Fairness-aware Anomaly Detection via Fair Projection

We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.

Question 1: What is the best possible in terms of the fairness objective in the unsupervised setting?

Response: The ideal case involves achieving complete demographic parity across all groups for both normal and abnormal data. The necessary conditions for the ideal case are outlined below. For simplicity, we consider a sensitive attribute associated with two demographic groups, denoted as $s_i, s_j$.

• For the normal data $\mathcal{X}=\\{ \mathbf{x}\_1, \mathbf{x}\_2, \cdots, \mathbf{x}\_n \\}$, the complete demographic parity across groups is achieved when Proposition 2 (Section 3.3.3) holds, i.e., $h\_\phi (\mathcal{X}\_{s\_i}) =h\_\phi (\mathcal{X}\_{s\_j})$ where $h_\phi$ denotes the distribution projector.
• For the abnormal data $\mathcal{\tilde{X}}=\\{ \mathbf{\tilde{x}}\_1, \mathbf{\tilde{x}}\_2, \cdots, \mathbf{\tilde{x}}\_m \\}$, the complete demographic parity across groups is achieved when both Proposition 2 (Section 3.3.3) and Assumption 2 (Section 3.2) hold. Specifically, if the anomalies are generated from the normal data by a perturbation function $f$, such that $\mathbf{\tilde{x}} = f(\mathbf{x})$, then the condition $f \circ h = h \circ f$ ensures that the ideal case with respect to fairness is attained for both normal and abnormal data when Proposition 2 holds.

Question 2: What is the worst-case complexity for achieving the optimal objective value?

Response: We are a little confused about this question. Do you mean the iterative complexity for the optimal objective value in (11)? Since the optimization is highly nonconvex, there is no guarantee to achieve the optimal objective value. This is very common in deep learning. If you mean the complexity for reaching the zero objective value in (10), it depends the data and network size. The worst-case complexity for the network is that widths of all layers are equal to the input data dimension. That means, we have to compute the density in high-dimensional space, which may raise the test error.

Question 3: What is the worst case impact on anomaly detection with a fairness constraint?

Response: For simplicity, we assume to protect a sensitive attribute associated with two demographic groups. If samples from one group are abnormal while those from the other group are normal, imposing a fairness constraint on the optimization objective will inevitably degrade detection accuracy in such scenario. In the extreme case where complete group fairness is achieved between groups, the detection capability of the detector is lost entirely (e.g., AUROC=0.5)..

We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.

To Weakness 1 & Question 2: We complement experiments on a text data (SST_sentiment_fairness_data from HuggingFace) with gender as protected attribute. In this experiment, we use BERT(bert-large-uncased) to extract embeddings (dim=1024) and adopt balanced splitting for two groups. The related results are reported in the following table.

\begin{matrix} \hline & \text{AUC (\%) } & \text{normal (ADPD \%)} & \text{all (ADPD \%)} \\ \hline \text{FairOD} & 42.28 & 8.10 & 5.57 \\ \hline \text{Deep Fair SVDD} & 62.23 & 12.57 & 9.48 \\ \hline \text{Ex-FairAD (Ours)}& 62.79 & 6.99 & 5.17 \\ \text{Im-FairAD (Ours)} & 63.64 & 6.68 & 5.03 \\ \hline \end{matrix} We expect to extend the proposed framework to more different type of data (e.g. point cloud, graphs, video) in the future work.

To Weakness 2 & Question 3: The original optimization objective of Im-FairAD is as follows:

$

\underset{\phi, \psi}{\text{min}} ~ \sum\_{s \in S}\text{Sinkhorn}(h\_\phi(\mathcal{X}\_{S=s}), \mathcal{Z}) + \frac{\beta}{n}\sum\_{i=1}\^{n} \Vert \mathbf{x}\_i - g_\psi(h\_\phi(\mathbf{x}\_i)) \Vert^2,

$

where only single protected attribute is considered. When protecting multiple sensitive attributes (e.g., race & gender), the optimization objective of Im-FairAD can be naturally reformulated to the following form (similar on Ex-FairAD).

$

\underset{\phi, \psi}{\text{min}} ~ \sum\_{S \in \Omega} \sum\_{s \in S}\text{Sinkhorn}(h\_\phi(\mathcal{X}\_{S=s}), \mathcal{Z}) + \frac{\beta}{n}\sum\_{i=1}^{n} \Vert \mathbf{x}\_i - g_\psi(h\_\phi(\mathbf{x}\_i)) \Vert^2,

$

where $\Omega = \\{S^{\text{(race)}}, S^{\text{(gender)}}, \cdots\\}$ denotes the set of sensitive attributes. Meanwhile, the proposed fairness metric, ADPD, becomes

$

\text{ADPD} := \frac{1}{n \cdot \vert \Omega \vert} \sum_{S \in \Omega}\sum_{k=1}^{n} \Big\vert  \mathbb{P}(\text{Score}(\mathcal{X}) > t_k | S=s_i ) 
-  \mathbb{P}(\text{Score}(\mathcal{X}) > t_k | S=s_j) \Big\vert.

$

When the number of values of the protected attribute (e.g., race) exceeds two, i.e., $\vert S \vert > 2$, the ADPD becomes

$

\text{ADPD} := \frac{1}{n \cdot \vert \Omega \vert} \sum\_{S \in \Omega}\sum\_{k=1}\^{n} \max \big(  \big\\{  \big\vert \mathbb{P}(s\_i) - \mathbb{P}(s\_j) \big\vert  \big\\}^{s\_i, s\_j \in S}\_{i \neq j}  \big),

$

where $\mathbb{P}(s_i) = \mathbb{P}(\text{Score}(\mathcal{X}) > t_k | S=s_i)$ and the range of ADPD still is [0, 1).

To Question 1: This is a great question. In such scenario, the accuracy of distance measurement between distributions is compromised, which limits distribution transformation capability of the proposed method and further impacts the performance the detection and fairness for the extremes small groups.

Thank you for your thoughtful and detailed rebuttal. I appreciate the clarifications and additional experiments you provided in response to my questions.

We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.

To Weakness & Question 3: There are four key factors affecting the computational cost of Sinkhorn distance. We list them below.

• $n$: sample size;
• $d$: feature dimension of sample;
• $\alpha$: coefficient of entropic regularization term;
• $\epsilon$: stop threshold on error;

To evaluate the time cost associated with Sinkhorn distance, we conduct experiments to quantify the time required for a single computation of the Sinkhorn distance on both CPU and GPU. In this experiment, we utilize a real tabular data (Census from ADBench) as source distribution and a truncated Gaussian as target distribution, which maintains the task similarity with our proposed method. We keep $(n_\text{mini-batch}=4000, d=500)$ and adjust the $\alpha \in \\{1.0, 0.5, 0.1\\}$ and $\epsilon \in \\{1e^{-2}, 1e^{-3}, 1e^{-4}\\}$. Note that $n_\text{mini-batch}=4000$ means that 4000 samples drawn from source distribution and an additional 4000 samples drawn from target distribution, both of which are utilized in a single computation of the Sinkhorn distance. All the experiments are conducted on Ubuntu 22.04 with 10 Core Intel Xeon Processor, 1$\times$ NVIDIA Tesla V100S-32GB, CUDA 12.4. The average results with 10 repeats are provided in the following table.

The single computation time (seconds) of Sinkhorn distance.

\begin{matrix} \hline & {\epsilon=1e^{-2}} & {\epsilon=1e^{-2}} & {\epsilon=1e^{-2}} & {\epsilon=1e^{-3}} & {\epsilon=1e^{-3}} & {\epsilon=1e^{-3}} & {\epsilon=1e^{-4}} & {\epsilon=1e^{-4}} & {\epsilon=1e^{-4}}\\ & \text{CPU} & \text{GPU} & \text{Speedup} & \text{CPU} & \text{GPU} & \text{Speedup} & \text{CPU} & \text{GPU} & \text{Speedup} \\ \hline \alpha=1.0 & 11.89 & 0.1825 & 65\times & 12.07 & 0.1836 & 65\times & 12.66 & 0.2017 & 62\times \\ \alpha=0.5 & 12.77 & 0.1982 & 64\times & 12.82 & 0.2020 & 63\times & 13.14 & 0.2027 & 64\times \\ \alpha=0.1 & 14.49 & 0.2302 & 62\times & 14.51 & 0.2339 & 62\times & 14.63 & 0.2367 & 61\times \\ \hline \end{matrix}

These results indicates that the GPU can consistently accelerate the computation of the Sinkhorn distance about 60 times across various $(\alpha, \epsilon)$ configurations when handling similar tasks. To validate the performance on different type data, we further conduct experiments on two image datasets (CIAFR10, Fashion-MNIST) and three text datasets (IMDB, 20Newsgroups, Yelp), where we directly utilize their corresponding embeddings provided in ADBench. We keep $(\alpha=0.1, \epsilon=1e^{-4})$ in the following results. Based on this estimation on different type datasets (different source distributions), GPU can averagely accelerate the computation of the Sinkhorn distance about 50 times.

The single computation time (seconds) of Sinkhorn distance.

\begin{matrix} \hline \text{Dataset} & \text{Census} & \text{CIFAR10-(0)} & \text{Fashion-MNIST-(0)} & \text{IMDB} & \text{20Newsgroups-(0)} & \text{Yelp} & \text{Avg} \\ (n_\text{mini-batch}, d) & (4000, 500) & (4000, 512) & (4000, 512) & (3000, 768) & (3000, 768) & (3000, 768) & -\\ \hline \text{Time (CPU)} & 14.63 & 18.29 & 14.18 & 12.14 & 10.61 & 11.86 & 13.61\\ \text{Time (GPU)} & 0.2367 & 0.3260 & 0.2211 & 0.3308 & 0.2200 & 0.2848 & 0.2699\\ \text{Speedup} & 61\times & 56\times & 64\times & 36\times & 48\times & 41\times & 50\times\\ \hline \end{matrix}

When addressing a similar task (involving source distribution and feature (or embedding) dimension) with $**one million samples**$, based on the empirical estimation, a single computation of Sinkhorn distance requires approximately $90s \approx (1e^6 / 3000) * 0.2699s$ on the GPU. If this process is repeated 100 times, the total computational time associated with the Sinkhorn distance amounts to roughly 150 minutes. We argue that such a time cost may be acceptable for scenarios of this scale.

We summarize the several effective strategies for accelerating the computation of the Sinkhorn distance when handling high-dimensional and large-scale data as follow:

• First and foremost, leveraging GPU acceleration for computing the Sinkhorn distance.
• Dimensionality reduction when handling high-dimensional data.
• Employing relatively large values for $\alpha$ and $\epsilon$.
• Decreasing the number of samples drawn from target distribution.

For the information of well-defined demographic groups, the current version needs to know the protected attributes accurately and a compact target distribution is critical for distinguishing between normal and abnormal samples. We hope the future work can relieve the dependence for accurate demographics and try to propose more general target distribution.

To Question 1: First, when abnormal samples differ significantly from normal data, the anomaly detection task becomes trivial. In other words, the anomalies can be identified easily and accurately and the False Positive Rate $FPR=0$ can be achieved. Under such conditions, it does not yield fairness issues technically, as no samples would be misidentified. Regarding the demographic parity of true abnormal samples between groups, it is not a technical issue in this situation.

For these assumptions:

• Assumption 1 ensures the learnability of normal patterns while providing feasibility guarantees for the unsupervised anomaly detection task. All the existing unsupervised anomaly detection works have validated the assumption. In real-world scenarios, especially fault detection in industry, it is quite common that anomalous samples emerge as perturbed normal samples and the evolution from normality to anomaly is gradual.
• Similarly, on Assumption 2 and Assumption 3, they have already verified by the existing fairness-aware anomaly detection works, such as FairOD, Deep Fair SVDD, CFAD and so on. In our experiments, the results on real-world datasets validate the reasonability of the two assumptions again.
• Certainly, these assumptions cannot hold all domains and scenarios, nor is that our goal. In fact, we make (or summarize) these assumptions in order to clarify the necessary prerequisites for unsupervised anomaly detection (UAD) and fairness-aware UAD.

To Question 2: We conduct experiments to explore the sensitive of performance for different truncated radius $r$. The truncated radius $r$ is determined based on sampling probability $p$ in a Gaussian distribution $\mathcal{N}(\mathbf{0}, \mathbf{I}_d)$. We adjust $p \in \\{0.80, 0.85, 0.90, 0.95\\}$ and related results are reported in the following table. We can observe that the performance (including detection accuracy and fairness) exhibits minor fluctuations within a reasonable changing range of $p$.

The performance with different sampling probability $p$ on COMPAS and Adult (balanced splitting). Note that $F_d$ denotes the CDF of the chi-square distribution $\chi^2(d)$.

\begin{matrix} \hline r=\sqrt{F^{-1}_d(p)} & \text{Ex-FairAD} & \text{Ex-FairAD} & \text{Ex-FairAD} & \text{Im-FairAD} & \text{Im-FairAD} & \text{Im-FairAD}\\ & \text{AUC (\%)} & \text{normal (ADPD \%)} & \text{all (ADPD \%)} & \text{AUC (\%)} & \text{normal (ADPD \%)} & \text{all (ADPD \%)}\\ \hline & & & \text{COMPAS} & & & \\ \hline p=0.80 & 62.00 & 4.56 & 6.08 & 63.29 & 5.17 & 7.35\\ p=0.85 & 61.46 & 4.51 & 5.72 & 62.22 & 4.90 & 6.72 \\ p=0.90 & 63.13 & 3.40 & 6.31 & 63.17 & 4.05 & 6.97 \\ p=0.95 & 61.54 & 3.63 & 5.62 & 61.50 & 4.01 & 5.88\\ \hline & & & \text{Credit} & & & \\ \hline p=0.80 & 64.98 & 3.37 & 1.66 & 63.91 & 3.31 & 1.64\\ p=0.85 & 63.38 & 3.50 & 1.80 & 62.76 & 3.32 & 2.10\\ p=0.90 & 64.37 & 3.31 & 1.33 & 66.08 & 3.56 & 2.00\\ p=0.95 & 63.21 & 2.64 & 1.31 & 63.47 & 2.68 & 1.48\\ \hline \end{matrix}

We use truncated Uniform in hypersphere as target distribution and related results are reported in the following table.

\begin{matrix} \hline & \text{Ex-FairAD} & \text{Ex-FairAD} & \text{Ex-FairAD} & \text{Im-FairAD} & \text{Im-FairAD} & \text{Im-FairAD}\\ & \text{AUC (\%)} & \text{normal (ADPD \%)} & \text{all (ADPD \%)} &\text{AUC (\%)} & \text{normal (ADPD \%)} & \text{all (ADPD \%)}\\ \hline & & & \text{COMPAS} & & & \\ \hline \text{Uniform} & 60.02 & 4.09 & 4.99 & 60.47 & 3.79 & 3.92\\ \text{Gaussian} & 63.11 & 4.38 & 4.54 & 63.89 & 4.16 & 4.76\\ \hline & & & \text{Credit} & & & \\ \hline \text{Uniform} & 62.57 & 3.79 & 2.25 & 63.73 & 4.85 & 3.08\\ \text{Gaussian} & 64.96 & 2.95 & 1.92 & 63.70 & 2.20 & 1.97\\ \hline \end{matrix}

To Question 4: The original optimization objective of Im-FairAD is as follows:

$

\underset{\phi, \psi}{\text{min}} ~ \sum\_{s \in S}\text{Sinkhorn}(h\_\phi(\mathcal{X}\_{S=s}), \mathcal{Z}) + \frac{\beta}{n}\sum\_{i=1}\^{n} \Vert \mathbf{x}\_i - g_\psi(h\_\phi(\mathbf{x}\_i)) \Vert^2,

$

where only single protected attribute is considered. When protecting multiple sensitive attributes (e.g., race & gender), the optimization objective of Im-FairAD can be naturally reformulated to the following form (similar on Ex-FairAD).

$

\underset{\phi, \psi}{\text{min}} ~ \sum\_{S \in \Omega} \sum\_{s \in S}\text{Sinkhorn}(h\_\phi(\mathcal{X}\_{S=s}), \mathcal{Z}) + \frac{\beta}{n}\sum\_{i=1}^{n} \Vert \mathbf{x}\_i - g\_\psi(h\_\phi(\mathbf{x}\_i)) \Vert^2,

$

where $\Omega = \\{S^{\text{(race)}}, S^{\text{(gender)}}, \cdots\\}$ denotes the set of sensitive attributes. Meanwhile, the proposed fairness metric, ADPD, becomes

$

\text{ADPD} := \frac{1}{n \cdot \vert \Omega \vert} \sum_{S \in \Omega}\sum_{k=1}^{n} \Big\vert  \mathbb{P}(\text{Score}(\mathcal{X}) > t_k | S=s_i ) 
-  \mathbb{P}(\text{Score}(\mathcal{X}) > t_k | S=s_j) \Big\vert.

$

We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.

To Weakness 1 & Question 1: This is a practical and valuable question worthy of further exploration. There are four key factors affecting the computational cost of Sinkhorn distance. We list them below.

• $n$: sample size;
• $d$: feature dimension of sample;
• $\alpha$: coefficient of entropic regularization term;
• $\epsilon$: stop threshold on error;

To evaluate the time cost associated with Sinkhorn distance, we conduct experiments to quantify the time required for a single computation of the Sinkhorn distance on both CPU and GPU. In this experiment, we utilize a real tabular data (Census from ADBench) as source distribution and a truncated Gaussian as target distribution, which maintains the task similarity with our proposed method. We keep $(n_\text{mini-batch}=4000, d=500)$ and adjust the $\alpha \in \\{1.0, 0.5, 0.1\\}$ and $\epsilon \in \\{1e^{-2}, 1e^{-3}, 1e^{-4}\\}$. Note that $n_\text{mini-batch}=4000$ means that 4000 samples drawn from source distribution and an additional 4000 samples drawn from target distribution, both of which are utilized in a single computation of the Sinkhorn distance. All the experiments are conducted on Ubuntu 22.04 with 10 Core Intel Xeon Processor, 1$\times$ NVIDIA Tesla V100S-32GB, CUDA 12.4. The average results with 10 repeats are provided in the following table.

The single computation time (seconds) of Sinkhorn distance.

\begin{matrix} \hline & {\epsilon=1e^{-2}} & {\epsilon=1e^{-2}} & {\epsilon=1e^{-2}} & {\epsilon=1e^{-3}} & {\epsilon=1e^{-3}} & {\epsilon=1e^{-3}} & {\epsilon=1e^{-4}} & {\epsilon=1e^{-4}} & {\epsilon=1e^{-4}}\\ & \text{CPU} & \text{GPU} & \text{Speedup} & \text{CPU} & \text{GPU} & \text{Speedup} & \text{CPU} & \text{GPU} & \text{Speedup} \\ \hline \alpha=1.0 & 11.89 & 0.1825 & 65\times & 12.07 & 0.1836 & 65\times & 12.66 & 0.2017 & 62\times \\ \alpha=0.5 & 12.77 & 0.1982 & 64\times & 12.82 & 0.2020 & 63\times & 13.14 & 0.2027 & 64\times \\ \alpha=0.1 & 14.49 & 0.2302 & 62\times & 14.51 & 0.2339 & 62\times & 14.63 & 0.2367 & 61\times \\ \hline \end{matrix}

These results indicates that the GPU can consistently accelerate the computation of the Sinkhorn distance about 60 times across various $(\alpha, \epsilon)$ configurations when handling similar tasks. To validate the performance on different type data, we further conduct experiments on two image datasets (CIAFR10, Fashion-MNIST) and three text datasets (IMDB, 20Newsgroups, Yelp), where we directly utilize their corresponding embeddings provided in ADBench. We keep $(\alpha=0.1, \epsilon=1e^{-4})$ in the following results. Based on this estimation on different type datasets (different source distributions), GPU can averagely accelerate the computation of the Sinkhorn distance about 50 times.

The single computation time (seconds) of Sinkhorn distance.

\begin{matrix} \hline \text{Dataset} & \text{Census} & \text{CIFAR10-(0)} & \text{Fashion-MNIST-(0)} & \text{IMDB} & \text{20Newsgroups-(0)} & \text{Yelp} & \text{Avg} \\ (n_\text{mini-batch}, d) & (4000, 500) & (4000, 512) & (4000, 512) & (3000, 768) & (3000, 768) & (3000, 768) & -\\ \hline \text{Time (CPU)} & 14.63 & 18.29 & 14.18 & 12.14 & 10.61 & 11.86 & 13.61\\ \text{Time (GPU)} & 0.2367 & 0.3260 & 0.2211 & 0.3308 & 0.2200 & 0.2848 & 0.2699\\ \text{Speedup} & 61\times & 56\times & 64\times & 36\times & 48\times & 41\times & 50\times\\ \hline \end{matrix}

When addressing a similar task (involving source distribution and feature (or embedding) dimension) with $**one million samples**$, based on the empirical estimation, a single computation of Sinkhorn distance requires approximately $90s \approx (1e^6 / 3000) * 0.2699s$ on the GPU. If this process is repeated 100 times, the total computational time associated with the Sinkhorn distance amounts to roughly 150 minutes. We argue that such a time cost may be acceptable for scenarios of this scale.

We summarize the several effective strategies for accelerating the computation of the Sinkhorn distance when handling high-dimensional and large-scale data as follow:

• First and foremost, leveraging GPU acceleration for computing the Sinkhorn distance.
• Dimensionality reduction when handling high-dimensional data.
• Employing relatively large values for $\alpha$ and $\epsilon$.
• Decreasing the number of samples drawn from target distribution.

Based on the truncated Gaussian on $\mathcal{N}(\mathbf{0}, \mathbf{I\_d})$ as our target distribution, we define the anomaly score function as $\text{Score}(\mathbf{x}\_{\text{new}})=\big\Vert h\_\phi(\mathbf{x}\_{\text{new}}) \big\Vert$, which eliminates the need for a density estimation process.

To Weakness 2: In fact, the proposed method pays no much attention to the complexity of data distribution in the original space. We primarily expect that the normal data locate in some high-density regions in the latent space for a clear and reliable decision boundary. The transformation capability between distributions of the proposed method depends on the complexity of the neural networks and the accuracy of the distribution distance measurement. Theoretically, leveraging neural networks and the Sinkhorn distance, our method can effectively transform the complex data distributions into a well-defined target distribution.

To Question 2: We conduct experiments to explore the sensitive of performance for different truncated radius $r$. The truncated radius $r$ is determined based on sampling probability $p$ in a Gaussian distribution $\mathcal{N}(\mathbf{0}, \mathbf{I}_d)$. We adjust $p \in \\{0.80, 0.85, 0.90, 0.95\\}$ and related results are reported in the following table. We can observe that the performance (including detection accuracy and fairness) exhibits minor fluctuations within a reasonable changing range of $p$.

The performance with different sampling probability $p$ on COMPAS and Adult (balanced splitting). Note that $F_d$ denotes the CDF of the chi-square distribution $\chi^2(d)$.

\begin{matrix} \hline r=\sqrt{F^{-1}_d(p)} & \text{Ex-FairAD} & \text{Ex-FairAD} & \text{Ex-FairAD} & \text{Im-FairAD} & \text{Im-FairAD} & \text{Im-FairAD}\\ & \text{AUC (\%)} & \text{normal (ADPD \%)} & \text{all (ADPD \%)} & \text{AUC (\%)} & \text{normal (ADPD \%)} & \text{all (ADPD \%)}\\ \hline & & & \text{COMPAS} & & & \\ \hline p=0.80 & 62.00 & 4.56 & 6.08 & 63.29 & 5.17 & 7.35\\ p=0.85 & 61.46 & 4.51 & 5.72 & 62.22 & 4.90 & 6.72 \\ p=0.90 & 63.13 & 3.40 & 6.31 & 63.17 & 4.05 & 6.97 \\ p=0.95 & 61.54 & 3.63 & 5.62 & 61.50 & 4.01 & 5.88\\ \hline & & & \text{Credit} & & & \\ \hline p=0.80 & 64.98 & 3.37 & 1.66 & 63.91 & 3.31 & 1.64\\ p=0.85 & 63.38 & 3.50 & 1.80 & 62.76 & 3.32 & 2.10\\ p=0.90 & 64.37 & 3.31 & 1.33 & 66.08 & 3.56 & 2.00\\ p=0.95 & 63.21 & 2.64 & 1.31 & 63.47 & 2.68 & 1.48\\ \hline \end{matrix}

When instancing our framework by normalizing flow, we obtain the following the optimization problem:

$

\mathop{\text{maximize}}\_{\mathcal{W}} \sum\_{s \in S}\sum\_{\mathbf{x}\sim \mathcal{X}\_{S=s}} \log \Big(p\_{\mathcal{Z}}(F\_\mathcal{W}(\mathbf{x}))\left\vert\det(\nabla\_\mathbf{x}F\_\mathcal{W}(\mathbf{x}))\right\vert\Big),

$

where $S$ denotes the sensitive attributes. In this experiment, we use Real NVP as $F_\mathcal{W}$ and $\mathcal{N}(\mathbf{0}, \mathbf{I}\_d)$ as $\mathcal{Z}$. The related results are reported in the following tables. For $\text{Real NVP-1}$ and $\text{Real NVP-2}$, we use $\log \Big(p_{\mathcal{Z}}(F\_\mathcal{W}(\mathbf{x}\_{new}))\left\vert\det(\nabla_{\mathbf{x}\_{new}}F\_\mathcal{W}(\mathbf{x}\_{new}))\right\vert\Big)$ and $\Vert F\_\mathcal{W}(\mathbf{x}\_{new}) \Vert$ to measure the anomaly score of $\mathbf{x}\_{new}$, respectively. In this experiment, Real NVP indeed improves the detection performance. However, it results in degraded fairness compared to the original instances (Im-FairAD and Ex-FairAD).

\begin{matrix} \hline & \text{AUC (\%)} & \text{normal (ADPD \%)} & \text{all (ADPD \%)}\\ \hline \text{RealNVP-1} & 70.51 & 18.23 & 16.15 \\ \text{RealNVP-2} & 64.54 & 10.93 & 10.74\\ \hline \text{Ex-FairAD} & 63.11 & 4.38 & 4.54\\ \text{Im-FairAD} & 63.89 & 4.16 & 4.76\\ \hline \end{matrix}

To Question3: The definition of ADPD indicates its insensitivity to the sizes of groups concerning the sensitive attribute, as it is probability-based. Depending on the definition, ADPD can effectively measure the group fairness/unfairness across all possible cases.

Dear authors, thank you for your detailed rebuttal. It has addressed most of my concerns. I maintain my score to borderline accept.

We sincerely appreciate your thoughtful comments and recognition of our work. We have carefully addressed each question and concern below.

To Weakness 1: Yes, anomalies in real data could be more complex. Anomaly detection under adversarial attacks and fair anomaly for time series are important and interesting problems worthy of exploration in future work. We hope that our work can bring new perspectives to these future studies.

To Weakness 2: We complement experiments on a text data (SST_sentiment_fairness_data from HuggingFace) with gender as protected attribute. In this experiment, we use BERT(bert-large-uncased) to extract embeddings (dim=1024) and adopt balanced splitting for two groups. The related results are reported in the following table. \begin{matrix} \hline & \text{AUC (\%) } & \text{normal (ADPD \%)} & \text{all (ADPD \%)} \\ \hline \text{FairOD} & 42.28 & 8.10 & 5.57 \\ \hline \text{Deep Fair SVDD} & 62.23 & 12.57 & 9.48 \\ \hline \text{Ex-FairAD (Ours)}& 62.79 & 6.99 & 5.17 \\ \text{Im-FairAD (Ours)} & 63.64 & 6.68 & 5.03 \\ \hline \end{matrix}

Existing studies on fairness-aware anomaly detection in graph data, such as FairGAD and DEFEND, adopt an inductive learning paradigm where the training set and test set are identical. This setting differs from the learning paradigm (transductive learning) followed by the proposed method. We expect to extend the proposed framework to more different type data in the future work.

To Weakness 3: In Appendices D.1 and D.2 of our paper, we evaluated the fairness-accuracy trade off by adjusting $\beta \in \\{0.001, 0.01, 0.1, 1, 10, 100, 1000\\}$ and $\lambda \in \\{0.001, 0.01, 0.1, 1, 10, 100, 1000\\}$, respectively. The corresponding results are shown in Figure 6 and 7 in our manuscript. From Figure 6, we observe that as $\beta$ increases, the accuracy (measured by AUC) shows a trend of slight increasing first and then decreasing on both balanced and skewed data. The fairness (measured by ADPD) shows a pronounced increasing trend. From Figure 7, we observe that the impact of varying $\lambda$ on accuracy is marginal across most datasets. As $\lambda$ increases, the fairness shows a trend of decreasing first and then increasing in most cases.

To Weakness 4: We report the training time and the time occupied by Sinkhorn distance in single epoch. For this experiments, We maintain the same configurations as in our manuscript, with $\epsilon = 1e^{-4}$ (stop threshold on error of Sinkhorn distance) on the three tabular datasets (Compas, Adult and Credit) and $\epsilon=1e^{-3}$ for CelebA. The $\alpha$ (coefficient of entropic regularization term) is consistently set to $0.1$ across all experiments.

$

 \text{Sinkhorn}(\mathcal{X}, \mathcal{Y}):=  \min \langle \mathbf{P}, \mathbf{C} \rangle_F + \alpha \sum\_{i,j}\mathbf{P}\_{ij}\log(\mathbf{P}\_{ij}),  ~~\text{s.t.}~\mathbf{P}\mathbf{1} = \mathbf{a}, \mathbf{P}^T\mathbf{1}=\mathbf{b}, \mathbf{P} \geq 0.

$

The time cost (seconds) on the datasets with balanced splitting.

\begin{matrix} \hline \text{Dataset} & \text{\# Samples} & \text{Dimension} & \text{Ex-FairAD (all)} & \text{Ex-FairAD (Sinkhorn)} & \text{Im-FairAD (all)} & \text{Im-FairAD (Sinkhorn)} \\ \hline \text{Compas} & 2000 & 4 & 0.3842 & 0.1888 & 0.6028 & 0.3414 \\ \hline \text{Adult} & 12000 & 4 & 2.932 & 1.645 & 4.645 & 2.900 \\ \hline \text{Credit} & 10000 & 8 & 2.922 & 1.710 & 4.770 & 3.063 \\ \hline \text{CelebA} & 16000 & 512 & 243.51 & 150.18 & 264.12 & 159.58 \\ \hline \end{matrix}

To Question 1: Yes. A perfect projection holds the Proposition 2, which ensures complete group fairness among different groups of normal data. Under this condition, the ideal case is achieved when both Assumption 1 and Assumption 2 hold.

To Question 2: We conduct experiments on Compas(balanced splitting) to explore how fairness changes as the contamination rate $cr \in \\{0.05, 0.10, 0.15, 0.20\\}$ increases. The related results are reported in the following table. In terms of fairness, we observe that the fairness (measured by ADPD) of normal data exhibits minor fluctuations within a small range. However, the fairness across the entire test set (including normal and abnormal samples) shows the declining trends (better fairness) as $cr$ increases. This phenomenon aligns with our optimization objective: as the number of abnormal samples in the training set grows, the model would achieve improved group fairness among the groups of abnormal data.

The performance changes on Compas with the increasing of contamination rate.

\begin{matrix} \hline & \text{Ex-FairAD} & \text{Ex-FairAD} & \text{Ex-FairAD} & \text{Im-FairAD} & \text{Im-FairAD} & \text{Im-FairAD} \\ \hline & \text{AUC (\%) } & \text{normal (ADPD \%)} & \text{all (ADPD \%)} & \text{AUC (\%)} & \text{normal (ADPD \%)} & \text{all (ADPD \%)}\\ \hline 0.00 & 63.11 & 4.38 & 4.54 & 63.89 & 4.16 & 4.76 \\ \hline 0.05 & 58.84 & 4.33 & 4.55 & 58.88 & 4.11 & 4.72 \\ \hline 0.10 & 55.89 & 3.98 & 3.45 & 55.80 & 3.70 & 4.16 \\ \hline 0.15 & 54.48 & 4.19 & 3.11 & 55.01 & 3.89 & 3.51 \\ \hline 0.20 & 54.41 & 4.53 & 2.49 & 55.04 & 4.20 & 2.95 \\ \hline \end{matrix}

To Question 3: The computational cost associated with the Sinkhorn distance increases linearly with the number of sensitive attributes when protecting multiple sensitive attributes $\Omega=\\{ S^{(\text{race})}, S^{(\text{gender})}, \cdots\\}$. Given that $\vert \Omega \vert < 10$ in most cases, this scenario does not lead to prohibitive computational cost. To empirically validate this claim, we conduct experiments on Adult (gender & race) and Compas (gender & race) datasets to protect two sensitive attributes at the same time and report the computation cost (seconds) of Sinkhorn distance in the following table.

Time cost (seconds) of Sinkhorn distance when protecting one and two attributes in single epoch.

\begin{matrix} \hline & \text{Compas} & \text{Adult} \\ \hline \text{Im-FairAD (one)} & 0.3414 & 2.900\\ \hline \text{Im-FairAD (two)} & 0.6342 & 5.8610\\ \hline \end{matrix}