{"id":"8de89457-29e9-4d18-9be8-1a1d7ad79dbd","arxiv_id":"2505.04796","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"A private labeled-data prior gives an auditor a calculable probability of catching a platform that manipulates its answers to appear fair, while any public prior can be exploited.","lead":"Auditors can prevent platforms from faking fair outcomes by using private labeled data as prior knowledge, while public priors are always gameable. The paper derives a detection-rate formula for such private priors and tests it on tabular and image benchmarks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 4.3's detection-rate formula has a sign error; the printed formula is not a probability (e.g., it exceeds 1 at n=2, delta/tau=0.5), and the proof's own decomposition requires a plus sign.","rationale":"The reader's conditional verdict is appropriate in spirit, but the most load-bearing problem is not chiefly the unverifiable uniform-prior assumption; it is an internal algebraic inconsistency in Theorem 4.3. The geometric setup and the cap/cylinder decomposition are sound, the corrected formula is a valid probability, and the boundary cases remain intact. Because the displayed theorem is the paper's central quantitative claim, it must be corrected before the paper can be accepted; after the sign fix, the prior-assumption concerns still justify conditional language. I therefore keep the verdict conditional but shift the stated condition from 'assume the prior is valid' to 'correct the theorem and recheck Corollary 4.4.' The experiments, which use a different detection score, do not test Theorem 4.3 and are not affected by this algebraic issue.","tokens_in":19492,"tokens_out":17977,"duration_ms":168074,"concrete_test":"Re-derive Puf for n=2, tau=1, delta=0.5 directly: Vball=pi, Vcylinder=sqrt(3), Vcap=pi/3 - sqrt(3)/4 ~ 0.614, so Puf = 1 - (sqrt(3) + 2*(pi/3 - sqrt(3)/4))/pi = 1/3 - sqrt(3)/(2*pi) ~ 0.058. Then evaluate Theorem 4.3 as printed: 1 - (4/pi)*(pi/6 - 3*sqrt(3)/8) = 1/3 + 3*sqrt(3)/(2*pi) ~ 1.160. Replacing the minus sign with a plus inside the bracket reproduces the geometric value. This single analytic check settles that the printed formula is false and identifies the required correction.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"Under the paper's own assumptions, the Appendix A proof defines V# = Vball - 2Vcap - Vcylinder. Dividing by Vball gives Puf = 1 - (1/W_n)[integral_0^{arccos(delta/tau)} sin^n(theta) dtheta + (delta/tau)(1 - delta^2/tau^2)^((n-1)/2)]. The displayed Theorem 4.3 has a minus sign between the two terms in the bracket. This is not a cosmetic typo: with n=2 and delta/tau=1/2, the printed formula evaluates to 1/3 + 3*sqrt(3)/(2*pi) ~ 1.160, which is impossible for a probability. Direct integration over the unit disk with F the x-axis and ha=(0,1/2) gives Puf = 1/3 - sqrt(3)/(2*pi) ~ 0.058, which matches the corrected plus sign. The boundary corollaries (delta=0 and delta=tau) are insensitive to the sign because the second term vanishes there, which makes the error easy to miss. Corollary 4.4's lower bound also relies on the erroneous sign. Thus, even granting the uniform-prior and exact ground-truth-center assumptions flagged by the reader, the central detection formula is algebraically incorrect for intermediate delta/tau, and the quantitative content of the theorem is unsupported as printed.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper formalizes the problem of audit manipulation (fairwashing) in black-box fairness audits. It introduces the notion of an auditor prior as a set of models the auditor considers expectable, proves that public priors cannot prevent manipulation (Theorem 3.2), and proposes a private dataset prior defined as a risk ball around the auditor's labeled data. The central theoretical result is Theorem 4.3, which gives a closed-form detection probability Puf under an assumed uniform distribution over the prior ball, together with boundary corollaries and a lower bound. The empirical section measures the concealable unfairness achievable by four manipulation methods on CelebA and ACSEmployment datasets. The main result as printed is, however, algebraically incorrect: the sign between the two terms inside the brackets in Theorem 4.3 is wrong, so the expression is not a valid probability for intermediate parameter values.","tokens_in":19802,"tokens_out":6227,"duration_ms":62178,"significance":"The paper addresses a timely and important problem: making fairness audits robust to strategic manipulation. If the central formula is corrected, the framework provides a computable detection probability for a private dataset prior, clean boundary cases (tau=delta gives detection probability one, delta=0 gives zero), and a useful formal separation between public and private priors. The experimental study of concealable unfairness across datasets and manipulation methods is a genuine contribution, and the authors state that their code is publicly available. However, the current Theorem 4.3 does not define a probability for intermediate delta/tau, and the erroneous sign also invalidates the claimed lower bound in Corollary 4.4. The paper's main theoretical contribution therefore needs correction before its conclusions can be accepted.","major_comments":[{"comment":"Theorem 4.3 (and the final line of its proof in Appendix A) contains a sign error. The proof correctly decomposes the volume as V# = Vball - 2Vcap - Vcylinder, which yields Puf = 1 - (1/W_n)[integral_0^{arccos(delta/tau)} sin^n(theta) dtheta + (delta/tau)(1 - delta^2/tau^2)^{(n-1)/2}]. The printed formula has a minus sign where the plus sign should be. This is not cosmetic: for n=2 and delta/tau=1/2, the printed expression evaluates to 1/3 + 3*sqrt(3)/(2*pi) ≈ 1.160, which is impossible for a probability, whereas the correct expression gives 1/3 - sqrt(3)/(2*pi) ≈ 0.058. Direct integration over the unit disk confirms the plus-sign version. Because the second term vanishes at delta=0 and delta=tau, the boundary corollaries A.4 and A.5 are unaffected, but the quantitative claim of Theorem 4.3 for intermediate delta/tau is false as printed.","section":"Corollary 4.4"},{"comment":"The theorem's probabilistic interpretation is conditional on two strong assumptions that are asserted rather than justified: (i) the uninformative prior, i.e., the platform model hp is uniformly distributed over the ball Ha, and (ii) the auditor's labeled dataset Da provides the exact ground-truth center ha of that ball, with no label noise or distribution shift. These assumptions are stated, but the takeaway in Section 4.3 that 'the auditor can always calculate a priori the probability to correctly detect a malicious platform' overstates what is actually derived: Theorem 4.3 computes a geometric volume ratio under the uniformity assumption, not an unconditional operational detection probability. I ask the authors to qualify this claim and, ideally, to include a sensitivity discussion or a simple non-uniform example showing how Puf would change.","section":"Section 4.3"},{"comment":"The experimental section does not test Theorem 4.3 directly: the detection score in Eq. (9) and the concealable unfairness in Eq. (8) are different objects from the Puf formula's volume ratio, and no experiment compares measured detection frequencies with the theorem's prediction. The experiments are informative about achievable manipulation in practice, but they do not validate the corrected formula. If the authors intend the experiments as an empirical check of the theory, this link should be made explicit; otherwise the paper should state more clearly that the theory and the experiments are complementary rather than confirmatory.","section":"Section 5.2"}],"minor_comments":[{"comment":"In Table 1, delta is described as the 'distance between the groundtruth and the set of expectable model'; it should be the distance between the ground truth and the set of fair models F, i.e., d(ha,F).","section":"Table 1"},{"comment":"The statement of Theorem 4.3 should explicitly define n = |S| and state the domain 0 <= delta <= tau; currently these are only mentioned in the surrounding text.","section":"Theorem 4.3"},{"comment":"In Eq. (7), the symbol tau is reused as the tolerable demographic-parity constraint, after tau was introduced in Definition 4.1 as the risk threshold for the dataset prior. Using a different symbol (e.g., epsilon) would avoid a notational collision.","section":"Equation (7)"},{"comment":"The appendix states that Ha is an open set, while Definition 4.1 gives Ha = {h : L(h,Da) < tau}, an open ball, yet Theorem 4.3 and the corollaries use volumes of the closed ball. The boundary has measure zero, so the distinction does not affect the results, but it should be stated explicitly to avoid confusion.","section":"Appendix A"},{"comment":"Figure 2 would be easier to interpret if the axes were labeled and the 'red area' were linked to the formula in Theorem 4.3; currently the geometric intuition is hard to map onto the algebra.","section":"Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The sign error in Theorem 4.3 is central and must be corrected; it is not a cosmetic typo because the printed expression is not a valid probability for intermediate delta/tau. With the sign fixed and the statements about the uniform-prior assumption suitably qualified, the paper could be suitable for publication. There are no concerns about attribution or novelty; the issue is purely technical."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the main theorem as printed is not a probability, and the error is not cosmetic. The framework is worth engaging with, but the central quantitative claim needs a substantive fix.\n\nWhat is new and good. The paper formalizes an auditor prior as a set of expectable models and distinguishes public versus private priors. Theorem 3.2, that a public prior lets a manipulative platform always pass by picking hm in Ha∩F, is simple but clean. The idea of using a labeled dataset to define Ha as a risk ball is a natural formalization, and the volume-ratio approach to detection is a genuine attempt to derive an operationally meaningful quantity. The experiments are honest: they show concealable unfairness can persist even at high audit budgets, and they do not oversell the theory. The code is released, and the empirical measurements are independent of the theorem's constants.\n\nThe soft spot that matters. Theorem 4.3 has a sign error. Under the paper's own decomposition, V# = Vball - 2Vcap - Vcylinder, the second term inside the bracket must be added, not subtracted. With n=2 and δ/τ=1/2 the printed formula yields 1.16, which is not a probability. The corrected formula gives about 0.058. The boundary cases δ=0 and δ=τ are unaffected, which explains how the error survived; but Corollary 4.4's lower bound is wrong too, since for the same parameters it claims Puf ≥ 0.55 while the true value is ~0.06. This is a load-bearing flaw, not a typo in an unimportant display.\n\nSecondary concerns. The reader flagged the uninformative uniform prior over the model ball and the assumption that the auditor's labels give the exact center ha. Those are real limitations and reduce the practical force of the result, but the paper acknowledges them. The sign error is more immediate and more serious.\n\nBottom line. For someone studying fairwashing and audit robustness, the framework, the impossibility result, and the empirical findings are useful. But as printed, Theorem 4.3 cannot be cited for its detection-rate numbers. The paper deserves a serious referee and likely a major revision. I would not accept it as-is; I would send it back with instructions to fix the algebra and re-derive the lower bound, and ideally to address the prior assumptions.","headline":"Theorem 4.3's detection-rate formula has a sign error that makes it exceed 1; the framework is promising, but the central quantitative claim is wrong as printed.","tokens_in":20333,"tokens_out":6006,"would_cite":false,"duration_ms":52830,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper establishes that an auditor with a private labeled dataset can compute the probability of detecting a platform that changes its answers to look fair.","keywords":["audit manipulation","fairwashing","fairness auditing","demographic parity","auditor prior","dataset prior","detection rate","black-box auditing"],"falsifier":"Train a cohort of honest models on a fixed task, choose an audit dataset $\\mathcal{D}_a$ and threshold $\\tau$, measure how often the optimal projection of an honest model lands outside $\\mathcal{H}_a$, and compare that empirical frequency with the closed-form $P_{uf}$ for several values of $n$, $\\delta$, and $\\tau$; a systematic gap would show that the uniform-prior assumption is not how real models distribute.","tokens_in":19316,"feed_emoji":"🕵️","tokens_out":8178,"duration_ms":73181,"temperature":0.7,"pith_summary":"The paper asks whether a fairness auditor can stop a platform from fairwashing, meaning changing its answers only during the audit to appear fair, and answers yes, on a condition. The condition is that the auditor holds a private labeled dataset and treats its ground-truth labels as the center of a dataset prior: the set of models whose squared loss on that dataset is below a threshold. Under that prior, the paper derives a closed-form probability for detecting the optimally manipulating platform, depending only on the distance from the ground truth to the fair set, the threshold, and the number of audit queries. It also proves that any public prior can always be gamed, so the prior must stay secret. The paper's message is that audit robustness comes less from clever querying and more from what the auditor knows before the audit begins.","feed_headline":"Private priors give audits a computable fairwashing-detection rate","feed_subtitle":"A secret labeled dataset lets auditors calculate how likely they are to catch a platform hiding bias.","key_machinery":"The load-bearing object is the dataset prior $\\mathcal{H}_a = \\{h : L(h, D_a) < \\tau\\}$, a ball in model space centered on the auditor's labeled data. The fair set $\\mathcal{F}$ is a hyperplane under demographic parity, and the manipulating platform's optimal move is the orthogonal projection $\\mathrm{proj}_{\\mathcal{F}}(h_p)$, which flips as few labels as possible. Detection fails exactly when that projection still lands inside the prior ball, so the detection probability is a volume ratio: the part of the ball whose projection exits the ball divided by the whole ball. Because the prior is assumed uniform, the ratio becomes the volume of a ball minus a cylinder and two spherical caps, evaluated in closed form with Wallis integrals.","core_discovery":"The central claim is Theorem 4.3: for binary classification, squared-error loss, and an auditor prior that is a ball of radius $\\tau$ around the labeled dataset's ground truth $h_a$, the probability that the auditor catches a platform whose optimal manipulation is the orthogonal projection of its honest model onto the demographic-parity hyperplane is $P_{uf} = 1 - \\frac{1}{W_n}\\left(\\int_0^{\\arccos(\\delta/\\tau)} \\sin^n(\\theta)\\,d\\theta - \\frac{\\delta}{\\tau}\\left(1-\\frac{\\delta^2}{\\tau^2}\\right)^{(n-1)/2}\\right)$. Here $\\delta = d(h_a, \\mathcal{F})$ is the distance from the ground truth to the fair set, $n$ is the audit budget, and $W_n$ is the $n$-term Wallis integral. Two boundary cases frame the result: a fair prior ($\\delta=0$) gives zero detection probability, while a tangent prior ($\\delta=\\tau$) gives detection probability one. The paper also proves a more general, distribution-free statement: detection probability equals the volume of the prior ball whose projection onto the fair set leaves the ball, normalized by the ball's volume.","pith_inferences":["Editorial extension: the same ball-hyperplane geometry should transfer to any fairness metric whose constraint set is a hyperplane or low-codimension subspace of model space, such as equality of opportunity; only the direction of the normal changes.","Editorial extension: if the uniform-prior assumption is doubtful, the formula can be re-read as the detection probability under the least-informative prior, and one could replace it with a Monte Carlo estimate obtained by sampling models that actually pass the task.","Editorial extension: an auditor could actively design the labeled dataset $\\mathcal{D}_a$ to push $\\delta$ upward, for instance by balancing the protected groups in the audit set, thereby raising the lower bound on $P_{uf}$ at the cost of making $\\delta$ itself an audited quantity.","Editorial extension: a direct empirical check is to train many honest models on one task, project each onto the fair set, and compare the measured detection frequency against the closed-form $P_{uf}$ across sample sizes and threshold values."],"forward_implications":["An auditor with a private labeled dataset can compute, before sending a single query, the probability of catching an optimally manipulating platform; no assumption about the platform's training pipeline is needed beyond the uniform prior.","Any prior the platform can reconstruct is worthless: with knowledge of $\\mathcal{H}_a$, the platform simply answers with a model in $\\mathcal{H}_a \\cap \\mathcal{F}$ and passes both the fairness and honesty checks.","A perfectly fair audit prior leaves the auditor blind ($P_{uf}=0$); to be effective the prior's ground truth must sit at positive distance from the fair set, and tightening $\\tau$ down to $\\delta$ gives detection probability one.","Detection thresholds can be calibrated from the error rate of state-of-the-art models on the task, and simulations on tabular and image data show that for easy tasks a larger audit budget drives concealable unfairness to zero, while for harder tasks some unfairness remains hidden."],"supporting_citations":[{"why":"Supplies the sample-space and probabilistic-classifier setup in which the fair set becomes a hyperplane, the geometric starting point of Theorem 4.3.","marker":"(Buyl & Bie, 2022)"},{"why":"Provides the hyperspherical-cap volume formula used to compute the intersection of the prior ball with the projection cylinder.","marker":"(Li, 2010)"},{"why":"Supplies the Gamma integral and Wallis constants that close the formula for $P_{uf}$.","marker":"(NIST, 2013)"},{"why":"The active-fairness-auditing baseline this work extends by adding an explicit auditor prior.","marker":"(Yan & Zhang, 2022)"},{"why":"Prior impossibility results on manipulation that Theorem 3.2 reinterprets as a public-prior failure.","marker":"(Godinot et al., 2024)"},{"why":"Gives the ROC mitigation procedure used as a manipulation strategy in the experiments.","marker":"(Kamiran et al., 2012)"},{"why":"Gives optimal label transport, one of the strongest empirical manipulation strategies.","marker":"(Jiang et al., 2019)"},{"why":"Gives the linear relaxation manipulation strategy tested in the experiments.","marker":"(Lohaus et al., 2020)"},{"why":"Provides the threshold manipulation baseline used to compare strategies.","marker":"(Hardt et al., 2016)"}],"fun_headline_variants":["Private priors yield audit catch probability formula","Audits beat manipulation when prior is private, not public","Prior ball geometry sets audit detection rate","From zero to unit detection: prior distance drives audit odds","Fairwashing detection: private prior gives a computable rate"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The formula's numbers are only objective probabilities if the honest platform model is uniformly distributed inside the prior ball and the auditor's labeled dataset gives the exact center of that ball; otherwise the detection rate is a conditional geometric ratio that depends on how models actually cluster.","fun_headline_variants_meta":{"raw":{"variants":["Private priors yield audit catch probability formula","Audits beat manipulation when prior is private, not public","Prior ball geometry sets audit detection rate","From zero to unit detection: prior distance drives audit odds","Fairwashing detection: private prior gives a computable rate"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000336,"raw_usage":{"total_tokens":1863,"prompt_tokens":947,"completion_tokens":916,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":563,"completion_tokens_details":{"reasoning_tokens":842}},"tokens_in":563,"tokens_out":916,"duration_ms":8978,"temperature":1.0,"reasoning_tokens":842,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:20:51.718026+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a cohort of honest models on a fixed task, choose an audit dataset $\\mathcal{D}_a$ and threshold $\\tau$, measure how often the optimal projection of an honest model lands outside $\\mathcal{H}_a$, and compare that empirical frequency with the closed-form $P_{uf}$ for several values of $n$, $\\delta$, and $\\tau$; a systematic gap would show that the uniform-prior assumption is not how real models distribute.","supporting_citations":[{"cited_title":"and Bie, T","cited_arxiv_id":null,"evidence_quote":"Supplies the sample-space and probabilistic-classifier setup in which the fair set becomes a hyperplane, the geometric starting point of Theorem 4.3."},{"cited_title":"Nist digital library of mathematical functions, 2013","cited_arxiv_id":null,"evidence_quote":"Supplies the Gamma integral and Wallis constants that close the formula for $P_{uf}$."},{"cited_title":"and Zhang, C","cited_arxiv_id":null,"evidence_quote":"The active-fairness-auditing baseline this work extends by adding an explicit auditor prior."},{"cited_title":"Decision theory for discrimination-aware classification","cited_arxiv_id":null,"evidence_quote":"Gives the ROC mitigation procedure used as a manipulation strategy in the experiments."},{"cited_title":"Wasserstein fair classification","cited_arxiv_id":null,"evidence_quote":"Gives optimal label transport, one of the strongest empirical manipulation strategies."},{"cited_title":"Too relaxed to be fair","cited_arxiv_id":null,"evidence_quote":"Gives the linear relaxation manipulation strategy tested in the experiments."},{"cited_title":"Equality of opportunity in supervised learning","cited_arxiv_id":null,"evidence_quote":"Provides the threshold manipulation baseline used to compare strategies."}],"review_version":1}