Differentially Private Fair Learning

Introduction

Large-scale algorithmic decision making, often driven by machine learning on consumer data, has increasingly run afoul of various social norms, laws and regulations. A prominent concern is when a learned model exhibits discrimination against some demographic group, perhaps based on race or gender. Concerns over such algorithmic discrimination have led to a recent flurry of research on fairness in machine learning, which includes both new tools and methods for designing fair models, and studies of the tradeoffs between predictive accuracy and fairness [ACM, 2019].

At the same time, both recent and longstanding laws and regulations often restrict the use of “sensitive” or protected attributes in algorithmic decision-making. U.S. law prevents the use of race in the development or deployment of consumer lending or credit scoring models, and recent provisions in the E.U. General Data Protection Regulation (GDPR) restrict or prevent even the collection of racial data for consumers. These two developments — the demand for non-discriminatory algorithms and models on the one hand, and the restriction on the collection or use of protected attributes on the other — present technical conundrums, since the most straightforward methods for ensuring fairness generally require knowing or using the attribute being protected. It seems difficult to guarantee that a trained model is not discriminating against (say) a racial group if we cannot even identify members of that group in the data.

A recent line of work [Veale and Binns, 2017, Kilbertus et al., 2018] made these cogent observations, and proposed an interesting solution employing the cryptographic tool of secure multiparty computation (commonly abbreviated MPC). In this model, we imagine a commercial entity with access to consumer data that excludes race, but this entity would like to build a predictive model for, say, commercial lending, under the constraint that the model be non-discriminatory by race with respect to some standard fairness notion (e.g. equality of false rejection rates). In order to do so, the company engages in MPC with a set of regulatory agencies, which are either trusted parties holding consumers’ race data [Veale and Binns, 2017], or hold among them a secret sharing of race data, provided by the consumers themselves [Kilbertus et al., 2018]. Together the company and the regulators apply standard fair machine learning techniques in a distributed fashion. In this way the company never directly accesses the race data, but still manages to produce a fair model, which is the output of the MPC. The guarantee provided by this solution is the standard one of MPC — namely, the company learns nothing more than whatever is implied by its own consumer data, and the fair model returned by the protocol.

Our point of departure stems from our assertion that MPC is the wrong guarantee to give if our motivation is ensuring that data about an individual’s race does not “leak” to the company via the model. In particular, MPC implies nothing about what individual information can already be inferred from the learned model itself. The guarantee we would prefer is that the company’s data and the fair model do not leak anything about an individual’s race beyond what can be inferred from “population level” correlations. That is, the fair model should not leak anything beyond inferences that could be carried out even if the individual in question had declined to provide her racial identity. This is exactly the type of promise made by differential privacy [Dwork et al., 2006b], but not by MPC.

The insufficiency of MPC. To emphasize the fact that concerns over leakage of protected attributes under the guarantee of MPC are more than hypothetical, we describe a natural example where this leakage would actually occur.

Example. An SVM model, trained in the standard way, is represented by the underlying support vectors, which are just data points from the training data. Thus, if race is a feature represented in the training data, an SVM model computed under MPC reveals the race of the individuals represented in the support vectors. This is the case even if race is uncorrelated with all other features and labels, in which case differential privacy would prevent such inferences. We note that there are differentially private implementations of SVMs.

The reader might object that, in this example, the algorithm is trained to use racial data at test time, and so the output of the algorithm is directly affected by race. But there are also examples in which the same problems with MPC can arise even when race is not an input to the learned model, and race is again uncorrelated with the company’s data. We also note that SVMs are just an extreme case of a learned model fitting, and thus potentially revealing, its training data. For example, points from the training set can also be recovered from trained neural networks [Song et al., 2017].

Our approach: differential privacy. These examples show that cryptographic approaches to “locking up” sensitive information during a training process are insufficient as a privacy mechanism — we need to explicitly reason about what can be inferred from the output of a learning algorithm, not simply say that we cannot learn more than such inferences. In this paper we thus instead consider the problem of designing fair learning algorithms that also promise differential privacy with respect to consumer race, and thus give strong guarantees about what can be inferred from the learned model.

We note that the guarantee of differential privacy is somewhat subtle, and does not promise that the company will be unable to infer race. For example, it might be that a feature that the company already has, such as zip codes, is perfectly correlated with race, and a computation that is differentially private might reveal this correlation. In this case, the company will be able to infer racial information about its customers. However, differential privacy prevents leakage of individual racial data beyond what can be inferred from population-level correlations.

Like [Veale and Binns, 2017], our approach can be viewed as a collaboration between a company holding non-sensitive consumer data and a regulator holding sensitive data. Our algorithms allow the regulator to build fair models from the combined data set (potentially also under MPC) in a way that ensures the company, or any other party with access to the model or its decisions, cannot infer the race of any consumer in the data much more accurately than they could do from population-level statistics alone. Thus, we comply with the spirit of laws and regulations asking that sensitive attributes not be leaked, while still allowing them to be used to enforce fairness.

We study the problem of learning classifiers from data with protected attributes. More specifically, we are given a class of classifiers $\mathcal{H}$ and we output a randomized classifier in $\Delta(\mathcal{H})$ (i.e. a distribution over $\mathcal{H}$). The training data consists of $m$ individual data points of the form $(X,A,Y)$. Here $X\in\mathcal{X}$ is the vector of unprotected attributes, $A\in\mathcal{A}$ is the protected attribute and $Y\in\{0,1\}$ is the binary label. As discussed above, our algorithms achieve three goals simultaneously:

Differential privacy: Our learning algorithms satisfy differential privacy [Dwork et al., 2006b] with respect to protected attributes. (They need not be differentially private with respect to the unprotected attributes $X$ — although sometimes are.)

Fairness: Our learning algorithms guarantee approximate notions of statistical fairness across the groups specified by the protected attribute. The particular statistical fairness notion we focus on is Equalized Odds [Hardt et al., 2016], which in the binary classification case reduces to asking that false positive rates and false negative rates be approximately equal, conditional on all values of the protected attribute (but our techniques apply to other notions of statistical fairness as well, including statistical parity).

Accuracy: Our output classifier has error rate comparable to non-private benchmarks in $\Delta(\mathcal{H})$ consistent with the fairness constraints.

We evaluate fairness and error as in-sample quantities. Out-of-sample generalization for both error and fairness follow from standard sample-complexity bounds in learning theory, and so we elide this complication for clarity (but see e.g. the treatment in [Kearns et al., 2018b] for formal generalization bounds).

We start with a simple extension of the post-processing approach of [Hardt et al., 2016]. Their algorithm starts with a possibly unfair classifier $\widehat{Y}$ and derives a fair classifier by mixing $\widehat{Y}$ with classifiers which are based on protected attributes. This involves solving a linear program which takes quantities $\hat{q}_{\hat{y}ay}$ as input. Here $\hat{q}_{\hat{y}ay}$ is the fraction of data points with $\widehat{Y}=\hat{y},A=a,Y=y$. To make this approach differentially private with respect to protected attributes, we start with $\widehat{Y}$ which is learned without using protected attributes and we use standard techniques to perturb the $\hat{q}_{\hat{y}ay}$’s before feeding them into the linear program, in a way that guarantees differential privacy. We analyze the additional error and fairness violation that results from the perturbation. Detailed results can be found in Section 3.

Although having the virtue of being exceedingly simple, this first approach has two significant drawbacks. First, even without privacy, this post-processing approach does not in general produce classifiers with error that is comparable to that of the best fair classifiers, and our privacy preserving modification inherits this limitation. Second, and often more importantly, this post-processing approach crucially requires that protected attributes can be used at test time, and this isn’t feasible (or legal) in certain applications. Even when it is, if racial information is held only by a regulator, although it may be feasible to train a model once using MPC, it probably is not feasible to make test-time decisions repeatedly using MPC.

We then consider the approach of [Agarwal et al., 2018], which we refer to it as in-processing (to distinguish it from post-processing). They give an oracle-efficient algorithm, which assumes access to a subroutine that can optimally solve classification problems absent a fairness constraint (in practice, and in our experiments, these “oracles” are implemented using simple learning heuristics). Their approach does not have either of the above drawbacks: it does not require that protected features be available at test time, and it is guaranteed to produce the approximately optimal fair classifier. The algorithm is correspondingly more complicated. The main idea of their approach (following the presentation of [Kearns et al., 2018b]) is to show that the optimal fair classifier can be found as the equilibrium of a zero-sum game between a “Learner” who selects classifiers in $\mathcal{H}$ and an “Auditor” who finds fairness violations. This equilibrium can be approximated by iterative play of the game, in which the Auditor plays exponentiated gradient descent and the Learner plays best responses (computed via an efficient cost-sensitive classification oracle). To make this approach private, we add Laplace noise to the gradients used by the Auditor and we let the Learner run the exponential mechanism (or some other private learning oracle) to compute approximate best responses. Our technical contribution is to show that the Learner and the Auditor still converge to an approximate equilibrium despite the noise introduced for privacy. Detailed results can be found in Section 4.

One of the most interesting aspects of our results is an inherent tradeoff that arises between privacy, accuracy, and fairness, that doesn’t arise when any two of these desiderata are considered alone. This manifests itself as the parameter “$B$” in our in-processing result (see Table 1) which mediates the tradeoff between error, fairness and privacy. This parameter also appears in the (non-private) algorithm of [Agarwal et al., 2018]—but there it serves only to mediate a tradeoff between fairness and running time. At a high level, the reason for this difference is that without the need for privacy, we can increase the number of iterations of the algorithm to decrease the error to any desired level. However, when we also need to protect privacy, there is an additional tradeoff, and increasing the number of iterations also requires increasing the scale of the gradient perturbations, which may not always decrease error.

This tradeoff exhibits an additional interesting feature. Recall that as we discussed above, the in-processing approach works even if we can not use protected attributes at test time. But if we are allowed to use protected attributes at test time, we are able to obtain a better tradeoff between these quantities — essentially eliminating the role of the variable $B$ that would otherwise mediate this tradeoff. We give details of this improvement in section 4.1 (for this result, we also need to relax the fairness requirement from Equalized Odds to Equalized False Positive Rates). The main step in the proof is to show that, for small constant $B$ and $\mathcal{H}$ containing certain “maximally discriminatory” classifiers which make decisions solely on the basis of group membership, we can give a better characterization of the Learner’s strategy at the approximate equilibrium of the zero-sum game.

Finally, we provide evidence that using protected attributes at test time is necessary for obtaining this better tradeoff. In Section 4.2, we consider the sensitivity of computing the error of the optimal classifier subject to fairness constraints. We show that this sensitivity can be substantially higher when the classifier cannot use protected attributes at test time, which shows that higher error must be introduced to estimate this error privately.

2 Related Work

The literature on algorithmic fairness is growing rapidly, and is by now far too extensive to exhaustively cover here. See [Chouldechova and Roth, 2018] for a recent survey. Our work builds directly on that of [Hardt et al., 2016], [Agarwal et al., 2018], and [Kearns et al., 2018b]. In particular, [Hardt et al., 2016] introduces the “equalized odds” definition that we take as our primary fairness goal, and gave a simple post-processing algorithm that we modify to make differentially private. [Agarwal et al., 2018] derives an “oracle efficient” algorithm which can optimally solve the fair empirical risk minimization problem (for a variety of statistical fairness constraints, including equalized odds) given oracles (implemented with heuristics) for the unconstrained learning problem. [Kearns et al., 2018b] generalize this algorithm to be able to handle infinitely many protected groups. We give a differentially private version of [Agarwal et al., 2018] as well.

Our paper is directly inspired by [Kilbertus et al., 2018], who study how to train fair machine learning models by encrypting sensitive attributes and applying secure multiparty computation (SMC). We share the goal of [Kilbertus et al., 2018]: we want to train fair classifiers without leaking information about an individual’s race through their participation in the training. Our starting point is the observation that differential privacy, rather than secure multiparty computation, is the right tool for this.

We use differential privacy [Dwork et al., 2006b] as our notion of individual privacy, which has become an influential “solution concept” for data privacy in the last decade. See [Dwork and Roth, 2014] for a survey. We make use of standard tools from this literature, including the Laplace mechanism [Dwork et al., 2006b], the exponential mechanism [McSherry and Talwar, 2007] and composition theorems [Dwork et al., 2006a, Dwork et al., 2010].

Model and Preliminaries

Suppose we are given a data set of $m$ individuals drawn $i.i.d.$ from an unknown distribution $\mathcal{P}$ where each individual is described by a tuple $(X,A,Y)$. $X\in\mathcal{X}$ forms a vector of unprotected attributes, $A\in\mathcal{A}$ is the protected attribute where $|\mathcal{A}|<\infty$, and $Y\in\mathcal{Y}$ is a binary label. Without loss of generality, we write $\mathcal{A}=\{0,1,\ldots,|\mathcal{A}|-1\}$ and let $\mathcal{Y}=\{0,1\}$. Let $\widehat{\mathcal{P}}$ denote the empirical distribution of the observed data. Our primary goal is to develop an algorithm to learn a (possibly randomized) fair classifier $\widehat{Y}$, with an algorithm that guarantees the privacy of the sensitive attributes $A$. By privacy, we mean differential privacy, and by fairness, we mean (approximate versions of) the Equalized Odds condition of [Hardt et al., 2016]. Both of these notions are parameterized: differential privacy has a parameter $\epsilon$, and the approximate fairness constraint is parameterized by $\gamma$. Our main interest is in characterizing the tradeoff between $\epsilon$, $\gamma$, and classification error.

We will use notation $\text{FP}_{a}(\widehat{Y})$ and $\text{TP}_{a}(\widehat{Y})$ to refer to the false and true positive rates of $\widehat{Y}$ on the subpopulation $\{A=a\}$.

$\widehat{\text{FP}}_{a}(\widehat{Y})$ and $\widehat{\text{TP}}_{a}(\widehat{Y})$ are used to refer to the empirical false and true positive rates. $\Delta\text{FP}_{a}(\widehat{Y})=|\text{FP}_{a}(\widehat{Y})-\text{FP}_{0}(\widehat{Y})|$ and $\Delta\text{TP}_{a}(\widehat{Y})=|\text{TP}_{a}(\widehat{Y})-\text{TP}_{0}(\widehat{Y})|$ are used to measure $\widehat{Y}$’s false and true positive rate discrepancies across groups. $\Delta\widehat{\text{FP}}_{a}(\widehat{Y})$ and $\Delta\widehat{\text{TP}}_{a}(\widehat{Y})$ are the corresponding empirical versions.

2 Fairness

We say a classifier $\widehat{Y}$ satisfies the $\gamma$-Equalized Odds condition with respect to the attribute $A$, if for all $a,a^{\prime}\in\mathcal{A}$, the false and true positive rates of $\widehat{Y}$ in the subpopulations $\{A=a\}$ and $\{A=a^{\prime}\}$ are within $\gamma$ of one another. In other words, for all $a,a^{\prime}\in\mathcal{A}$,

The above constraint involves quadratically many inequalities in $|\mathcal{A}|$. It will be more convenient to instead work with a slightly different formulation of $\gamma$-Equalized Odds in which we constrain the difference between false and true positive rates in the subpopulation $\{A=a\}$ and the corresponding rates for $\{A=0\}$ to be at most $\gamma$ for all $a\neq 0$. The choice of group as an anchor is arbitrary and without loss of generality. The result is a set of only linearly many constraints. For all $a\in\mathcal{A}$:

Since the distribution $\mathcal{P}$ is not known, we will work with empirical versions of the above quantities, in which all the probabilities will be taken with respect to the empirical distribution of the observed data $\widehat{\mathcal{P}}$. Since we will generally be dealing with this definition of fairness, we will use the shortened term “$\gamma$-fair” throughout the paper to refer to “$\gamma$-Equalized Odds fair”.

3 Differential Privacy

Let $\mathcal{D}$ be a data universe from which a database $D$ of size $m$ is drawn and let $M$ be an algorithm that takes the database $D$ as input and outputs $M(D)\in\mathcal{O}$. Informally speaking, differential privacy requires that the addition or removal of a single data entry should have little (distributional) effect on the output of the mechanism. In other words, for every pair of neighboring databases $D\sim D^{\prime}\in\mathcal{D}^{m}$ that differ in at most one entry, differential privacy requires that the distribution of $M(D)$ and $M(D^{\prime})$ are “close” to each other where closeness are measured by the privacy parameters $\epsilon$ and $\delta$.

A randomized algorithm $M:\mathcal{D}^{m}\to\mathcal{O}$ is said to be $(\epsilon,\delta)$-differentially private if for all pairs of neighboring databases $D,D^{\prime}\in\mathcal{D}^{m}$ and all $O\subseteq\mathcal{O}$,

Recall that our data universe is $\mathcal{D}=(\mathcal{X},\mathcal{A},\mathcal{Y})$, which will be convenient to partition as $(\mathcal{X},\mathcal{Y})\times\mathcal{A}$. Given a dataset $D$ of size $m$, we will write it as a pair $D=(D_{I},D_{S})$ where $D_{I}\in(\mathcal{X},\mathcal{Y})^{m}$ represents the insensitive attributes and $D_{S}\in\mathcal{A}^{m}$ represents the sensitive attributes. We will sometimes incidentally guarantee differential privacy over the entire data universe $\mathcal{D}$ (see Table 1), but our main goal will be to promise differential privacy only with respect to the sensitive attributes. Write $D_{S}\sim D^{\prime}_{S}$ to denote that $D_{S}$ and $D^{\prime}_{S}$ differ in exactly one coordinate (i.e. in one person’s group membership). An algorithm is $(\epsilon,\delta)$-differentially private in the sensitive attributes if for all $D_{I}\in(\mathcal{X},\mathcal{Y})^{m}$ and for all $D_{S}\sim D_{S}^{\prime}\in\mathcal{A}^{m}$ and for all $O\subseteq\mathcal{O}$, we have:

Differentially private mechanisms usually work by deliberately injecting perturbations into quantities computed from the sensitive data set, and used as part of the computation. The injected perturbation is sometimes “explicitly” in the form of a (zero-mean) noise sampled from a known distribution, say Laplace or Gaussian, where the scale of noise is calibrated to the sensitivity of the query function to the input data. However, in some other cases, the noise is “implicitly” injected by maintaining a distribution over a set of possible outcomes for the algorithm and outputting a sample from that distribution. The Laplace or Gaussian mechanisms which are two standard techniques to achieve differential privacy follow the former approach by adding Laplace or Gaussian noise of appropriate scale to the outcome of computation, respectively. The Exponential mechanism instead falls into the latter case and is often used when an object, say a classifier, with optimal utility is to be chosen privately. In the setting of this paper, to guarantee the privacy of the sensitive attribute $A$ in our algorithms, we will be using the Laplace and the Exponential Mechanisms which are briefly reviewed below. See [Dwork and Roth, 2014] for a more detailed discussion and analysis.

where $W_{i}$’s are $i.i.d.$ random variables drawn from $\text{Lap}\left(\Delta f/\epsilon\right)$.

Keep in mind that besides having privacy, we would like the privately computed query $\widetilde{f}_{\epsilon}(D)$ to have some reasonable accuracy. The following theorem which uses standard tail bounds for a Laplace random variable formalizes the tradeoff between privacy and accuracy for the Laplace mechanism.

The Laplace mechanism guarantees $\epsilon$-differential privacy and that with probability at least $1-\delta$,

We will discuss some important properties of differential privacy such as post-processing and Composition Theorems in Appendix A.

Differentially Private Fair Learning: Post-processing

In this section we will present our first differentially private fair learning algorithm which will be called DP-postprocessing. The DP-postprocessing algorithm is a private variant of the fair learning algorithm introduced in [Hardt et al., 2016] where decisions made by an arbitrary base classifier $\widehat{Y}$ have their false and true positive rates equalized across different groups $\{A=a\}$ in a post-processing step. Due to the desire for privacy of the sensitive attribute $A$, we assume the base classifier $\widehat{Y}$ is trained only on the unprotected attributes $X$ and that $A$ is used only for the post-processing step.

We emphasize that the accuracy guarantee stated in Theorem 3.1 is relative to the non-private post-processing algorithm, not relative to the optimal fair classifier. This is because the non-private post-processing algorithm itself has no such optimality guarantees: its main virtue is simplicity. In the next section, we analyze a more complicated algorithm that is competitive with the optimal fair classifier.

Differentially Private Fair Learning: In-processing

$\gamma$-fair ERM Problem $\displaystyle\ \ \ \min_{Q\,\in\,\Delta(\mathcal{H})}$ $\displaystyle\widehat{\text{err}}\,(Q)$ (2) s.t. $\forall\underset{a\neq 0}{a\in\mathcal{A}}$: $\displaystyle\Delta\widehat{\text{FP}}_{a}(Q)\leq\gamma$ $\displaystyle\Delta\widehat{\text{TP}}_{a}(Q)\leq\gamma$ In this section we will introduce our second differentially private fair learning algorithm which will be called DP-oracle-learner and is based on the algorithm presented in [Agarwal et al., 2018]. Essentially, [Agarwal et al., 2018] reduces the $\gamma$-fair learning problem (2) into the following Lagrangian min-max problem:

Here $\mathcal{H}$ is a given class of binary classifiers with $d_{\mathcal{H}}=VCD(\mathcal{H})<\infty$ and $\Delta(\mathcal{H})$ is the set of all randomized classifiers that can be obtained by functions in $\mathcal{H}$. $\widehat{\boldsymbol{r}}\,(Q)$ is a vector of fairness violations of the classifier $Q$ across groups, and $\boldsymbol{\lambda}\in\Lambda=\{\boldsymbol{\lambda}:\ ||\boldsymbol{\lambda}||_{1}\leq B\}$ is the dual variable where the bound $B$ is chosen to ensure convergence. In this work,

The method developed by [Agarwal et al., 2018], in the language of [Kearns et al., 2018b] gives a reduction from finding an optimal fair classifier to finding the equilibrium of a two-player zero-sum game played between a “Learner” ($Q$-player) who needs to solve an unconstrained learning problem (given access to an efficient cost-sensitive classification oracle) and an “Auditor” ($\boldsymbol{\lambda}$-player) who finds fairness violations. In an iterative framework, having the learner play its best response and the auditor play a no-regret learning algorithm (we use exponentiated gradient descent, or “multiplicative weights”) guarantees convergence of the average plays to the equilibrium ([Freund and Schapire, 1996]).

In Algorithm 3, to make the above approach differentially private, Laplace mechanism is used by the Auditor when computing the gradients and we let the Learner run the exponential mechanism (or some other private learning oracle) to compute approximate best responses. This is the differentially private equivalent of assuming access to a perfect oracle, as is done in [Agarwal et al., 2018, Kearns et al., 2018b]. In practice, the exponential mechanism would be substituted for a computationally efficient private learner with heuristic accuracy guarantees. Subroutine 2 reduces the Learner’s best response problem to privately solving a cost sensitive classification problem solved with a private oracle $\text{CSC}_{\epsilon^{\prime}}(\mathcal{H})$. Here we sketch the main steps of analyzing Algorithm 3. All the proofs of this section, as well as a brief review of [Agarwal et al., 2018]’s approach for the fair learning problem without privacy constraints, will appear in Appendix C.

We assume in this section that the VC dimension of $\mathcal{H}$ ($=d_{\mathcal{H}}$) is finite, in which case the set of strategies for the Learner reduces to $\Delta(\mathcal{H}(S))$, where $\mathcal{H}(S)$ is the set of all possible labellings induced on $S:=\{X_{i}\}_{i=1}^{m}$ by $\mathcal{H}$. In other words, $\mathcal{H}(S)=\left\{(h(X_{1}),\ldots,h(X_{m}))|h\in\mathcal{H}\right\}$ and recall that $|\mathcal{H}(S)|\leq O(m^{d_{\mathcal{H}}})$ by Sauer’s Lemma. Note that since the privacy of the protected attribute $A$ is required, we need $A$ to be excluded from the domain of functions in $\mathcal{H}$ (“$A$-blind classification”) and accordingly, from the set $S$. Because otherwise there might be some privacy loss of $A$ through using $\mathcal{H}(S)$ as the range of the exponential mechanism for the private Learner. This assumption is of course not necessary if one is willing to instead assume $|\mathcal{H}|<\infty$. We will have a discussion later where we state our guarantees assuming $|\mathcal{H}|<\infty$ instead of $d_{\mathcal{H}}<\infty$. Note that having $\mathcal{H}(S)$ as the range of the exponential mechanism used by the private Learner implies the privacy of the unprotected attributes $X$ is not guaranteed. However, in the more general setting where $|\mathcal{H}|<\infty$ is assumed, the privacy of the unprotected attributes comes for free as there will be no reduction of $\mathcal{H}$ to $\mathcal{H}(S)$.

We first bound the regret of the Learner and the Auditor in Lemma 4.1 and 4.2 by understanding how the introduced noise affect these regrets. Proofs of these Lemmas follow from the “sensitivity” and “accuracy” of the private players which are all stated and proved in Appendix C.2.

Suppose $\{\widetilde{h}_{t}\}_{t=1}^{T}$ is the sequence of best responses to $\{\widetilde{\boldsymbol{\lambda}}_{t}\}_{t=1}^{T}$ by the private Learner over $T$ rounds. We have that with probability at least $1-\beta/2$,

Let $\{\widetilde{\boldsymbol{\lambda}}_{t}\}_{t=1}^{T}$ be the sequence of exponentiated gradient descent plays (with learning rate $\eta$) by the private Auditor to given $\{\widetilde{h}_{t}\}_{t=1}^{T}$ of the private Learner over $T$ rounds. We have that with probability at least $1-\beta/2$,

Now in Theorem 4.3, given the regret bounds of Lemma 4.1 and 4.2, we can characterize the average plays of both players. This theorem provides a formal guarantee that the output $(\widetilde{Q},\widetilde{\boldsymbol{\lambda}})$ of Algorithm 3 forms a “$\nu$-approximate equilibrium” of the game between the Learner and the Auditor (where $\nu$ is specified in the theorem). This property essentially means neither play would gain more than $\nu$ if they palyed an strategy other than the ones output by the Algorithm.

Let $(\widetilde{Q},\widetilde{\boldsymbol{\lambda}})$ be the output of Algorithm 3. We have that with probability at least $1-\beta$, $(\widetilde{Q},\widetilde{\boldsymbol{\lambda}})$ is a $\nu$-approximate solution of the game, i.e.,

where we hide further logarithmic dependence on $m$, $\epsilon$, and $|\mathcal{A}|$ under the $\widetilde{O}$ notation.

We are now ready to conclude the DP-oracle-learner algorithm’s analysis with the main theorem of this subsection that provides high probability bounds on the accuracy and fairness violation of the output $\widetilde{Q}$ of Algorithm 3. These bounds can be viewed as revealing the inherent tradeoff between privacy of the algorithm and accuracy or fairness of the output classifier where a stronger privacy guarantee (i.e. smaller $\epsilon$ and $\delta$) will lead to weaker accuracy and fairness guarantees.

Let $(\widetilde{Q},\widetilde{\boldsymbol{\lambda}})$ be the output of Algorithm 3 and let $Q^{\star}$ be the solution to the non-private $\gamma$-fair ERM problem 2. We have that with probability at least $1-\beta$,

Notice the bounds stated above reveal a tradeoff between accuracy and fairness violation that we may control through the parameter $B$. As $B$ gets increased, the upper bound on error will get looser while the one on fairness violation gets tighter. We will consider a setting in the next subsection where we can remove this extra tradeoff and choose $B$ as small as possible — at the cost of requiring that the classifiers be able to use protected attributes at test time.

We assumed so far in this section that the protected attribute $A$ is not available to the classifiers in $\mathcal{H}$ (“$A$-blind” classification) and stated all our bounds in terms of $d_{\mathcal{H}}$. In the more general setting where classifiers in $\mathcal{H}$ could depend on $A$ (“$A$-aware” classification), similar results hold. The only change to make is to replace $\ln\,(m^{d_{\mathcal{H}}})$ with $\ln\,(|\mathcal{H}|)$ in Algorithm 3 (when computing the number of iterations $T$) and in the bounds. See Theorem 4.5 for this generalization.

Suppose $|\mathcal{H}|<\infty$ and let $(\widetilde{Q},\widetilde{\boldsymbol{\lambda}})$ be the output of Algorithm 3 that runs for

iterations, and let $Q^{\star}$ be the solution to the non-private $\gamma$-fair ERM problem 2. We have that with probability at least $1-\beta$,

In this subsection we show that if we only ask for equalized false positive rates (instead of equalized odds, which also requires equalized true positive rates), and moreover, if we assume $\mathcal{H}$ includes all “maximally discriminatory” classifiers (see Assumption 4.1), the fairness violation guarantees given in Theorem 4.5 can be improved. As a consequence, the tradeoff discussed in Remark 4.1 will be no longer an issue. Thus, in this subsection, we are interested in solving the $\gamma$-fair ERM Problem 4 which now only has false positive parity constraints.

Suppose $|\mathcal{H}|<\infty$, $B>|A|-1$, and let Assumption 4.1 hold. Let $(\widetilde{Q},\widetilde{\boldsymbol{\lambda}})$ be the output of Algorithm 3, and let $Q^{\star}$ be the solution to the $\gamma$-fair ERM problem 4. We have that with probability at least $1-\beta$,

As an immediate consequence of Theorem 4.6, we have the following Corollary where $B=|\mathcal{A}|$ can be chosen to get bounds which are now free of $B$.

Under assumptions stated in Theorem 4.6, one can choose $B=|\mathcal{A}|$ in Algorithm 3, in which case with probability at least $1-\beta$,

2 A Separation: A𝐴A-blind vs. A𝐴A-aware Classification

In this subsection we show that the sensitivity of the accuracy of the optimal classifier subject to fairness constraints can be substantially higher if it is prohibited from using sensitive attributes at test time. This implies that higher error must be introduced when estimating this accuracy subject to differential privacy. This shows a fundamental tension between the goals of trading off privacy and approximate equalized odds, with the goal of preventing disparate treatment. Given a data set $D$ of $m$ individuals, define $f(D)$ to be the optimal error rate in the $\gamma$-fair ERM problem 4 which is constrained to have a false positive rate disparity of at most $\gamma$.

Consider $\gamma>1/m$ and data sets with $\min_{a}\hat{q}_{a0}\geq C$ for some constant $C>0$. If $\mathcal{H}=\{h_{0},h_{U}\}$, the sensitivity of $f$ is $\Omega(1/(\gamma m))$. If the “maximally discriminatory” classifier $h_{R}$ and $h_{B}$ are included in $\mathcal{H}$ as well, i.e. $\mathcal{H}=\{h_{0},h_{U},h_{R},h_{B}\}$, the sensitivity of $f$ is $O(1/m)$.

Experimental Evaluation

As a proof of concept, we empirically evaluate our two algorithms on a common fairness benchmark dataset: the Communities and Crime datasetBriefly, each record in this dataset summarizes aggregate socioeconomic information about both the citizens and police force in a particular U.S. community, and the problem is to predict whether the community has a high rate of violent crime. from the UC Irvine Machine Learning Repository. We refer the reader to [Kearns et al., 2018a] for an outline of potential fairness concerns present in the dataset. We clean and preprocess the data identically to [Kearns et al., 2018a]. Our main experimental goal is to obtain, for both algorithms, the Pareto frontier of error and fairness violation tradeoffs for different levels of differential privacy. To elaborate, for a given setting of input parameters, we start with the target fairness violation bound $\gamma=0$ and then increase it over a rich pre-specified subset of $$while recording for each$\gamma$the error and the (realized) fairness violation of the classifier output by the algorithm. We take$\mathcal{H}$to be the class of linear threshold functions,$\beta=0.05$, and$\delta=10^{-7}$.

Logistic regression is used as the base classifier of the DP-postprocessing algorithm in our experiments. To implement the Learner’s cost-sensitive classification oracle used in the DP-oracle-learner algorithm, following [Kearns et al., 2018a], we build a regression-based linear predictor for each vector of costs ($C_{0}$ and $C_{1}$), and classify a point according to the lowest predicted cost. We made this private following the method of [Smith et al., 2017]: computing each regression as $(X^{T}X)^{-1}X^{T}C_{b}$, and adding appropriately scaled Laplace noise to both $X^{T}X$ and $X^{T}C_{b}$. Note when the sensitive attribute $A$ is not included in $X$ (the $A$-blind case, as in our experiments) noise need not be added to $X^{T}X$ as we only need to guarantee the privacy of $A$.

The theory is ambiguous in its predictions about which algorithm should perform better: the “privacy cost” is higher for the in-processing algorithm, but the benchmark that the post-processing algorithm competes with is weaker. We would generally expect therefore that on sufficiently large datasets, the in-processing algorithm would obtain better tradeoffs, but on small datasets, the post-processing algorithm would.

Our experimental results appear in Fig. 1. Indeed, on our relatively small dataset ($m\approx 2$K), the post-processing algorithm can obtain good tradeoffs between accuracy and fairness at meaningful levels of $\epsilon$, whereas the in-processing algorithm cannot. Nevertheless, we can empirically obtain the “shape” of the Pareto curve trading off accuracy and fairness for unreasonable levels of $\epsilon$ using our algorithm. This is still valuable, because the value of $\epsilon$ obtained by our algorithms predictably decreases as the dataset size $m$ increases without otherwise changing the dynamics of the algorithm. For example, if we “upsampled” our dataset by a factor of 10 (i.e. taking 10 copies of the dataset), the result would be a reasonably sized dataset of $m\approx 20$K. Our algorithm run on this upsampled dataset would obtain the same tradeoff curve but now with meaningful values of $\epsilon$. In the left panel of Fig. 1, $\epsilon$ is the actual privacy parameter used in the experiments; while $\epsilon^{\prime}$ is the value that the privacy parameter would take on the dataset that was upsampled by a factor of 10.

Recall that the post-processing approach requires the use of the protected attribute at test time, but the in-processing approach does not. Our results therefore suggest that the requirement that we not use the protected attribute at test time (i.e. that we be avoid “disparate treatment”) might be extremely burdensome if we also want the protections of differential privacy and have only small dataset sizes. In contrast, it can be overcome with the in-processing algorithm at larger dataset sizes.

Acknowledgements

AR is supported in part by NSF grants AF-1763307 and CNS-1253345. JU is supported by NSF grants CCF-1718088, CCF-1750640, and CNS-1816028, and a Google Faculty Research Award.

References

Appendix A Appendix for Models and Preliminaries: Differential Privacy

An important property of differential privacy is that it is robust to post-processing. The post-processing of an $(\epsilon,\delta)$-DP algorithm output remains $(\epsilon,\delta)$-DP.

Let $M:\mathcal{D}^{m}\to\mathcal{O}$ be a $(\epsilon,\delta)$-DP algorithm and let $f:\mathcal{O}\to\mathcal{R}$ be any randomized function. We have that the algorithm $f\,o\,M:\mathcal{D}^{m}\to\mathcal{R}$ is $(\epsilon,\delta)$-DP.

Another important property of differential privacy is that DP algorithms can be composed adaptively with a graceful degradation in their privacy parameters.

Let $M_{t}$ be an $(\epsilon_{t},\delta_{t})$-DP algorithm for $t\in[T]$. We have that the composition $M=(M_{1},\ldots,M_{T})$ is $(\epsilon,\delta)$-DP where $\epsilon=\sum_{t}\epsilon_{t}$ and $\delta=\sum_{t}\delta_{t}$.

Following the Composition Theorem A.2, if for instance, an iterative algorithm that runs in $T$ iterations is to be made private with target privacy parameters $\epsilon$ and $\delta=0$, each iteration must be made $\epsilon/T$-DP. This may lead to a huge amount of per iteration noise if $T$ is too large. The Advanced Composition Theorem A.3 instead allows the privacy parameter at each step to scale with $O(\epsilon/\sqrt{T})$.

Suppose $0<\epsilon<1$ and $\delta>0$ are target privacy parameters. Let $M_{t}$ be a $(\epsilon^{\prime},\delta^{\prime})$-DP algorithm for all $t\in[T]$. We have that the composition $M=(M_{1},\ldots,M_{T})$ is $(\epsilon,T\delta^{\prime}+\delta)$-DP where $\epsilon=2\epsilon^{\prime}\sqrt{2T\ln(1/\delta)}$.

Appendix B Appendix for DP Fair Learning: Post-processing

LP: Linear Program $\displaystyle\ \ \ \operatorname*{arg\,min}_{p}$ $\displaystyle\text{err}\,\left(\widehat{Y}_{p}\right)$ (5) s.t. $\forall\underset{a\neq 0}{a\in\mathcal{A}}$ $\displaystyle\Delta\text{FP}_{a}\left(\widehat{Y}_{p}\right)\leq\gamma$ $\displaystyle\Delta\text{TP}_{a}\left(\widehat{Y}_{p}\right)\leq\gamma$ $\displaystyle 0\leq p_{\hat{y}a}\leq 1\quad\forall\hat{y},a$ Since the true underlying distribution $\mathcal{P}$ is not known, in practice the empirical distribution $\widehat{\mathcal{P}}$ is used to estimate the quantities appearing in LP (5). Using simple probability techniques, one can expand the empirical quantities $\widehat{\text{err}}\,(\widehat{Y}_{p})$, $\Delta\widehat{\text{FP}}_{a}(\widehat{Y}_{p})$, and $\Delta\widehat{\text{TP}}_{a}(\widehat{Y}_{p})$ in a linear form in $p$ with coefficients being a function of $\hat{q}_{\hat{y}ay}$ and $\hat{q}_{ay}$ quantities (see $\widehat{\text{LP}}$ (6)).

B.2 Proof of Theorem 3.1

The proof of Theorem 3.1 relies on some facts which are stated here.

Suppose $\min\limits_{a,y}\{\hat{q}_{ay}\}>4\ln\left(4|\mathcal{A}|/\beta\right)/\left(m\,\epsilon\right)$. we have that with probability $\geq 1-\beta$,

$\left|\widetilde{\text{err}}\,\left(\widehat{Y}_{p}\right)-\widehat{\text{err}}\,\left(\widehat{Y}_{p}\right)\right|\leq\frac{12|\mathcal{A}|\ln\left(4|\mathcal{A}|/\beta\right)}{m\epsilon}\quad;\forall\,p.$

$\hat{p}^{\star}$, the optimal solution of $\widehat{\text{LP}}$ (6), is feasible in $\widetilde{\text{LP}}$ (1).

We will show that $\widehat{p}^{\star}$ satisfies the first constraint of $\widetilde{\text{LP}}$ (1) for all $a\in\mathcal{A}$. Satisfying the second constraint can be similarly shown and the third is trivial. We have that

by part 4 of this Lemma and the fact that $\left|\Delta\widehat{\text{FP}}_{a}(\widehat{Y}_{\widehat{p}^{\star}})\right|\leq\gamma$ (see $\widehat{\text{LP}}$ (6)).

Following Lemma B.2, with probability at least $1-\beta$

Appendix C Appendix for DP Fair Learning: In-processing

Suppose given a class of binary classifiers $\mathcal{H}$, the task is to find the optimal $\gamma$-fair classifier in $\Delta(\mathcal{H})$, where $\Delta(\mathcal{H})$ is the set of all randomized classifiers that can be obtained by functions in $\mathcal{H}$. [Agarwal et al., 2018] provided a reduction of the learning problem with only the fairness constraint to a two-player zero-sum game and introduced an algorithm that achieves the lowest empirical error. In this section we mainly discuss their reduction approach which forms the basis of our differentially private fair learning algorithm: DP-oracle-learner. Although [Agarwal et al., 2018] considers a general form of a constraint that captures many existing notions of fairness, in this paper, we focus on the Equalized Odds notion of fairness described in Definition 2.1. Our techniques, however, generalize beyond this. To begin with, the $\gamma$-fair classification task can be modeled as the constrained optimization problem 7.

$\gamma$-fair Learning Problem $\displaystyle\ \ \ \min_{Q\,\in\,\Delta(\mathcal{H})}$ $\displaystyle\text{err}\,(Q)$ (7) s.t. $\forall\underset{a\neq 0}{a\in\mathcal{A}}$: $\displaystyle\Delta\text{FP}_{a}(Q)\leq\gamma$ $\displaystyle\Delta\text{TP}_{a}(Q)\leq\gamma$ As the data generating distribution $\mathcal{P}$ is unknown, we will be dealing with the Fair Empirical Risk Minimization (ERM) problem 8. In this empirical version, all the probabilities and expectations are taken with respect to the empirical distribution of the data $\widehat{\mathcal{P}}$.

be the Lagrangian of the optimization problem. We therefore have that the Fair ERM Problem 8 is equivalent to

The above primal and dual problems can be shown to have solutions that coincide at a point $(Q^{\star},\boldsymbol{\lambda}^{\star})$ which is the saddle point of $L$. From a game theoretic perspective, the saddle point can be viewed as an equilibrium of a zero-sum game between a Learner ($Q$-player) and an Auditor ($\boldsymbol{\lambda}$-player) where $L(Q,\boldsymbol{\lambda})$ is how much the Learner must pay to the Auditor. Algorithm 5, developed by [Agarwal et al., 2018], proceeds iteratively according to a no-regret dynamic where in each iteration, the Learner plays the best response ($\text{BEST}_{h}$) to the given play of the Auditor and the Auditor plays exponentiated gradient descent. The average play of both players over $T$ rounds are then taken as the output of the algorithm, which can be shown to converge to the saddle point $(Q^{\star},\boldsymbol{\lambda}^{\star})$ ([Freund and Schapire, 1996]). [Agarwal et al., 2018] shows how $\text{BEST}_{h}$ can be solved efficiently having access to the cost-sensitive classification oracle for $\mathcal{H}$ ($\text{CSC}(\mathcal{H})$) and we have their reduction for our Equalized Odds notion of fairness written in Subroutine 4.

It is assumed that the proposed algorithm has access to $\text{CSC}\,(\mathcal{H})$ which is the cost-sensitive classification oracle for $\mathcal{H}$. This oracle takes as input a set of individual-level attributes and costs $\{X_{i},C_{i}^{0},C_{i}^{1}\}_{i=1}^{m}$, and outputs $\operatorname*{arg\,min}_{h\,\in\,\mathcal{H}}\sum_{i=1}^{m}h(X_{i})C_{i}^{1}+\left(1-h(X_{i})\right)C_{i}^{0}$. In practice, these oracles are implemented using learning heuristics.

Note that the Learner finds $\operatorname*{arg\,min}_{Q\in\Delta(\mathcal{H})}L(Q,\boldsymbol{\lambda})$ for a given $\boldsymbol{\lambda}$ of the Auditor and since the Lagrangian $L$ is linear in $Q$, the minimizer of $L(Q,\boldsymbol{\lambda})$ can be chosen to put all the probability mass on a single classifier $h\in\mathcal{H}$. Additionally, our reduction in Subroutine 4 looks different from the one derived in Example 4 of [Agarwal et al., 2018] since we have our Equalized Odds fairness constraints formulated a bit differently from how it is formulated in [Agarwal et al., 2018].

[Agarwal et al., 2018] shows for any $\nu>0$, and for appropriately chosen $\eta$ and $T$, Algorithm 5 under Assumption C.1 returns a pair $(\widehat{Q},\widehat{\boldsymbol{\lambda}})$ for which

that corresponds to a $\nu$-approximate equilibrium of the game and it implies neither player can gain more than $\nu$ by changing their strategy (see Theorem 1 of [Agarwal et al., 2018]). They further show that any $\nu$-approximate equilibrium of the game achieves an error close to the best error one would hope to get and the amount by which it violates the fairness constraints is reasonably small (see Theorem 2 of [Agarwal et al., 2018]).

C.2 Missing Lemmas and Proofs of Section 4

Recall that at round $t$, the private $\boldsymbol{\lambda}$-player is given some $h_{t}\in\mathcal{H}$ and wants to calculate

privately, where for all $a\in\mathcal{A}$, we have that

Having modified one of the records in $A\in\mathcal{A}^{m}$, say $A_{j}=a$ is changed to $A^{\prime}_{j}=a^{\prime}$ for some $j\in[m]$, $\hat{q}_{\hat{y}_{j}ay_{j}}$ will then decrease by $1/m$ and $\hat{q}_{\hat{y}^{\prime}a^{\prime}y_{j}}$ will increase by $1/m$ where $\hat{y}^{\prime}$ may or may not be equal to $\hat{y}_{j}$. Thus, depending on the value of $y_{j}$, it is then the case that

if $y_{j}=0$: $\widehat{\text{FP}}_{a}(h_{t})$ and $\widehat{\text{FP}}_{a^{\prime}}(h_{t})$ will change by at most $1/\left(\min_{a,y}\{\hat{q}_{ay}\}\,m-1\right)$.

if $y_{j}=1$: $\widehat{\text{TP}}_{a}(h_{t})$ and $\widehat{\text{TP}}_{a^{\prime}}(h_{t})$ will change by at most $1/\left(\min_{a,y}\{\hat{q}_{ay}\}\,m-1\right)$.

Therefore, since each $\widehat{\text{FP}}_{a}$ ($\widehat{\text{TP}}_{a}$) appears twice in $\widehat{\boldsymbol{r}}_{t}(h_{t})$ if $a\neq 0$ and $2(|\mathcal{A}|-1)$ times if $a=0$, we have that

At round $t$ of Algorithm 3, let $\widehat{\boldsymbol{r}}_{t}=\widetilde{\boldsymbol{r}}_{t}-\boldsymbol{W}_{t}$ be the noiseless version of $\widetilde{\boldsymbol{r}}_{t}$ and $h_{t}^{\star}$ be the classifier given by the noiseless subroutine $\text{BEST}_{h}(\widetilde{\boldsymbol{\lambda}}_{t})$. We have that

Results follow from Lemma C.1, Theorem 2.1 and Theorem 2.2 of this paper. Recall that $|\mathcal{H}(S)|\leq O(m^{d_{\mathcal{H}}})$ by Sauer’s Lemma. ∎

This result follows directly from the accuracy of the private $Q$-player given in Lemma C.2. ∎

Observe that with probability at least $1-\beta/2T$, $||\widetilde{\boldsymbol{r}}_{t}^{\prime}||_{\infty}=||\widetilde{\boldsymbol{r}}_{t}||_{\infty}\leq 2+\frac{8|\mathcal{A}|\sqrt{T\ln(1/\delta)}\ln(8T|\mathcal{A}|/\beta)}{\left(\min_{a,y}\{\hat{q}_{ay}\}\,m-1\right)\cdot\epsilon}$ (see Lemma C.2). Thus, by Corollary 2.14 of [Shalev-Shwartz, 2012], we have that with probability at least $1-\beta/2$, for any $\boldsymbol{\lambda}^{\prime}\in\Lambda^{\prime}$,

Consequently, by Equation 9, we have that with probability at least $1-\beta/2$, for any $\boldsymbol{\lambda}\in\Lambda$,

be the regret bounds of the private $Q$ and $\boldsymbol{\lambda}$ players respectively, and let $\nu:=R_{Q}+R_{\boldsymbol{\lambda}}$. We have that for any $Q\in\Delta(\mathcal{H}(S))$, with probability at least $1-\beta$,

Now for any $\boldsymbol{\lambda}\in\Lambda$, with probability at least $1-\beta$,

Therefore, with probability at least $1-\beta$,

Plugging in the proposed values of $T$ and $\eta$ in Algorithm 3 results in

where we hide further logarithmic dependence on $m$, $\epsilon$, and $|\mathcal{A}|$ under the $\widetilde{O}$ notation. ∎

The following two lemmas are taken from [Agarwal et al., 2018] and are used in the proof of Theorem 4.4 and Theorem 4.6.

Let $(\widetilde{Q},\widetilde{\boldsymbol{\lambda}})$ be any $\nu$-approximate solution of the game described in section 4,i.e.,

For any $Q$ satisfying the fairness constraints of the fair ERM problem, we have that

Let $(\widetilde{Q},\widetilde{\boldsymbol{\lambda}})$ be any $\nu$-approximate solution of the game described in section 4, i.e.,

and suppose the fairness constraints of the fair ERM problem are feasible. Then the distribution $\widetilde{Q}$ satisfies

The results follow from Theorem 4.3, Lemma C.3, and Lemma C.4. ∎

The stated bound on $\widehat{\text{err}}\,(\widetilde{Q})$ follows from Lemma C.3. Let’s now prove the bound on fairness violation. Let, for all $a\in\mathcal{A}$, $\beta_{a}:=(\widehat{\text{FP}}_{0}(\widetilde{Q})-\widehat{\text{FP}}_{a}(\widetilde{Q})-\gamma)_{+}$ and $\bar{\beta}_{a}:=(\widehat{\text{FP}}_{a}(\widetilde{Q})-\widehat{\text{FP}}_{0}(\widetilde{Q})-\gamma)_{+}$. Notice at most one of $\beta_{a}$ and $\bar{\beta}_{a}$ can be positive.

We are going to construct some deviating strategies: $Q$ and $\boldsymbol{\lambda}$. As shown in the previous subsection, we know $(\widetilde{Q},\widetilde{\boldsymbol{\lambda}})$ is a $\nu$-approximate equilibrium of the zero-sum game. It implies

Define $Q=\frac{1}{1+\sum_{a\in\mathcal{A}}(\beta_{a}+\bar{\beta}_{a})}(\widetilde{Q}+\sum_{a}\beta_{a}h_{a}+\hat{\beta}_{a}\hat{h}_{a})$. It is easy to see that, for all $a\in\mathcal{A}$,

Define $\boldsymbol{\lambda}$ to have $B$ in the coordinate which corresponds to $\arg\max_{a\in\mathcal{A}}|\widehat{\text{FP}}_{a}(\widetilde{Q})-\widehat{\text{FP}}_{0}(\widetilde{Q})|$ and 0 in other coordinates. Then we have

First consider the case where $\mathcal{H}=\{h_{0},h_{U}\}$. Choose data set $D$ of size $m$ as follows: $m/2$ individuals with $(A=R,X=V,Y=0)$; $m/4$ individuals with $(A=B,X=U,Y=1)$, $m(1-\gamma)/4$ individuals with $(A=B,X=V,Y=0)$ and $m\gamma/4$ individuals with $(A=B,X=U,Y=0)$. For this data set, it is easy to check that $h_{U}$ has error $\gamma/4$ and $h_{U}$ satisfies the fairness constraint. So $f(D)\leq\gamma/4$. Now consider $D$’s neighboring data set $D^{\prime}$ by changing one individual with $(A=B,X=V,Y=0)$ to $(A=B,X=U,Y=0)$. For $D^{\prime}$, the classifier which satisfies the fairness constraint and has the minimum error rate is $\frac{1}{4+\gamma m}(4h_{0}+\gamma mh_{U})$. Therefore

implying that $|f(D)-f(D^{\prime})|=\Omega(1/(\gamma m))$ and the sensitivity of $f$ is $\Omega(1/(\gamma m))$.

Now consider the case where $\mathcal{H}=\{h_{0},h_{U},h_{R},h_{B}\}$. It suffices to show that $f(D^{\prime})\leq f(D)+O(1/m)$ for any neighboring data sets $D$ and $D^{\prime}$. Let $Q^{*}$ be the classifier with minimum error rate on data set $D$. We have $f(D)=\widehat{\text{err}}\,(Q^{*},D)$ and we know $|\widehat{\text{FP}}_{R}(Q^{*},D)-\widehat{\text{FP}}_{B}(Q^{*},D)|\leq\gamma$ (we put $D$ into the arguments of $\widehat{\text{err}}\,$ and $\widehat{\text{FP}}$ as we are talking about two different data sets). For data set $D^{\prime}$, there are two cases.

The case when $|\widehat{\text{FP}}_{R}(Q^{*},D^{\prime})-\widehat{\text{FP}}_{B}(Q^{*},D^{\prime})|\leq\gamma$: In this case, we have

The case when $|\widehat{\text{FP}}_{R}(Q^{*},D^{\prime})-\widehat{\text{FP}}_{B}(Q^{*},D^{\prime})|>\gamma$: Wlog let’s assume $\widehat{\text{FP}}_{R}(Q^{*},D^{\prime})-\widehat{\text{FP}}_{B}(Q^{*},D^{\prime})>\gamma$. And let $\alpha=\widehat{\text{FP}}_{R}(Q^{*},D^{\prime})-\widehat{\text{FP}}_{B}(Q^{*},D^{\prime})-\gamma$. We know $\alpha>0$ and we also have

Now define $Q^{\prime}=\frac{1}{1+\gamma+\alpha}\left((1+\gamma)Q^{*}+\alpha h_{B}\right)$. We have