← All papers
First page of Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning

Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning

Devharsh Trivedi, Nesrine Kaaniche, Nikos Triandopoulos, Maryline Laurent, Jackson Walters

cs.CR Aug 6, 2026 · v1 cs.LG
One author machine-checked the paper's security theorems in Lean, including the Fairis weight properties, the clipped displacement bound, the EOD counterexample, and FairFed fixed-point results.
Collaborative machine learning among financial institutions must be both group-fair and robust against deliberate adversarial manipulation. Existing fairness-aware aggregation methods remain formally vulnerable to fairness poisoning: a malicious client maximizing group disparity while preserving accuracy evades accuracy-based Byzantine defenses, and in our threat model FairFed's gap-based weighting can be gamed by an adversary who observes the global fairness score. We present Fairis, a server-side reweighting scheme in which each client's update receives the normalized weight $ω_k = \bar{w}_k / \sum_j \bar{w}_j$ built from the unnormalized score $\bar{w}_k = η- \mathcal{F}_k$, with $\mathcal{F}_k \in [0,1]$ the local Equal Opportunity Difference and $η> 1$ a security parameter. We prove three properties, Monotone Weight Reduction (MWR), Demographic Participation, and Non-Gamesmanship, extend MWR to colluding minority coalitions, and show that combining MWR with server-side norm clipping bounds the adversary's displacement of the global model by $ω_0 C$, strictly decreasing in its own reported disparity. Assuming honest score reporting, an assumption this paper does not discharge, Fairis is the only rule evaluated that guarantees every client strictly positive weight while provably reducing an adversary's weight monotonically in its bias; clipped FairFed can reach a lower weight but guarantees nothing and zeroes a client outright on Taiwan Credit. Against an adversary stealthy enough to evade accuracy-based defenses, within 0.04 accuracy of benign, Fairis cuts its weight by 41 to 54% below a size-blind control on Taiwan. On routine non-IID partitions no rule dominates, and a uniform-weighting ablation shows that containment tracks how far the adversary's score separates from the honest mean, providing none when the honest population is already unfair.

Fairness-aware aggregation in collaborative learning is vulnerable to fairness poisoning, where a malicious client increases group disparity while keeping accuracy. FairFed's gap-based weighting can be gamed by an adversary that matches the global fairness score.

Fairis weights each client by eta minus its local Equal Opportunity Difference, normalized across clients, with eta > 1. The authors prove Monotone Weight Reduction, Demographic Participation, and Non-Gamesmanship. They extend these to colluding minority coalitions and bound adversarial displacement under norm clipping. One author machine-checked the proofs in Lean, including counterexamples and the FairFed matched-gap fixed point.

Assuming honest score reporting, Fairis guarantees every client positive weight and reduces an adversary's weight monotonically in its bias. On Taiwan Credit it cuts a stealthy attacker's weight by 41–54% relative to a uniform control. On routine non-IID partitions no rule dominates.

alpha_advUniform ω0Fairis ω0ReductionAcc. gap
0.250.3330.26819.6%0.012
0.50.3330.19840.6%0.005
10.3330.15254.4%0.038
20.3330.04885.5%0.111
Attacker weight on Taiwan Credit: uniform vs Fairis