Pith. sign in

REVIEW 2 major objections 7 minor 66 references

Reviewed by Pith at T0; open to challenge.

T0 means a machine referee read the full paper against a public rubric. The mark states how deep the mechanical check went, never who wrote it. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

Post-processing wins as best fairness fix for private synthetic data

2026-07-09 09:45 UTC pith:2HHBHDR5

load-bearing objection First systematic benchmark of fairness interventions on DP synthetic tabular data; post-processing methods (ROC, EqOdds) emerge as most reliable stage under DP constraints. the 2 major comments →

arxiv 2607.07471 v1 pith:2HHBHDR5 submitted 2026-07-08 cs.LG cs.AIcs.CR

Where to Intervene? Benchmarking Fairness-Aware Learning on Differentially Private Synthetic Tabular Data

Vin\'icius Gabriel Angelozzi , H\'eber H. Arcolezi This is my paper
classification cs.LG cs.AIcs.CR
keywords differential privacysynthetic dataalgorithmic fairnessfairness-utility trade-offpost-processing fairnesstabular databenchmark
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper asks a practical question: when you train classifiers on differentially private synthetic tabular data, where in the machine learning pipeline should you apply fairness interventions — before training (pre-processing), during training (in-processing), or after training (post-processing)? The authors construct the first systematic benchmark to answer this, evaluating eight fairness mechanisms from all three stages across four datasets, three classifiers, and twelve privacy budgets, using two marginal-based DP synthesizers (AIM and MST). Their central finding is that post-processing methods — specifically Reject Option Classification (ROC) and Equalized Odds Post-Processing (EqOdds) — consistently deliver the strongest fairness improvements (measured by Equalized Opportunity Difference and Statistical Parity Difference) while keeping accuracy and F1-score within bounded degradation relative to DP-only training. Pre-processing methods like Reweighing can reduce disparities but at a measurable utility cost; in-processing methods like Exponentiated Gradient Reduction preserve utility but achieve only modest bias correction. The authors attribute post-processing's advantage to its operating on model predictions rather than on noisy training data, allowing it to exploit residual predictive signal that survives DP synthesis. The results are statistically validated via paired Wilcoxon signed-rank tests across thousands of experimental configurations, confirming that post-processing significantly outperforms both pre- and in-processing stages for EOD/SPD-oriented trade-offs.

Core claim

The paper's central discovery is a stage-level ranking of fairness interventions under differential privacy: post-processing (adjusting model outputs after training) is the most reliable strategy for mitigating bias in classifiers trained on DP synthetic tabular data, outperforming both pre-processing (modifying training data) and in-processing (modifying training algorithms). The mechanism behind this ranking is that post-processing operates on predictions rather than on noise-perturbed data, so it can realign group outcomes using whatever predictive signal the model retained after DP synthesis, without needing to disentangle fairness corrections from the distributional distortions that DP已

What carries the argument

The benchmark compares four pipeline configurations (Baseline, DP-only, Fair-only, DP+Fair) across three intervention stages (pre-, in-, post-processing), using AIM as the primary DP synthesizer, three classifiers (XGBoost, Random Forest, Logistic Regression), three fairness metrics (MAD, EOD, SPD), and twelve privacy budgets ranging from ε=0.05 to ε=20. Statistical validation uses paired Wilcoxon signed-rank tests on over 20,000 paired configurations.

Load-bearing premise

The benchmark evaluates only marginal-based DP synthesizers (AIM, MST) with binary classification and binary protected attributes, using AIF360-based fairness mechanisms. The claim that post-processing is the best intervention stage depends on this scope: if lower-utility synthesizers (like DP-GANs) or multi-class and intersectional settings were included, the relative effectiveness of intervention stages could shift, since post-processing's advantage relies on the synthesize

What would settle it

If a future benchmark using deep generative DP synthesizers (e.g., DP-GANs) or multi-class/intersectional protected attributes found that pre- or in-processing methods consistently outperform post-processing in fairness-utility trade-offs, the stage-level ranking would not generalize beyond marginal-based synthesizers with binary settings.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Practitioners deploying DP synthetic data in regulated domains (healthcare, finance, criminal justice) can apply ROC or EqOdds post-hoc to trained models as a practical fairness mitigation strategy without redesigning their DP generation pipeline.
  • The finding that fairness interventions are not uniformly transferable from non-private to DP settings suggests that fairness audits of DP synthetic data systems must re-evaluate interventions specifically under privacy constraints, not assume transfer from non-private benchmarks.
  • The structural utility ceiling observed under MST (but not AIM) implies that the choice of DP synthesizer constrains the achievable fairness-utility frontier, making synthesizer selection a first-order fairness decision.
  • The DP post-processing property (Proposition 1) means that applying fairness post-processing to DP synthetic data preserves the original privacy guarantee at no additional privacy cost, making this approach 'free' from a privacy standpoint.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If post-processing's advantage stems from exploiting residual separability in model output space, then the advantage should weaken for very low privacy budgets (very small ε) where DP noise destroys most predictive signal — the paper observes this trend but does not formally characterize the ε threshold below which post-processing loses its edge.
  • The restriction to binary classification and binary protected attributes means the stage-level ranking may not hold for intersectional fairness settings, where post-processing methods face combinatorially more group-specific threshold adjustments and may lose their stability advantage.
  • The finding that in-processing methods are conservative under DP synthetic data could reflect that these methods were designed for non-private settings; fairness-aware training objectives specifically designed to be robust to DP-induced distributional shifts might close the gap with post-processing.
  • The structural utility ceiling under MST suggests a testable hypothesis: the effectiveness of post-processing fairness interventions is bounded below by a function of the synthesizer's utility retention, meaning there exists a minimum utility threshold below which no intervention stage can achieve satisfactory fairness-utility trade-offs.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 7 minor

Summary. This manuscript presents the first systematic benchmark of fairness-aware learning interventions (pre-, in-, and post-processing) applied to classifiers trained on differentially private (DP) synthetic tabular data. The study evaluates 8 fairness mechanisms from AIF360 across 4 datasets, 3 classifiers, 2 marginal-based DP synthesizers (AIM, MST), 12 privacy budgets, and 20 random seeds. The central finding is that post-processing methods—particularly Reject Option Classification (ROC) and Equalized Odds Post-Processing (EqOdds)—consistently provide the most stable fairness–utility trade-offs under DP synthetic data, supported by Pareto-front analysis and paired Wilcoxon signed-rank tests (Tables 1–2). The paper is well-structured, transparent about limitations, and releases all code and artifacts.

Significance. The paper addresses a genuine gap: prior work on DP synthetic data and fairness is observational, measuring disparities without evaluating whether standard fairness interventions remain effective under DP constraints. The benchmark design is thorough—spanning multiple datasets, classifiers, synthesizers, privacy budgets, and intervention stages—and the release of code, data, and a PyPI package (BenchmarkDPFair) is a clear strength for reproducibility. The statistical validation via paired Wilcoxon tests is a commendable addition over purely visual Pareto-front analysis. The practical guidance (post-processing with high-utility synthesizers like AIM) is actionable for practitioners deploying DP synthetic data pipelines.

major comments (2)
  1. §4.6 and Table 2: The central statistical claim (Claim 2, Table 2) that POST significantly outperforms PRE and IN is validated under the main protocol, where post-processing methods are calibrated on a real, non-private held-out set (20% of data) while pre- and in-processing methods operate solely on DP synthetic training data. This creates a systematic asymmetry: POST methods have access to additional real data that PRE/IN never see. The paper acknowledges this (§4.6) and provides a DP-compliant calibration ablation in Appendix B.1, but the ablation covers only 3 datasets × 1 classifier (Figure 5) and 1 dataset × 3 classifiers (Figure 6) using visual inspection. Critically, the Wilcoxon tests in Table 2—the statistical backbone of the strongest claim—are never re-run under DP-compliant calibration. Given that the effect sizes are small (d̄ = −0.020 vs PRE, −0.029 vs IN), the non-private
  2. calibration data could inflate these results. The authors should either (a) re-run the full Wilcoxon analysis from Table 2 under DP-compliant calibration across all 4 datasets × 3 classifiers, or (b) explicitly state in the main text that the statistical validation in Table 2 is conditional on the non-private calibration protocol and that the DP-compliant ablation provides only qualitative (not statistical) support. As written, the paper states in §6 that 'the qualitative conclusions remain unchanged' (Appendix B.1), but this is based on visual inspection of a reduced experimental scope, not on the same statistical test that anchors the main claim.
minor comments (7)
  1. §3.3, Definition 3: 'Eqal Opportunity Difference' should be 'Equal Opportunity Difference'.
  2. §6, Discussion: The sentence beginning 'Overall,Overall, the Pareto-front analysis...' contains a duplicated word.
  3. Figures 2–3: The marker size encoding for ε is helpful, but distinguishing individual ε values is difficult in dense regions. Consider adding a few explicit ε labels on selected points or providing a separate legend table mapping marker sizes to ε values.
  4. Table 2 caption: Clarify that POST is defined as the best score among ROC and EqOdds (this is stated in the text above the table but not in the caption itself, which could cause confusion for readers scanning tables).
  5. §4.2: The BiasOnDemand configuration parameters (Table 3 in Appendix A) use abbreviated names (ly, lmy, thr_supp, etc.) without clear definitions in the main text. A brief glossary or reference to the BiasOnDemand documentation would improve readability.
  6. §B.1: The description of the DP-compliant partitioning is somewhat convoluted. Consider simplifying the explanation or providing a diagram analogous to Figure 1 for this alternative protocol.
  7. §5.1: The statement that LFR 'occasionally collapse[s] one of the target classes' is mentioned briefly and deferred to Appendix B.3, but no quantitative failure rate is given. Reporting the fraction of seeds/configurations where this occurs would strengthen the claim.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the careful reading and the constructive recommendation. The referee raises a single major concern regarding the calibration asymmetry between post-processing and pre/in-processing methods, and its implications for the statistical claim in Table 2. We agree this is an important point and address it below.

read point-by-point responses

  1. Referee: §4.6 and Table 2: The central statistical claim (Claim 2, Table 2) that POST significantly outperforms PRE and IN is validated under the main protocol, where post-processing methods are calibrated on a real, non-private held-out set (20% of data) while pre- and in-processing methods operate solely on DP synthetic training data. This creates a systematic asymmetry: POST methods have access to additional real data that PRE/IN never see. The paper acknowledges this (§4.6) and provides a DP-compliant calibration ablation in Appendix B.1, but the ablation covers only 3 datasets × 1 classifier (Figure 5) and 1 dataset × 3 classifiers (Figure 6) using visual inspection. Critically, the Wilcoxon tests in Table 2—the statistical backbone of the strongest claim—are never re-run under DP-compliant calibration. Given that the effect sizes are small (d̄ = −0.020 vs PRE, −0.029 vs IN), the non-private

    Authors: We fully agree with this concern. The referee is correct that the Wilcoxon tests in Table 2 are conditional on the non-private calibration protocol, and that the DP-compliant ablation in Appendix B.1 currently provides only qualitative (visual) support over a reduced experimental scope. This is a genuine gap between the strength of the claim and the evidence provided under the DP-compliant setting. We will address it as follows in the revised manuscript: (1) We will re-run the full Wilcoxon signed-rank analysis from Table 2 under DP-compliant calibration across all 4 datasets × 3 classifiers × AIM, using the same scalarized fairness–utility score (Equation 1) and the same paired comparison (POST vs PRE, POST vs IN). The DP-compliant calibration pipeline already exists (Appendix B.1) and only needs to be extended to the full experimental grid. We will report the results in a new table alongside Table 2, so that readers can directly compare the non-private and DP-compliant calibration regimes. (2) Regardless of the outcome of the re-run, we will add an explicit statement in the main text (§6, where Claim 2 is introduced) that the statistical validation in Table 2 is conditional on the non-private calibration protocol, and that the DP-compliant analysis is reported separately. This ensures full transparency about the protocol under which each result holds. (3) If the DP-compliant Wilcoxon tests do not reach significance at the same thresholds, we will revise the strength of Claim 2 accordingly and qualify the main-text conclusion to reflect the calibration-protocol dependence. We note that the visual evidence in Appendix B.1 (Figures 5–6) suggests the qualitative ordering is preserved, but we agree that visual inspection of a reduced scope is not a substitute for the full, revision: yes

  2. Referee: calibration data could inflate these results. The authors should either (a) re-run the full Wilcoxon analysis from Table 2 under DP-compliant calibration across all 4 datasets × 3 classifiers, or (b) explicitly state in the main text that the statistical validation in Table 2 is conditional on the non-private calibration protocol and that the DP-compliant ablation provides only qualitative (not statistical) support. As written, the paper states in §6 that 'the qualitative conclusions remain unchanged' (Appendix B.1), but this is based on visual inspection of a reduced experimental scope, not on the same statistical test that anchors the main claim.

    Authors: This is a continuation of the point above, and we agree with the specific characterization: the current statement in §6 that 'the qualitative conclusions remain unchanged' is based on visual inspection of a reduced scope, not on the same statistical test. We will implement both options (a) and (b) as described above. Specifically, we will re-run the full Wilcoxon analysis under DP-compliant calibration (option a), and we will also add the explicit caveat in the main text regardless of the re-run outcome (option b), so that the protocol conditioning is transparent even to readers who do not consult the appendix. We agree that the small effect sizes (d̄ = −0.020 vs PRE, −0.029 vs IN) make it especially important to verify whether the advantage persists when post-processing methods do not have access to non-private calibration data. If the effect sizes shrink or lose significance under DP-compliant calibration, we will report this honestly and adjust the claim's scope. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical benchmark with externally defined methods, metrics, and baselines

full rationale

This paper is an empirical benchmarking study with no theoretical derivations, no fitted parameters repackaged as predictions, and no self-citation chains that are load-bearing for a central claim. The fairness mechanisms (RW, DIR, LFR, EGR, GSR, ROC, EqOdds, CEOP) are standard methods from AIF360 with external citations. The DP synthesizers (AIM, MST) are externally defined via SmartNoise. The fairness metrics (MAD, EOD, SPD) and utility metrics (accuracy, F1) are standard definitions. The four pipeline configurations (Baseline, DP-only, Fair-only, DP+Fair) are compared against each other as external baselines. The Wilcoxon signed-rank tests in Tables 1-2 compare configurations against each other using a scalarized distance metric (Eq. 1) that is defined independently of the results. Self-citations [7, 41, 42] by author Arcolezi are to related but distinct work on local DP and anonymization, not invoked to prove a premise of this paper. The paper's claims are empirical observations from experiments, not derivations from premises that could be circular. The calibration asymmetry concern (post-processing calibrated on non-private data) is a correctness risk, not a circularity issue, and the paper addresses it with an ablation (Appendix B.1). No step in the paper's argument reduces to its inputs by construction.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

No new entities, particles, or forces are introduced. The paper uses existing DP synthesizers, fairness mechanisms, and classifiers from established libraries. All parameters are either swept (epsilon), chosen a priori (trade-off weights), or tuned for a specific classifier (LR hyperparameters). No axioms are invented; all are standard results or domain assumptions with stated justifications.

free parameters (3)
  • Privacy budgets epsilon = {0.05, 0.1, 0.25, 0.5, 0.75, 1, 2, 3, 5, 10, 15, 20}
    Swept over 12 values; not fitted but chosen to cover high/moderate/low privacy regimes per Section 4.5.
  • Trade-off weights w_U, w_F = 0.5, 0.5
    Equal weights for utility and fairness in the scalarized distance metric (Eq. 1), chosen a priori.
  • LR hyperparameters (solver, penalty, l1_ratio, C, max_iter) = saga, elasticnet, 0.5, 0.8, 10000
    Tuned via grid search for Logistic Regression to achieve reasonable utility (Table 4, Appendix A.5). XGBoost and RF use defaults.
axioms (4)
  • standard math DP post-processing property (Proposition 1): downstream operations on DP synthetic data preserve the epsilon-DP guarantee.
    Invoked in Section 3.2 to establish that fairness interventions on DP synthetic data do not weaken privacy. Standard result from Dwork & Roth 2014.
  • domain assumption Marginal-based DP synthesizers (AIM, MST) are representative of high-utility DP synthetic tabular data generation.
    Invoked in Section 4.3 to justify restricting to two synthesizers. Supported by cited benchmarks [32, 51, 52, 54] but limits generalizability.
  • domain assumption Binary classification with binary protected attributes is the appropriate experimental scope.
    Invoked in Section 4.2 to justify the task formulation. Motivated by AIF360 framework constraints and standardization; limits applicability to multi-class/intersectional settings.
  • ad hoc to paper Default hyperparameters (except LR) provide fair cross-method comparison.
    Invoked in Section 4.6 to ensure comparable conditions. The hyperparameter sensitivity ablation (Appendix B.2) only covers EGR/GSR, leaving other methods' sensitivity untested.

pith-pipeline@v1.1.0-glm · 44547 in / 2739 out tokens · 391171 ms · 2026-07-09T09:45:14.438967+00:00 · methodology

0 comments
read the original abstract

Machine learning models are increasingly deployed in high-stakes domains, raising concerns about both privacy and fairness. Differential Privacy (DP) has become a gold standard for privacy-preserving data analysis, while fairness-aware mechanisms aim to mitigate discrimination against underrepresented groups. However, these objectives can conflict: DP often amplifies disparities across demographic groups, and little is known about whether established fairness interventions remain effective under DP constraints. In this work, we present, to our knowledge, the first systematic evaluation of fairness interventions on differentially private synthetic tabular data. Our benchmark centers on the Adaptive Iterative Mechanism (AIM), identified as the state-of-the-art marginal-based DP synthesizer (Cormode et al. 2025). We thus evaluate fairness interventions across four datasets, multiple group fairness metrics, and three categories of mitigation strategies (pre-processing, in-processing, and post-processing) under a wide range of privacy budgets. We compare four pipeline configurations: (Baseline) training on original data; (DP-only) training on DP synthetic data; (Fair-only) applying fairness mechanisms on original data; and (DP+Fair) combining fairness mechanisms with DP synthetic data. Our results demonstrate that while DP alone can degrade both utility and fairness, applying fairness interventions can partially restore equitable outcomes. Among them, post-processing methods tend to provide more stable fairness-utility trade-offs across privacy budgets and synthesizers, achieving strong fairness improvements while preserving competitive utility relative to other intervention stages. We release all code, data, and experimental artifacts in an open-source repository to ensure full reproducibility and to support future research on the privacy-fairness-utility trade-off.

Figures

Figures reproduced from arXiv: 2607.07471 by H\'eber H. Arcolezi, Vin\'icius Gabriel Angelozzi.

Figure 1
Figure 1. Figure 1: Overview of our benchmark design. We evaluate fairness-aware learning mechanisms applied at three intervention [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Accuracy–fairness trade-off under the AIM synthesizer across four datasets. Each subfigure reports accuracy (ACC) [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: F1-score–fairness trade-offs under the AIM synthesizer across four datasets. Each subfigure reports F1-score versus [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Accuracy–fairness trade-offs under the AIM synthesizer across the Adult dataset and all tested ML models (XGBoost, [PITH_FULL_IMAGE:figures/full_fig_p013_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Accuracy–fairness trade-off under the AIM synthesizer across three real-world datasets (Adult, Compas and AC [PITH_FULL_IMAGE:figures/full_fig_p018_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Accuracy–fairness trade-off under the AIM synthesizer across the Adult dataset and three different classifiers (Logistic [PITH_FULL_IMAGE:figures/full_fig_p019_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Accuracy–fairness trade-off under the AIM synthesiser across the Compas dataset, two fairness mechanisms and [PITH_FULL_IMAGE:figures/full_fig_p019_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Accuracy–fairness trade-off under the MST synthesizer across four datasets with the XGBoost classifier. Each subfigure [PITH_FULL_IMAGE:figures/full_fig_p021_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Accuracy–fairness trade-off under the AIM synthesizer across four datasets with the Logistic Regression classifier. [PITH_FULL_IMAGE:figures/full_fig_p022_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: F1–fairness trade-off under the AIM synthesizer across four datasets with the Logistic Regression classifier. The [PITH_FULL_IMAGE:figures/full_fig_p023_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Accuracy–fairness trade-off under the AIM synthesizer across four datasets with the Random Forest classifier. Each [PITH_FULL_IMAGE:figures/full_fig_p024_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Accuracy–fairness trade-off under the MST synthesizer across configurations 1, 2, and 3 of the BoD dataset with the [PITH_FULL_IMAGE:figures/full_fig_p025_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Accuracy–fairness trade-off under the MST synthesizer across configurations 4, 5, and 6 of the BoD dataset with the [PITH_FULL_IMAGE:figures/full_fig_p026_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Accuracy–fairness trade-off under the AIM synthesizer across configurations 1, 2, and 3 of the BoD dataset with the [PITH_FULL_IMAGE:figures/full_fig_p027_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Accuracy–fairness trade-off under the AIM synthesizer across configurations 4, 5, and 6 of BoD dataset with the [PITH_FULL_IMAGE:figures/full_fig_p028_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Accuracy–fairness trade-off under the AIM synthesizer across configurations 1, 2, and 3 of the BoD dataset with [PITH_FULL_IMAGE:figures/full_fig_p029_16.png] view at source ↗
Figure 17
Figure 17. Figure 17: Accuracy–fairness trade-off under the AIM synthesizer across configurations 4, 5, and 6 of the BoD dataset with [PITH_FULL_IMAGE:figures/full_fig_p030_17.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

66 extracted references · 66 canonical work pages · 6 internal anchors

  1. [1]

    Tumult Labs

    2024. Tumult Labs. https://www.tmlt.io/differentially-private-synthetic-data

    work page 2024

  2. [2]

    2024. YData. https://ydata.ai/products/synthesizer.html

    work page 2024

  3. [3]

    Jan Aalmoes, Vasisht Duddu, and Antoine Boutet. 2025. On the Alignment of Group Fairness with Attribute Privacy. InInternational Conference on Web Information Systems Engineering. Springer, 333–348. https://doi.org/10.1007/978- 981-96-0567-5_24

    work page doi:10.1007/978- 2025

  4. [4]

    Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang

    Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep Learning with Differential Privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security(Vienna, Austria)(CCS ’16). Association for Computing Machinery, New York, NY, USA, 308–318. https://doi.org/10.1145/297...

    work page doi:10.1145/2976749.2978318 2016

  5. [5]

    Alekh Agarwal, Alina Beygelzimer, Miroslav Dudik, John Langford, and Hanna Wallach. 2018. A Reductions Approach to Fair Classification. InProceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 80), Jennifer Dy and Andreas Krause (Eds.). PMLR, 60–69. https://proceedings.mlr.press/v80/agarwal18a.html

    work page 2018

  6. [6]

    Julia Angwin, Jeff Larson, Surya Mattu, and Lauren Kirchner. 2022. Machine bias. InEthics of data and analytics. Auerbach Publications, 254–264

    work page 2022

  7. [7]

    Héber H Arcolezi, Mina Alishahi, Adda-Akram Bendoukha, and Nesrine Kaaniche

    work page

  8. [8]

    InECAI 2025

    Fair Play for Individuals, Foul Play for Groups? Auditing Anonymization’s Impact on ML Fairness. InECAI 2025. IOS Press, 1009–1018. https://doi.org/10. 3233/FAIA250909

    work page 2025

  9. [9]

    Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. 2019. Differential privacy has disparate impact on model accuracy.Advances in neural information processing systems32 (2019)

    work page 2019

  10. [10]

    2023.Fairness and Machine Learning: Limitations and Opportunities

    Solon Barocas, Moritz Hardt, and Arvind Narayanan. 2023.Fairness and Machine Learning: Limitations and Opportunities. MIT Press

    work page 2023

  11. [11]

    Joachim Baumann, Alessandro Castelnovo, Riccardo Crupi, Nicole Inverardi, and Daniele Regoli. 2023. Bias on Demand: A Modelling Framework That Generates Synthetic Data With Bias. InProceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency(Chicago, IL, USA)(FAccT ’23). Association for Computing Machinery, New York, NY, USA, 1002–...

    work page arXiv 2023

  12. [12]

    Barry Becker and Ronny Kohavi. 1996. Adult. UCI Machine Learning Repository. DOI: https://doi.org/10.24432/C5XW20

    work page doi:10.24432/c5xw20 1996

  13. [13]

    Rachel KE Bellamy, Kuntal Dey, Michael Hind, Samuel C Hoffman, Stephanie Houde, Kalapriya Kannan, Pranay Lohia, Jacquelyn Martino, Sameep Mehta, Aleksandra Mojsilovic, et al . 2018. AI Fairness 360: An extensible toolkit for detecting, understanding, and mitigating unwanted algorithmic bias

    work page 2018

  14. [14]

    Leo Breiman. 2001. Random forests.Machine learning45, 1 (2001), 5–32

    work page 2001

  15. [15]

    Blake Bullwinkel, Kristen Grabarz, Lily Ke, Scarlett Gong, Chris Tanner, and Joshua Allen. 2022. Evaluating the fairness impact of differentially private syn- thetic data.arXiv preprint arXiv:2205.04321(2022)

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  16. [16]

    Toon Calders, Faisal Kamiran, and Mykola Pechenizkiy. 2009. Building Classifiers with Independency Constraints. In2009 IEEE International Conference on Data Mining Workshops. 13–18. https://doi.org/10.1109/ICDMW.2009.83

    work page doi:10.1109/icdmw.2009.83 2009

  17. [17]

    Hongyan Chang and Reza Shokri. 2021. On the Privacy Risks of Algorithmic Fairness. In2021 IEEE European Symposium on Security and Privacy (EuroS&P). 292–303. https://doi.org/10.1109/EuroSP51992.2021.00028

    work page doi:10.1109/eurosp51992.2021.00028 2021

  18. [18]

    Tianqi Chen and Carlos Guestrin. 2016. Xgboost: A scalable tree boosting system. InProceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining. 785–794

    work page 2016

  19. [19]

    CNIL. 2026. AI system development: CNIL’s recommendations to comply with the GDPR. https://www.cnil.fr/en/ai-system-development-cnils-recommendations- comply-gdpr

    work page 2026

  20. [20]

    1999.Practical nonparametric statistics

    William Jay Conover. 1999.Practical nonparametric statistics. john wiley & sons

    work page 1999

  21. [21]

    Graham Cormode, Shripad Gade, Samuel Maddock, and Enayat Ullah. 2025. Synthetic Tabular Data: Methods, Attacks and Defenses.Proc. VLDB Endow.18, 12 (Sept. 2025), 5448–5450. https://doi.org/10.14778/3750601.3750692

    work page doi:10.14778/3750601.3750692 2025

  22. [22]

    Frances Ding, Moritz Hardt, John Miller, and Ludwig Schmidt. 2021. Retiring adult: New datasets for fair machine learning.Advances in Neural Information Processing Systems34 (2021)

    work page 2021

  23. [23]

    Cynthia Dwork, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Richard Zemel. 2012. Fairness through awareness. InProceedings of the 3rd Innovations in Theoretical Computer Science Conference (ITCS ’12). Association for Comput- ing Machinery, New York, NY, USA, 214–226. https://doi.org/10.1145/2090236. 2090255

    work page doi:10.1145/2090236 2012

  24. [24]

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Cali- brating Noise to Sensitivity in Private Data Analysis. InTheory of Cryptography, Shai Halevi and Tal Rabin (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 265–284

    work page 2006

  25. [25]

    Cynthia Dwork and Aaron Roth. 2014. The algorithmic foundations of differential privacy.Foundations and Trends®in Theoretical Computer Science9, 3–4 (2014), 211–407

    work page 2014

  26. [26]

    European Parliament and Council. 2024. Regulation (EU) 2024/1689 of the Euro- pean Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and...

    work page 2024

  27. [27]

    Tom Farrand, Fatemehsadat Mireshghallah, Sahib Singh, and Andrew Trask

    work page

  28. [28]

    InProceedings of the 2020 workshop on privacy-preserving machine learning in practice

    Neither private nor fair: Impact of data imbalance on utility and fairness in differential privacy. InProceedings of the 2020 workshop on privacy-preserving machine learning in practice. 15–19

    work page 2020

  29. [29]

    Friedler, John Moeller, Carlos Scheidegger, and Suresh Venkatasubramanian

    Michael Feldman, Sorelle A. Friedler, John Moeller, Carlos Scheidegger, and Suresh Venkatasubramanian. 2015. Certifying and Removing Disparate Impact. InProceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD ’15). Association for Computing Machinery, New York, NY, USA, 259–268. https://doi.org/10.1145/27832...

    work page doi:10.1145/2783258.2783311 2015

  30. [30]

    Ferdinando Fioretto, Cuong Tran, Pascal Van Hentenryck, and Keyu Zhu. 2022. Differential Privacy and Fairness in Decisions and Learning Tasks: A Survey. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelli- gence. IJCAI. https://doi.org/10.24963/ijcai.2022/766

    work page doi:10.24963/ijcai.2022/766 2022

  31. [31]

    FSA. 2023. Feedback Statement on Synthetic Data Call for Input. https://www.fca.org.uk/publications/feedback-statements/fs23-1-feedback- statement-synthetic-data-call-for-input

    work page 2023

  32. [32]

    Truly Anonymous

    Georgi Ganev and Emiliano De Cristofaro. 2025. The Inadequacy of Similarity- Based Privacy Metrics: Privacy Attacks Against “Truly Anonymous” Synthetic Datasets. In2025 IEEE Symposium on Security and Privacy (SP). 4007–4025. https: //doi.org/10.1109/SP61157.2025.00218

    work page doi:10.1109/sp61157.2025.00218 2025

  33. [33]

    Georgi Ganev, Bristena Oprisanu, and Emiliano De Cristofaro. 2022. Robin hood and matthew effects: Differential privacy has disparate impact on synthetic data. InInternational Conference on Machine Learning. PMLR, 6944–6959

    work page 2022

  34. [34]

    Georgi Ganev, Kai Xu, and Emiliano De Cristofaro. 2024. Graphical vs. Deep Generative Models: Measuring the Impact of Differentially Private Mechanisms and Budgets on Utility. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security(Salt Lake City, UT, USA)(CCS ’24). Association for Computing Machinery, New York, NY, USA,...

    work page doi:10.1145/3658644.3690215 2024

  35. [35]

    Matteo Giomi, Franziska Boenisch, Christoph Wehmeyer, and Borbála Tasnádi

    work page

  36. [36]

    Proceedings on Privacy Enhancing Technologies2 (2023), 312–328

    A Unified Framework for Quantifying Privacy Risk in Synthetic Data. Proceedings on Privacy Enhancing Technologies2 (2023), 312–328

    work page 2023

  37. [37]

    Moritz Hardt, Eric Price, and Nati Srebro. 2016. Equality of opportunity in supervised learning.Advances in neural information processing systems29 (2016)

    work page 2016

  38. [38]

    Yuzheng Hu, Fan Wu, Qinbin Li, Yunhui Long, Gonzalo Munilla Garrido, Chang Ge, Bolin Ding, David Forsyth, Bo Li, and Dawn Song. 2024. SoK: Privacy- Preserving Data Synthesis. In2024 IEEE Symposium on Security and Privacy (SP). 4696–4713. https://doi.org/10.1109/SP54263.2024.00002

    work page doi:10.1109/sp54263.2024.00002 2024

  39. [39]

    James Jordon, Lukasz Szpruch, Florimond Houssiau, Mirko Bottarelli, Giovanni Cherubin, Carsten Maple, Samuel N Cohen, and Adrian Weller. 2022. Synthetic Data–what, why and how?arXiv preprint arXiv:2205.03257(2022)

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  40. [40]

    Faisal Kamiran, Asim Karim, and Xiangliang Zhang. 2012. Decision theory for discrimination-aware classification. In2012 IEEE 12th international conference on data mining. IEEE, 924–929

    work page 2012

  41. [41]

    Soyeon Kim, Yuji Roh, Geon Heo, and Steven Euijong Whang. 2025. PFGuard: A Generative Framework with Privacy and Fairness Safeguards. InThe Thirteenth International Conference on Learning Representations

    work page 2025

  42. [42]

    Tongyu Liu, Ju Fan, Guoliang Li, Nan Tang, and Xiaoyong Du. 2024. Tabular data synthesis with generative adversarial networks: design space and optimizations. The VLDB Journal33, 2 (2024), 255–280. 14 Where to Intervene? Benchmarking Fairness-Aware Learning on Differentially Private Synthetic Tabular Data Proceedings on Privacy Enhancing Technologies YYYY(X)

    work page 2024

  43. [43]

    Andrew Lowy, Zhuohang Li, Jing Liu, Toshiaki Koike-Akino, Kieran Parsons, and Ye Wang. 2024. Why does differential privacy with large epsilon defend against practical membership inference attacks?arXiv preprint arXiv:2402.09540(2024)

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  44. [44]

    Karima Makhlouf, Heber H Arcolezi, Sami Zhioua, Ghassen Ben Brahim, and Catuscia Palamidessi. 2024. On the impact of multi-dimensional local differential privacy on fairness.Data Mining and Knowledge Discovery38, 4 (2024), 2252–2275. https://doi.org/10.1007/s10618-024-01031-0

    work page doi:10.1007/s10618-024-01031-0 2024

  45. [45]

    Arcolezi, and Catuscia Palamidessi

    Karima Makhlouf, Tamara Stefanović, Héber H. Arcolezi, and Catuscia Palamidessi. 2024. A Systematic and Formal Study of the Impact of Local Dif- ferential Privacy on Fairness: Preliminary Results. In2024 IEEE 37th Computer Security Foundations Symposium (CSF). 1–16. https://doi.org/10.1109/CSF61375. 2024.00039

    work page doi:10.1109/csf61375 2024

  46. [46]

    Ryan McKenna, Gerome Miklau, and Daniel Sheldon. 2021. Winning the NIST contest: A scalable and general approach to differentially private synthetic data. arXiv preprint arXiv:2108.04978(2021)

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  47. [47]

    Ryan McKenna, Brett Mullins, Daniel Sheldon, and Gerome Miklau. 2022. AIM: an adaptive and iterative mechanism for differentially private synthetic data.Proc. VLDB Endow.15, 11 (July 2022), 2599–2612. https://doi.org/10.14778/3551793. 3551817

    work page doi:10.14778/3551793 2022

  48. [48]

    Ryan McKenna, Daniel Sheldon, and Gerome Miklau. 2019. Graphical-model based estimation and inference for differential privacy. InInternational Conference on Machine Learning. PMLR, 4435–4444

    work page 2019

  49. [49]

    2023.Probabilistic machine learning: Advanced topics

    Kevin P Murphy. 2023.Probabilistic machine learning: Advanced topics. MIT press

    work page 2023

  50. [50]

    Nicolas Papernot, Shuang Song, Ilya Mironov, Ananth Raghunathan, Kunal Tal- war, and Ulfar Erlingsson. 2018. Scalable Private Learning with PATE. InInterna- tional Conference on Learning Representations

    work page 2018

  51. [51]

    Mayana Pereira, Meghana Kshirsagar, Sumit Mukherjee, Rahul Dodhia, Juan Lavista Ferres, and Rafael de Sousa. 2024. Assessment of differentially private synthetic data for utility and fairness in end-to-end machine learning pipelines for tabular data.PLOS ONE19, 2 (Feb. 2024), e0297271. https://doi.org/10.1371/ journal.pone.0297271

    work page 2024

  52. [52]

    Dana Pessach and Erez Shmueli. 2022. A Review on Fairness in Machine Learning. ACM Comput. Surv.55, 3, Article 51 (Feb. 2022), 44 pages. https://doi.org/10. 1145/3494672

    work page 2022

  53. [53]

    Geoff Pleiss, Manish Raghavan, Felix Wu, Jon Kleinberg, and Kilian Q Wein- berger. 2017. On Fairness and Calibration. InAdvances in Neural Infor- mation Processing Systems, I. Guyon, U. Von Luxburg, S. Bengio, H. Wal- lach, R. Fergus, S. Vishwanathan, and R. Garnett (Eds.), Vol. 30. Curran Associates, Inc. https://proceedings.neurips.cc/paper_files/paper/...

    work page 2017

  54. [54]

    Zhaozhi Qian, Rob Davis, and Mihaela Van Der Schaar. 2023. Synthcity: a benchmark framework for diverse use cases of tabular synthetic data.Advances in neural information processing systems36 (2023), 3173–3188

    work page 2023

  55. [55]

    Lucas Rosenblatt, Bernease Herman, Anastasia Holovenko, Wonkwon Lee, Joshua Loftus, Elizabeth McKinnie, Taras Rumezhak, Andrii Stadnik, Bill Howe, and Julia Stoyanovich. 2023. Epistemic Parity: Reproducibility as an Evaluation Metric for Differential Privacy.Proc. VLDB Endow.16, 11 (July 2023), 3178–3191. https://doi.org/10.14778/3611479.3611517

    work page doi:10.14778/3611479.3611517 2023

  56. [56]

    Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. 2022. Synthetic Data – Anonymisation Groundhog Day. In31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 1451–1468. https: //www.usenix.org/conference/usenixsecurity22/presentation/stadler

    work page 2022

  57. [57]

    Yuchao Tao, Ryan McKenna, Michael Hay, Ashwin Machanavajjhala, and Gerome Miklau. 2021. Benchmarking differentially private synthetic data generation algorithms.arXiv preprint arXiv:2112.09238(2021)

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  58. [58]

    Reihaneh Torkzadehmahani, Peter Kairouz, and Benedict Paten. 2019. Dp-cgan: Differentially private synthetic data and label generation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops. 0–0

    work page 2019

  59. [59]

    Archit Uniyal, Rakshit Naidu, Sasikanth Kotti, Sahib Singh, Patrik Joslin Kenfack, Fatemehsadat Mireshghallah, and Andrew Trask. 2021. Dp-sgd vs pate: Which has less disparate impact on model accuracy?arXiv preprint arXiv:2106.12576 (2021)

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  60. [60]

    Census Bureau

    U.S. Census Bureau. 2023. 2023 ACS 1-Year Public Use Microdata Sample (PUMS) Code Lists. https://www2.census.gov/programs-surveys/acs/tech_docs/pums/ code_lists/ACSPUMS2023CodeLists.xls. Accessed: 2025-09-06

    work page 2023

  61. [61]

    Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni

    work page

  62. [62]

    Modeling tabular data using conditional gan.Advances in neural information processing systems32 (2019)

    work page 2019

  63. [63]

    Kai Yao and Marc Juarez. 2025. SoK: What Makes Private Learning Unfair?. In2025 IEEE Conference on Secure and Trustworthy Machine Learning. 841–857. https://doi.org/10.1109/SaTML64287.2025.00052

    work page doi:10.1109/satml64287.2025.00052 2025

  64. [64]

    Zexi Yao, Nataša Krčo, Georgi Ganev, and Yves-Alexandre de Montjoye. 2025. The DCR delusion: measuring the privacy risk of synthetic data. InEuropean Symposium on Research in Computer Security. Springer, 469–487. https://doi.org/ 10.1007/978-3-032-07884-1_24

    work page doi:10.1007/978-3-032-07884-1_24 2025

  65. [65]

    Rich Zemel, Yu Wu, Kevin Swersky, Toni Pitassi, and Cynthia Dwork. 2013. Learning fair representations. InInternational conference on machine learning. PMLR, 325–333

    work page 2013

  66. [66]

    Male”sexto 1 and others to 0; (ii) maps “White

    Jun Zhang, Graham Cormode, Cecilia M. Procopiuc, Divesh Srivastava, and Xiaokui Xiao. 2017. PrivBayes: Private Data Release via Bayesian Networks. ACM Trans. Database Syst.42, 4, Article 25 (Oct. 2017), 41 pages. https://doi.org/ 10.1145/3134428 A Classifiers, Datasets, & Data Pre-Processing This section provides complementary details to support the repro...

    work page doi:10.1145/3134428 2017