Robust Decentralized Fairness Auditing

summary

The gist

The gist: AUDITOPUS is a novel round-based decentralized auditing protocol that uses local historical consistency checks to robustly defend against fairwashing attacks in collaborative fairness

In short

AUDITOPUS is a decentralized auditing protocol designed to prevent 'fairwashing' attacks against LLMs during collaborative fairness audits. It allows multiple auditors to check each other's results by having honest auditors locally down-weight any reports that are statistically inconsistent with their own past data, significantly reducing audit error.

Key concepts

Fairwashing: This is an adversarial attack where a bad actor fabricates statistics to make an LLM appear fair when it is actually unfair. The goal is to steer the final fairness estimate toward zero by manipulating the reported data vectors.
LAS Vector: This vector represents the cumulative statistics of all query results issued by a single auditor over time. Honest auditors use these vectors to check if other auditors' reports are statistically consistent with their own history, forming the basis for their defense.
Suspicion Score (S): An honest auditor calculates this score using binomial z-scores to measure how far an incoming statistic vector lies from what the binomial model predicts based on its own history. This score determines the weight applied to that source's contribution.

Terminology used across episodes

Reinforcement Learning (RL) — explained in 25 episodes
Sample Complexity — explained in 20 episodes
Retrieval-Augmented Generation (RAG) — explained in 19 episodes
Federated Learning — explained in 17 episodes
Flow Matching — explained in 17 episodes
Quantum Fisher Information (QFI) — explained in 16 episodes

This episode discusses

The paper

Robust Decentralized Fairness Auditing · Read on arXiv

Sayan Biswas, Jade Garcia Bourree, Anne-Marie Kermarrec, Palak Palak, Martijn de Vos

EPFL, Switzerland

Emerging legislation requires large language models (LLMs) to be audited for compliance with regulatory standards, particularly fairness. Such black-box audits typically assume a single auditor with access to a large, representative set of queries. In practice, it can be difficult for an auditor to obtain such a query set, but multiple auditors can together cover the relevant demographic groups by auditing the LLM collaboratively with their individual query sets. However, relying on multiple auditors raises a fundamental trust problem, as they may act on behalf of the LLM provider to portray a misleading appearance of fairness, i.e., fairwashing. We propose Auditopus, a novel approach for robust decentralized fairness auditing. In Auditopus, auditing proceeds in rounds without a central server. In each round, every auditor issues a fixed number of queries to the LLM, and sends only cumulative statistics vectors of its query results to other auditors instead of sensitive queries in clear. The fairness of the audited LLM is then estimated by aggregating all the vectors. We show theoretically and empirically that even a single adversarial auditor in the network can steer this estimate by fabricating the vectors it sends, making an unfair LLM appear fair. To address this threat, Auditopus has each honest auditor locally down-weight any auditor whose cumulative statistics vectors are statistically inconsistent with previous ones. We implement Auditopus and compare it to robust aggregation baselines on two datasets with two pre-trained LLMs. Against an attacker that optimizes the vectors it sends to make the LLM appear fair, Auditopus reduces audit error by up to 78% on average relative to no defense and at least 62% relative to the robust aggregation baselines. Even when 49% of the auditors are adversarial, Auditopus never lets a very unfair or moderately unfair LLM pass as fair.

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: I'm Tom.

Jane: And I'm Jane, here with Lu, Meng and our in-house large language model, Lalam.

Tom: Today's paper: "Robust Decentralized Fairness Auditing".

Jane: The gist: AUDITOPUS is a novel round-based decentralized auditing protocol that uses local historical consistency checks to robustly defend against fairwashing attacks in collaborative fairness audits of large language models.

Tom: First, who's behind it and why it matters.

Title and authors: Tom: So we're looking at the paper 'Robust Decentralized Fairness Auditing'. The title itself tells you a lot about what they're tackling. It’s about making fairness audits more robust when you have multiple auditors instead of just one person trying to do everything.

Jane: Exactly. Think about it this way: if one auditor looks at the LLM, they might get a picture of fairness for only one group, but having several auditors helps cover different groups, which is good for fairness in general. But then you run into this problem where those auditors might not be honest and try to trick the system into looking fair.

Lu: That trickery is called fairwashing, and it’s a big concern when we talk about black-box audits one <ref:2610.10199#pg1>. The authors are proposing a new way to do these audits without needing one central authority controlling everything, which solves that trust issue.

Meng: Without a central server coordinating all the auditors' data streams, how do you make sure they aren't just sending us biased numbers? That sounds like it introduces a whole new set of complexities for deployment at scale.

Lalam: The paper suggests they are moving away from relying on one big, perfect dataset for queries and instead using this round-based system where auditors exchange statistics instead of sensitive query pairs <ref:2610.10199#pg2>.

The paper's summary: Tom: So, what is the core idea of AUDITOPUS? It seems to be a decentralized protocol that lets auditors check each other’s statistics against their own history, which sounds like a way to catch inconsistencies.

Jane: Right. The summary explains that in each round, every auditor sends aggregated statistics vectors instead of their actual queries <ref:2610.10199#pg2>. Then, an honest auditor looks at the incoming stats and compares them to what they already saw from that specific source in previous rounds.

Lu: The defense mechanism is this local down-weighting. If an auditor’s statistics don't line up with their own past reports, they get penalized locally <ref:2610.10199#pg3>. It’s a self-check system rather than everyone checking everyone else, which seems smart for decentralized settings.

Meng: But what about the real-world impact of this round structure? If you're shipping a model to production, does running these rounds add too much latency or complexity compared to just running one big audit and getting a result?

Lalam: The goal is to reduce the error in estimating Demographic Parity, DP, by up to seventy-eight percent on average compared to no defense <ref:2610.10199#pg4>. It’s trying to make the estimate much more reliable even when you have a lot of different query sets <ref:2610.10199#pg2>.

The paper's improvements: Tom: The paper points out two major problems with current collaborative fairness audits: first, the queries are all different in size and groups, which makes local estimates unreliable <ref:2610.10199#pg2>. And second, adversaries can send fabricated numbers to steer the verdict toward fairness <ref:2610.10199#pg3>.

Jane: So the improvement is building a system that handles both of those simultaneously. They introduce a defense where each honest auditor calculates a suspicion score using binomial z-scores to measure how far new stats are from what their own model predicts <ref:2610.10199#pg4>.

Lu: And they fix the weight assigned to these statistics increments once, so it stays fixed. This means an honest auditor always samples uniformly from their set, keeping their increments consistent with its own local model <ref:2610.10199#pg4>.

Meng: So this defense is internal to the auditor’s logic, not relying on a central authority to tell them who is lying. That sounds like something you could embed in a distributed system, which would be good for production environments.

Lalam: The main result they show is that even when forty-nine percent of auditors are trying to fairwash the LLM, AUDITOPUS never lets a very unfair or moderately unfair LLM pass as fair <ref:2610.10199#pg4>. It maintains an error of between zero point zero two and zero point zero five in those scenarios <ref:2610.10199#pg5>.

Conclusion: Tom: So, to wrap up, the paper 'Robust Decentralized Fairness Auditing' presents AUDITOPUS as a round-based decentralized way for auditors to check each other’s statistics against their own history. It seems it handles the challenges of heterogeneous query sets and adversarial behavior pretty well.

Jane: It does show significant reduction in audit error, going up to seventy-eight percent compared to no defense, even when nearly half the participants are trying to cheat <ref:2610.10199#pg4>. This means we can trust these collaborative audits a lot more when deploying LLMs.

Lu: I think the real contribution is how they address that reliance on robust aggregation methods that discard outliers <ref:2610.10199#pg3>. AUDITOPUS doesn't need to assume the majority is right; it judges each source only against its own history, which is a key insight for representation learning <ref:2610.10199#pg5>.

Meng: For deployment, it’s important that the performance stays stable regardless of how many honest auditors you have or how different their query sets are. The paper shows the error stays between zero point zero two and zero point zero five even with forty-nine percent adversaries <ref:2610.10199#pg5>. That stability is what we need when we think about scaling this for real traffic <ref:2610.10199#pg5>.

Lalam: Yeah, the paper confirms that an adversary has to keep adjusting its fabricated statistics just to cancel out the honest ones <ref:2610.10199#pg5>. That's a pretty strong finding for defending against those adaptive adversaries.

More episodes

← Home