Cited by 95Ethics and Social Impacts of AIExplainable Artificial Intelligence (XAI)Privacy-Preserving Technologies in Data

One-Network Adversarial Fairness

Open access
Adel, Tameem, Valera, Isabel, Ghahramani, Zoubin, Weller, Adrian·2019·Proceedings of the AAAI Conference on Artificial Intelligence

Abstract

There is currently a great expansion of the impact of machine learning algorithms on our lives, prompting the need for objectives other than pure performance, including fairness. Fairness here means that the outcome of an automated decisionmaking system should not discriminate between subgroups characterized by sensitive attributes such as gender or race. Given any existing differentiable classifier, we make only slight adjustments to the architecture including adding a new hidden layer, in order to enable the concurrent adversarial optimization for fairness and accuracy. Our framework provides one way to quantify the tradeoff between fairness and accuracy, while also leading to strong empirical performance.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper introduces one-network adversarial fairness (FAD) and a minibatch-diversity variant (FAD-MD) that add a hidden layer and sensitive-attribute predictor to an existing differentiable classifier, reversing gradients to learn fair representations while preserving accuracy. Experiments on COMPAS and Adult show minimal accuracy loss and state-of-the-art fairness results, with a generalization bound linking the adversary to distribution discrepancy.

Key findings

  • FAD and FAD-MD retain high accuracy: on COMPAS, unfair baseline 89.3%, FAD 88.4%, FAD-MD 88.7%; on Adult, unfair baseline 90.1%, FAD 88.6%, FAD-MD 89.0%.
  • The proposed methods minimize unfairness and achieve the best fairness metrics in five out of six cases across `Disp_DI`, `Disp_FPR`, and `Disp_FNR` on the two datasets; e.g., COMPAS `Disp_DI` drops from 0.6 (unfair) to 0.08 (FAD) and 0.11 (FAD-MD), and Adult `Disp_DI` drops from 0.71 to 0.14 (FAD) and 0.13 (FAD-MD).
  • FAD-MD’s diverse minibatches improve representation fidelity: MMD two-sample tests show lower rejection rates than FAD for both datasets, and FAD-MD gives slightly higher accuracy than FAD.
  • A generalization bound interprets the sensitive-attribute classifier as minimizing discrepancy/H-divergence between distributions with different sensitive values, while the label classifier minimizes Rademacher-complexity terms.

Methods

  • Architecture modification: add hidden layer `g` producing fair representation `x'` and sensitive-attribute predictor `φ`; reverse the gradient from `φ`’s loss into `g`, while label classifier `f` trains normally. Objective: `min_{g,f} [L(f(g(x)), y) - β max_φ L(φ(g(x)), s)]`; a disparate-mistreatment variant reweights by misclassification indicator/probability.
  • Data and setup: COMPAS (5,278 instances, 12 features; race black vs. white as sensitive attribute) and Adult (32,561 complete instances, 14 features; gender as sensitive attribute). Each experiment repeated ten times with 60% training, 20% validation, 20% test; β selected by cross-validation as 0.3 (COMPAS) and 0.8 (Adult); Adam optimizer.
  • Analysis: compare classification accuracy and disparity metrics (`Disp_DI`, `Disp_FPR`, `Disp_FNR`) against prior fairness algorithms; use MMD two-sample tests for representation fidelity; paired t-tests at 5% significance; derive a generalization bound using Rademacher complexity and discrepancy distance.

Limitations

  • The paper states adversarial learning is prone to mode collapse; FAD-MD is proposed to mitigate this, but the authors note they tried existing heuristics that did not improve results in their one-network framework.
  • The paper states future work includes applying the paradigm to deep generative models, continuous sensitive attributes, and studying how a pre-trained network adapts to the dual objective.
  • Evident from the text: the theoretical bound assumes binary labels and binary sensitive attributes with an equal split, and the experiments are limited to two binary classification datasets with binary sensitive attributes and two fairness notions (disparate impact and disparate mistreatment).

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1609/aaai.v33i01.33012412

Cites

Statistics

Nothing to recompute.

Claims the paper makes

0 of 23 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    FAD-MD leads to less distinguishable (less unfair) representations of data with different s than FAD.

    “FAD-MD leads to less distinguishable (less unfair) representations of data with different s, than FAD.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Most current frameworks of adversarial learning have the problem that the adversary bases its optimization on comparing data points instead of distributions or sets of points.
  • Findingown data

    The heuristics proposed in Salimans et al. 2016 did not improve results in the one-network adversarial framework.

    “We experimented with the heuristics proposed in (Salimans et al. 2016) but they did not improve results in our one-network adversarial framework.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Salimans et al. 2016

      Not checked in the free run.

  • Findingown data

    With both datasets, classification accuracy has not considerably changed for β > 1.

    “With both datasets, classification accuracy has not considerably changed for β > 1.”
    Quote in the paperNot a substantial claim
  • Findingnone given

    They demonstrated strong empirical performance of their methods compared to previous leading approaches.

    “We demonstrated strong empirical performance of our methods compared to previous leading approaches.”
    Quote in the paperSubstantial claim
  • Findingcitation

    Theorem 1: For distributions P0=P(x|s=0) and P1=P(x|s=1), with training data D of size n equally divided into D0 and D1, for a class H of binary classifiers and δ>0, with probability at least 1-δ, disc(P0,P1) ≤ disc(P0_hat,P1_hat) + sqrt(2 log(1/δ)/n) + 1/2(Rad_D0(Err(H))+Rad_D1(Err(H))).

    “disc(P 0 , P 1 ) ≤disc( P0 , P1 ) + 2 log(1/δ) n + 1 2 (Rad D0 (Err(H))+Rad D1 (Err(H)))(16)”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The label y (as well as its estimate ŷ) and the sensitive attribute s values are binary.
    • The authors state this as an assumption: Training data D with size n is equally divided into data points with s=0 and s=1.
  • May combine two claims. 13
  • Classified as probably not a substantial claim. 10
  • The quote only partly states this claim. 4
  • May combine two claims.

    Findingown data

    FAD and FAD-MD achieve state-of-the-art effectiveness in fairness (unfairness metrics).

    “Results demonstrate state-of-the-art effectiveness of FAD and FAD-MD”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Findingown data

    Loss in accuracy due to fairness (difference between unfair and fair versions) is not big; with FAD-MD, it is as minimal as state-of-the-art by Zafar et al. (2017b) for COMPAS and uniquely minimal for Adult.

    “Loss in accuracy due to fairness (difference in classification accuracy between the unfair and fair versions) is not big; with FAD-MD, it is as minimal as state-of-the-art by Zafar et al. (2017b) for the COMPAS data, and uniquely minimal for the Adult data.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Zafar et al. (2017b)

      Not checked in the free run.

  • May combine two claims.

    Findingown data

    FAD-MD achieves better results with lower rejection rates than FAD for both datasets in the MMD two-sample test.

    “Hence, FAD-MD achieves better results with lower rejection rates than FAD for both datasets.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: Most current frameworks of adversarial learning have the problem that the adversary bases its optimization on comparing data points instead of distributions or sets of points.
  • May combine two claims.

    Findingown data

    FAD and FAD-MD minimize disparity values (unfairness) when optimizing for fairness, and achieve the best results in terms of fairness metrics in five out of six cases.

    “The proposed algorithms, FAD and FAD-MD, minimize the disparity values (unfairness) when optimizing for fairness, and achieve the (at times joint) best results, in terms of the fairness metrics, in five out of six cases (three disparity values -Disp DI , Disp FPR and Disp FNR -for each dataset).”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S1 (asserted), S3 (load-bearing), S4 (based). The quote only partly states this claim.

    Findingnone given

    The increase in training time due to optimizing for fairness is not considerable for FAD compared to its unfair version.

    “Moreover, the increase in training time due to optimizing for fairness is not considerable for DAF compared to its unfair version.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Performing training with diverse minibatches leads to improved results.

    “Performing the training with diverse minibatches, i.e. minibatches whose elements are maximally diverse from one another, leads to improved results.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Most current frameworks of adversarial learning have the problem that the adversary bases its optimization on comparing data points instead of distributions or sets of points.
  • May combine two claims.

    Interpretationreasoning

    In FAD, g and φ adversarially optimize for fairness while f ensures that accuracy is not fully sacrificed for the sake of fairness.

    “To summarize: g, φ and f are all involved in the concurrent optimization for fairness and accuracy.The parameters of g and φ adversarially optimize for fairness while f guarantees that accuracy is not fully sacrificed for the sake of fairness.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S1 (asserted), S4 (based). The quote only partly states this claim.

    Interpretationnone given

    The FAD-MD method increases diversity among elements of each minibatch using a one-class SVM in order to achieve a representation with higher fidelity.

    “We propose a variation of the adversarial learning procedure to increase diversity among elements of each minibatch of the gradient descent training, in order to achieve a representation with higher fidelity.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Reversing a layer's gradient with respect to the layer below in the backward pass was used in domain adaptation to develop invariant representations to changes between source and target domains.

    “The idea of reversing a layer's gradient with respect to the layer below in the backward pass was used in domain adaptation to develop invariant representations to changes between the source and target domains (Ajakan et al. 2014;Ganin and Lempitsky 2015;Ganin et al. 2016).”
    Quote in the paperNot a substantial claim0 of 3 sources checked
    • cites Ajakan et al. 2014

      Not checked in the free run.

    • cites Ganin and Lempitsky 2015

      Not checked in the free run.

    • cites Ganin et al. 2016

      Not checked in the free run.

  • May combine two claims.

    Interpretationreasoning

    In mode collapse, the discriminator becomes maximally confused and convergence is reached although only a small subset of the data is well represented by the inferred representation.

    “The latter therefore becomes maximally confused and a convergence of the whole adversarial learning framework is reached although in reality only a small subset of the data is well represented by the inferred representation.”
    Quote in the paperSubstantial claim
  • The quote only partly states this claim.

    Interpretationreasoning

    The FAD framework modifies the architecture of an existing differentiable classifier by adding a hidden layer g and a sensitive attribute predictor φ, enabling concurrent adversarial optimization for fairness and accuracy.

    “Given any existing differentiable classifier, we make only slight adjustments to the architecture including adding a new hidden layer, in order to enable the concurrent adversarial optimization for fairness and accuracy.”
    • Also stated in: § 2 Fair Learning by Modifying an Unfair Model · plain
      “Our strategy is to add a term to the optimization objective to simultaneously maximize both fairness and accuracy.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationcitation

    The FAD framework avoids the need for a separate adversary network, thereby avoiding difficulties that may arise from double-network adversarial learning.

    “In this adversarial learning framework, there is no need for a separate network architecture representing the adversary, thus we avoid the well-known difficulties which may arise from double-network adversarial learning (Goodfellow 2016;Goodfellow et al. 2014).”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites Goodfellow 2016

      Not checked in the free run.

    • cites Goodfellow et al. 2014

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Interpretationnone given

    The fairness hyperparameter β > 0 controls the degree of fairness induced in the FAD model.

    “where the fairness hyperparameter β > 0 controls the degree of fairness induced in the model.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim.

    Study design and conductnone given

    To test significance, they perform a paired t-test with significance level at 5%.

    “To test significance, we perform a paired t-test with significance level at 5%.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Premisecitation

    Most previously proposed solutions to mode collapse are either tailored to generative adversarial learning or computationally inefficient for the FAD purpose.

    “Most of the previously proposed solutions are either tailored to the generative versions of adversarial learning (Arjovsky, Chintala, and Bottou 2017;Kim et al. 2017;Metz et al. 2017;Rosca et al. 2017) or computationally inefficient for our purpose (Srivastava et al. 2017).”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites Arjovsky, Chintala, and Bottou 2017

      Not checked in the free run.

    • cites Kim et al. 2017

      Not checked in the free run.

    • cites Metz et al. 2017

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Interpretationnone given

    The label classifier f(g(x_i)) aims at minimizing the error of the classifier, i.e., minimizing the error in predicting the label ŷ of the data points D (both D0 and D1).

    “The label classifier f (g(x i )) aims at minimizing the error of the classifier, i.e. minimizing the error in predicting the label ŷ of the data points D (both D 0 and D 1 ).”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationreasoning

    Due to the negative sign preceding the term in (9) and the equivalent former term in (24), it is inversely proportional to the maximization of the objective and to the overall distance between estimated distributions of data with different s values.

    “Due to the negative sign preceding the latter term in (9) and the equivalent former term in (24), it is inversely proportional to the maximization of our objective, and to the overall distance between estimated distributions of data with different s values, respectively.”
    Quote in the paperSubstantial claim
  • Classified as probably not a substantial claim. The quote only partly states this claim.

    Interpretationreasoning

    The sensitive attribute classifier φ(g(x)) aims at minimizing the first term in the bound on the right of (21), disc(P0_hat,P1_hat).

    “The sensitive attribute classifier φ (g(x)) aims at minimizing the first term in the bound on the right of ( 21), disc( P0 , P1 ).”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    The FAD adversarial paradigm can also be adopted in models with other metrics to achieve fairness.

    “However, our adversarial paradigm can also be adopted in models with other metrics to achieve fairness.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Premisecitation

    The discrepancy distance is symmetric and satisfies the triangle inequality.

    “For deriving our bound, we use a notion of distance between distributions, proposed by Mansour, Mohri, and Rostamizadeh (2009), and referred to as the discrepancy distance.It is symmetric and it satisfies the triangle inequality.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Mansour, Mohri, and Rostamizadeh 2009

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisenone given

    Disparate mistreatment depends on the ground truth labels y, and therefore it can be considered only when such information is available.

    “One major difference between the two notions is that disparate mistreatment depends on the ground truth labels y, and therefore it can be considered only when such information is available.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Interpretationreasoning

    The two classifiers of the adversarial formulation proposed in (9) can be interpreted with respect to the first two terms of the upper bound on the right of (21), and minimizing the classifiers' losses can be interpreted as minimizing the generalization upper bound.

    “From the latter note and (24), the two classifiers of the adversarial formulation proposed in (9) in the main document can be interpreted w.r.t. the first two terms of the upper bound on the right of ( 21); minimizing the classifier's losses can be interpreted as minimizing the generalization upper bound.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationnone given

    Their framework is capable of quantitatively evaluating the achieved degree of fairness as well as the difference (potential loss) in accuracy due to imposing fairness.

    “Our framework is capable of quantitatively evaluating the achieved degree of fairness as well as the difference (potential loss) in accuracy due to imposing fairness.”
    Quote in the paperNot a substantial claim
23 of 23
  • The authors state this as an assumption.

    The label y (as well as its estimate ŷ) and the sensitive attribute s values are binary.

    “Assume the label y (as well as its estimate ŷ) and the sensitive attribute s values are binary.”
  • The authors state this as an assumption.

    Training data D with size n is equally divided into data points with s=0 and s=1.

    “Assuming training data D with size n, which, without loss of generality (WLOG), is equally divided into data points with s = 0, D 0 , and those with s = 1, D 1 .”
  • The paper relies on this without support.

    Most state-of-the-art machine learning algorithms for fairness build from scratch a model's architecture tailored for a specific fairness notion.

    “Most state-of-the-art machine learning algorithms for fairness build from scratch a model's architecture tailored for a specific fairness notion.”
  • The paper relies on this without support.

    Most current frameworks of adversarial learning have the problem that the adversary bases its optimization on comparing data points instead of distributions or sets of points.

    “One of the problems of most current frameworks of adversarial learning is the fact that the adversary bases its optimization on comparing data points instead of distributions or, at least, of sets of points.”
4 of 4

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • There has been work proposing the use of an adversary as a pre-processing transformation process on the training data with similar objectives to transformation yet often moving towards a notion of censoring the training data with similar objectives to variable blinding.

    “There has also been work proposing the use of an adversary as a pre-processing transformation process on the training data (e.g.[1,99,162,206,234,299,300]) with similar objectives to transformation as discussed in subsection 4.4 yet often moving towards a notion of łcensoringž the training data with similar objectives to variable blinding as discussed in subsection 4.1.”

    From Fairness in machine learning: A survey (2024) · cites this paper as [1]

  • Fairlean implements several parity-based fairness measures and algorithms for binary classification and regression, as well as a dashboard to visualize disparity in accuracy and parity.

    “Fairlean 1 Implements several parity-based fairness measures and algorithms [1,2,6] for binary classiication and regression as well as a dashboard to visualize disparity in accuracy and parity.”

    From Fairness in machine learning: A survey (2024) · cites this paper as [1]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Adversary maximizes sensitive-attribute error instead of accuracy

    Minor

    Equation (9) maximizes the sensitive-attribute classification error over φ. Elsewhere, φ is said to maximize its accuracy at predicting the sensitive attribute; maximizing error is the opposite objective.

1 of 1

The citation lists haven’t been fetched yet

References 61 · Cited by 95

Research works printed but not linked: 8

  1. Agarwal, A.; Beygelzimer, A.; Dudik, M.; Langford, J.; and Wal- lach, H. 2018. A reductions approach to fair classification. ICML.
  2. Arjovsky, M.; Chintala, S.; and Bottou, L. 2017. Wasserstein gen- erative adversarial networks. ICML.
  3. Edwards, H., and Storkey, A. 2016. Censoring representations with an adversary. ICLR.
  4. Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde- Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y. 2014. Gen- erative adversarial nets. NIPS 2672-2680.
  5. Kusner, M.; Loftus, J.; Russell, C.; and Silva, R. 2017. Counter- factual fairness. NIPS.
  6. Metz, L.; Poole, B.; Pfau, D.; and Sohl-Dickstein, J. 2017. Un- rolled generative adversarial networks. ICLR.
  7. Mohri, M., and Afshin, R. 2008a. Rademacher complexity bounds for non-IID processes. NIPS.
  8. Salimans, T.; Goodfellow, I.; Zaremba, W.; Cheung, V.; and Rad- ford, A. 2016. Improved techniques for training GANs. NIPS.

Authors
Adel, T., Valera, I., Ghahramani, Z., & Weller, A.
Affiliations
  • University of Cambridge (GB)
  • Max Planck Institute for Intelligent Systems (DE)
Venue
Proceedings of the AAAI Conference on Artificial Intelligence
Published
2019-07-17
Volume
33
Issue
01
Pages
2412-2420
ISSN
  • 2159-5399 (ISSN-L)
  • 2374-3468
OpenAlex
W2904642422
Cited by
95
References
61
Citations by year
2026: 3 · 2025: 6 · 2024: 19 · 2023: 17 · 2022: 18 · 2021: 18 · 2020: 9 · 2019: 5
FWCI
13.02
Type
conference paper
Language
en
Open access
Locations
  • Proceedings of the AAAI Conference on Artificial Intelligence (publishedVersion)
  • AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI)) (submittedVersion)
  • ENLIGHTEN (Jurnal Bimbingan dan Konseling Islam) (submittedVersion, cc-by-sa)
  • Cambridge University Engineering Department Publications Database (submittedVersion)
Funders
  • Alan Turing Institute (EP/N510129/1., N510129)
  • Leverhulme Trust
  • Max-Planck-Gesellschaft
  • Engineering and Physical Sciences Research Council (N510129, EP/N510129/, EP/N510129/1, TU/B/000074, EPSRC grant EP/N510129/1)
Topics
  • Social Sciences › Safety Research › Ethics and Social Impacts of AI
  • Physical Sciences › Computer Science › Artificial Intelligence › Explainable Artificial Intelligence (XAI)
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Keywords
algorithmic fairness, fairness-accuracy trade-off, automated decision-making, sensitive attributes, adversarial optimization

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review