{'fraction_non_alphanumeric': 0.03930356835028443, 'fraction_numerical': 0.008159512727690627, 'mean_word_length': 4.1322127199449525, 'pattern_counts': {'":': 0, '<': 29, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 10, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Unfairness Despite Awareness: Group-Fair Classification with Strategic Agents

The use of algorithmic decision making systems in domains which impact the financial, social, and political well-being of people has created a demand for these decision making systems to be"fair"under some accepted notion of equity. This demand has in turn inspired a large body of work focused on the development of fair learning algorithms which are then used in lieu of their conventional counterparts. Most analysis of such fair algorithms proceeds from the assumption that the people affected by the algorithmic decisions are represented as immutable feature vectors. However, strategic agents may possess both the ability and the incentive to manipulate this observed feature vector in order to attain a more favorable outcome. We explore the impact that strategic agent behavior could have on fair classifiers and derive conditions under which this behavior leads to fair classifiers becoming less fair than their conventional counterparts under the same measure of fairness that the fair classifier takes into account. These conditions are related to the the way in which the fair classifier remedies unfairness on the original unmanipulated data: fair classifiers which remedy unfairness by becoming more selective than their conventional counterparts are the ones that become less fair than their counterparts when agents are strategic. We further demonstrate that both the increased selectiveness of the fair classifier, and consequently the loss of fairness, arises when performing fair learning on domains in which the advantaged group is overrepresented in the region near (and on the beneficial side of) the decision boundary of conventional classifiers. Finally, we observe experimentally, using several datasets and learning methods, that this fairness reversal is common, and that our theoretical characterization of the fairness reversal conditions indeed holds in most such cases.


Introduction
The increasing deployment of algorithmic decision making systems in social, political, and economic domains has brought with it a demand that fairness of decisions be a central part of algorithm design. While the specific notion of 1 fairness appropriate to a domain is often a matter of debate, several have come to be commonly used in prior literature, such as positive (or selection) rate and false positive rate. A common goal in the design of fairness-aware (group-fair ) algorithms is to balance predictive efficacy (such as accurate) with achieving near-equality on a chosen fairness measure among demographic categories, such as race or gender. A question that arises in many domains where such "fair" algorithms could be used is whether they are susceptible to, and create incentives for, manipulation by agents who may misrepresent themselves in order to achieve better outcomes.
Fair classifiers are often deployed in domains where feature manipulation is possible, under some constraints or potentially at some cost to agents. For example, in selection of individuals to receive assistance from social service programs (e.g homelessness services), or in admission to selective educational programs, it may be possible for applicants to misreport things, such as the number of dependents, income, or other self-reported characteristics. Importantly, we assume that agents cannot lie about group membership itself, and that the classifier cannot use group membership in making predictions (it can only do so during training). This is in keeping with most policy frameworks where fair machine learning might be used, since explicit use of protected categories in decision-making is often illegal.
We investigate the effects of such strategic manipulation of a binary groupfair classifier. In the context of the social services example, the classifier's job is to determine if an applicant should, or should not, be granted assistance, and the fairness guarantee of this classifier could be approximate equality of false positive rate between male and female applicants. Specifically, we aim to understand the circumstances under which a group-fair classifier becomes less fair than its conventional analog (i.e., a similar classifier that does not explicitly consider group fairness). Our main high-level observation is that if a group-fair classifier achieves greater fairness by becoming more selective than a fairness-agnostic classifier, it is also more unfair than the latter when agents are strategic. We first establish this theoretically, albeit in restricted settings, and subsequently show that this fairness reversal property obtains for several classifiers and datasets, and our theoretical analysis helps explain why. Summary of results: We begin by examining threshold classifiers which operate on a single predictive feature (or an engineered score). Surprisingly, we show that in this setting strategic manipulation leads to a group-fair classifier being less fair than its baseline counterpart if and only if the group-fair classifier has a higher threshold (i.e., is more selective) than the baseline classifier. Furthermore, we provide conditions on the distribution of data for this to occur.
While the multivariate case is more complex, much of the intuition carries over. In particular, we demonstrate that for any hypothesis class from which the baseline and group-fair classifiers are sourced, there always exists a data distribution and a cost of manipulation such that fair classifiers become less fair under strategic manipulation. Additionally we show that when the fair classifier is more selective (aas formalized below), there exists a cost function such that the group-fair classifier becomes less fair than the base classifier in the presence of strategic agents. Lastly, we experimentally evaluate two state-of-theart group-fair learning algorithms on several standard datasets and demonstrate that in both the single-and multi-variable case, these algorithms often indeed produce models which are less fair than their baseline counterparts when agents act strategically. Selectivity and fairness: Fairness reversal is a consequence of group-fair models becoming more selective than their conventional counterparts. In the case of threshold classifiers, higher selectivity means that the group-fair classifier has a higher selection threshold θ F than the base (accuracy-maximizing) classifier (θ C ). When does this happen? Figure 1 provides some intuition. De-Figure 1: Stylized example of how the underlying conditional distribution leads to fair classifiers becoming more selective. The figures on the left hand correspond to the distribution, where x is the predictive feature, g indicates group membership, and y indicates true label. The figures on the right correspond to the accuracy and unfairness of the threshold θ with respect to the distribution. Here θ C corresponds to the threshold with the maximum accuracy, and θ U is the threshold with the maximum unfairness.
fine θ U as the threshold that maximizes unfairness. As discussed above, θ C is the threshold that maximizes accuracy. Assuming that the informative feature x is positively correlated with the desirable class y = 1, when θ C > θ U , the fair classifier will typically be more selective than the baseline, and the fairness reversal conditions will be met (top half of figure). This corresponds to a situa-tion where the advantaged group is overrepresented in the region of the x-space just to the right of the decision boundary of θ C . Shifting this decision boundary to the right (excluding members of the advantaged group) increases fairness. However, doing so means that the newly excluded members of the advantaged group are now those who benefit most from strategic manipulation. Conversely, if θ C < θ U this will likely not be the case, as pushing θ C to the right increases unfairness. While this is a stylized example, we show in Section 6 that the selectivity condition often holds using several real-world examples.

Related Work
Our work is closely related to two major strands in literature: algorithmic fairness, and in particular, approaches for group-fair classification, and adversarial machine learning (also called strategic classification).
Broadly, algorithmic fairness literature aims to study the extent to which algorithmic decisions are perceived as unfair, for example, by being inequitable to historically disadvantaged groups [Buolamwini and Gebru, 2018, Corbett-Davies and Goel, 2018, Bolukbasi et al., 2016, Ajunwa et al., 2016. In particular, many approaches have been introduced, particularly in machine learning, that investigate how to balance fairness and task-related efficacy, such as accurate [Agarwal et al., 2018, Feldman et al., 2015, Kearns et al., 2018, Xu et al., 2021, Zafar et al., 2019, Zemel et al., 2013, Hardt et al., 2016b. Most of these impose hard constraints to ensure that pre-defined groups are near-equitable on some exogenously specified metric, such as selection (positive) rate [Agarwal et al., 2018, Kearns et al., 2018, Zafar et al., 2019, although alternative means, such as modifying the data to eliminate disparities, have also been proposed [Feldman et al., 2015, Chouldechova, 2017.
The adversarial machine learning literature was initially motivated by security considerations, such as spam and malware detection [Lowd and Meek, 2005, Huang et al., 2011, Vorobeychik and Kantarcioglu, 2018. The primary issue of concern is that as we use machine learning techniques to identify malicious behavior, malicious actors change behavior characteristics to evade detection. It has, however, come to have a far broader scope, encompassing robustness of machine learning techniques in computer vision as well as social applications [Goodfellow et al., 2015, Hardt et al., 2016a, Björkegren et al., 2020, Dong et al., 2018, Chen et al., 2020. In the latter context, this has come to be known as strategic classification, to indicate the concern that individuals impacted by algorithmic decisions change their features (e.g., by misreporting their household characteristics on surveys used to allocate housing to the homeless) and thereby undermine algorithms' efficacy. The intersection between strategic classification and fairness is particularly salient to our work, and has featured studies that highlight the inequity that results from strategic behavior by individuals [Hu et al., 2019], as well as inequity (social cost) resulting from making classifiers robust to strategic behavior [Milli et al., 2019, Xu et al., 2021. Our goal, however, is quite distinct: we investigate the extent to which group-fair classification itself leads to greater inequity compared to baseline approaches that do not include group-fairness constraints as a result of strategic behavior by individuals.

Preliminaries
We consider a setting with a population of agents, with each characterized by 1) a feature vector x ∈ X , 2) a group g ∈ G ≡ {0, 1} to which it belongs (as is common in much prior literature, we treat it as binary here), and 3) a (true) binary label y ∈ Y ≡ {0, 1}, denoting, for example, the agent's qualification (for a service, employment, bail, etc). Let D be the joint distribution over G×X ×Y. We define h(x) as the marginal pdf of x, and assume that h(x) > 0 for each x ∈ X .
Since using the sensitive group membership feature may pose a legal challenge, we assume that neither the conventional nor the group-fair classifier do so at prediction time (but may at training time). We denote the baseline, or conventional, classifier by f C , while the group-fair classifier is denoted by f F , and both map feature vectors x into a binary label y ∈ Y. We assume that the baseline classifier aims to maximize accuracy, i.e., f C ∈ arg max f P (x,y) f (x) = y , while f F aims to balance accuracy and fairness, solving where α ∈ [0, 1] specifies the relative weight of accuracy and fairness terms, while M(f ; g) is a measure of efficacy (e.g., positive rate) of f restricted to a group g.
In the literature fairness is sometimes defined with hard constraints, rather than the soft constraints of α-fairness, for example With hard constraints, decreasing β can never increase the unfairness of f F . In general soft constraints do not have the propriety that increasing α will never increase the unfairness of f F . However, in the settings we study this is not an issue as there is a direct correspondence between α and β fairness.
We consider the impact of strategic behavior of agents when they face a classifier f (whether baseline or group-fair). Specifically, we suppose that each agent with features x can modify these, transforming them into another feature vector x that is reported to the classifier. In doing so, the agent incurs a cost, captured by a cost function c(x, x ) ≥ 0. As in Hardt et al. [2016a], we define the agent's utility to be Following the standard setting in strategic classification or adversarial machine learning, we assume any misreporting behavior would not change the true nature of x's label y. We assume that all agents are rational utility maximizers. Thus, since f (x )−f (x) ≤ 1, the agent will misreport its features only when c(x, x ) ≤ 1; additionally, the agent will not misreport if f (x) = 1 (they are selected even with true values of features).

Classifiers on a Single Variable
First we consider the case in which there is a single continuous feature, i.e. X = [0, 1] and classifiers are thresholds on this feature. Recall that f C is the base classifier selected for maximum accuracy, and f F is an α-fair classifier w.r.t. to fairness metric M. We can express both classifiers as single parameter We start by formalizing some standard notions we use extensively.

Preliminaries and preparations
This single crossing property is relevant to our work as we look at conditional distributions which have a single crossing with their unconditioned counterpart, e.g.. the functions P y = 1|x and P y = 1 have a single crossing w.r.t. x. Experimentally we observe that this single crossing between P y = 1|x and P y = 1 , as well as P g = 1|x and P g = 1 where g indicates group membership, almost always holds in practice. Note that any monotone function has a single crossing with every constant function and thus monotone conditionals trivially satisfy this condition.
We begin our investigation by proving several lemmas (whose proofs are provided in the supplement) which will be useful in proving our main results, namely Theorems 1 and 2, later in the section.
Lemma 1. Suppose that P y = 1|x) has a single crossing with P(y = 1). Then error is negatively unimodal w.r.t. θ and the optimal base threshold is θ C s.t. P y = 1|θ C = P y = 1 .
Lemma 3. Suppose that fairness is defined by either True Positive Rate or False Positive Rate and that g, y are conditionally independent given x. Suppose further that P g = 1|x has a single crossing with P g = 1|y = 1 in the TPR case and by P g = 1|y = 0 in the FPR case. Then when M is TPR or FPR, 1. M D (θ|g = 1) ≥ M D (θ|g = 0) for any θ ∈ [0, 1], (i.e. group 1 is advantaged under any threshold classifier), and 2. the unfairness term M D (θ|g = 1) − M D (θ|g = 0) is positively unimodal w.r.t. θ and is maximized at any θ U s.t. P g = 1|x = θ U = P g = 1|y = 1 in the TPR case and P g = 1|x = θ U = P g = 1|y = 0 in the FPR case.
Lemma 4 implies that strategic agent behavior can be examined through both the perspective of the original classifier f predicting on the modified distribution D or a modified classifier f on the original distribution D. Since our investigation involves comparing two classifiers, f C and f F , the latter perspective will prove particularly useful given that the distribution D remains invariant between classifiers.

Fair vs. baseline classifiers when agents are strategic
We now have the tools to compare the relative fairness of the fair classifier f F and the baseline classifier f C when agents are strategic. First we state a necessary and sufficient condition for which the fair classifier becomes less fair than the baseline classifiers when agents best respond to either classifier, namely that f F becomes less fair than f C if and only if f F is more selective than f C (i.e. the set of examples which f F classifies as a 1, is a subset of those classified as a 1 by f C ). Next we state a sufficient condition on the underlying distribution D that guarantees that f F will become less fair than f C when both are learned on D. We observe that this sufficient condition is frequently satisfied in our experiments.
Note that if the budget of agents is so high that both f C and f F classify all agents as positive, then both classifiers have equal fairness and our results hold in an uninteresting manner. Thus we assume for the remainder of the paper that the available budgets do not induce such degenerate outcomes.
Theorem 1. Suppose fairness is defined by PR, TPR, or FPR. Suppose further that P y = 1|x has a single crossing (Def 2) with P(y = 1), P g = 1|x has a single crossing with value given in Lemmas 2 and 3, c(x, x ) is monotone in |x − x|, and θ C , θ F are respectively the most accurate and optimal α-fair thresholds. Then there exists a range of budgets [B 1 , B 2 ] such that strategic behavior agent behavior, with budget B ∈ [B 1 , B 2 ], leads to f F being less fair than f C if and only if θ C < θ F , (i.e. fair classifiers which are more selective than their baseline counterpart become less fair under strategic manipulation) Proof Sketch. The full proof is provided in the supplement. The unfairness of threshold θ w.r.t. to the distribution D and fairness metric M ∈ {PR, TPR, FPR} is expressed as, For a given threshold θ and manipulation budget B the best response of an agent with true feature x is When agents from D play this optimal response, let the resulting distribution be D (B) θ . The difference in unfairness, between classifiers, when agents are strategic By lemma 4 this unfairness can be expressed in terms of the true distribution D, namely By the monotonicity of c both θ C , θ F are monotonically decreasing w.r.t. B and θ This must be true since the only setting in which this does not occur is θ C < θ F < θ U , which would imply that f C is at least as fair as f F on D. Thus the forward direction holds. Now assume that there exists a budget B such that U D (θ which would imply again that f C is at least as fair as f F on the true distribution. Thus the converse direction also holds. Theorem 1 indicates that the fair classifier becomes less fair than the base classifier (under PR, TPR, or FPR) iff θ C < θ F , i.e. only fair classifiers which are more selective than their baseline counter parts lead to greater unfairness under strategic behavior. With this observation, the question then becomes: under what conditions is f F actually more selective than f C ? We now provide a sufficient condition on the underlying distribution D such that the optimal α-fair classifier is indeed more selective. In section 6 we demonstrate empirically that these sufficient conditions do in fact hold frequently in practice.
Theorem 2. Suppose fairness is defined by PR, TPR, or FPR. Suppose further that P y = 1|x has a single crossing with P(y = 1), and that P g = 1|x has a single crossing with the respective value given in Lemmas 2 and 3, call this value p g . Let x y and x g be defined by P y = 1|x y = P(y = 1) and P g = 1|x g = p g If x g < x y , then there exists a nonempty interval [α 0 , α 1 ] s.t. for any α ∈ [α 0 , α 1 ] the optimal α-fair classifier f F , has the propriety that θ C < θ F (implying that strategic agent behavior leads to f F becoming less fair than f C as outlined by Theorem 1).
Intuitively this condition is saying that if the advantaged group (group 1) is overrepresented among features x which have a slightly higher than base rate probability to be true positive examples (y=1), the optimal α-fair classifier achieves its fairness by negatively classifying those "borderline" features on group 1 is overrepresented. This selectivity in turn leads to strategic agent behavior reversing the relative fairness of f C and f F since those newly rejected members of group 1 are now those who will most benefit from strategic manipulation. The size of this range of fairness coefficients will be a function of how great the over-representation of group 1 is on the features x. (See Figure 1) Proof Sketch. The full proof is provided in the supplement. Note that x y = θ C and x g = θ U , and thus θ U < θ C . For metric M ∈ {PR, TPR, FPR} the fair learning objective is By Lemmas 1, 2, 3 the error term P I[x ≥ θ F ] = y is negatively unimodal w.r.t. θ and the unfairness term U (θ, D) is positively unimodal. Therefore it cannot be the case that θ U < θ F < θ C , which implies that θ F lives either on [0, θ U ) or (θ C , 1]. Further the optimal θ F restricted to [0, θ U ) is monotonically decreasing, and the optimal θ F restricted to (θ C , 1] is monotonically increasing, w.r.t. α. Thus unfairness is monotonically decreasing on both intervals w.r.t. to α. Since θ U < θ C and both P I[x ≥ θ] = y and U (θ, D) are smooth it must be the case that there exists a θ s.t. any θ ∈ [θ C , θ ] has the property that Thus for α ∈ (0, α ], where α is the fairness coefficient corresponding θ , the optimal fair classifier has θ C < θ F .
We now turn our attention to a complementary observation. Previously we examined how strategic agent behavior can lead to a fairness reversal between the fair classifier f F and the baseline classifier f C . This fairness reversal also comes with an interesting accuracy reversal. Not only is it the case that strategic behavior leads to f F taking on some of the unfairness of f C , but also leads to f F obtaining some of the accuracy of f C as well. This is primarily due to the fact that f F becomes more selective and therefore more resilient to manipulation. This benefit overrides the accuracy drop on the original distribution when the budget B is sufficiently large. To illustrate this concept we look at linearly separable data, i.e. there exists a θ * such that for x ≥ θ * , y = 1; otherwise y = 0.
Denote the following set: Note that for a fixed θ, X (θ, B) is monotone in B, i.e. a larger B incurs a larger X (θ, B).
Theorem 3. When θ F > θ C (the fair classifier is more selective), and B is large enough such that The full proof is provided in the supplement.
Fair classifiers when agents are strategic vs. when agents are truthful: Thus far we have considered fairness reversals between f F and f C . However, it is worth noting that Theorem 1 also implies that the unfairness of f F must strictly increase for some range of manipulation budgets, and Theorem 2 is then also sufficient for this strict decrease of fairness to occur. Thus there always exists some range of manipulation budgets for which the fairness of the fair classifier strictly decreases in the presence of strategic agents.

Multivariate Classifiers
It is more challenging to show general results for multivariate classifiers. However, we can provide three main results that tie into both the univariate case and our subsequent empirical analyses. First we show existence: If the hypothesis class under consideration is at least as expressive as linear models, fairness reversal can occur under some distributions and cost functions. Second we show that when the fair classifier is, in a strict sense, more selective than the base classifier, there is always some cost function under which a fairness reversal occurs. Finally, to show that such cost functions are not necessarily esoteric, we provide an example of a natural cost function for linear classifiers that leads to fairness reversal. The next theorem states that if the set of examples which f F classifies as positive is partially a subset of those which f C classifies as positive, then there exists a cost function such that strategic agent behavior leads to f F being less fair than f C .
Proof Sketch. The full proof is provided in the supplement. Strategic agent behavior causes the decisions of a classifier to change only in one direction: negative predictions become positive.
) can be constructed by a cost function c and f F , yielding equal fairness between f C andf F on X ).
This result implies that the difference in unfairness between f F and f C grows as X shrinks. That is, as the positive predictions of f F are more likely to be subsumed by f C , the difference in unfairness grows. This relationship between f C and f F holds particularly well when the cost function is congruent to the decision boundary of f C , as is the case with monotone cost functions and threshold classifiers as well as the l 2 -norm costs and linear classifiers.
While there may be edge cases which require this cost function to be obscure for the result to hold analytically, we demonstrate in our experimental section that the l 2 norm is often a sufficient cost function for this result to hold. Additionally we provide a concrete example where more selective linear classifiers exhibit this fairness reversal between f C and f F with l 2 manipulation cost.

Linear classifiers:
We now turn to linear classifiers as an illustrative example. Suppose both group membership and true label have the following relationship with x: where v y , v g are fixed vectors and ϕ y , ϕ g are a monotone functions describing a proper PDF. To model the "advantage" of group 1, let v T g v y > 0 (i.e. the Hamming product is elementwise nonnegative, implying that each feature x is either negatively, or positively, correlated with both y and g.). In the supplement we show this regularly arises on real data.
Theorem 6. Let f C and f F be the optimal base and fair linear classifiers respectively. If f F is more selective than f C , i.e. w C w F > 0 and θ F > θ g , then there exists a range of manipulation budgets [B 0 , B 1 ] s.t. c(x, x ) = ||x − x || lead f F to be less fair than f C .
Proof. The full proof is provided in the supplement.

Experiments
In this section we experimentally study the fairness reversal phenomenon that we so far considered theoretically. We use three datasets commonly found in the fairness literature, Recidivism: The COMPAS dataset in which the objective is to predict reoffending. Law School: Dataset of law students where the objective is to predict barexam passage. Community Crime: Dataset of communities where the objective is to predict if the community has high crime.
All three datasets have binary outcomes, and we label the more desirable outcome for the individuals by y = 1 (e.g., not re-offending in the recidivism data), with the less desirable outcome labeled by y = 0. Consequently, higher positive rate (PR), , or false positve rate (FPR) is more desirable for individuals. Group membership in each dataset is determined by race, which in these datasets corresponds to a binary feature. In all cases, we refer to the "advantaged" group (e.g. the group with higher PR for PR based fairness) as group 1, or G 1 , while the disadvantaged group is referred to as 0 or G 0 .
We begin by considering single-variable threshold classifiers. For each dataset we look at thresholds over ordinal features. In both the Recidivism and Law School datasets there are 4 such features (excluding age). In the Community Crime dataset we select 4 features which have non-negligible unfairness and high correlation between the feature x and label y. We then scale each feature to have domain [0, 1] and for visual consistency across plots, if Cor(x, y) < 0 we set x := 1 − x. In these three datasets most ordinal features satisfy the single crossing condition, and thus these featuers also satisfy the unimodality of error and unfairness w.r.t. to the threshold θ -this is discussed further in the supplement.
Recall that in Section 4 we showed that if error is negatively unimodal and unfairness is positively unimodal then f F becomes less fair than f C under strategic behavior if and only if θ F ≥ θ C . We examine error and unfairness as a function of the selected features for each of the three datasets and each of the three fairness criteria. Due to space limitations, we present two of the figures here and defer the other seven, which are qualitatively similar, to the supplement. Figure  2 shows that both error and unfairness are approximately unimodal across each variable for each combination of dataset and fairness metric, with the exception of one example in which unfairness is negligible for any threshold. Moreover in these figures we see that θ C < θ F holds in all but the aforementioned exception.
In the supplement, in addition to presenting graphs for other combinations of dataset and fairness metric, we also outline why the unimodality of error and unfairness arises so frequently. Specifically we show that when the conditional probabilities P y = 1|x and P g = 1|x meet the single crossing condition, as characterized in Section 4, unfairness, error, or both exhibit unimodality. Moreover, this is indeed the typical case in real data, with exceptions infrequent.

Multivariable Classifiers
Next, we study fairness reversal in settings where we make use of all ordinal features in the datasets, and consider three common baseline classifiers: logistic regression (LGR), support vector machines (SVM with an RBF kernel), and neural networks (NN). We consider two algorithms for group-fair classification: one due to Agarwal et al. [2018] (Reductions) and the second due to Kearns et al.
[2018] (GerryFair ). Both leverage a connection to cost-sensitive learning, but the specific techniques are different. Significant for our purposes is that both approaches turn the problem of learning with hard group-fairness constraints (that group averages on a given measure are within a specified tolerance level β) into a series of unconstrained optimization problems via an approximated Langrangian multiplier, which corresponds to α in our notation. Agents' manipulations are computed via Projected Gradient Decent (PGD) [Madry et al., Figure 2: Optimal base and fair threshold classifiers θ C , θ F respectively, on the Law School and Recidivism datasets. Recall that θ F > θ C (observed in all examples, except for one -Juvenile Other Count + Recidivism) implies that strategic agent behavior will lead to θ F becoming less fair than θ C . Error and unfairness are approximately unimodal. 14 2018]; this is discussed further in the supplement. Figure 3 shows the unfairness and error of the fair (f F ) and base (f C ) classifiers, and presents three cases in which the fairness reversal occurs and one in which it does not. These are representative cases. Both error (dotted) and unfairness (solid) exhibit unimodality (w.r.t. the budget B, which is ultimately the parameter we care about -in the single variable case unimodality in θ implies unimodality in B for any monotone cost function c) for both the base (blue) and fair (orange) classifiers. The shaded part indicates the region (and magnitude) of fairness reversal. In this region, the base classifier becomes more fair than than the fair classifier under strategic behavior, and there is a corresponding change where the fair classifier becomes more accurate than the base classifier, as predicted by Theorem 3. We observe experimentally that this fairness reversal is common on both the Law School and Community Crime datasets for any combination of fairness definition, base classifier, and fair learning scheme (see Supplement).
However, while the Recidivism dataset lends itself to unfairness in the single variable case, this reversal is quite infrequent in the multivariate setting, due in part to the fact that the particularly predictive features in the other two datasets are more directly correlated with group membership than those in the recidivism dataset (all though the correlation is in general high, it is lower than the other two datasets). This is discussed further in the supplement.   That is, so long as f (x) is upper bounded by v prior to crossing v, and lower bounded by v after crossing v, the single crossing condition holds.

Supplement
Single crossing and unimodality Lemma 5. A once-differentiable function is unimodal if its derivative has a single crossing with the constant function 0.
Proof. Let f (x) : R → R be a once-differentiable function. Suppose that f (x) has a single crossing with 0. Then there exists a point z such that x ≤ z implies f (x) ≤ 0 and z ≤ x implies 0 ≤ f (x). Thus f is monotonically decreasing on the interval (−∞, z] and monotonically increasing on the interval [z, ∞). Implying that f is unimodal.

Proofs
Proof: (Lemma 1). The error of a classifier f (x) = I[x ≥ θ] is given by, Since x is a continuous random variable and the terms involving θ are joint CDFs with well defined conditional PDFs, the derivative of the above expression w.r.t.
to θ, exists and is equal to Since P y = 1|x = θ is split by the value 1 /2, the above derivative is split by the value 0, thus by Lemma 5 error is negatively unimodal with global minima at any θ C s.t. P y = 1|x = θ C = 1 /2.
Proof: (Lemma 2). For a classifier f (x) = I[x ≥ θ], we begin by demonstrating (1) the unimodality of P x ≥ θ|g = 1 − P x ≥ θ|g = 0 and then use this propriety to show (2) the equivalence between P x ≥ θ|g = 1 − P x ≥ θ|g = 0 and the unfairness term P x ≥ θ|g = 1 − P x ≥ θ|g = 0 . First, note that Since each term involving θ is a joint CDF, the derivative of this term w.r.t to θ exists and is equal to Since P g = 1|x is split by the value P g = 1 the above term is split by the value 0, thus by Lemma the term P x ≥ θ|g = 1 − P x ≥ θ|g = 0 is positively unimodal, and is maximized at any θ U s.t.
Since h x (x = θ) > 0 any such θ U has the propriety that P g = 1|x = θ U = P g = 1 . Thus concluding the proof of (2). We now use (2) to show that (1) immediately follows. Note that for θ ∈ {0, 1} we have P x ≥ θ|g = 1 = P x ≥ θ|g = 0 . Since the function is positively unimodal and P g = 1 > 0 neither θ = 0 nor θ = 1 can be points corresponding to local maximums, hence for any θ we have Proof: (Lemma 3. This proof follows a similar argument to the the proof of 2. Proof: (Lemma 4). When all agents prefer positive predictions to negative predictions, their manipulations will change the classifier in only a single direction, namely manipulations cause negatively predicted examples to become positively predicted. Thus, only agents with feature x, where f (x) = 0 need be considered.
Suppose f is a threshold classifier with threshold θ, then the agent's best response to f is, Since the cost function c(x, x ) is monotone w.r.t. |x −x| the above best response has solution Moreover, the monotonicity of c(x, x ) also implies that if an agent with feature x has best response x * = θ, then so will any other agent with x 1 where x ≤ x 1 < θ. Thus, the distribution shift of D caused by strategic behavior, can be quantified in terms of the agent with the smallest feature which is able to report a value of θ, i.e. the feature Thus when agents are strategic, any agent with feature x ≥ x min will be positively classified by f . Therefore, the threshold θ = x min makes the same classifications on the unmanipulated distribution D as θ makes on the manipulated distribution D (B) θ . Proof: (Theorem 1). We first show that θ C < θ F implies the existence of a budget interval [B 1 , B 2 ] s.t. strategic agent behavior under any B ∈ [B 1 , B 2 ] leads to f F being less fair than f C . We then show that if θ F < θ C , no such budget interval exists.
The unfairness of threshold θ w.r.t. to the distribution D and fairness metric M ∈ {PR, TPR, FPR} is expressed as, For a given threshold θ and manipulation budget B the best response of an agent with true type a = (g, x) is When agents, originally distributed in accordance with D, play this optimal responses w.r.t. θ and B, let the resulting distribution be D (B) θ . The difference in unfairness, between classifiers, when agents are strategic, can then be expressed θ F ). Lemma 4 gives a way to express this difference in terms of the original distribution D by changing the thresholds, namely By the monotonicity of c(x, x ) w.r.t.
x − x we have that i.e. the relative ordering of the thresholds is preserved under strategic behavior for any manipulation budget B, this fact will be of use later.
Let θ U = argmax θ U (θ, D), we now proceed to prove the forward direction of our claim by three cases of the relative order of the thresholds θ C , θ F , θ U : First note that case (1) is infeasible. By Lemmas 2 and 3, we know that U (θ, D) is positively unimodal and maximized at θ U . Therefore, for θ ∈ [θ C , θ U ] we have that U (θ, D) is monotonically increasing. Thus in case (1) we have U (θ F , D) ≥ U (θ C , D), which is impossible since f F is assumed to be strictly more fair than f C .
To prove that the claim holds in cases (2) and (3) we use the fact that the unfairness term U (θ, D), being positively unimodal implies that the term is also monotonically increasing on the interval [0, θ U ] and monotonically decreasing on [θ U , 1]. Hence, as stated previously, for any θ 1 ≤ θ 2 ≤ θ U it must also be the case that U (θ 1 , D) ≤ U (θ 2 , D) ≤ U (θ U , D). Therefore it suffices to show that there exists a budget interval [B 1 , B 2 ] s.t. for any B ∈ [B 1 , B 2 ] we have θ F θ U , and as stated previously, for any B ≥ 0 θ C < θ F implies that θ F . Hence we need only show that in cases (2) In both cases, (2) and (3), this follows immediately form Lemma 4, which gives the existence of a budget B U , such that θ (B U ) F = θ U , and implies that θ F (B) is monotonically decreasing w.r.t. to B. Therefore, for any B ∈ [B U , ∞) it must be the case that U (θ To prove the reverse direction, we need to show that when θ F < θ C it is the case that for any B ≥ 0 we have U (θ . We again show this by three cases on the relative order of the thresholds θ F , θ C , θ U : Similar to the forward direction of the proof, one case is infeasible, namely case (3). This can be seen be a symmetric argument to the previous one, specifically that on the interval [θ U , θ C ] both error and unfairness are monotonically decreasing, and thus θ F could not be an optimal fair threshold.
As shown previously, when θ F < θ C it is also the case that for any B ≥ 0 we have θ C , D). Thus the claim holds for case (1), leaving only case (2) left to prove.
In case (2) Therefore the reverse direction of the claim holds, and thus there exists an Proof: (Theorem 2). Given α ∈ (0, 1), fairness metric M ∈ {PR, TPR, FPR}, and data distribution D, the objective of learning scheme is to find θ F such that where U D (θ) = M(θ|g = 1) − M(θ|g = 0) By Lemma 1 the error term P I[x ≤ θ] = y is negatively unimodal unimodal in θ and achieves a minimum at θ C where P y = 1|x = θ C = P(y = 1). Similarly, by Lemmas 2, 3 the unfairness term U D (θ) is positively unimodal in θ and achieves a maximum at θ U where P g = 1|x = θ U = P g = 1 . Thus for any α the fair learning objective (Equation 2) is monotonically increasing, thus θ F / ∈ [θ U , θ C ]. Implying that either θ F ∈ [0, θ U ) or θ F ∈ (θ C , 1]. Moreover since Proof: (Theorem 3). Since the data is linearly separable, and the definition of θ C , we have θ C = θ * which has an accuracy of 1. Due to the manipulation from X (θ C , B), the accuracy of θ C on D is then precisely 1 − P x ∈ X (θ C , B) .
Define the following two quantities: x.
Consider the following two cases. First when x F ≤ θ C . Since all x ≥ θ C would either be classified by θ F as 1 or be included in X (θ F , B) (so will report a x which will be classified as 1), the accuracy of θ F is precisely 1 Since c is monotonic in |x − x |, and θ F > θ C , we have x F > x C , and therefore establishing θ F is more accurate. Now consider the case x F > θ C . In this case, the error of θ F is incurred by the x ∈ [θ C , x F ] that has a y = 1 but has no incentive to deviate into X (θ F , B) and be misclassified. Therefore the accuracy of θ F is: where the inequality is due to the condition we required.
Proof. This proof follows a similar line of reasoning to its single dimensional counter part, namely that agents best responding to linear classifiers f C and f F can equivalently formulated as those same agents truthfully reporting to two modified linear classifiers f C and f F . More specifically, agents sourced from D best responding to a classifier, say f with cost function c(x, x ) = ||x − x || and budget B, causes a shift in D. We call this shift D (B) f , when agents strategically react to f , the classifier f is now predicting over D (B) f , rather than D. However, there exists a modified linear classifier f whose predictions on D are precisely those of f on D (B) f . Thus our proof strategy is to prove that there exists a B 0 s.t. for any B ≥ B 0 , the corresponding modified base and fair classifier f C and f F have the propriety that f F is less fair than f C on D.
To construct f C and f F we first compute the best response of agents. Under the cost function of c(x, x ) = ||x − x || and a classifier linear classifier with parameters w, θ the optimal response of an agent with true feature x is to play x otherwise Using this best response and the fact that w C , w F are unit vectors we can assume for the sake of analysis, that every agent plays x = x − Bw since doing so will not effect the decisions of f . Therefore we can write f C and f F as w C , θ F − B and w F , θ F − B respectively. Thus, we need only show that for some B, thresholds θ F − B and θ C − B have "reversed" fairness compared to θ F and θ C . Since w C w F > 0, it must also be the case that w F v g > 0 and w C v g > 0, which in turn implies that P(g = 1|x) is also monotone in w T F x and w T C x. As a result, if there are no agents which f F predicts positively, but f C predicts negativity, then f C is at least as fair as f F . More specifically, let The fairness of f C and f F are equal on X \ S 0,B ∪ S 1,B ), since on this set their decisions agree. We show that if S 1,B = ∅ for some B , then there exists a budget B 0 ≥ B s.t. for all B ≥ B 0 . The existence of B comes directly from the fact that θ F > θ C . Such a B must exist since θ C < θ F .
Intuitively this follows a similar argument to the single variable case, namely that S 1,B = ∅ implies that the hyperplane induced by f F is an upperbound for the hyperplane induced by f C . Meaning that unfairness is again unimodal w.r.t. the budget B.
More specifically, the PR fairness of a linear classifier can be expressed as Thus if S 1,B = ∅ then the difference in unfairness of f F and f C can be expressed Since we only care that this quantity is non-negative, i.e. f C is at least as fair as f F , the term P x ∈ S 0,B can be dropped. The difference in conditionals can be written as Since ϕ g is monotone in both w T C x and w T F x and decreasing B can only introduce values of x into S 0,B which have smaller values of w T C x and remove values which have higher value of w T F x. Thus for B such that any x ∈ S 0,B has ϕ g (v T g x) ≤ P(g = 1) the integral is guaranteed to be positive, implying that for B or any larger budget f C is more fair than f F . Again due to the monotonicity of ϕ g , such a sufficiently large B must exist.

Single Crossing
Figures 5, 6, 7 show the single crossing conditions between P y = 1|x , and P g = 1|x , and their respective constant functions given in Lemmas 1, 2, 3. We see that in all three datasets the single crossing conditions approximately holds in the sense that when the condition is violated, (i.e. crossing the respective horizontal line more than once) the violation is small in magnitude. Recall that the single crossing propriety implies the unimodality of the error and unfairness terms. Small violations (both in magnitude and duration) of the single crossing condition amount to small changes in the derivative of error or unfairness, which in term does not consequentially impact the unimodality of either term from an empirical perspective.
With this said we see that the Recidivism dataset breaks the single crossing assumptions on P g = 1|x more so than the other two datasets. However, we still observe both the unimodality of unfairness as well as a reversal of fairness between the base and fair classifier on this dataset (in the single variable case).
Moreover, we see that the variables in the Recidivism dataset have weaker relationships between P(y = 1|x) and P(g = 1|x) compared to those of the Law School and Community Crime datasets. Meaning that in the Recidivism dataset, label identification and group identification are easier to untangle, compared to the other two datasets. This is partially the reason we observe that the fairness reversal does not occur on the recidivism dataset in the multivariate setting.

Fair learning schemes
We make use of two fair learning algorithms to generate the fair models (denoted as f F ), namely GerryFair and Reductions. Each algorithm takes as input a baselearner (not to be confused with the baseline classifier which we denote as f C ). This base-learner is used solve the fair learning objective through cost sensitive learning. Each algorithm uses their respective base learner in a unique way, and the fair models produced by each learning scheme different considerably in terms of their structure. Reductions uses the base-learner to perform traditional cost sensitive learning and outputs a model which is of the same type of the baselearner. For example if the base-learner is Logistic Regression, then f F is also a Logistic Regression model. Thus the Projected Gradient Decent attack (PDG) is effective at computing an agents best response to f F when f F is learned via reductions and a differentiable base-learner (e.g. Logistic Regression, SVM, and Neural Networks). In the case of GerryFair the returned fair model f F has a different structure from the base learner, namely f F is an ensemble of models produced from the base learner. Thus the resulting model may not be smooth and PGD will not work to compute agents best response. However, of the models we examine (LRG, SVM, NN) GerryFair only supports LRG and SVM with a linear kernel. Meaning that each learner in the ensemble, produced by GerryFair, is linear and thus it is trivial to compute each agent's best response.

Fairness Reversal
Recall that in the single variable case, strategic manipulation leads to a fairness reversal between the base and fair thresholds θ C and θ F respectively, if and only if θ C < θ F . Figures 5-16 show the relationship between θ C and θ F for each of the variables, dataset, and fairness metrics we study. In these figures we see that θ C < θ F is a common. Moreover, we see that the cases where this relationship does not hold are cases in which either θ C < θ U (meaning the sufficient condition of Theorem 2 does not hold), the fair classifier is trivial (i.e. θ F = 0), or there is negligible unfairness regardless of the value selected for θ. Moreover, we see that both error and unfairness are unimodal w.r.t. θ, thus Lemma 4 implies that error and unfairness will remain unimodal w.r.t. the manipulation budget Figure 5: Probabilities of group membership g (green) and true label y (orange). Probabilities conditioned on the feature x are given as solid lines, while those unconditioned are given as dotted, or dashed, lines. Recall that if the conditioned probabilities P(g = 1|x) and P(y = 1|x) having a single crossing with the respective unconditioned value (outlined in Lemmas 1, 2, 3) then error and unfairness will be unimodal w.r.t. to the threshold θ. For example, in the case of PRfairness, if P(g = 1|x) has a single crossing with P(g = 1) and P(y = 1|x) has a single crossing with P(y = 1) then error and unfairness are unimodal w.r.t. to θ. B for any manipulation cost function c(x, x ) which is monotone in |x − x|.
With respect to Figures 5-16, agent manipulation amounts to "moving" each threshold to the left. We can see that when θ C < θ F , moving θ C to the left decreases unfairness, while moving θ F to left increases unfairness, until the manipulated θ F has been moved all the way to θ U (the most unfair threshold). Additionally in these figures we see that not only does this leftward shift increase the unfairness of θ F , but also increased the accuracy of θ F : a phenomenon outlined by Theorem 3. That is, in the cases where θ C < θ F , strategic manipulation leads to both a fairness, and an accuracy, reversal between θ C and θ F .
In the multivariate case, Figures 17-24, show that again the fairness reversal is common. In these figures the error (dotted) and unfairness (solid) are given for f C (blue) and f F (orange) as a function of the manipulation budget B when agents have manipulation cost c(x, x ) = ||x − x ||. The shaded orange region indicates both the duration (in terms of B) and magnitude of the fairness reversal of f F and f C . Similar to the single variable case, these graphs again show a fundamental trade-off between fairness and accuracy in the presence of manipulation. In all settings where a fairness reversal between f F and f C occurs, an accuracy reversal also occurs. Namely, if f F becomes less fair than f C , it also becomes more accurate than f C . Moreover, as was the case in the single variable case, we see that in the multivariate case both error and unfairness exhibit unimodality w.r.t. to the budget B.
In the single variable case, we would expect that once f C and f F respectively hit the point with maximum unfairness (as a function of B) their unfairness would decrease at an equal rate from that point onward since both classifiers are effectively sharing the same unfairness curve, but sit at different points. In the multivariate case, we make this same observation. After reaching the most unfair B, both classifiers decreases at similar rates. However, f C requires a larger B, than f C , to reach this point. Which ultimately leads to f F becoming less fair, since the unfairness of f F is still increasing while the unfairness of f C has already begun to fall.
The fairness reversal is common on the Law School and Community Crime datasets, but non-existent on the recidivism dataset. As mentioned previously there is a weaker correlation between group membership and true label on the Recidivism dataset compared to the other two datasets. We suspect that this weaker link between accuracy and unfairness results in fair classifiers which lose less of their fairness in the presence of strategic behavior, since the agents benefiting from strategic behavior should be more representative of the population as a whole, rather than one particular group.
We train a total of 9 linear models in our experiments (3 fairness definitions across 3 datasets using LRG and Reductions). We observe that 5/9 cases the propriety that w C w F > 0 approximately holds. Here approximately holding means that if an element pair w i,C w i,F < 0 the respective magnitude of the product is small relative to those of the larger value weights. Thus error and unfairness are also unimodal w.r.t. the manipulation budget B for any manipulation cost function c(x, x ) which is monotone in |x − x|. When this unimodality holds θ C < θ F implies that strategic manipulation will lead to θ C becoming more fair than θ F . This fairness reversal is due to the fact that strategic manipulation amounts to lowering (shifting to the left) the threshold. In this figure, as well as the subsequent figures, we see that θ C < θ F is a common occurrence (namely 30 our of the 36 combinations of variable, fairness metric, and dataset studied). The shaded region indicates instances in which the fair classifier is less fair than its baseline counterpart. Note that when the fairness of f F and f C are reversed, there accuracy is reversed as well. Once hitting their maximally unfair point both f C and f F tend to decreased in unfairness at equal rates. However, f F typically hits this maximally unfair point for a B larger than f C .