This work argues that privacy cost, the information leakage borne by each group, is itself a form of harm, and adopts a compensatory-fairness framework in which a group that involuntarily bears greater privacy exposure is owed proportionally greater benefit from the system.
Abstract
Differential privacy (DP) is increasingly deployed to limit membership inference risk in machine-learning systems. Prior work has shown that DP-SGD can widen accuracy disparities across demographic groups, but this framing treats fairness as a purely outcome-side concern. We argue that privacy cost, the information leakage borne by each group, is itself a form of harm, and adopt a compensatory-fairness framework in which a group that involuntarily bears greater privacy exposure is owed proportionally greater benefit from the system. From this principle we derive the \emph{Privacy-Cost Equity Ratio} (PCER), a group fairness metric defined as a group's positive prediction rate normalized by its per-group overfitting gap. By a standard membership inference bound, this overfitting gap upper-bounds each group's vulnerability to inference attacks, making PCER a conservative measure of benefit relative to exposure. PCER needs only per-group train and test accuracy (no shadow models), making it a practical post-hoc audit tool. We evaluate PCER alongside standard fairness metrics across six benchmark--attribute combinations spanning tabular and NLP domains, under DP-SGD at a range of privacy budgets, and validate the overfitting-gap proxy against a direct threshold membership-inference attack. The results reveal patterns that outcome-based metrics miss. On COMPAS, PCER uncovers a persistent double disadvantage: the protected group bears both greater privacy exposure and worse predictive outcomes, something demographic parity gap masks entirely. Sensitivity analysis shows very strong privacy guarantees collapse both groups'overfitting to a numerical floor, rendering exposure-based audits uninformative in that regime. Together, these findings show that fairness audits of privacy-preserving systems must account for who bears the cost of protection, not only who benefits from its outcomes.
It is demonstrated that while DP alone can degrade both utility and fairness, applying fairness interventions can partially restore equitable outcomes, and post-processing methods tend to provide more stable fairness–utility trade-offs across privacy budgets and synthesizers.
Vin'icius Gabriel Angelozzi, H. H. Arcolezi· Proceedings on Privacy Enhan...· 0 citations
Machine learning (ML) models deployed in sensitive domains such as healthcare, law enforcement, and finance must satisfy not only utility requirements but also fairness and privacy guarantees. While prior work has largely examined how privacy-preserving techniques affect fairness, the inverse question-how fairness-enhancing algorithms influence privacy leakage-remains underexplored. We present the first comprehensive study of how fairness interventions affect membership inference privacy risks at the subpopulation level. By adapting the Likelihood Ratio Attack (LiRA) for subgroup auditing, we uncover privacy disparities that aggregate evaluations obscure. We further analyze how Differential Privacy (DP) interacts with fairness-enhancing methods across different categories, showing that DP’s privacy benefits and utility costs are unevenly distributed across subpopulations. Our results demonstrate that fairness interventions do not uniformly increase privacy risk; their impact depends on model architecture, subgroup size, and mitigation strategy. These findings reveal that fairness, privacy, and utility must be jointly evaluated at the subpopulation level, and we introduce the first unified empirical framework to support such auditing in practice.
U. Suleymanov, Ilhama Novruzova, Khalid Mammadov et al.· European Symposium on Securi...· 0 citations
When a classifier is trained by actively choosing which examples to label, should its labeling budget depend on which notion of fairness it must satisfy? We answer this with the first information-theoretic lower bounds for group-fair active learning, and the answer is a sharp hierarchy across the three standard notions. Demographic Parity (DP), which equalizes the positive prediction rate across groups, can be verified from unlabeled data alone, so it adds no labels beyond ordinary learning. Equal Opportunity (EO), which equalizes each group's true positive rate, is fundamentally harder: estimating a rate conditioned on the true label forces the learner to collect labeled positives from every group, an irreducible cost that no query strategy can avoid. Equalized Odds (EqOdds), which additionally equalizes false positive rates, costs no more than EO whenever positives are the minority, the typical regime. This exposes a separation at the heart of fair learning: active querying yields the well-known exponential savings for accuracy, but no speedup whatsoever for fairness verification. Concretely, certifying EO to fairness tolerance γ requires Ω(d/ε2 + k/(ε2 p+)) labels, where d is the model's Vapnik--Chervonenkis (VC) dimension, k the number of groups, ε the target error, and p+ = Pr[Y=1] the positive rate; the fairness term is independent of ε, so it is a floor that active learning cannot lower. We give matching algorithms (ConstrainedERM-DP for DP, FairStratified for EO and EqOdds) that are tight up to logarithmic factors. The cost is largest exactly when positives are rare: at p+ = 0.01, as in fraud detection, EO demands roughly 90× more labels than DP. Experiments on Folktables, COMPAS, and Adult confirm the predicted scaling and yield 36 to 39% label savings over passive fair-learning baselines.
Chang Lu, Yizheng Zhao· Proceedings of the 32nd ACM...· 0 citations
Best-of-N (BoN) sampling is the simplest and most widely deployed inference-time alignment strategy, but it suffers from two distinct problems: reward hacking, in which the selected response exploits errors in the proxy reward model, and the absence of any privacy protection for the sensitive human preference data used to train that reward model. We show that a single intervention-adding calibrated noise to reward scores before selection-resolves both. Our first result, Private Best-of-N (PrivBoN), establishes that Gumbel noise at an appropriate scale simultaneously provides $\epsilon$-differential privacy and implements KL-regularized alignment. Whenever the privacy budget exceeds a critical threshold $\epsilon^*$, the privacy-mandated noise is the regret-optimal regularization, and privacy imposes zero additional alignment cost-matching the information-theoretic skyline of Huang et al. (2025). Because $\epsilon^*$ depends on an unknown coverage coefficient, we introduce Private Inference-Time Pessimism (PrivITP), which combines $\chi^2$-regularized rejection sampling with a two-phase Gaussian mechanism. PrivITP achieves ex-post $(\epsilon,\delta)$-DP with a privacy cost independent of the number of responses $n$, cleanly decouples the regularization parameter from the privacy parameter, and attains the skyline up to a noise-inflation term. Experiments across several language models, datasets, and reward models confirm our results: PrivBoN and PrivITP are scaling-monotonic (unlike BoN, which degrades past a critical $n$), and PrivITP matches or outperforms PrivBoN at equivalent privacy levels, with the largest gains in the strong-privacy regime.
Ishika Jain, Nandini Bhattad, Sayak Ray Chowdhury· 0 citations
It is shown, through a theoretical study of the dynamics and numerical experiments, that a finite privacy budget can outperform non-private estimation in the long term when the feedback loop between leakage and participation is sufficiently strong.
Uddalak Mukherjee, Edwige Cyffers, Y. Chevaleyre· 0 citations
Differential privacy is a mathematical definition of what it means to protect data subjects'privacy in data releases. Differential privacy depends on a parameter $\epsilon$ known as the privacy budget. The value of $\varepsilon$ determines the nature of the privacy guarantee, with smaller values generally offering more privacy. However, reducing $\varepsilon$ also tends to decrease the accuracy of results protected with differentially private algorithms. Setting a value for $\varepsilon$ that satisfactorily balances this risk/accuracy trade off is complicated in practice, and there is not a standard approach to doing so. In part this is because practitioners may struggle to understand the privacy guarantee afforded by $\varepsilon$. We present an approach to interpreting and setting $\varepsilon$ in which (i) the practitioner establishes bounds on the posterior odds that adversaries can learn sensitive information, and (ii) the practitioner converts these bounds to values of $\varepsilon$. We illustrate the approach using data from a case control study.
Ruwimal Y. Pathiraja, Jerome P. Reiter· 0 citations