Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning

Researchers at arXiv (2608.06469v1) introduced Fairis, a server-side reweighting scheme for collaborative machine learning that provably contains fairness poisoning attacks by malicious clients. Fairis guarantees every client strictly positive weight while reducing an adversary's weight by 41–54% on the Taiwan Credit dataset, even when the adversary evades accuracy-based defenses. The scheme is the only evaluated rule that ensures monotone weight reduction in the adversary's bias, though it assumes honest score reporting.

arXiv:2608.06469v1 Announce Type: cross Abstract: Collaborative machine learning among financial institutions must be both group-fair and robust against deliberate adversarial manipulation. Existing fairness-aware aggregation methods remain formally vulnerable to fairness poisoning: a malicious client maximizing group disparity while preserving accuracy evades accuracy-based Byzantine defenses, and in our threat model FairFed's gap-based weighting can be gamed by an adversary who observes the global fairness score. We present Fairis, a server-side reweighting scheme in which each client's update receives the normalized weight $\omega k = \bar{w} k / \sum j \bar{w} j$ built from the unnormalized score $\bar{w} k = \eta - \mathcal{F} k$, with $\mathcal{F} k \in 0,1 $ the local Equal Opportunity Difference and $\eta 1$ a security parameter. We prove three properties, Monotone Weight Reduction MWR , Demographic Participation, and Non-Gamesmanship, extend MWR to colluding minority coalitions, and show that combining MWR with server-side norm clipping bounds the adversary's displacement of the global model by $\omega 0 C$, strictly decreasing in its own reported disparity. Assuming honest score reporting, an assumption this paper does not discharge, Fairis is the only rule evaluated that guarantees every client strictly positive weight while provably reducing an adversary's weight monotonically in its bias; clipped FairFed can reach a lower weight but guarantees nothing and zeroes a client outright on Taiwan Credit. Against an adversary stealthy enough to evade accuracy-based defenses, within 0.04 accuracy of benign, Fairis cuts its weight by 41 to 54% below a size-blind control on Taiwan. On routine non-IID partitions no rule dominates, and a uniform-weighting ablation shows that containment tracks how far the adversary's score separates from the honest mean, providing none when the honest population is already unfair.