Jul 2026· European Symposium on Security and Privacy· pp. 634-657· 0 citations· 46 references
Computer Science
TL;DR
The results demonstrate that fairness interventions do not uniformly increase privacy risk; their impact depends on model architecture, subgroup size, and mitigation strategy, and the first unified empirical framework to support such auditing in practice.
Abstract
Machine learning (ML) models deployed in sensitive domains such as healthcare, law enforcement, and finance must satisfy not only utility requirements but also fairness and privacy guarantees. While prior work has largely examined how privacy-preserving techniques affect fairness, the inverse question-how fairness-enhancing algorithms influence privacy leakage-remains underexplored. We present the first comprehensive study of how fairness interventions affect membership inference privacy risks at the subpopulation level. By adapting the Likelihood Ratio Attack (LiRA) for subgroup auditing, we uncover privacy disparities that aggregate evaluations obscure. We further analyze how Differential Privacy (DP) interacts with fairness-enhancing methods across different categories, showing that DP’s privacy benefits and utility costs are unevenly distributed across subpopulations. Our results demonstrate that fairness interventions do not uniformly increase privacy risk; their impact depends on model architecture, subgroup size, and mitigation strategy. These findings reveal that fairness, privacy, and utility must be jointly evaluated at the subpopulation level, and we introduce the first unified empirical framework to support such auditing in practice.
This work argues that privacy cost, the information leakage borne by each group, is itself a form of harm, and adopts a compensatory-fairness framework in which a group that involuntarily bears greater privacy exposure is owed proportionally greater benefit from the system.
It is shown, through a theoretical study of the dynamics and numerical experiments, that a finite privacy budget can outperform non-private estimation in the long term when the feedback loop between leakage and participation is sufficiently strong.
Uddalak Mukherjee, Edwige Cyffers, Y. Chevaleyre· 0 citations
The Consistency Radius is introduced, a metric that quantifies the maximum distribution shift under which an audit conclusion based on a third-party dataset remains consistent, and a convex relaxation-based optimization method to estimate the radius using only model responses over the audit dataset is proposed.
CoP is proposed, a coordinated perturbation mechanism designed to mitigate CIL in multidimensional data collection while preserving utility and significantly outperforms state-of-the-art LDP mechanisms in reducing disclosure while preserving analytical accuracy.
Sandaru Jayawardana, Ming Ding, Kanchana Thilakarathna· Proceedings on Privacy Enhan...· 0 citations
As regulatory requirements increasingly shape automated lending decisions, fairness remains a critical challenge in high-stakes domains, particularly credit scoring. Although artificial intelligence models can achieve strong predictive performance, they may also reproduce biased outcomes that reduce financial inclusion or transfer harm to overlooked protected groups. Existing fairness interventions commonly operate at a single stage of the decision-making pipeline, despite bias often propagating across representational and decision layers. This study proposes iCert-Fair, a two-layer framework for technical fairness assessment and harm recovery in credit scoring. The first layer adopts a fairness-through-explainability paradigm, using SHAP-based explanations to identify direct and proxy dependence on protected attributes and guide structural dataset repair, while the second layer applies targeted threshold-policy adjustments to recover residual harm while preserving decision utility. Experiments on the German and Taiwanese credit datasets show that fairness gains are model- and dataset-specific and may be collective, concentrated, transferred, or recovered unevenly across protected attributes. The direct comparison with representative pre-processing, in-processing, and post-processing methods revealed that baseline methods targeting one protected attribute at a time frequently transferred residual harm to other monitored attributes. In contrast, the fairness-focused recommendations generated by iCert-Fair achieved larger collective fairness improvements across all considered protected attributes while avoiding residual harm. These gains were obtained while preserving predictive utility on the German dataset and with utility degradation remaining below 5% across the evaluated performance metrics on the Taiwanese dataset, alongside consistently lower false-negative risk. The empirical findings support the use of complementary structural and policy-level interventions and demonstrate the importance of jointly evaluating aggregate disparity, worst-case attribute-level harm, cross-attribute transfer, and predictive utility.
Federated learning enables privacy-conscious collaboration for network intrusion detection without centralizing sensitive traffic data, yet its deployment in operational environments must simultaneously satisfy three competing requirements: formal differential privacy guaranties, tolerance to Byzantine-adversarial participants, and reliable detection coverage across severely imbalanced attack categories. Existing literature treats these properties as independently composable, an assumption that this paper challenges both theoretically and empirically. In this paper, we study how these requirements interact in class-imbalanced federated NIDS and introduce geometric indistinguishability as a conceptual lens for a regime in which privacy-induced dispersion in client updates can make minority-class signals harder for robust aggregation to preserve. Using UNSW-NB15 as a case study, we evaluate DP-SGD combined with coordinate-wise median under label-flip and model-poisoning attacks, with threat coverage assessed across attack categories. Our results provide initial evidence that the joint use of privacy noise and robust aggregation can disproportionately degrade detection of rare attacks relative to majority classes. We also show that part of the observed collapse under strong privacy can arise from training miscalibration, while a residual performance floor may remain for ultra-rare categories even after epsilon-dependent tuning. These findings motivate studying privacy, robustness, and rare-attack coverage jointly rather than as independently composable properties, and suggest that aggregation-aware modeling and sample-aware evaluation are promising directions for trustworthy federated NIDS.
Adrita Rahman Tory, Abm Shawkat Ali, M. Layek et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
