.

Original: In extensive experiments on the COMPAS, Communities and Crime, Default Credit, and Adult datasets, we demonstrate that a company can use Confidential-PROFITT to certify the fairness of their decision tree to an auditor in less than 2 minutes, thus indicating the applicability of our approach.
Revised: In extensive experiments on the COMPAS, Communities and Crime, Default Credit, and Adult datasets, we demonstrate that a company can use Confidential-PROFITT to certify the fairness of their decision tree to an auditor in less than 2 minutes, thus indicating the applicability of our approach.

Original: This is true for both the demographic parity and equalized odds definitions of fairness.
Revised: This is true for both the demographic parity and equalized odds definitions of fairness.

Original: Finally, we extend Confidential-PROFITT to apply to ensembles of trees.
Revised: Finally, we extend Confidential-PROFITT to apply to ensembles of trees.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: The deployment of machine learning models in high-stake decision systems (Waddell, 2016; Benjamens et al., 2020; Kleinberg et al., 2018) is associated with the risk of unfair decisions towards particular subgroups defined by sensitive attributes (Dwork et al., 2012).
Revised: The deployment of machine learning models in high-stake decision systems (Waddell, 2016; Benjamens et al., 2020; Kleinberg et al., 2018) is associated with the risk of unfair decisions towards particular subgroups defined by sensitive attributes (Dwork et al., 2012).

Original: A canonical approach for auditing such deployment is to measure the fairness of a trained model on a reference dataset (Pentyala et al., 2022).
Revised: A canonical approach for auditing such deployment is to measure the fairness of a trained model on a reference dataset (Pentyala et al., 2022).

Original: In practice, this would be done by an external party (i.e., an auditor ).
Revised: In practice, this would be done by an external party (i.e., an auditor ).

Original: Such audits, however, can be difficult to organize and are sensitive to the choice of reference dataset (Fukuchi et al., 2020).
Revised: Such audits, however, can be difficult to organize and are sensitive to the choice of reference dataset (Fukuchi et al., 2020).

Original: This may lead to a form of unhelpful interaction between the company and the auditor, in which the company could deny a model is unfair by claiming that the reference dataset does not belong to the training distribution used, or the auditor can forge a reference dataset that could be used to blame the company for unfair predictions.
Revised: This may lead to a form of unhelpful interaction between the company and the auditor, in which the company could deny a model is unfair by claiming that the reference dataset does not belong to the training distribution used, or the auditor can forge a reference dataset that could be used to blame the company for unfair predictions.

Original: One avenue to address this problem would be for the company to release its training data and the model to the auditor who can then verify that a fair training algorithm was used by e.g., locally rerunning the training process.
Revised: One avenue to address this problem would be for the company to release its training data and the model to the auditor who can then verify that a fair training algorithm was used by e.g., locally rerunning the training process.

Original: However, this approach does not protect the confidentiality of the company’s training data.
Revised: However, this approach does not protect the confidentiality of the company’s training data.

Original: In this paper, we remediate these issues by introducing confidential proofs of fair training.
Revised: In this paper, we remediate these issues by introducing confidential proofs of fair training.

Original: We highlight that our method does not guarantee fairness.
Revised: We highlight that our method does not guarantee fairness.

Original: Rather, our approach employs a tunable parameter controlling the resulting degree of fairness.
Revised: Rather, our approach employs a tunable parameter controlling the resulting degree of fairness.

Original: The certificate we provide proves that our approach was employed, and also includes the specific parameter value used, and the resulting fairness metrics on the training data.
Revised: The certificate we provide proves that our approach was employed, and also includes the specific parameter value used, and the resulting fairness metrics on the training data.

Original: We call this approach “fairness-aware training”, or “fair training” for short.
Revised: We call this approach “fairness-aware training”, or “fair training” for short.

Original: Concretely, we design a framework (i.e., Confidential-PROFITT) that allows a company to directly prove to the auditor, through the execution of a cryptographic protocol, that the learning algorithm used to train the model was fair by design.
Revised: Concretely, we design a framework (i.e., Confidential-PROFITT) that allows a company to directly prove to the auditor, through the execution of a cryptographic protocol, that the learning algorithm used to train the model was fair by design.

Original: To achieve this without revealing the company’s dataset or model to the auditor, we rely on zero knowledge (ZK) proofs (Goldwasser et al., 1985;
Revised: To achieve this without revealing the company’s dataset or model to the auditor, we rely on zero knowledge (ZK) proofs (Goldwasser et al., 1985;

Original: Goldreich et al., 1991), which allow a party to prove statements about their private data without revealing it.
Revised: Goldreich et al., 1991), which allow a party to prove statements about their private data without revealing it.

Original: Our framework is generic in the sense that it allows the company to prove to interested parties (e.g., users in addition to the auditor)
Revised: Our framework is generic in the sense that it allows the company to prove to interested parties (e.g., users in addition to the auditor)

Original: the fairness of the model learning process—thus increasing public trust in the model.
Revised: the fairness of the model learning process—thus increasing public trust in the model.

Original: We instantiate the confidential proof of fair training in the context of decision trees, which are widely used by companies in sensitive domains such as healthcare (Podgorelec et al., 2002) and finance (Ghatasheh, 2014; Güntay et al., 2022), in part due to their performance, in their ability to be leveraged in ensemble methods (e.g.,, random forests), and also, occasionally, due to their assumed interpretability (Molnar, 2020).
Revised: We instantiate the confidential proof of fair training in the context of decision trees, which are widely used by companies in sensitive domains such as healthcare (Podgorelec et al., 2002) and finance (Ghatasheh, 2014; Güntay et al., 2022), in part due to their performance, in their ability to be leveraged in ensemble methods (e.g.,, random forests), and also, occasionally, due to their assumed interpretability (Molnar, 2020).

Original: We propose a cryptographic protocol that can prove the fair training of decision trees with various common fairness definitions including demographic parity (Calders et al., 2009) and equalized odds (Hardt et al., 2016).
Revised: We propose a cryptographic protocol that can prove the fair training of decision trees with various common fairness definitions including demographic parity (Calders et al., 2009) and equalized odds (Hardt et al., 2016).

Original: Fair decision tree learning builds a decision tree iteratively by splitting its dataset according to a criterion capturing the information gain with respect to both the class and sensitive attributes.
Revised: Fair decision tree learning builds a decision tree iteratively by splitting its dataset according to a criterion capturing the information gain with respect to both the class and sensitive attributes.

Original: In particular, our criterion addresses issues of prior fair training algorithms by connecting information gain with respect to the sensitive attribute to demographic parity.
Revised: In particular, our criterion addresses issues of prior fair training algorithms by connecting information gain with respect to the sensitive attribute to demographic parity.

Original: To render the verification more efficient, once it is implemented cryptographically, we propose a co-design involving concepts originating from both machine learning and cryptography.
Revised: To render the verification more efficient, once it is implemented cryptographically, we propose a co-design involving concepts originating from both machine learning and cryptography.

Original: First, we design a ZK-friendly fair decision tree learning algorithm based on the insight that verifying fairness is sufficient because the accuracy is of no interest for the auditor.
Revised: First, we design a ZK-friendly fair decision tree learning algorithm based on the insight that verifying fairness is sufficient because the accuracy is of no interest for the auditor.

Original: Prior works (Kamiran et al., 2010;
Revised: Prior works (Kamiran et al., 2010;

Original: Raff et al., 2018) on fair decision tree learning consider only demographic parity and view the problem as as a joint optimization problem between accuracy and demographic parity.
Revised: Raff et al., 2018) on fair decision tree learning consider only demographic parity and view the problem as as a joint optimization problem between accuracy and demographic parity.

Original: The optimal solution is obtained by searching exhaustively through an enumeration of all possible attributes and split points.
Revised: The optimal solution is obtained by searching exhaustively through an enumeration of all possible attributes and split points.

Original: However, in ZK, the whole exhaustive search would need to be proven using heavy cryptographic machinery, which is computationally expensive in most settings of interest.
Revised: However, in ZK, the whole exhaustive search would need to be proven using heavy cryptographic machinery, which is computationally expensive in most settings of interest.

Original: To address this, we propose a generalized framework that formulates training as a constrained optimization problem, in which fairness is represented as a constraint and the accuracy is the objective of optimization.
Revised: To address this, we propose a generalized framework that formulates training as a constrained optimization problem, in which fairness is represented as a constraint and the accuracy is the objective of optimization.

Original: As a result, we only need to verify the satisfaction of the constraint in ZK without verifying the accuracy.
Revised: As a result, we only need to verify the satisfaction of the constraint in ZK without verifying the accuracy.

Original: Second, we propose an efficient ZK protocol that can perform the aforementioned fairness constraint verification efficiently using state-of-the-art ZK protocols in the RAM model (Franzese et al., 2021).
Revised: Second, we propose an efficient ZK protocol that can perform the aforementioned fairness constraint verification efficiently using state-of-the-art ZK protocols in the RAM model (Franzese et al., 2021).

Original: Instead of using a naïve verification approach that requires proving a computation as long as the training process, we design a fairness verification protocol with complexity sublinear to the training phase.
Revised: Instead of using a naïve verification approach that requires proving a computation as long as the training process, we design a fairness verification protocol with complexity sublinear to the training phase.

Original: In summary, we propose a novel way of auditing model fairness by proving directly that the training algorithm itself is fair rather than inspecting the model and its predictions.
Revised: In summary, we propose a novel way of auditing model fairness by proving directly that the training algorithm itself is fair rather than inspecting the model and its predictions.

Original: As a consequence, we do not need a reference dataset and both the training data and the model remain confidential, i.e., are not disclosed to the auditor.
Revised: As a consequence, we do not need a reference dataset and both the training data and the model remain confidential, i.e., are not disclosed to the auditor.

Original: We highlight the following contributions:
Revised: We highlight the following contributions:

Original: We propose a new ZK-friendly fair decision tree learning algorithm such that its fairness can be verified efficiently without repeating the entire training process.
Revised: We propose a new ZK-friendly fair decision tree learning algorithm such that its fairness can be verified efficiently without repeating the entire training process.

Original: We summarize existing fairness metrics and show that our approach is generally applicable to these metrics.
Revised: We summarize existing fairness metrics and show that our approach is generally applicable to these metrics.

Original: We design and implement a specialized ZK proof protocol to efficiently verify the fairness of the above training algorithm.
Revised: We design and implement a specialized ZK proof protocol to efficiently verify the fairness of the above training algorithm.

Original: While prior works exist in secure inference using ZK proofs, to the best of our knowledge we are the first to propose secure training using ZK proofs.
Revised: While prior works exist in secure inference using ZK proofs, to the best of our knowledge we are the first to propose secure training using ZK proofs.

Original: We implement and evaluate our framework in terms of accuracy, fairness, running time and scalability using decision trees and random forests trained on a variety of real-world datasets.
Revised: We implement and evaluate our framework in terms of accuracy, fairness, running time, and scalability using decision trees and random forests trained on a variety of real-world datasets.

Original: For example on the Community and Crime dataset, Confidential-PROFITT can provide a certificate in less than 9 seconds that the company employed our fair training algorithm and obtained a decision tree.
Revised: For example on the Community and Crime dataset, Confidential-PROFITT can provide a certificate in less than 9 seconds that the company employed our fair training algorithm and obtained a decision tree.

Original: In this example, our fair training algorithm can improve the equalized odds fairness, which is not supported by prior works (Kamiran et al., 2010; Raff et al., 2018), by 50% with negligible effects on the accuracy.
Revised: In this example, our fair training algorithm can improve the equalized odds fairness, which is not supported by prior works (Kamiran et al., 2010; Raff et al., 2018), by 50% with negligible effects on the accuracy.

Original: In our implementation, Confidential-PROFITT provides the same certificate for random forests in 70 seconds.
Revised: In our implementation, Confidential-PROFITT provides the same certificate for random forests in 70 seconds.

Original:  P ROBLEM S TATEMENT , B ACKGROUND , AND R ELATED W ORK
Revised:  P ROBLEM S TATEMENT , B ACKGROUND , AND R ELATED W ORK

Original: Problem statement.
Revised: Problem statement.

Original: Ignoring fairness in the training process may result in models that negatively affect users belonging to specific subgroups with respect to a sensitive attribute such as gender, race or disability (Kamiran & Calders, 2009; Raff et al., 2018).
Revised: Ignoring fairness in the training process may result in models that negatively affect users belonging to specific subgroups with respect to a sensitive attribute such as gender, race or disability (Kamiran & Calders, 2009; Raff et al., 2018).

Original: For example, Buolamwini & Gebru (2018) demonstrated that darker-skinned women are the most misclassified demographic group in commercially-used facial recognition systems.
Revised: For example, Buolamwini & Gebru (2018) demonstrated that darker-skinned women are the most misclassified demographic group in commercially-used facial recognition systems.

Original: Similarly, Amazon’s automated recruiting system displayed a negative bias against hiring women 1 .
Revised: Similarly, Amazon’s automated recruiting system displayed a negative bias against hiring women 1 .

Original: Therefore, it is important for companies to demonstrate that their models have been trained with fairness constraints associated with minimizing negative biases.
Revised: Therefore, it is important for companies to demonstrate that their models have been trained with fairness constraints associated with minimizing negative biases.

Original: Our objective in this work is to provide a certificate proving that a company employs a fair training algorithm with a tunable parameter controlling the resulting degree of fairness 2 .
Revised: Our objective in this work is to provide a certificate proving that a company employs a fair training algorithm with a tunable parameter controlling the resulting degree of fairness 2 .

Original: This is challenging for several reasons.
Revised: This is challenging for several reasons.

Original: First, the sharing of data, collected predominantly from users, with the third party might not be permitted due to the associated privacy risks (Shokri & Shmatikov, 2015).
Revised: First, the sharing of data, collected predominantly from users, with the third party might not be permitted due to the associated privacy risks (Shokri & Shmatikov, 2015).

Original: Second, confidentiality issues also arise as companies are usually not willing to disclose their models to protect their intellectual property (Zhang et al., 2018).
Revised: Second, confidentiality issues also arise as companies are usually not willing to disclose their models to protect their intellectual property (Zhang et al., 2018).

Original: Thus, the proof of fairness should ensure both the confidentiality of the training data as well as that of the model.
Revised: Thus, the proof of fairness should ensure both the confidentiality of the training data as well as that of the model.

Original: More formally, we consider two parties: a prover (i.e., company, with a private training dataset
Revised: More formally, we consider two parties: a prover (i.e., company, with a private training dataset

Original: D =
Revised: D =

Original: { X, Y } in which X and Y denote respectively, the set of dataset attributes and ground-truth labels) and a verifier (i.e., auditor).
Revised: { X, Y } in which X and Y denote respectively, the set of dataset attributes and ground-truth labels) and a verifier (i.e., auditor).

Original: Both the prover and verifier must agree on the dimensions of ( X, Y ) and the sensitive attribute a , which is one of the columns of X , and a fair decision tree training algorithm A ( · , · ) (in practice the prover is likely to be the entity deciding these parameters as they are also responsible for training the model).
Revised: Both the prover and verifier must agree on the dimensions of ( X, Y ) and the sensitive attribute a , which is one of the columns of X , and a fair decision tree training algorithm A ( · , · ) (in practice the prover is likely to be the entity deciding these parameters as they are also responsible for training the model).

Original: For the sake of simplicity, we assume that Y and a are binary and we use DT ← A ( X, Y ) to denote the resulting decision tree.
Revised: For the sake of simplicity, we assume that Y and a are binary and we use DT ← A ( X, Y ) to denote the resulting decision tree.

Original: Our Confidential PROof of FaIr
Revised: Our Confidential PROof of FaIr

Original: Tree Training (Confidential-PROFITT) enables the prover to prove to the verifier that it has a DT model, which is indeed correctly computed as A ( X, Y ) .
Revised: Tree Training (Confidential-PROFITT) enables the prover to prove to the verifier that it has a DT model, which is indeed correctly computed as A ( X, Y ) .

Original: See Appendix A for a table of our notations.
Revised: See Appendix A for a table of our notations.

Original: Fairness.
Revised: Fairness.

Original: Many fairness metrics have been defined based on different philosophical and moral assumptions (Heidari et al., 2019; Narayanan, 2018).
Revised: Many fairness metrics have been defined based on different philosophical and moral assumptions (Heidari et al., 2019; Narayanan, 2018).

Original: To show the generalizability of our framework, we consider four common notions of group fairness.
Revised: To show the generalizability of our framework, we consider four common notions of group fairness.

Original: Demographic Parity ignores the ground-truth label and ensures the equal probability of a predicted positive label across subgroups.
Revised: Demographic Parity ignores the ground-truth label and ensures the equal probability of a predicted positive label across subgroups.

Original: In comparison,
Revised: In comparison,

Original: Equalized Odds ensures that the predicted label is conditionally independent of the sensitive attribute and the ground-truth label.
Revised: Equalized Odds ensures that the predicted label is conditionally independent of the sensitive attribute and the ground-truth label.

Original: Equality Opportunity and Predictive Equality enforce a partial form of equalized odds, suitable in domains in which being included (or not) in the positive class is viewed respectively as a desirable or poor outcome.
Revised: Equality Opportunity and Predictive Equality enforce a partial form of equalized odds, suitable in domains in which being included (or not) in the positive class is viewed respectively as a desirable or poor outcome.

Original: Hereafter, we give the definitions for the first two metrics, with more details available in Appendix B:
Revised: Hereafter, we give the definitions for the first two metrics, with more details available in Appendix B:

Original: Definition 1 (Demographic Parity (Calders et al., 2009)) .
Revised: Definition 1 (Demographic Parity (Calders et al., 2009)) .

Original: A predictor ˆ Y satisfies Demographic Parity with respect to the sensitive attribute a if:
Revised: A predictor ˆ Y satisfies Demographic Parity with respect to the sensitive attribute a if:

Original: [Equation]
Revised: [Equation]

Original: Definition 2 (Equalized Odds (Hardt et al., 2016)) .
Revised: Definition 2 (Equalized Odds (Hardt et al., 2016)) .

Original: A predictor ˆ Y satisfies Equalized Odds with respect to the sensitive attribute a if:
Revised: A predictor ˆ Y satisfies Equalized Odds with respect to the sensitive attribute a if:

Original: [Equation]
Revised: [Equation]

Original: Fairness and decision trees.
Revised: Fairness and decision trees.

Original: Fair decision tree algorithms are usually either based on greedy optimizers (Kamiran et al., 2010; Loh, 2011) or Mixed-Integer Programming (MIP) solvers (Bennett, 1992; Aghaei et al., 2019; Jo et al., 2022).
Revised: Fair decision tree algorithms are usually either based on greedy optimizers (Kamiran et al., 2010; Loh, 2011) or Mixed-Integer Programming (MIP) solvers (Bennett, 1992; Aghaei et al., 2019; Jo et al., 2022).

Original: The former optimizes a fairness-accuracy splitting criterion for each node based on the data routed to it while the latter solves a mathematical optimization augmented with a fairness constraint.
Revised: The former optimizes a fairness-accuracy splitting criterion for each node based on the data routed to it while the latter solves a mathematical optimization augmented with a fairness constraint.

Original: In this paper, we focus on greedy-based optimization methods as MIP-based methods are currently only applicable on datasets with at most thousands of inputs and with non-continuous features (Zantedeschi et al., 2021).
Revised: In this paper, we focus on greedy-based optimization methods as MIP-based methods are currently only applicable on datasets with at most thousands of inputs and with non-continuous features (Zantedeschi et al., 2021).

Original: One such greedy approach from Kamiran et al.
Revised: One such greedy approach from Kamiran et al.

Original: (2010) defines a fair training algorithm by reformulating the information gain traditionally used for decision tree training to encourage demographic parity fairness.
Revised: (2010) defines a fair training algorithm by reformulating the information gain traditionally used for decision tree training to encourage demographic parity fairness.

Original: This work was extended to random forests by Raff et al.
Revised: This work was extended to random forests by Raff et al.

Original: Both works manage the accuracy-fairness trade-off via a novel gain term encouraging discrimination over the class label while discouraging discrimination with respect to the sensitive attribute, leading to both high performance and fairness.
Revised: Both works manage the accuracy-fairness trade-off via a novel gain term encouraging discrimination over the class label while discouraging discrimination with respect to the sensitive attribute, leading to both high performance and fairness.

Original: Zero-knowledge proof.
Revised: Zero-knowledge proof.

Original: We design a Zero-Knowledge (ZK) proof protocol that lets the prover prove to the verifier that their model is trained using the fair training algorithm without revealing their data or model, thus preserving confidentiality.
Revised: We design a Zero-Knowledge (ZK) proof protocol that lets the prover prove to the verifier that their model is trained using the fair training algorithm without revealing their data or model, thus preserving confidentiality.

Original: Given an agreed upon program P , a ZK proof protocol Π enables a prover to convince a verifier that they possess an input w such that P ( w ) = 1 , while revealing no additional information about w (Goldwasser et al., 1985; Goldreich et al., 1991).
Revised: Given an agreed upon program P , a ZK proof protocol Π enables a prover to convince a verifier that they possess an input w such that P ( w ) = 1 , while revealing no additional information about w (Goldwasser et al., 1985; Goldreich et al., 1991).

Original: Typically, a ZK proof protocol Π has the following properties:
Revised: Typically, a ZK proof protocol Π has the following properties:

Original: • Completeness – For any input w that P evaluates to 1 in the clear, an honest prover (who behaves correctly) can convince an honest verifier that P ( w ) =
Revised: • Completeness – For any input w that P evaluates to 1 in the clear, an honest prover (who behaves correctly) can convince an honest verifier that P ( w ) =

Original: 1 using Π . • Soundness – Given an input w that P does not evaluate to 1 in the clear, no malicious prover (who can behave arbitrarily) can falsely convince an honest verifier that P ( w ) =
Revised: 1 using Π . • Soundness – Given an input w that P does not evaluate to 1 in the clear, no malicious prover (who can behave arbitrarily) can falsely convince an honest verifier that P ( w ) =

Original: 1 using Π .
Revised: 1 using Π .

Original: • Zero Knowledge – If the prover and verifier execute Π to prove that P ( w ) = 1 , even a malicious verifier (who can behave arbitrarily) learns no information about w other than what can be inferred from the fact that P ( w ) = 1 .
Revised: • Zero Knowledge – If the prover and verifier execute Π to prove that P ( w ) = 1 , even a malicious verifier (who can behave arbitrarily) learns no information about w other than what can be inferred from the fact that P ( w ) = 1 .

Original: In the context of this paper, we write a fairness verification program that takes as inputs a decision tree and a dataset and evaluates to 1 if and only if the decision tree is trained using the fair training algorithm A ( · , · ) on the dataset.
Revised: In the context of this paper, we write a fairness verification program that takes as inputs a decision tree and a dataset and evaluates to 1 if and only if the decision tree is trained using the fair training algorithm A ( · , · ) on the dataset.

Original: We instantiate this ZK proof protocol from a vector-oblivious linear evaluation (Weng et al., 2021), with a recent extension to support ZK RAM accession (Franzese et al., 2021).
Revised: We instantiate this ZK proof protocol from a vector-oblivious linear evaluation (Weng et al., 2021), with a recent extension to support ZK RAM accession (Franzese et al., 2021).

Original: Circuit-based models of computation incur relatively high overhead when the control flow of a program depends on the input (Goldreich & Ostrovsky, 1996).
Revised: Circuit-based models of computation incur relatively high overhead when the control flow of a program depends on the input (Goldreich & Ostrovsky, 1996).

Original: This limitation often becomes a bottleneck when writing programs for decision trees (e.g.,, when selecting a particular attribute of a sample to test against the threshold in each node).
Revised: This limitation often becomes a bottleneck when writing programs for decision trees (e.g., when selecting a particular attribute of a sample to test against the threshold in each node).

Original: Utilizing a RAM model ZK bypasses much of this overhead, thereby allowing for a succinct and efficient implementation of our fairness verification program.
Revised: Utilizing a RAM model ZK bypasses much of this overhead, thereby allowing for a succinct and efficient implementation of our fairness verification program.

Original: Cryptographic protocols and decision trees.
Revised: Cryptographic protocols and decision trees.

Original: Prior works (Hamada et al., 2021; Abspoel et al., 2021;
Revised: Prior works (Hamada et al., 2021; Abspoel et al., 2021;

Original: Adams et al., 2021) designed protocols to allow multiple parties, each with a private dataset, to jointly train a decision tree.
Revised: Adams et al., 2021) designed protocols to allow multiple parties, each with a private dataset, to jointly train a decision tree.

Original: These protocols work in a different setting compared to ours, where all private inputs come from the company proving the correctness of private computation.
Revised: These protocols work in a different setting compared to ours, where all private inputs come from the company proving the correctness of private computation.

Original: Other works (Zhang et al., 2020a) developed ZK proofs for decision trees at inference but not at training time.
Revised: Other works (Zhang et al., 2020a) developed ZK proofs for decision trees at inference but not at training time.

Original:  C ONFIDENTIAL -PROFITT
Revised:  C ONFIDENTIAL -PROFITT

Original: We propose Confidential-PROFITT to confidentially certify the fair training of a decision tree.
Revised: We propose Confidential-PROFITT to confidentially certify the fair training of a decision tree.

Original: Confidential-PROFITT consists of four main steps (see also the block diagram in Appendix C):
Revised: Confidential-PROFITT consists of four main steps (see also the block diagram in Appendix C):

Original: Local training: The prover locally trains a decision tree on their private training data using our proposed fair decision tree learning algorithm.
Revised: Local training: The prover locally trains a decision tree on their private training data using our proposed fair decision tree learning algorithm.

Original: The algorithm is designed to be both i) cryptofriendly and efficient in ZK via a constraint optimization problem that maximizes the accuracy gain while the constraining the unfairness gain to some threshold; and ii) generic in supporting many fairness metrics (described in Section 2) by defining information gain with respect to each fairness metric.
Revised: The algorithm is designed to be both i) cryptofriendly and efficient in ZK via a constraint optimization problem that maximizes the accuracy gain while the constraining the unfairness gain to some threshold; and ii) generic in supporting many fairness metrics (described in Section 2) by defining information gain with respect to each fairness metric.

Original: Data and model commitment: The prover commits to the training data and the decision tree trained on this data.
Revised: Data and model commitment: The prover commits to the training data and the decision tree trained on this data.

Original: These commitments are binding and hiding, meaning that the prover cannot change the content being committed without the verifier’s consent and that the commitment does not reveal anything about the underlying content (Katz & Lindell, 2007).
Revised: These commitments are binding and hiding, meaning that the prover cannot change the content being committed without the verifier’s consent and that the commitment does not reveal anything about the underlying content (Katz & Lindell, 2007).

Original: Proving counter update in ZK: The prover locally computes and commits to the path each data point takes through the trained decision tree.
Revised: Proving counter update in ZK: The prover locally computes and commits to the path each data point takes through the trained decision tree.

Original: The prover proves in ZK that the committed paths are correct by comparing the values of each data point to the thresholds in the tree.
Revised: The prover proves in ZK that the committed paths are correct by comparing the values of each data point to the splitting values in the tree.

Original: Then for each value of the sensitive attribute a , the prover counts the number of data points with value a that pass through each node, and proves that these counts are valid.
Revised: Then for each value of the sensitive attribute a , the prover counts the number of data points with value a that pass through each node, and proves that these counts are valid.

Original: Prove fairness constraint in ZK: The prover computes fairness-related information gain of each node using their corresponding committed counters and proves to the verifier that this is below the desired threshold.
Revised: Prove fairness constraint in ZK: The prover computes fairness-related information gain of each node using their corresponding committed counters and proves to the verifier that this is below the desired threshold.

Original: Next, we describe our fair decision tree learning algorithm and our ZK protocol in detail.
Revised: Next, we describe our fair decision tree learning algorithm and our ZK protocol in detail.

Original: 3. F AIR DECISION TREE LEARNING ALGORITHM
Revised: 3. F AIR DECISION TREE LEARNING ALGORITHM

Original: In this section, we propose a novel training algorithm to learn fair decision trees.
Revised: In this section, we propose a novel training algorithm to learn fair decision trees.

Original: The decision tree is learned by recursively partitioning the training dataset (Breiman et al., 2017)
Revised: The decision tree is learned by recursively partitioning the training dataset (Breiman et al., 2017)

Original: (see Appendix D for a detailed description of tree training).
Revised: (see Appendix D for a detailed description of tree training).

Original: Splitting by the value t of the attribute f partitions thedataset at
Revised: Splitting by the value, val , of the attribute, attr , partitions the

Original: Input: Dataset X in j -th node DT [j], Sensitive attribute a , Threshold τ over unfairness-based information gain Gini Unfairness ( · ) .

Original: Output: Best split 1: Threshold_attribute_gains =

Original: [] ▷ Initialize each attribute 2: Parent =

Original: X ▷ Make parent node 3: for f ∈ Attributes do 4: for x ∈ X do 5: t = x

Original: [ f ] ▷ Set split threshold value per datapoint 6:

Original: Child 1 = { x ∈ X | x [ f ] < t } , Child 2 = { x ∈ X | x [ f ] ≥ t } ▷ Make children 7:

Original: Gain Accuracy = Gini

Original: [Table]
Revised: [Table]

Original: ( Parent ) − (cid:80) 2 k =

Original: [Table]
Revised: [Table]

Original: | Child k | | Parent | Gini Accuracy ( Child k )

Original: ▷ Gain wrt label 8:

Original: Gain

Original: [Table]
Revised: [Table]

Original: =

Original: [Table]

Original: [Table]

Original: ) − [Table] [Table] =1 |
Revised: = x

Original: [Table]
Revised: [Table]

Original: k | |

Original: [Table]
Revised: [Table]

Original: | Gini

Original: [Table]
Revised: [Table]

Original: ( Child k )

Original: ▷ Gain wrt sensitive attribute 9: if Gain Unfairness ≤ τ then 10:

Original: Threshold_

Original: [Table]
Revised: [Table]

Original: _gains.append( f,t, { Gain Accuracy , Gain Unfairness } )

Original: ▷ Record fair splits 11: return DT [ j ] .

Original: attr , DT [ j ] .

Original: [Table] , DT [ j ] . gains = max Gain Accuracy Threshold_attribute_gains ▷ Best split the parent node into two children nodes, Parent =
Revised: dataset at the parent node into two children nodes, Parent =

Original: { Child 1 , Child 2 } , such that:
Revised: { Child 1 , Child 2 } , such that:

Original: [Equation]
Revised: [Equation]

Original: In general, the information gain of each split, Gain ( Split ) , is the amount of information improved in the children nodes with respect to their parent node:
Revised: In general, the information gain of each split, Gain ( Split ) , is the amount of information improved in the children nodes with respect to their parent node:

Original: [Equation]
Revised: [Equation]

Original: in which Gini quantifies the impurity of each node.
Revised: in which Gini quantifies the impurity of each node.

Original: We introduce two different variants of Gini : for accuracy-based information ( Gini Accuracy ) and for unfairness-based information ( Gini Unfairness ) to capture the effect of each split on both accuracy and fairness.
Revised: We introduce two different variants of Gini : for accuracy-based information ( Gini Accuracy ) and for unfairness-based information ( Gini Unfairness ) to capture the effect of each split on both accuracy and fairness.

Original: We define Gini Accuracy with respect to the class label (Breiman et al., 2017) and demographic parity
Revised: We define Gini Accuracy with respect to the class label (Breiman et al., 2017) and demographic parity

Original: Gini DP with respect to the sensitive attribute a (Raff et al., 2018) as:
Revised: Gini DP with respect to the sensitive attribute a (Raff et al., 2018) as:

Original: [Equation]
Revised: [Equation]

Original: in which X c and X s are training points with ground-truth label c and sensitive attribute s , respectively.
Revised: in which X c and X s are training points with ground-truth label c and sensitive attribute s , respectively.

Original: Definition 3 (Equalized Odds-aware Information Gain) .
Revised: Definition 3 (Equalized Odds-aware Information Gain) .

Original: Given a prospective split over an attribute, we introduce the information gain with respect to the sensitive attribute conditioned on a class variable that we call equalized odds-aware information gain.
Revised: Given a prospective split over an attribute, we introduce the information gain with respect to the sensitive attribute conditioned on a class variable that we call equalized odds-aware information gain.

Original: The information gained over the split follows Equation 2 in which the equalized odds Gini index, Gini Eodds ( X ) , is measured with respect to the sensitive attribute conditioned on class:
Revised: The information gained over the split follows Equation 2 in which the equalized odds Gini index, Gini Eodds ( X ) , is measured with respect to the sensitive attribute conditioned on class:

Original: [Equation]
Revised: [Equation]

Original: Gini + Eodds ( X ) and Gini − Eodds ( X ) measure the impurity with respect to the sensitive attribute conditioned on the positive and negative class, respectively.
Revised: Gini + Eodds ( X ) and Gini − Eodds ( X ) measure the impurity with respect to the sensitive attribute conditioned on the positive and negative class, respectively.

Original: To find the best split among all possible splits, we propose a constrained optimization problem that maximizes the accuracy-based information gain and upper-bounds unfairness-based information gain:
Revised: To find the best split among all possible splits, we propose a constrained optimization problem that maximizes the accuracy-based information gain and upper-bounds unfairness-based information gain:

Original: [Equation]
Revised: [Equation]

Original:  for Property ∈ { Unfairness , Accuracy } in which Unfairness denotes a measure of unfairness such as demographic parity or equalized odds (see Definition 3).
Revised: in which Gain Property ( Split ) = Gini [Equation] for Property ∈ { Unfairness , Accuracy } in which Unfairness denotes a measure of unfairness such as demographic parity or equalized odds (see Definition 3).

Original: Algorithm 1 describes our fair tree training that supports different fairness metrics and can be verified efficiently.
Revised: Algorithm 1 describes our fair tree training that supports different fairness metrics and can be verified efficiently.

Original: [Table]
Revised: [Table]

Original: 3. E FFICIENT ZKP OF FAIR TRAINING
Revised: 3. E FFICIENT ZKP OF FAIR TRAINING

Original: In this section, we describe our ZK protocol which efficiently checks the fair training of the model.
Revised: In this section, we describe our ZK protocol which efficiently checks the fair training of the model.

Original: Note that in this paper we do not invent new cryptographic protocols to prove arbitrary programs P (described in Section 2).
Revised: Note that in this paper we do not invent new cryptographic protocols to prove arbitrary programs P (described in Section 2).

Original: Instead, our focus is to design a P that verifies that a decision tree was trained fairly, and can be executed efficiently by a RAM model ZK protocol.
Revised: Instead, our focus is to design a P that verifies that a decision tree was trained fairly, and can be executed efficiently by a RAM model ZK protocol.

Original: To this end, in Section 3.1, we separated accuracy maximization and fairness requirements by modifying the split finding criterion.
Revised: To this end, in Section 3.1, we separated accuracy maximization and fairness requirements by modifying the split finding criterion.

Original: This means that one need only verify that the split point in the trained decision tree satisfies the fairness requirement, as opposed to exhaustively trying all possible split points.
Revised: This means that one need only verify that the split point in the trained decision tree satisfies the fairness requirement, as opposed to exhaustively trying all possible split points.

Original: As a result, our ZK verification of fair training has a computational complexity lower than the training itself.
Revised: As a result, our ZK verification of fair training has a computational complexity lower than the training itself.

Original: Decision Tree and Commitment Representation.
Revised: Decision Tree and Commitment Representation.

Original: Each internal node  in a decision tree is represented as a tuple (thld , attr , val ) , while internal nodes do not have the latter and leaf nodes do not have the former two fields.
Revised: Each internal node n in a decision tree is represented as a tuple ( attr , val ) , which respectively encode the attribute and threshold value by which n splits the data.

Original: By unifying the representation, one can easily hide the shape of the decision tree.

Original: The decision tree DT of height h is represented as an array of nodes, such that the two children of node DT [ i ] are DT [2 i ] and DT [2 i + 1] .
Revised: The decision tree DT of height h is represented as an array of nodes, such that the two children of node DT [ i ] are DT [2 i ] and DT [2 i + 1] .

Revised: To avoid leaking information about the topology of the tree, the array will always have space for a full binary tree.

Revised: Non-full trees can trivially be encoded using dummy threshold values to ensure that data never enters the missing nodes.

Original: We will use (cid:74) x (cid:75) to represent the cryptographic commitment of a value x known to the prover.
Revised: We will use (cid:74) x (cid:75) to represent the cryptographic commitment of a value x known to the prover.

Original: This means the prover can prove facts about x without disclosing its value to the verifier.
Revised: This means the prover can prove facts about x without disclosing its value to the verifier.

Original: Our ZKP protocol.
Revised: Our ZKP protocol.

Original: Our efficient fairness verification is presented in Algorithm 2.
Revised: Our efficient fairness verification is presented in Algorithm 2.

Original: It has two phases:
Revised: It has two phases:

Original: Phase 1: ZK proofs of frequency counting
Revised: Phase 1: ZK proofs of frequency counting.

Original: This steptakes the trained decision tree and the training data and, for each node and each
Revised: This step

Original:  possible sensitive attribute value, obtains committed counters on the number of training data entries falling into that node.
Revised: takes the trained decision tree and the training data and, for each node and each possible sensitive attribute value, obtains committed counters on the number of training data entries falling into that node.

Original: Phase 2: ZK fairness metric verification.
Revised: Phase 2: ZK fairness metric verification.

Original: Based on the committed counters, prove in ZK that the calculated fairness metrics from the counters are below the required fairness threshold.
Revised: Based on the committed counters, prove in ZK that the calculated fairness metrics from the counters are below the required fairness threshold.

Original: Below we formally state the security of our protocol.
Revised: Below we formally state the security of our protocol.

Original: Intuitively, the protocol does not reveal anything about the training dataset or the decision tree except to indicate that the fairness metric used for splitting is satisfied.
Revised: Intuitively, the protocol does not reveal anything about the training dataset or the decision tree except to indicate that the fairness metric used for splitting is satisfied.

Original: Because a generic ZK protocol is used, the committed decision tree and the dataset can potentially be used to prove other statements.
Revised: Because a generic ZK protocol is used, the committed decision tree and the dataset can potentially be used to prove other statements.

Original: Below we state our main theorem in the security of the protocol, which is formally proven in Appendix E.
Revised: Below we state our main theorem in the security of the protocol, which is formally proven in Appendix E.

Original: Theorem 1.
Revised: Theorem 1.

Original: Algorithm 2 is a secure ZK proof of fair training.
Revised: Algorithm 2 is a secure ZK proof of fair training.

Original: Extensions.
Revised: Extensions.

Original: In the above description, we show a ZK proof of fair training w.r.t.
Revised: In the above description, we show a ZK proof of fair training w.r.t.

Original: demographic parity.
Revised: demographic parity.

Original: We note that it is easily generalizable to other fairness metrics mentioned in Section 3.1 as we can  represent many group fairness metrics with a unified function such as:
Revised: We note that it is easily generalizable to other fairness metrics mentioned in Section 3.1 as we can [Table] represent many group fairness metrics with a unified function such as:

Original: [Equation]
Revised: [Equation]

Original: Demographicparity : α = β = 1 , Equalized odds : { α = 1 , β = 0 } and { α = 0 , β = 1 } .
Revised: Demographic

Original: [Equation]
Revised: [Equation]

Revised: Equalized

Original: [Figure]
Revised: [Equation]

Original: For example, to support equalized odds, one must maintain four counter trees (rather than just cand c 2 , as in demographic parity) and verify the fairness metric accordingly.
Revised: For example, to support equalized odds, one must maintain four counter trees (rather than just cand c 2 , as in demographic parity) and verify the fairness metric accordingly.

Original: See our proposed ZK protocol for equalized odds in Appendix F.
Revised: See our proposed ZK protocol for equalized odds in Appendix F.

Original:  E XPERIMENTAL E VALUATION
Revised:  E XPERIMENTAL E VALUATION

Original: Our principal motivation for introducing Confidential-PROFITT is to prove to interested parties (e.g., users or auditor) that the learning algorithm used to train a model is fair by design—while protecting the confidentiality of both the training data and model.
Revised: Our principal motivation for introducing Confidential-PROFITT is to prove to interested parties (e.g., users or auditor) that the learning algorithm used to train a model is fair by design—while protecting the confidentiality of both the training data and model.

Original: Next, we empirically evaluate the novel aspects introduced by Confidential-PROFITT: namely, (1) the ZK-friendly fairness-aware training algorithm along with (2) its customized ZK proof protocols.
Revised: Next, we empirically evaluate the novel aspects introduced by Confidential-PROFITT: namely, (1) the ZK-friendly fairness-aware training algorithm along with (2) its customized ZK proof protocols.

Original: Therefore, we validate empirically the performance of Confidential-PROFITT as follows: i) effectiveness in training a fair model :
Revised: Therefore, we validate empirically the performance of Confidential-PROFITT as follows: i) effectiveness in training a fair model :

Original: The unfairness of decision trees decreases (while keeping the accuracy high) as the bound on the information gain w.r.t the sensitive attribute decreases; ii) efficiency in proving the use of fair algorithm :
Revised: The unfairness of decision trees decreases (while keeping the accuracy high) as the bound on the information gain w.r.t the sensitive attribute decreases; ii) efficiency in proving the use of fair algorithm :

Original: We implement our customized ZK protocol for verifying the algorithm and benchmark its runtime and communication costs.
Revised: We implement our customized ZK protocol for verifying the algorithm and benchmark its runtime and communication costs.

Original: Our framework scales to real-world use cases (e.g., to a large number of training samples and attributes as well as deep decision trees).
Revised: Our framework scales to real-world use cases (e.g., to a large number of training samples and attributes as well as deep decision trees).

Original: We assess the performance of Confidential-PROFITT using four common datasets for fairness benchmarking: COMPAS (Angwin et al., 2016), Communities and Crime (Redmond, 2009), Adult
Revised: We assess the performance of Confidential-PROFITT using four common datasets for fairness benchmarking: COMPAS (Angwin et al., 2016), Communities and Crime (Redmond, 2009), Adult

Original: Income (Adu, 1996), and Default Credit (Def, 2016).
Revised: Income (Adu, 1996), and Default Credit (Def, 2016).

Original: Refer to Appendix G.1 for details on these datasets.
Revised: Refer to Appendix G.1 for details on these datasets.

Original: Two distinct code bases are utilized.
Revised: Two distinct code bases are utilized.

Original: We use the EMP-toolkit (Wang et al., 2016) to efficiently implement our ZK protocol and a JAVA and Python implementation to train and assess the accuracy and fairness of decision trees.
Revised: We use the EMP-toolkit (Wang et al., 2016) to efficiently implement our ZK protocol and a JAVA and Python implementation to train and assess the accuracy and fairness of decision trees.

Original: Additional details about our implementations are in Appendix G.2.
Revised: Additional details about our implementations are in Appendix G.2.

Original: Effectiveness of Confidential-PROFITT.
Revised: Effectiveness of Confidential-PROFITT.

Original: Figure 1 shows the relationship between accuracy and fairness for decision trees with demographic parity and equalized odds fairness.
Revised: Figure 1 shows the relationship between accuracy and fairness for decision trees with demographic parity and equalized odds fairness.

Original: These figures were constructed with a sweep of threshold values.
Revised: These figures were constructed with a sweep of threshold values.

Original: We indicate the fairness and accuracy of trees trained without the fairness constraint as "Original" in Figure 1.
Revised: We indicate the fairness and accuracy of trees trained without the fairness constraint as "Original" in Figure 1.

Original: We also compare Confidential-PROFITT to a "Baseline" for the demographic parity fair training method in 
Revised: We also compare Confidential-PROFITT to a "Baseline" for the demographic parity fair training method in Kamiran et al.

Revised: (2010) and Raff et al.

Original: Note that this baseline is not applicable to trees trained for equalized odds fairness.
Revised: Note that this baseline is not applicable to trees trained for equalized odds fairness.

Original: Also note that the tree heights used for each dataset are described in Appendix G.1.
Revised: Also note that the tree heights used for each dataset are described in Appendix G.1.

Original: The figures indicate that Confidential-PROFITT leads to increased fairness (shown by small fairness gap values) with only marginal, or sometimes no, decreases in accuracy compared to trees trained without fairness or with the baseline demographic parity fairness from Kamiran et al.
Revised: The figures indicate that Confidential-PROFITT leads to increased fairness (shown by small fairness gap values) with only marginal, or sometimes no, decreases in accuracy compared to trees trained without fairness or with the baseline demographic parity fairness from Kamiran et al.

Original: (2010) and Raff et al.
Revised: (2010) and Raff et al.

Original: Interestingly, for some datasets, the range of accuracy values achieved exceeds the performance of trees trained without the fairness constraint.
Revised: Interestingly, for some datasets, the range of accuracy values achieved exceeds the performance of trees trained without the fairness constraint.

Original: The accuracy drops themselves are often less than 10%.
Revised: The accuracy drops themselves are often less than 10%.

Original: For example, for the Communities and Crime dataset we increase the fairness by almost 50% with at most a 5% accuracy drop.
Revised: For example, for the Communities and Crime dataset we increase the fairness by almost 50% with at most a 5% accuracy drop.

Original: Therefore, Confidential-PROFITT effectively improves the fairness.
Revised: Therefore, Confidential-PROFITT effectively improves the fairness.

Original: Efficiency of Confidential-PROFITT.
Revised: Efficiency of Confidential-PROFITT.

Original: Table 1 shows the runtime and communication costs of our

Original: COMPAS

Original: Communities and Crime

Original: Default Credit

Original: Adult Eodds

Original: Dem.

Original: Parity

Original: Eodds

Original: Dem.

Original: Parity

Original: Eodds

Original: Dem.

Original: Parity

Original: Eodds

Original: Dem.

Original: Parity Running time 12.74s 9.87s 8.31s 7.37s 72.21s 50.80s 104.73s

Original: 62.86s

Original: Communication 28.7MB 21.1MB 23.9MB 16.9MB 107.3MB 67.7MB 145.2MB 89.1MB

Original: [Figure] fair training ZK protocols on Amazon EC2 machines in which the prover (i [Figure] e., the company) and the verifier (i
Revised: Table 1 shows the runtime and communication costs of our fair training ZK protocols on Amazon EC2 machines in which the prover (i.e., the company) and the verifier (i.e., the auditor) are connected over a local area network (LAN).

Original: [Figure]

Original: e., the auditor) are connected over a local area network (LAN).

Original: The runtime for all datasets is in the order of seconds.
Revised: The runtime for all datasets is in the order of seconds.

Original: For example, it takes less than 10 seconds to prove the fair training in terms of demographic parity on COMPAS dataset.
Revised: For example, it takes less than 10 seconds to prove the fair training in terms of demographic parity on COMPAS dataset.

Original: The communication overhead for both parties is at most 145 MB.
Revised: The communication overhead for both parties is at most 145 MB.

Original: For example, the total communication cost of running Confidential-PROFITT using equalized odds and demographic parity on the COMPAS dataset is 28 MB and 21 MB, respectively.
Revised: For example, the total communication cost of running Confidential-PROFITT using equalized odds and demographic parity on the COMPAS dataset is 28 MB and 21 MB, respectively.

Original: Therefore, Confidential-PROFITT efficiently proves the fair training of trees .
Revised: Therefore, Confidential-PROFITT efficiently proves the fair training of trees .

Original:  We further evaluate the scalability of Confidential-PROFITT by considering various numbers of training samples, number of attributes, and height of trees, which are [10 3 , 10 6 ] , [10 , 10 4 ] and [4 , 10] , respectively.
Revised: [Figure] [Figure] unn i n g t i m e ( s ) We further evaluate the scalability of Confidential-PROFITT by considering various numbers of training samples, number of attributes and height of trees, which are [10 3 , 10 6 ] , [10 , 10 4 ] and [4 , 10] , respectively.

Original: Figure 2 shows the effect of the number of training samples, number of attributes and height of trees on the running time (see Appendix H for the communication cost) of Confidential-PROFITT when proving demographic parity and equalized odds.
Revised: Figure 2 shows the effect of the number of training samples, number of attributes and height of trees on the running time (see Appendix H for the communication cost) of Confidential-PROFITT when proving demographic parity and equalized odds.

Original: These results demonstrate that even for the maximum values of these parameters, the running time is less than an hour.
Revised: These results demonstrate that even for the maximum values of these parameters, the running time is less than an hour.

Original: Therefore, Confidential-PROFITT is scalable .
Revised: Therefore, Confidential-PROFITT is scalable .

Original: Next, we discuss the pattern of running time.
Revised: Next, we discuss the pattern of running time

Original: As expected, we observe linear scaling with the number of samples (left panel).
Revised: As expected we observe linear scaling with the number of samples (left panel)

Original: The reason for this is that each sample is processed using a constant number of operations during the first phase of our protocol, and the number of operations in the second phase is unchanged by the number of samples.
Revised: The reason for this is that each sample is processed using a constant number of operations during the first phase of our protocol and the number of operations in the second phase is unchanged by the number of samples.

Original: The equalized odds protocol incurs higher running times, since it has to initialize and update four counting trees while the demographic parity version only needs to keep track of two.
Revised: The equalized odds protocol incurs higher running times, since it has to initialize and update four counting trees while the demographic parity version only needs to keep track of two.

Original: We also observe that the protocol scales linearly with the number of attributes (middle panel).
Revised: We also observe that the protocol scales linearly with the number of attributes (middle panel).

Original: This is because increasing the number of attributes increases the number of operations required to commit to the dataset.
Revised: This is because increasing the number of attributes increases the number of operations required to commit to the dataset.

Original: We note that the demographic parity and equalized odds protocols are roughly equivalent in run time for these experiments because committing to the dataset takes the same amount of work in both versions.
Revised: We note that the demographic parity and equalized odds protocols are roughly equivalent in run time for these experiments because committing to the dataset takes the same amount of work in both versions.

Original: Finally, we observe the beginning of exponential scaling as tree height is increased (right panel).
Revised: Finally, we observe the beginning of exponential scaling as tree height is increased (right panel).

Original: This is due to the exponentially increasing size of the trained decision tree and counting trees, as well as the fairness checking phase (which iterates through all interior nodes).
Revised: This is due to the exponentially increasing size of the trained decision tree and counting trees, as well as the fairness checking phase (which iterates through all interior nodes).

Original: Breakdown of computational costs between phases of the ZK protocol varied depending on parameters.
Revised: Breakdown of computational costs between phases of the ZK protocol varied depending on parameters.

Original: For example, on the COMPAS dataset, the commitment, counting, and fairness checking phases took up approximately 60% , 32% , and 0 .
Revised: For example, on the COMPAS dataset, the commitment, counting, and fairness checking phases took up approximately 60% , 32% , and 0 .

Original: 2% of the runtime respectively whereas for the Default Credit dataset, those respective values became 24% , 72% and 2% (the remainder of the runtime is spent initializing the underlying ZK framework).
Revised: 2% of the runtime respectively whereas for the Default Credit dataset, those respective values became 24% , 72% and 2% (the remainder of the runtime is spent initializing the underlying ZK framework).

Original: This difference is caused by the size difference between the two datasets.
Revised: This difference is caused by the size difference between the two datasets.

Original: An analysis on fair splitting criterion versus fairness metrics.
Revised: An analysis on fair splitting criterion versus fairness metrics.

Original: Figure 3 demonstrates a connection between the fair learning algorithm and the fairness metrics investigated: the unfairness of demographic parity and equalized odds increases with the average unfairness gain values over all node splits for decision trees.
Revised: Figure 3 demonstrates a connection between the fair learning algorithm and the fairness metrics investigated: the unfairness of demographic parity and equalized odds increases with the average unfairness gain values over all node splits for decision trees.

Original: This is intuitive given that similarly to the label-wise discrimination encouraged by Gain Accuracy , high values of Gain Unfairness may bring the tree to discriminate across values of the sensitive attribute.
Revised: This is intuitive given that similarly to the label-wise discrimination encouraged by Gain Accuracy , high values of Gain Unfairness may bring the tree to discriminate across values of the sensitive attribute.

Original: By limiting this discrimination, we expect little change to the purity of successive nodes, eventually leading to leaves having a mixed population from each subgroup.
Revised: By limiting this discrimination, we expect little change to the purity of successive nodes, eventually leading to leaves having a mixed population from each subgroup.

Original: [Figure]
Revised: [Figure]

Original: [Figure] 
Revised: [Figure] [Figure] [Table]

Original: [Figure]
Revised: [Figure]

Original:  C ONFIDENTIAL PROOF OF FAIR TRAINING OF ENSEMBLES OF TREES
Revised:  C ONFIDENTIAL PROOF OF FAIR TRAINING OF ENSEMBLES OF TREES

Original: Ensembling decision trees into a random forest can improve the performance of the resulting classifier (see Appendix I for these results).
Revised: Ensembling decision trees into a random forest can improve the performance of the resulting classifier (see Appendix I for these results).

Original: Therefore, we extend Confidential-PROFITT to prove the fairness of random forests (Zhang et al., 2020b; 2021; Raff et al., 2018).
Revised: Therefore, we extend Confidential-PROFITT to prove the fairness of random forests (Zhang et al., 2020b; 2021; Raff et al., 2018).

Original: Concretely, we construct fair random forests from ensembles of fair decision trees with bagging and random feature selection (see Appendix G.2 for details of how to train random forests).
Revised: Concretely, we construct fair random forests from ensembles of fair decision trees with bagging and random feature selection (see Appendix G.2 for details of how to train random forests).

Original: By running a secure coin-flipping protocol between the company and the auditor before training, the randomness used for subsampling data points and attributes during the ensemble process can be revealed to the auditor.
Revised: By running a secure coin-flipping protocol between the company and the auditor before training, the randomness used for subsampling data points and attributes during the ensemble process can be revealed to the auditor.

Original: Given this, an efficient protocol for ZK proof of fairness for a random forest can be derived by performing ZK proofs of each decision tree and data consistency between different trees.
Revised: Given this, an efficient protocol for ZK proof of fairness for a random forest can be derived by performing ZK proofs of each decision tree and data consistency between different trees.

Original: See details in Appendix J.
Revised: See details in Appendix J.

Original: Figure 4 and Table 2 show accuracy-fairness relationships and running time of random forests.
Revised: Figure 4 and Table 2 show accuracy-fairness relationships and running time of random forests.

Original: We observe similar results: Confidential-PROFITT achieves major fairness gains for random forests with marginal changes to the accuracy in a practical time .
Revised: We observe similar results: Confidential-PROFITT achieves major fairness gains for random forests with marginal changes to the accuracy in a practical time .

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this paper, we proposed a framework that can be used to confidentially prove the fair training of a decision tree.
Revised: In this paper, we proposed a framework that can be used to confidentially prove the fair training of a decision tree.

Original: Confidential-PROFITT can help companies avoid receiving fairness-related penalties as it certifies the fairness during training prior to making any decisions on clients’ queries.
Revised: Confidential-PROFITT can help companies avoid receiving fairness-related penalties as it certifies the fairness during training prior to making any decisions on clients’ queries.

Original: Practical considerations.
Revised: Practical considerations.

Original: Across the whole data-based decision process, Confidential-PROFITT can prove the fairness of the model-training phase.
Revised: Across the whole data-based decision process, Confidential-PROFITT can prove the fairness of the model-training phase.

Original: To provide an end-to-end fairness guarantee to the auditor, one could extend our framework by proving the fairness of the data source and by proving the inference-time use of the model.
Revised: To provide an end-to-end fairness guarantee to the auditor, one could extend our framework by proving the fairness of the data source and by proving the inference-time use of the model.

Original: The company can use fairness-aware data pre-processing to ensure a fair representation of the different subpopulations (e.g., by swapping the ground-truth labels (Kamiran & Calders, 2009; Luong et al., 2011)) and prove the integrity of this process by providing a ZK proof to the auditor.
Revised: The company can use fairness-aware data pre-processing to ensure a fair representation of the different subgroups (e.g., by swapping the ground-truth labels (Kamiran & Calders, 2009; Luong et al., 2011)) and prove the integrity of this process by providing a ZK proof to the auditor.

Original: To ensure the company uses the proven fair model in the deployment phase, one could use existing ZK-based verified inferences for trees (Zhang et al., 2020a; Singh et al., 2021). 
Revised: To ensure the company uses the proven fair model in the deployment phase, one could use existing ZK-based verified inferences for trees (Zhang et al., 2020a; Singh et al., 2021). A CKNOWLEDGMENTS

Revised: We would like to acknowledge our sponsors, who support our research with financial and in-kind contributions: CIFAR through the Canada CIFAR AI Chair program and the Catalyst grant program,

Revised: Microsoft, and NSERC through the Discovery Grant and COHESA Strategic Alliance.

Original: E THICS S TATEMENT
Revised: Resources used in preparing this research were provided, in part, by the Province of Ontario, the Government of Canada through CIFAR, and companies sponsoring the Vector Institute. We would like to thank members of the CleverHans Lab for their feedback. Sébastien Gambs is supported by the Canada Research Chair program, a Discovery Grant from NSERC as well as the NSERC-RDC DEEL project.

Revised: Xiao Wang is supported by DARPA under Contract No.

Revised: HR001120C0087, NSF award #2016240, and research awards from Meta and Google.

Revised: Adrian Weller acknowledges support from EPSRC grant

Revised: EP/V056883/1, a Turing AI Fellowship under EP/V025279/1, and the Leverhulme Trust via CFI.

Revised: E THICS S TATEMENT

Original: The main objective behind Confidential-PROFITT is to achieve provably fair training without the requirements of revealing the training data or model to an auditor.
Revised: The main objective behind Confidential-PROFITT is to achieve provably fair training without the requirements of revealing the training data or model to an auditor.

Original: In particular, the combination of confidentiality and fairness alleviates companies’ data and intellectual property concerns for auditing, which could increase fairness auditing and public trust in audited AI overall.
Revised: In particular, the combination of confidentiality and fairness alleviates companies’ data and intellectual property concerns for auditing, which could increase fairness auditing and public trust in audited AI overall.

Original: The main ethical issues of this work are related to the definitions of fairness and benchmark datasets used.
Revised: The main ethical issues of this work are related to the definitions of fairness and benchmark datasets used.

Original: Indeed, algorithmic fairness is composed of multitudes of conflicting definitions.
Revised: Indeed, algorithmic fairness is composed of multitudes of conflicting definitions.

Original: Our work focuses on group fairness, and specifically on demographic parity and equalized odds, both of which are popular and relevant metrics.
Revised: Our work focuses on group fairness, and specifically on demographic parity and equalized odds, both of which are popular and relevant metrics.

Original: However by relying on these definitions, we acknowledge that this reinforces the political and philosophical worldviews and ideologies underlying them, and deprives other notions of fairness (e.g., individual fairness or settings in which there is no given sensitive attribute) of due attention.
Revised: However by relying on these definitions, we acknowledge that this reinforces the political and philosophical worldviews and ideologies underlying them, and deprives other notions of fairness (e.g., individual fairness or settings in which there is no given sensitive attribute) of due attention.

Original: The datasets used to validate our methods are popular fairness benchmarks.
Revised: The datasets used to validate our methods are popular fairness benchmarks.

Original: Unfortunately, their popularity can be partially attributed to the blatant unfairness of the models they have produced and the harm these models may have done when deploy in practice.
Revised: Unfortunately, their popularity can be partially attributed to the blatant unfairness of the models they have produced and the harm these models may have done when deployed in practice.

Original: Our use of these benchmark datasets is merely to remain comparable with other approaches in the literature—we do not necessarily support the use of machine learning in any of these contexts, specifically in recidivism prediction (COMPAS) or community crime profiling (Communities and Crime).
Revised: Our use of these benchmark datasets is merely to remain comparable with other approaches in the literature—we do not necessarily support the use of machine learning in any of these contexts, specifically in recidivism prediction (COMPAS) or community crime profiling (Communities and Crime).

Original: To account for these risks, we advocate for more research at the intersection of privacy and fairness, particularly for other definitions of fairness.
Revised: To account for these risks, we advocate for more research at the intersection of privacy and fairness, particularly for other definitions of fairness.

Original: We also believe that it is important to foster more research on the development of practical solutions in fairness and fairness auditing.
Revised: We also believe that it is important to foster more research on the development of practical solutions in fairness and fairness auditing

Original: R EPRODUCIBILITY S TATEMENT
Revised: R EPRODUCIBILITY S TATEMENT

Original: To support our main contributions, we have provided a detailed report of our algorithms and proofs in appendices.
Revised: To support our main contributions we have provided a detailed report of our algorithms and proofs in appendices.

Original: More precisely, we have detailed our datasets, hyperparameters and implementations in Appendix G.1 and G.2.
Revised: More precisely, we have detailed our datasets, hyperparameters and implementations in Appendix G.1 and G.2.

Original: The code is available as supplementary material.
Revised: The code is available at https://github.com/cleverhanslab/Confidential-PROFITT . This work is licensed under a Creative Commons AttributionNonCommercial 4.0 International License https://creativecommons.org/licenses/ by-nc/4.0/ .

Original: A N OTATION
Revised: A N OTATION

Original: Table 3 describes the notations used throughout this paper.
Revised: Table 3 shows the notation used throughout this paper.

Original: [Table]
Revised: [Table]

Original: B F AIRNESS METRICS
Revised: B F AIRNESS METRICS

Original: In this section, we describe four common fairness metrics: Demographic Parity , Equalized Odds ,
Revised: In this section, we describe four common fairness metrics: Demographic Parity , Equalized Odds ,

Original: Equal Opportunity , and Predictive Equality .
Revised: Equal Opportunity , and Predictive Equality .

Original: We consider the former two metrics in this paper, though our work may be easily extended to these other metrics as equal opportunity and predictive equality are weaker versions of equalized odds.
Revised: We consider the former two metrics in this paper, though our work may be easily extended to these other metrics as equal opportunity and predictive equality are weaker versions of equalized odds.

Original: Definition 4 (Demographic parity (Calders et al., 2009)) .
Revised: Definition 4 (Demographic parity (Calders et al., 2009)) .

Original: A predictor ˆ Y satisfies Demographic Parity with respect to the sensitive attribute S if:
Revised: A predictor ˆ Y satisfies Demographic Parity with respect to the sensitive attribute S if:

Original: [Equation]
Revised: [Equation]

Original: Satisfying demographic parity, or statistical group parity, refers to equal probability of a predicted positive label across subgroups partitioned by protected attribute A .
Revised: Satisfying demographic parity, or statistical group parity, refers to equal probability of a predicted positive label across subgroups partitioned by protected attribute S .

Original: In essence, enforcing demographic parity ensures that the predicted class under the model is independent of inclusion in a particular subgroup.
Revised: In essence, enforcing demographic parity ensures that the predicted class under the model is independent of inclusion in a particular subgroup.

Original: Such a fairness definition leads to situations and tasks in which the prediction is intended to be independent of subgroup inclusion.
Revised: Such a fairness definition leads to situations and tasks in which the prediction is intended to be independent of subgroup inclusion.

Original: Additionally, demographic parity presents a fairness metric that can, to some extent, overcome issues of bias in the true label associated with A , as demographic parity ignores the true label in its formulation.
Revised: Additionally, demographic parity presents a fairness metric that can, to some extent, overcome issues of bias in the true label associated with S , as demographic parity ignores the true label in its formulation.

Original: Although several tasks necessitate such properties in a fairness metric, classification in domains in which target labels may be intrinsically related to subgroup values, such as healthcare, demographic parity fails to capture key relationships between target labels and subgroups that can lead to poorer fairness (in the societal sense of fairness).
Revised: Although several tasks necessitate such properties in a fairness metric, classification in domains in which target labels may be intrinsically related to subgroup values, such as healthcare, demographic parity fails to capture key relationships between target labels and subgroups that can lead to poorer fairness (in the societal sense of fairness).

Original: For example, prediction in breast cancer diagnosis needs to incorporate subgroup information about biological sex, due to higher rates in women.
Revised: For example, prediction in breast cancer diagnosis needs to incorporate subgroup information about biological sex, due to higher rates in women.

Original: Definition 5 (Equalized Odds (Hardt et al., 2016)) .
Revised: Definition 5 (Equalized Odds (Hardt et al., 2016)) .

Original: A predictor ˆ Y satisfies Equalized Odds with respect to the sensitive attribute S if:
Revised: A predictor ˆ Y satisfies Equalized Odds with respect to the sensitive attribute S if:

Original: [Equation]
Revised: [Equation]

Original: The equalized odds metric is a strict constraint on fairness that requires a predictor to jointly equalize the false positive rate (FPR) and true positive rate (TPR) across subgroups determined by A .
Revised: The equalized odds metric is a strict constraint on fairness that requires a predictor to jointly equalize the false positive rate (FPR) and true positive rate (TPR) across subgroups determined by S .

Original: In the equalized odds formulation, the fairness of a model depends not only on the predicted label but on the true label distribution as well.
Revised: In the equalized odds formulation, the fairness of a model depends not only on the predicted label but on the true label distribution as well.

Original: Satisfying equalized odds ensures that the predicted class is conditionally independent of the protected attribute and the target class.
Revised: Satisfying equalized odds ensures that the predicted class is conditionally independent of the protected attribute and the target class.

Original: Equalized odds was proposed to alleviate pitfalls of demographic parity, which cannot capture important relationships between the target class and the subgroup’s information in its formulation of fairness.
Revised: Equalized odds was proposed to alleviate pitfalls of demographic parity, which cannot capture important relationships between the target class and the subgroup’s information in its formulation of fairness.

Original: Therefore, equalized odds is better suited for tasks in which intrinsic information links subgroup inclusion and true class, but can propagate bias in cases where the “true” label encodes societal unfairness.
Revised: Therefore, equalized odds is better suited for tasks in which intrinsic information links subgroup inclusion and true class, but can propagate bias in cases where the “true” label encodes societal unfairness.

Original: For equalized odds fairness, the prediction should be completely independent of the sensitive attribute, such as in recidivism prediction.
Revised: For equalized odds fairness, the prediction should be completely independent of the sensitive attribute.

Original: Note that equalizing both FPR and TPR implies searching for the intersection of per-subgroup area-under-receiver-operator-curves (AUROC), which may not be always satisfiable for non-trivial intersections.
Revised: Note that equalizing both FPR and TPR implies searching for the intersection of per-subgroup area-under-receiver-operator-curves (AUROC), which may not be always satisfiable for non-trivial intersections.

Original: Similarly, such an intersection may lie in an undesirable region of the parameter space that significantly degrades the utility of the model overall.
Revised: Similarly, such an intersection may lie in an undesirable region of the parameter space that significantly degrades the utility of the model overall.

Original: Thus, relaxation and calibration methods have spawned in order to mitigate these issues with this fairness metric (Hardt et al., 2016).
Revised: Thus, relaxation and calibration methods have spawned in order to mitigate these issues with this fairness metric (Hardt et al., 2016).

Original: Definition 6 (Equal Opportunity (Hardt et al., 2016)) .
Revised: Definition 6 (Equal Opportunity (Hardt et al., 2016)) .

Original: A predictor ˆ Y satisfies Equal Opportunity with respect to the sensitive attribute S if:
Revised: A predictor ˆ Y satisfies Equal Opportunity with respect to the sensitive attribute S if:

Original: [Equation]
Revised: [Equation]

Original: Equal opportunity introduces a weaker version of equalized odds, in which solely TPR is equalized across subgroups.
Revised: Equal opportunity introduces a weaker version of equalized odds, in which solely TPR is equalized across subgroups.

Original: Due to the relative difficulties associated with satisfying equalized odds, equality of opportunity relaxes the metric by permitting unequalized FPR, but continues to require TPR, and offers an advantage over demographic parity in certain settings by incorporating the target label into its formulation.
Revised: Due to the relative difficulties associated with satisfying equalized odds, equality of opportunity relaxes the metric by permitting unequalized FPR, but continues to require TPR, and offers an advantage over demographic parity in certain settings by incorporating the target label into its formulation.

Original: Equality of opportunity largely works in domains in which the positive class could be viewed as “desirable” (thus the name opportunity ) by enforcing equal inclusion in the positive class conditionally independent of A and true inclusion in the positive class.
Revised: Equality of opportunity largely works in domains in which the positive class could be viewed as “desirable” (thus the name opportunity ) by enforcing equal inclusion in the positive class conditionally independent of S and true inclusion in the positive class.

Original: Definition 7 (Predictive Equality (Chouldechova, 2016; Corbett-Davies et al., 2017)) .
Revised: Definition 7 (Predictive Equality (Chouldechova, 2016; Corbett-Davies et al., 2017)) .

Original: A predictor ˆ Y satisfies Predictive Equality with respect to the sensitive attribute S if:
Revised: A predictor ˆ Y satisfies Predictive Equality with respect to the sensitive attribute S if:

Original: [Equation]
Revised: [Equation]

Original: Similar to equal opportunity, predictive equality enforces a partial form of equalized odds requiring equalized FPR across subgroups with no constraints on TPR.
Revised: Similar to equal opportunity, predictive equality enforces a partial form of equalized odds requiring equalized FPR across subgroups with no constraints on TPR.

Original: Conversely to equal opportunity, predictive equality applies well in scenarios in which the inclusion in the positive class under the model can be considered a poor outcome, and therefore causes considerable damage when the true label is negative.
Revised: Conversely to equal opportunity, predictive equality applies well in scenarios in which the inclusion in the positive class under the model can be considered a poor outcome, and therefore causes considerable damage when the true label is negative.

Original: Equality of opportunity and predictive equality both can be seen as partial requirements for equalized odds:
Revised: Equality of opportunity and predictive equality both can be seen as partial requirements for equalized odds:

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: [Equation]

Original: Therefore, any predictor satisfying equalized odds will satisfy both predictive equality and equal opportunity.
Revised: Therefore, any predictor satisfying equalized odds will satisfy both predictive equality and equal opportunity.

Original: C B LOCK DIAGRAM OF C ONFIDENTIAL -PROFITT
Revised: C B LOCK DIAGRAM OF C ONFIDENTIAL -PROFITT

Original: Figure 5 depicts an overview of Confidential-PROFITT which consists of four main steps.
Revised: Figure 5 depicts an overview of Confidential-PROFITT which consists of four main steps.

Original: D D ECISION TREE TRAINING D. D ECISION TREE TRAINING WITHOUT FAIRNESS CONSTRAINTS
Revised: D D ECISION TREE TRAINING D. D ECISION TREE TRAINING WITHOUT FAIRNESS CONSTRAINTS

Original: Decision trees used for classification are trained recursively from root to leaf node by successively partitioning the input set, as shown in Algorithm 3.
Revised: Decision trees used for classification are trained recursively from root to leaf node by successively partitioning the input set, as shown in Algorithm 3.

Original: Ideally, data points in the leaf nodes are pure with respect to class and the leaves are used for prediction during inference.
Revised: Ideally, data points in the leaf nodes are pure with respect to class and the leaves are used for prediction during inference.

Original: Partitioning is represented by nodes in a binary tree and enforced with a Boolean condition that splits the data based on some attribute value into at most two disjoint child nodes.
Revised: Partitioning is represented by nodes in a binary tree and enforced with a Boolean condition that splits the data based on some attribute value into at most two disjoint child nodes.

Original: To find the optimal splitting criterion for a node, the algorithm iterates over every attribute and attribute value.
Revised: To find the optimal splitting criterion for a node, the algorithm iterates over every attribute and attribute value.

Original: These values are used as thresholds to split the data into child nodes.
Revised: These values are used as thresholds to split the data into child nodes.

Original: The algorithm measures the information gained (with respect to node class purity) between the parent and child nodes and chooses the splitting criterion that maximized this gain.
Revised: The algorithm measures the information gained (with respect to node class purity) between the parent and child nodes and chooses the splitting criterion that maximized this gain.

Original: The process of finding the best split is detailed in Algorithm 4.
Revised: The process of finding the best split is detailed in Algorithm 4.

Original: Splitting continues until some maximum height is reached or until the node sizes have reached some minimum value.
Revised: Splitting continues until some maximum height is reached or until the node sizes have reached some minimum value.

Original: While there are many decision tree training algorithms, this paper uses the CART (Classification and
Revised: While there are many decision tree training algorithms, this paper uses the CART (Classification and

Original: Regression Tree) with information gain, Gini impurity, binary splitting, and binary classification for numerical and categorical datasets.
Revised: Regression Tree) with information gain, Gini impurity, binary splitting, and binary classification for numerical and categorical datasets.

Original: The CART algorithm has been popular since its inception in 1983 (Breiman et al., 1983).
Revised: The CART algorithm has been popular since its inception in 1983 (Breiman et al., 1983).

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure][Figure] [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: Input: Dataset X in j -th node DT [j].

Original: Output: Best split.

Original: 1: Accuracy_gains 2: Parent = X 3: for f ∈ Attributes do4: for x ∈ X do5: t = x
Revised: do do

Original: [ f ] ▷ Set split threshold value per datapoint 6:
Revised: Set split threshold value per datapoint 6:

Original: Child 1 = { x ∈ X | x [ f ] < t }, Child 2 = { x ∈ X | x [ f ] ≥ t } ▷ Make children 7:
Revised: Child 1 = { x ∈ X | x [ attr ] < val } Child 2 = { x ∈ X | x [ attr ] ≥ val } ▷ Make children 7:

Original: Gain Accuracy = Gini Accuracy ( Parent ) − (cid:80) 2 k =1 | Child k | | Parent | Gini Accuracy ( Child k )
Revised: Gain Accuracy = Gini Accuracy ( Parent ) − (cid:80) 2 k =1 | Child k | | Parent | Gini Accuracy ( Child k )

Original: ▷ Gain wrt label 8:
Revised: ▷ Gain wrt label 8:

Original: Accuracy_gains.append( f,t, Gain Accuracy ) 9: return DT [ j ] .
Revised: Accuracy_gains.append( attr , val , Gain Accuracy ) 9: return DT [ j ] .

Original: attr , DT [ j ] .
Revised: attr , DT [ j ] .

Original: val , DT [j ] . gains
Revised: val , DT [

Original: [Table]
Revised: [Table]

Original: D. D ECISION TREE TRAINING WITH FAIRNESS CONSTRAINTS
Revised: D. D ECISION TREE TRAINING WITH FAIRNESS CONSTRAINTS

Original: Training a decision tree with fairness while maintaining the root-to-leaf recursive training procedure only requires one additional step, detailed in Algorithm 4.
Revised: Training a decision tree with fairness while maintaining the root-to-leaf recursive training procedure only requires one additional step, detailed in Algorithm 4.

Original: While iterating over the various splits, we measure both information gain with respect to class Gini impurity and fairness Gini impurity.
Revised: While iterating over the various splits, we measure both information gain with respect to class Gini impurity and fairness Gini impurity.

Original: We select the splits that produced fairness information gains below some threshold before choosing whichever had the highest class information gain.
Revised: We select the splits that produced fairness information gains below some threshold before choosing whichever had the highest class information gain.

Original: This leads to a high fairness and accuracy for the dataset.
Revised: This leads to a high fairness and accuracy for the dataset.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: • Commitment to private inputs: On receiving ( Input , x ) from P , store x and send (cid:74) x (cid:75) to each [Table]
Revised: • Commitment to private inputs: On receiving ( Input , x ) from P , store x and send (cid:74) x (cid:75) to each party.

Original: • Commitment to (public) constants:
Revised: • Commitment to (public) constants:

Original: On receiving ( Const , x ) from both parties, store x and send (cid:74) x (cid:75) to each party (if the two inputs do not match, both parties receive cheating ).
Revised: On receiving ( Const , x ) from both parties, store x and send (cid:74) x (cid:75) to each party (if the two inputs do not match, both parties receive cheating ).

Original: • Boolean circuit satisfiability: On receiving ( Circ , C,
Revised: • Boolean circuit satisfiability: On receiving ( Circ , C,

Original: [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: x 
Revised: x n

Original: [Table] [Table]
Revised: [Table] [Table]

Original: ) from both parties, in which the x ’s are Boolean values and C is a Boolean circuit, compute b :=
Revised: ) from both parties, in which the x ’s are Boolean values and C is a Boolean circuit, compute b :=

Original: C ( x 0 , · · · , x n − 1 ) and send b to
Revised: C ( x 0 , · · · , x n − 1 ) and send b to

Original: [Figure]
Revised: [Figure]

Original: • Initialization:
Revised: • Initialization:

Original: On receiving ( Init , N ) from P and V , store an N -value array A with values initialized to ⊥ , and set f := honest .
Revised: On receiving ( Init , N ) from P and V , store an N -value array A with values initialized to ⊥ , and set f := honest .

Original: • Write:
Revised: • Write:

Original: On receiving ( Write , (cid:74) i (cid:75) , (cid:74) d (cid:75) ) from P and V , set
Revised: On receiving ( Write , (cid:74) i (cid:75) , (cid:74) d (cid:75) ) from P and V , set

Original: A [ i ] :=
Revised: A [ i ] :=

Original: d and send fresh (cid:74) d (cid:75) to each party.
Revised: d and send fresh (cid:74) d (cid:75) to each party.

Original: • Read:
Revised: • Read:

Original: On receiving ( Read , (cid:74) i (cid:75) , d ) , from P , ( Read , (cid:74) i (cid:75) ) from V , send (cid:74) d (cid:75) to both parties.
Revised: On receiving ( Read , (cid:74) i (cid:75) , d ) , from P , ( Read , (cid:74) i (cid:75) ) from V , send (cid:74) d (cid:75) to both parties.

Original: If d ̸ =
Revised: If d ̸ =

Original: A [ i ] set f := cheating .
Revised: A [ i ] set f := cheating .

Original: • Check:
Revised: • Check:

Original: On receiving ( Check ) from V , send f to both parties.
Revised: On receiving ( Check ) from V , send f to both parties.

Original: for Zero Knowledge Proofs with RAM access.
Revised: Zero Knowledge Proofs with RAM access.

Original: E P ROOF OF S ECURITY O F T HEOREM
Revised: E P ROOF OF S ECURITY O F T HEOREM

Original: We prove the property of our protocol based on the composition paradigm Canetti (2000), which is the standard way for proving cryptographic protocols.
Revised: We prove the property of our protocol based on the composition paradigm Canetti (2000), which is the standard way for proving cryptographic protocols.

Original: We represent the ideal functionality for our zero knowledge fairness check F ZKDT in Figure 6.
Revised: We represent the ideal functionality for our zero knowledge fairness check F ZKDT in Figure 6.

Original: To realize this functionality, the protocol described in Algorithm 2 specifies a series of calls to a Zero-Knowledge Proof functionality with
Revised: To realize this functionality, the protocol described in Algorithm 2 specifies a series of calls to a Zero-Knowledge Proof functionality with

Original: RAM capabilities F ZK , which is given in Figure 7.
Revised: RAM capabilities F ZK , which is given in Figure 7.

Original: This can be instantiated using existing works that construct RAM-based zero-knowledge proofs.
Revised: This can be instantiated using existing works that construct RAM-based zero-knowledge proofs.

Original: Proof.
Revised: Proof.

Original: A given execution of the protocol in Algorithm 2 comes with a prescribed pattern of calls to
Revised: A given execution of the protocol in Algorithm 2 comes with a prescribed pattern of calls to

Original: F ZK – the low level details of this pattern are abstracted in the algorithm, but specified exactly in the code that implements our protocol.
Revised: F ZK – the low level details of this pattern are abstracted in the algorithm, but specified exactly in the code that implements our protocol.

Original: Any deviation from this pattern of calls to F ZK is detected trivially (since the honest party sends a command to F ZK that goes unanswered), and results in abort of the protocol.
Revised: Any deviation from this pattern of calls to F ZK is detected trivially (since the honest party sends a command to F ZK that goes unanswered), and results in abort of the protocol.

Original: Thus no adversary A is able to break security by deviating from this pattern.
Revised: Thus no adversary A is able to break security by deviating from this pattern.

Original: For those adversaries that follow the correct pattern of calls, we construct simulators as follows.
Revised: For those adversaries that follow the correct pattern of calls, we construct simulators as follows.

Original: Malicious Prover: Simulator S interacts with F ZKDT with the following procedure, running malicious Prover A in the F ZK -hybrid model as a subroutine:
Revised: Malicious Prover: Simulator S interacts with F ZKDT with the following procedure, running malicious Prover A in the F ZK -hybrid model as a subroutine:

Original: Simulating F ZK , S receives ( Init , N ) from A , in which N is the size of RAM required to represent the computation.
Revised: Simulating F ZK , S receives ( Init , N ) from A , in which N is the size of RAM required to represent the computation.

Original: Store flag f := honest .
Revised: Store flag f := honest .

Original: Initialize an array A in accordance with F ZK .
Revised: Initialize an array A in accordance with F ZK .

Original: Next S receives a sequence of Input commands from A , followed by Const commands to obtain RAM indices, and Write commands to store the values in the RAM.
Revised: Next S receives a sequence of Input commands from A , followed by Const commands to obtain RAM indices, and Write commands to store the values in the RAM.

Original: Write the values into A and interpret them as X and DT.
Revised: Write the values into A and interpret them as X and DT.

Original: Send back commitments (cid:74) X (cid:75) and (cid:74) DT (cid:75) .
Revised: Send back commitments (cid:74) X (cid:75) and (cid:74) DT (cid:75) .

Original: Receive a sequence of ( Const , 0) and ( Const , RAM index ) followed by Write commands to initialize c 1 and c 2 .
Revised: Receive a sequence of ( Const , 0) and ( Const , RAM index ) followed by Write commands to initialize c 1 and c 2 .

Original: Similarly to the previous step, store these values in A and send back (cid:74) c 1 (cid:75) and (cid:74) c 2 (cid:75) .
Revised: Similarly to the previous step, store these values in A and send back (cid:74) c 1 (cid:75) and (cid:74) c 2 (cid:75) .

Original: For all x i ∈
Revised: For all x i ∈

Original: X do: 4.
Revised: X do: 4.

Original: Receive Input , Const , and Write commands to store { I 1 , · · · , I H } .
Revised: Receive Input , Const , and Write commands to store { I 1 , · · · , I H } .

Original: Write the values in A , and send back { (cid:74) I 1 (cid:75) , · · · , (cid:74) I H (cid:75) } .
Revised: Write the values in A , and send back { (cid:74) I 1 (cid:75) , · · · , (cid:74) I H (cid:75) } .

Original: Receive ( Read , (cid:74) index of x [ a ] (cid:75) , s ) , if A [ index of x [ a ]] ̸ = s , set f := cheating .
Revised: Receive ( Read , (cid:74) index of x [ a ] (cid:75) , s ) , if A [ index of x [ a ]] ̸ = s , set f := cheating .

Original: Send back (cid:74) s (cid:75) .
Revised: Send back (cid:74) s (cid:75) .

Original: For all j ∈ [1 , H ] do:- trieve [ I j a
Revised: For all j ∈ [1 , H ] do:

Original: command to verify b ZK Clearly S constructs a view for A that is indistinguishable from real world execution, since all interactions with A through F ZK are performed faithfully.
Revised: Clearly S constructs a view for A that is indistinguishable from real world execution, since all interactions with A through F ZK are performed faithfully.

Original: Input extraction follows trivially since A sends the values of X and DT to F ZK in the commitment phase.
Revised: Input extraction follows trivially since A sends the values of X and DT to F ZK in the commitment phase.

Original: Further, we have that the generated view is consistent with the outputs generated by A ’s inputs, since the fairness checking phase directly computes (an algebraic rearrangement of)
Revised: Further, we have that the generated view is consistent with the outputs generated by A ’s inputs, since the fairness checking phase directly computes (an algebraic rearrangement of)

Original: Gain Unfairness ( i, X, DT ) ≤ τ for each interior node index i .
Revised: Gain Unfairness ( i, X, DT ) ≤ τ for each interior node index i .

Original: Malicious Verifier: Simulator S interacts with F ZKDT with the following procedure, running malicious Verifier A in the F ZK -hybrid model as a subroutine:
Revised: Malicious Verifier: Simulator S interacts with F ZKDT with the following procedure, running malicious Verifier A in the F ZK -hybrid model as a subroutine:

Original: Simulating F ZK , S receives ( Init , N ) from A , where N is the size of RAM required to represent the computation.
Revised: Simulating F ZK , S receives ( Init , N ) from A , where N is the size of RAM required to represent the computation.

Original: Store flag f := honest .
Revised: Store flag f := honest .

Original: Initialize an array A in accordance with F ZK .
Revised: Initialize an array A in accordance with F ZK .

Original: Next, simulate a series of Input commands by sending (cid:74) 0 (cid:75) to A several times (with fresh randomness each time).
Revised: Next, simulate a series of Input commands by sending (cid:74) 0 (cid:75) to A several times (with fresh randomness each time).

Original: Then receive a series of Const commands to obtain commitments to RAM indices – simulate F ZK by sending back commitments to the requested indices.
Revised: Then receive a series of Const commands to obtain commitments to RAM indices – simulate F ZK by sending back commitments to the requested indices.

Original: Next receive Write commands from A for storage of the dataset in the RAM.
Revised: Next receive Write commands from A for storage of the dataset in the RAM.

Original: Store 

Revised: Store

Original: at each requested index and send (cid:74) 0 (cid:75) to simulate responses to the Write commands.
Revised: at each requested index and send (cid:74) 0 (cid:75) to simulate responses to the Write commands.

Original: In this way, A receives a list of commitments that stand in for (cid:74) X (cid:75) and (cid:74) DT (cid:75) .
Revised: In this way, A receives a list of commitments that stand in for (cid:74) X (cid:75) and (cid:74) DT (cid:75) .

Original: Receive a sequence of ( Const , 0) and ( Const , RAM index ) followed by Write commands to initialize c 1 and c 2 .
Revised: Receive a sequence of ( Const , 0) and ( Const , RAM index ) followed by Write commands to initialize c 1 and c 2 .

Original: Give commitments to the requested Const values faithfully, store these values in A , and send back (cid:74) c 1 (cid:75) and (cid:74) c 2 (cid:75) .
Revised: Give commitments to the requested Const values faithfully, store these values in A , and send back (cid:74) c 1 (cid:75) and (cid:74) c 2 (cid:75) .

Original: For all x i ∈
Revised: For all x i ∈

Original: X do: 4.
Revised: X do: 4.

Original: To simulate commitment to { I 1 , · · · , I H } , send (cid:74) 0 (cid:75) for Input commands, and faithful commitments to RAM indices when Const commands are received from A .
Revised: To simulate commitment to { I 1 , · · · , I H } , send (cid:74) 0 (cid:75) for Input commands, and faithful commitments to RAM indices when Const commands are received from A .

Original: Simulate Write commands by storing 0 at the requested indices in A , and send (cid:74) 

Revised: Simulate Write commands by storing 0 at the requested indices in A , and send (cid:74)

Original: (cid:75) to stand in for the commitments { (cid:74) I 1 (cid:75) , · · · , (cid:74) I H (cid:75) } .
Revised: (cid:75) to stand in for the commitments { (cid:74) I 1 (cid:75) , · · · , (cid:74) I H (cid:75) } .

Original: Receive ( Read , (cid:74) index of x [ a ] (cid:75) ) , simulate honest execution of F ZK by sending back (cid:74) 0 (cid:75) and keeping f = honest .
Revised: Receive ( Read , (cid:74) index of x [ a ] (cid:75) ) , simulate honest execution of F ZK by sending back (cid:74) 0 (cid:75) and keeping f = honest .

Original: For all j ∈ [1 , H ] do: 7.
Revised: For all j ∈ [1 , H ] do: 7.

Original: Send (cid:74) b (cid:75)
Revised: Send (cid:74) b (cid:75)

Original: where b = 0 .
Revised: where b = 0 .

Original: Receive Read commands to retrieve x
Revised: Receive Read commands to retrieve x

Original: [ DT [ I j ] .
Revised: [ DT [ I j ] .

Original: attr ] and x [ DT [ I j ] .
Revised: attr ] and x [ DT [ I j ] .

Original: val – simulate by sending (cid:74) 0 (cid:75) and keeping f = honest .
Revised: val – simulate by sending (cid:74) 0 (cid:75) and keeping f = honest .

Original: Next receive a Circ command to verify that b = x
Revised: Next receive a Circ command to verify that b = x

Original: [ DT [ I j ] .
Revised: [ DT [ I j ] .

Original: attr ] <
Revised: attr ] <

Original: DT [ I j ] .
Revised: DT [ I j ] .

Original: val – send back 1 indicating that the equality holds.
Revised: val – send back 1 indicating that the equality holds.

Original: Receive commands to verify (cid:74) I j +1 (cid:75)
Revised: Receive commands to verify (cid:74) I j +1 (cid:75)

Original: = 2 (cid:74) I j (cid:75)
Revised: = 2 (cid:74) I j (cid:75)

Original: + (cid:74) b (cid:75) , as in previous steps send (cid:74) 0 (cid:75) to simulate commitments for the Read commands (while keeping f = honest ) and send 1 in response to Circ commands indicating that the desired equality holds.
Revised: + (cid:74) b (cid:75) , as in previous steps send (cid:74) 0 (cid:75) to simulate commitments for the Read commands (while keeping f = honest ) and send 1 in response to Circ commands indicating that the desired equality holds.

Original: Receive commands to verify updates c 1 [ I j ] + s and c 

Revised: Receive commands to verify updates c 1 [ I j ] + s and c

Original: [ I j ] + ¬ s and write the updates to the RAM.
Revised: [ I j ] + ¬ s and write the updates to the RAM.

Original: Simulate the verification as in the previous two steps, and send (cid:74) 0 (cid:75) in response to the Write commands.
Revised: Simulate the verification as in the previous two steps, and send (cid:74) 0 (cid:75) in response to the Write commands.

Original: For all i ∈ { interior node indices } do - Receive Read commands to retrieve c 1 [ i ] , c 1 [2 i ] , c 1 [2 i +1] , c 

Revised: For all i ∈ { interior node indices } do - Receive Read commands to retrieve c 1 [ i ] , c 1 [2 i ] , c 1 [2 i +1] , c

Original: [ i ] , c 2 [2 i ] , c 2 [2 i +1] , followed by Circ commands to carry out the fairness check.
Revised: [ i ] , c 2 [2 i ] , c 2 [2 i +1] , followed by Circ commands to carry out the fairness check.

Original: As before, send (cid:74) 0 (cid:75) to simulate commitments and send 1 to indicate that the fairness checks pass.
Revised: As before, send (cid:74) 0 (cid:75) to simulate commitments and send 1 to indicate that the fairness checks pass.

Original: After protocol execution, receive Check command.
Revised: After protocol execution, receive Check command.

Original: Simulate F ZK by sending honest to A .
Revised: Simulate F ZK by sending honest to A .

Original: [Table]
Revised: [Table]

Original: S constructs a view for A that is indistinguishable from real world execution, since all handles (cid:74)
Revised: S constructs a view for A that is indistinguishable from real world execution, since all handles (cid:74)

Original: [Table]
Revised: [Table]

Original: given to A are indistinguishable from those during real-world execution, and because in simulating
Revised: given to A are indistinguishable from those during real-world execution, and because in simulating

Original: F ZK , S can trivially indicate that the component circuits of the protocol are satisfied properly.
Revised: F ZK , S can trivially indicate that the component circuits of the protocol are satisfied properly.

Original: We would like to highlight that our approach relies on zero-knowledge proofs to formally guarantee the confidentiality of the learned model as well as of the data even against a malicious auditor (see the above mathematical proof).
Revised: We would like to highlight that our approach relies on zero-knowledge proofs to formally guarantee the confidentiality of the learned model as well as of the data even against a malicious auditor (see the above mathematical proof).

Original: To be more precise, the confidentiality of the model and data is ensured by the “zero-knowledge” property of the underlying cryptographic protocol that can tolerate any malicious behavior (Goldwasser et al., 1985;
Revised: To be more precise, the confidentiality of the model and data is ensured by the “zero-knowledge” property of the underlying cryptographic protocol that can tolerate any malicious behavior (Goldwasser et al., 1985;

Original: Goldreich et al., 1991).
Revised: Goldreich et al., 1991).

Original: The security of these protocols are in turn based on standard hardness assumptions used to secure the Internet.
Revised: The security of these protocols are in turn based on standard hardness assumptions used to secure the Internet.

Original: We note that the zero-knowledge proof protocol itself is not the focus of this paper; instead, we show how we can use existing zero-knowledge proof protocols to prove fairness-aware training in a smart way for high efficiency.
Revised: We note that the zero-knowledge proof protocol itself is not the focus of this paper; instead, we show how we can use existing zero-knowledge proof protocols to prove fairness-aware training in a smart way for high efficiency.

Original: The confidentiality of our system can be ensured by any secure zero-knowledge proof system (which is what Appendix E proves), including the one used in this paper or others systems.
Revised: The confidentiality of our system can be ensured by any secure zero-knowledge proof system (which is what Appendix E proves), including the one used in this paper or others systems.

Original: F O UR ZERO - KNOWLEDGE PROOF PROTOCOL FOR TREE TRAINING WITH EQUALIZED ODDS FAIRNESS
Revised: F O UR ZERO - KNOWLEDGE PROOF PROTOCOL FOR TREE TRAINING WITH EQUALIZED ODDS FAIRNESS

Original: Algorithm 5 follows the same ideas as Algorithm 2, except it proves that Gain + Eodds and Gain − Eodds do not exceed the threshold τ , rather than Gain DP .
Revised: Algorithm 5 follows the same ideas as Algorithm 2, except it proves that Gain + Eodds and Gain − Eodds do not exceed the threshold τ , rather than Gain DP .

Original: As in Algorithm 2, these metrics are computed and proved by counting the number of samples of particular categories that pass through each node in the tree.
Revised: As in Algorithm 2, these metrics are computed and proved by counting the number of samples of particular categories that pass through each node in the tree.

Original: However, to compute Gain + Eodds and Gain − Eodds we need to keep track of four categories of samples rather than just two: samples that are in the protected class with true positive label, samples in the unprotected class with true positive label, samples in the protected class with true negative label, and samples in the unprotected class with true negative label.
Revised: However, to compute Gain + Eodds and Gain − Eodds we need to keep track of four categories of samples rather than just two: samples that are in the protected class with true positive label, samples in the unprotected class with true positive label, samples in the protected class with true negative label, and samples in the unprotected class with true negative label.

Original: To keep track of these quantities at each node, we use four counting trees, whose commitments are updated by adding Boolean values u 1 through u 4 indexing which category a given sample falls into.
Revised: To keep track of these quantities at each node, we use four counting trees, whose commitments are updated by adding Boolean values u 1 through u 4 indexing which category a given sample falls into.

Original: In Phase 2 of the algorithm, the sample counts are used to show that in each interior node, the Gain + Eodds and Gain − Eodds do not exceed the threshold τ .
Revised: In Phase 2 of the algorithm, the sample counts are used to show that in each interior node, the Gain + Eodds and Gain − Eodds do not exceed the threshold τ .

Original: [Table]
Revised: [Table]

Original: G D ETAILS ON EXPERIMENTAL SETUP G. D ETAILS ON DATASETS
Revised: G D ETAILS ON EXPERIMENTAL SETUP G. D ETAILS ON DATASETS

Original: We consider four common datasets for fairness benchmarking (summarized in Table 4):
Revised: We consider four common datasets for fairness benchmarking (summarized in Table 4):

Original: COMPAS (Angwin et al., 2016) 3 attempts to predict recidivism with recidivists comprising 53% of the dataset.
Revised: COMPAS (Angwin et al., 2016) 3 attempts to predict recidivism with recidivists comprising 53% of the dataset.

Original: For fairness, we consider just two of the provided races (AfricanAmerican and Caucasian) as sensitive attributes, in which African-Americans are the majority class at 60% of the dataset. 2.
Revised: For fairness, we consider just two of the provided races (AfricanAmerican and Caucasian) as sensitive attributes, in which African-Americans are the majority class at 60% of the dataset. 2.

Original: Communities and Crime (Redmond, 2009) 4 (Crime) is used for regression to determine if a community will have a high violent crime rate.
Revised: Communities and Crime (Redmond, 2009) 4 (Crime) is used for regression to determine if a community will have a high violent crime rate.

Original: We adapt this task for classification by binarizing the target ViolentCrimesPerPop to ≥ .
Revised: We adapt this task for classification by binarizing the target ViolentCrimesPerPop to ≥ .

Original: 7 and for the fairness attribute binarize RacepctBlack ≥ .
Revised: 7 and for the fairness attribute binarize RacepctBlack ≥ .

Original: 06 in which the disadvantaged communities have higher Black populations and make up 52.1% of the dataset. 3.
Revised: 06 in which the disadvantaged communities have higher Black populations and make up 52.1% of the dataset. 3.

Original: Census Income (Adu, 1996) 

Revised: Census Income (Adu, 1996)

Original: (Adult) attempts to predict if an individuals income is ≥ 50 , 000 , in which 75% of the individuals have a salary below 50K.
Revised: (Adult) attempts to predict if an individuals income is ≥ 50 , 000 , in which 75% of the individuals have a salary below 50K.

Original: We use gender (Male, Female) as the sensitive attribute, in which Males composed 68% of the dataset. 4.
Revised: We use gender (Male, Female) as the sensitive attribute, in which Males composed 68% of the dataset. 4.

Original: Default Credit (Def, 2016) 6 (Credit) seeks to predict if an individual will default on an credit card payment.
Revised: Default Credit (Def, 2016) 6 (Credit) seeks to predict if an individual will default on an credit card payment.

Original: The default class composed 22% of the dataset, and the sensitive attribute used is the age with the minority group of young individual under 25 constituting 13% of the dataset.
Revised: The default class composed 22% of the dataset, and the sensitive attribute used is the age with the minority group of young individual under 25 constituting 13% of the dataset.

Original: G. D ETAILS ON OUR IMPLEMENTATION
Revised: G. D ETAILS ON OUR IMPLEMENTATION

Original: We use two distinct code bases: one for efficient ZK protocol implementation and the second for assessing the accuracy and fairness of our fair decision tree.
Revised: We use two distinct code bases: one for efficient ZK protocol implementation and the second for assessing the accuracy and fairness of our fair decision tree.

Original: EMP-toolkit.
Revised: EMP-toolkit.

Original: We use EMP-toolkit (Wang et al., 2016) to implement our ZK protocol.
Revised: We use EMP-toolkit (Wang et al., 2016) to implement our ZK protocol.

Original: EMP is written in C++ and offers efficient implementations of ZK protocols.
Revised: EMP is written in C++ and offers efficient implementations of ZK protocols.

Original: This code base is used for timing results (benchmarking the efficiency of our ZK protocol) and conducted using two Amazon EC2 c6a.2xlarge machines to represent the prover and verifier.
Revised: This code base is used for timing results (benchmarking the efficiency of our ZK protocol) and conducted using two Amazon EC2 c6a.2xlarge machines to represent the prover and verifier.

Original: We use the Linux tc command to simulate a LAN connection between the two machines with a bandwidth of at most 1000Mbit/sec and latency of 2ms.
Revised: We use the Linux tc command to simulate a LAN connection between the two machines with a bandwidth of at most 1000Mbit/sec and latency of 2ms.

Original: We report the median runtime of 5 experiments at each parameter setting.
Revised: We report the median runtime of 5 experiments at each parameter setting.

Original: JSAT with Fair Trees and Forests.
Revised: JSAT with Fair Trees and Forests.

Original: The Java Statistical Analysis Tool (JSAT) (Raff, 2017), is an open source Java library which supports decision tree and random forest models.
Revised: The Java Statistical Analysis Tool (JSAT) (Raff, 2017), is an open source Java library which supports decision tree and random forest models.

Original: We built on the Fair-Forest extension of JSAT in Fantin (2020) and implemented splitting criteria to recreate the work of Kamiran et al.
Revised: We built on the Fair-Forest extension of JSAT in Fantin (2020) and implemented splitting criteria to recreate the work of Kamiran et al.

Original: (2010) and Raff et al.
Revised: (2010) and Raff et al.

Original: (2018) as a baseline for demographic parity fair trees.
Revised: (2018) as a baseline for demographic parity fair trees.

Original: Additionally, we implement a splitting criterion for Gain Unfairness based on thresholds for both demographic parity and equalized odds fairness.
Revised: Additionally, we implement a splitting criterion for Gain Unfairness based on thresholds for both demographic parity and equalized odds fairness.

Original: To evaluate Confidential-PROFITT, we train decision trees and random forests for 250 values of τ with 10 random seeds each.
Revised: To evaluate Confidential-PROFITT, we train decision trees and random forests for 250 values of τ with 10 random seeds each.

Original: For each dataset, we set the height of the tree by observing test and training set results in a decision tree trained without fairness.
Revised: For each dataset, we set the height of the tree by observing test and training set results in a decision tree trained without fairness.

Original: We choose the smallest height that maintains accuracy without overfitting.
Revised: We choose the smallest height that maintains accuracy without overfitting.

Original: These heights are reported for each dataset in Table 4.
Revised: These heights are reported for each dataset in Table 4.

Original: We evaluate fairness and accuracy using Fairlearn (Bird et al., 2020) and SciPy (Virtanen et al., 2020) over a testing set using a test-train split of 75% : 25% .
Revised: We evaluate fairness and accuracy using Fairlearn (Bird et al., 2020) and SciPy (Virtanen et al., 2020) over a testing set using a test-train split of 75% : 25% .

Original: Experiments are run on 8 Intel Xeon CPUs with Java (v. 14.0.2).
Revised: Experiments are run on 8 Intel Xeon CPUs with Java (v. 14.0.2).

Original: Our code can be found publicly on GitHub 7 .

Original: G. D ETAILS ON OUR EVALUATION METRICS
Revised: G. D ETAILS ON OUR EVALUATION METRICS

Original: Demographic parity unfairness.
Revised: Demographic parity unfairness.

Original: Demographic parity (DP) unfairness is often characterized by the absolute value of the gap between the positive prediction rate for each subgroup.
Revised: Demographic parity (DP) unfairness is often characterized by the absolute value of the gap between the positive prediction rate for each subgroup.

Original: DP unfairness has a range of [0 , 1] in which a value of 0 corresponds to perfect DP fairness.
Revised: DP unfairness has a range of [0 , 1] in which a value of 0 corresponds to perfect DP fairness.

Original: We measure this with
Revised: We measure this with

Original: Fairlearn’s fairlearn.metrics.demographic_parity_difference function (Bird et al., 2020).
Revised: Fairlearn’s fairlearn.metrics.demographic_parity_difference function (Bird et al., 2020).

Original: DP unfairness = (cid:12)(cid:12)
Revised: DP unfairness = (cid:12)

Original: Pr[ ˆ Y = 1 | S = a ] − Pr [ ˆ Y = 1 | S = b ] (cid:12)(cid:12) ∀ a, b ∈ S.
Revised: [Equation]

Original: Equalized odds unfairness.
Revised: Equalized odds unfairness.

Original: Equalized odds (Eodds) unfairness is characterized by the largest gap between subgroups’ true positive and false positive rates.
Revised: Equalized odds (Eodds) unfairness is characterized by the largest gap between subgroups’ true positive and false positive rates.

Original: Eodds unfairness has a range of [0 , 1] , in which a value of 0 corresponds to perfect Eodds fair.
Revised: Eodds unfairness has a range of [0 , 1] , in which a value of 0 corresponds to perfect Eodds fair.

Original: We measure this with Fairlearn’s fairlearn.metrics.equalized_odds_difference function (Bird et al., 2020).
Revised: We measure this with Fairlearn’s fairlearn.metrics.equalized_odds_difference function (Bird et al., 2020).

Original: Eodds unfairness= (cid:12)(cid:12)
Revised: Eodds unfairness

Original: Pr[ ˆ Y = 1 | Y = 1 , S = a ] − Pr [ ˆ Y = 1 | Y = 1 , S = b ] (cid:12)(cid:12) ∀ a, b ∈ S.
Revised: [Equation]

Original: Unfairness gain of the trained decision tree.
Revised: Unfairness gain of the trained decision tree.

Original: Unfairness gain ( Gain Unfairness ) is the information gain over parent and child nodes’ Gini impurity ( Gini Unfairness ) of sensitive attribute a .
Revised: Unfairness gain ( Gain Unfairness ) is the information gain over parent and child nodes’ Gini impurity ( Gini Unfairness ) of sensitive attribute a .

Original: Gini Unfairness may be taken with respect to demographic parity or equalized odds unfairness.
Revised: Gini Unfairness may be taken with respect to demographic parity or equalized odds unfairness.

Original: Accuracy.
Revised: Accuracy.

Original: The accuracy is computed from the ratio of the number of correct predictions to the total number of predictions.
Revised: The accuracy is computed from the ratio of the number of correct predictions to the total number of predictions.

Original: Here, we use SciPy’s sklearn.metrics.accuracy_score function (Virtanen et al., 2020).
Revised: Here, we use SciPy’s sklearn.metrics.accuracy_score function (Virtanen et al., 2020).

Original: H C OMMUNICATION COSTS
Revised: H C OMMUNICATION COSTS

Original: In this section, we evaluate the communication costs of our framework.
Revised: In this section, we evaluate the communication costs of our framework.

Original: Figure 8 evaluates the communication costs of Confidential-PROFITT as a function of number of training samples, number of attributes, and height of trees using both demographic parity and equalized odds.
Revised: Figure 8 evaluates the communication costs of Confidential-PROFITT as a function of number of training samples, number of attributes, and height of trees using both demographic parity and equalized odds.

Original: The communication cost of Confidential-PROFITT increases linearly as we increase the number of training samples or the number of attributes.
Revised: The communication cost of Confidential-PROFITT increases linearly as we increase the number of training samples or the number of attributes.

Original: The reason for this is that the communication cost of committing to each sample is constant, and this cost increases as the number of attributes increases.
Revised: The reason for this is that the communication cost of committing to each sample is constant, and this cost increases as the number of attributes increases.

Original: The increased steepness of the 10 6 sample benchmark is likely a result of the batch amortization used by our underlying ZKP framework.
Revised: The increased steepness of the 10 6 sample benchmark is likely a result of the batch amortization used by our underlying ZKP framework.

Original: In general, equalized odds incurs higher communication costs than demographic parity as proofs need to be performed over four counting trees in equalized odds, but only two in demographic parity.
Revised: In general, equalized odds incurs higher communication costs than demographic parity as proofs need to be performed over four counting trees in equalized odds, but only two in demographic parity.

Original: I R ANDOM FOREST CAN IMPROVE UPON THE PERFORMANCE OF A DECISION TREE
Revised: I R ANDOM FOREST CAN IMPROVE UPON THE PERFORMANCE OF A DECISION TREE

Original: We show results for the model performances of both decision trees and random forests trained without fairness in Table 5.
Revised: We show results for the model performances of both decision trees and random forests trained without fairness in Table 5.

Original: These results show that random forests improves upon the accuracy of decision trees across all datasets.
Revised: These results show that random forests improves upon the accuracy of decision trees across all datasets.

Original: However, random forests are typically more unfair, supporting prior conclusions that standard ensemble strategies alone cannot improve fairness (Feffer et al., 2022;
Revised: However, random forests are typically more unfair, supporting prior conclusions that standard ensemble strategies alone cannot improve fairness (Feffer et al., 2022;

Original: Bhaskaruni et al., 2019).
Revised: Bhaskaruni et al., 2019).

Original: [Figure]
Revised: [Figure]

Original:  mm un i c a t i o n ( M B )
Revised: C o mm un i c a t i o n ( M B )

Original: [Figure]
Revised: [Figure]

Original: mm [Figure] i 
Revised: mm un i c a t i o n ( M B )

Original: [Figure]
Revised: [Figure]

Original: t i o n ( M B )

Original: [Figure]
Revised: [Figure]

Original:  mm un i [Figure] a t i o n ( M B )
Revised: C o mm un i c a t i o n ( M B )

Original: Dataset
Revised: Dataset

Original: Accuracy
Revised: Accuracy

Original: Unfairness (Demographic Parity)
Revised: Unfairness (Demographic Parity)

Original: Unfairness (Eodds)
Revised: Unfairness [Table] Eodds)

Original: DT
Revised: DT

Original: RF
Revised: RF

Original: DT
Revised: DT

Original: RF
Revised: RF

Original: DT
Revised: [Table]

Original: RF
Revised: RF

Original: Crime .
Revised: Crime .

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: .. 432 ± .. 443 ± .
Revised: .. 432 ± .. [Table]

Original: COMPAS .
Revised: COMPAS .

Original: 601 ± .

Original: [Table]
Revised: [Table]

Original: 652 ± .
Revised: [Table] [Table] [Table] [Table]

Original: [Table]
Revised: [Table]

Original: 121 ± .. 178 ± .. 135 ± .. 190 ± .
Revised: [Table] [Table] [Table]

Original: Adult .
Revised: Adult .

Original: [Table]
Revised: [Table]

Original: [Table] [Table] 
Revised: [Table] [Table] [Table]

Original: [Table]
Revised: [Table]

Original: .. 130 ± .. 076 ± .. 091 ± .

Original: Credit.
Revised: Credit

Original: [Table] [Table]
Revised: [Table] [Table]

Original: 042 ± .. 034 ± .. 028 ± ..
Revised: [Table]

Original: 026 ± .
Revised: [Table] [Table] [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: J O UR Z ERO -K NOWLEDGE P ROOF P ROTOCOL FOR R ANDOM F OREST T RAINING WITH F AIRNESS
Revised: J O UR Z ERO -K NOWLEDGE P ROOF P ROTOCOL FOR R ANDOM F OREST T RAINING WITH F AIRNESS

Original: Our protocol for the fair training of decision trees is described in Algorithm 6.
Revised: Our protocol for the fair training of decision trees is described in Algorithm 6.

Original: The parties use the input randomness (decided via a secure coin-flipping protocol) to index into a committed dataset, thus obtaining subsamples.
Revised: The parties use the input randomness (decided via a secure coin-flipping protocol) to index into a committed dataset, thus obtaining subsamples.

Original: Next, decision trees can be trained on the subsamples to build the trees used in the random forest.
Revised: Next, decision trees can be trained on the subsamples to build the trees used in the random forest.

Original: Finally, the fairness of the trees can be verified individually using Algorithm 2.
Revised: Finally, the fairness of the trees can be verified individually using Algorithm 2.

Original: Note that we use the same tree heights for random forests as for decision trees (as reported in Table 4).
Revised: Note that we use the same tree heights for random forests as for decision trees (as reported in Table 4).

Original: We create random forests from a collection of 10 decision trees in which each node considers a random subset of attributes of size √ H , in which H is the total number of attributes.
Revised: We create random forests from a collection of 10 decision trees in which each node considers a random subset of attributes of size √ H , in which H is the total number of attributes.

Original: K A DDITIONAL RESULTS ON THE RELATIONSHIPS BETWEEN UNFAIRNESS INFORMATION GAIN AND UNFAIRNESS DEFINITIONS
Revised: K A DDITIONAL RESULTS ON THE RELATIONSHIPS BETWEEN UNFAIRNESS INFORMATION GAIN AND UNFAIRNESS DEFINITIONS

Original: Figures 9 and 10 show the relationship between Gain Unfairness and the fairness gap for demographic parity and equalized odds, respectively.
Revised: Figures 9 and 10 show the relationship between Gain Unfairness and the fairness gap for demographic parity and equalized odds, respectively.

Original: The Gain Unfairness reported in these figures was computed from the average values for all nodes of ten trees trained from one of 250 threshold values.
Revised: The Gain Unfairness reported in these figures was computed from the average values for all nodes of ten trees trained from one of 250 threshold values.

Original: They show a positive correlation between Gain Unfairness and the fairness gap, supporting our intuition that bounding Gain Unfairness leads to a smaller fairness gap.
Revised: They show a positive correlation between Gain Unfairness and the fairness gap, supporting our intuition that bounding Gain Unfairness leads to a smaller fairness gap.

Original: [Figure]
Revised: [Figure]

Original: [Figure]

Original: ss

Original: [Figure]
Revised: [Figure]

Original: a i n
Revised: a i n

Original: [Figure]
Revised: [Figure]

Original: O
Revised: O

Original: [Figure]
Revised: [Figure]

Original: We compute the average unfairness information gain over all node splits for decision trees created with a sweep of threshold bounds on unfair information gain.
Revised: We compute the average unfairness information gain over all node splits for decision trees created with a sweep of threshold bounds on unfair information gain.