Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning

Devharsh Trivedi; Jackson Walters; Maryline Laurent; Nesrine Kaaniche; Nikos Triandopoulos

REVIEW 3 major objections 5 minor 31 references

Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Fairis proves that weighting each client by eta minus its local Equal Opportunity Difference shrinks a fairness-poisoning adversary's influence monotonically while every client keeps strictly positive weight.

desk verdict A clean formal result with an honestly stated, load-bearing assumption about honest score reporting; worth refereeing but not as a complete solution to fairness poisoning. read the letter →

arxiv 2608.06469 v1 pith:H7WKNFUJ submitted 2026-08-06 cs.CR cs.LG

Devharsh Trivedi , Nesrine Kaaniche , Nikos Triandopoulos , Maryline Laurent , Jackson Walters This is my paper · ORCID

classification cs.CRcs.LG

keywords collaborativelearningfederatedgroupfairnesspoisoningattacksequalopportunitydifferenceaggregationreweightingByzantinerobustnessnon-IIDdata

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Fairis is a server-side aggregation rule for collaborative machine learning that assigns client $k$ the normalized weight $\omega_k=(\eta-F_k)/\sum_j(\eta-F_j)$, where $F_k\in[0,1]$ is the client's local Equal Opportunity Difference (the gap in true-positive rates between privileged and unprivileged groups) and $\eta>1$ is a tunable parameter. The paper proves three properties: the weight is strictly decreasing in the reported score (Monotone Weight Reduction), every client keeps strictly positive weight (Demographic Participation), and no adversary can regain the influence of a perfectly fair client by tracking a global average (Non-Gamesmanship). Under server-side norm clipping, the adversary's contribution to the global update is bounded by $\omega_0 C$, which is strictly decreasing in its own reported disparity. The paper's point is that a fairness-poisoning attacker who preserves accuracy escapes accuracy-based defenses, but a score-based reweighting can nonetheless shrink its influence. Its strongest claim is that, assuming clients report scores honestly, Fairis is the only evaluated rule that guarantees every client strictly positive weight while provably reducing an attacker's weight as its bias grows.

What carries the argument

The load-bearing object is the normalized weight itself, $\omega_k=(\eta-F_k)/\sum_j(\eta-F_j)$, built from each client's absolute local Equal Opportunity Difference rather than a gap from a global average; $\eta>1$ supplies strict positivity and the derivative supplies strict monotone reduction. A second identity does much of the explanatory work: $\omega_k = 1/K + (\bar F-F_k)/(K\eta-\sum_j F_j)$, which splits the weight into a uniform share plus a signed correction, showing why raising $\eta$ flattens the weights toward uniform and why a client whose score sits below the honest mean can receive more than $1/K$. Norm clipping at $C$ is the other half of the mechanism, because without it a small weight could be offset by an arbitrarily large update norm; with it, the adversary's displacement is bounded by $\omega_0 C$.

What would settle it

Run Fairis with a malicious client that maximizes group disparity while reporting $F_0=0$ every round and keeping its update norm below the clipping bound. The weighting formula cannot distinguish this from a genuinely fair client, so the adversary gets the maximum possible normalized weight and its displacement of the global model stays at roughly $\omega_0 C$; if the pooled model's EOD rises while the reported scores stay zero, the containment claim fails exactly as the paper's limitation (ii) predicts.

Watch

Extended reading notes

Core claim

The central discovery is that a single scalar fairness score per client, used in the closed-form weight map $\omega_k=(\eta-F_k)/\sum_j(\eta-F_j)$ with $\eta>1$, converts reported bias into a provable limit on aggregation influence. Holding the other clients' scores fixed, $\partial\omega_k/\partial F_k = -S_{-k}/(S_{-k}+\eta-F_k)^2<0$, so a more biased client always receives less weight; since $\eta-F_k>0$ for every $F_k\le 1$, no client is zeroed out; and since the formula never references the global average, an adversary cannot match a server-side statistic to erase the penalty. Theorem 3 proves that FairFed's gap-based rule is gameable by a client that matches $F_{\mathrm{global}}$, while Fairis is not. Proposition 2 turns the monotonicity into a displacement bound: after norm clipping to bound $C$, the adversary's contribution satisfies $\|\omega_0\Delta_0\|_2\le \omega_0 C$, strictly decreasing in $F_0$. The paper is explicit that this is influence containment rather than a promise of better honest-client EOD, and that the honest-score-reporting assumption is load-bearing and undischarged.

Load-bearing premise

Everything depends on clients reporting their fairness scores honestly; the paper states that a client that could falsely report a near-zero score would keep near-maximum weight while injecting bias, and it does not discharge this assumption.

Editorial extensions

If this is right

A client that becomes more biased, as measured by its reported Equal Opportunity Difference, strictly loses aggregation weight in every round, so the incentive to inject group disparity is directly penalized.
Every client always keeps strictly positive weight, so no demographic subgroup is permanently removed from the shared model even when a client is heavily down-weighted.
With norm clipping, a malicious client's maximum displacement of the global model is $\omega_0 C$, and this bound shrinks monotonically with the client's reported bias; the attacker cannot compensate for lower weight with a larger update.
The same monotonicity extends to a colluding minority coalition: the coalition's combined weight strictly decreases as any member's bias grows.
On a stealthy attack on Taiwan Credit, where the adversary stays within 0.04 accuracy of benign, Fairis lowers the attacker's aggregation weight by 41 to 54 percent relative to a size-blind uniform control, and at high attack strength its weight drops to 0.048.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural extension the paper leaves implicit is a population-adaptive rule: because absolute-score weighting only contains attackers that are outliers relative to the honest mean, a hybrid that estimates the honest score distribution without allowing clients to match it would address the Adult-Income failure mode.
If the honest-score-reporting assumption were discharged by verifiable score computation, for example a zero-knowledge proof over the fairness metric, the same closed-form weight would give containment in fully malicious deployments; the paper lists this as future work.
The uniform-weighting ablation suggests that any comparison of a score-based aggregator should include both a size-weighted baseline and a size-blind uniform baseline, since on small datasets the apparent gains can come from dropping size proportionality rather than from fairness weighting.
In deployment, the score channel doubles as a detector: a client whose reported EOD diverges sharply from the honest population's scores is exactly the client the rule down-weights, but only as long as scores cannot be forged.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The thing to know: this is a well-scoped paper about a simple reweighting rule, and the algebra is correct as far as I can tell. The headline security claim, however, rests on Assumption (A2) that clients report their fairness scores honestly, and the paper says in plain terms that it does not discharge this assumption. That is not a hidden flaw; it is a stated boundary. But it is the boundary between a useful mechanism and a solution to fairness poisoning, so read the title accordingly.

What is genuinely new: the absolute-score weighting ω_k = (η−F_k)/Σ(η−F_j) with η>1, plus the formal properties — monotone weight reduction, demographic participation, non-gamesmanship — and the coalition bound. The matched-gap fixed-point analysis of FairFed (Eq. 5) is a nice piece of work, and the empirical section includes a genuinely honest negative result: on Adult, where honest clients are themselves unfair, the rule gives the adversary more weight than uniform. That kind of failure-case reporting earns credit.

The soft spots are real but mostly proportional. A2 is the big one: an adversary that controls its training can also misreport its score, and the paper itself notes that authenticating the sender does not prove correct computation. That is not an internal inconsistency, but it does mean the practical guarantee is conditional on trust in exactly the channel the attacker would exploit. Second, local EOD does not decompose into population EOD, so all clients can report zero while the pooled model is unfair; the paper spells this out as limitation (iii). Third, the empirics are thin: three seeds, one dataset for the headline reduction claim, no code or Lean artifact despite the formalization claim, and no FairTrade baseline — the paper flags the last one itself.

I would send this to a serious referee. The formal contribution is clear, the proofs are elementary and checkable, and the paper is unusually honest about its scope. The referee should press on A2 and ask whether any realistic enforcement mechanism (e.g., verification of score computation) can be added or whether the threat model should be weakened. Also worth asking for the artifact. But the core idea is sound and the presentation is clean.

For me: I would cite it when discussing fairness-aware aggregation under honest reporting, and I would bring it to a reading group focused on adversarial ML. Conditional accept.

Referee Report

3 major / 5 minor

Summary. The paper proposes Fairis, a server-side reweighting rule for collaborative learning in which each client receives normalized weight ω_k = (η − F_k) / Σ_j (η − F_j), where F_k ∈ [0,1] is the client's local Equal Opportunity Difference and η > 1 is a security parameter. The authors prove three properties—Monotone Weight Reduction, Demographic Participation, and Non-Gamesmanship—extend monotonicity to colluding coalitions, and show that norm clipping bounds the adversary's displacement of the global model by ω_0 C. The empirical evaluation on German, Taiwan, and Adult datasets under both SplitML and full-model FL reports that Fairis contains a stealthy adversary on Taiwan (41–54% weight reduction below uniform), but does not dominate on routine non-IID settings and provides no containment when the honest population is already unfair. The paper explicitly acknowledges that all security guarantees are conditional on Assumption (A2), honest score reporting, which it does not discharge, and that local fairness scores do not imply population-level fairness.

Significance. If the security claims are taken as conditional on honest score reporting, the paper offers a clean, elementary, and correctly proved set of results for a specific aggregation-component design. The explicit separation of influence containment from downstream EOD improvement, the honest reporting of failure cases (Adult income, FairFed's self-limiting gamesmanship), and the derivation of Eq. (3) linking weights to the score gap are strengths. The claimed Lean formalization, if released with an artifact, would be a further strength. However, the central 'provable influence containment' claim rests on a trust assumption that the adversary can trivially violate by misreporting its score, and the paper itself concedes this is undischarged. The significance is therefore real but narrower than the title suggests: it is a result about weighting under honest score reports, not a complete defense against fairness poisoning.

major comments (3)

[§3.1, Assumption (A2), and §7.2(ii)] The load-bearing premise of the entire security analysis is Assumption (A2), that clients honestly report their scalar fairness scores. Algorithm 1 computes F_k client-side in step 5, and Section 7.2(ii) admits that authenticating the sender does not establish that the score was computed correctly. A malicious client can therefore train a disparity-maximizing model and report F_0 = 0; by Corollary 1 it then receives near-maximum weight η/(η + S_{−0}), and by Proposition 2 its displacement contribution is bounded only by ω_0 C, essentially the same bound as a perfectly fair client. Theorems 1 and Proposition 2 are monotonic in the reported score, not in the adversary's actual injected disparity, so the title's 'provable influence containment' collapses under a trivial misreporting strategy. The paper is honest about this limitation, but it remains load-bearing: the authors should either supply at least a sketch of a verifiable-score mechanism (e.g., a ZK-proof or committed-computation protocol) that enforces (A2), or reframe the contribution as a conditional building block and adjust the title and abstract to make the conditional nature unmissable.
[§7.2(iii) and §3.1] Even under honest score reporting, local EOD does not decompose into population EOD, and the paper's own Lean development includes a concrete instance in which every client reports F_k = 0 while the pooled model has EOD 49/50. This means the fairness signal fed into the aggregation rule can be entirely uninformative about the population-level quantity the system aims to control. The consequence is acknowledged in Remark 1 and Section 7.2(iii), but it sharply limits the practical scope: the mechanism can only contain influence relative to reported local disparity, not actual population disparity. I request that the authors state more precisely the data conditions under which the local EOD is a meaningful signal, and discuss whether any preprocessing or client-level aggregation can make the local scores more informative.
[§5, 'Machine-checked proofs' paragraph] The paper claims that Theorems 1–3, Corollary 2, Proposition 2, and the population-fairness counterexample have been 'independently formalized and checked in the Lean proof assistant,' but no artifact, repository link, or code listing is provided. For a paper whose headline is a provable guarantee, a machine-checked proof is a strong asset, but without the artifact the claim is not independently verifiable. Please release the Lean files (or provide an appendix with the formal statements) and briefly describe the correspondence between the informal and formal claims.

minor comments (5)

[Throughout] The rendered text contains odd spacing artifacts such as 'F airis', 'F airFed', and 'F airis-N'. These appear to be LaTeX or extraction artifacts, but they should be cleaned up in the camera-ready version.
[Table 1 and §6.4] The negative reductions for Adult (e.g., −2.8% at α_adv = 0.25) are explained in the text, but a one-line note in the table caption would help readers who do not first read the paragraph.
[§4.1, Eq. (2)] The data-driven heuristic for selecting η is described as a 'practical default,' but no sensitivity study is presented. A brief remark on its behavior on the three datasets would be useful, especially since all reported experiments use fixed η values.
[§6.2 and Table 3] The claim that 'no single method dominates' is based on mean EOD/SPD with three seeds and wide standard deviations. The paper acknowledges this, but a more explicit statement that no statistical significance tests are performed would help set expectations.
[§5 and Appendix A.12] The proof of Theorem 3 for FairFed is given under explicit premises (β>0, positive total mass, and at least one honest nonzero gap). It would be helpful to state the theorem in the main text with these premises attached, rather than only in the appendix, to avoid the impression that the result is unconditional.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the formal security properties are transparent analytic consequences of the stated weight formula, and the empirical evaluation is external and reports failure regimes.

full rationale

The paper's formal claims are stated as consequences of an explicit construction. Theorem 1 differentiates ω_k = (η−F_k)/Σ_j(η−F_j) with S_{−k} > 0 to obtain ∂ω_k/∂F_k < 0; Proposition 2 multiplies this by the clipping bound C; Theorem 2 is positivity from η > 1 and F_k ≤ 1; Theorem 3 follows from the same strict monotonicity and adds a separate proof that FairFed's gap update is gameable. These are algebraic identities over the defined weight map, so no fitted parameter is renamed as a prediction. The empirical sections test the rule against FedAvg, FairFed, uniform, and Silo on German, Taiwan, and Adult, and explicitly report regimes where containment fails (Adult's honest-mean condition, German's saturated score channel), which is inconsistent with results being forced by construction. The self-references are not load-bearing: SplitML [27] motivates an experimental testbed, but the same rule is validated under full-model FL, and the Lean formalization by one author is an auxiliary check that the paper itself says does not validate the modeling. Section 7.2(ii) explicitly identifies honest score reporting (A2) as an undischarged, sharpest limitation, and limitation (iii) concedes local EOD does not imply population EOD; these are assumption gaps, not circular equivalences. The security game's 'attack-resistant' condition is stipulated as weight monotonicity, but the paper transparently derives the properties from the formula rather than using the properties to fit it. No step reduces a prediction to its input by construction.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The scheme's formal claims rely on standard algebra (weight formula, derivatives) plus the stated threat-model assumptions A1-A5. The main free choices are the security parameter η and the clipping bound C; neither is fitted to the reported outcomes, though C is calibrated to honest-update norms in a pilot. No new entities are invented. The central unvalidated axiom is A2: honest score reporting, which the paper explicitly does not discharge.

free parameters (2)

η (security parameter) = 1.01 and 1.32 in experiments; recommended range (1,(K+1)/K]
Tunable parameter in ω_k = (η−F_k)/Σ_j(η−F_j); chosen by hand or by heuristic Eq (2). Values are not fitted to outcome data, but the recommended range is dataset-size dependent.
C (norm clipping bound) = 2.83 to 5.41 per configuration
Calibrated to the 90th percentile of honest update norms in an adversary-free pilot (Section 5); the influence bound uses C, so empirical displacement numbers depend on this calibration.

assumptions (5)

domain assumption A1: Malicious clients are a minority, |B| < K/2.
Needed for Corollary 2 (W_¬B > 0) and to ensure the honest majority exists; Section 3.1.
domain assumption A2: Clients report their local fairness scores honestly; the adversary cannot forge F_k.
Critical: the entire security argument operates on reported F_k; Section 7.2(ii) states the paper does not discharge this assumption.
domain assumption A3-A5: PPT adversary, honest-but-curious server, and stealth accuracy constraint within ε of benign baseline.
Define the attack class and the server trust model; Section 3.1.
domain assumption Other clients' scores {F_j}_{j≠k} are held fixed when F_k varies in the monotonicity derivative.
This is the algebraic condition for MWR; in practice honest scores evolve with the model, so the guarantee is per-round and conditional (Section 3.1 and Theorem 1).
standard math Local EOD F_k ∈ [0,1] is well-defined and computable by each client on private data.
EOD is the absolute TPR gap (Appendix A.3); the weight formula relies on this range. The paper stresses that local EOD does not decompose into population EOD (limitation iii).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning." pith.science (2026). https://pith.science/paper/H7WKNFUJ

@misc{pith2026260806469,
  author       = {Pith},
  title        = {Pith review of: Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H7WKNFUJ}},
  note         = {Machine review of arXiv:2608.06469}
}

abstract

Collaborative machine learning among financial institutions must be both group-fair and robust against deliberate adversarial manipulation. Existing fairness-aware aggregation methods remain formally vulnerable to fairness poisoning: a malicious client maximizing group disparity while preserving accuracy evades accuracy-based Byzantine defenses, and in our threat model FairFed's gap-based weighting can be gamed by an adversary who observes the global fairness score. We present Fairis, a server-side reweighting scheme in which each client's update receives the normalized weight $\omega_k = \bar{w}_k / \sum_j \bar{w}_j$ built from the unnormalized score $\bar{w}_k = \eta - \mathcal{F}_k$, with $\mathcal{F}_k \in [0,1]$ the local Equal Opportunity Difference and $\eta > 1$ a security parameter. We prove three properties, Monotone Weight Reduction (MWR), Demographic Participation, and Non-Gamesmanship, extend MWR to colluding minority coalitions, and show that combining MWR with server-side norm clipping bounds the adversary's displacement of the global model by $\omega_0 C$, strictly decreasing in its own reported disparity. Assuming honest score reporting, an assumption this paper does not discharge, Fairis is the only rule evaluated that guarantees every client strictly positive weight while provably reducing an adversary's weight monotonically in its bias; clipped FairFed can reach a lower weight but guarantees nothing and zeroes a client outright on Taiwan Credit. Against an adversary stealthy enough to evade accuracy-based defenses, within 0.04 accuracy of benign, Fairis cuts its weight by 41 to 54% below a size-blind control on Taiwan. On routine non-IID partitions no rule dominates, and a uniform-weighting ablation shows that containment tracks how far the adversary's score separates from the honest mean, providing none when the honest population is already unfair.

Figures

Figures reproduced from arXiv: 2608.06469 by the authors.

**Figure 1.** Effect of the security parameter η on Fairis aggregation weights (K = 3). Left: aggregation weight ωk as a function of a client’s Equal Opportunity Difference (EOD) for two values of η, assuming two other clients with mean EOD = 0.30. All Fairis curves are strictly decreasing (Theorem 1); smaller η penalizes bias more sharply. FedAvg is constant at 1/K = 0.33 regardless of bias. FairFed (β = 1) drives highly biased … view at source ↗

**Figure 2.** SplitML architecture. Each client holds a local model whose top layers (closer to the input) are common across clients and whose bottom layers (closer to the output, including the classification head) are personalized. At each round, clients send their common-layer updates to the central server, which returns the aggregated weights; the personalized bottom layers never leave the client. Fairis sets these aggregation… view at source ↗

**Figure 3.** Architecture-agnostic transfer. Solid bars: SplitML mode (only the shared top, input-side layers are aggregated; the personalized bottom layers remain private). Hatched bars: FL mode (full model aggregated, all parameters shared). The Fairis weighting rule ωk = (η − Fk)/ P j (η − Fj ) is applied unchanged in both settings, shown for German, Taiwan, and Adult at K = 5. The same closed-form aggregation runs on both ar… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Empirical verification of Monotone Weight Reduction and Demographic Participation: aggregation weight ω0 assigned to the adversarial client under active fairness poisoning at αadv = 2 (K = 3, mean over three seeds; solid bars German Credit, hatched Taiwan Credit, cros…

**Figure 5.** Figure 5: Global-model fairness over communication rounds (German Credit, full-model FL, K = 5, three-round moving average of EOD over three seeds). On this small dataset the score channel saturates, so FairFed (β=1) coincides exactly with FedAvg (overlapping curves) and Fairis …

**Figure 6.** Figure 6: Mean Equal Opportunity Difference (EOD, lower is fairer) per method and number of clients K under Dirichlet non-IID partitioning (α = 0.5), SplitML mode with 2 shared layers, averaged over non-degenerate client-run combinations from 3 seeds. Error bars are the standard…

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 19 canonical work pages

[1]

Badar, M., Sikdar, S., Nejdl, W., Fisichella, M.: FairTrade: Achieving pareto- optimal trade-offs between balanced accuracy and fairness in federated learning. 22 D. Trivedi et al. Proceedings of the AAAI Conference on Artificial Intelligence38(10), 10962–10970 (2024).https://doi.org/10.1609/aaai.v38i10.28971

work page doi:10.1609/aaai.v38i10.28971 2024
[2]

UCI Machine Learning Repository (1996)

Becker, B., Kohavi, R.: Adult. UCI Machine Learning Repository (1996). https: //doi.org/10.24432/C5XW20

doi:10.24432/c5xw20 1996
[3]

Proceedings on Privacy Enhancing Technologies2025(1), 845–865 (2025)

Bendoukha, A.A., Demirag, D., Kaaniche, N., Boudguiga, A., Sirdey, R., Gambs, S.: Towards privacy-preserving and fairness-aware federated learning framework. Proceedings on Privacy Enhancing Technologies2025(1), 845–865 (2025). https: //doi.org/10.56553/popets-2025-0044

work page doi:10.56553/popets-2025-0044 2025
[4]

In: Advances in Neural Information Processing Systems (NeurIPS)

Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., Stainer, J.: Machine learning with adversaries: Byzantine tolerant gradient descent. In: Advances in Neural Information Processing Systems (NeurIPS). vol. 30, pp. 119–129 (2017)

work page 2017
[5]

In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security

Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H.B., Patel, S., Ramage, D., Segal, A., Seth, K.: Practical secure aggregation for privacy- preserving machine learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. pp. 1175–1191 (2017)

work page 2017
[6]

Sensors24(1), 88 (2024)

Chen, H., Chen, X., Peng, L., Bai, Y.: Personalized fair split learning for resource- constrained internet of things. Sensors24(1), 88 (2024). https://doi.org/10. 3390/s24010088

work page 2024
[7]

In: Proceedings of the 3rd Innovations in Theoretical Computer Science Conference (ITCS)

Dwork, C., Hardt, M., Pitassi, T., Reingold, O., Zemel, R.: Fairness through awareness. In: Proceedings of the 3rd Innovations in Theoretical Computer Science Conference (ITCS). pp. 214–226 (2012)

work page 2012
[8]

Official Journal of the European Union, L series (2024), regulation (EU) 2024/1689

European Parliament and Council: Regulation (EU) 2024/1689 laying down har- monised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L series (2024), regulation (EU) 2024/1689

work page 2024

Show all 31 references

[9]

In: Proceedings of the 37th AAAI Conference on Artificial Intelligence

Ezzeldin, Y.H., Yan, S., He, C., Ferrara, E., Avestimehr, A.S.: FairFed: Enabling group fairness in federated learning. In: Proceedings of the 37th AAAI Conference on Artificial Intelligence. pp. 7494–7502 (2023)

2023
[10]

arXiv preprint arXiv:1712.07557 (2017)

Geyer, R.C., Klein, T., Nabi, M.: Differentially private federated learning: A client level perspective. arXiv preprint arXiv:1712.07557 (2017)

2017 arXiv
[11]

Journal of Network and Computer Applications116, 1–8 (2018)

Gupta, O., Raskar, R.: Distributed learning of deep neural network over multiple agents. Journal of Network and Computer Applications116, 1–8 (2018). https: //doi.org/10.1016/j.jnca.2018.05.003

2018 doi
[12]

In: Advances in Neural Information Processing Systems (NeurIPS)

Hardt, M., Price, E., Srebro, N.: Equality of opportunity in supervised learning. In: Advances in Neural Information Processing Systems (NeurIPS). vol. 29, pp. 3315–3323 (2016)

2016
[13]

UCI Machine Learning Repository (1994).https://doi.org/10.24432/C5NC77

Hofmann, H.: Statlog (German Credit Data). UCI Machine Learning Repository (1994).https://doi.org/10.24432/C5NC77

1994 doi
[14]

Foundations and Trends in Machine Learning14(1–2), 1–210 (2021)

Kairouz, P., McMahan, H.B., et al.: Advances and open problems in federated learning. Foundations and Trends in Machine Learning14(1–2), 1–210 (2021). https://doi.org/10.1561/2200000083

2021 doi
[15]

In: 2025 IEEE 24th International Confer- ence on Trust, Security and Privacy in Computing and Communications (Trust- Com) (2025)

Kasyap, H., Fang, M., Liu, Z., Maple, C., Tripathy, S.: Fairness-constrained opti- mization attack in federated learning. In: 2025 IEEE 24th International Confer- ence on Trust, Security and Privacy in Computing and Communications (Trust- Com) (2025). https://doi.org/10.1109/T...

2025
[16]

arXiv preprint arXiv:2507.12983 (2025)

Liu, S.: FedGA: A fair federated learning framework based on the gini coefficient. arXiv preprint arXiv:2507.12983 (2025)

2025 arXiv
[17]

In: Proceedings of the 20th AISTATS

McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication- efficient learning of deep networks from decentralized data. In: Proceedings of the 20th AISTATS. PMLR, vol. 54, pp. 1273–1282 (2017) Fairis: Fairness-Aware Aggregation with Influence Containment 23

2017
[18]

In: Proceedings of the 33rd IJCAI

Meerza, S.I.A., Liu, J.: EAB-FL: Exacerbating algorithmic bias through model poisoning attacks in federated learning. In: Proceedings of the 33rd IJCAI. pp. 458–466 (2024).https://doi.org/10.24963/ijcai.2024/51

2024 doi
[19]

arXiv preprint arXiv:2401.03562 (2024)

Meerza, S.I.A., Liu, L., Zhang, J., Liu, J.: GLOCALFAIR: Jointly improving global and local group fairness in federated learning. arXiv preprint arXiv:2401.03562 (2024)

2024 arXiv
[20]

ACM Computing Surveys54(6), 1–35 (2021)

Mehrabi, N., Morstatter, F., Saxena, N., Lerman, K., Galstyan, A.: A survey on bias and fairness in machine learning. ACM Computing Surveys54(6), 1–35 (2021). https://doi.org/10.1145/3457607

2021 doi
[21]

In: 2019 IEEE Symposium on Security and Privacy (SP)

Melis, L., Song, C., Cristofaro, E.D., Shmatikov, V.: Exploiting unintended feature leakage in collaborative learning. In: 2019 IEEE Symposium on Security and Privacy (SP). pp. 691–706. IEEE (2019)

2019
[22]

Advanced Intelligent Systems7(6), 2400836 (2025)

Mukhtiar, N., Mahmood, A., Sheng, Q.Z.: Fairness in federated learning: Trends, challenges, and opportunities. Advanced Intelligent Systems7(6), 2400836 (2025). https://doi.org/10.1002/aisy.202400836

2025 doi
[23]

arXiv preprint arXiv:2205.11584 (2022)

Pentyala, S., Neophytou, N., Nascimento, A., Cock, M.D., Farnadi, G.: Priv- FairFL: Privacy-preserving group fairness in federated learning. arXiv preprint arXiv:2205.11584 (2022)

2022 arXiv
[24]

Discover Internet of Things6(1), 36 (2026).https://doi.org/10.1007/s43926-026-00308-8

Santhosh Kumar, V., Sunehra, D.: A privacy preserving split learning framework with adaptive inference selection for IoT security. Discover Internet of Things6(1), 36 (2026).https://doi.org/10.1007/s43926-026-00308-8

2026 doi
[25]

In: 2017 IEEE Symposium on Security and Privacy (SP)

Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: 2017 IEEE Symposium on Security and Privacy (SP). pp. 3–18. IEEE (2017)

2017
[26]

In: Proceedings of the 36th AAAI Conference on Artificial Intelligence

Thapa, C., Arachchige, P.C.M., Camtepe, S., Sun, L.: SplitFed: When federated learning meets split learning. In: Proceedings of the 36th AAAI Conference on Artificial Intelligence. pp. 8485–8493 (2022)

2022
[27]

Electronics15(2), 267 (2026)

Trivedi, D., Boudguiga, A., Kaaniche, N., Triandopoulos, N.: SplitML: A uni- fied privacy-preserving architecture for federated split-learning in heteroge- neous environments. Electronics15(2), 267 (2026). https://doi.org/10.3390/ electronics15020267

2026
[28]

arXiv:1812.00564 (2018)

Vepakomma, P., Gupta, O., Swedish, T., Raskar, R.: Split learning for health: Distributed deep learning without sharing raw patient data. arXiv:1812.00564 (2018)

2018 arXiv
[29]

arXiv preprint arXiv:2407.19331 (2024)

Yang, Y., Payani, A., Naghizadeh, P.: Friends in unexpected places: Enhancing local fairness in federated learning through clustering. arXiv preprint arXiv:2407.19331 (2024)

2024 arXiv
[30]

UCI Machine Learning Repository (2009)

Yeh, I.C.: Default of credit card clients. UCI Machine Learning Repository (2009). https://doi.org/10.24432/C55S3H, donated to the repository in 2016

2009 doi
[31]

Expert Systems with Applications269, 126418 (2025)

Zhang, J., Li, Y., Wu, D., Zhao, Y., Palaiahnakote, S.: SFFL: Self-aware fairness federated learning framework for heterogeneous data distributions. Expert Systems with Applications269, 126418 (2025). https://doi.org/10.1016/j.eswa.2025. 126418 A Background: Collaborative Lear...

2025

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

Badar, M., Sikdar, S., Nejdl, W., Fisichella, M.: FairTrade: Achieving pareto- optimal trade-offs between balanced accuracy and fairness in federated learning. 22 D. Trivedi et al. Proceedings of the AAAI Conference on Artificial Intelligence38(10), 10962–10970 (2024).https://doi.org/10.1609/aaai.v38i10.28971

work page doi:10.1609/aaai.v38i10.28971 2024

[2] [2]

UCI Machine Learning Repository (1996)

Becker, B., Kohavi, R.: Adult. UCI Machine Learning Repository (1996). https: //doi.org/10.24432/C5XW20

doi:10.24432/c5xw20 1996

[3] [3]

Proceedings on Privacy Enhancing Technologies2025(1), 845–865 (2025)

Bendoukha, A.A., Demirag, D., Kaaniche, N., Boudguiga, A., Sirdey, R., Gambs, S.: Towards privacy-preserving and fairness-aware federated learning framework. Proceedings on Privacy Enhancing Technologies2025(1), 845–865 (2025). https: //doi.org/10.56553/popets-2025-0044

work page doi:10.56553/popets-2025-0044 2025

[4] [4]

In: Advances in Neural Information Processing Systems (NeurIPS)

Blanchard, P., Mhamdi, E.M.E., Guerraoui, R., Stainer, J.: Machine learning with adversaries: Byzantine tolerant gradient descent. In: Advances in Neural Information Processing Systems (NeurIPS). vol. 30, pp. 119–129 (2017)

work page 2017

[5] [5]

In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security

Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H.B., Patel, S., Ramage, D., Segal, A., Seth, K.: Practical secure aggregation for privacy- preserving machine learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. pp. 1175–1191 (2017)

work page 2017

[6] [6]

Sensors24(1), 88 (2024)

Chen, H., Chen, X., Peng, L., Bai, Y.: Personalized fair split learning for resource- constrained internet of things. Sensors24(1), 88 (2024). https://doi.org/10. 3390/s24010088

work page 2024

[7] [7]

In: Proceedings of the 3rd Innovations in Theoretical Computer Science Conference (ITCS)

Dwork, C., Hardt, M., Pitassi, T., Reingold, O., Zemel, R.: Fairness through awareness. In: Proceedings of the 3rd Innovations in Theoretical Computer Science Conference (ITCS). pp. 214–226 (2012)

work page 2012

[8] [8]

Official Journal of the European Union, L series (2024), regulation (EU) 2024/1689

European Parliament and Council: Regulation (EU) 2024/1689 laying down har- monised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L series (2024), regulation (EU) 2024/1689

work page 2024