1 files changed, 30 insertions, 0 deletions
diff --git a/ACSAC/proofs/proof_advdebias.tex b/ACSAC/proofs/proof_advdebias.tex
new file mode 100644
index 0000000..06212a0
--- /dev/null
+++ b/ACSAC/proofs/proof_advdebias.tex
@@ -0,0 +1,30 @@
+Definition~\ref{def:dp} of \dempar can be written synthetically as the following property:
+$P_{\hat{Y},S}=P_{\hat{Y}}\otimes P_{S}$.
+Where $P_{\hat{Y}}\otimes P_{S}$ is the product measure defined as the unique measure on 
+$\mathcal{P}(\mathcal{Y})\times\mathcal{P}(\mathcal{S})$ such that
+$\forall y\in\mathcal{P}(\mathcal{Y})\forall s\in\mathcal{P}(\mathcal{S})\quad P_{\hat{Y}}\otimes P_{S}(y\times s) = P_{\hat{Y}}(y)P_{S}(s)$.
+This is equivalent to definition~\ref{def:dp} for binary labels and sensitive attribute but more general because when $\hat{Y}$ is not binary as in soft labels, this new definition is well defined.
+% We write formally 
+\begin{definition}
+\label{def:dps}
+    $\hat{Y}$ satisfies extended \dempar for $S$ if and only if: $P_{\hat{Y},S}=P_{\hat{Y}}\otimes P_{S}$.
+\end{definition}
+This definition is the same as the statistical parity introduced for fair regression~\cite{fairreg}. 
+Note that we can not derive a quantity similar to \demparlevel with this definition but this extended \dempar assures indistinguishably of the sensitive attribute when looking at the soft labels.
+We have the following theorem:
+\begin{theorem}\label{th:advdebias}
+    The following propositions are equivalent: ``$\hat{Y}_s$ is independent of $S$'' and ``Balanced accuracy of \aia in \ref{tm:soft} is $\frac{1}{2}$''
+\end{theorem}
+\begin{proof}
+Let's show that it is equivalent to say "all attack models have a balanced accuracy of 0.5" and "the target model satisfies extended demographic parity".
+{\footnotesize
+    \begin{align*}
+            &\forall a~P(\hat{Y}\in a^{-1}(\{0\})|S=0)+P(\hat{Y}\in a^{-1}(\{1\})|S=1) = 1\\
+            \Leftrightarrow&\forall a~P(\hat{Y}\in a^{-1}(\{0\})|S=0)=P(\hat{Y}\in a^{-1}(\{0\})|S=1)\\
+            \Leftrightarrow&\forall A~P(\hat{Y}\in A)|S=0)=P(\hat{Y}\in A|S=1) \\
+            \Leftrightarrow &P_{\hat{Y},S}=P_{\hat{Y}}\otimes P_{S}
+        \end{align*}
+        }
+\end{proof}
+
+%In conclusion, with extended \dempar we can not unconditionally bound the balanced accuracy of the attack without introducing distances in the space of distributions, but it gives us a condition to protect the sensitive attribute in case of an adversary gaining access to soft labels (AS). 
+\ No newline at end of file