{"id":"ad107455-6ee1-4fc8-8a41-1aa40abb5827","arxiv_id":"2607.14607","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Fairness-enhancing algorithms do not uniformly change membership-inference privacy risk; the effect depends on model architecture, subgroup size, and mitigation strategy, and DP's utility costs fall unevenly across subgroups.","lead":"This paper studies whether algorithms that make machine-learning models fairer also make them leak more privacy, measuring results for demographic subgroups instead of whole datasets. It finds the answer depends on the model type, the subgroup's size, and the fairness method, so fairness, privacy, and utility need to be audited group by group.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Threshold-based attacks (OQTA/OTA) are fitted on the data they score and OTA's Eq. (16) computes TNR over non-Gj; this can inflate subgroup gaps and weakens cross-attack confirmation of the central claim.","rationale":"Good-faith reading: the paper is an extensive empirical audit; its central claim is that fairness interventions do not uniformly change MIA risk and that subgroup size is a persistent driver. The LiRA subgroup adaptation is the most credible piece if implemented correctly, and the released code, 20-run averaging, and error bars are real supporting evidence. However, the two threshold attacks are not merely conservative or approximate; they are internally inconsistent with the paper's own definitions. OQTA fits its threshold to the labels it later scores (Alg. 36), which is an optimistic in-sample estimate. OTA's Eq. (16) explicitly uses non-Gj data for TNR_Gj, contradicting Eq. (9). Both problems differentially affect small subgroups, so the headline qualitative pattern—smaller groups are more exposed—is at risk. This is the single most load-bearing concern because it undermines the cross-validation that the authors offer for the LiRA result. I agree with the reader's weakest assumption; the recommended verdict stays CONDITIONAL, pending a corrected threshold-selection protocol and re-analysis of the affected tables/figures.","tokens_in":34118,"tokens_out":6438,"duration_ms":73559,"concrete_test":"Re-run OQTA/OTA with thresholds selected on a separate calibration split (e.g., 50% of the target set) and then scored on the held-out half, or use nested cross-validation; recompute TNR_Gj over Gj∩test as in Eq. (9). Compare subgroup privacy gaps and mitigation rankings to Figures 1–2/Tables 2–3. If minority-majority gaps shrink to LiRA's level or the ranking of mitigators changes, the threshold-based metrics are the source of the reported disparities.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.2/Alg. 36 selects the per-subgroup OQTA threshold by maximizing balanced accuracy on the target split (lines 16–22) and then reports accuracy on that same split (lines 30–32). That makes the reported subgroup risks an optimistic in-sample fit: the attack's only parameter is chosen using test labels. The bias is larger for smaller subgroups because the target split has fewer samples, so the 'smaller subgroups are more exposed' pattern can be amplified. Section 4.3/Eq. (16) defines TNR_Gj with x' in non-Gj rather than x in Gj ∩ test as Definition (9) requires; the OTA subgroup risk is therefore not a subpopulation metric at all. Because the paper uses OQTA/OTA as the non-parametric cross-validation of LiRA (Section 4.1 'Robustness'), these flaws remove the independent support for the size-vulnerability claim and can change the reported ordering of mitigators. The LiRA-based results may still be correct, but the paper's cross-attack consistency argument is currently not valid.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents a broad empirical audit of how five fairness-enhancing algorithms (SYN, DIR, REW, EGR, CPP) affect membership-inference privacy risk at the subpopulation level, across six tabular datasets, five model families, and three attack paradigms (LiRA, OQTA, OTA). It introduces a subgroup-conditioned variant of LiRA and reports that fairness interventions do not uniformly increase privacy risk; the effects depend on model architecture, subgroup size, and mitigation strategy. The paper also studies DP-fairness interactions, reporting that DP suppresses membership-inference risk but imposes uneven utility losses across subgroups. A theoretical section attempts to explain the observed size-vulnerability pattern via influence functions.","tokens_in":34332,"tokens_out":7069,"duration_ms":69786,"significance":"If the empirical claims survive scrutiny, this would be a useful contribution to the fairness-privacy auditing literature: it broadens the evidence base to multiple fairness-intervention families, multiple model classes, and subpopulation-level metrics, and it ships code and experimental details. The paper also correctly identifies that aggregate privacy metrics can mask subgroup disparities. However, the two non-parametric attacks used as cross-validation of LiRA contain protocol errors that bias the reported subgroup risks and undermine the paper's claim that the size-vulnerability pattern is robust 'across all attacks.' The LiRA-based results may still be meaningful, but the manuscript's current cross-attack consistency argument is not valid, so the central claims require revision and re-analysis.","major_comments":[{"comment":"OQTA selects per-subgroup thresholds by maximizing accuracy on the target dataset itself: lines 16-22 evaluate candidate thresholds on LD(target)_{g,y}, and lines 30-32 compute the reported accuracy on the same TARGET_MEMBER ∪ TARGET_NON_MEMBER split. This is an in-sample, label-dependent selection of the attack's only parameter, producing an optimistic upper bound on attack success. The bias is stronger for smaller subgroups because the target split has fewer samples, so the reported pattern that smaller subgroups are more exposed can be amplified. Thresholds should be selected on a disjoint held-out set (or via cross-validation) and then evaluated on the target split.","section":"Section 4.2, Algorithm 36"},{"comment":"The OTA subgroup metric is not correctly defined. Definition (9) requires TNR_Gj = Pr(Attack says 'non-member' | x in Gj ∩ test), but Eq. (16) defines TNR_Gj as the average over x' in non-Gj. Thus PrivacyRisk(Gj) mixes the subgroup's TPR with the complement's TNR and is not a subpopulation-level risk. For a small subgroup, the TNR term is dominated by the large complement, so the reported OTA subgroup values do not measure the subgroup. This affects all OTA-based tables and figures, including Tables 6 and 10 and Figures 12-14.","section":"Section 4.3, Eq. (16)"},{"comment":"The manuscript explicitly uses OQTA and OTA as the non-parametric cross-validation of LiRA ('Robustness for Small Subpopulations'). Because both attacks have the protocol errors above, the consistency argument does not hold. The claim in Section 7.1 that the size-vulnerability pattern is 'robust across all attacks' and in Section 7.4 that it holds 'regardless of the mitigator or attack applied' is not supported by the current experiments. The LiRA-based results may still stand, but the paper needs to re-run corrected non-parametric attacks and re-evaluate the ordering of mitigators and the size-vulnerability claim.","section":"Section 4.1 and Section 7.1"},{"comment":"The theoretical characterization relies on the approximation H^{-1} ≈ (n/n_g) H_g^{-1}, stated to hold if groups have distinct feature distributions or group-specific parameters. Distinct feature distributions alone do not block-diagonalize the Hessian for a shared-parameter model such as logistic regression; cross-group Hessian blocks remain. The listed conditions are therefore not sufficient for the claimed O(1/n_g) scaling. Since Section 6 is presented as a 'theoretical explanation' of the empirical findings, it should either be proved under precise conditions or explicitly labeled a heuristic/intuition, not a derivation. This is not the main empirical claim, but it is a stated contribution and should be corrected.","section":"Section 6, Eq. (17)"}],"minor_comments":[{"comment":"The 'Privacy' columns contain values such as -0.75% and 6.10%, which are inconsistent with the definition of PrivacyRisk as a proper accuracy score in [0,1] and with the caption's statement that ✓ means 'privacy risk goes down to 50±2%'. Please clarify whether these entries are risk differences, raw risks, or something else, and ensure the table headers and captions match the displayed numbers.","section":"Tables 2-3"},{"comment":"The pseudocode says 'Compute accuracy on LD(target)' while Section 4.2 says the threshold maximizes balanced accuracy. Align the pseudocode with the prose, and specify whether 'accuracy' means balanced accuracy or plain accuracy.","section":"Algorithm 36, line 17"},{"comment":"Several passages contain unreadable font artifacts (e.g., '/uni00000032/...' sequences) in the full text, particularly in Section 6 and figure captions. These artifacts must be fixed in the source so that equations and captions are legible.","section":"Section 6 and Appendix text"},{"comment":"The text says neural networks use 'two hidden layers for the Law dataset,' but Section 5 lists both Law School Admissions and Law School GPA. Specify which dataset or clarify the architecture by dataset.","section":"Section 5, Models"}],"recommendation":"major_revision","confidential_remarks":"The paper has a useful empirical scope, but the two threshold-based attack implementations contain errors that directly affect the cross-attack robustness argument and the headline size-vulnerability claim. The LiRA results may survive, but the authors need to rerun OQTA with proper held-out threshold selection and fix the OTA subgroup TNR definition before the central claims can be accepted. The theoretical section should also be reframed as heuristic or made rigorous. I recommend major revision, not rejection, because the issues are concrete and fixable within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hey —\n\nQuick take: this is a genuinely broad empirical audit, and the LiRA-based subgroup results are worth taking seriously. But the paper leans on OQTA/OTA as independent cross-validation, and those attacks are not currently trustworthy. The OQTA thresholds are selected by maximizing accuracy on the target set that is later scored (Algorithm 36), which makes the reported risk an optimistic in-sample fit; the bias is worse for small subgroups, so the size-vulnerability pattern can be amplified. And Equation (16) defines TNR_Gj over non-Gj points, which contradicts the subgroup definition in Equation (9). The OTA subgroup risk is therefore not a well-defined subpopulation metric. Since the paper explicitly uses OQTA/OTA as a non-parametric robustness check for LiRA, that consistency argument doesn't hold as written. The LiRA results may still be right, but they currently stand alone.\n\nWhat's good: adapting LiRA to per-subgroup in/out distributions and running it across five mitigators, three model families, DP variants, and ten datasets is a real expansion over prior work like Chang & Shokri or Tian et al. The central claim—fairness interventions don't uniformly change MIA risk; subgroup size and model architecture mediate—is plausible and aligns with earlier disparate-vulnerability results. The DP findings on uneven subgroup utility collapse are practically useful. The paper is clearly written and the experimental grid is impressive.\n\nSoft spots, in order: the two attack-metric issues above; then Section 6's theoretical characterization, which is explicitly post-hoc and uses a Hessian block-decomposition assumption that is plausible but not derived. The O(1/n_g) intuition matches prior theory, but it's explanatory, not predictive—the paper does label it as intuition, which I appreciate. Minor: some utility comparisons lack error bars, and the \"first\" claims are a bit loose given the existing literature.\n\nBottom line: for practitioners and researchers auditing fairness–privacy trade-offs, the LiRA subpopulation framework and empirical map are valuable. The flaws are real but fixable—re-derive the OTA metric, select thresholds on a separate reference set, and report LiRA-based confidence directly. I'd send it to peer review (it deserves referee time), but I wouldn't take the reported subgroup risk numbers at face value until those issues are addressed.","headline":"A broad, useful LiRA-based audit of fairness mitigators vs. subgroup MIA risk, but the OQTA/OTA robustness evidence is invalid as written due to in-sample threshold tuning and a mis-defined TNR; the core findings are plausible but need fixes.","tokens_in":34864,"tokens_out":3949,"would_cite":false,"duration_ms":45489,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper shows that fairness-enhancing algorithms do not uniformly raise membership-inference privacy risk; the direction and size of the effect depend on subgroup size, model architecture, and the chosen mitigation strategy.","keywords":["membership inference attack","subpopulation privacy risk","fairness-enhancing algorithms","differential privacy","LiRA","disparate vulnerability","fairness-privacy trade-off","subgroup auditing"],"falsifier":"Re-run the OTA and OQTA audits with thresholds chosen on a separate held-out population set—never on the target data—and compare subgroup privacy-risk orderings; if the disparities between small and large subgroups largely vanish, the paper's central claim about persistent structural exposure after fairness mitigation would fail.","tokens_in":33936,"feed_emoji":"⚖️","tokens_out":4803,"duration_ms":48587,"temperature":0.7,"pith_summary":"This paper tries to establish that the common assumption—fairness interventions trade away privacy—is too simple. Auditing membership inference at the subpopulation level, it finds that fairness mitigators can raise, lower, or leave privacy risk unchanged depending on model architecture, subgroup size, and mitigation strategy. The paper extends the Likelihood Ratio Attack (LiRA) to per-group leakage estimates and shows that smaller subgroups are consistently more exposed to membership inference, even after fairness fixes are applied. It also shows that Differential Privacy reliably suppresses membership-inference risk across subgroups but lands its utility costs unevenly, sometimes collapsing accuracy for specific subpopulations to near zero. If right, fairness, privacy, and utility must be evaluated jointly at subgroup granularity rather than at the aggregate level.","feed_headline":"Fairness fixes don't uniformly raise privacy risk","feed_subtitle":"Smaller subgroups stay most exposed to membership inference even after fairness tools are applied; aggregate metrics hide the gaps.","key_machinery":"The central mechanism is a subgroup-conditioned Likelihood Ratio Attack (LiRA): instead of drawing in- and out-distributions uniformly, the attack restricts both the target sample and the shadow-model distributions to a single demographic subgroup, producing subgroup-specific likelihood ratios and privacy-risk estimates. The theoretical explanation for the empirical pattern is an influence-function argument: the membership signal Δ_i scales as O(1/n_g), so a sample from a group of size n_g represents a fraction 1/n_g of that group's information, making members of small groups more easily detected; DP adds independent noise that lowers the signal-to-noise ratio, and the same reasoning explain","core_discovery":"The central claim is that fairness interventions do not uniformly increase privacy risk; their effect on membership inference is mediated by model architecture, subgroup size, and mitigation strategy. Adapting LiRA to subgroup-conditioned attack distributions, the authors report that the smallest subpopulations consistently carry the highest membership-inference risk across datasets and attack families, and that this structural disadvantage persists after fairness mitigation. They further report that differential privacy (via DP random forests and DP-SGD) drives subgroup privacy risk toward the random-guessing baseline, but does so at a heavily uneven utility price: privileged and underrepre","pith_inferences":["If the O(1/n_g) influence scaling is the driver, then interventions that increase a subgroup's effective sample size—beyond naive oversampling—should measurably reduce its membership-inference risk; this is a testable extension the paper does not run.","The same logic suggests a per-group privacy budget: allocating DP noise unevenly, with more protection for groups whose accuracy collapses, could rebalance the fairness–privacy–utility trilemma without giving up formal guarantees.","Because OQTA and OTA select thresholds on the target data they later score, the reported risk gaps are optimistic upper bounds; re-running the audit with thresholds fixed on a separate population set is a direct check on whether the group-level disparities persist.","The finding that apparent fairness improvements under DP often reflect uniform accuracy loss warns that fairness metrics computed on degraded models can be misleading; a meaningful audit should report utility alongside fairness, as the paper does."],"forward_implications":["Aggregate privacy metrics are insufficient: membership-inference risk must be reported per subpopulation to see who is actually exposed.","Fairness mitigators do not have a universal privacy effect; EGR can strengthen privacy for random forests but worsen it for simpler models, while REW gives modest but stable improvements and DIR behaves inconsistently.","Differential privacy reduces subgroup privacy risk to near-random-guessing levels under every tested mitigator, but its utility cost can be catastrophic for specific subgroups, with accuracy sometimes falling below 5%.","Subpopulation size remains a persistent driver of privacy vulnerability: smaller subgroups stay the most exposed even after fairness interventions.","Practitioners should select strategies by priority—DP with lower-complexity models and conservative mitigators like REW if privacy is paramount—but must verify subgroup-level utility in every case."],"fun_headline_variants":["Fairness tools don't uniformly hike privacy risk","Small subgroups stay most exposed to privacy attacks","Subpopulation audit reveals uneven privacy costs","Fairness privacy trade-off varies by subgroup size","DP evens privacy risk but at unfair utility cost"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The reported subgroup privacy gaps rest on attack thresholds that are tuned on the target data being scored, which makes the attacks optimistic upper bounds; for OTA the non-member rate is also computed from outside the subgroup, so the subgroup risk numbers are not clean subpopulation metrics.","fun_headline_variants_meta":{"raw":{"variants":["Fairness tools don't uniformly hike privacy risk","Small subgroups stay most exposed to privacy attacks","Subpopulation audit reveals uneven privacy costs","Fairness privacy trade-off varies by subgroup size","DP evens privacy risk but at unfair utility cost"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000143,"raw_usage":{"total_tokens":980,"prompt_tokens":691,"completion_tokens":289,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":435,"completion_tokens_details":{"reasoning_tokens":220}},"tokens_in":435,"tokens_out":289,"duration_ms":2790,"temperature":1.0,"reasoning_tokens":220,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T01:35:52.979954+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the OTA and OQTA audits with thresholds chosen on a separate held-out population set—never on the target data—and compare subgroup privacy-risk orderings; if the disparities between small and large subgroups largely vanish, the paper's central claim about persistent structural exposure after fairness mitigation would fail.","supporting_citations":[],"review_version":1}