Robust Decentralized Fairness Auditing

arXiv:2610.10199 · cs.LG · Submitted 2026-10-07 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: I'm Tom.

Jane: And I'm Jane, here with Lu, Meng and our in-house large language model, Lalam.

Tom: Today's paper: "Robust Decentralized Fairness Auditing".

Jane: The gist: AUDITOPUS is a novel round-based decentralized auditing protocol that uses local historical consistency checks to robustly defend against fairwashing attacks in collaborative fairness audits of large language models.

Tom: First, who's behind it and why it matters.

Title and authors: Tom: So we're looking at the paper 'Robust Decentralized Fairness Auditing'. The title itself tells you a lot about what they're tackling. It’s about making fairness audits more robust when you have multiple auditors instead of just one person trying to do everything.

Jane: Exactly. Think about it this way: if one auditor looks at the LLM, they might get a picture of fairness for only one group, but having several auditors helps cover different groups, which is good for fairness in general. But then you run into this problem where those auditors might not be honest and try to trick the system into looking fair.

Lu: That trickery is called fairwashing, and it’s a big concern when we talk about black-box audits one <ref:2610.10199#pg1>. The authors are proposing a new way to do these audits without needing one central authority controlling everything, which solves that trust issue.

Meng: Without a central server coordinating all the auditors' data streams, how do you make sure they aren't just sending us biased numbers? That sounds like it introduces a whole new set of complexities for deployment at scale.

Lalam: The paper suggests they are moving away from relying on one big, perfect dataset for queries and instead using this round-based system where auditors exchange statistics instead of sensitive query pairs <ref:2610.10199#pg2>.

The paper's summary: Tom: So, what is the core idea of AUDITOPUS? It seems to be a decentralized protocol that lets auditors check each other’s statistics against their own history, which sounds like a way to catch inconsistencies.

Jane: Right. The summary explains that in each round, every auditor sends aggregated statistics vectors instead of their actual queries <ref:2610.10199#pg2>. Then, an honest auditor looks at the incoming stats and compares them to what they already saw from that specific source in previous rounds.

Lu: The defense mechanism is this local down-weighting. If an auditor’s statistics don't line up with their own past reports, they get penalized locally <ref:2610.10199#pg3>. It’s a self-check system rather than everyone checking everyone else, which seems smart for decentralized settings.

Meng: But what about the real-world impact of this round structure? If you're shipping a model to production, does running these rounds add too much latency or complexity compared to just running one big audit and getting a result?

Lalam: The goal is to reduce the error in estimating Demographic Parity, DP, by up to seventy-eight percent on average compared to no defense <ref:2610.10199#pg4>. It’s trying to make the estimate much more reliable even when you have a lot of different query sets <ref:2610.10199#pg2>.

The paper's improvements: Tom: The paper points out two major problems with current collaborative fairness audits: first, the queries are all different in size and groups, which makes local estimates unreliable <ref:2610.10199#pg2>. And second, adversaries can send fabricated numbers to steer the verdict toward fairness <ref:2610.10199#pg3>.

Jane: So the improvement is building a system that handles both of those simultaneously. They introduce a defense where each honest auditor calculates a suspicion score using binomial z-scores to measure how far new stats are from what their own model predicts <ref:2610.10199#pg4>.

Lu: And they fix the weight assigned to these statistics increments once, so it stays fixed. This means an honest auditor always samples uniformly from their set, keeping their increments consistent with its own local model <ref:2610.10199#pg4>.

Meng: So this defense is internal to the auditor’s logic, not relying on a central authority to tell them who is lying. That sounds like something you could embed in a distributed system, which would be good for production environments.

Lalam: The main result they show is that even when forty-nine percent of auditors are trying to fairwash the LLM, AUDITOPUS never lets a very unfair or moderately unfair LLM pass as fair <ref:2610.10199#pg4>. It maintains an error of between zero point zero two and zero point zero five in those scenarios <ref:2610.10199#pg5>.

Conclusion: Tom: So, to wrap up, the paper 'Robust Decentralized Fairness Auditing' presents AUDITOPUS as a round-based decentralized way for auditors to check each other’s statistics against their own history. It seems it handles the challenges of heterogeneous query sets and adversarial behavior pretty well.

Jane: It does show significant reduction in audit error, going up to seventy-eight percent compared to no defense, even when nearly half the participants are trying to cheat <ref:2610.10199#pg4>. This means we can trust these collaborative audits a lot more when deploying LLMs.

Lu: I think the real contribution is how they address that reliance on robust aggregation methods that discard outliers <ref:2610.10199#pg3>. AUDITOPUS doesn't need to assume the majority is right; it judges each source only against its own history, which is a key insight for representation learning <ref:2610.10199#pg5>.

Meng: For deployment, it’s important that the performance stays stable regardless of how many honest auditors you have or how different their query sets are. The paper shows the error stays between zero point zero two and zero point zero five even with forty-nine percent adversaries <ref:2610.10199#pg5>. That stability is what we need when we think about scaling this for real traffic <ref:2610.10199#pg5>.

Lalam: Yeah, the paper confirms that an adversary has to keep adjusting its fabricated statistics just to cancel out the honest ones <ref:2610.10199#pg5>. That's a pretty strong finding for defending against those adaptive adversaries.

Sayan Biswas, Jade Garcia Bourree, Anne-Marie Kermarrec, Palak Palak, Martijn de Vos

EPFL, Switzerland

cs.LG

Submitted: 2026-10-07

Updated: 2026-10-07

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 89/100

The gist: The gist: AUDITOPUS is a novel round-based decentralized auditing protocol that uses local historical consistency checks to robustly defend against fairwashing attacks in collaborative fairness

Key concepts

Fairwashing: This is an adversarial attack where a bad actor fabricates statistics to make an LLM appear fair when it is actually unfair. The goal is to steer the final fairness estimate toward zero by manipulating the reported data vectors.
LAS Vector: This vector represents the cumulative statistics of all query results issued by a single auditor over time. Honest auditors use these vectors to check if other auditors' reports are statistically consistent with their own history, forming the basis for their defense.
Suspicion Score (S): An honest auditor calculates this score using binomial z-scores to measure how far an incoming statistic vector lies from what the binomial model predicts based on its own history. This score determines the weight applied to that source's contribution.

Summary

The gist: AUDITOPUS is a novel round-based decentralized auditing protocol that uses local historical consistency checks to robustly defend against fairwashing attacks in collaborative fairness audits of large language models.

Background and Problem Description

Emerging legislation requires large language models (LLMs) to be audited for compliance with regulatory standards, particularly with respect to fairness In practice, it can be difficult for an auditor to obtain such a query set, but multiple auditors can together cover the relevant demographic groups by auditing the LLM collaboratively with their individual query sets Collaborative fairness audits raise two challenges: first, the auditor query sets are heterogeneous in terms of size, groups, and predicted labels which makes local estimates unreliable second, some auditors may be adversarial who can send fabricated numbers that steer honest auditors toward a verdict of fairness, a form of fairwashing.

AUDITOPUS Mechanism

AUDITOPUS proceeds in rounds without a central server where every auditor issues a fixed number of queries to the LLM, and sends only cumulative statistics vectors of its query results to other auditors instead of sensitive queries in clear. In each round, an honest auditor samples from a fixed query set, and then checks incoming statistics against its own past reports. The defense mechanism involves each honest auditor locally down-weights any auditor whose cumulative statistics vectors are statistically inconsistent with previous ones.

Adversary Model and Fairwashing

The strong adaptive adversary aims to fairwash the LLM by fabricating, every round, the statistics vectors that bring the estimated DP as close to 0 as possible. An adversary follows a strategy where it optimizes its fabricated statistics vectors every round by minimizing DP(C + δ) over feasible moves Xn. This attacker can steer the estimate to any value, including one such that the LLM appears fair, because honest auditors cannot verify another auditor’s LAS vector, as they never see its queries; and nothing bounds the size of a single contribution.

Defense Details

The defense mechanism relies on checking each source against its own history rather than against others. An honest auditor scores an increment by calculating a suspicion score S using binomial z-scores, which measures how far s lies from what the binomial model predicts. The weight assigned to an increment is calculated as w = (1 + S)−2, and this weight is fixed once assigned and never revised. This means an honest auditor samples uniformly from a fixed query set, so its increments remain consistent with its own LAS vector.

Experimental Results

AUDITOPUS reduces audit error by up to 78% on average relative to no defense and at least 62% relative to the robust aggregation baselines. Against an attacker that optimizes the vectors it sends to make the LLM appear fair, AUDITOPUS reduces audit error by up to 78% on average relative to no defense and at least 62% relative to the robust aggregation baselines. Even when 49% of auditors are adversarial, AUDITOPUS never lets a very unfair or moderately unfair LLM pass as fair.

Contributions

The paper makes four contributions: first, We introduce a novel round-based decentralized fairness auditing mechanism, named AUDITOPUS, where auditors exchange only LAS vectors with their neighbors; second, We introduce a strong adaptive adversary that fairwashes the LLM by optimizing its fabricated statistics vectors every round, and we theoretically characterize the conditions under which a single adversary can steer the estimate so that an unfair LLM appears fair; third, We design a defense that is central to AUDITOPUS: each honest auditor locally down-weights any auditor whose statistics vectors are statistically self-inconsistent; and fourth, We evaluate AUDITOPUS on two real-world datasets against robust aggregation baselines which shows that the error of the estimated DP stays between 0.02 and 0.05 even with 49% adversaries.

Conclusion

AUDITOPUS successfully neutralizes the threat from adaptive adversaries present in the network. With 23% adversaries in the network, the error of the estimated DP of AUDITOPUS stays between 0.02 and 0.05 as the number of honest auditors and the heterogeneity of their query sets vary. The defense exploits exactly this, as an adversary must keep adjusting its fabricated statistics to cancel the honest ones. AUDITOPUS is effective across all fairness levels in Bias in Bios, even when nearly half of the auditors (49%) attempt to fairwash the LLM. The paper concludes that AUDITOPUS reduces attack success rate and error in estimation compared against the no defense and robust aggregation baselines.

How it works

Each round, every auditor issues a fixed number of queries to the LLM, and sends only cumulative statistics vectors of its query results to other auditors instead of sensitive queries in clear.
Each honest auditor maintains a LAS vector ci which sums the statistics of all queries it has issued so far.
In each round, an honest auditor checks each source against its own history, never against the other sources.
The defense mechanism involves each honest auditor locally down-weights any auditor whose cumulative statistics vectors are statistically inconsistent with previous ones.
The final estimate is computed by summing the weighted LAS vectors of all sources, where each weight is determined by the suspicion score S.

Evaluation Summary

AUDITOPUS maintains a low attack success rate, succeeding in only 3% of the audits against an attacker. It also substantially improves accuracy, reducing the mean absolute error from 0.158 to 0.034 (−78%), and by 75% and 62% relative to the median and the trimmed mean. AUDITOPUS is insensitive to both the number of honest auditors N and the heterogeneity level α, with a DP estimation error between 0.02 and 0.05 in every setting. The paper demonstrates that robust aggregation baselines break down as the query sets become more heterogeneous.

Future Work Implications

The study shows that "Robust aggregation methods typically discard contributions that deviate from the majority, but under heterogeneity honest auditors with unusual sub-populations also deviate, so discarding outliers also discards the data that makes the audit representative. AUDITOPUS avoids this by not relying on such assumptions, as it judges each source only against its own history. The paper suggests that AUDITOPUS is unaffected as long as the audit has several rounds and that the budget only changes" when considering query budget variations.

Data and Implementation

The experiments are implemented in Python using NUMPY and PANDAS libraries, running on NVIDIA A100 GPUs for LLM replicas. The audits are conducted on two datasets: Civil Comments for toxicity classification and Bias in Bios for occupation prediction. The audit simulation is fully seeded to ensure reproducibility and uses a fair band of τ = 0.05 across all experiments.

References

[1] Ulrich A¨ıvodji, Hiromi Arai, Olivier Fortineau, Sebastien Gambs, ´ Satoshi Hara, and Alain Tapp. Fairwashing: the risk of rationalization. In International conference on machine learning, pages 161–170. PMLR, 2019

[2] Youssef Allouah, Rachid Guerraoui, Nirupam Gupta, Rafael Pinot, and Geovani Rizk. Robust distributed learning: Tight error bounds and breakdown point under data heterogeneity. Advances in neural information processing systems, 36:45744–45776, 2023

[3] McKane Andrus, Elena Spitzer, Jeffrey Brown, and Alice Xiang. What we can’t measure, we can’t understand: Challenges to demographic data procurement in the pursuit of fairness. In Proceedings of the 2021 ACM conference on fairness, accountability, and transparency, pages 249–260, 2021

[4] Lena Armstrong, Abbey Liu, Stephen MacNeil, and Danae Metaxa. ¨ The silicon ceiling: Auditing GPT’s race and gender biases in hiring. In Proceedings of the 4th ACM Conference on Equity and Access in Algorithms, Mechanisms, and Optimization, pages 1–18, 2024

[5] Peter J. Bickel, Eugene A. Hammel, and J. William O’Connell. Sex bias in graduate admissions: Data from Berkeley.

Improvements for AI systems

Robust Decentralized Auditing Protocol (AUDITOPUS) Implementation: Implement AUDITOPUS to conduct fairness audits in a decentralized manner where every honest auditor locally down-weights any auditor whose cumulative statistics vectors are statistically inconsistent with previous ones. This defense mechanism specifically targets fairwashing by ensuring that the audit is not steered by fabricated statistics, even when an adversary controls 49% of the auditors.
Adaptive Adversary Characterization: Develop and deploy a strong adaptive adversary that optimizes its strategy by fabricating statistics vectors to steer the estimate toward fairness, as characterized in Section IV. This system will actively test LLM robustness by attempting to make an unfair LLM appear fair by sending fabricated LAS vectors instead of those of its own queries.
Multi-Round Statistical Aggregation: Structure the auditing process across multiple rounds with a fixed per-round budget 'n' to bound adversary influence, as AUDITOPUS proceeds in multiple rounds without a central server. This prevents single-round attacks from dominating the estimate by limiting how much any single auditor can contribute per round.
History-Based Consistency Checking: Integrate the defense mechanism into the auditing workflow where each honest auditor checks new statistics against its own past, ensuring that an honest source's increments remain consistent with its history, as noted in Section V: An honest auditor samples from a fixed query set, so each LAS vector is statistically consistent with its previous ones.
Heterogeneity-Resistant Estimation: Utilize the Global Aggregated Statistics (GAS) vector to estimate fairness, ensuring that the estimate is accurate even when auditors hold very different query sets, as this method recovers the DP of this union exactly, whatever the data heterogeneity.

Abstract

Emerging legislation requires large language models (LLMs) to be audited for compliance with regulatory standards, particularly fairness. Such black-box audits typically assume a single auditor with access to a large, representative set of queries. In practice, it can be difficult for an auditor to obtain such a query set, but multiple auditors can together cover the relevant demographic groups by auditing the LLM collaboratively with their individual query sets. However, relying on multiple auditors raises a fundamental trust problem, as they may act on behalf of the LLM provider to portray a misleading appearance of fairness, i.e., fairwashing. We propose Auditopus, a novel approach for robust decentralized fairness auditing. In Auditopus, auditing proceeds in rounds without a central server. In each round, every auditor issues a fixed number of queries to the LLM, and sends only cumulative statistics vectors of its query results to other auditors instead of sensitive queries in clear. The fairness of the audited LLM is then estimated by aggregating all the vectors. We show theoretically and empirically that even a single adversarial auditor in the network can steer this estimate by fabricating the vectors it sends, making an unfair LLM appear fair. To address this threat, Auditopus has each honest auditor locally down-weight any auditor whose cumulative statistics vectors are statistically inconsistent with previous ones. We implement Auditopus and compare it to robust aggregation baselines on two datasets with two pre-trained LLMs. Against an attacker that optimizes the vectors it sends to make the LLM appear fair, Auditopus reduces audit error by up to 78% on average relative to no defense and at least 62% relative to the robust aggregation baselines. Even when 49% of the auditors are adversarial, Auditopus never lets a very unfair or moderately unfair LLM pass as fair.