Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning

2026-08-06

AI Summary

This work addresses fairness poisoning attacks in collaborative machine learning, where malicious clients degrade group fairness while preserving model accuracy to evade accuracy-based defenses. To counter this threat, the authors propose Fairis, a server-side dynamic reweighting mechanism that adjusts client update weights based on their local fairness metrics—normalized using Equal Opportunity Difference—and integrates norm clipping with a safety parameter η for robust control. Fairis provides the first provable bound on the impact of fairness poisoning attacks and offers three theoretical guarantees: monotonic weight decay, demographic participation, and non-manipulability. It also resists collusion by a minority of adversarial clients. Experiments on the Taiwanese Credit dataset demonstrate that Fairis reduces the influence of stealthy attackers by 41%–54% while consistently assigning positive weights to honest clients, substantially outperforming existing approaches.

Abstract

Collaborative machine learning among financial institutions must be both group-fair and robust against deliberate adversarial manipulation. Existing fairness-aware aggregation methods remain formally vulnerable to fairness poisoning: a malicious client maximizing group disparity while preserving accuracy evades accuracy-based Byzantine defenses, and in our threat model FairFed's gap-based weighting can be gamed by an adversary who observes the global fairness score. We present Fairis, a server-side reweighting scheme in which each client's update receives the normalized weight $ω_k = \bar{w}_k / \sum_j \bar{w}_j$ built from the unnormalized score $\bar{w}_k = η- \mathcal{F}_k$, with $\mathcal{F}_k \in [0,1]$ the local Equal Opportunity Difference and $η> 1$ a security parameter. We prove three properties, Monotone Weight Reduction (MWR), Demographic Participation, and Non-Gamesmanship, extend MWR to colluding minority coalitions, and show that combining MWR with server-side norm clipping bounds the adversary's displacement of the global model by $ω_0 C$, strictly decreasing in its own reported disparity. Assuming honest score reporting, an assumption this paper does not discharge, Fairis is the only rule evaluated that guarantees every client strictly positive weight while provably reducing an adversary's weight monotonically in its bias; clipped FairFed can reach a lower weight but guarantees nothing and zeroes a client outright on Taiwan Credit. Against an adversary stealthy enough to evade accuracy-based defenses, within 0.04 accuracy of benign, Fairis cuts its weight by 41 to 54% below a size-blind control on Taiwan. On routine non-IID partitions no rule dominates, and a uniform-weighting ablation shows that containment tracks how far the adversary's score separates from the honest mean, providing none when the honest population is already unfair.

Problem

• fairness poisoning attacks
• collaborative machine learning
• group fairness
• adversarial manipulation
• Byzantine robustness

Innovation

• fairness-aware aggregation
• fairness poisoning attacks
• monotone weight reduction
• collaborative machine learning
• Equal Opportunity Difference