SF-PATE: Scalable, Fair, and Private Aggregation of Teacher Ensembles

1 Introduction

A number of decision processes with high societal impact, such as criminal assessment, lending, and hiring procedures, are increasingly being supported by machine-learning systems. A critical concern is that the learned models may report outcomes that are discriminatory against some demographic group, including gender, ethnicity, or age.

To ensure non-discrimination in learning tasks, knowledge of the sensitive attributes is essential. At the same time, legal and ethical requirements often prevent the use of this sensitive data. For example, U.S. law prevents using racial identifiers in the development of models for consumer lending or credit scoring, and the GDPR in the E.U. prevents the collection of protected user attributes. In this scenario, an important tension arise between (1) the demand for models to be non-discriminatory, (2) the requirement for such model to use the protected attribute during training, as adopted by common fairness models, and (3) the restriction on the data or protected attributes that can be used. There is thus a need to develop learning models that can both guarantee nondiscriminatory decisions and protect the privacy of the individuals' groups attributes.

To this end, this paper introduces a novel differentially private learning framework that satisfy group fairness while providing privacy of the protected attributes. The proposed framework, called Scalable, Fair, and Private Aggregation of Teacher Ensemble (SF-PATE) is inspired by the success of private teachers ensemble learning [Papernot et al., 2018]. These frameworks transfer the classification knowledge learned from a pretrained ensemble of models (called teachers) to a target model (called student) via a privacypreserving aggregation process. This paper exploits this key idea, but rather than transferring the classification capability of the models, it seeks to answer an important and unanswered question: can fairness properties of a model ensemble be transferred in a privacy-perserving way to a target model?

In addition to providing an affirmative answer to the question above, this paper makes four key contributions: (1) It proposes two flavors of SF-PATE that enforce fairness properties while protecting the demographic group attributes. (2) In addition to guaranteeing differential privacy, the paper provides an analysis on the fairness properties of SF-PATE and shows that unfairness can be bounded in many practical settings. (3) Importantly, SF-PATE decouples the implementation of fairness and privacy requirements and it can be systematically built on top of (non-private) fair models which are viewed as black-box. This engineering benefit is truly unique: it simplifies the development of private and fair models, and facilitates the adoption of new fairness metrics in privacypreserving ML, as the paper shows in the evaluation. (4) Evaluations on both tabular and image datasets show that SFPATE not only achieves better accuracy, privacy, and fairness tradeoffs with respect to the current state of the art, but it is also significantly faster. This aspect is important because the added computational cost of considering privacy and fairness in already computationally heavy models (e.g., large vision or language models) can make deployment more expensive and may discourage the release of ethical and trustworthy models. Supplemental material. [Tran et al., 2022] contains an extended version of this paper including proofs of all theorems, and additional experiments. All references to the appendix in this paper refer to such an extended version.

2 RelatedWork

The interconnection between privacy and fairness is receiving increasing attention and the reader is referred to [Fioretto et al., 2022] for an overview about the state of the field. Within this literature, a recent line of work observed that private models may have a negative impact towards fairness [Bagdasaryan et al., 2019; Pujol et al., 2020; Tran et al., 2021c; Tran et al., 2021a; Tran and Fioretto, 2023]. Building from these observations, [Ekstrand et al., 2018] raise questions about the tradeoff between privacy and fairness and, [Jagielski et al., 2019] and [Mozannar et al., 2020] proposed two simple, yet effective algorithms that satisfy (ϵ, δ) and ϵdifferential privacy, respectively, for equalized odds. In particular, state of the art model M, proposed in [Mozannar et al., 2020], adds calibrated noise to the group attributes using randomized response prior to use them as input to a fair classifier. [Xu et al., 2019] proposed a private and fair logistic regression model making use of the functional mechanism [Chaudhuri et al., 2011]. Finally, [Tran et al., 2021b] proposed PF-LD, a method to train a private classifier under differential privacy stochastic gradient descent [Abadi et al., 2016] while imposing fairness constraints. These constraints are imposed using a privacy-preserving extension of the Dual Lagrangian framework of [Fioretto et al., 2020]. Although this method was shown effective to balance privacy and fairness, it is computationally expensive.

In contrast, this work introduces a semi-supervised framework that relies on transferring privacy and fairness from a model ensemble to construct high-quality private and fair classifiers, while also being practical and scalable.

3 Problem Settings and Goals

The paper considers datasets D consisting of n individual data points (Xi,Ai, Yi), with i ∈ [n] drawn i.i.d. from an unknown distribution Π. Therein, Xi ∈ X is a non-sensitive feature vector, Ai ∈ A, where A = [m] (for some finite m) is a demographic group attribute and Yi ∈ Y is a class label. The goal is to learn a classifier Mθ : X → Y, where θ is a vector of real-valued parameters, that ensures a specified non-discriminatory notion with respect to A while guaranteeing the privacy of the group attribute A. The model quality is measured in terms of a non-negative, and assumed differentiable, loss function L : Y × Y → R+, and the problem is that of minimizing the empirical risk function (ERM):

The paper focuses on learning general classifiers, such as neural networks, that satisfy group fairness (as defined next) and protect the disclosure of the group attributes using the notion of differential privacy. Importantly, the paper assumes that the attribute A is not part of the model input during inference. This is crucial in the application of interest to this work as the protected attributes cannot be disclosed.

Fairness. This work constrains a classifier M to satisfy a given group fairness notion under a distribution over (X, A, Y ) for the protected attribute A as defined below.

Definition 1 (α-fairness). A model Mθ is α-fair w.r.t. a joint

wehre ξ(D, h, θ) is referred to as fairness violation.

The above compares a property for a group of individuals with respect to the whole population and quantifies its difference. Therein, h(Mθ(X), Y ) ∈ R, referred here as fairness function, defines a target group fairness notion while parameter α ∈ R+ represents the fairness violation.

The above capture an example class of group fairness notions, including Demographic parity, Equalized odds, and Accuracy parity. A comprehensive review of these fairness definitions is provided in Appendix A.

Differential Privacy. Differential Privacy (DP) [Dwork et al., 2006] is a strong privacy notion used to quantify and bound the privacy loss of an individual participation to a computation. Similarly to [Jagielski et al., 2019; Tran et al., 2021b], this work focuses on the instance where the protection is restricted to the group attributes only. A dataset D ∈D = (X×A×Y) of size n can be described as a pair (DP ,DS) where DP ∈ (X ×Y)n describes the public attributes and DS ∈An the group attributes. The privacy goal is to ensure that the output of the learning model does not significantly change when a single group attribute is changed.

The action of changing a single attribute from a dataset DS , resulting in a new dataset D′S , defines the notion of dataset adjacency. Two dataset DS and D′S ∈ An are said adjacent, denoted DS ∼ D′S , if they differ in at most a single entry (e.g., in one individual's group membership).

Definition 2 (Differential Privacy). A randomized mechanism M : D → R with domain D and range R is (ϵ, δ)- differentially private w.r.t. attribute A, if, for any dataset DP ∈ (X × Y)n , any two adjacent inputs DS,D′S ∈ An , and any subset of output responses R ⊆ R:

When δ = 0 the algorithm is said to satisfy ϵ-DP. Parameter ϵ > 0 describes the privacy loss of the algorithm, with values close to 0 denoting strong privacy, while parameter δ ∈ [0, 1] captures the probability of failure of the algorithm to satisfy ϵ-DP. The global sensitivity ∆f of a realvalued function f : D → Rk is defined as the maximum amount by which f changes in two adjacent inputs D and D′ : ∆f = maxD∼D′ ‖f(D) - f(D′ )‖. In particular, the Gaussian mechanism, defined by M(D) = f (D) + N (0, ∆2f σ2 ), where N(0, ∆2f σ2 ) is the Gaussian distribution with 0 mean and standard deviation ∆f σ, satisfies (ϵ, δ)-DP for δ > 4 5 exp(-(σϵ)2 /2) [Dwork et al., 2006].

4 Private &Fair Learning: Challenges

Constructing models enforcing both privacy and fairness brings with it three fundamental challenges:

• Scalability: When interpreted as constraints of the form (1), fairness properties can be explicitly imposed to problem (P). The resulting problem is typically non-convex,

but has been approached using a variety of solutions [Agarwal et al., 2018; Du et al., 2021; Kim et al., 2022; Shui et al., 2022]. Researchers have used adaptations of the DP-SGD algorithm [Abadi et al., 2016] to make these methods private. However, the use of sequential clipping operations and fairness constraints in DP-SGD leads to a slow training process, especially in large, overparametrized networks [Subramani et al., 2021]. Even further, the adoption of fairness constraints can also reduce the effectiveness of frameworks such as [Bradbury et al., 2018] and Opacus [Yousefpour et al., 2021], which use vectorization to speed up operations in DP-SGD (see [Tran et al., 2021b], for example).

• Privacy analysis: Analyzing the privacy of these methods is also challenging. Ensuring differential privacy through the appropriate amount of noise requires specialized solutions to assess the sensitivity of fairness constraints [Tran et al., 2021b]. These ad-hoc solutions make it difficult to systematically adopt these methods when new fairness notions are introduced or when better fair methods are developed.
• Poor accuracy/fairness tradeoffs: Finally, state-of-the-art methods for enforcing privacy in fair learning often sacrifice utility and/or fairness. For example, [Mozannar et al., 2020] perturbs group attributes in a pre-processing step and uses a non-private, fair ML model to post-process the private data. While this avoids the challenge of analyzing privacy, it has been shown to introduce a large amount of unnecessary noise, especially in settings with more than two groups [Tran et al., 2021b].

The approach proposed in this paper avoids these difficulties by providing a teachers ensemble model that (1) provides state-of-the-art accuracy, privacy, and fairness tradeoffs, (2) adds negligible computational cost to standard (non-private) training, and (3) directly exploits the existence of fair (nonprivate) algorithms. This last property significantly simplifies the engineering of fair and private models, facilitates the adoption of new fairness notions, and avoids the complications introduced by fairness constraints in the DP analysis.

5 The SF-PATE Framework

This section discusses two algorithms for transferring fairness considerations during the private learning process. Both algorithms rely on the presence of an ensemble of teacher models T = {M(i) }Ki=1 , with each M(i) trained on a nonoverlapping portion Di of the dataset D. This ensemble is used to transfer knowledge to a student model ¯Mθ : X →Y. The student model ¯M is trained using a subset ¯D ⊆ DP whose samples are randomly selected from the original training dataset but whose protected group attributes are unrevealed. As characteristic of ensemble models, the student's queries (data entries X ∈ ¯D) are processed by the teacher ensemble to predict the associated label Y through a voting process (which is elaborated below). This process allows the teachers knowledge to be transferred to the student model. The framework, and the two variants introduced next, are depicted schematically in Figure 1.

5.1 Transfer Learning with Fair Student

The first algorithm presented, called SFS-PATE, trains a student model with privacy-preserving group attributes chosen by an ensemble of teachers. Subscript S in the algorithm's name stands for "student" to emphasize that it is the student that enforces the fairness constraints during training.

The teachers ensemble T = {M(i) }Ki=1 is comprised of models M(i) : X → A. Its goal is to predict the group attributes from a sample features, but not the labels as classically done in classification tasks. Note that, importantly, the teacher models are standard classifiers: they are neither private nor fair. Their role is to transfer the information of the group attributes associated with the samples (Xi, Yi) ∈ ¯D provided by the student. The student model ¯Mθ : X → Y solves the following regularized constrained minimization:

where ˜ vA : AK → A is a private voting scheme returning the group attribute ˜ A chosen by the teachers ensemble:

with Gaussian noise of zero mean and standard deviation σ.

Problem (2) minimizes the standard empirical risk function (first component of (2a)), while encouraging the student model parameters θ to be close to the optimal, non-fair, parameters θ∗ (second component of (2a)). Note that θ∗ can be considered as the most accurate model since it solves problem (P) using all training data D. This model will not leak any private information w.r.t. the protected attributes A because it is trained using only features X and labels Y . The regularization parameter λ > 0 controls the trade-off between accuracy (when λ is large, the model is pushed towards θ∗ ) and fairness (when λ is small, the model prioritizes fairness violations). The fairness constraints expressed in Equation (2b) can be enforced through the adoption of off-the-shelf techniques and this paper relies on the use of the Lagrangian dual deep learning framework of [Fioretto et al., 2020]. This choice also allows us to make a fair comparison with state-ofthe-art PF-LD [Tran et al., 2021b] in our experiments.

SFS-PATE achieves (ϵ, δ)-DP by introducing calibrated noise on the counts of the protected attributes predicted by the teachers ensemble, as illustrated in Equation (3). The privacy analysis follows from [Papernot et al., 2018] with a few additional considerations and is provided in Appendix C.

Fairness analysis. The rest of this section discusses the fairness guarantees provided by SFS-PATE. The proofs of all theorems are reported in the Appendix B. Note that SFSPATE relies on a (non-private) fair classifier to train the student model. The performance of many such fair classifiers has been established in the literature. The key question however is to assess the impact of the privacy-preserving voting scheme on the fairness of the student model. The following theorem bounds the fairness violation of the student ¯Mθ w.r.t. (X, A, Y )-i.e., the original, non-noisy data-when the group attributeAand its privacy-preserving counterpart ˜ A are close enough to each other statistically, i.e.,

for events (X = x, Y = x) and value a. Note that, above, ηA characterizes the confidence of the noisy voting process. Small ηA values correspond to ensembles with high prediction agreement (e.g., many teachers predict the same output ˜ A). Conversely, large ηA values correspond to ensembles with low agreements, rendering the noisy votes less tolerant to noise. Additionally, this property specifies that the group attributes can be inferred from the sample features and labels, which is also what allows a notion of disparity to arise.

Theorem 1. Let ¯Mθ be α-fair w.r.t. (X, ˜ A, Y ) and h(·). Then, ¯Mθ is α′ -fair w.r.t. (X,A, Y ) and h(·) with:

where B is the supremum of the fairness function h(·).

Thus, this result help us quantifying the fairness guarantees attained on the original data (X,A, Y ) when only private noisy data (X, ˜ A, Y ) (as used by SFS-PATE) is used. Quantity Pr( ˜ A= a), however, may be difficult to compute, due to the noisy voting process. The next result allows us to compute α′ as a function of quantity Pr(A=a) only, which is independent from the noisy process and can be computed empirically from the data, in non-restrictive settings.

Corollary 1. When the probability of A belonging to any class a ∈ [m] is at least ηA (i.e., Pr (A = a) > ηA, ∀ a ∈ [m]), the fairness bound α′ can then be given by

The appendix in [Tran et al., 2022] also provides a result (described in Theorem 3) to compare the fairness guarantees achieved when the protected attributes ˜ A are computed using randomized response, which is the core process used by the baseline and state of the art model M [Mozannar et al., 2020]. This result shows that, when compared with the baseline model M, SFS -PATE makes the privacy-preserving group attributes ˜ A much closer to their original counterparts A under the same privacy budgets. This aspect is also further discussed in the experiments (as emphasized in Figure 3).

5.2 Transfer Learning with Fair Teachers

SFS-PATE transfers privacy-preserving group attributes from an ensemble of teachers to a fair student model. This section introduces an SF-PATE variant that transfer (non-private) fairness through the semi-supervised learning scheme. The proposed algorithm, called SFT -PATE, trains a student model from an ensemble of fair teacher models. Subscript T in the algorithm's name stands for "teachers" and emphasizes that the fairness constraints are enforced by the teachers and transferred to the student during training.

The teachers transfer fairness properties via model prediction to the student. The teachers ensemble T = {M(i) }Ki=1 is composed of pre-trained classifiersM(i) : X → Y that are non-private but fair over their training data Di. Each SFT - PATE teacher solves an empirical risk minimization problem subject to fairness constraint:

Similar to SFS-PATE, the implementation uses the Lagrangian dual method [Fioretto et al., 2020] to achieve this goal. This is again an important aspect of the SF-PATE framework since, by relying on black-box fair (and not private) algorithms, it decouples the dependency of developing joint private and fair analysis. The student model ¯Mθ : X → Y solves a standard empirical risk minimization:

where θ∗ represents the student model parameters obtained solving the standard classification task (without fairness considerations) (P) on ¯D and the private voting scheme ˜ vY : Y K →Y reports the label ˜ Y selected by the teachers:

SFT -PATE protects the privacy of the sensitive group information A and of the labels Y when λ=0. The reason comes from the fact that when λ=0, the student only utilize the private class label ˜ vY (T(X) but not the true label Y , implicitly encoded in θ∗ , to train the model. Thus, SFT -PATE can be adopted in contexts where both the protected group and the labels are sensitive information. Finally, note that the voting scheme above, emulates the GNMAX framework proposed in [Papernot et al., 2018], but the two have fundamentally different goals: GNMAX aims at protecting the participation of individuals into the training data, while SFT -PATE aims at privately transferring the fairness properties of the teachers ensemble to a student model.

SFT -PATE achieves (ϵ, δ)-DP by introducing calibrated noise on the counts of the predicted labels reported by the teachers ensemble (see Appendix C).

Fairness analysis. The next results considers how well the fairness properties of the ensemble are transferred to the student model. They provides theoretical insights on the potential fairness violations induced by the voting mechanism ˜ vY . For notational convenience, let B := supy∈Y,y′∈Y h(y, y′ ) denote the supremum of the fairness function h(·). Let Z be the random vector (M(1) θ (X), . . . ,M(K) θ (X), Y ) while Za the conditional random vector given the group label a ∈ [m], i.e., Za := (M(1) θ (X), . . . ,M(K) θ (X), Y ) | A = a.

The following theorem bounds the fairness violation of the voting mechanism ˜ vY (T) when the joint distributions of the teachers ensemble and labels Y are roughly similar across the different group classes. That is, for each group attribute a ∈ [m], the total variation distance between Z and Za is bounded from the above by ηY > 0, i.e.,

where Ω is used to denote the shared probability space.

Theorem 2. The voting mechanism ˜ vY (T) is α′ fair w.r.t. (X,A, Y ) and h(·) with α′ = ηY · B.

The result above shed light on the (non-restrictive) conditions required for the ensemble votes to transfer fairness knowledge accurately. The next corollary is a direct consequence of Theorem 2 and provides a sufficient condition for perfect fairness of the voting mechanism ˜ vY (T ).

Corollary 2. Suppose that the random vector Z is independent of A, i.e., {Za}a∈[m] and Z are identically distributed. Then, the voting mechanism ˜ vY (T) is perfectly fair (i.e., fairness violation α = 0) w.r.t. (X, A, Y ) and h(·).

These results are reassuring: informally speaking, they show that SFT -PATE provides fairness guarantees that are "inversely propertional" to the predictive impact of the protected attributes. The experimental results presented subsequently confirm that SFT -PATE achieves state-of-the-art tradeoffs among accuracy, privacy, and fairness.

6 Experiments

This section evaluates the performance of the SF-PATE algorithms against the prior approaches of [Tran et al., 2021b] and [Mozannar et al., 2020], denoted by PF-LD and M, respectively. They represents the state-of-the-art for learning private and fair classifiers in the context studied in this paper. In addition to assess the competitiveness of the proposed solutions, the evaluation focuses on two key aspects that set the proposed framework apart from existing methods. (1) It shows that SF-PATE can naturally handle new fairness notions, even when no viable privacy analysis exists about these notions. (2) It shows that SF-PATE has a low computational overhead compared to classical (non-private, non-fair) classifiers, rendering it a practical choice for the training of very large models. These two properties are unique to SF-PATE and make it to applicable to a broad class of challenging decision tasks.

Datasets and settings. The evaluation is conducted using four UCI tabular datasets: Bank, Parkinson, Income and Credit Card [Blake, 1998], and UTKFace [Hwang et al., 2020], a vision dataset. The latter is used to demonstrate the scalability of SF-PATE when trained on very large models. All experiments are repeated using 100 random seeds.

Models and hyperparameters. To ensure a fair comparison, the experimental analysis uses the same architectures, model initialization θ, and parameters for all models (including the baselines models PF-LD and M). For tabular datasets, the underlying classifier is a feedforward neural network with two hidden layers and nonlinear ReLU activations. The fair, non-private, classifiers adopted by the two SF-PATE variants implement a Lagrangian dual scheme [Fioretto et al., 2020], which is also the underlying scheme adopted by baseline models. For vision tasks on the UTK-Face dataset, the evaluation uses a Resnet 50 classifier. A more detailed description of these approaches, the settings adopted, hyperparameters optimization, and the datasets is deferred to Appendix D.

6.1 Accuracy, Privacy, and Fairness Trade-off

We now compare the accuracy, fairness, and privacy tradeoffs of the proposed model variants SFS- and SFT -PATE against the baseline models PF-LD and M on the tabular datasets. Figure 2(a) illustrates the accuracy (top subplots) and fairness violations ξ(θ, h, ¯D) (bottom subplots) when varying the privacy loss ϵ (x-axis). The fairness notion adopted is demographic parity and additional results on other fairness metrics and datasets are deferred to the Appendix (in [Tran et al., 2022]), showing similar trends. The figures clearly illustrate that both SF-PATE variants achieve better accuracy/fairness tradeoffs for various privacy parameters. The property of retaining high accuracy with low fairness violation is especially relevant in the tight privacy regime adopted (ϵ < 2). Observe that the figures y-axes have different scales.

First, notice that, consistently with previous work showing that teachers ensemble models can outperform DP-SGD

based models in terms of accuracy [Uniyal et al., 2021], all SF-PATE models typically outperform the FP-LD model based on DP-SGD. Remarkably, both SF-PATE variants also report lower fairness violations, for the fairness notions analyzed, indicating the strength of this approach.

Additionally, recall that both SFS-PATE and M generate privacy-preserving group features and input them to a fair model. However, in contrast to M, the model ensemble used in SFS-PATE exploits the relationship between the sample features X and its associated group information A to derive more accurate private group information ˜ A. This results in student models which are often more accurate, and fairer, than the baseline M. This result is further highlighted in Figure 3, which reports the expected accuracy of the private group attributes Pr( ˜ Ai = Ai) produced by SFS-PATE for different sizes K of the ensemble and compares it with that obtained by model M. Note the distinctive ability of the teachers ensemble to generate high-quality privacy-preserving group attributes ˜ A = ˜ vA(T(X)), especially under tight privacy regimes. Additionally, increasing the ensemble size also enables the teachers to transfer higher quality private group attributes, which is a fundamental aspect to ensure fairness.

The second SF-PATE variant, SFT -PATE, which operates by privately transferring the fairness knowledge from a teachers ensemble to a student, is found to always outperform both M and PF-LD on tabular datasets (see Figure 2(a) and Appendix D). Finally, the analysis also shows that the average accuracy of the SF-PATE models is within 2% of their nonprivate counterpart and brings up to an order of magnitude fairness violation gains over existing methods. This is significant due to the challenging nature of the tasks.

6.2 Handling NewGroup Fairness Notions

The next results consider the ability of SF-PATE to handle arbitrary fairness notions, even if a privacy analysis is missing, as long as a fair model can be derived. This feature stems from the use of black-box (non-private but fair) models in SFPATE. This is in sharp contrast with state-of-the-art model PF-LD, that requires the development of a privacy analysis for each fairness property of interest, in order to calibrate the amount of noise to apply in both primal and dual step. To demonstrate this benefit, this section introduces a new fairness notion, which generalizes demographic parity.

Definition 3 (Generalized demographic parity). requires the distribution over the predictions of M to be statistically independent of the protected group attribute A. That is, ∀a ∈ A, η ∈ [0, 1], Pr(M(X) ≥ η|A = a) = Pr(M(X) ≥ η).

This generalizes demographic parity, which states that Pr (Mθ(X) ≥ 0.5 | A = a) = Pr (Mθ(X) ≥ 0.5). Generalized demographic parity is useful in settings where the decision threshold (e.g., 0.5 above) might not be available at the training time. Matching the distribution of score functions (e.g., credit or income scores) among different groups attributes guarantees demographic parity fairness regardless of the decision threshold adopted. Such fairness constraint can be implemented by equalizing different order statistics of the score functions between group and population level:

The experiments H = 2 and the Lagrangian Dual method of [Fioretto et al., 2020] to enforce these constraints during training. Notice that it is highly non-trivial to derive a privacy analysis for such fairness notion-the PF-LD model only does so for H = 1, and, thus, not viable in this setting.

Figure 2(b) reports the accuracy and fairness violations obtained by the SF-PATE models and the baseline model M which adopts, as a post-processing step, a non-private but fair classifier. Fairness is evaluated in terms of the Wasserstein distance between the score functions of different groups. The smaller the distance the lower the fairness violation. The plots clearly illustrates the advantages of SF-PATE in terms of both accuracy and fairness when compared to model M. Remarkably, the fairness violations reported by SF-PATE are often significantly lower than those reported by model M for various privacy loss parameters ϵ.

These results are significant from an engineering standpoint: the development of private and fair analysis is complex and SF-PATE immediately lowers the accessibility barrier for non-privacy experts to develop private and fair ML models.

6.3 Computational Time and Scalability

The last results demonstrate another key benefits of SF-PATE: its ability to scale to large data and perform well on very deep networks. These experiments use a ResNet 50 (> 23M parameters) and PF-LD was unable to train even a single epoch (in 1h) due to its use of computational expensive per-sample gradient clipping performed during training. This renders such model unusable for many realistic settings. The comparison thus focuses on SF-PATE and M.

Figure 2(c) shows the accuracy and fairness trade-off for different privacy values ϵ. The models enforce accuracy parity and the figure shows that both versions of SF-PATE significantly improve accuracy compared to model M, while also maintaining similar or even reducing fairness violations. For additional results see Appendix D.

Table 1 shows the training time required for the algorithms to create a private model (with ϵ = 1.0) on the benchmarks set. Notice the significant training time differences across the models with SFS-PATE being up to three times faster than M and up to two orders of magnitude faster than PF-LD.

These results show that SF-PATE can become a practical tool for private and fair ML especially for large, overparametetrized models and under stringent privacy regimes.

6.4 Discussion and Limitations

While the previous section highlighted the advantages of the proposed framework over existing models, this section sheds light on key elements and usage guidelines for SFS- and SFT -PATE. While both SF-PATE variants rely on the same framework, they diverge in the fairness enforcing mechanism. SFS-PATE delegates this to its student while SFT -PATE to its teachers. Notice that, by training an ensemble of fair teachers, SFT -PATE is able to transfer fairness knowledge directly which, as observed in the experiments, often results in smaller fairness violations than those attained by SFS-PATE. This is notable, especially in the case of "complex" fairness constraints; i.e., when multiple concurrent constraints are to be enforced, as in the case of generalized demographic parity which imposes multiple order moments matching. Being treated as soft penalty functions, these constraints are added to the original empirical loss function (see Problem (2)). SFSPATE adds noise to each constraint terms (e.g., those represented by the constrains in (2b)) since the private voting scheme affects the accuracy of the constraints. In contrast, SFT -PATE adds noise only to the original loss term (e.g., the first term of (2a)) because the voting scheme acts on the labels Y and not the protected groups A and fairness is enforced by the teachers.

A shortcoming of the SFT -PATE algorithm, however, is that it has to enforce fairness in each teacher model. Thus, one has to ensure that enough data (with large enough representation from all the protected groups) is assigned to each teacher. On the other hand, by training a single fair model (the student) SFS-PATE avoids such potential issue.

It is also worth noting that a limitation of all ensemble models, including those proposed in this work, is the need to store a model for each of the K teachers. This, however, also represents an opportunity for future research to develop effective model storage and pruning techniques that minimize the loss in accuracy and fairness while retaining privacy.

7 Conclusions

This paper proposed a framework to train deep learning models that satisfy several notions of group fairness while ensuring that the model satisfies differential privacy for the protected attributes. The proposed framework, called Scalable, Fair, and Private Aggregation of Teacher Enseble (SF-PATE) transfer fairness knowledge learned from a pretrained ensemble of models to a target model via a privacy-preserving voting process. The paper analyzes the fairness properties of SF-PATE and shows that unfairness can be bounded in many practical settings. An important property of SF-PATE is to allow the adoption of black-box (non-private) fair models during the knowledge transfer process, which may simplify the development and boosts the adoption of new fairness metrics in privacy-preserving ML.

Finally, evaluation on both tabular and image datasets shows not only that SF-PATE achieves better accuracy, privacy, and fairness tradeoffs with respect to the current stateof-the-art, but it is also significantly faster. These properties render SF-PATE amenable to train large, overparameterized, models, that ensure privacy, accuracy, and fairness simultaneously, showing that it may become a practical tool for privacy-preserving and fair decision making.

Ethical Statement

This research aims to address the ethical concern of building models that do not discriminate against certain demographic groups by studying a model that protects the privacy of individuals' sensitive information while also allowing it to learn non-discriminatory predictors. The proposed model allows the use of existing fair models to create a privacy-preserving and fair model, and it is designed to be scalable and accurate for very large neural networks. The paper analyze the relationship between accuracy, privacy, and fairness and evaluate the benefits of the proposed model on various prediction tasks. Overall, this research aims to promote ethical and fair practices in data-driven processes by finding ways to balance privacy and fairness concerns.

Acknowledgements

This research is partially supported by NSF grants 2232054 and 2133169. Fioretto is also partially supported by an Amazon Research Award and a Google Research Scholar Award. Its views and conclusions are those of the authors only.