Pith. sign in

REVIEW 3 major objections 4 minor 76 references

Manipulation-Proof Oblivious Audits against Deceptive Model Providers

T0 review · 3 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A PIR-based audit protocol hides which queries count, forcing a deceptive provider to falsify a large fraction of the candidate set rather than a small known audit set.

desk verdict Clever protocol idea, but the 'must falsify' claim outruns the proof; worth reviewing after the necessity gap is fixed. read the letter →

arxiv 2608.04365 v1 pith:TXDXPYXM submitted 2026-08-05 cs.LG cs.CRcs.CY

Augustin Godinot , Sofiane Azogagh , Julien Ferry , Sébastien Gambs This is my paper · ORCID
classification cs.LGcs.CRcs.CY
keywords algorithmicauditingfairnessdemographicparityauditmanipulationprivateinformationretrievaldetectionobliviousqueryingmodelgovernance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to make algorithmic fairness audits harder to game when the audited company can see which queries count. It introduces R²esPIR, a protocol in which the provider labels a large candidate set and the auditor uses Private Information Retrieval to obtain labels for a hidden audit subset, so the provider never knows which points are actually scored. The central result is a lower bound on manipulation effort: to pass a demographic-parity audit with probability at least 1−δ, a provider whose model is unfair on the candidate set must falsify a number of predictions that scales with the candidate set's smallest protected group, not the small audit set's. This raises both the cost and the detectability of manipulation, and the reported experiments on credit, recidivism, and hate-speech datasets show detection probabilities roughly doubling for the same number of verification queries.

What carries the argument

The load-bearing object is the hidden audit set. R²esPIR (Robust Research audit APIs enabled by Private Information Retrieval) works in three steps: both parties agree on a candidate set $C$; the provider privately labels every point in $C$ and commits to that label database; the auditor samples an audit set $S\subseteq C$ uniformly and retrieves $h(S)$ through VeriSimplePIR, a verifiable PIR scheme that prevents the provider from changing labels after commitment. Two mathematical ingredients convert this hiding into a manipulation cost: a concentration inequality for sampling without replacement, which bounds $|d_S-d_C|$ by $\sqrt{2\ln(4/\delta)/n_{\min}}$ with probability at least $1-\delta$, and the sensitivity bound that a single output flip changes $d_C$ by at most $1/N_{\min}$. Together they imply that the provider must make the whole candidate set look fair rather than patch the known audit set.

What would settle it

For a small concrete candidate set and audit size, enumerate every subset the auditor could draw and every strategy in which the provider flips exactly $m_{\mathrm{R^2esPIR}}-1$ predictions chosen to minimize the candidate gap; if any such strategy passes with probability at least $1-\delta$, then Theorem 1's claimed lower bound is false.

Watch

Extended reading notes

Core claim

The paper's central claim is that hiding the audit set inside a larger candidate set converts a local patching problem into a global one. Theorem 1 states that a provider who would fail on the candidate set with gap $d_{C,\mathrm{true}}$ must flip at least $\left\lceil \left(|d_{C,\mathrm{true}}|-\varepsilon + \sqrt{2\ln(4/\delta)/n_{\min}}\right) N_{\min}\right\rceil$ predictions in $C$ to pass with probability at least $1-\delta$, versus the $\lceil(|d_{\mathrm{true}}|-\varepsilon)n_{\min}\rceil$ flips needed when the audit set is known. The extra square-root term comes from concentration of the sampled audit-set gap around the candidate-set gap, so the provider must push the candidate gap down to $\varepsilon$ minus that margin. The proof combines a bound on how much one output flip can change the gap, namely at most $1/N_{\min}$, with a sufficient condition relating the candidate-set gap to the observed audit-set gap.

Load-bearing premise

The lower bound assumes that meeting the paper's sufficient condition is the only way for a provider to pass with high probability; if a provider whose hidden-set fairness gap is slightly above that threshold can still pass, the 'must flip this many' conclusion is too strong.

Editorial extensions

If this is right

  • Faking fairness under R²esPIR requires altering a number of predictions that scales with the candidate set's smallest protected group, so enlarging and rebalancing $C$ directly multiplies the attacker's cost.
  • For a fixed number of verification canaries, the detection probability rises as the required flip count grows, and the reported experiments show detection probabilities roughly doubling compared with a vanilla black-box audit.
  • The auditor's added cost stays small: a single lightweight PIR query per audited point, with measured online times on the order of milliseconds for small databases and seconds for an 8 GiB label database.
  • The protocol leaves the provider's model and inference pipeline untouched; the provider's only obligation is to label the candidate set and answer PIR queries.
  • A finite-population refinement of the bound gives a smaller required margin when the audit set covers a large share of a protected group, so the overhead of the protocol shrinks as the audit becomes more thorough.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The protocol's logic suggests that candidate-set design, not just cryptography, carries the guarantee: an auditor should negotiate a large and group-balanced $C$, because the manipulation cost scales with $N_{\min}$ while the detection margin scales with $n_{\min}$.
  • The same hidden-set recipe should transfer to any audited quantity that is a difference of two empirical rates with bounded one-flip sensitivity, such as equalized odds or predictive parity; the paper sketches equal opportunity, but the general pattern is to replace the protected-group sizes with the relevant conditioning-stratum sizes.
  • An empirical next step would be to measure the canary indistinguishability parameter $q$ directly on deployed APIs, since the detection probability formula makes $q$ the main unknown between the theoretical guarantee and real-world detection.
  • Because VeriSimplePIR commits the provider to a label database before the audit set is drawn, R²esPIR effectively turns an interactive audit into a pre-registered commitment, which suggests hybrid designs where the provider commits first and the auditor later randomizes the audit subset without the provider observing it.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes R²esPIR, an audit protocol that hides the actual audit set S inside a larger candidate set C using private information retrieval. The provider is required to label all of C, while the auditor later retrieves labels on a uniformly random subset S and tests demographic parity. The authors claim that this forces a deceptive provider to flip substantially more predictions than in a vanilla black-box audit, and they support this claim with a concentration-based analysis (Theorems 1 and 2), a finite-population refinement (Theorem 4), an extension to equal opportunity (Theorem 3), and experiments on CCD, COMPAS, and HateDay using a VeriSimplePIR implementation.

Significance. If the central claim were fully established, the paper would make a useful contribution: it offers a practical, model-agnostic mechanism for increasing the cost and detectability of audit manipulation, it integrates verifiable stateful PIR with known performance characteristics, and it is accompanied by public code. The concentration derivation in Theorem 2 is correct and uses standard bounds, and the extension to equal opportunity is clean. However, the headline 'must falsify' claim is currently supported only for a sufficient condition, and the flip lower bound depends on a random quantity that is unavailable to the provider when it commits its flips; these are substantive gaps that require additional work rather than mere polishing.

major comments (3)
  1. [Section 4.3, Theorem 1] The abstract's central claim that a deceptive provider under R²esPIR 'must falsify a significantly larger number of responses' is not established by the proof of Theorem 1. Theorem 2, which the proof invokes, provides only a sufficient condition for passing: if |d_C| ≤ ε − γ then Pr(|d_S| ≤ ε | n0, n1) ≥ 1 − δ. Theorem 1 counts the flips needed to reach this sufficient condition, but no converse is proved: a provider whose post-manipulation candidate-set gap lies in (ε − γ, ε + γ] may still pass with probability at least 1 − δ because the Hoeffding/Serfling bound is not tight. Therefore the quantity in Eq. (4) is a lower bound on flips needed to satisfy a sufficient condition, not a lower bound on flips needed to pass the audit. The manuscript should either prove a matching necessity direction (e.g., via an anti-concentration argument) or consistently phrase the result as a guarantee relative to the sufficient condition rather than as a 'must falsify' lower bound.
  2. [Section 4.3, Theorem 1] The lower bound in Eq. (4) depends on n_min, the realized smallest protected-group size of the randomly sampled audit set S. Under the protocol in Algorithm 2, the provider commits to labels on all of C before S is sampled, so n_min is not known to the provider when it chooses its flips. Consequently, Eq. (4) does not describe a deterministic strategy guarantee; different realizations of S yield different claimed thresholds. The paper itself acknowledges in Section 5 that the bound depends on 'the realized value of n_min,' but the theorem statement does not supply the required high-probability lower bound on n_min. To make the claim operational, the authors should add a concentration argument for n_min under uniform sampling without replacement (or use a worst-case lower bound derived from N_min, N, and n) and state Theorem 1 unconditionally in terms of that bound.
  3. [Section 5, Table 3] Table 3 labels m_vanilla and m_R²esPIR as the 'number of output flips required' and the surrounding text repeatedly states that R²esPIR increases the number of required output flips. Because Proposition 1 is a genuine deterministic lower bound but Theorem 1 is only a lower bound on flips needed to meet a sufficient condition, the comparison in Table 3 is not a comparison of minimal manipulation costs. The experimental conclusions remain meaningful as an illustration of the sufficient-condition-based bound, but as written the 'required' language goes beyond what the theorems prove. Please either add the missing converse or relabel the experimental quantity, for example as 'flips needed to reach the sufficient condition of Theorem 1.'
minor comments (4)
  1. [Algorithms 1 and 2] Algorithm 1 and Algorithm 2 test 'd_S < ε' while the surrounding text and Theorem 2 use '|d_S| ≤ ε'; these should be aligned to avoid ambiguity about boundary behavior.
  2. [Section 4.3, Theorem 1 statement] The statement 'it suffices for the provider to flip at least [m]' is logically inverted: the proof shows that reaching the sufficient condition requires at least m flips, not that flipping at least m arbitrary predictions suffices to pass. The statement should be reworded accordingly.
  3. [Section 3.2, Eq. (3)] The role of q in Eq. (3) is unclear: the text says that conditional on being effectively present a canary is modified with probability m/n, but the formula includes the factor q m/n. The generative model for q and for canary inclusion should be stated explicitly so that Eq. (3) follows from the definition.
  4. [Section 4.1] The phrase 'Algorithm 2, algorithm 2' appears twice in the step descriptions and seems to be a typo; it likely refers to specific lines of Algorithm 2 and should be corrected.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: Theorem 1 is derived from external Hoeffding/Serfling concentration bounds and an elementary flip-sensitivity calculation; the cited prior work is context, not a premise.

full rationale

I traced the derivation of the main guarantee (Theorem 1) back to its inputs. The proof of Theorem 1 explicitly reduces to Theorem 2, whose proof applies finite-population Hoeffding/Serfling bounds to p_{a,S} around p_{a,C} and then uses a triangle inequality and union bound; this is an external probabilistic result, not a restatement of the target claim. The per-flip effect on d_C is bounded by 1/N_min using the same rate-decomposition argument as Proposition 1, applied to the candidate set rather than the audit set; no fitted parameter is renamed as a prediction, and no equation is assumed that is definitionally equal to the conclusion. The self-citations (Garcia Bourrée et al. 2025, which shares an author with the present paper) are used as background on manipulation-proof auditing and as a comparison point, but the proof does not rely on that work's conclusions; the load-bearing ingredients are Hoeffding (1963) and Serfling (1974), which are independent external results. VeriSimplePIR is cited for its cryptographic properties and is not used to derive the manipulation bound. I therefore find no circular step. The important caveat is a logical-strength issue rather than circularity: Theorem 1's abstract-level 'must falsify' wording overstates what the proof establishes, since Theorem 2 gives only a sufficient condition for passing and the paper never proves the matching necessity; the paper itself flags in Section 5 that the bound is an analytical characterization depending on the realized n_min, not an operational recipe. These caveats reduce confidence in the headline but do not make the derivation equivalent to its inputs.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

No new physical or mathematical entities are postulated; R²esPIR is a protocol, not an entity, and canaries are a known auditing tool.

free parameters (2)
  • effective target gap for best-effort manipulation = 0
    Section 5 replaces the unattainable sufficient target ε - γ with a target of 0 to compute manipulation counts when ε - γ < 0. This choice affects Table 3 numbers but not the theoretical bound.
  • canary indistinguishability probability q = 0.8
    Chosen in Section 5 and Figure 1 for computing detection probabilities (Equation 3). It is a modeling parameter, not measured or fitted, and the reported detection percentages depend on it.
assumptions (5)
  • standard math Hoeffding and Serfling inequalities for sampling without replacement
    Invoked in Theorem 2 and Appendix B to bound |d_S - d_C| conditional on n_0, n_1.
  • domain assumption Computational hardness of Learning With Errors (LWE)
    The query-hiding property of VeriSimplePIR relies on LWE, cited to Regev (2009); not proved in this paper.
  • domain assumption Adversary can arbitrarily flip any output at unit cost
    Section 3.2 defines manipulation as arbitrary output flipping; the lower bounds are valid for any input-output mapping under this model.
  • domain assumption Candidate set C is representative of the data distribution
    Section 4.1 and Section 6.2 state that guarantees assume C captures the provider's operational domain; otherwise passing the audit may not imply fairness outside C.
  • domain assumption Canaries remain indistinguishable with probability q
    Equation (3) models detection through a catch-all probability q; this is a black-box simplification of external verification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Manipulation-Proof Oblivious Audits against Deceptive Model Providers." pith.science (2026). https://pith.science/paper/TXDXPYXM

@misc{pith2026260804365,
  author       = {Pith},
  title        = {Pith review of: Manipulation-Proof Oblivious Audits against Deceptive Model Providers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TXDXPYXM}},
  note         = {Machine review of arXiv:2608.04365}
}
read the original abstract

Audits have emerged as a critical instrument for algorithmic governance, providing a mechanism for external scrutiny and governance of machine learning models. However, ensuring the integrity of such assessments remains a challenging issue. For instance in regulatory contexts, audits are typically declared or easily detected, thus enabling model providers to manipulate the process, whether intentionally or inadvertently. This vulnerability is particularly acute in the context of fairness evaluations, in which providers can often infer sensitive attributes and strategically equalize allocation rates between groups to satisfy fairness metrics. In this paper, we introduce a novel audit protocol designed to significantly increase the post-audit detectability of such manipulations by enabling the auditor to query the model in an oblivious manner. Our approach leverages a Private Information Retrieval mechanism to require the provider to label a large set of instances, while preventing it from knowing which subset will ultimately be used for the audit. The protocol is efficient, imposes minimal overhead on the auditor, and requires no modification to the audited model, its training procedure, or its inference pipeline. We provide theoretical guarantees showing that, under this protocol, a provider attempting to hide unfairness must falsify a significantly larger number of responses, thereby increasing both the difficulty and the likelihood of detection of manipulation. Experimental results across representative audit scenarios confirm the effectiveness and practicality of our approach.

Figures

Figures reproduced from arXiv: 2608.04365 by the authors.

Figure 1
Figure 1. Illustration of our theoretical bounds on manipulation difficulty for a vanilla black-box audit and for R [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. Probability of manipulation detection for a subset [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. The interaction between the auditor and the provider based on the SimplePIR protocol (Henzinger et al. 2023) and [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

76 extracted references · 65 canonical work pages

  1. [1]

    Richmond Journal of Law & Technology , volume=

    Artificial Intolerance: The Disparate Impact of AI in Housing , author=. Richmond Journal of Law & Technology , volume=. 2024 , publisher=

    work page 2024

  2. [2]

    2022 , howpublished =

    Safe. 2022 , howpublished =

    work page 2022

  3. [3]

    Proceedings of the 30th Annual Conference on Neural Information Processing Systems, NIPS , year=

    Equality of opportunity in supervised learning , author=. Proceedings of the 30th Annual Conference on Neural Information Processing Systems, NIPS , year=

    work page

  4. [4]

    Martinchek, Kassandra and Carther, Alex and Braga, Breno and Quakenbush, Caleb and McKernan, Signe-Mary , year =. Credit

    work page

  5. [5]

    Bernoulli , volume =

    Concentration Inequalities for Sampling without Replacement , author =. Bernoulli , volume =. 2015 , doi =

    work page 2015

  6. [6]

    Proceedings of the 36th International Conference on Machine Learning,

    Ulrich A. Proceedings of the 36th International Conference on Machine Learning,

    work page

  7. [7]

    Anders and Plamen Pasliev and Ann

    Christopher J. Anders and Plamen Pasliev and Ann. Proceedings of the 37th International Conference on Machine Learning,

    work page

  8. [8]

    Proceedings of the

    Abeba Birhane and Ryan Steed and Victor Ojewale and Briana Vecchione and Inioluwa Deborah Raji , bibsource =. Proceedings of the

    work page

Show all 76 references
  1. [9]

    Expert Systems with Applications , year=

    The comparisons of data mining techniques for the predictive accuracy of probability of default of credit card clients , author=. Expert Systems with Applications , year=

  2. [10]

    Reuters , urldate =

    Meta Created `Playbook' to Fend off Pressure to Crack down on Scammers, Documents Show , author =. Reuters , urldate =

  3. [11]

    arXiv preprint arXiv:2506.09746 , year=

    TikTok's Research API: Problems Without Explanations , author=. arXiv preprint arXiv:2506.09746 , year=

    arXiv

  4. [12]

    Public Statement from the

  5. [13]

    Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, FAccT , pages=

    Who Audits the Auditors? Recommendations from a field scan of the algorithmic auditing ecosystem , author=. Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, FAccT , pages=

    2022

  6. [14]

    and Fraiberger, Samuel and

    Tonneau, Manuel and Liu, Diyi and Malhotra, Niyati and Hale, Scott A. and Fraiberger, Samuel and. Proceedings of the 63rd

  7. [15]

    Larson, Jeff and Mattu, Surya and Kirchner, Lauren and Angwin, Julia , year = 2016, month = may, journal =. How

    2016

  8. [16]

    arXiv preprint arXiv:2305.13883 , title =

    Jade Garcia Bourr. arXiv preprint arXiv:2305.13883 , title =

  9. [17]

    Varun Chandrasekaran and Hengrui Jia and Anvith Thudi and Adelin Travers and Mohammad Yaghini and Nicolas Papernot , journal=

  10. [18]

    Journal of Machine Learning Research , pages =

    Hidde Fokkema and Rianne de Heide and Tim van Erven , bibsource =. Journal of Machine Learning Research , pages =

  11. [19]

    doi:10.1609/AAAI.V34I01.5377 , pages =

    Kazuto Fukuchi and Satoshi Hara and Takanori Maehara , booktitle =. doi:10.1609/AAAI.V34I01.5377 , pages =

    doi

  12. [20]

    Proceedings of the

    Augustin Godinot and Erwan Le Merrer and Gilles Tr. Proceedings of the

  13. [21]

    Garcia Bourr. Robust. Proceedings of the 42nd

  14. [22]

    Hong and Henry Corrigan

    Alexandra Henzinger and Matthew M. Hong and Henry Corrigan

  15. [23]

    The Eleventh International Conference on Learning Representations,

    Gabriel Laberge and Ulrich A. The Eleventh International Conference on Learning Representations,

  16. [24]

    Lam and Mitchell L

    Michelle S. Lam and Mitchell L. Gordon and Dana. doi:10.1145/3555625 , journal =

    doi

  17. [25]

    doi:10.1002/WIDM.1452 , journal =

    Tai Le Quy and Arjun Roy and Vasileios Iosifidis and Wenbin Zhang and Eirini Ntoutsi , bibsource =. doi:10.1002/WIDM.1452 , journal =

    doi

  18. [26]

    Proceedings of the 29th

    Pranav Maneriker and Codi Burley and Srinivasan Parthasarathy , bibsource =. Proceedings of the 29th

  19. [27]

    doi:10.1561/1100000083 , journal =

    Dana. doi:10.1561/1100000083 , journal =

    doi

  20. [28]

    Sikha Pentyala and David Melanson and Martine De Cock and Golnoosh Farnadi , journal=

  21. [29]

    White and Margaret Mitchell and Timnit Gebru and Ben Hutchinson and Jamila Smith

    Inioluwa Deborah Raji and Andrew Smart and Rebecca N. White and Margaret Mitchell and Timnit Gebru and Ben Hutchinson and Jamila Smith. Proceedings of the 2020 ACM Conference on Fairness, Accountability, and Transparency, FAT* , pages =

    2020

  22. [30]

    Ribeiro, Manoel Horta , howpublished =

  23. [31]

    Standard

    Ribeiro, Manoel Horta , urldate =. Is Facebook “Standard” Algorithm Polarizing? , url =

  24. [32]

    Facebook made big mistake in data it provided to researchers, undermining academic work , issn =

    Timberg, Craig , urldate =. Facebook made big mistake in data it provided to researchers, undermining academic work , issn =. 2021 , journaltitle =

    2021

  25. [33]

    Information, Communication & Society , publisher =

    Beyond the margin of error: a systematic and replicable audit of the. Information, Communication & Society , publisher =. 2024 , pages =

    2024

  26. [34]

    Meta created ‘playbook’ to fend off pressure to crack down on scammers, documents show , url =

    Horwitz, Jeff , urldate =. Meta created ‘playbook’ to fend off pressure to crack down on scammers, documents show , url =

  27. [35]

    Public statement from the Co-Chairs and European Advisory Committee of Social Science One

  28. [36]

    Patterns , volume=

    Reliance on metrics is a fundamental challenge for AI , author=. Patterns , volume=. 2022 , publisher=

    2022

  29. [37]

    Proceedings of the 2022 ACM conference on fairness, accountability, and transparency, FAccT , pages=

    Evaluation gaps in machine learning practice , author=. Proceedings of the 2022 ACM conference on fairness, accountability, and transparency, FAccT , pages=

    2022

  30. [38]

    2025 , date =

    Commission fines X €120 million under the digital services act , url =. 2025 , date =

    2025

  31. [39]

    doi:10.48550/ARXIV.2506.09746 , shorttitle =

    Entrena-Serrano, Carlos and Degeling, Martin and Romano, Salvatore and Çetin, Raziye Buse , urldate =. doi:10.48550/ARXIV.2506.09746 , shorttitle =

    doi arXiv

  32. [40]

    Proceedings of the 36th Annual Conference on Neural Information Processing Systems, NeurIPS , timestamp =

    Ali Shahin Shamsabadi and Mohammad Yaghini and Natalie Dullerud and Sierra Calanda Wyllie and Ulrich A. Proceedings of the 36th Annual Conference on Neural Information Processing Systems, NeurIPS , timestamp =

  33. [41]

    doi:10.1145/3479577 , journal =

    Hong Shen and Alicia DeVos and Motahhare Eslami and Kenneth Holstein , bibsource =. doi:10.1145/3479577 , journal =

    doi

  34. [42]

    doi:10.1145/3375627.3375830 , pages =

    Dylan Slack and Sophie Hilgard and Emily Jia and Sameer Singh and Himabindu Lakkaraju , bibsource =. doi:10.1145/3375627.3375830 , pages =

  35. [43]

    doi:10.1145/3465416.3483294 , pages =

    Briana Vecchione and Karen Levy and Solon Barocas , bibsource =. doi:10.1145/3465416.3483294 , pages =

  36. [44]

    Forty-first International Conference on Machine Learning,

    Chhavi Yadav and Amrita Roy Chowdhury and Dan Boneh and Kamalika Chaudhuri , bibsource =. Forty-first International Conference on Machine Learning,

  37. [45]

    Transactions on Machine Learning Research , year =

    Yadav, Chhavi and Moshkovitz, Michal and Chaudhuri, Kamalika , title =. Transactions on Machine Learning Research , year =

  38. [46]

    Proceedings of the 39th International Conference on Machine Learning,

    Tom Yan and Chicheng Zhang , bibsource =. Proceedings of the 39th International Conference on Machine Learning,

  39. [47]

    Confidential-

    Shamsabadi, Ali Shahin and Wyllie, Sierra Calanda and Franzese, Nicholas and Dullerud, Natalie and Gambs, S. Confidential-. Proceedings of the

  40. [48]

    Proceedings of the 1st ACM Conference on Equity and Access in Algorithms, Mechanisms, and Optimization , pages=

    Algorithmic auditing and social justice: Lessons from the history of audit studies , author=. Proceedings of the 1st ACM Conference on Equity and Access in Algorithms, Mechanisms, and Optimization , pages=

  41. [49]

    Trustless

    Waiwitlikhit, Suppakit and Stoica, Ion and Sun, Yi and Hashimoto, Tatsunori and Kang, Daniel , year = 2024, month = jul, pages =. Trustless. Proceedings of the 41st

    2024

  42. [50]

    2023 , month = jun, journal =

    Improving Fairness Generalization through a Sample-Robust Optimization Method , author =. 2023 , month = jun, journal =. doi:10.1007/s10994-022-06191-y , urldate =

    2023 doi

  43. [51]

    Journal of the American Statistical Association , volume =

    Hoeffding, Wassily , title =. Journal of the American Statistical Association , volume =. 1963 , doi =

    1963

  44. [52]

    , title =

    Serfling, Robert J. , title =. The Annals of Statistics , volume =. 1974 , doi =

    1974

  45. [53]

    Proceedings of the ACM Web Conference 2022 , pages=

    Fairness audit of machine learning models with confidential computing , author=. Proceedings of the ACM Web Conference 2022 , pages=

    2022

  46. [54]

    Proceedings of the 33rd International Conference on Machine Learning, ICML , pages=

    CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy , author=. Proceedings of the 33rd International Conference on Machine Learning, ICML , pages=

  47. [55]

    Proceedings of the 36th International Conference on Machine Learning, ICML , year=

    Low Latency Privacy Preserving Inference , author=. Proceedings of the 36th International Conference on Machine Learning, ICML , year=

  48. [56]

    Juvekar, Chiraag and Vaikuntanathan, Vinod and Chandrakasan, Anantha , booktitle=

  49. [57]

    Proceedings of the 29th USENIX Security Symposium , pages=

    Delphi: A Cryptographic Inference Service for Neural Networks , author=. Proceedings of the 29th USENIX Security Symposium , pages=

  50. [58]

    Cybersecurity , volume=

    Practical solutions in fully homomorphic encryption: a survey analyzing existing acceleration methods , author=. Cybersecurity , volume=

  51. [59]

    Theory of cryptography conference , pages=

    Compressible FHE with applications to PIR , author=. Theory of cryptography conference , pages=. 2019 , organization=

    2019

  52. [60]

    Olumofin and Ian Goldberg , title =

    Femi G. Olumofin and Ian Goldberg , title =. Proceedings of the 15th International Conference on Financial Cryptography and Data Security,

  53. [61]

    Journal of the

    Benny Chor and Eyal Kushilevitz and Oded Goldreich and Madhu Sudan , title =. Journal of the. 1998 , url =. doi:10.1145/293347.293350 , timestamp =

    1998

  54. [62]

    Smith and David Safford , title =

    Sean W. Smith and David Safford , title =. IBM Systems Journal , volume =. 2001 , url =. doi:10.1147/sj.403.0683 , timestamp =

    2001 doi

  55. [63]

    Proceedings on Privacy Enhancing Technologies , pages =

    Carlos Aguilar Melchor and Joris Barrier and Laurent Fousse and Marc. Proceedings on Privacy Enhancing Technologies , pages =. 2016 , url =. doi:10.1515/popets-2016-0010 , timestamp =

    2016 doi

  56. [64]

    Proceedings of the 2018 IEEE Symposium on Security and Privacy, SP , pages=

    PIR with compressed queries and amortized query processing , author=. Proceedings of the 2018 IEEE Symposium on Security and Privacy, SP , pages=

    2018

  57. [65]

    Proceedings of the 30th USENIX Security Symposium , pages=

    Ali, Asra and Lepoint, Tancr. Proceedings of the 30th USENIX Security Symposium , pages=

  58. [66]

    Proceedings of the 15th

    Addra: Metadata-private voice communication over fully untrusted infrastructure , author=. Proceedings of the 15th

  59. [67]

    Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , pages=

    OnionPIR: Response efficient single-server PIR , author=. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2021

  60. [68]

    Proceedings of the 2022 IEEE Symposium on Security and Privacy, SP , pages=

    Spiral: Fast, high-rate single-server PIR via FHE composition , author=. Proceedings of the 2022 IEEE Symposium on Security and Privacy, SP , pages=

    2022

  61. [69]

    Proceedings on Privacy Enhancing Technologies , year=

    Frodopir: Simple, scalable, single-server private information retrieval , author=. Proceedings on Privacy Enhancing Technologies , year=

  62. [70]

    Henzinger, Alexandra and Hong, Matthew M and Corrigan-Gibbs, Henry and Meiklejohn, Sarah and Vaikuntanathan, Vinod , booktitle=

  63. [71]

    Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques , pages=

    Single-server private information retrieval with sublinear amortized time , author=. Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques , pages=

  64. [72]

    Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques , pages=

    Private information retrieval with sublinear online time , author=. Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques , pages=

  65. [73]

    Proceedings of the 30th USENIX Security Symposium , pages=

    Private blocklist lookups with checklist , author=. Proceedings of the 30th USENIX Security Symposium , pages=

  66. [74]

    Proceedings of the Annual International Cryptology Conference , pages=

    Puncturable pseudorandom sets and private information retrieval with near-optimal online bandwidth and time , author=. Proceedings of the Annual International Cryptology Conference , pages=

  67. [75]

    Journal of the ACM , volume=

    On lattices, learning with errors, random linear codes, and cryptography , author=. Journal of the ACM , volume=. 2009 , publisher=

    2009

  68. [76]

    de Castro, Leo and Lee, Keewoo , booktitle=

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.