Cited by 405Software Testing and Debugging TechniquesEthics and Social Impacts of AIExplainable Artificial Intelligence (XAI)

Fairness testing: testing software for discrimination

Open access
Galhotra, Sainyam, Brun, Yuriy, Meliou, Alexandra·2017·Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering

Abstract

This paper defines software fairness and discrimination and develops a testing-based method for measuring if and how much software discriminates, focusing on causality in discriminatory behavior. Evidence of software discrimination has been found in modern software systems that recommend criminal sentences, grant access to financial products, and determine who is allowed to participate in promotions. Our approach, Themis, generates efficient test suites to measure discrimination. Given a schema describing valid system inputs, Themis generates discrimination tests automatically and does not require an oracle. We evaluate Themis on 20 software systems, 12 of which come from prior work with explicit focus on avoiding discrimination. We find that (1) Themis is effective at discovering software discrimination, (2) state-of-the-art techniques for removing discrimination from algorithms fail in many situations, at times discriminating against as much as 98% of an input subdomain, (3) Themis optimizations are effective at producing efficient test suites for measuring discrimination, and (4) Themis is more efficient on systems that exhibit more discrimination. We thus demonstrate that fairness testing is a critical aspect of the software development cycle in domains with possible discrimination and provide initial tools for measuring software discrimination.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper defines causal software discrimination and presents Themis, a testing method that automatically generates test suites to measure group and causal discrimination without an oracle. Evaluating 20 instances of 8 financial-decision systems, it finds discrimination even in systems designed to avoid it and shows sound pruning reduces test suites by two-to-three orders of magnitude.

Key findings

  • Themis detected causal discrimination missed by group discrimination: for `B census gender`, the causal score was 11.27% versus a group score of 0.52%, more than 21× higher.
  • Discrimination was present even in systems designed to avoid it: `B census gender` had a causal discrimination score over 11% for gender, and discriminated against gender, marital status, and race with a causal score of 77.2%; `F census` discriminated against country and race with a causal score of 98.1%.
  • There was no clear evidence that discrimination-aware methods outperformed discrimination-unaware ones; the discrimination-unaware approaches typically discriminated less than their discrimination-aware counterparts, with the exception of logistic regression.
  • Pruning reduced the number of test cases by, on average, a factor of 2,849 for group and 148 for causal discrimination; Themis was more efficient when systems discriminated more, e.g., `B credit gender` needed 3,413 tests at threshold θ = 0.7 but only 10 tests at θ = 0.6.

Methods

  • The paper formally defines group, causal, and apparent discrimination, then introduces Themis, which uses an input schema, requires no oracle, and employs test caching, adaptive confidence-driven sampling, and sound pruning based on monotonicity properties.
  • Evaluation used 20 instances of 8 software systems making financial decisions: 12 instances from prior discrimination-aware work (4 focused on race, 8 on gender) and 8 standard machine-learning instances that made no attempt to avoid discrimination.
  • The datasets were the Adult/Census Income dataset (45K individuals, 14 attributes) and the Statlog German Credit dataset (1,000 individuals, 20 pieces of data); systems were trained on balanced samples of 15.5K census individuals and 600 credit individuals, and Themis measured group and causal discrimination with respect to race and gender, including discrimination-checking experiments with thresholds and pruning comparisons at 99% confidence and 0.05 error bound.

Limitations

  • The paper states simplifying assumptions: software is modeled as a black box mapping categorical input characteristics to a categorical output characteristic, and non-categorical inputs/outputs are handled via binning; extending the measures directly to broader data types is left to future work.
  • The paper states Themis requires an input schema, and its apparent-discrimination method does not compute confidence because it is only as strong as the developer’s confidence that the test suite or operational profile is representative; apparent discrimination was not directly evaluated.
  • Evident from the text: the evaluation is limited to 20 instances of 8 financial-decision systems on two datasets, so the findings may not generalize to other software domains; the paper also leaves integration with combinatorial testing and other automated test-generation improvements to future work.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1145/3106237.3106277

Cites

92 of 92 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 45 cited sources checked · 0 supported · 0 flagged

  • Findingown data
    § 1 INTRODUCTION · p. 1

    Themis optimizations are effective at producing efficient test suites for measuring discrimination.

    “(3) Themis optimizations are effective at producing efficient test suites for measuring discrimination”
    Quote in the paperSubstantial claim
  • Findingown data
    § 1 INTRODUCTION · p. 1

    Themis is effective at discovering software discrimination.

    “We find that (1) Themis is effective at discovering software discrimination”
    • Also stated in: § ACMReference format: · p. 2 · plain
      “Themis is an effective fairness testing tool.”
    Quote in the paperSubstantial claim
  • Findingown data
    § 1 INTRODUCTION · p. 1

    State-of-the-art techniques for removing discrimination from algorithms fail in many situations, at times discriminating against as much as 98% of an input subdomain.

    “(2) state-of-the-art techniques for removing discrimination from algorithms fail in many situations, at times discriminating against as much as 98% of an input subdomain”
    Quote in the paperSubstantial claim
  • Findingown data
    § 5.2 Race and Gender Discrimination · p. 8

    The discrimination-aware decision tree instance B census gender, trained not to discriminate against gender, had a causal discrimination score over 11%, meaning more than 11% of individuals had their output flipped by altering only gender.

    “For example, a discrimination-aware decision tree approach trained not to discriminate against gender, B census gender , had a causal discrimination score over 11%: more than 11% of the individuals had the output flipped just by altering the individual's gender.”
    Quote in the paperSubstantial claim
  • Findingown data
    § ACMReference format: · p. 2

    Even when fairness is a design goal, developers can easily introduce discrimination in software.

    “demonstrating that (i) even when fairness is a design goal, developers can easily introduce discrimination in software”
    Quote in the paperSubstantial claim
  • May combine two claims. 32
  • Classified as probably not a substantial claim. 30
  • May combine two claims.

    Findingown data
    § 5.2 Race and Gender Discrimination · p. 9

    The discrimination-unaware approaches typically discriminated less than their discrimination-aware counterparts, with the exception of logistic regression.

    “In fact, the discrimination-unaware approaches typically discriminated less than their discrimination-aware counterparts, with the exception of logistic regression.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data
    § 5.4 Themis Efficiency and the Pruning Effect · p. 9

    Pruning reduces the number of test cases needed to compute group and causal discrimination by, on average, a factor of 2,849 for group and 148 for causal discrimination.

    “Pruning reduces the number of test cases by, on average, a factor of 2 , 849 for group and 148 for causal discrimination.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data
    § 5.3 Computing Discriminated-Against Characteristics · p. 9

    B census gender discriminates against gender, marital status, and race with a causal score of 77.2%, meaning that for 77.2% of individuals, changing only gender, marital status, or race causes the output to flip.

    “For example, B census gender discriminates against gender, marital status, and race with a causal score of 77.2%. That means for 77.2% of the individuals, changing only the gender, marital status, or race causes the output of the algorithm to flip.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data
    § 5.3 Computing Discriminated-Against Characteristics · p. 9

    For B census gender, the causal discrimination score against gender is 11.2%, but against gender, marital status, and race is 77.2%.

    “This is the case with B census gender , for example, as its causal discrimination score against gender is 11.2%, but against gender, marital status, and race is 77.2%.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data
    § 7 CONTRIBUTIONS · p. 11

    Themis effectively measures discriminations and produces efficient test suites to do so.

    “show that Themis effectively measures discriminations and produces efficient test suites to do so.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingnone given
    § 5.5 Discussion · p. 10

    Themis is effective at finding both group and causal discrimination.

    “Themis is effective at finding both group and causal discrimination.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data
    § 5.4 Themis Efficiency and the Pruning Effect · p. 10

    Themis needed 3,413 tests to find sets of characteristics that B credit gender discriminated with a score of more than θ = 0.7, but only 10 tests when θ was reduced to 0.6.

    “For example, Themis needed 3,413 tests to find sets of characteristics that B credit gender discriminated with a score of more than θ = 0 . 7, but only 10 tests when we reduced θ to 0.6.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: Decreasing the discrimination threshold θ effectively simulates increasing system discrimination.
  • May combine two claims.

    Interpretationreasoning
    § 1 INTRODUCTION · p. 1

    Themis automatically generates test suites that measure discrimination and does not require an oracle.

    “Given a schema describing valid system inputs, Themis generates discrimination tests automatically and does not require an oracle.”
    • Also stated in: § ACMReference format: · p. 2 · plain
      “Themis requires a schema for generating inputs, but does not require an oracle.”
    • Also stated in: § ACMReference format: · p. 2 · plain
      “Unlike prior work that requires manually written tests [79], Themis automatically generates test suites that measure discrimination.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Premisecitation
    § 2 SOFTWARE FAIRNESS MEASURES · p. 3

    Amazon.com's same-day delivery software did not explicitly consider race but made race-correlated decisions because of correlations between race and other input characteristics.

    “Amazon.com, Inc. software that determined where to offer free same-day delivery did not explicitly consider race but made racecorrelated decisions because of correlations between race and other input characteristics [36, 52].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [36] [36] David Ingold and Spencer Soper. Amazon doesn't consider the race of its customers. Should it? Bloomberg , April 21, 2016. http://www.bloomberg.com/ graphics/2016-amazon-same-day. -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [52]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationreasoning
    § 4.1 Caching and Approximation · p. 6

    Test caching in Themis has low storage overhead and offers significant runtime gains.

    “Test caching has low storage overhead and offers significant runtime gains.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § 3 FORMAL FAIRNESS DEFINITIONS · p. 4

    The output domain distance function generalizes our work beyond binary outputs.

    “The output domain distance function generalizes our work beyond binary outputs.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Interpretationreasoning
    § ACMReference format: · p. 2

    These prior approaches do not capture causality and can miss discrimination that our causal approach detects.

    “These approaches do not capture causality and can miss discrimination that our causal approach detects, e.g., when the software discriminates negatively with respect to a group in one settings, but positively in another.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationown data
    § 5.2 Race and Gender Discrimination · p. 8

    Themis is effective: it can verify that many software instances do not discriminate against race and gender, and identify the software that does.

    “Themis is effective. Themis is able to (1) verify that many of the software instances do not discriminate against race and gender, and (2) identify the software that does.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Premisecitation
    § ACMReference format: · p. 1

    The COMPAS software is particularly likely to falsely flag black defendants as future criminals, wrongly labeling them at almost twice the rate as white defendants; white defendants were mislabeled as low risk more often than black defendants.

    “In forecasting who would reoffend, the software is 'particularly likely to falsely flag black defendants as future criminals, wrongly labeling them this way at almost twice the rate as white defendants; white defendants were mislabeled as low risk more often than black defendants' [5].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [5] [5] Julia Angwin, Jeff Larson, Surya Mattu, and Lauren Kirchner. Machine bias. ProPublica , May 23, 2016. https://www.propublica.org/article/ machine-bias-risk-assessments-in-criminal-sentencing. -

      Not checked in the free run.

  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationreasoning
    § 3 FORMAL FAIRNESS DEFINITIONS · p. 4

    The causal discrimination score penalizes software that gives loans to individuals of one race but not to otherwise identical individuals of another race, while group and apparent discrimination scores penalize software that gives loans to different fractions of individuals of different races.

    “As a result, for example, while the group and apparent discrimination scores penalize software that gives loans to different fractions of individuals of different races, the causal discrimination score penalizes software that gives loans to individuals of one race but not to otherwise identical individuals of another race.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationcitation
    § ACMReference format: · p. 2

    Our causal fairness definition is designed specifically to be testable, unlike definitions that require probabilistic estimation or knowledge of the future.

    “Our causal fairness definition is designed specifically to be testable, unlike definitions that require probabilistic estimation or knowledge of the future [38].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [38] [38] Matthew Joseph, Michael Kearns, Jamie Morgenstern, and Aaron Roth. Fairness in learning: Classic and contextual bandits. CoRR , abs/1207.0016, 2012. https: //arxiv.org/abs/1605.07139. - source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Interpretationreasoning
    § 3 FORMAL FAIRNESS DEFINITIONS · p. 4

    The causal discrimination score identifies changing which characteristics directly affects the output.

    “The causal discrimination score identifies changing which characteristics directly affects the output.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning
    § 3 FORMAL FAIRNESS DEFINITIONS · p. 4

    Our definition extends to the more broad categorical input types.

    “Our definition extends to the more broad categorical input types, reflecting the relative complexity of arbitrary decision software.”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim.

    Interpretationnone given
    § ACMReference format: · p. 2

    Our definition captures causal relationships between inputs and outputs.

    “Our definition captures causal relationships between inputs and outputs”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning
    § ACMReference format: · p. 2

    Themis could have analyzed the Amazon software and detected the discrimination prior to deployment.

    “Themis could have analyzed the software and detected the discrimination prior to deployment.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 6 RELATED WORK · p. 11

    Operational profiles describe the input distributions likely to be observed in the field.

    “Operational profiles [58] describe the input distributions likely to be observed in the field.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [58] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § 6 RELATED WORK · p. 10

    Our group discrimination score generalizes the CV score to the software domain with more complex inputs.

    “Our group discrimination score generalizes the CV score to the software domain with more complex inputs.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [19] [19] Toon Calders and Sicco Verwer. Three naive Bayes approaches for discriminationfree classification. Data Mining and Knowledge Discovery , 21(2):277-292, 2010. - source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 6 RELATED WORK · p. 11

    Operational profiles can significantly improve the effectiveness of testing by more accurately representing real-world system use.

    “operational profiles can significantly improve the effectiveness of testing by more accurately representing real-world system use [7, 50]”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [7] [7] Andrea Arcuri and Lionel Briand. A practical guide for using statistical tests to assess randomized algorithms in software engineering. In ACM/IEEE International Conference on Software Engineering (ICSE) , pages 1-10, Honolulu, HI, USA, 2011. -

      Not checked in the free run.

    • cites [50] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 6 RELATED WORK · p. 11

    The use of operational profiles has been shown to more accurately measure system properties, such as reliability.

    “the use of operational profiles has been shown to more accurately measure system properties, such as reliability [35].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [35] [35] Herman Hartmann. A statistical analysis of operational profile driven testing. In International Conference on Software Quality, Reliability, and Security Companion (QRS-C) , pages 109-116, Viena, Austria, August 2016. -

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationnone given
    § 6 RELATED WORK · p. 11

    Themis measures apparent discrimination by either executing a provided test suite, or by generating a test suite following a provided operational profile.

    “Themis measures apparent discrimination by either executing a provided test suite, or by generating a test suite following a provided operational profile.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given
    § 5.5 Discussion · p. 10

    Themis can also measure apparent discrimination (Definition 3.8) via a developer-provided test suite or operational profile.

    “Themis can also measure apparent discrimination (Definition 3.8) via a developer-provided test suite or operational profile.”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationreasoning
    § 6 RELATED WORK · p. 10

    Our work does not attempt to remove discrimination but offers developers a tool to identify and measure discrimination.

    “our work does not attempt to remove discrimination but offers developers a tool to identify and measure discrimination”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim. May combine two claims.

    Premisereasoning
    § 6 RELATED WORK · p. 11

    Input characteristics may correlate, so perturbing some characteristics without perturbing others may create inputs not representative of the real world.

    “input characteristics may correlate, e.g., education correlates with age, so perturbing some characteristics without perturbing others may create inputs not representative of the real world.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given
    § 7 CONTRIBUTIONS · p. 11

    We have described Themis, an approach and its open-source implementation for measuring discrimination in software and for generating efficient test suites to perform these measurements.

    “We have further described Themis, an approach and its open-source implementation for measuring discrimination in software and for generating efficient test suites to perform these measurements.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationown data
    § 5.2 Race and Gender Discrimination · p. 9

    Focusing on avoiding discrimination against one characteristic may create discrimination against another; for example, B census gender limits discrimination against gender but discriminates against race with a causal score of 38.40%.

    “Further, focusing on avoiding discriminating against one characteristic may create discrimination against another, e.g., B census gender limits discrimination against gender but discriminates against race with a causal score of 38.40%.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 6 RELATED WORK · p. 11

    FairTest uses manually written tests to measure four kinds of discrimination scores: the CV score and a related ratio, mutual information, Pearson correlation, and a regression between the output and sensitive inputs.

    “FairTest, an implementation of the unwarranted associations framework [79] uses manually written tests to measure four kinds of discrimination scores: the CV score and a related ratio, mutual information, Pearson correlation, and a regression between the output and sensitive inputs.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [79]

      Not checked in the free run.

  • May combine two claims.

    Interpretationown data
    § 5.2 Race and Gender Discrimination · p. 9

    The B approach was designed to avoid a variant of group discrimination, but this design is, at least in some conditions, insufficient to prevent causal discrimination.

    “The B approach was designed to avoid a variant of group discrimination (as are other discrimination-aware approaches), but this design is, at least in some conditions, insufficient to prevent causal discrimination.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § 6 RELATED WORK · p. 11

    FairML uses orthogonal projection to co-perturb characteristics, which can mask some discrimination, but find discrimination that is more likely to be observed in real-world scenarios.

    “FairML [1] uses orthogonal projection to co-perturb characteristics, which can mask some discrimination, but find discrimination that is more likely to be observed in real-world scenarios”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [1] [1] Julius Adebayo and Lalana Kagal. Iterative orthogonal feature projection for diagnosing bias in black-box models. CoRR , abs/1611.04967, 2016. -

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisereasoning
    § 6 RELATED WORK · p. 11

    Counterfactual fairness can miss some instances of discrimination.

    “Counterfactual fairness is related to causal fairness but can miss some instances of discrimination, e.g., if loan shows preferential treatment for some purple inputs, but at the same time against some other similar purple inputs.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Interpretationown data
    § 5.3 Computing Discriminated-Against Characteristics · p. 9

    The experiment demonstrates that Themis effectively discovers discrimination and can test software for unexpected discrimination effects across a wide variety of input partitions.

    “This experiment demonstrates that Themis effectively discovers discrimination and can test software for unexpected software discrimination effects across a wide variety of input partitions.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning
    § 6 RELATED WORK · p. 11

    The work on operational profiles is complementary to ours: Themis uses operational profiles and work on more efficient test generation from operational profiles can directly benefit discrimination testing.

    “The work on operational profiles is complementary to ours: Themis uses operational profiles and work on more efficient test generation from operational profiles can directly benefit discrimination testing.”
    Quote in the paperNot a substantial claim
  • Classified as probably not a substantial claim. May combine two claims.

    Interpretationnone given
    § 7 CONTRIBUTIONS · p. 11

    We have formally defined software fairness testing and introduced a causality-based measure of discrimination.

    “We have formally defined software fairness testing and introduced a causality-based measure of discrimination.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 6 RELATED WORK · p. 11

    The number of tests needed to evaluate every possible value pair can be significantly smaller than the exhaustive testing alternative.

    “The number of tests needed to evaluate every possible value pair can be significantly smaller than the exhaustive testing alternative since each test can simultaneously contribute to multiple value pairs [22, 44, 80].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [22] [22] Marcelo d'Amorim, Steven Lauterburg, and Darko Marinov. Delta execution for efficient state-space exploration of object-oriented programs. In International Symposium on Software Testing and Analysis (ISSTA) , pages 50-60, London, UK, 2007. - source

      Not checked in the free run.

    • cites [44] [44] Christian Kästner, Alexander von Rhein, Sebastian Erdweg, Jonas Pusch, Sven Apel, Tillmann Rendel, and Klaus Ostermann. Toward variability-aware testing. In International Workshop on Feature-Oriented Software Development (FOSD) , pages 1-8, Dresden, Germany, 2012. - source

      Not checked in the free run.

    • cites [80] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 6 RELATED WORK · p. 11

    Counterfactual fairness requires output probability distributions to match for input populations that differ only in the label value of a sensitive input characteristic.

    “Counterfactual fairness requires output probability distributions to match for input populations that differ only in the label value of a sensitive input characteristic [51].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [51] source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § 6 RELATED WORK · p. 11

    The goal of the generated tests is typically finding bugs or generating specifications.

    “The goal of the generated tests is typically finding bugs [29] or generating specifications [21].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [29] [29] Gordon Fraser and Andrea Arcuri. Whole test suite generation. IEEE Transactions on Software Engineering (TSE) , 39(2):276-291, February 2013. - source

      Not checked in the free run.

    • cites [21] [21] Valentin Dallmeier, Nikolai Knopp, Christoph Mallon, Gordon Fraser, Sebastian Hack, and Andreas Zeller. Automatically generating test cases for specification mining. IEEE Transactions on Software Engineering (TSE) , 38(2):243-257, March 2012. - source

      Not checked in the free run.

  • May combine two claims.

    Interpretationnone given
    § 6 RELATED WORK · p. 11

    Our approach generates tests automatically and measures causal discrimination.

    “our approach generates tests automatically and measures causal discrimination.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § 6 RELATED WORK · p. 11

    AdFisher computes a variant of group discrimination, but it could be integrated with Themis and its algorithms to measure causal discrimination.

    “AdFisher computes a variant of group discrimination, but it could be integrated with Themis and its algorithms to measure causal discrimination.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [23] [23] Amit Datta, Michael Carl Tschantz, and Anupam Datta. Automated experiments on ad privacy settings. Proceedings on Privacy Enhancing Technologies (PoPETs) , 1:92-112, 2015. - source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning
    § 6 RELATED WORK · p. 11

    Our main goal is to develop a method to process test executions to measure software discrimination, whereas that is not a goal of combinatorial testing.

    “Our main goal is to develop a method to process test executions to measure software discrimination, whereas that is not a goal of combinatorial testing.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 6 RELATED WORK · p. 11

    Causal relationships in data management systems can help explain query results and debug errors by tracking and using data provenance.

    “Causal relationships in data management systems [54, 55] can help explain query results [57] and debug errors [82-84] by tracking and using data provenance [56].”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites [54]

      Not checked in the free run.

    • cites [55]

      Not checked in the free run.

    • cites [57]

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation
    § 6 RELATED WORK · p. 11

    Our prior work on testing software that relies on data management systems has focused on data errors, whereas this work focuses on testing fairness.

    “Our prior work on testing software that relies on data management systems has focused on data errors [59, 60], whereas this work focuses on testing fairness.”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [59]

      Not checked in the free run.

    • cites [60] source

      Not checked in the free run.

  • May combine two claims.

    Premisereasoning
    § 6 RELATED WORK · p. 11

    These tools deal with more complex input spaces than Themis, but none of them focus on testing fairness and they require oracles whereas Themis does not need oracles as it measures discrimination by comparing tests' outputs.

    “These tools deal with more complex input spaces than Themis, but none of them focus on testing fairness and they require oracles whereas Themis does not need oracles as it measures discrimination by comparing tests' outputs.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: None of the automated test generation tools focus on testing fairness.
  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § 6 RELATED WORK · p. 11

    Our oracle is more precise and easier to compute, but is only applicable to fairness testing.

    “our oracle is more precise and easier to compute, but is only applicable to fairness testing.”
    Quote in the paperNot a substantial claim
47 of 47
  • The authors state this as an assumption.

    Software can be modeled as a black box that maps input characteristics to an output characteristic.

    “First, we define software as a black box that maps input characteristics to an output characteristic.”
  • The authors state this as an assumption.

    Input characteristics and the output characteristic are categorical variables.

    “Second, we assume that the input characteristics and the output characteristic are categorical variables, each having a set of possible values (e.g., race, gender, eye color, age ranges, income ranges).”
  • The authors state this as an assumption.

    For the remainder of the paper, software outputs binary decisions.

    “For simplicity of exposition, for the remainder of this paper, we assume software outputs binary decisions - a natural domain for fairness testing.”
  • The paper relies on this without support.

    No prior work automatically generates test suites to measure causal discrimination in software.

    “To the best of our knowledge, this work is the first to automatically generate test suites to measure causal discrimination in software.”
    “We are aware of no prior testing technique, neither automated nor manual, that produces a measure of a software system's causal discrimination.”
  • The authors state this as an assumption.

    Decreasing the discrimination threshold θ effectively simulates increasing system discrimination.

    “decreasing θ effectively simulates increasing system discrimination.”
  • The paper relies on this without support.

    No prior work on operational profile testing has measured software discrimination.

    “Meanwhile no prior work on operational profile testing has measured software discrimination.”
  • The paper relies on this without support.

    None of the automated test generation tools focus on testing fairness.

    “none of them focus on testing fairness”
7 of 7

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Causal methods are specifically well suited to identifying proxies of sensitive variables.

    “Thus, causal methods are speciically well suited to identifying 1) proxies of sensitive variables as discussed in subsection 2.1; 2) which subgroups are most (un)fairly treated and diferentiate the types of bias exhibited [118]; and 3) provide transparency with respect to how (classiication) decisions were made [143].”

    From Fairness in machine learning: A survey (2024) · cites this paper as [113]

  • A classifier trained without regard to the protected attribute fails to remove discrimination and can complicate detection and mitigation of discrimination downstream via in-processing or post-processing techniques.

    “As a result, a classifier trained without regard to the protected attribute not only fails to remove discrimination, but it can complicate the detection and mitigation of discrimination downstream via in-processing or post-processing techniques [9,10,18,24,25,34,43,51], such as those we describe next.”

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Reported group score exceeds causal score despite the stated bound

    Minor

    Theorem 4.3 states that the group discrimination score cannot exceed the causal score for the same characteristics. For A census race, the reported gender group score is 8.90%, above the gender causal score of 7.20%. Sampling uncertainty may explain the estimates, but the displayed scores do not satisfy the stated bound.

1 of 1

Cites

Flagged first, then by citations

Research works printed but not linked: 8

  1. Agitar Technologies . AgitarOne. http://www.agitar.com/solutions/products/ automated_junit_generation.html , 2016 . Agitar Technologies. AgitarOne. http://www.agitar.com/solutions/products/ automated_junit_generation.html, 2016.
  2. Julia Angwin , Jeff Larson , Surya Mattu , and Lauren Kirchner . Machine bias . ProPublica , May 23, 2016 . Julia Angwin, Jeff Larson, Surya Mattu, and Lauren Kirchner. Machine bias. ProPublica, May 23, 2016.
  3. 10.5555/1792786.1792789 · DOI
  4. Katelyn Ferral . Wisconsin supreme court allows state to continue using computer program to assist in sentencing . The Capital Times , July 13, 2016 . http://host.madison.com/ct/news/local/govt-and-politics/ wisconsin-supreme-court-allows-state-to-continue-using-computer-program/ article_7eb67874-bf40-59e3-b62a-923d1626fa0f.html. Katelyn Ferral. Wisconsin supreme court allows state to continue using computer program to assist in sentencing. The Capital Times, July 13, 2016. http://host.madison.com/ct/news/local/govt-and-politics/ wisconsin-supreme-court-allows-state-to-continue-using-computer-program/ article_7eb67874-bf40-59e3-b62a-923d1626fa0f.html.
  5. Rafi Letzter . Amazon just showed us that ‘unbiased’ algorithms can be inadvertently racist . TECH Insider , April 21, 2016 . http://www.techinsider.io/ how-algorithms-can-be-racist- 2016 - 2014 . Rafi Letzter. Amazon just showed us that ‘unbiased’ algorithms can be inadvertently racist. TECH Insider, April 21, 2016. http://www.techinsider.io/ how-algorithms-can-be-racist-2016-4.
  6. Satya Nadella . The partnership of the future . Slate , June 28, 2016 . http: //www.slate.com/articles/technology/future_tense/2016/06/microsoft_ceo_ satya_nadella_humans_and_a_i_can_work_together_to_solve_society.html. Satya Nadella. The partnership of the future. Slate, June 28, 2016. http: //www.slate.com/articles/technology/future_tense/2016/06/microsoft_ceo_ satya_nadella_humans_and_a_i_can_work_together_to_solve_society.html.
  7. Aarti Shahani . Now algorithms are deciding whom to hire, based on voice . NPR All Things Considered , March 2015 . Aarti Shahani. Now algorithms are deciding whom to hire, based on voice. NPR All Things Considered, March 2015.
  8. 10.5555/1792786.1792798 · DOI

Cited by

Sorted by citations

Authors
Galhotra, S., Brun, Y., & Meliou, A.
Affiliations
University of Massachusetts Amherst (US)
Venue
Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering
Publisher
ACM
Published
2017-08-21
Pages
498-510
OpenAlex
W2730550703
Cited by
405
References
91
Citations by year
2026: 26 · 2025: 55 · 2024: 46 · 2023: 56 · 2022: 50 · 2021: 53 · 2020: 57 · 2019: 37 · 2018: 22 · 2017: 3
FWCI
23.94
Type
conference paper
Language
en
Open access
Locations
  • ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
National Science Foundation (CCF-1453474, IIS-1453543, CNS-1744471)
Topics
  • Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
  • Social Sciences › Safety Research › Ethics and Social Impacts of AI
  • Physical Sciences › Computer Science › Artificial Intelligence › Explainable Artificial Intelligence (XAI)
Keywords
algorithmic discrimination, fairness testing, automated test generation, THEMIS, algorithmic fairness, automated decision systems

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review