# Fairis: Fairness-Aware Aggregation with Provable Influence Containment against Fairness Poisoning Attacks in Collaborative Machine Learning

arXiv: https://arxiv.org/abs/2608.06469 · HTML: https://mlsanity.com/paper/2608.06469/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 18 of its 32 references that are in the map.
- First posted on arXiv 6 Aug 2026.

## Builds on (most cited first, 18 of 18)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Equality of Opportunity in Supervised Learning](https://mlsanity.com/paper/1610.02413/) (2016)
- [A Survey on Bias and Fairness in Machine Learning](https://mlsanity.com/paper/1908.09635/) (2019)
- [Exploiting Unintended Feature Leakage in Collaborative Learning](https://mlsanity.com/paper/1805.04049/) (2018)
- [Differentially Private Federated Learning: A Client Level Perspective](https://mlsanity.com/paper/1712.07557/) (2017)
- [Split learning for health: Distributed deep learning without sharing raw patient data](https://mlsanity.com/paper/1812.00564/) (2018)
- [SplitFed: When Federated Learning Meets Split Learning](https://mlsanity.com/paper/2004.12088/) (2020)
- [Distributed learning of deep neural network over multiple agents](https://mlsanity.com/paper/1810.06060/) (2018)
- [FairFed: Enabling Group Fairness in Federated Learning](https://mlsanity.com/paper/2110.00857/) (2021)
- [PrivFairFL: Privacy-Preserving Group Fairness in Federated Learning](https://mlsanity.com/paper/2205.11584/) (2022)
- [GLOCALFAIR: Jointly Improving Global and Local Group Fairness in Federated Learning](https://mlsanity.com/paper/2401.03562/) (2024)
- [EAB-FL: Exacerbating Algorithmic Bias through Model Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2410.02042/) (2024)
- [Fairness in Federated Learning: Trends, Challenges, and Opportunities](https://mlsanity.com/paper/2509.00799/) (2025)
- [FedGA: A Fair Federated Learning Framework Based on the Gini Coefficient](https://mlsanity.com/paper/2507.12983/) (2025)
- [Friends in Unexpected Places: Enhancing Local Fairness in Federated Learning through Clustering](https://mlsanity.com/paper/2407.19331/) (2024)
- [Fairness-Constrained Optimization Attack in Federated Learning](https://mlsanity.com/paper/2510.12143/) (2025)

## Abstract (arXiv)

Collaborative machine learning among financial institutions must be both group-fair and robust against deliberate adversarial manipulation. Existing fairness-aware aggregation methods remain formally vulnerable to fairness poisoning: a malicious client maximizing group disparity while preserving accuracy evades accuracy-based Byzantine defenses, and in our threat model FairFed's gap-based weighting can be gamed by an adversary who observes the global fairness score. We present Fairis, a server-side reweighting scheme in which each client's update receives the normalized weight ωk = barwk / sumj barwj built from the unnormalized score barwk = η - Fk, with Fk ∈ [0,1] the local Equal Opportunity Difference and η > 1 a security parameter. We prove three properties, Monotone Weight Reduction (MWR), Demographic Participation, and Non-Gamesmanship, extend MWR to colluding minority coalitions, and show that combining MWR with server-side norm clipping bounds the adversary's displacement of the global model by ω0 C, strictly decreasing in its own reported disparity. Assuming honest score reporting, an assumption this paper does not discharge, Fairis is the only rule evaluated that guarantees every client strictly positive weight while provably reducing an adversary's weight monotonically in its bias; clipped FairFed can reach a lower weight but guarantees nothing and zeroes a client outright on Taiwan Credit. Against an adversary stealthy enough to evade accuracy-based defenses, within 0.04 accuracy of benign, Fairis cuts its weight by 41 to 54% below a size-blind control on Taiwan. On routine non-IID partitions no rule dominates, and a uniform-weighting ablation shows that containment tracks how far the adversary's score separates from the honest mean, providing none when the honest population is already unfair.