Collaboration method spots false fairness claims in AI language models
Robust Decentralized Fairness Auditing
Machine Learning
Summary
Checking if AI language models treat everyone fairly is important but can be tricky when multiple groups audit the model separately. The authors show that dishonest auditors can fake results to make unfair models look fair. They created Auditopus, a way for auditors to work together without sharing sensitive data and to spot when someone is lying. Auditopus helps ensure that fairness checks on AI models are more reliable, even when almost half of the auditors are dishonest.
What this means in practice
- •For ai compliance teams: Run reliable fairness audits on language models when multiple independent auditors cannot share raw queries due to privacy.
- •For data privacy officers: Ensure fairness auditing cooperations do not expose sensitive query data while still guarding against dishonest participants.
Authors
Sayan Biswas, Jade Garcia Bourrée, Anne-Marie Kermarrec, Palak, Martijn de Vos
Abstract
Emerging legislation requires large language models (LLMs) to be audited for compliance with regulatory standards, particularly fairness. Such black-box audits typically assume a single auditor with access to a large, representative set of queries. In practice, it can be difficult for an auditor to obtain such a query set, but multiple auditors can together cover the relevant demographic groups by auditing the LLM collaboratively with their individual query sets. However, relying on multiple auditors raises a fundamental trust problem, as they may act on behalf of the LLM provider to portray a misleading appearance of fairness, i.e., fairwashing. We propose Auditopus, a novel approach for robust decentralized fairness auditing. In Auditopus, auditing proceeds in rounds without a central server. In each round, every auditor issues a fixed number of queries to the LLM, and sends only cumulative statistics vectors of its query results to other auditors instead of sensitive queries in clear. The fairness of the audited LLM is then estimated by aggregating all the vectors. We show theoretically and empirically that even a single adversarial auditor in the network can steer this estimate by fabricating the vectors it sends, making an unfair LLM appear fair. To address this threat, Auditopus has each honest auditor locally down-weight any auditor whose cumulative statistics vectors are statistically inconsistent with previous ones. We implement Auditopus and compare it to robust aggregation baselines on two datasets with two pre-trained LLMs. Against an attacker that optimizes the vectors it sends to make the LLM appear fair, Auditopus reduces audit error by up to 78% on average relative to no defense and at least 62% relative to the robust aggregation baselines. Even when 49% of the auditors are adversarial, Auditopus never lets a very unfair or moderately unfair LLM pass as fair.