F AIR N ORMALIZING F LOWS
Anonymous authors
Paper under double-blind review
A BSTRACT
Fair representation learning is an attractive approach that promises fairness of downstream predictors by encoding sensitive data.
Unfortunately, recent work has shown that strong adversarial predictors can still exhibit unfairness by recovering sensitive attributes from these representations.
In this work, we present Fair Normalizing Flows (FNF), a new approach offering more rigorous fairness guarantees for learned representations.
Speciﬁcally, we consider a practical setting where we can estimate the probability density for sensitive groups.
The key idea is to model the encoder as a normalizing ﬂow trained to minimize the statistical distance between the latent representations of different groups.
The main advantage of
FNF is that its exact likelihood computation allows us to obtain guarantees on the maximum unfairness of any potentially adversarial downstream predictor.
We experimentally demonstrate the effectiveness of FNF in enforcing various group fairness notions, as well as other attractive properties such as interpretability and transfer learning, on a variety of challenging real-world datasets.
I NTRODUCTION
As machine learning is being increasingly used in scenarios that can negatively affect humans (Brennan et al., 2009; Khandani et al., 2010; Barocas & Selbst, 2016), fair representation learning has become one of the most promising ways to encode data into new, unbiased representations with high utility.
Concretely, the goal is to ensure that representations have two properties: (i) they are informative for various prediction tasks of interest, (ii) sensitive attributes of the original data (e.g., race) cannot be recovered from the representations.
Perhaps the most prominent approach for learning fair representations is adversarial training (Edwards & Storkey, 2016; Madras et al., 2018;
Xie et al., 2017; Song et al., 2019; Roy & Boddeti, 2019) which jointly trains an encoder trying to transform data into a fair representation with an adversary attempting to recover sensitive attributes from the representation.
However, several recent lines of work (Feng et al., 2019; Moyer et al., 2018; Elazar &
Goldberg, 2018; Xu et al., 2020; Gupta et al., 2021; Song & Shmatikov, 2020) have noticed that these approaches do not produce truly fair representations: stronger adversaries can in fact recover sensitive attributes.
Clearly, this could allow malicious or ignorant users to use the provided representations to discriminate.
This problem emerges at a time when regulators are crafting rules (Whittaker et al., 2018; EU, 2021; FTC, 2021) on the fair usage of AI, stating that any entity that cannot guarantee non-discrimination would be held accountable for the produced data.
This raises the question: Can we learn representations which provably guarantee that sensitive attributes cannot be recovered?
This work Following prior work, we focus on tabular datasets used for tasks such as loan or insurance asessment where fairness is of high relevance.
We assume that the original input data x comes from two probability distributions p 0 and p 1 , representing groups with sensitive attributes a = 0 and a = 1 , respectively.
In the cases where distributions p 0 and p 1 are known, we will obtain provable fairness guarantees, and otherwise we perform density estimation and obtain guarantees with respect to the estimated distribution.
In our experimental evaluation we conﬁrm that the bounds computed on the estimated distribution in practice also bound adversarial accuracy on the true distribution, meaning that density estimation works well for the setting we consider.
To address the above challenges, we propose Fair Normalizing Flows (FNF), a new method for learning fair representations with guarantees.
In contrast to other approaches where encoders are standard feed-forward neural networks, we instead model the encoder as a normalizing ﬂow (Rezende & Mohamed, 2015).
Fig.
1 provides a high-level overview of FNF.
As shown on the left in Fig.
1, x z p 0 ( x ) p 1 ( x ) p Z 0 ( z ) p Z 1 ( z ) x ∼ p a ∃ h : P ( y = h ( x )) ≈∃ g : P ( a = g ( x ))
≈
FNF z ∼ p
Z a ∃ h : P ( y = h ( z ))
≈∀ g : P ( a = g ( z ))
≤ 1+∆2 ≈z
=
f
( x ) z
= f 0 ( x ) x 1 = f − 1 1 ( z ) x 0 = f − 1 0 ( z ) allows us to train adversary cannot distinguish which of them actually produced latent z .
Crucially, as normalizing ﬂows enable us to compute the exact likelihood in the latent space, for trained encoders we can upper bound the accuracy of any adversary with 1+∆2 , which should be small if training was successful.
Furthermore, the distance ∆ provides a tight upper bound (Madras et al., 2018) on common fairness notions such as demographic parity (Dwork et al., 2012) and equalized odds (Hardt et al., 2016).
As shown on the right in Fig.
1, we can still train high-utility classiﬁers h using our representations, but now we can actually guarantee that no adversary g can recover sensitive attributes better than chance.
We empirically demonstrate that FNF can substantially increase provable fairness without signiﬁcantly sacriﬁcing accuracy on several common datasets.
Additionally, we show that the invertibility of FNF enables algorithmic recourse, allowing us to examine how to reverse a negative decision outcome.
Main contributions Our key contributions are:
• A novel fair representation learning method, called Fair Normalizing Flows (FNF), which can guarantee that sensitive attributes cannot be recovered from the learned representations.
• Experimental evaluation demonstrating that FNF can provably remove sensitive attributes from the representations, while keeping accuracy for the prediction task sufﬁciently high.
• Extensive investigation of algorithmic recourse and applications of FNF to transfer learning.
R ELATED W ORK
In this work, we focus on group fairness, which requires certain classiﬁcation statistics to be equal across different groups of the population.
Concretely, we consider demographic parity (Dwork et al., 2012), equalized odds (Hardt et al., 2016), and equality of opportunity (Hardt et al., 2016), which are widely studied in the literature (Edwards & Storkey, 2016; Madras et al., 2018; Zemel et al., 2013).
Algorithms enforcing such fairness notions target various stages of the machine learning pipeline: Pre-processing methods transform sensitive data into an unbiased representation (Zemel et al., 2013; McNamara et al., 2019), in-processing methods modify training by incorporating fairness constraints (Kamishima et al., 2011; Zafar et al., 2017), and post-processing methods change the predictions of a pre-trained classiﬁer (Hardt et al., 2016).
Here, we consider fair representation learning (Zemel et al., 2013), which computes data representations that hide sensitive information, e.g. group membership, while maintaining utility for downstream tasks and allowing transfer learning.
Fair representation learning Fair representations can be learned with a variety of different approaches, including variational autoencoders (Moyer et al., 2018;
Louizos et al., 2016), adversarial training (Edwards & Storkey, 2016; Madras et al., 2018; Xie et al., 2017; Song et al., 2019; Roy &
Boddeti, 2019; Liao et al., 2019; Jaiswal et al., 2020; Feng et al., 2019), and disentanglement (Creager et al., 2019; Locatello et al., 2019).
Adversarial training methods minimize a lower bound on demographic parity, namely an adversary’s accuracy for predicting the sensitive attributes from the latent representation.
However, since these methods only empirically evaluate worst-case unfairness, adversaries that are not considered during training can still recover sensitive attributes from the learned representations (Feng et al., 2019;
Moyer et al., 2018; Elazar & Goldberg, 2018; Xu et al., 2020; Gupta et al., 2021; Song & Shmatikov, 2020).
These ﬁndings illustrate the necessity of learning representations with provable guarantees on the maximum recovery of sensitive information regardless of the adversary, which is precisely the goal of our work.
Prior work makes ﬁrst steps in this direction: Gupta et al.
(2021) upper bound a monotonically increasing function of demographic parity with the mutual information between the latent representation and sensitive attributes.
However, the monotonic nature of this bound precludes computing guarantees on the reconstruction power of the optimal adversary.
Feng et al.
(2019) minimize the Wasserstein distance between latent distributions of different protected groups, but only provide an upper bound on the performance of any Lipschitz continuous adversary.
However, as we will show, the optimal adversary is generally discontinuous.
Provable fairness guarantees The ongoing development of guidelines on the fair usage of
AI (Whittaker et al., 2018; EU, 2021; FTC, 2021) has spurred interest in provably fair algorithms.
Unlike this work, the majority of these efforts (McNamara et al., 2019; John et al., 2020; Urban et al., 2020; Ruoss et al., 2020) focus on individual fairness.
Individual fairness is also tightly linked to differential privacy (Dwork et al., 2012; 2006), which guarantees that an attacker cannot infer whether a given individual was present in the dataset or not, but these models can still admit reconstruction of sensitive attributes by leveraging population-level correlations (Jagielski et al., 2019).
Group fairness certiﬁcation methods (Albarghouthi et al., 2017; Bastani et al., 2019; Segal et al., 2020) generally only focus on certiﬁcation and, unlike our work, do not learn representations that are provably fair.
B ACKGROUND
We assume that the data ( x , a ) ∈ R d ×A comes from a probability distribution p , where x represents the features and a represents a sensitive attribute.
In this work, we focus on the case where the sensitive attribute is binary, meaning A = { 0 , 1 } .
Given p , we can deﬁne the conditional probabilities as p 0 ( x ) =
P ( x | a = 0) and p 1 ( x ) = P ( x | a = 1) .
We are interested in classifying each sample ( x , a ) to a label y ∈ { 0 , 1 } , which may or may not be correlated with the sensitive attribute a .
Our goal is to build a classiﬁer
ˆ y =
h
( x ) which tries to predict y from the features x , while satisfying certain notions of fairness.
Next, we present several deﬁnitions of fairness relevant for this work.
Fairness criteria A classiﬁer
h satisﬁes demographic parity if it assigns positive outcomes to both sensitive groups equally likely, i.e., P ( h ( x ) = 1 | a = 0) =
P ( h ( x ) = 1 | a = 1) .
In cases where demographic parity can not be satisﬁed, we are also interested in a metric called demographic parity distance, deﬁned as | E
[ h ( x ) | a = 0]
− E
[ h ( x ) | a = 1] | .
A possible issue with demographic parity occurs if the base rates differ among the attributes, i.e., P ( y = 1 | a = 0) (cid:54) =
P ( y = 1 | a = 1) .
In that case, even the ground truth label y does not satisfy demographic parity.
To address this, Hardt et al.
(2016) instead introduced equalized odds , which requires that P ( h ( x ) = 1 | y
= y 0 , a = 0)
=
P ( h ( x ) = 1 | y =
y 0 , a = 1) for y 0 ∈ { 0 , 1 } , assuming h ( x ) = 1 is the advantaged outcome.
Fair representations Instead of directly predicting y from x , Zemel et al.
(2013) introduced the idea of learning fair representations of data.
The idea is that a data producer can preprocess the original data x and obtain a new representation z
= f ( x , a ) .
Then, any data consumer, who is using this data to solve a downstream task, can use z as an input to the classiﬁer instead of the original data [Figure] [Figure] [Figure]
x .
Thus, if the data producer can ensure that data representation is fair (w.r.t.
some notion of fairness), then all classiﬁers built on top of this representation will automatically inherit the fairness property.
Normalizing ﬂows Flow-based generative models (Rezende & Mohamed, 2015; Dinh et al., 2015; 2016; Kingma & Dhariwal, 2018) provide an attractive framework for transforming any probability distribution q into another distribution ¯ q .
Accordingly, they are often used to estimate densities from data using the change of variables formula on a sequence of invertible transformations, so-called normalizing ﬂows (Rezende & Mohamed, 2015).
In this work, however, we mainly leverage the fact that ﬂow models sample a latent variable z from a density ¯ q ( z ) and apply an invertible function f θ , parametrized by θ , to obtain datapoint x = f − 1 θ ( z ) .
Given a density q ( x ) , the exact log-likelihood is then obtained by applying the change of variables formula log q ( x ) = log ¯ q ( z ) + log | det( d z /d x ) | .
Thus, for f θ = f 1 ◦ f 2 ◦ . . .
◦
f K with r 0 = x , f i ( r i − 1 ) =
r i , and r K
=
z , we have log q ( x ) = log ¯ q ( z ) + K (cid:88) i = log | det( d r i /d
r i −
[Equation]
A clever choice of transformations f i (Rezende & Mohamed, 2015;
Dinh et al., 2015; 2016) makes the computation of log-determinant tractable, resulting in efﬁcient training and sampling.
Alternative generative models cannot compute the exact log-likelihood (e.g., VAEs (Kingma & Welling, 2014),
GANs (Goodfellow et al., 2014)) or have inefﬁcient sampling (e.g., autoregressive models).
Our approach is related to the work on alignment ﬂows (Grover et al., 2020; Usman et al., 2020), but the key difference is that they jointly learn the density and the transformation, which is not applicable in the fairness setting where these can be computed by different entities (data regulator and data producer).
Discrete ﬂows (Tran et al., 2019; Hoogeboom et al., 2019) are also related to our approach, and can be applied for discrete datasets.
M OTIVATION
In this section, we motivate our approach by highlighting some key issues with fair representation learning based on adversarial training.
Consider a distribution of samples x = ( x 1 , x 2 ) ∈ R 2 divided into two groups, shown as blue and orange in Fig.
The ﬁrst group with a sensitive attribute a = 0 has a distribution ( x 1 , x 2 ) ∼ p 0 , where p 0 is a mixture of two Gaussians N ([ − 3 , 3] , I ) and N ([3 , 3] , I ) .
The second group with a sensitive attribute a = 1 has a distribution ( x 1 , x 2 ) ∼ p 1 , where p 1 is a mixture of two Gaussians N ([ − 3 , − 3] , I ) and N ([3 , − 3] , I ) .
The label of a point ( x 1 , x 2 ) is deﬁned by y = 1 if sign( x 1 ) =
sign( x 2 ) and y = 0 otherwise.
Our goal is to learn a data representation z
= f ( x , a ) such that it is impossible to recover a from z , but still possible to predict target y from z .
Note that such a representation exists for our task: simply setting z = f ( x , a ) =
( − 1) a x makes it impossible to predict whether a particular z corresponds to a = 0 or a = 1 , while still allowing us to train a classiﬁer h with essentially perfect accuracy (e.g., h ( z )
= 1 { z 1 > 0 } ).
One of the most popular approaches to this problem is adversarial training (Edwards & Storkey, 2016; Madras et al., 2018).
The idea is to train encoder f and classiﬁer h jointly with an adversary g that tries to predict sensitive attribute a .
While the adversary tries to minimize its loss L adv , the encoder f and classiﬁer h are trying to maximize L adv and minimize the classiﬁcation loss L clf .
[Equation]
where G denotes the model family of adversaries, e.g., neural networks, considered during training.
Unfortunately, there are two key issues with adversarial training.
First, it yields a non-convex optimization problem which usually cannot be solved to optimality because of saddle points (extensively studied for GANs (Berard et al., 2020)).
Second, it assumes that the adversary g comes from a ﬁxed model family G , which means that even if the optimal g ∈ G cannot recover the sensitive attribute a , adversaries from other model families can still do so as demonstrated in recent work (Feng et al., 2019;
Moyer et al., 2018; Elazar & Goldberg, 2018;
Xu et al., 2020; Gupta et al., 2021).
To investigate these issues, we apply adversarial training to learn representations for our synthetic example, and measure how often the sensitive attributes can be recovered from learned representations.
Our results, shown in Fig.
3, repeated 100 times with different seeds, demonstrate that adversarial training is unstable and rarely results in truly fair representations (where only 50% can be recovered).
In Section 6 we follow up on recent work and show that several adversarial fair representation learning approaches are not robust to adversaries from a different model familiy (e.g., larger networks).
In Fig.
3 we show that our approach, introduced next, can reliably produce fair representations without affecting utility.
F AIR N ORMALIZING F LOWS
Throughout this section we will assume knowledge of prior distributions p 0 ( x ) and p 1 ( x ) .
At the end of the section, we discuss the required changes if we only work with estimates.
Let Z 0 and
Z 1 denote conditional distributions of z = f ( x , a ) for a ∈ { 0 , 1 } , and let p Z 0 and p Z 1 denote their respective densities.
Madras et al.
(2018) have shown that bounding the statistical distance ∆( p Z 0 , p Z 1 ) between Z 0 and Z 1 provides an upper bound on the unfairness of any classiﬁer h built on top of the representation encoded by f .
The statistical distance between Z 0 and Z 1 is deﬁned as the maximum mean discrepancy (MMD) (Gretton et al., 2006) between the two distributions:
[Equation]
where µ : R d → { 0 , 1 } is a binary classiﬁer trying to discriminate between Z 0 and Z 1 .
If we can train an encoder to induce latent distributions Z 0 and Z 1 with statistical distance below some threshold, then we can both upper bound the maximum adversarial accuracy by (1 + ∆( p Z 0 , p Z 1 ))
/and, using the bounds from Madras et al.
(2018), obtain guarantees for demographic parity and equalized odds of any downstream classiﬁer h .
Such guarantees are unattainble for adversarial training, which minimizes a lower bound of ∆( p Z 0 , p Z 1 ) .
In contrast, we learn fair representations that allow computing the optimal adversary µ ∗ attaining the supremum in Eq.
(3) and thus enable exact evaluation of ∆( p Z 0 , p Z 1 ) .
Optimal adversary In the following lemma we state the form of an optimal adversary which attains the supremum in the deﬁnition of statistical distance in Eq. We show the proof in Appendix A.1.
Lemma 5.1.
The adversary µ ∗ attaining the supremum in the deﬁnition of ∆( p Z 0 , p Z 1 ) can be deﬁned as µ ∗ ( z ) = [-
 if and only if-]1 { p Z 0 ( z ) ≤ p Z 1 ( z ) } , namely it evaluates to 1 if and only if p Z 0 ( z )[-= 
-]
≤ p Z 1 ( z ) .
This intuitively makes sense – given some representation z , the adversary computes likelihood under both distributions Z 0 and Z 1 , and predicts the attribute with higher likelihood for that z .
Liao et al.
(2019) also observed that the optimal adversary can be phrased as arg max a p ( a | z ) .
So far, prior work mostly focused on mapping input x to the latent representation z
= f θ ( x , a ) via standard neural networks.
However, for such models, given densities p 0 ( x ) and p 1 ( x ) over the input space, it is intractable to compute the densities p Z 0 ( z ) and p Z 1 ( z ) in the latent space as many inputs x can be mapped to the same latent z
and we cannot use inverse function theorem.
Consequently, prior adversarial training methods cannot compute the optimal adversary and thus resort to a lower bound.
with normalizing ﬂows Our approach, named Fair Normalizing Flows (FNF), consists of two models, f 0 and f 1 , that encode inputs from the groups with sensitive attributes a = 0 and a = 1 , respectively.
We show a high-level overview of FNF in Fig.
Note that models f 0 and f 1 are parameterized by θ
and θ 1 , but we do not write this explicitly to ease the notation.
Given some input x 0 ∼ p 0 , it is encoded to z 0 = f 0 ( x 0 ) , inducing a probability distribution Z 0 with density p Z 0 ( z ) over all possible latent representations z .
Similarly, inputs x 1 ∼ p 1 are encoded to z 1 = f 1 ( x 1 ) , inducing the probability distribution Z 1 with density p Z 1 ( z ) .
Clearly, if we can train f 0 and fso that the resulting distributions Z 0 and Z 1 have small distance, then we can guarantee fairness of representations using bounds from Madras et al.
As evaluating statistical distance is intractable for most neural networks, we need a model family that allows us to compute this quantity.
We propose to use bijective encoders f 0 and f 1 based on normalizing ﬂows (Rezende & Mohamed, 2015; Dinh et al., 2016).
Normalizing ﬂows allow us to compute the densities at z , using the change of variables formula
[Equation]
for a ∈ { 0 , 1 } .
We can thus write the optimal adversary as µ ∗ ( z ) = 1 { p Z 0 ( z ) ≤ p Z 1 ( z ) } .
To compute the statistical distance it remains to evaluate the expectations E z ∼Z
[ µ ∗ ( z )] and E z ∼Z 1 [ µ ∗ ( z )] .
Sampling from Z 0 and Z 1 is straightforward – we can sample x 0 ∼ p 0 and x 1 ∼ p 1 , and then pass the samples x 0 and x 1 through the respective encoders f 0 and f 1 to obtain z 0 ∼ Z 0 and z 1 ∼ Z 1 .
Given that the outputs of µ ∗ are bounded between 0 and 1, we can then use Hoeffding inequality to compute the conﬁdence intervals for our estimate using a ﬁnite number of samples.
Lemma 5.2.
Given a ﬁnite number of samples x 10 , x 20 , ..., x n 0 ∼ p 0 and x 11 , x 21 , ..., x n 1 ∼ p 1 , denote as z i {+
+} = f {+
+} ( x i 0 ) and z i 1 = f 1 ( x i 1 ) and let ˆ∆( p Z 0 , p Z 1 ) :
= | 1 n (cid:80) ni
=1 µ ∗ ( z i 0 ) − 1 n (cid:80) ni
=1 µ ∗ ( z i 1 ) | be an empirical estimate of the statistical distance ∆( p Z 0 , p Z 1 ) .
Then, for n ≥ − 2 log(1 − √ 1 − δ )
/(cid:15)with
probability at least 1 − δ , we are guaranteed that ∆( p Z 0 , p Z 1 ) ≤ ˆ∆( p Z 0 , p Z 1 ) + (cid:15) .
Lemma 5.3.
We can bound ∆( p Z 0 , p Z 1 ) 2 ≤ 14 ( KL ( p Z 0 , p Z 1 ) + KL ( p Z 1 , p Z 0 )) .
Algorithm
Input: N, B, γ, p 0 , p
Initialize f 0 and f 1 with parameters θ 0 and θfor i = 1 to N do for j = 1 to B do
Sample x j 0 ∼ p 0 , x j 1 ∼ p [Equation]
( x [Equation] ) end for
L[-0 = 1 B (cid:80) Bj =1 (log p Z 
 ( z j 0 ) − log p Z 1 ( z j 0 )) L 1 = 1 B (cid:80) Bj =1 (log p Z 1 ( z j 1 ) − log p Z 
-]
[Equation]
[Equation] Update θ 0 ← θ [Equation]
Update θ 1 ← θ [Equation] L end for
Training ﬂow-based encoders The next challenge is to design a training procedure for our newly proposed architecture.
The main issue is that the statistical distance is not differentiable (as classiﬁer µ ∗ is binary)
so we replace it with a differentiable proxy based on symmetrized KL divergence, shown in Lemma 5.3 (proof is shown in ?? ).
We show a high-level description of our training procedure in Algorithm 1.
In each step, we sample a batch of x 0 and x 1 from the respective distributions and encode them to the representations zand z 1 .
We then estimate a symmetrized KL divergence between distributions Z 0 and Z 1 , denoted as L 0 + L 1 , and combine it with a classiﬁcation loss L clf using tradeoff parameter γ , and run a gradient step to minimize the joint loss.
While we use a convex scalarization scheme to obtain the joint loss in Algorithm 1, our approach is independent of the concrete multi-objective optimization objective.
We will demonstrate the compatibility with other scalarization schemes in Appendix C.
Bijective encoders for categorical data Many fairness datasets consist of categorical data, and often even continuous data is discretized before training.
In this case, we will show that the optimal bijective representation can be easily computed.
Consider the case of discrete samples x coming from a probability distribution p ( x ) where each component x i takes a value from a ﬁnite set { 1 , 2 , . . .
, d i } .
Similar to the continuous case, our goal is to ﬁnd bijections f 0 and f 1 that minimize the statistical distance of the latent distributions.
Intuitively, we want to pair together inputs which have similar probabilities in both p 0 and p 1 .
In Lemma 5.4 we show that the solution which minimizes the statistical distance is obtained by sorting the inputs according to their probabilities in p 0 and p 1 , and then matching inputs at the corresponding indices in these two sorted arrays.
As this can result in a bad classiﬁcation accuracy when inputs with different target labels get matched together, we can obtain another representation by splitting inputs in two groups according to the predicted classiﬁcation label and then matching inputs in each group using Lemma 5.4.
We can trade off accuracy and fairness by randomly selecting one of the two mappings based on parameter γ .
Lemma 5.4.
Let X = { x 1 , ..., x m } and bijections f 0 , f 1 : X → X .
Denote i 1 , i 2 , ..., i m and j 1 , ..., j m permutations of { 1 , 2 , ..., m } such that p
( x i 1 ) ≤ p 0 ( x i 2 ) ≤ ... ≤ p 0 ( x i m ) and p 1 ( x j 1 ) ≤ p 1 ( x j 2 ) ≤ ... ≤ p 1 ( x j m ) .
The encoders deﬁned by mapping f
( x k )
=
x k and f 1 ( x j k )
=
x i k are bijective representations with the smallest possible statistical distance.
Statistical distance of true vs. estimated density In this work we assume access to a density of the inputs for both groups and we provably guarantee fairness with respect to this density.
While it is sensible in the cases where the density estimate can be trusted (e.g., if it was provided by a regulatory agency), in many practical scenarios, and our experiments in Section 6, we only have an estimate
ˆ pand ˆ p 1 of the true densities p 0 and p 1 .
We now want to know how far off our guarantees are compared to the ones for the true density.
The following theorem provides a way to theoretically bound the statistical distance between p Z 0 and p Z 1 using the statistical distance between ˆ p Z 0 and ˆ p Z 1 .
Theorem 5.5.
Let ˆ p 0 and ˆ p 1 be density estimates such that TV (ˆ p 0 , p 0 ) <
(cid:15)/ 2 and TV (ˆ p 1 , p 1 ) < (cid:15)/ 2 , where TV stands for total variation between two distributions.
If we denote latent distributions f 0 (ˆ p 0 ) and f 1 (ˆ p 1 ) as ˆ p Z 0 and ˆ p Z 1 then ∆( p Z 0 , p Z 1 ) ≤ ∆(ˆ p Z 0 , ˆ p Z 1 ) + (cid:15) .
This theorem can be naturally combined with Lemma 5.2 to obtain a high probability upper bound on the statistical distance of the underlying true densities using estimated densities and a ﬁnite number of samples.
Computing exact constants for the theorem is often not tractable, but as we will show experimentally, in practice bounds computed on the estimated distribution in fact bound adversarial accuracy on the true distribution.
Moreover, for low-dimensional data relevant to fairness obtaining good estimates can be provably done for models such as Gaussian Mixture Models (Hardt & Price, 2015) and Kernel Density Estimation (Jiang, 2017).
We can thus leverage the rich literature on density estimation (Rezende & Mohamed, 2015; Dinh et al., 2015; 2016; Kingma & Dhariwal, 2018; van den
Oord et al., 2016a;c;b; Germain et al., 2015) to estimate ˆ p 0 and ˆ p 1 .
Importantly, FNF is agnostic to the concrete density estimation method (as we will show in Appendix C), and can thus beneﬁt from future advances in the ﬁeld.
Finally, we note that density estimation has been successfully employed in a variety of security-critical areas such as fairness (Song et al., 2019), adversarial robustness (Wong & Kolter, 2020), and anomaly detection (Pidhorskyi et al., 2018).
E XPERIMENTAL E VALUATION
In this section, we evaluate Fair Normalizing Flows (FNF) on several standard datasets from the fairness literature.
We consider Adult and Crime from the UCI repository (Dua & Graff, 2017),
Compas (Angwin et al., 2016), Law School (Wightman, 2017), and the Health Heritage Prize dataset.
We preprocess Compas and Adult into categorical datasets by discretizing continuous features, and we keep the other datasets as continuous.
Moreover, we preprocess the datasets by dropping uninformative features, facilitating the learning of a good density estimate, while keeping accuracy high (shown in Appendix B).
We describe our full setup in detail in Appendix B. We will release all code, datasets, and preprocessing pipelines to ensure reproducibility of our results.
Evaluating Fair Normalizing Flows
We ﬁrst evaluate FNF’s effectiveness in learning fair representations.
For each dataset, we train different FNF models by varying the utility vs. fairness tradeoff parameter γ (see Algorithm 1).
We estimate input densities using RealNVP (Dinh et al., 2016) for
Health, MADE (Germain et al., 2015) for Adult and Compas, and Gaussian Mixture Models (GMMs) for the rest (we demonstrate that FNF is compatible with any differentiable prior by considering additional density estimation methods in Appendix C).
For continuous datasets we use RealNVP as encoder architecture, while for categorical datasets we compute the optimal bijective representations using Lemma 5.4.
Fig.
4 shows our results, each point representing a single model, with models on the right focusing on classiﬁcation accuracy, and models on the left gradually increasing their fairness focus.
The results in Fig. 4, averaged over 5 random seeds, indicate that FNF successfully reduces the statistical distance between representations of sensitive groups while maintaining high accuracy.
We observe that for some datasets (e.g., Law School) enforcing fairness only slightly degrades accuracy, while for others there is a substantial drop (e.g., Crime).
In such datasets where the label and sensitive
[Figure] [Figure] attribute are highly correlated we cannot achieve fairness and high accuracy simultaneously (Menon & Williamson, Zhao & Gordon, 2019).
Overall, we see that FNF is generally insensitive to the random seed and can reliably enforce fairness.
Recall that we have focused on minimizing statistical distance of learned representations because, as mentioned earlier, Madras et al.
(2018) have shown that fairness metrics such as demographic parity, equalized odds and equal opportunity can all be bounded by statistical distance.
For example, for Health FNF reduces the demographic parity distance of a classiﬁer from 0.39 to 0.08 with an accuracy drop of 3.9% (we provide similar results showing
FNF’s good performance for equalized odds and equality of opportunity in Appendix C).
[Figure]
Bounding adversarial accuracy Recall that the guarantees provided by FNF hold for estimated densities ˆ p 0 and ˆ p 1 .
Namely, the maximum adversarial accuracy for predicting whether the latent representation z originates from distribution ˆ Z 0 or ˆ Z 1 is bounded by (1 + ∆(ˆ p Z 0 , ˆ p Z 1 )) / 2 .
In this experiment, we investigate how well these guarantees transfer to the underlying distributions Z 0 and Z 1 .
In Fig.we show our upper bound on the adversarial accuracy computed from the statistical distance using the estimated densities (diagonal dashed line), together with adversarial accuracies obtained by training an adversary, a multilayer perceptron (MLP) with two hidden layers of 50 neurons, for each model from Fig.
We also show 95% conﬁdence intervals obtained using the Hoeffding bound from Lemma 5.2.
We observe that our upper bound from the estimated densities ˆ p 0 and ˆ pprovides a tight upper bound on the adversarial accuracy for the true distributions Z 0 and Z 1 .
This demonstrates that, even though exact constants from Theorem 5.5 are intractable, our density estimate is good enough in practice, and our bounds hold for adversaries on the true distribution.
Comparison with adversarial training We now compare FNF with adversarial fair representation learning methods on Adult dataset: LAFTR-DP ( γ = 2 ) (Madras et al., 2018), MaxEnt-ARL ( α = 10 ) (Roy & Boddeti, 2019), and Adversarial Forgetting ( ρ = 0 .
001 , δ = 1 , λ = 0 .
1 ) (Jaiswal et al., 2020).
Adversarial training operates on a family of adversaries G trying to predict the sensitive attribute from the latent representation.
Here, the families G are MLPs with 1 hidden layer ofneurons for Madras et al.
(2018), and 2 hidden layers with 64 neurons and 50 neurons for Roy & Boddeti (2019) and Jaiswal et al.
(2020), respectively.
In Table 1 we show that these methods generally succeed in preventing adversaries from G to predict the sensitive attributes.
However, we can still attack these representations using either larger MLPs (3 layers of 200 neurons for Madras et al.
(2018)) or simple preprocessing steps (for Roy & Boddeti (2019); Jaiswal et al.
as proposed by Gupta et al.
(2021) (essentially reproducing their results).
Our results conﬁrm ﬁndings from prior work (Feng et al., 2019; Elazar & Goldberg, 2018; Xu et al., 2020; Gupta et al., 2021): adversarial training provides no guarantees against adversaries outside G .
In contrast, FNF computes a provable upper bound on the accuracy of any adversary (i.e., G = ∅ ) for the estimated input distribution, and
Table 1 shows that this extends to the true distribution (as before).
FNF thus learns representations with signiﬁcantly lower adversarial accuracy with only minor decrease in task accuracy.
Algorithmic recourse with FNF We next experiment with using FNF’s bijectivity to perform recourse, i.e., reverse an unfavorable outcome, which is considered to be fundamental to transparent and explainable algorithmic decision-making (Venkatasubramanian & Alfano, 2020; Sharma et al., 2020).
To that end, we apply FNF with γ = 1 to the Law School dataset which has three features (after preprocessing): LSAT score, undergraduate GPA, and the college to which the student applied (ordered decreasingly in admission rate).
For all rejected applicants, i.e., x such that h ( f a ( x ))
=
h ( z ) = 0 , we compute the closest ˜ z (corresponding to a point ˜ x from the dataset) w.r.t.
the (cid:96) 2distance in latent space such that h (˜ z ) = 1 .
We then linearly interpolate between z and ˜ z to ﬁnd a (potentially crude) approximation of the closest point to z in latent space with positive prediction.
Using the bijectivity of our encoders, we can compute the corresponding average feature change in the original space which would have caused a positive decision: increasing LSAT by 4 . 2 (non-whites) and 7 . 7 (whites), and increasing GPA by 0 .
7 (non-whites) and 0 .
6 (whites), where we only report recourse in the cases where the college does not change since this may not be actionable advice for certain applicants (Zhang et al., 2018; Ustun et al., 2019; Poyiadzi et al., 2020; Karimi et al., 2021).
In Appendix C, we also show that, unlike prior work, FNF enables practical interpretability analyses.
[Table]
Flow architectures In the next experiment we compare RealNVP encoder with the alternative encoder based on Neural
Spline Flows architecture (Durkan et al., 2019), on the Crime dataset.
In Table 2 we show the statistical distance and accuracy for models obtained using different values for the tradeoff parameter γ .
We can observe that both ﬂows offer similar performance.
Note that FNF will only beneﬁt from future advances in normalizing ﬂows research, as it is orthogonal to the concrete ﬂow architecture that is used for training.
Transfer learning Unlike prior work, transfer learning with FNF requires no additional reconstruction loss since both encoders are invertible and thus preserve all information about the input data.
To demonstrate this, we follow the setup from Madras et al.
and train a model to predict the
Charlson Index for the Health Heritage Prize dataset.
We then transfer the learned encoder and train a classiﬁer for the task of predicting the primary condition group.
Our encoder reduces the statistical distance from 0.99 to 0.31 (this is independent of the label).
For the primary condition group MSC2a we retain the accuracy at 73.8%, while for METAB3 it slightly decreases from 75.4% to 73.1%.
C ONCLUSION
We introduced Fair Normalizing Flows (FNF), a new method for learning representations which ensure that no adversary can predict sensitive attributes.
This guarantee is stronger than prior work which only considers adversaries from a restricted model family.
The key idea is to use an encoder based on normalizing ﬂows which allows computing the exact likelihood in the latent space, given an estimate of the input density.
Our experimental evaluation on several datasets showed that
FNF is ﬂexible and can effectively enforce fairness without signiﬁcantly sacriﬁcing utility, while simultaneously allowing interpreting the learned representations and transferring to unseen tasks.
E THICS S TATEMENT
Since machine learning models have been shown to reinforce the human biases that are embedded in the training data, regulators and scientists alike are striving to propose novel regulations and algorithms to ensure the fairness of such models.
Our method enables data producers to learn fair data representations that are guaranteed to be non-discriminatory regardless of the concrete downstream usecase.
Since our method relies on accurate density estimates we envision that the data regulators, whose tasks already include determining fairness criteria, data sources, and auditing results, would create a regulatory framework for density estimation that can then be realized by, e g., industrial partners.
Importantly, this would not require regulators to estimate the densities themselves.
Nevertheless, data regulators would need to take great care when formulating such legislation since the potential negative effects of poor density estimates are still largely unexplored, both in the context of our work and in the broader ﬁeld (particularly for high-dimensional data).
In this setting, any data producer using our method would then be able to guarantee the fairness of all potential downstream consumer models
Proof of Lemma 5.1 (Optimal adversary)
Proof. Here we prove Lemma 5.1 which states the form of an adversary µ : R d → { 0 , 1 } that can achieve highest discrimination between Z 0 and Z 1 . We start by rewriting the equation for statistical distance ∆( p Z 0 , p Z 1 ) as follows:
[Equation]
To maximize the absolute value of the integral, we either have to maximize or minimize the integral (cid:82) z ( p Z 0 ( z ) − p Z 1 ( z ))
µ ( z ) dz . Clearly, to maximize the integral we should choose function µ ={ p Z 0 ( z ) ≥ p Z 1 ( z ) } , for which µ ( z ) = 1 if and only if p Z 0 ( z ) ≥ p Z 1 ( z ) , and 0 otherwise.
Similarly, to minimize the integral we should choose function µ = 1 { p Z 0 ( z ) ≤ p Z 1 {+( z ) } for which µ ( z ) = 
 if and only if+} p Z 0 ( z ) ≤ p Z 1 ( z ) , and 0 otherwise. In fact, it can be easily observed that both options result in the same absolute value of the integral so we can, without loss of generality, choose the ﬁrst option µ ∗ ( z )
= 1 { p Z 0 ( z ) ≤ p Z 1 ( z ) } . This subsequently yields ∆( p Z [Equation] p
[Equation] z )] − E z ∼Z 1 [ µ ∗ ( z )] (cid:12)(cid:12) . Moreover, we can also write ∆( p Z 0 , p Z 1 ) =
(cid:12)(cid:12)(cid:82) z ( p Z 1 ( z ) − p Z 0 ( z )) µ ∗ ( z ) dz (cid:12)(cid:12) = (cid:12)(cid:12)(cid:82) z max(0 , p Z 1 ( z ) − p Z 0 ( z ))
dz (cid:12)(cid:12) (this will be used to prove Theorem 5.5).
Proof of Lemma 5.2 (Finite sample estimate)
Proof.
We start by plugging in the optimal adversary µ ∗ from Lemma 5.1 into the deﬁnition of statistical distance.
Let µ ∗ be the optimal adversary deﬁned in Lemma 5.1, namely µ ∗ ( z ) =
if and only if p Z 0 ( z ) < p Z 1 ( z ) .
We ﬁrst write statistical distance in terms of the optimal adversary µ ∗ , then bound statistical distance using triangle inequality and ﬁnally apply Hoeffding’s inequality on individual terms: [Equation] ≤
[Equation]
where Hoeffding’s inequality guarantees that with probability at least (1 − 2 exp( − n(cid:15) 2 / 2)) 2 ﬁrst and last summand are at most (cid:15)/ 2 .
Proof of Lemma 5.3 (Bounding statistical distance with symmetrized KL)
Proof.
We can bound statistical distance ∆( p Z 0 , p Z 1 ) by noticing that because µ is a binary classiﬁer, we have that | µ ( z ) | ≤ 1 : ∆( p Z 0 , p Z 1 ) = sup µ
[Equation]
Pinsker’s inequality guarantees that TV ( p Z 0 , p Z 1 ) 2 ≤ 12 KL ( p Z 0 , p Z 1 ) . Given that TV ( p Z 0 , p Z 1 ) = TV ( p Z 1 , p Z 0 ) we also have that TV ( p Z 0 , p Z 1 ) 2 ≤ 12 KL ( p Z 1 , p Z 0 ) .
In order to bound statistical distance we can now use 2∆( p Z 0 , p Z 1 ) 2 ≤ 2 TV ( p Z 0 , p Z 1 ) 2 ≤ 12 KL ( p Z 0 , p Z 1 ) + 12 KL
[Equation]
p Z 1 , p Z 0 ) which corresponds to our objective with symmetrized KL divergence used in Algorithm 1.
Proof of Lemma 5.4 (Encoding for discrete distributions)
Proof.
Without loss of generality we can assume that f 0 ( x k ) =
x k .
Assume that f 1 ( x ) =
y and f 1 ( x (cid:48) )
=
y (cid:48) where p 0 ( x ) < p 0 ( x (cid:48) ) and p 1 ( y ) > p 1 ( y (cid:48) ) .
Let d 1 = | p
( x ) − p 1 ( y ) | + | p 0 ( x (cid:48) )
− p 1 ( y (cid:48) )
| and d 2 = | p 0 ( x ) − p 1 ( y (cid:48) )
| + | p 0 ( x (cid:48) )
− p 1 ( y ) | .
In the case when p 1 ( y ) ≤ p 0 ( x ) or p 1 ( y (cid:48) ) ≥ p 0 ( x ) it is easy to show that d 1 = d 2 .
Now, in the case when p 0 ( x ) < p 1 ( y (cid:48) ) <
p 0 ( x ) < p 1 ( y ) , we can see that d 2 ≤ d 1 − ( p 0 ( x ) − p 1 ( y (cid:48) ))
<
d 1 .
Similarly, when p 0 ( x ) < p 1 ( y (cid:48) ) <
p 1 ( y ) <
p 0 ( x ) , we can see that d 2 ≤ d 1 − ( p 1 ( y ) − p 1 ( y (cid:48) ))
<
d 1 .
In all cases, d 2 ≤ d 1 , which means that if we swap f 1 ( x ) and f 1 ( x (cid:48) ) total variation either decreases or stays the same.
We can repeatedly swap such pairs, and once there are no more swaps to do, we arrive at the condition of the lemma where two arrays are sorted the same way. Proof of Theorem
5.5 (True and approximate distributions)
Proof. Let a ∈ { 0 , 1 } be a sensitive attribute, and assume that TV (ˆ p a , p a ) < (cid:15)/ 2 . Recall that change of variables for probability densities gives us that for the representation z
= f a ( x ) we have, similar as in Eq.
(4), p Z
[Equation]
z
[Equation]
= p
[Equation]
x ) (cid:12)(cid:12)(cid:12) det ∂f
a
[Equation]
x ) ∂ x (cid:12)(cid:12)(cid:12) − 1 and ˆ p Z a ( z ) =
ˆ p a ( x ) (cid:12)(cid:12)(cid:12) det ∂f a ( x ) ∂ x (cid:12)(cid:12)(cid:12) − 1 .
Then, using those formulas together with the change of variables rule for multivariate integrals we derive:
[Equation]
We will also use the observation from the proof of Lemma 5.1 which states that
[Equation]
We can now observe that the following inequality holds:
[Equation]
Integrating both sides yields:
[Equation]
Here last inequality follows from the previously proved inequality TV (ˆ p Z a , p Z a ) < (cid:15)/ 2 , applied for both a = 0 and a = 1 .
B E XPERIMENTAL S ETUP
In this section [Equation] we provide the full speciﬁcation of our experimental setup.
We ﬁrst discuss the datasets considered and the corresponding preprocessing methods employed.
We empirically validate that our preprocessing maintains high accuracy on the respective prediction tasks.
Finally, we specify the hyperparameters and computing resources for the experiments in Section 6.
[Table]
We consider ﬁve commonly studied datasets from the fairness literature:
Adult and Crime from the UCI machine learning repository (Dua & Graff, 2017), Compas (Brennan et al., 2009), Law
School (Wightman, 2017), and the Health Heritage Prize (Kaggle) dataset.
Below, we brieﬂy introduce each of these datasets and discuss whether they contain personally identiﬁable information, if applicable.
We preprocess Adult and Compas into categorical datasets by discretizing continuous features, keeping the other datasets as continuous.
We drop rows and columns with missing values.
For each dataset, we ﬁrst split the data into training and test set, using the original splits wherever possible and a 80% / 20% split of the original dataset otherwise.
We then further sample 20% of the training set to be used as validation set.
Table 3 displays the dataset statistics for each of these splits.
Finally, we drop uninformative features to facilitate density estimation.
We show that the removal of these features does not signiﬁcantly affect the predictive utility of the data in Table 4.
Adult
The Adult dataset, also known as Census Income dataset, was extracted from the 1994 Census database by Barry Becker and is provided by the UCI machine learning repository (Dua & Graff, 2017).
It contains 14 attributes: age, workclass, fnlwgt, education, education-num, marital-status, occupation, relationship, race, sex, capital-gain, capital-loss, hours-per-week, and native-country.
The prediction task is to determine whether a person makes over 50 000 US dollars per year.
We consider sex as the protected attribute, and we discretize the dataset by keeping only the categorical columns relationship, workclass, marital-status, race, occupation, education-num, and education.
Compas
The Compas (Brennan et al., 2009) dataset was procured by ProPublica, and contains the criminal history, jail and prison time, demographics, and COMPAS risk scores for defendants from Broward
County from 2012 and 2013.
Through a public records request, ProPublica obtained two years worth of COMPAS scores ( 18 610 people) from the Broward County Sheriff’s Ofﬁce
[Table]
Furthermore, jail records were obtained from the Browards County Sheriff’s Ofﬁce, and public incarceration records were downloaded from the Florida Department of Corrections website.
The task consists of predicting recidivsm within two years for all individuals.
We only consider Caucasian and
African-American individuals and use race as the protected attribute.
We discretize the continuous features age, diff-custody, diff-jail, and priors-count, and we remove all other features except for sex, c-charge-degree, and v-score-text.
Crime
The Communities and Crime dataset combines socio-economic data from the 1990 US Census, law enforcement data from the 1990 US LEMAS survey, and crime data from the 1995 FBI UCR.
It was created by Michael Redmond and is provided by the UCI machine learning repository (Dua & Graff, 2017).
The dataset contains 128 attributes such as county, population, per capita income, and number of immigrants.
The task consists of predicting whether the number of violent crimes per population for a given community is above or below the median.
We consider race as the protected attribute, which we set to 1 if the percentage of white people divided by 5 is smaller than the percentage of black, asian, and hispanic individuals, and to 0 otherwise.
We keep the following 6 features: racePctWhite, pctWInvInc, PctFam2Par, PctKids2Par, PctYoungKids2Par, PctKidsBornNeverMar.
Health
The Health dataset was created for the Heritage Health Prize (Kaggle) competition on Kaggle and contains medical records of over 55 000 patients.
We consider the merged claims, drug count, lab count, and members sheets, which have a total of 18 attributes.
The identity of individual patients and health care providers, as well as other individual identiﬁable information, has been removed from the datasets to protect the privacy of those involved and to comply with applicable law.
We consider age as the protected attribute, which we binarize to patients above and below 60 years.
The task is to predict the maximum Charlson Comordbidity Index, which predicts 10-year survival in patients with multiple comorbities.
We drop all but the following features: DrugCount-total, DrugCount-months, no-Claims, no-Providers, PayDelay-total, PrimaryConditionGroup, Specialty, ProcedureGroup, and
PlaceSvc.
For the transfer learning experiments we follow Madras et al.
and omit the primary condition group labels from the set of features and try to predict them from the latent representation without explicitly optimizing for the task.
Law School
The Law School (Wightman, 2017) dataset contains admissions data from 25 law schools over the 2005, 2006, and in some cases 2007 admission cycles, providing information on over 100individual applications.
The data was procured by Project SEAPHE and was cleaned to adhere to high standards of data privacy.
Concretely, when the school, race, year, and gender information for enrolled students produced cells of fewer than ﬁve subjects, the cells were combined to minimize reidentiﬁcation risk.
The attributes are law school, year of fall term, LSAT score, undergraduate GPA, [Figure] race, gender, and in-state residency.
We consider race as the protected attribute, which we binarize to white and non-white.
We remove all features but the LSAT score, undergraduate GPA, and the college to which the student applied (ordered by decreasing admission rate).
B. T RAINING DETAILS
Our code is implemented in PyTorch (Paszke et al., 2019).
Computing resources We run all experiments on a desktop PC using a single GeForce RTX
Ti GPU and 16-core Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz.
Hyperparameters for main experiments For Crime we estimate input density using Gaussian
Mixture Model (GMM) with 4 components for a = 0 and 2 components for a = 1 .
For Law we use
GMM with 8 components for both groups.
Health dataset requires more complex density estimation so we use RealNVP (Dinh et al., 2016) with 4 blocks of 20 neurons each.
For categorical datasets,
Adult and Compas, we perform density estimation using MADE (Germain et al., 2015), which is represented using network of 2 hidden layers with 50 neurons.
We represent ﬂow encoders using RealNVP with 4 blocks for Crime and Law, and 6 blocks for Health.
Crime and Law use batch size 128, initial learning rate 0.01 and weight decay 0.0001, while Health uses batch size 256, initial learning rate 0.001 and weight decay 0.
Training is performed using
Adam (Kingma & Ba, 2015) optimizer.
We use 60, 100, and 80 epochs for Crime, Law and Health, respectively.
These parameters were chosen based on the performance on validation set.
For experiments in Fig.
4, we trained with the following 5 values for γ for respective datasets: 0, 0.02, 0.1, 0.2, 0.9 for Crime, 0, 0.001, 0.02, 0.1, 0.9 for Law, 0, 0.05, 0.1, 0.5, 0.95 for Health.
Training for 1 epoch takes around 1 second for Crime, 5 seconds for Law, and 30 seconds for Health.
C A DDITIONAL E XPERIMENTS
In this section we present additional experimental results.
Compatibility with other fairness metrics In Section 6 we focused on presenting results on statistical distance, as it can bound various fairness metrics Madras et al.
In constrast, here we provide more detailed experiments with three common group fairness metrics: demographic parity, equalized odds, and equality of opportunity.
We demonstrate the tradeoff between these metrics and downstream accuracy in Fig.
We observe that FNF achieves high rates of demographic parity, equalized odds, and equality of opportunity with only small decreases in classiﬁcation accuracy (similar to the results for the statistical distance showed in Fig. 4).
Compatibility with different scalarization schemes Since fairness and accuracy are often competing objectives, they merit a treatment from multi-objective optimization.
Here, we investigate the scalarization scheme proposed by Wei & Niethammer (2020) and replace our objective γ ( L 0 + L 1 ) + (1 − γ )
L clf , obtained via convex scalarization, with the Chebyshev scalarization scheme max { γ ( L 0 + L 1 ) , (1 − γ )
L clf } , where we use the same normalization for L 0 , L 1 , and L clf as Wei & Niethammer (2020).
[Figure]
We evaluate the schemes for a large range of γ values on the Crime dataset and compute the Area Under the Curve (AUC) with the trapezoidal rule.
The convex scalarization yields an AUC of 0.6036, whereas the Chebyshev scalarization attains an AUC of 0.6051.
Moreover, we aggregate the results in Fig.
In general, we observe that the convex scalarization slightly outperforms the Chebyshev scalarization scheme.
We believe that this is due to two reasons, (i) the Pareto curve is almost convex, which is why the convex scalarization performs well, and (ii) the stochasticity of gradient-based optimization.
We consider more advanced multi-objective optimization methods Lin et al.
; Martínez et al.
(2020) an interesting direction for future work.
[Figure]
Compatibility with different priors In the following experiment, we demonstrate that FNF is compatible with any differentiable estimate of p 0 and p 1 .
We consider
Crime with the same setup as before, but with 3 different priors: a GMM with k = 3 components, an autoregressive prior, and a RealNVP ﬂow (Dinh et al., 2016).
For each of these priors, we train an encoder using FNF and a classiﬁer on top of the learned representations.
Fig.shows the tradeoff between the statistical distance and accuracy for each of the priors.
Based on these results, we can conclude that FNF achieves similar results for each of the priors, empirically demonstrating the ﬂexibility of our approach.
Interpreting the representations We now show that the bijectivity of FNF enables interpretability analyses, an active area of research in fair representation learning (He et al., 2019; Kehrenberg et al., 2020; Wang et al., 2021).
To that end, we consider the Crime dataset where for a community x : (i) race (non-white vs. white majority) is the sensitive attribute a , (ii) the percentage of whites (highly correlated with, but not entirely predictive of the sensitive attribute) is in the feature set, and (iii) the label y strongly correlates with the sensitive attribute.
We encode every community x ∼ p a as z =
f a ( x ) and compute the corresponding community with opposite sensitive attribute that is also mapped to z , i.e., ˜ x = f − 1 (1 − a ) ( z ) (usually not in the dataset), yielding a matching between both distributions.
We visualize the t-SNE (van der Maaten & Hinton, 2008) embeddings of this mapping for γ ∈ { 0 , 1 } in Fig.
9, where the dots are communities x and the crosses are the corresponding ˜ x .
We run k-means (MacQueen, 1967; Lloyd, 1982) on all points with a = 1 and show the matched clusters for points with a = 0 (e.g., red clusters are matched).
For γ = 0 , where FNF only minimizes the classiﬁcation loss L clf , we observe a dichotomy between x and ˜ x , since the encoder learns to match real points x with high likelihood to points ˜ x with low likelihood, yielding both high task utility (due to (iii)), but also high statistical distance (due to (ii)).
For example, the red cluster has an average log-likelihood of − 4 .
3 for x and − 130 .
1 for ˜ x .
In contrast, for γ = 1 FNF minimizes only the KL-divergence losses L 0 + L 1 , and thus learns to match points of roughly equal likelihood to the same latent point z such that the optimal adversary can no longer recover the sensitive attribute.
Accordingly, the red cluster has an average log-likelihood of − 2 . 8 for x and − 3 .
for ˜ x .
[Figure]