FairProof : Confidential and Certifiable Fairness for Neural Networks (2402.12572v2)

Abstract: Machine learning models are increasingly used in societal applications, yet legal and privacy concerns demand that they very often be kept confidential. Consequently, there is a growing distrust about the fairness properties of these models in the minds of consumers, who are often at the receiving end of model predictions. To this end, we propose \name -- a system that uses Zero-Knowledge Proofs (a cryptographic primitive) to publicly verify the fairness of a model, while maintaining confidentiality. We also propose a fairness certification algorithm for fully-connected neural networks which is befitting to ZKPs and is used in this system. We implement \name in Gnark and demonstrate empirically that our system is practically feasible. Code is available at https://github.com/infinite-pursuits/FairProof.

• The paper presents a fairness certification algorithm that uses ZKPs to verify individual fairness for each input while preserving model confidentiality.
• It transforms fairness verification into a robustness certification problem using projection distances to achieve computational efficiency.
• The authors implement and evaluate FairProof with the Gnark library on multiple datasets, demonstrating its practical efficiency in real-world scenarios.

Overview of "\name: Confidential and Certifiable Fairness for Neural Networks"

The paper introduces \name, a system ensuring the certifiable fairness of neural networks using Zero-Knowledge Proofs (ZKPs). With the increasing use of ML models in sensitive societal applications, there has been heightened concern over the models' fairness. Often, these models must remain confidential for legal and privacy reasons, which complicates public confidence in their fairness. This paper proposes a novel cryptographic framework that enables the public to verify a model's fairness while maintaining the confidentiality of the model's internal parameters.

Key Contributions

The paper's contributions can be summarized as follows:

1. Fairness Certification Algorithm: The authors present an algorithm tailored for fully-connected neural networks utilizing ReLU activations to compute a fairness certificate. This certificate is based on a local condition known as Individual Fairness (IF), which requires that similar individuals receive similar classifications. The model's fairness is certified for each input point separately, allowing personalized verification of fairness.
2. ZKP-Integrable Robustness Certification: Converting the problem of certifying fairness to one of certifying robustness, a known paradigm in robustness literature, was a pivotal insight. The transformation involves using projection distances instead of exact distances in the robustness calculation to maintain efficiency when employing ZKPs.
3. Efficient ZKP Protocol: The authors develop a ZKP protocol which proves the validity of the generated fairness certificate. This involves starting from the polytope containing the queried input and efficiently verifying each facet's distance until a boundary facet is reached while ensuring all computations are ZKP-compatible.
4. Implementation and Evaluation: The authors implement \name using the Gnark library, providing practical feasibility evidence through empirical evaluation on several datasets, including the Adult, German Credit, and Default Credit datasets. The results demonstrate the system's capability to distinguish between fair and unfair models with computational efficiency acceptable for real-world applications.

Numerical Results

The practical evaluation reveals that \name can generate verifiable fairness certificates quickly enough for each individual query on moderately-sized neural networks. For instance, using an Intel-i9 CPU, the algorithm took approximately 1.17 minutes to process each data point for the German Credit dataset.

Implications and Future Directions

The implications of this work are manifold. The authors extend the capabilities of neural networks by integrating cryptographic proofs to ensure fairness without compromising model confidentiality, a critical requirement in consumer-facing applications. Practically, this enables models to be deployed in environments where users' trust might otherwise be insufficient due to opacity or lack of fairness guarantees.

Theoretically, the alignment of fairness certification with robustness provides a foundation for future exploration of related cryptographic and learning-theoretic problems. The adaptation of ZKPs for model fairness verification invites further scalability improvements and optimizations that could extend these methods to larger-scale neural architectures and other model classes.

Future developments may explore extending the system to handle models with more complex architectures or investigating alternate definitions of fairness beyond local individual fairness. Additionally, the potential of incorporating parallelism or hardware acceleration tools could significantly improve the computational cost, facilitating wider adoption in industry settings.

In summary, \name represents a meaningful step toward integrating fairness guarantees in ML systems while upholding privacy, a crucial need in today's society. The authors’ approach could serve as a reference point for developing similar verification systems in other ML applications requiring fairness assurances.