Fair Adversarial Networks
Description
Fair Adversarial Networks is a pre-processing method, proposed by Cevora (2020), that rewrites a dataset so that a protected characteristic such as race, sex or age is hard to predict from it, including through proxies such as postcode or occupation. It trains two neural networks against each other. An autoencoder (a network that learns to reproduce its input) rewrites each record while staying as close to the original as it can, and an adversary network tries to predict the protected characteristic from the rewritten records. The autoencoder is penalised both for changing the data and for the adversary's success, so over alternating rounds of training it strips out the information the adversary relies on and changes little else. The output is the rewritten dataset, which any downstream analysis or model can use unchanged, and in the paper success means a freshly trained adversary does no better than always guessing the most common category.
Example Use Cases
Fairness
A probation service's analytics team wants to model reoffending from defendant records in which race is encoded indirectly, through charge descriptions and neighbourhood. It runs the records through a Fair Adversarial Network before modelling and confirms that a freshly trained classifier predicts race from the transformed data no better than always guessing the most common group.
An HR analytics team at a courier company building an absenteeism model removes information about employees' age group from its personnel records, including through proxies such as length of service and family circumstances, so that the standard modelling tools its analysts already use can run on the transformed data unchanged.
A local education authority allocating support funding with a model of school performance data de-biases the data with respect to each school's majority ethnic composition before modelling, and keeps the adversary's chance-level result and the reconstruction error with the funding model's documentation as evidence of what was removed and how much the data changed.
Limitations
- No public implementation is known. The paper withholds the parts that make training practical (an approximation of how well a fully trained adversary would do, a stabilising mechanism and regularisers) as its company's intellectual property, saying only that standard approaches can replicate the result on a one-off basis with heavy tuning, and the company's web tool is no longer online. Adopting the method means reimplementing it from the paper.
- It removes every detectable relationship with the protected characteristic, including relationships that are legitimate or deliberately protective; the author notes it also removes positive discrimination. Where the characteristic carries legitimate information, such as sex in some clinical data, that information goes along with the bias, and the accuracy drops seen on the demonstration datasets cannot be split into bias removed and signal lost.
- Success is judged against one adversary: in the paper, a single-hidden-layer network trained from three random starts. A more capable model may still recover the characteristic, and the author states that residual discrimination is likely still present, so a chance-level adversary is weaker evidence than it appears. The paper reports no downstream accuracy or fairness results; the only application evidence is the same company's Rosa demonstration.
- Every variable in every record can be altered by the autoencoder, so the de-biased dataset no longer contains the original values. Individual records cannot be checked against source data, feature meanings drift, and any explanation of a downstream model refers to transformed features rather than to the applicant's actual postcode or income.
- Adversarial training is unstable and its settings have no principled choice: the weight balancing reconstruction against the adversary, the network architectures and the stopping point all need tuning per dataset. The paper keeps the lowest-loss state to guard against run-away training and describes its own convergence as fairly sub-optimal.
Resources
Research Papers
Fair Adversarial Networks
The influence of human judgement is ubiquitous in datasets used across the analytics industry, yet humans are known to be sub-optimal decision makers prone to various biases. Analysing biased datasets then leads to biased outcomes of the analysis. Bias by protected characteristics (e.g. race) is of particular interest as it may not only make the output of analytical process sub-optimal, but also illegal. Countering the bias by constraining the analytical outcomes to be fair is problematic because A) fairness lacks a universally accepted definition, while at the same time some definitions are mutually exclusive, and B) the use of optimisation constraints ensuring fairness is incompatible with most analytical pipelines. Both problems are solved by methods which remove bias from the data and returning an altered dataset. This approach aims to not only remove the actual bias variable (e.g. race), but also alter all proxy variables (e.g. postcode) so the bias variable is not detectable from the rest of the data. The advantage of using this approach is that the definition of fairness as a lack of detectable bias in the data (as opposed to the output of analysis) is universal and therefore solves problem (A). Furthermore, as the data is altered to remove bias the problem (B) disappears because the analytical pipelines can remain unchanged. This approach has been adopted by several technical solutions. None of them, however, seems to be satisfactory in terms of ability to remove multivariate, non-linear and non-binary biases. Therefore, in this paper I propose the concept of Fair Adversarial Networks as an easy-to-implement general method for removing bias from data. This paper demonstrates that Fair Adversarial Networks achieve this aim.