{"id":"d1ff9ba7-198b-4d5e-937b-44ae1242b5d7","arxiv_id":"2501.04142","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"BiasGuard uses test-time augmentation with CTGAN to flip protected attributes and average predictions, reporting a 31% average reduction in Equalized Odds with a 0.09% accuracy drop on five tabular benchmarks.","lead":"BiasGuard is a post-processing fairness tool that, at test time, swaps protected attributes, generates synthetic look-alike samples with the opposite value using a conditional GAN, and averages the model's predictions to soften biased decisions. A generalist reader should care because it promises fairer outputs from already-deployed black-box ML systems without retraining, a common real-world constraint.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 31% EOD claim is not secure until the paper specifies and verifies that each per-PA CTGAN is fitted on training folds only; the manuscript gives CTGAN hyperparameters but never states the split used for generative-model training.","rationale":"The reader's weakest assumption — that CTGAN is trained on data excluding the evaluated test fold — is exactly the load-bearing condition for the empirical contribution. I re-checked the manuscript for any statement of the split or of the CTGAN training protocol: Section 4.3 gives only hyperparameters, Section 4.4 gives only dataset descriptions, and the 5-fold phrase in Section 5.6 is about timing. The methodological gap is therefore real and central. I do not see a reason to move beyond the reader's CONDITIONAL verdict: a code trace plus a rerun with train-only CTGAN fitting would either confirm the 31% claim or expose it as an artifact, and the manuscript should state this protocol explicitly. I also note that the comparison to Threshold Optimizer and Reject Option is plausible from Table 1 (BiasGuard is best on four of five datasets), so I did not treat the related-work comparison as the primary weakness. The lack of significance testing is a secondary concern that the reader already flagged.","tokens_in":13597,"tokens_out":9357,"duration_ms":91904,"concrete_test":"Clone https://github.com/nuritci/BiasGuard and trace where each per-PA CTGAN is fit relative to the train/test split (search for CTGAN fit calls and the cross-validation loop). Then rerun the LAW and COMPAS experiments in two modes: (a) the exact published code path, and (b) a modified path with each CTGAN fit only on the training folds, with the test fold never seen by the generator. Compare Table 1 EOD values. If mode (b) loses more than a small fraction of the reported 31% improvement, or differs materially from mode (a), the headline result is inflated by leakage; if the two modes match, the concern is resolved and only a protocol statement is needed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim — 31% average EOD reduction with 0.09% accuracy loss — depends entirely on the synthetic test-time augmentations. Section 4.3 reports CTGAN hyperparameters but not the data on which each per-PA generator is fit, and Section 4.4 describes datasets without a train/test split. The only mention of 5-fold evaluation is in Section 5.6, and there it is attached to inference-time measurement, not to the CTGAN fit. If a CTGAN is fit on the full dataset (or on the test fold), then nearest-neighbor selection in Algorithm 1 can pull synthetic samples that are near-duplicates of test instances, so the 'opposite-group' smoothing uses test-set structure and the reported EOD gains would not transfer to a production setting where only a generator fit before deployment is available. The issue is not merely stylistic: without this protocol, the headline number cannot be distinguished from a leakage artifact. Conversely, if the public code already fits each CTGAN inside a cross-validation loop on training folds only, the omission is purely a reporting gap; but the paper as written leaves the reproducibility of the main result unresolved.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes BiasGuard, a post-processing fairness method for production ML systems that uses Test-Time Augmentation (TTA) with Conditional GANs (CTGAN) to generate synthetic samples with the opposite protected attribute value, then aggregates the black-box classifier's predictions on the original and augmented samples. The authors report experiments on five tabular datasets (LAW, SURGICAL, RECRUIT, ADULT, COMPAS) claiming an average 31% reduction in Equalized Odds (EOD) with only a 0.09% accuracy drop relative to an unmitigated baseline, and better EOD than Threshold Optimizer and Reject Option post-processing in four of five datasets. The contribution is framed as a model-agnostic guardrail that requires no retraining and is suitable for deployed systems.","tokens_in":13845,"tokens_out":2484,"duration_ms":24044,"significance":"If the empirical claims hold, BiasGuard would be a practically relevant addition to the post-processing fairness toolbox: it operates on predictions only, is compatible with black-box models, and the reported fairness/accuracy trade-off is competitive with standard benchmarks. The paper also ships a public code repository and uses a simple, transparent aggregation rule. However, the central result currently rests on an underspecified evaluation protocol: the paper never states the train/test split or whether the per-protected-attribute CTGAN generators are fit on training folds only, which is the main load-bearing point for the 31% EOD claim. With that protocol gap closed and the statistical support strengthened, the contribution would be credible; as written, the evidence is suggestive rather than definitive.","major_comments":[{"comment":"The evaluation protocol is underspecified in a way that directly affects the headline claim. The paper states CTGAN hyperparameters (epochs, embedding_dim, generator/discriminator dims, learning rate) in Section 4.3, but never specifies the train/test split used for the Random Forest classifier or for fitting the per-PA CTGAN generators. The only mention of cross-validation is in Section 5.6, where 5-fold evaluation is attached to inference-time measurement, not to the CTGAN fit. If a CTGAN is fit on the full dataset or on the test fold, then the nearest-neighbor selection in Algorithm 1 (line 12) could draw synthetic samples that are near-duplicates of test instances, causing the reported EOD gain to be an artifact of test-set structure rather than a transferable production effect. Please specify the exact split, state that each per-PA CTGAN is trained on training folds only, and report the fold-level EOD and accuracy results.","section":"Section 4.3 and 4.4"},{"comment":"The function NearestNeighbors(x, CTGAN_PA, T) is never defined in the manuscript or in the pseudocode. It is not clear how the T synthetic samples are sampled from the CTGAN and selected for each test instance—what distance metric is used, how continuous and categorical features are scaled, and how the generated candidates are conditioned on the opposite protected attribute value. Because the aggregation in line 15 depends entirely on this selection, the method as described is not reproducible, and the paper's claimed fairness improvements cannot be independently verified from the text alone. Please provide a precise definition of the nearest-neighbor selection procedure and, ideally, pseudocode.","section":"Algorithm 1, line 12"},{"comment":"The statement in Section 5.4 that Threshold Optimizer and Reject Option worsened EOD on average (by 16% and 10%) is not supported by Table 1. For COMPAS, Threshold Optimizer achieves EOD=0.04415 versus the baseline's 0.13476, i.e., an improvement, and Reject Option also improves EOD on SURGICAL and COMPAS relative to baseline. Either the average is computed over the four datasets where both methods worsen (the text does not say this) or the computation is incorrect. This discrepancy undermines the comparative claim in Section 5.4 and the related Discussion paragraph, and should be corrected with a clear statement of the averaging procedure.","section":"Table 1 and Section 5.4"},{"comment":"No significance tests are reported, and the per-metric standard deviations in Table 1 are extremely small (e.g., 1e-5 for accuracy and EOD in LAW and ADULT), which is implausible unless the numbers are computed over a single fixed split or a very large number of repetitions. If the standard deviations come from a repeated sampling procedure, that procedure should be described. If they come from, say, bootstrap or fold variation, then the 31% average EOD reduction should be accompanied by a confidence interval or a paired test across folds. Without such support, the reader cannot distinguish the reported improvement from random variation, especially for ADULT where the DI standard deviations are approximately 0.7.","section":"Table 1 and Section 5.1"}],"minor_comments":[{"comment":"The citation refers to \"Canton et al.\" but the correct name is Caton et al. (reference [1]).","section":"Section 2.1"},{"comment":"The columns ΔFPR and ΔTPR are used but never defined in the table caption or in the metric definitions. Please define these quantities (presumably |FPR_privileged - FPR_unprivileged| and |TPR_privileged - TPR_unprivileged|) and explain their relation to the EOD formula in Eq. (3).","section":"Table 1"},{"comment":"The dataset name \"LA W (SEX)\" appears to have a typo; it should be \"LAW (SEX)\".","section":"Section 4.4"},{"comment":"The notation x^(i)_opposite ← x^(i)^{¬PA} in line 6 is ambiguous. It would be clearer to state that the protected attribute value is replaced by the opposite value while all other features remain unchanged.","section":"Algorithm 1"},{"comment":"The time complexity analysis assumes that all m test instances are augmented, but Algorithm 1 only augments the subset where the round(ŷ) comparison in line 11 detects a flip. The stated O(mT·L·D^2) is therefore an upper bound for the worst case; the expected cost in the reported experiments is lower. Please state this distinction explicitly to avoid confusion with Table 2.","section":"Section 3.3"}],"recommendation":"major_revision","confidential_remarks":"The core idea is interesting and the reported direction of the empirical results is consistent across datasets, but the evaluation protocol gap (CTGAN fitting on test-inclusive data) is exactly the kind of issue that can invalidate a post-processing fairness claim. I would encourage the editor to invite a revision that specifies the split, defines the NearestNeighbors procedure, and reports per-fold results. I do not see grounds for rejection if these points are addressable in revision; the paper's scope is appropriate for a machine learning journal or conference proceedings."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"BiasGuard is worth taking seriously. The core idea - generate synthetic samples with the flipped protected attribute at inference, detect label flips, and aggregate with nearest neighbors - is a new combination that I haven't seen in the fairness post-processing literature. It is model-agnostic, does not require retraining, and the paper ships public code and five datasets with standard baselines. The table shows consistent EOD improvements over the unmitigated baseline in all five experiments and over both post-processing baselines in four of five. On COMPAS, Threshold Optimizer clearly beats it, so the abstract's blanket \"outperforms\" is overbroad, but the empirical direction is still credible. The main soft spot is exactly what the stress-test note flags: the paper never says how each per-protected-attribute CTGAN is trained relative to the test set. Section 4.3 gives hyperparameters, Section 4.4 gives dataset sizes, and only Section 5.6 mentions 5-fold evaluation, attached to inference-time measurement. If a generator was fit on the full dataset or on the test fold, the synthetic nearest neighbors could be near-duplicates of test instances, and the reported EOD gains would be a leakage artifact rather than a deployable result. This is a reporting gap, not necessarily a fatal flaw - I didn't run the public code, and if it fits CTGAN inside a cross-validation loop on training folds only, the fix is a few sentences. But as written, the reproducibility of the headline number is unresolved. That alone justifies a conditional verdict. Two smaller issues. Section 5.4 claims both Threshold Optimizer and Reject Option worsened EOD relative to baseline on average; Table 1 shows Threshold Optimizer improves EOD on LAW, RECRUIT, and COMPAS, and COMPAS's improvement is large. That sentence is simply wrong. Also, the 31% average uses each dataset's best BiasGuard configuration, which is a reasonable sensitivity choice but should be stated. No significance tests are reported; the stds are tiny because they appear to be across CV folds, but the paper should at least report paired tests or confidence intervals. Who is this for: practitioners with deployed black-box binary classifiers, and fairness methodologists interested in test-time interventions. It does not reframe fairness theory, and the method is a straightforward application of known components, but it is a useful addition to the toolbox. I would send it to peer review rather than desk-reject: the idea is novel enough, the code is public, and the evaluation gap is fixable. The revision must specify the CTGAN training protocol, correct the Section 5.4 claim, and soften the comparative statements in the abstract. If the code already respects train/test separation, the paper could be acceptably revised in one round; if not, the empirical claims fall apart.","headline":"BiasGuard is a genuinely new combination - test-time augmentation with CTGAN for post-hoc fairness - with a promising empirical table, but the paper leaves the critical question of how the generators are trained relative to the test data unanswered, so the headline 31% EOD gain is not yet secure.","tokens_in":784,"tokens_out":2022,"would_cite":true,"duration_ms":38398,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Post-processing fairness tool cuts Equalized Odds 31% with only 0.09% accuracy cost.","keywords":["fairness in machine learning","post-processing bias mitigation","test-time augmentation","CTGAN","equalized odds","production ML systems","tabular data","model-agnostic fairness"],"falsifier":"Re-run the five experiments with CTGAN generators trained strictly on the training split, holding out the test fold for both the classifier and the generator, and compare Equalized Odds to the reported values; if the 31% average reduction shrinks or disappears under this clean split, the method's core claim is unsupported.","tokens_in":13417,"feed_emoji":"⚖️","tokens_out":4558,"duration_ms":39891,"temperature":0.7,"pith_summary":"BiasGuard is a post-processing method that makes already-deployed machine learning classifiers fairer without retraining or changing the model. For each test instance, it flips the protected attribute (for example sex or race) and asks the black-box model for a prediction on that hypothetical version; if the predicted label changes, it uses CTGAN to generate synthetic counterfactual samples from the opposite group, obtains the model's predictions on those, and averages them with the original prediction. On five tabular datasets, the authors report that this reduces Equalized Odds by 31% on average relative to the unmitigated baseline while lowering accuracy by only 0.09%, and that it outperforms two established post-processing baselines on fairness in four of five experiments. The paper's aim is to give production ML systems a 'fairness guardrail' that can be switched on at inference time when retraining is impractical.","feed_headline":"Fairness guardrail cuts Equalized Odds 31% with 0.09% accuracy cost","feed_subtitle":"BiasGuard recalibrates predictions at test time with AI-synthesized counterfactual samples, no retraining required.","key_machinery":"The machinery is a set of CTGAN generators, one per protected-attribute value, with CTGAN being a conditional generative adversarial network for tabular data. For each test instance, BiasGuard constructs an 'opposite' version by flipping only the protected attribute; if the classifier's rounded probabilities differ, it retrieves the $T$ nearest synthetic counterfactuals from the opposite group via nearest-neighbor search and feeds them through the black-box model. The final prediction uses the default aggregation $G(\\hat{y}^{(i)}, \\hat{Y}^{(i)}_{TTA}) = \\tfrac{1}{2}\\hat{y}^{(i)} + \\tfrac{1}{2} \\overline{\\hat{Y}^{(i)}_{TTA}}$, so only predictions that would flip under the attribute swap get recalibrated. This targeted trigger is what keeps the number of flips low and the accuracy cost small.","core_discovery":"The central discovery is that test-time augmentation with synthetic data generated conditional on inverted protected attributes can reduce Equalized Odds, a confusion-matrix fairness metric that measures true-positive-rate and false-positive-rate gaps between privileged and unprivileged groups, while barely moving accuracy. BiasGuard only intervenes on instances where flipping the protected attribute changes the model's discrete decision; on those instances it balances the original prediction with the average prediction over a small number of CTGAN-generated counterfactual samples. Across the LSAC law admissions, surgical outcome, Utrecht recruitment, Adult census income, and COMPAS recidivism datasets, the authors find that BiasGuard achieves an average Equalized Odds reduction of about 31% relative to the unmitigated baseline, with an average accuracy drop of 0.09%, and that it produces fewer prediction flips than Reject Option or Threshold Optimizer in four of five experiments.","pith_inferences":["A testable implication is that BiasGuard's gains depend on how well CTGAN models the conditional distribution of the opposite group; the paper never specifies a train/test split for the generators, so a clean reproduction should check whether the synthetic samples leak test-fold information.","The trigger condition, rounding the original and counterfactual predictions and comparing them, is essentially a counterfactual consistency check, which suggests the same aggregation idea could extend to other sensitive interventions such as recasting age or disability status.","Because BiasGuard only adjusts instances where the protected attribute flips the decision, its effect is bounded by the model's own sensitivity to that attribute; models that already ignore the attribute would receive no augmentation and no fairness change.","The reported 31% reduction is an average over datasets with very different baseline Equalized Odds values (from about 0.033 to 0.135), so the practical benefit is likely dataset-dependent and practitioners should tune the augmentation count per deployment."],"forward_implications":["Deployed black-box models can be made fairer at inference time without access to training data or model weights.","Equalized Odds drops by about 31% on average across five datasets while accuracy degrades by only 0.09%.","BiasGuard beats Reject Option and Threshold Optimizer on Equalized Odds in four of five experiments, and produces the fewest prediction flips in four of five.","The number of augmentations (2, 4, 6, or 8) can be tuned to trade latency against fairness, and even the smallest setting still yields substantial Equalized Odds gains.","Inference time increases roughly 11 to 31 times due to synthetic data generation, but the per-sample overhead remains sub-second."],"supporting_citations":[{"why":"Introduces CTGAN, the conditional generative model that produces the synthetic opposite-group samples at the core of BiasGuard.","marker":"[29]"},{"why":"Defines Equalized Odds, the primary fairness metric that BiasGuard is designed to reduce.","marker":"[10]"},{"why":"Source of the Reject Option and Threshold Optimizer post-processing baselines that BiasGuard is compared against.","marker":"[30]"},{"why":"Survey of bias mitigation methods supporting the paper's claim that post-processing is under-explored and that Random Forest is a common testbed classifier.","marker":"[5]"},{"why":"Survey of fairness datasets used to justify the selection of the five evaluation datasets.","marker":"[32]"}],"fun_headline_variants":["Test-time synthetic flips cut Equalized Odds 31%, accuracy barely moves","No retrain: CTGAN counterfactuals lower bias 31% at 0.09% accuracy cost","BiasGuard shields deployed ML: 31% less bias, tiny accuracy dip","Production fairness guardrail: 31% Equalized Odds cut, 0.09% accuracy hit","On-the-fly bias fix: 31% fairness gain, no model retraining"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"BiasGuard's fairness gains depend on CTGAN generators, trained once per protected-attribute value, producing synthetic samples that faithfully represent the opposite group's conditional distribution; the paper never specifies whether those generators were fit only on training data or whether the test fold was excluded, so if the synthetic samples leak test information the reported Equalized Odds improvements would not transfer to production.","fun_headline_variants_meta":{"raw":{"variants":["Test-time synthetic flips cut Equalized Odds 31%, accuracy barely moves","No retrain: CTGAN counterfactuals lower bias 31% at 0.09% accuracy cost","BiasGuard shields deployed ML: 31% less bias, tiny accuracy dip","Production fairness guardrail: 31% Equalized Odds cut, 0.09% accuracy hit","On-the-fly bias fix: 31% fairness gain, no model retraining"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000224,"raw_usage":{"total_tokens":1457,"prompt_tokens":938,"completion_tokens":519,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":554,"completion_tokens_details":{"reasoning_tokens":401}},"tokens_in":554,"tokens_out":519,"duration_ms":5231,"temperature":1.0,"reasoning_tokens":401,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:40:18.691449+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the five experiments with CTGAN generators trained strictly on the training split, holding out the test fold for both the classifier and the generator, and compare Equalized Odds to the reported values; if the 31% average reduction shrinks or disappears under this clean split, the method's core claim is unsupported.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces CTGAN, the conditional generative model that produces the synthetic opposite-group samples at the core of BiasGuard."},{"cited_title":"Hardt, E","cited_arxiv_id":null,"evidence_quote":"Defines Equalized Odds, the primary fairness metric that BiasGuard is designed to reduce."},{"cited_title":"Sikdar, F","cited_arxiv_id":null,"evidence_quote":"Source of the Reject Option and Threshold Optimizer post-processing baselines that BiasGuard is compared against."},{"cited_title":"Le Quy, A","cited_arxiv_id":null,"evidence_quote":"Survey of fairness datasets used to justify the selection of the five evaluation datasets."}],"review_version":1}