FairProof : Confidential and Certifiable Fairness for Neural Networks

TL;DR

FairProof tackles publicly verifiable fairness for confidential neural networks by coupling a local individual fairness certification for fully-connected ReLU networks with a cryptographic protocol that commits to the model and proves certificate correctness via succinct zero-knowledge proofs. It reduces the certification problem to robust verification using GeoCert, and introduces a ZKP-friendly lower bound $\epsilon_{LB}$ to enable efficient online verification while maintaining model confidentiality and uniformity. The approach is implemented in Gnark and validated on standard datasets, showing feasible certificate generation times and small proof sizes, enabling practical deployment under confidentiality constraints. Overall, FairProof demonstrates a viable path toward transparent, privacy-preserving fairness verification in high-stakes ML deployments.

Abstract

Machine learning models are increasingly used in societal applications, yet legal and privacy concerns demand that they very often be kept confidential. Consequently, there is a growing distrust about the fairness properties of these models in the minds of consumers, who are often at the receiving end of model predictions. To this end, we propose \name -- a system that uses Zero-Knowledge Proofs (a cryptographic primitive) to publicly verify the fairness of a model, while maintaining confidentiality. We also propose a fairness certification algorithm for fully-connected neural networks which is befitting to ZKPs and is used in this system. We implement \name in Gnark and demonstrate empirically that our system is practically feasible. Code is available at https://github.com/infinite-pursuits/FairProof.

Figures (24)

• Figure 1: Pictorial Representation of FairProof
• Figure 2: A neural network with ReLU activations partitions the input space into polytopes.
• Figure 3: Connection between robustness & fairness for $n=2$ and one sensitive feature $S$ with values $\{a,b,c\}$. Final fairness certificate is the minimum of $\{\epsilon_a, \epsilon_b, \epsilon_c\}$. Red color denotes decision boundary.
• Figure 4: GeoCert's behavior on point $x^*$. Colored facets are in the priority queue; red and solid black lines denote boundary and non-boundary facets respectively. Algorithm stops when the minimum distance facet is a boundary facet (rightmost).
• Figure 5: Projection of $x^*$ onto the hyperplane $H$ containing facet $\mathcal{F}$ gives a lower bound on the $\ell_2$ distance between $x^*$ and $\mathcal{F}$, i.e., $d_{proj}(x^*,\mathcal{F})\leq d_{\ell_2}(x^*,\mathcal{F})$.

Theorems & Definitions (15)

• Definition 1: Local Individual Fairness
• Theorem 3.1
• Theorem 4.1
• Lemma A.1
• Theorem C.1: Correctness of GeoCert Geocert
• Theorem C.3
• proof
• Theorem C.4: Correctness of FairProof
• proof
• Lemma D.1: Soundness of VerifyPolytope