PaperlayerView exact revision on arXiv

Source-linked AI summary

Generating Fair Universal Representations using Adversarial Models

Peter Kairouz, Jiachun Liao, Chong Huang, Maunil Vyas, Monica Welfert, Lalitha Sankar

arXiv:1910.00411v7cs.LGstat.ML

TL;DR

Fairness methods face a tradeoff between hiding sensitive features and preserving useful representations. The paper learns fair universal representations with a constrained encoder–adversary game, then evaluates their fairness and utility across datasets and downstream tasks. The reported results show that these representations can support high-accuracy DemP and EO classifiers while varying fairness and utility.

  • Problem

    Sensitive information in datasets can shape learned models, while a representation independent of the data has no downstream utility, motivating a way to balance censoring and usefulness.

    Source: §I · p. 1, A. FUR: Framework and Theoretical… · p. 3

  • Method

    A constrained encoder–adversary minimax game learns randomized representations that decouple sensitive features while enforcing a distortion constraint.

    Source: §I · p. 2, §III · p. 3

  • Results

    Across public datasets and tasks, FURs support high-accuracy DemP and even EO classifiers while exhibiting tradeoffs between censoring, representation fidelity, fairness, and downstream utility.

    Source: §I · p. 2, §VI · p. 14

  • Takeaways & Limitations

    FURs are designed for use across downstream tasks not known in advance, with appropriately chosen losses providing guarantees against strong information-theoretic adversaries.

    Source: §VI · p. 13

Abstract

from arXiv · show

We present a data-driven framework for learning fair universal representations (FUR) that guarantee statistical fairness for any learning task that may not be known a priori. Our framework leverages recent advances in adversarial learning to allow a data holder to learn representations in which a set of sensitive attributes are decoupled from the rest of the dataset. We formulate this as a constrained minimax game between an encoder and an adversary where the constraint ensures a measure of usefulness (utility) of the representation. The resulting problem is that of censoring, i.e., finding a representation that is least informative about the sensitive attributes given a utility constraint. For appropriately chosen adversarial loss functions, our censoring framework precisely clarifies the optimal adversarial strategy against strong information-theoretic adversaries; it also achieves the fairness measure of demographic parity for the resulting constrained representations. We evaluate the performance of our proposed framework on both synthetic and publicly available datasets. For these datasets, we use two tradeoff measures: censoring vs. representation fidelity and fairness vs. utility for downstream tasks, to amply demonstrate that multiple sensitive features can be effectively censored even as the resulting fair representations ensure accuracy for multiple downstream tasks.

I. INTRODUCTION

The paper introduces fair universal representations (FURs), which decouple sensitive features for use across unknown downstream tasks, and develops a constrained adversarial framework for learning them. It connects this approach to demographic-parity fairness and evaluates utility and fairness tradeoffs across datasets and tasks.

I. INTRODUCTION

  • Sensitive information in ML datasets can be learned even when omitted from training, while learned models can inherit societal bias and discrimination.These concerns have motivated work on fairness measures and algorithms.Source: §I · p. 1

II. PRELIMINARIES

  • The preliminaries distinguish DemP, which requires prediction independence from sensitive features, from EO, which requires that independence conditioned on the true outcome.The setup denotes sensitive, non-sensitive, and target features by S, X, and Y, respectively.Source: §I · p. 1, §II · p. 2

I. INTRODUCTION

  • A constrained encoder–adversary minimax game learns noisy representations under a hard distortion constraint, controlling representation fidelity and supporting downstream utility.The framework uses Lagrange penalty methods to enforce the hard constraint in a GAN setting.Source: §I · p. 2
  • The paper formalizes censored and demographically fair representations, relating censoring to information-theoretic guarantees and adversarial loss choices.For independent-component Gaussian mixtures, it gives optimal additive Gaussian noise against a MAP adversary and compares neural-network log-loss results with that optimum.Source: §I · p. 2
  • Across multiple public datasets, FURs support high-accuracy DemP and even EO classifiers, span a wide range of DemP values, and include perfect fairness.The introduction also highlights non-binary sensitive attributes, multiple downstream tasks, and hard distortion constraints as distinctions from prior approaches.Source: §I · p. 2

III. FURS VIA GENERATIVE ADVERSARIAL MODELS

The FUR framework learns representations by balancing censoring of sensitive features against bounded distortion. Under demographic parity, those representations also guarantee demographic parity for downstream algorithms, while α-loss supports different adversarial strategies and fairness formulations.

III. FURS VIA GENERATIVE ADVERSARIAL MODELS

A. FUR: Framework and Theoretical Results

  • The framework defines censoring relative to an adversary’s loss: the best censored representation is least informative about sensitive features under that inferential measure.The formulation can use different losses and decision rules to represent different adversaries.Source: A. FUR: Framework and Theoretical… · pp. 3–4
  • If a representation satisfies demographic parity, any downstream algorithm using it also satisfies demographic parity with respect to the sensitive features.As distortion increases, the framework’s fairness guarantee approaches ideal demographic parity.Source: A. FUR: Framework and Theoretical… · pp. 3–4
  • A utility-free representation independent of both data and sensitive features achieves censoring, but provides no utility, creating a fairness–utility tradeoff.For sufficiently large distortion bounds, the framework yields a representation censored with respect to the sensitive features.Source: A. FUR: Framework and Theoretical… · p. 3
  • Under α-loss, the optimal adversary uses an α-tilted conditional distribution; log-loss yields the true conditional distribution, while α = ∞ yields MAP estimation.The resulting objectives connect to Arimoto mutual information, and increasing distortion approaches ideal demographic parity.Source: A. FUR: Framework and Theoretical… · p. 4
  • The framework also formulates equalized-odds predictors under a performance constraint, but such targeted fairness requires the intended task Y.Unlike task-specific designs, FUR representations guarantee demographic parity for downstream tasks without requiring Y in advance.Source: A. FUR: Framework and Theoretical… · pp. 3–5

B. Data-driven FUR

The data-driven formulation learns a generative decorrelator from samples by competing against a neural-network adversary. It alternates adversary and encoder updates and approximates the distortion constraint with a penalty.

B. Data-driven FUR

  • The sample-based method learns a generative decorrelator from n paired data samples rather than requiring the joint distribution P(X, S).Its learned representation is evaluated against a strong MAP adversary with access to distribution statistics.Source: B. Data-driven FUR · p. 5
  • Training alternates between maximizing the adversary’s performance for a fixed encoder and minimizing the encoder’s loss for a fixed adversary.A penalty method approximates the hard distortion constraint, with the penalty coefficient decreasing over iterations.Source: B. Data-driven FUR · p. 5
  • The experiments apply the data-driven framework to synthetic Gaussian mixtures and four public datasets: UCI Adult, UTKFace, GENKI, and HAR.The implementation can be generalized to non-binary sensitive variables and α-loss.Source: B. Data-driven FUR · p. 6

IV. FUR FOR GAUSSIAN MIXTURE MODELS

For Gaussian mixtures with shared covariance, the paper studies additive Gaussian censoring against a MAP adversary under an ℓ2 distortion bound. The tractable affine model supports closed-form information-theoretic analysis.

A. Game-Theoretical Approach

  • In the affine Gaussian-mixture model, the encoder adds independent zero-mean Gaussian noise and a constant shift, with ℓ2 distortion bounded by D.The adversary has access to the joint distribution and chooses the MAP estimate of the sensitive group.Source: A. Game-Theoretical Approach · p. 6, §IV · p. 6
  • The minimax censoring strategy is characterized for diagonal covariance matrices, with its parameters constrained by the distortion budget.The paper states that the resulting MAP adversary accuracy follows its detection-probability expression.Source: A. Game-Theoretical Approach · p. 6
  • The optimal noise variance on a dimension is proportional to |µ_i|, so dimensions with larger group-mean separation receive more noise.The analysis uses an affine encoder for tractability and closed-form adversarial results; the authors note it could be generalized to non-affine encoders.Source: A. Game-Theoretical Approach · p. 6

B. Data-driven Approach

The data-driven Gaussian-mixture approach learns the encoder from samples by competing against a neural-network adversary, then evaluates censoring against a strong MAP adversary.

B. Data-driven Approach

  • The learned Gaussian-mixture encoder is evaluated against a strong MAP adversary with access to the joint distribution and censoring mechanism.Training instead uses a computational adversary modeled by a multilayer neural network.Source: B. Data-driven Approach · p. 6
  • For binary sensitive features, the adversary is trained with empirical log-loss, while the encoder learns per-dimension shifts and noise scales.The encoder adds independent standard Gaussian noise scaled by each learned noise parameter.Source: B. Data-driven Approach · p. 6
  • A penalty method is used to enforce the distortion constraint during training.Source: B. Data-driven Approach · p. 6

C. Illustration of Results

The section evaluates learned FURs on Gaussian mixtures and public datasets, focusing on censoring and downstream fairness–utility tradeoffs. Results show close agreement with a theoretical MAP adversary and reduced sensitive-feature inference while retaining task accuracy.

C. Illustration of Results

  • In 32-dimensional GMMs, the data-driven scheme’s maximum accuracy difference from the theoretical MAP adversary is around 0.7%, while normalized mutual information decreases as distortion increases.The comparison covers prior probabilities P(S = 1) of 0.75 and 0.5.Source: C. Illustration of Results · p. 7, Figure 2 · p. 7

V. FUR FOR PUBLICLY AVAILABLE DATASETS

  • Evaluation covers UCI Adult, UTKFace, GENKI, and HAR, with neural networks used for encoders, adversaries, and downstream predictors.The datasets include tabular, image, and motion-sensor data, with sensitive attributes such as gender and subject identity.Source: §V · p. 7

A. Illustration of Results for UCI Adult Dataset

  • At ∆DemP ≈0, salary accuracy remains ≥79%; gender inference approaches its 66% test prior, while further fairness requires more distortion and lowers utility.The FUR can reach ∆DemP ≈0 with a small reduction in salary accuracy.Source: A. Illustration of Results for UCI… · p. 8, Figure 3 · p. 8
  • At ∆DemP =0.06, and achieve 2% and 2.5% higher salary accuracy, respectively, but FUR reaches ∆DemP ≈0 with salary accuracy ≥79%.FUR-generated representations from X or (S, X) lead to similar fairness guarantees.Source: A. Illustration of Results for UCI… · p. 8, Figure 3 · p. 8
  • With salary accuracy above 79%, gender, relationship, and joint inference fall to about 66%, 45%, and 41%; censoring correlated features costs up to 3% salary accuracy.These inference accuracies approach random-guess levels given the original test-data priors.Source: A. Illustration of Results for UCI… · p. 9
  • With non-binary sensitive S, salary accuracy stays above 94% of baseline as ∆DemP falls to 25% for gender and about 34% for relationship or their combination.For a given ∆DemP for gender, Case II salary accuracy is about 1% lower than Case I; for a given salary accuracy, its ∆DemP for gender is about 0.25 higher.Source: A. Illustration of Results for UCI… · pp. 8–9

B. Illustration of Results for UTKFace Dataset

On UTKFace, the representations reduce demographic-parity disparity while retaining much of the utility for ethnicity and age prediction. On GENKI, increasing distortion reduces sensitive-feature information and classification disparities, while the extent of retained expression utility and fairness varies by decorrelator.

B. Illustration of Results for UTKFace Dataset

  • On UTKFace, gender-distinguishing facial features are smoothed at per-pixel distortion 0.003, while distortion 0.006 can produce faces with the opposite gender.At distortion 0.01, generated representations are often too blurred.Source: B. Illustration of Results for UTKFace… · p. 9
  • On UTKFace, gender accuracy is about 62% while ethnicity accuracy stays above 74%, with respective baseline decreases of 35% and 14%.The reported age-regression MAE increase is 1.5 years, about 20% over its 7.2-year baseline; the age-prediction CDF drops by at most 1%.Source: B. Illustration of Results for UTKFace… · p. 10
  • At 86% of baseline utility, UTKFace ethnicity classification has ΔDemP 0.03, 20% of the original 0.14; age regression has ΔDemP 0.015 at 86% utility, below 33% of the original 0.046.At pixel distortion 0.01, ΔDemP(y) is zero for 17 distinct ages.Source: B. Illustration of Results for UTKFace… · pp. 10–11

C. Illustration of Results for GENKI Dataset

  • For GENKI, FNND achieves lower gender-classification accuracy than TCNND at the same distortion; both adversaries' accuracy decreases as distortion increases.The paper attributes the difference to FNND using both the noise vector and original image, while TCNND generates a noise mask independently before adding it to the image.Source: C. Illustration of Results for GENKI… · p. 11
  • At the same distortion on GENKI, learned FUR schemes achieve lower gender-classification accuracy than pixel-level Gaussian or Laplacian noise, whose privacy risk remains high even with substantial noise.The paper also reports that those noise levels deteriorate expression-classification accuracy.Source: C. Illustration of Results for GENKI… · p. 11
  • At distortion 5 per image, GENKI expression-classification accuracy decreases by 10%, while normalized mutual information about expression decreases more slowly than normalized mutual information about gender.The authors report that the representation retains relatively more information about the intended expression task than the sensitive feature at every distortion level.Source: C. Illustration of Results for GENKI… · p. 11
  • For GENKI expression classifiers, differences in each error rate between male and female groups decrease as distortion increases; at D = 5 they are small.FNND enforces fairness better than TCNND but has a slightly higher error rate.Source: C. Illustration of Results for GENKI… · p. 11

D. Illustration of Results for HAR Dataset

On HAR, increasing distortion sharply reduces subject-identification accuracy while limiting the activity-accuracy loss. The conclusion presents FUR as a way to trade representation fidelity against censoring and downstream utility, while noting that when demographic-parity representations preserve equalized-odds guarantees remains unresolved.

D. Illustration of Results for HAR Dataset

  • On HAR, identity-classification accuracy falls to 27% at D = 2 and 3.8% at D = 8, while activity-classification accuracy decreases by at most 18%.As distortion increases, normalized mutual information about activity decreases more slowly than normalized mutual information about subject identity.Source: D. Illustration of Results for HAR… · p. 12

VI. CONCLUSION

  • The conclusion describes FUR as a randomized mapping that decouples sensitive and non-sensitive features, learned from the dataset without requiring access to dataset statistics.Its stated aim is fairness for downstream tasks not specified in advance.Source: §VI · p. 13
  • The conclusion reports that appropriately chosen losses give guarantees against MAP and mutual-information adversaries, while tunable α-losses can approach ideal demographic parity.For a known classification task, the framework can also be modified to approximate demographic parity or equalized odds.Source: §VI · pp. 13–14
  • The paper reports evaluations on synthetic and public datasets spanning Gaussian mixtures, images, and mixed categorical and continuous features.The conclusion highlights tradeoffs among representation fidelity, censoring, multiple downstream tasks, and demographic-parity or equalized-odds guarantees.Source: §VI · p. 14
  • The authors identify unresolved conditions under which demographic-parity FURs suffice for meaningful equalized-odds guarantees, and question whether worst-case ΔDemP is too strong when Y or S is large.They point to the UTKFace age-prediction results as an example motivating that question.Source: §VI · p. 14
  • The authors leave robustness of α-loss for highly imbalanced datasets, unsupervised-task utility, and robustness and convergence guarantees for the data-driven encoder as open questions.These are presented as directions for further investigation.Source: §VI · p. 14

APPENDIX

The appendix proves that representations independent of sensitive attributes yield demographic parity, then derives how different adversarial losses shape the censoring objective and optimal inference strategy.

A. Proof of Theorem 1

  • Independence of the representation from sensitive attributes implies demographic parity for predictions, including with respect to any subset of those attributes.The proof uses the data processing inequality and non-negativity of mutual information.Source: A. Proof of Theorem 1 · pp. 14–15

B. Proofs of Proposition 1, Results in Table I, and Theorem 3

  • Under squared-error loss, the optimal adversary estimates the sensitive variable by its conditional mean, giving censoring guarantees against an MMSE adversary.The representation remains subject to the distortion constraint.Source: B. Proofs of Proposition 1, Results in… · p. 15
  • Under 0-1 loss, the adversary's optimal strategy is MAP classification, and the FUR objective provides censoring guarantees against that adversary.Ties in the MAP rule are broken uniformly at random.Source: B. Proofs of Proposition 1, Results in… · p. 15
  • With log-loss, the censoring objective is equivalent to mutual information; α-loss generalizes this link, with independence marking perfect demographic parity.As the distortion bound increases, the formulation can approach ideal demographic parity.Source: B. Proofs of Proposition 1, Results in… · p. 16

C. Proof of Theorem 4

The proof relates the equalized-odds objective to conditional dependence between the representation and sensitive attributes given the target. Increasing the allowed performance constraint can move the formulation toward perfect equalized odds.

C. Proof of Theorem 4

  • Minimizing the α-loss objective achieves equalized odds when the representation is conditionally independent of sensitive attributes given the target.The passage states that the relevant conditional mutual information is nonnegative and equals zero exactly under that conditional independence.Source: C. Proof of Theorem 4 · p. 16
  • As the performance constraint ε increases, the formulation approaches perfect equalized odds with respect to the target and sensitive attributes.Source: C. Proof of Theorem 4 · p. 16

D. Alternate Minimax Algorithm

The algorithm handles the distortion constraint with a penalty method, adjusting the penalty and learning rate during training and checking distortion at termination.

D. Alternate Minimax Algorithm

  • The constrained optimization is replaced by a series of unconstrained problems that add a penalty for constraint violation.The penalty parameter ρ_t scales the violation measure.Source: D. Alternate Minimax Algorithm · pp. 16–17
  • Training starts with a large penalty parameter and decreases it exponentially across epochs to enforce distortion early and reduce the penalty near convergence.Source: D. Alternate Minimax Algorithm · p. 17
  • The initial learning rate is tuned so adversarial loss and distortion penalty have similar scales early in training, then final average distortion is checked and the update rule adjusted if needed.Source: D. Alternate Minimax Algorithm · p. 17

E. Proof of Theorem 5

The proof of Theorem 5 constrains additive Gaussian noise by a distortion bound and relates the resulting optimization to reverse water-filling. The supplement describes the decorrelator architectures and their dataset assignments.

E. Proof of Theorem 5

  • For the Gaussian-noise representation, the distortion constraint requires ||β||^2 + tr(Σ_p) ≤ D.The representation is written as X̂ = X + Z + β.Source: E. Proof of Theorem 5 · p. 17
  • The optimization is analogous to rate-distortion for independent Gaussian sources, with reverse water-filling identified as the solution approach.The proof says it uses similar techniques to obtain the theorem's result.Source: E. Proof of Theorem 5 · p. 17

Adversarial Models – Supplementary Material

  • The experiments use FNND and TCNND for GENKI, FNND for UCI Adult and HAR, and NAED for UTKFace; PMM is not used for these mixed or continuous-valued datasets.The supplement describes FNND, TCNND, NAED, and PMM as decorrelator architectures.Source: Adversarial Models – Supplementary… · p. 19

SII. GENKI DATASET DETAILS AND RESULTS

The section describes the GENKI dataset and the architectures used for decorrelation, adversarial classification, and mutual-information estimation, alongside a pixel-based approach to bounding differential censoring risk.

SII. GENKI DATASET DETAILS AND RESULTS

A. Architecture

  • The feedforward decorrelator adds a 100-dimensional Gaussian noise vector to a flattened image before a four-layer network reconstructs the 16 × 16 image.The transposed-convolution alternative starts from Gaussian noise, projects it to a feature tensor, and adds its generated output to the original image.Source: A. Architecture · p. 20
  • The CNN adversary predicts gender from processed images, while the expression classifier uses a similar architecture to predict smiling versus not smiling.The adversary uses convolution, max-pooling, and fully connected layers; its final two outputs represent male and female beliefs.Source: A. Architecture · p. 20

B. Computing Differential Censoring Risk

C. Architecture for Mutual Information Estimation

  • The mutual-information estimator trains on Xr with S to form Xg for estimating I(Xg; S), and separately on Xr with Y to form Xf for estimating I(Xf; Y).The feature embedding Xf is an 8-dimensional vector.Source: C. Architecture for Mutual Information… · p. 20

A. Architecture

This section gives dataset-specific encoder, adversary, classifier, and mutual-information-estimation designs for HAR, UCI Adult, and UTKFace.

A. Architecture

  • HAR’s 561 normalized motion features cover six activities from 30 subjects; subject identity is sensitive, and a feedforward encoder and adversary are paired with a six-class activity classifier.The encoder and adversary use feedforward networks, while the classifier predicts the six activity labels.Source: A. Architecture · pp. 20–21

B. Architecture for Mutual Information Estimation

SIV. UCI ADULT DATASET DETAILS

  • UCI Adult categorical features are one-hot encoded, continuous X features are normalized to (0, 1), and the encoder output matches X’s dimension in both cases.Case I uses gender as the binary sensitive feature; Case II uses gender and relationship as non-binary S.Source: SIV. UCI ADULT DATASET DETAILS · p. 21, A. Architecture · p. 21
  • For UCI Adult, the Case I adversary predicts gender from Xr, while Case II uses a larger three-layer adversarial classifier for the non-binary sensitive variable.The Case I classifier architecture is also used for downstream salary classification.Source: A. Architecture · p. 22

A. Architecture

  • The UTKFace experiments use 64 × 64 face images for ages 10–65, with gender as sensitive and age and ethnicity as target labels.The noisy-autoencoder encoder mixes its image feature vector with Gaussian noise before decoding the universal representation; a classifier predicts gender from that representation.Source: A. Architecture · pp. 22–23

Related papers

Loading 1910.00411v7…