Manipulation-Proof Oblivious Audits against Deceptive Model Providers

2026-08-04

AI Summary

This work addresses the vulnerability of existing model auditing methods, which can be easily detected and manipulated by model providers—particularly in fairness assessments, where providers may infer sensitive attributes to fabricate compliant outputs. To counter this, the authors propose an oblivious auditing protocol based on Private Information Retrieval (PIR), enabling auditors to query models in a way that remains oblivious to the provider. The protocol compels the provider to label a large set of samples without knowing which subset will ultimately be used for auditing. Requiring no modifications to the model or inference pipeline, the approach is both efficient and low-overhead. Theoretically, it substantially increases the number of falsified samples needed to conceal unfair behavior. Empirical results demonstrate that the protocol effectively enhances the detection probability of manipulation across diverse auditing scenarios while reducing the auditor’s burden.

Abstract

Audits have emerged as a critical instrument for algorithmic governance, providing a mechanism for external scrutiny and governance of machine learning models. However, ensuring the integrity of such assessments remains a challenging issue. For instance in regulatory contexts, audits are typically declared or easily detected, thus enabling model providers to manipulate the process, whether intentionally or inadvertently. This vulnerability is particularly acute in the context of fairness evaluations, in which providers can often infer sensitive attributes and strategically equalize allocation rates between groups to satisfy fairness metrics. In this paper, we introduce a novel audit protocol designed to significantly increase the post-audit detectability of such manipulations by enabling the auditor to query the model in an oblivious manner. Our approach leverages a Private Information Retrieval mechanism to require the provider to label a large set of instances, while preventing it from knowing which subset will ultimately be used for the audit. The protocol is efficient, imposes minimal overhead on the auditor, and requires no modification to the audited model, its training procedure, or its inference pipeline. We provide theoretical guarantees showing that, under this protocol, a provider attempting to hide unfairness must falsify a significantly larger number of responses, thereby increasing both the difficulty and the likelihood of detection of manipulation. Experimental results across representative audit scenarios confirm the effectiveness and practicality of our approach.

Problem

• auditing
• manipulation
• fairness
• oblivious
• model governance

Innovation

• Oblivious Audit
• Manipulation-Proof
• Private Information Retrieval
• Fairness Evaluation
• Algorithmic Governance