blob: 06212a00558c9165213c130be796284321129081 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
Definition~\ref{def:dp} of \dempar can be written synthetically as the following property:
$P_{\hat{Y},S}=P_{\hat{Y}}\otimes P_{S}$.
Where $P_{\hat{Y}}\otimes P_{S}$ is the product measure defined as the unique measure on
$\mathcal{P}(\mathcal{Y})\times\mathcal{P}(\mathcal{S})$ such that
$\forall y\in\mathcal{P}(\mathcal{Y})\forall s\in\mathcal{P}(\mathcal{S})\quad P_{\hat{Y}}\otimes P_{S}(y\times s) = P_{\hat{Y}}(y)P_{S}(s)$.
This is equivalent to definition~\ref{def:dp} for binary labels and sensitive attribute but more general because when $\hat{Y}$ is not binary as in soft labels, this new definition is well defined.
% We write formally
\begin{definition}
\label{def:dps}
$\hat{Y}$ satisfies extended \dempar for $S$ if and only if: $P_{\hat{Y},S}=P_{\hat{Y}}\otimes P_{S}$.
\end{definition}
This definition is the same as the statistical parity introduced for fair regression~\cite{fairreg}.
Note that we can not derive a quantity similar to \demparlevel with this definition but this extended \dempar assures indistinguishably of the sensitive attribute when looking at the soft labels.
We have the following theorem:
\begin{theorem}\label{th:advdebias}
The following propositions are equivalent: ``$\hat{Y}_s$ is independent of $S$'' and ``Balanced accuracy of \aia in \ref{tm:soft} is $\frac{1}{2}$''
\end{theorem}
\begin{proof}
Let's show that it is equivalent to say "all attack models have a balanced accuracy of 0.5" and "the target model satisfies extended demographic parity".
{\footnotesize
\begin{align*}
&\forall a~P(\hat{Y}\in a^{-1}(\{0\})|S=0)+P(\hat{Y}\in a^{-1}(\{1\})|S=1) = 1\\
\Leftrightarrow&\forall a~P(\hat{Y}\in a^{-1}(\{0\})|S=0)=P(\hat{Y}\in a^{-1}(\{0\})|S=1)\\
\Leftrightarrow&\forall A~P(\hat{Y}\in A)|S=0)=P(\hat{Y}\in A|S=1) \\
\Leftrightarrow &P_{\hat{Y},S}=P_{\hat{Y}}\otimes P_{S}
\end{align*}
}
\end{proof}
%In conclusion, with extended \dempar we can not unconditionally bound the balanced accuracy of the attack without introducing distances in the space of distributions, but it gives us a condition to protect the sensitive attribute in case of an adversary gaining access to soft labels (AS).
|
