Paper deep dive
Auditing Fairness-Privacy Trade-offs: Subpopulation-Level Effects of Fairness-Enhancing Algorithms
Umid Suleymanov, Ilhama Novruzova, Khalid Mammadov, Natavan Hasanova, Murat Kantarcioglu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 7/18/2026, 9:42:02 AM
Summary
This paper presents the first comprehensive study on how fairness-enhancing algorithms affect membership inference privacy risks at the subpopulation level. The authors adapt the Likelihood Ratio Attack (LiRA) for subgroup auditing to uncover privacy disparities obscured by aggregate evaluations. They analyze the interaction between Differential Privacy (DP) and fairness methods, finding that DP's benefits and utility costs are unevenly distributed across subpopulations. The study concludes that fairness interventions do not uniformly increase privacy risk; their impact depends on model architecture, subgroup size, and mitigation strategy.
Entities (11)
Relation Signals (8)
Fairness-Enhancing Algorithms → affects → Membership Inference Privacy Risks
confidence 95% · We present the first comprehensive study of how fairness interventions affect membership inference privacy risks at the subpopulation level.
Differential Privacy → interactswith → Fairness-Enhancing Algorithms
confidence 95% · We further analyze how Differential Privacy (DP) interacts with fairness-enhancing methods across different categories
Reweighing → istypeof → Pre-processing Method
confidence 95% · pre-processing methods such as Disparate Impact Remover (DIR) [14] and Reweighing (REW) [24]
Exponentiated Gradient Reduction → istypeof → In-processing Method
confidence 95% · in-processing techniques such as Exponentiated Gradient Reduction (EGR) [2]
Calibrated Equalized Odds → istypeof → Post-processing Method
confidence 95% · post-processing approaches such as Calibrated Equalized Odds (CPP) [32]
Synthetic Mitigator → istypeof → Pre-processing Method
confidence 95% · Synthetic Mitigator (SYN), Disparate Impact Remover (DIR), and Reweighing (REW) as pre-processing techniques
Disparate Impact Remover → istypeof → Pre-processing Method
confidence 95% · pre-processing methods such as Disparate Impact Remover (DIR) [14]
Likelihood Ratio Attack → →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Machine learning (ML) models deployed in sensitive domains such as healthcare, law enforcement, and finance must satisfy not only utility requirements but also fairness and privacy guarantees. While prior work has largely examined how privacy-preserving techniques affect fairness, the inverse question-how fairness-enhancing algorithms influence privacy leakage-remains underexplored. We present the first comprehensive study of how fairness interventions affect membership inference privacy risks at the subpopulation level. By adapting the Likelihood Ratio Attack (LiRA) for subgroup auditing, we uncover privacy disparities that aggregate evaluations obscure. We further analyze how Differential Privacy (DP) interacts with fairness-enhancing methods across different categories, showing that DP's privacy benefits and utility costs are unevenly distributed across subpopulations. Our results demonstrate that fairness interventions do not uniformly increase privacy risk; their impact depends on model architecture, subgroup size, and mitigation strategy. These findings reveal that fairness, privacy, and utility must be jointly evaluated at the subpopulation level, and we introduce the first unified empirical framework to support such auditing in practice.
Tags
Links
- Source: https://arxiv.org/abs/2607.14607v1
- Canonical: https://arxiv.org/abs/2607.14607v1
Trouble viewing inline? Open PDF directly →
Full Text
102,314 characters extracted from source content.
Expand or collapse full text
Auditing Fairness-Privacy Trade-offs: Subpopulation-Level Effects of Fairness-Enhancing Algorithms Umid Suleymanov* Virginia Tech Blacksburg, USA umids@vt.edu Ilhama Novruzova* ADA University Baku, Azerbaijan inovruzova16235@ada.edu.az Khalid Mammadov University of Potsdam Potsdam, Germany khalid.mammadov@uni-potsdam.de Natavan Hasanova University of Passau Passau, Germany hasano04@ads.uni-passau.de Murat Kantarcioglu Virginia Tech Blacksburg, USA muratk@vt.edu Abstract Machine learning (ML) models deployed in sensitive domains such as healthcare, law enforcement, and finance must satisfy not only utility requirements but also fairness and privacy guarantees. While prior work has largely examined how privacy-preserving techniques affect fairness, the inverse question-how fairness-enhancing algorithms influence privacy leakage-remains underexplored. We present the first comprehensive study of how fairness interventions affect membership inference privacy risks at the subpopulation level. By adapting the Likelihood Ratio Attack (LiRA) for subgroup auditing, we uncover privacy disparities that aggregate evaluations obscure. We further analyze how Differential Privacy (DP) interacts with fairness-enhancing methods across different categories, showing that DP’s privacy benefits and utility costs are unevenly distributed across subpopulations. Our results demonstrate that fairness interventions do not uniformly increase privacy risk; their impact depends on model architecture, subgroup size, and mitigation strategy. These findings reveal that fairness, privacy, and utility must be jointly evaluated at the subpopulation level, and we introduce the first unified empirical framework to support such auditing in practice. 1 Introduction ML models are increasingly deployed in sensitive domains such as healthcare, law enforcement, and finance, where addressing fairness and privacy concerns is essential. These models often rely on datasets that are not only sensitive but also unequally distributed across subpopulations, intensifying both fairness and privacy challenges [29, 36]. Yet, these concerns are typically studied at the aggregate level, obscuring disparities across subpopulations. In practice, risks are rarely uniform: minority or less-represented groups may experience disproportionately poor fairness, weaker privacy protections, or severe utility losses. This motivates a shift from aggregate evaluation toward subpopulation-level auditing. Prior work has primarily examined how privacy-preserving mechanisms affect fairness, with particular focus on Differential Privacy (DP) [35, 18, 27, 28]. These studies ask whether DP amplifies or reduces group disparities under standard training pipelines. In contrast, the inverse question, how fairness-enhancing algorithms influence privacy risk, remains largely underexplored. Widely used fairness interventions span three categories: (i) pre-processing methods such as Disparate Impact Remover (DIR) [14] and Reweighing (REW) [24]; (i) in-processing techniques such as Exponentiated Gradient Reduction (EGR) [2]; and (i) post-processing approaches such as Calibrated Equalized Odds (CPP) [32]. Despite their widespread adoption, we do not yet understand whether these interventions raise or reduce privacy leakage, nor how these effects vary across demographic subgroups. In this work, we fill this gap by conducting the first comprehensive analysis of how fairness-enhancing methods impact membership inference risk at the subpopulation level. We evaluate three state-of-the-art membership inference attacks (MIAs), including the Likelihood Ratio Attack (LiRA) [8], and extend LiRA to produce subgroup-specific leakage estimates. We further analyze how Differential Privacy interacts with fairness interventions across mitigation categories. Our findings show that while DP reliably reduces privacy risk, its utility costs are highly uneven across subgroups: some retain acceptable performance, while others, often underrepresented groups, collapse to near-random accuracy. Motivated by the lack of evidence regarding how fairness-enhancing interventions influence privacy leakage, we pose the following research questions: • RQ1: How do fairness-enhancing algorithms affect membership inference risk and utility across subpopulations? • RQ2: How does Differential Privacy, alone or combined with fairness methods, alter the privacy–fairness–utility trade-off at the subgroup level? • RQ3: How do model architecture and subgroup representation shape these interactions? Our results demonstrate that fairness and privacy are not inherently in conflict. Rather, their interaction depends on factors such as model architecture, the prevalence of subpopulations in the training data, and the choice of fairness technique. By illuminating these dependencies, our work promotes a more nuanced understanding of the trade-offs between fairness enhancing techniques and their privacy implications in ML systems. Our experiments span ten variants of six widely used datasets (plus a synthetic benchmark) in the fairness and privacy domains. To quantify privacy risks, we employ state-of-the-art membership inference attacks under both black-box and white-box threat models. The main contributions of this paper are summarized as follows: • We provide the first systematic audit of how pre-, in-, and post-processing fairness algorithms affect subgroup-level privacy risk and utility. • We extend the Likelihood Ratio Attack (LiRA) [8] to enable subgroup-specific privacy auditing, allowing fine-grained measurement of membership inference vulnerability across demographic groups. • We systematically characterize how Differential Privacy (DP) interacts with fairness interventions, revealing uneven privacy–utility trade-offs across models and subpopulations. • We uncover that fairness and privacy are not inherently conflicting objectives; their interaction depends critically on model architecture, subgroup representation, and the chosen fairness mitigation strategy. 2 Related Work Disparate vulnerability and subgroup privacy risk. Average-based generalization metrics can mask large differences across protected subgroups. To address this, researchers have proposed subgroup-level notions of generalization and disparate vulnerability. Kulynych et al. [26] introduce a subgroup-specific distributional generalization gap, R(π,d)≜d(μ1π,μ0π)R(π,d) d( _1^π, _0^π), and show how subgroup shifts can affect vulnerability to MIAs. Empirical studies likewise report that underrepresented groups are often more susceptible to membership inference [36, 39], motivating audits at the subpopulation level rather than aggregate reporting. How Differential Privacy alters fairness and utility. A large body of work investigates how Differential Privacy (DP) training affects fairness outcomes and model utility. Several studies find that DP-SGD can amplify disparities in accuracy and fairness for underrepresented groups [5]. Jagielski et al. [23] provide one of the first formal treatments of the joint design of fairness and Differential Privacy, proposing algorithms that satisfy both constraints and identifying fundamental trade-offs between privacy, accuracy, and fairness. More recent work reveals nuanced effects: Hansen et al. [21] show that DP can sometimes reduce disparities when combined with group-robust optimization. Makhlouf et al. [27] analyze local DP and derive theoretical bounds for fairness metrics under randomized response, while Mangold et al. [28] prove that deviations in fairness measures under central DP diminish with larger margins. Tran et al. [35, 18] empirically assess DP’s impact on group-level utility and provide mitigation guidelines. Bullwinkel et al. [7] extend this discussion to DP synthetic data generation, showing that privacy-preserving synthesis can maintain overall accuracy but often worsens fairness for minority groups. Collectively, these works focus on how DP affects fairness and utility, but they do not directly examine how fairness-enhancing interventions, in turn, influence privacy leakage. Fairness interventions and privacy leakage: an open question. Prior research often treats fairness and privacy as a strict trade-off [9, 17], with improvements in one presumed to harm the other. However, many existing evaluations remain narrow in scope, typically limited to a single model family or a restricted set of fairness methods (often in-processing), and they do not consider the interactions of fairness-enhancing algorithms with Differential Privacy (DP). For example, Chang and Shokri [9] and more recently Tian et al. [34] study membership inference risks in fairness-enhanced models, but focus on specific mitigation strategies and do not analyze interactions with DP or multiple fairness mitigation categories. As a result, the combined effect of fairness techniques, privacy protections, and model choice across subpopulations remains poorly understood. In this paper, we address this gap through a broad, systematic study. Gap and our focus. In summary, while there is substantial research on (i) disparate privacy vulnerability across subgroups, (i) fairness and utility under DP, there remains a gap: how widely used fairness-enhancing algorithms (pre-, in-, and post-processing) affect empirical privacy leakage at the subpopulation level, and how these effects interact with Differential Privacy. In this paper, we fill this gap by (a) adapting modern membership inference attacks (LiRA, OQTA, OTA) for subgroup auditing, (b) evaluating a broad set of fairness mitigators (DIR, REW, EGR, CPP, SYN) across multiple model families and datasets, and (c) quantifying the joint fairness–privacy–utility trade-offs at subpopulation granularity. stat_par_diff=Pr(Y^=1∣unprivileged)−Pr(Y^=1∣privileged)stat\_par\_diff= ( Y=1 )- ( Y=1 ) (2) disp_imp=1−min(ℛ,1ℛ), wheredisp\_imp=1- (R, 1R ), where (3) ℛ=Pr(Y^=1∣unprivileged)Pr(Y^=1∣privileged)R= ( Y=1 ) ( Y=1 ) (4) avg_odds_diff=12[|FPRunpriv−FPRpriv|+|TPRunpriv−TPRpriv|]avg\_odds\_diff= 12 [ |FPR_unpriv-FPR_priv |+ |TPR_unpriv-TPR_priv | ] (5) 3 Background 3.1 Membership Inference Attack MIAs pose a significant privacy threat in machine learning. These attacks seek to identify whether a specific data point was included in the training set used to build a model. If successful, such attacks can expose sensitive or personal information about individuals in the dataset, raising serious privacy concerns. In a typical MIA scenario, the attacker has black-box access to the trained model, meaning they can provide inputs and observe the corresponding outputs (e.g., predicted labels or probabilities). By carefully analyzing the model’s responses, the attacker attempts to infer whether a given data point was used during training. Formally, let Ω represent the overall population of possible data points, and D be the data-generating distribution over Ω . A training set S⊂ΩS⊂ of size n is drawn from D, and a learning algorithm A(⋅)A(·) produces the model A(S)A(S). Given a challenge example x∈Ωx∈ , the attacker’s objective is to decide if x∈Sx∈ S. To achieve this, the attacker designs a membership inference function: m^=(A(S),x), m=A (A(S),x ), (1) where m^∈0,1 m∈\0,1\ is the membership prediction (m^=1 m=1 indicates that x is inferred to be in S, while m^=0 m=0 implies otherwise). The attack leverages the intuition that models often behave differently for data points they have seen during training (members) compared to those they have not (non-members). For example, models may assign higher confidence scores to training points, making it easier for an attacker to distinguish members from non-members. These attacks pose serious privacy risks, particularly when dealing with sensitive datasets such as medical records, financial information, or social data. By successfully guessing membership, an attacker can infer private details about individuals, emphasizing the need for robust defenses against MIAs. 3.2 Fairness Fairness in machine learning seeks to ensure that models treat different groups without causing undue benefit or harm based on sensitive attributes (e.g., gender, race, age). In our approach, we assess fairness by measuring performance gaps or differences in outcomes across subpopulations defined by these attributes. Specifically, the data is analyzed by identifying privileged and unprivileged groups based on the sensitive attribute under consideration. Privileged group consists of individuals who receive systematically better outcomes or treatment from the model while the unprivileged group includes individuals who are more likely to face unfavorable outcomes or treatment from the model. By distinguishing between these groups, we can quantify and address disparities in model behavior, ensuring that outcomes are distributed equitably across all subpopulations. Our analysis uses several fairness metrics to evaluate these disparities: • Balanced Accuracy: bal_acc=12(TPR+TNR),bal\_acc= 12 (TPR+TNR ), (6) where TPR is the true positive rate and TNR is the true negative rate. This metric captures how well the model classifies both positive and negative instances across all groups. • Statistical Parity Difference: Shown in (2), where Y Y denotes the model’s prediction, a value of 0 indicates equal rates of positive prediction for both groups. • Disparate Impact: Formulated as in (3) using the ratio ℛR from (4). If ℛR is close to 11, the model assigns positive outcomes at similar rates to both groups, indicating low disparate impact. Our definition of disp_imp transforms this ratio such that lower values correspond to better fairness, with disp_imp=0disp\_imp=0 representing perfect parity. • Average Odds Difference: Defined in (5), where FPR is the false positive rate, this measures how differently the model classifies positives and negatives across privileged and unprivileged groups. • Equal Opportunity Difference: eq_opp_diff=TPRunpriv−TPRpriv,eq\_opp\_diff=TPR_unpriv-TPR_priv, (7) evaluating the gap in true positive rates between groups. 3.3 Subpopulation Privacy Subpopulation privacy examines how much membership information is leaked for specific subgroups under membership inference attacks. If certain subgroups have higher privacy risk values than others, it indicates that membership information is easier to detect for those subgroups, a phenomenon referred to as disparate vulnerability. This disparity can be quantified by the difference between the highest and lowest privacy risk values across all subgroups: maxj(PrivacyRisk(Gj))−minj(PrivacyRisk(Gj)). _j (PrivacyRisk(G_j) )\;-\; _j (PrivacyRisk(G_j) ). (8) A large gap suggests that the model leaks membership information more readily for some subgroups, which may arise due to imbalanced training sets, model overfitting on certain groups, or fairness constraints that unintentionally expose membership data about underrepresented groups. To assess privacy risk at the subgroup level, we compute per-example losses ℓi _i for both training and test data, analyzing how well an attacker can distinguish group members from non-members. For a subgroup GjG_j, we define: TPRGj _G_j =Pr(Attack says “member”∣x∈Gj∩train), = (Attack says ``member′ x∈ G_j ), (9) TNRGj _G_j =Pr(Attack says “non-member”∣x∈Gj∩test). = (Attack says ``non-member′ x∈ G_j ). The subgroup-level privacy risk is given by: PrivacyRisk(Gj)=TPRGj+TNRGj2.PrivacyRisk(G_j)= TPR_G_j+TNR_G_j2. (10) A higher PrivacyRisk(Gj)PrivacyRisk(G_j) indicates that membership inference is more successful for that subgroup, implying greater privacy exposure. This analysis helps identify whether certain fairness strategies inadvertently increase inference accuracy in underrepresented groups and provides insights into mitigating such risks. 3.4 Fairness-Enhancing Algorithms In this work, we evaluate five fairness mitigators to assess their impact on both fairness and privacy: Synthetic Mitigator (SYN), Disparate Impact Remover (DIR), and Reweighing (REW) as pre-processing techniques; Exponentiated Gradient Reduction (EGR) as an in-processing method; and Calibrated Equalized Odds (CPP) as a post-processing approach. Each mitigator addresses fairness through a distinct mechanism, which may, in turn, influence privacy risk. Regarding pre-processing techniques, SYN generates synthetic data to balance favorable outcome distributions across privileged and unprivileged groups [40, 10]. It modifies the training dataset through oversampling or undersampling to equalize positive base rates. In our implementation, the transformed dataset is used only for training the target model and is excluded from the attack setup (i.e., only real data is used in privacy evaluation). This setup ensures a realistic assessment of privacy risk. DIR modifies feature values to reduce the correlation between sensitive attributes and predictions, aiming to lower disparate impact while maintaining data utility [14]. In our setup, DIR is applied to both training and testing data for all models, including both shadow and target models used in the LiRA attack framework (Section 4.1). REW assigns weights to training samples based on group membership and class labels, enabling the model to learn from all subgroups in a balanced way [24]. In our experiments, REW is applied only to the training data; test datasets remain unchanged. This mitigator addresses fairness without altering the dataset itself. Moving to the in-processing method, EGR enforces fairness constraints-such as demographic parity or equal opportunity-during model training [2]. It operates by iteratively optimizing a constrained loss function. In our implementation, EGR is applied directly during model training with a learning rate set to 0.001. Finally, for the post-processing approach, CPP adjusts predicted probabilities to satisfy fairness criteria like equalized odds [32]. This method is particularly useful for high-accuracy models, as it modifies output probabilities without retraining. In our experiments, the CPP mitigator is applied to model predictions, calibrating probabilities for each subgroup to meet fairness constraints while leaving the underlying model unchanged. 4 Membership Inference Attacks for Subpopulations In this section, we describe the attack setups used to evaluate the privacy risks associated with fairness algorithms across subpopulations. We examine three membership inference attacks: the Optimal-Quantile-Threshold Attack (OQTA) [9], the Optimal-Threshold Attack (OTA) [26, 38], and the LiRA [8]. These attacks are adapted to measure privacy leakage under different fairness algorithms. We specifically chose OQTA, OTA, and LiRA because of their methodological differences e.g. determining thresholds based on population dataset and shadow models, suitability for subgroup-specific analysis, and relevance to real-world adversarial scenarios. We consider subpopulation privacy risk as an additional dimension of fairness. To address this, we provide a detailed description of the attack setups and their adaptations for subpopulations. This evaluation framework allows the privacy leakage of fairness algorithms to be measured and reported alongside other fairness metrics. 4.1 Likelihood Ratio Attack Implementation In the original LiRA attack [8], the in- and out-distributions are sampled uniformly from the entire training and reference datasets. In contrast, our modified LiRA restricts both distributions to specific fairness-relevant subpopulations. For a given subgroup, both the target sample and its reference comparison sets are drawn exclusively from that subgroup. This adaptation reveals how membership inference vulnerabilities vary across groups, providing a finer granularity necessary for auditing fairness-privacy trade-offs. Group-Specific Likelihood Ratio Attack. For each subgroup g, we filter the dataset to include only samples belonging to that subgroup and perform the following steps: 1. Extract the confidence scores ϕing _in^g and ϕoutg _out^g for the shadow models trained on inD_in. 2. Compute the mean and variance of the subgroup-specific in- and out-distributions: μing=mean(ϕing),σing2=var(ϕing), _in^g=mean( _in^g), _in^g^2=var( _in^g), (11) μoutg=mean(ϕoutg),σoutg2=var(ϕoutg). _out^g=mean( _out^g), _out^g^2=var( _out^g). (12) 3. Compute the likelihood ratio for the subgroup g: Λg=p(ϕobsg∣(μing,σing2))p(ϕobsg∣(μoutg,σoutg2)). ^g= p( _obs^g ( _in^g, _in^g^2))p( _obs^g ( _out^g, _out^g^2)). (13) Robustness for Small Subpopulations. Estimating Gaussian parameters for small subgroups (e.g., in the German Credit dataset, N=1,000N=1,000) can introduce statistical instability. We address this through two primary safeguards. First, all reported metrics are averaged over 20 independent experimental runs; as shown in our results (e.g., Figures 7–17), the standard deviations (represented by error bars) remain tightly bounded even for minority subgroups, indicating that the identified disparate vulnerability is a stable characteristic rather than a statistical artifact. Second, we cross-validate our findings against the non-parametric OQTA and OTA attacks. Because these methodologies do not rely on Gaussian parameter estimation yet yield consistent leakage patterns across all models (e.g., Random Forests), we confirm that our subpopulation-level LiRA adaptation is robust to the constraints of small-scale data. We implemented the LiRA attack using the TensorFlow Privacy library to assess the membership privacy risks of models trained on sensitive datasets. 4.2 Optimal-Quantile-Threshold Attack The OQTA is a threshold-based membership inference attack inspired by the (OTA) [26, 38], with a key difference: it selects per-subgroup thresholds by sweeping quantiles over the loss distribution of a separate population dataset. This quantile-based strategy is based on the implementation in Chang and Shokri [9], and we adopt their setup to ensure reproduction of their results. We use Decision Tree classifier, Random Forest classifier, Neural Network, Differentially Private Random Forest, or Differentially Private Neural Network as the target model. The original dataset is split into three disjoint parts: training set, test set (together forming the TARGET_MEMBER and TARGET_NON_MEMBER sets, respectively), and a larger population dataset (REFERENCE_MEMBER). Loss values are computed on all samples using the target model. To perform inference, we define subgroup-specific thresholds τ(g,y)τ^(g,y), where g denotes group membership (e.g., privileged/unprivileged) and y the true label (favorable/unfavorable). We compute a range of thresholds by sweeping quantiles (logarithmically spaced between 10−510^-5 and 1) over the population loss distribution, and select the threshold that maximizes balanced accuracy on the target dataset. Membership is then inferred as follows: if the model’s loss on a sample z=(x,g,y)z=(x,g,y) is below the threshold τ(g,y)τ^(g,y), it is labeled as a member; otherwise, a non-member. We use cross-entropy loss with clipping for numerical stability. Subgroups (G0−G_0^-: unprivileged unfavorable, G0+G_0^+: unprivileged favorable, G1−G_1^-: privileged unfavorable, G1+G_1^+: privileged favorable) are defined by sensitive attribute and true label (see figures and Appendix E for full details). ROC curves are available in the code. 4.3 Optimal-Threshold Attack In our setting, we evaluate the membership inference (MI) vulnerability of different subpopulations by comparing the model’s per-example losses on training and test points, and then applying a threshold-based attack. Suppose we have: • ℓtrain=(ℓx1,…,ℓxntrain) _train=( _x_1,…, _x_n_train), the losses for ntrainn_train training examples, • ℓtest=(ℓx1′,…,ℓxntest′) _test=( _x _1,…, _x _n_test), the losses for ntestn_test test examples. (Here, a smaller loss often indicates the point was likely in the training set.) We pick a threshold c and label examples with loss ≤c≤ c as “member” (i.e., from the training data) and those with loss >c>c as “non-member.” One way to find c is to scan possible thresholds to maximize a measure of attack success, such as the overall balanced accuracy: maxc12(∑x∈trainℓx≤cntrain+∑x′∈testℓx′>cntest). _c\; 12 ( _x 1\ _x≤ c\n_train\;+\; _x 1\ _x >c\n_test ). (14) Here, ⋅1\·\ is the indicator function. Once the threshold is chosen, we define: TPR=∑x∈trainℓx≤cntrain,TNR=∑x′∈testℓx′>cntest.TPR= _x 1\ _x≤ c\n_train, = _x 1\ _x >c\n_test. (15) Subpopulation Analysis To see how privacy differs across subgroups, we label each data point with a subgroup identifier (e.g., a protected attribute) and a class label. Let GjG_j represent a particular subgroup of the training set. Then we compute: ℓtrain,Gjandℓtest,Gj, _train,G_j _test,G_j, the training and test losses for that subgroup. We apply the threshold-based approach within each subgroup: TPRGj _G_j =∑x∈Gjℓx≤cj|Gj|, = _x∈ G_j1\ _x≤ c_j\|G_j|, TNRGj _G_j =∑x′∈non-Gjℓx′>cj|non-Gj| = _x -G_j1\ _x >c_j\|non-G_j| (16) for a threshold cjc_j chosen to optimize the attack over subgroup GjG_j. By comparing TPRGjTPR_G_j and TNRGjTNR_G_j across subgroups, we identify which subpopulations are at higher risk of membership exposure. Understanding this is crucial, as certain fairness interventions or data imbalances can lead to increased memorization for specific subgroups, potentially exposing more information about their membership status. Additionally, ROC curves are available in the code. 5 Datasets and Models Our study focuses on tabular data as it remains the primary format in high-stakes domains, such as healthcare, finance, and criminal justice where auditing fairness-privacy trade-offs is most critical [6, 19]. We evaluate our framework on ten versions of six real-world datasets and one synthetic dataset. Each dataset is partitioned into subpopulations defined by (i) a binary sensitive attribute (privileged vs. unprivileged) and (i) a binary label (favorable vs. unfavorable), following standard fairness literature. Table I summarizes all datasets, subgroup definitions, and sample sizes. TABLE I: Summary of datasets used in this study. Each dataset is binarized into four subpopulations based on (privileged/unprivileged) × (favorable/unfavorable). Synthetic data enables controlled mechanism analysis; real datasets provide external validity across diverse domains. Dataset #Samples #Features Protected Attribute Privileged Group Synthetic 2,500 2 G∈0,1G∈\0,1\ G=1G=1 (80%) Bank Marketing 30,448 57 Age Age ≥25≥ 25 COMPAS (Race) 6,172 11 Race Caucasian COMPAS (Gender) 6,172 11 Gender Female Law School Admissions (Race) 20,798 13 Race White Law School Admissions (Gender) 20,798 13 Gender Male German Credit (Age) 1,000 57 Age Age >25>25 German Credit (Sex) 1,000 57 Sex Male Law School GPA 22,342 3 Race White MEPS 19 15,830 138 Race White Real-world Datasets. We use six benchmark datasets from AIF360 [6]: Bank Marketing (age as protected attribute; 57 features, 30,448 samples), COMPAS (race/gender; 11 features, 6,172 samples), Law School Admissions111From https://github.com/jjgold012/lab-project-fairness (Bechavod and Ligett, 2017). Preprocessed by dropping duplicates, null values, and highly correlated features (>0.95>0.95). (race/gender; 13 features, 20,798 samples), German Credit (age/sex; 57 features, 1,000 samples), Law School GPA (race; binarized regression target at threshold 0.6; 3 features, 22,342 samples), and MEPS 19 (race; 138 features, 15,830 samples). All datasets follow standard AIF360 preprocessing pipelines to ensure reproducibility. Synthetic Dataset To complement real-world datasets and enable controlled analysis of subgroup privacy leakage, we generate a synthetic binary classification dataset following the setup of Chang and Shokri [9]. The dataset contains N=2,500N=2,500 samples with two continuous features, a binary sensitive attribute G∈0,1G∈\0,1\, and a binary label Y∈0,1Y∈\0,1\. The sensitive attribute is intentionally imbalanced, with Pr(G=0)=0.2 (G=0)=0.2 and Pr(G=1)=0.8 (G=1)=0.8, reflecting real-world population disparities. Labels are generated conditional on G such that the disadvantaged group exhibits higher base-rate skew: for G=0G=0, Pr(Y=1)=0.9 (Y=1)=0.9, whereas for G=1G=1, Pr(Y=1)=0.5 (Y=1)=0.5. Feature vectors are sampled from group–label–specific Gaussians, producing four subpopulations (G,Y)(G,Y) with distinct means and covariance structures: X∼(μg,y,Σg,y),X ( _g,y, _g,y), where the parameters are: • (G=0,Y=0)(G=0,Y=0): μ=[0,−1]μ=[0,-1], Σ=[7117] = bmatrix7&1\\ 1&7 bmatrix • (G=1,Y=0)(G=1,Y=0): μ=[−5,0]μ=[-5,0], Σ=[5115] = bmatrix5&1\\ 1&5 bmatrix • (G=0,Y=1)(G=0,Y=1): μ=[1,2]μ=[1,2], Σ=[5225] = bmatrix5&2\\ 2&5 bmatrix • (G=1,Y=1)(G=1,Y=1): μ=[2,3]μ=[2,3], Σ=[10114] = bmatrix10&1\\ 1&4 bmatrix This construction produces (i) unequal subgroup sizes, (i) asymmetric class balance across protected groups, and (i) distinct feature distributions - three core drivers of disparate vulnerability demonstrated in prior theory [26]. Because ground-truth generative structure is known, this dataset enables mechanistic examination of how fairness-enhancing algorithms and Differential Privacy alter subgroup-specific memorization and membership inference risk. All synthetic experiments use the same threat model, classifier families, and fairness interventions as the real datasets to ensure comparability. Models: Five distinct classifier architectures were employed to assess across different model families: Decision Trees (DT) were implemented using scikit-learn’s default parameters. We set the maximum depth to 10, following prior work (e.g., Shokri et al. [9]), where this parameter is commonly used as a standard benchmark to balance between underfitting and overfitting. Random Forest (RF) classifiers were implemented using scikit-learn with constrained complexity (maximum depth set to ⌈d2⌉ d2 where d is the number of features), retaining default parameters for tree counts (100 estimators). This constrained complexity approach is supported by prior work such as [30] showing that shallower trees (with appropriate ensemble size) often suffice for strong performance without the risk of overly deep, overfit trees. Because the synthetic data task is 2-dimensional with smooth class boundaries, we regularize Random Forests by capping tree depth at 6 to prevent memorization. Neural Networks (N) were implemented using scikit-learn’s MLPClassifier with ReLU activation functions and the Adam optimizer. The architecture was adapted to each dataset: a single hidden layer was used for moderate-dimensional datasets (Bank, COMPAS, Law School GPA); two hidden layers for the Law dataset; and three hidden layers for high-dimensional datasets such as German and MEPS19. Training employed an adaptive learning rate schedule and early stopping to reduce overfitting. The number of layers and overall setup were informed by existing literature to ensure alignment with expected test accuracies [4, 31, 12, 3, 13]. Our results closely replicate prior findings, with the exception of the Law School GPA dataset with classification setup, for which no clear benchmark values were available in the literature. Differentially Private Random Forest (DPRF) classifiers were implemented using IBM’s Differential Privacy library. The model mirrors the configuration of scikit-learn’s RF, with the same maximum depth logic applied (i.e., ⌈d2⌉ d2 ). In addition, it includes privacy-specific parameters. We tested the model under three different privacy levels, using ϵε values of 1, 10, and 50. As the literature commonly explores ϵε values in the range of 1 to 100, as noted in Holohan et al. [22], our choices are consistent with these practices. Differentially Private Stochastic Gradient Descent Neural Network (DP-SGD N) was implemented in PyTorch as a feedforward neural network, with the number of hidden layers and units matched to the dataset-specific architectures described for the non-private Neural Networks (see Neural Networks (N) above). Each hidden layer used ReLU activation, followed by a final linear output layer producing logits. Privacy was enforced using the Opacus PrivacyEngine, which applies per-sample gradient clipping and Gaussian noise addition during training to satisfy (ϵ,δ)(ε,δ)-differential privacy. We set the target privacy budget to ϵ=8.0ε=8.0 and δ=10−5δ=10^-5 to balance privacy protection and model utility, following common practice in differentially private ML experiments. We used the Opacus default maximum gradient clipping norm of 1.01.0, which bounds per-sample sensitivity while avoiding overly aggressive clipping. Models were trained with the Adam optimizer, a learning rate of 10−310^-3, a batch size of 64, and for 20 epochs. All other hyperparameters and training settings were kept consistent with the non-private N baselines, with the only difference being the use of DP-SGD to provide formal privacy guarantees. Our parameter settings follow the conventions established in the original DP-SGD paper [1]. Because all six datasets in our study are tabular and of moderate dimensionality, we focus on models that are standard and widely deployed in tabular decision-making pipelines (tree-based ensembles and feedforward neural networks), rather than architectures tailored to images or long sequences such as convolutional networks or transformers. This ensures that our findings reflect realistic fairness-privacy behavior in the domains where these datasets are typically used. These models provide a comparative analysis across simple non-parametric models, ensemble methods, and neural network architectures, while controlling for overfitting through architectural constraints and early stopping. Application of Differential Privacy. We apply Differential Privacy (DP) using IBM’s Differential Privacy Library for Random Forests (configured to match scikit-learn) and Opacus for differentially private stochastic gradient descent (SGD) when training neural networks. Below, we describe how DP is integrated with fairness-enhancing techniques in our experiments: 1. Data Preparation: We begin by uploading the dataset and splitting it into training and test sets. 2. Fairness Intervention (Pre-Processing): If the fairness method is a pre-processing technique, it is applied Pre-processing methods are applied to the training set only, except for Disparate Impact Remover (DIR), which operates on the full dataset. This ensures that fairness interventions do not interfere with the separation of training and test data. 3. Differentially Private Training: We then train the model using its differentially private version (Random Forest or Neural Network), maintaining the same hyperparameters as in the non-private version to enable direct comparison. If the fairness method is in-processing (e.g., Exponentiated Gradient Reduction), it is applied during this training phase. DP is applied solely during training, ensuring that all learned parameters and outputs satisfy the DP guarantee with respect to the training data. 4. Evaluation and Post-Processing: After training, the model is evaluated on the test set. For subgroup-level analysis, the test set is partitioned into subpopulations, and metrics are reported per subgroup. If the fairness technique is post-processing (e.g., Calibrated Equalized Odds), it is applied at this stage to model predictions-after training, without access to the training data, thereby preserving DP guarantees. 6 Theoretical Characterization of Subpopulation Privacy Risk Before presenting our full empirical analysis, we provide a concise theoretical explanation for the main phenomena observed on the synthetic dataset and later confirmed in real-world experiments (see Figure 1): (i) smaller / rarer subpopulations are more vulnerable to membership inference attacks (MIAs); (i) Differential Privacy (DP) reliably reduces membership-inference risk but can severely degrade subgroup utility, especially for underrepresented groups; and (i) different fairness-enhancing algorithms (reweighting, pre-processing, in-processing, post-processing) modify subgroup risk via changes to effective sample size, class separability, and Fisher information. All derivations given below are carried out under simplifying assumptions (binary class label, Gaussian class-conditional features, and a smooth parametric classifier such as logistic regression). These assumptions match the synthetic data construction used in our experiments (see the synthetic-data specification in Section 3 and results in Figure 1). Figure 1: Subpopulation-level membership inference vulnerability across datasets and fairness interventions. Plots show MIA success rates for every subgroup, dataset, and fairness mitigation strategy. Across all datasets minority subgroups exhibit consistently higher privacy leakage, while some fairness methods (e.g., egr) reduce subgroup-specific risk and others shift vulnerability unevenly. Setup and notation Let data points be z=(x,y,g)z=(x,y,g) where x∈ℝdx ^d are features, y∈0,1y∈\0,1\ the class label, and g∈0,1g∈\0,1\ the sensitive attribute (group). The training set S contains n samples partitioned into ngn_g samples from subgroup g. For clarity we write n0n_0 and n1n_1 for the two subgroup sizes. Assume a parametric classifier pθ(y∣x)p_θ(y x) trained by empirical risk minimization with loss ℓ(θ;z) (θ;z) (e.g., negative log-likelihood for logistic regression). Denote by θ θ the estimator trained on the full dataset and by θ^−i θ^-i the leave-one-out estimator excluding sample ziz_i. We study MIAs whose test statistic is (or is correlated with) the per-sample score difference between the model trained with and without that sample. Writing the per-sample logit sθ(x)s_θ(x) (e.g., raw model output), a generic membership signal is: Δi≜sθ^(xi)−sθ^−i(xi). _i s_ θ(x_i)-s_ θ^-i(x_i). Large (positive) Δi _i indicates that including point i makes the model more confident on xix_i, which increases membership-inference success. Assumptions: The following derivation relies on the ability to approximately isolate the Hessian contribution of each group. We emphasize that the conditions below are alternative sufficient conditions; the decomposition holds if any single one is satisfied: (i) Distinct feature distributions: Groups occupy different regions of the feature space. This is a standard prerequisite in fairness settings; if protected groups had identical distributions, disparate impact would generally not occur. (i) Group-specific parameters: In overparameterized models, different subsets of parameters (e.g., specific neurons or ensemble branches) effectively specialize for different subgroups. (i) Local decision boundaries: The boundary near group g is shaped primarily by within-group samples, which often occurs as a natural consequence of condition (i). In our study of tabular fairness datasets, sensitive attributes (e.g., race, gender) often correlate with distinct feature distributions, making these conditions realistic for providing explanatory intuition for our empirical findings. We now present the theoretical analysis that may explain the observed effects. 6.1 Influence function framework Under standard regularity conditions and for smooth loss ℓ , the leave-one-out parameter difference admits the first-order influence-function approximation [11, 20, 25]: θ^−θ^−i≈1nH−1∇θℓ(θ^;zi), θ- θ^-i≈ 1nH^-1 _θ ( θ;z_i), where H=1n∑j=1n∇θ2ℓ(θ^;zj)H= 1n _j=1^n∇^2_θ ( θ;z_j) is the empirical Hessian at θ θ. This is the classical influence function result from M-estimation theory. Applying a first-order Taylor expansion to the score difference: Δi≈∇θsθ^(xi)⊤(θ^−θ^−i)≈1n∇θsθ^(xi)⊤H−1∇θℓ(θ^;zi). _i≈ _θs_ θ(x_i) ( θ- θ^-i)≈ 1n _θs_ θ(x_i) H^-1 _θ ( θ;z_i). 6.2 Why small groups are more vulnerable Prior empirical work has documented that minority subgroups exhibit higher vulnerability to membership inference attacks [37, 5, 36, 39]. Here we provide a theoretical explanation for this phenomenon through influence function analysis. To understand the subgroup-size dependence, we decompose the empirical Hessian by group: H=1n∑j=1n∇θ2ℓ(θ^;zj)=n0nH0+n1nH1,H= 1n _j=1^n∇^2_θ ( θ;z_j)= n_0nH_0+ n_1nH_1, where Hg=1ng∑j:gj=g∇θ2ℓ(θ^;zj)H_g= 1n_g _j:g_j=g∇^2_θ ( θ;z_j) is the average Hessian within group g. For many learning problems, particularly when groups have distinct distributions or when the model has group-specific parameters, the curvature information about group g is primarily captured by HgH_g and contributes to H with weight ng/n_g/n. Consider the simplified case where the loss decomposes across groups (or parameters affecting each group are approximately independent). For a sample ziz_i from group g, the relevant second-order information is dominated by the group-specific component. In this regime, H−1≈(n/ng)Hg−1H^-1≈(n/n_g)H_g^-1, giving: H−1∇θℓ(θ^;zi)≈nngHg−1∇θℓ(θ^;zi).H^-1 _θ ( θ;z_i)≈ nn_gH_g^-1 _θ ( θ;z_i). Substituting back: Δi _i ≈1n∇θsθ^(xi)⊤⋅nngHg−1∇θℓ(θ^;zi) ≈ 1n _θs_ θ(x_i) · nn_gH_g^-1 _θ ( θ;z_i) =1ng∇θsθ^(xi)⊤Hg−1∇θℓ(θ^;zi). = 1n_g _θs_ θ(x_i) H_g^-1 _θ ( θ;z_i). (17) Result and Interpretation: The membership signal Δi _i scales as O(1/ng)O(1/n_g). Each sample from group g represents fraction 1/ng1/n_g of the group’s information, so removing it eliminates a larger share of group-specific knowledge when ngn_g is small. This amplifies the observable change in model predictions, linking smaller group size to larger |Δi|| _i| and higher MIA vulnerability. This aligns with theoretical work on deep learning memorization, which establishes that models must effectively ”memorize” examples from rare subpopulations (where ngn_g is small) to achieve low training error, resulting in high influence scores and privacy vulnerability [16, 15]. 6.3 Effect of Differential Privacy: noise reduces signal-to-noise ratio DP lowers membership signal but may disproportionately harm small groups. DP-SGD adds calibrated noise to gradients during training, utilizing mechanisms such as those introduced by Abadi et al. [1]. This has the cumulative effect of perturbing the learned parameters. As a first-order approximation, we can model this as additive Gaussian noise on the final parameters: θ^DP≈θ^+η θ_DP≈ θ+η where η∼(0,σ2I)η (0,σ^2I) and σ depends on the privacy budget. Critically, the DP-trained model θ^DP θ_DP and its leave-one-out counterpart θ^DP−i θ_DP^-i receive independent noise realizations (since they are trained on different datasets with independent randomness). For a linear score function sθ(x)=θ⊤xs_θ(x)=θ x, the noisy membership signal becomes: Δ~i=sθ^DP(xi)−sθ^DP−i(xi)≈Δi+(η−η−i)⊤xi, _i=s_ θ_DP(x_i)-s_ θ_DP^-i(x_i)≈ _i+(η-η^-i) x_i, where Δi=sθ^(xi)−sθ^−i(xi) _i=s_ θ(x_i)-s_ θ^-i(x_i) is the non-private signal and (η−η−i)⊤xi(η-η^-i) x_i is the additive noise term with variance 2σ2‖xi‖22σ^2\|x_i\|^2. The signal-to-noise ratio for distinguishing members from non-members degrades as: SNR∝([Δi|member]−[Δi|non-member])2Var(Δi)+2σ2‖xi‖2.SNR (E[ _i|member]-E[ _i|non-member])^2Var( _i)+2σ^2\|x_i\|^2. When 2σ2‖xi‖2≫Var(Δi)2σ^2\|x_i\|^2 ( _i), the DP noise dominates and the membership signal becomes undetectable, reducing MIA success. Disproportionate impact on small groups. While DP noise uniformly affects all samples, its impact on model utility is heterogeneous across subgroups. Recall that for small subgroups with size ngn_g, the model has less statistical information to learn group-specific patterns. If we view the learning problem for group g as distinct, the effective signal strength for classification in group g scales roughly with ng n_g (from standard learning theory [33]), while DP noise remains constant at level σ. For minority groups where ngn_g is small, the learned decision boundary exhibits higher variance and is less reliable, while the effective margin between classes is smaller. Consequently, DP noise of magnitude σ can overwhelm this weak group-specific signal, manifesting as catastrophic utility degradation (near-zero accuracy). In contrast, majority groups with large ngn_g have stronger learned signals that remain above the noise floor even with DP. This explains the empirical observations in Tables I–I and Figure 5, where DP training preserves utility for majority groups while collapsing accuracy for underrepresented groups. This creates a tension: DP successfully reduces MIA vulnerability (good for privacy), but the uniform noise injection disproportionately harms groups that have weaker representation in the training data (bad for fairness). 6.4 How fairness interventions change subgroup MIA risk Below we analyze how common fairness strategies modify the learned model and consequently affect MIA vulnerability across subgroups. The key insight is that fairness interventions change the decision boundaries, margins, and loss landscape in group-specific ways. Reweighting (REW) multiplies each sample’s loss by a weight wg,yw_g,y that upweights underrepresented subgroup-label combinations [24]. The weighted objective becomes: θ^REW=argminθ1n∑i=1nwgi,yiℓ(θ;zi). θ_REW= _θ 1n _i=1^nw_g_i,y_i (θ;z_i). This changes MIA vulnerability through two mechanisms. First, the learned θ^REW θ_REW differs from the unweighted θ θ, typically improving classification margins for upweighted groups. Better margins mean smaller per-sample gradients ‖∇θℓ(θ^REW;zi)‖\| _θ ( θ_REW;z_i)\| for correctly classified samples, which reduces the membership signal Δi _i. Second, the influence function for weighted ERM becomes: θ^REW−θ^REW−i≈wgi,yinHw−1∇θℓ(θ^REW;zi), θ_REW- θ_REW^-i≈ w_g_i,y_inH_w^-1 _θ ( θ_REW;z_i), where Hw=1n∑jwgj,yj∇θ2ℓ(θ^REW;zj)H_w= 1n _jw_g_j,y_j∇^2_θ ( θ_REW;z_j). While individual sample influence is scaled by wgi,yiw_g_i,y_i, the Hessian HwH_w also changes, making the net effect depend on the balance between upweighting in numerator vs. denominator. Empirically, REW often reduces MIA vulnerability for minority groups, primarily because the improved model quality (better margins, lower loss) reduces the distinguishability between member and non-member samples. Disparate Impact Remover (DIR) reduces correlation between features and sensitive attributes by projecting data to remove disparate impact [14]. This changes the class-conditional distributions P(x|y,g)P(x|y,g), potentially reducing distributional differences between groups, and changing the feature space geometry (affecting ‖xi‖\|x_i\| and thus noise terms). The impact on MIA depends on whether DIR makes the learning problem easier (better generalization → lower vulnerability) or introduces artifacts (potential for different types of memorization). Synthetic data augmentation (SYN) increases training set size by adding synthetic samples for minority groups [40, 10]. This effectively increases ngn_g, which should reduce per-sample influence (Δi∝1/ng _i 1/n_g). However, if synthetic samples are low-quality or highly correlated with real samples, they may not provide independent information, limiting the privacy benefit. In summary, fairness interventions modify MIA risk primarily by changing the learned model θ θ and the resulting classification margins, loss values, and gradient magnitudes for each subgroup. The direction and magnitude of privacy impact depend on the specific intervention and how it reshapes the loss landscape. We would like to stress that the above derivations use linearized / first-order approximations (influence functions, additive DP noise). Nonlinear model behavior (deep nets), adaptive training, and more complex fairness algorithms can produce richer dynamics; nevertheless the arguments identify the dominant mechanisms that explain the empirical patterns reported in Section 7 and illustrated in Figure 1 7 Empirical Results 7.1 Impact of Fairness-Enhancing Algorithms Mitigation strategies reveal several notable patterns. As shown in Figure 1, EGR generally achieves the strongest reductions in privacy risk for the more complex RF model. In contrast, REW and SYN yield only modest privacy-risk reductions for simpler models such as DT and N, and these differences are typically small (Figures 1, 2 and Appendix A). DIR exhibits inconsistent behavior, sometimes increasing and other times decreasing privacy risk, while EGR itself performs poorly on DT and N despite its strong performance on RF. While SYN performs well on Bank and COMPAS, it does not exhibit consistent advantages across other datasets, indicating that its effectiveness is dataset-dependent. Notably, these fairness algorithms preserve overall accuracy within ± 1–3% across all datasets, but subpopulation-level utility shifts can be dramatic, reaching up to ± 33% for individual subgroups (details in Appendix F). No single method consistently improves utility for underrepresented groups across all datasets, further confirming that fairness–privacy–utility trade-offs are dataset-dependent. Figure 2: Decision Tree privacy risk results under OQTA for: Bank (Age), COMPAS (Race), MEPS (Race), and Synthetic (G) datasets. It visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model. Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 3: Radial plot comparing the subpopulation most affected by the CPP mitigator in each dataset for the Decision Tree (DT) model under the OTA attack. For every dataset, the plotted value corresponds to the subpopulation with the largest positive gap between the original and CPP test accuracies, indicating where CPP reduces accuracy the most. Dataset labels marked with an asterisk (*) denote cases where this most-affected subpopulation is the underrepresented group. The outer polygon shows the original model’s accuracy, while the inner polygon shows the CPP-mitigated accuracy, highlighting the extent of subgroup-level utility degradation introduced by the mitigator. Figure 4: Distribution of data samples across all subpopulations for each dataset. Figure 5: Comparison of mean test accuracies across subpopulations and fairness mitigation methods for different models under LiRA setup (RF and DPRF with varying privacy epsilons). Each point on the radar represents the average accuracy across subpopulations and methods for a dataset. (a) Decision Tree (b) Random Forest (c) Neural Network (d) DP Random Forest (ε=1 =1) Figure 6: Fairness metric (average odds difference) results under LiRA attack. Lower values indicate better fairness. TABLE I: Subpopulation utility difference (difference between the test accuracy for the subpopulation before and after application of DP) and privacy risks for subpopulation after the application of DP (DPRF vs. RF) across fairness mitigators for LiRA setup. Rows show datasets with fairness mitigators. Asterisks (*) mark low-utility subgroups (¡ 5%) whereas tick (✓) means that the privacy risk is minimized for the given subpopulation (privacy risk goes down to 50± 2%). G0−G_0^- G1−G_1^- G0+G_0^+ G1+G_1^+ Dataset Mitigator Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Synthetic (G) orig -25.49% -0.75% ✓ 2.02% ✓ 1.60% ✓ syn -46.06% -1.50% ✓ 20.37% ✓ -2.97% ✓ rew -30.33% ✓ 1.67% ✓ 4.38% -5.06% ✓ dir -27.64% -0.53% ✓ 0.99% ✓ -0.19% ✓ eg -30.32% -69.24% ✓ -7.67% ✓ -7.46% MEPS (race) orig 2.33% ✓ 5.16% ✓ -25.42% ✓ -33.14% ✓ syn 2.01% ✓ 4.44% ✓ -25.82% ✓ -31.82%* ✓ rew 2.25% ✓ 4.93% ✓ -24.28% ✓ -32.47% ✓ dir 2.09% ✓ 4.96% ✓ -23.82% ✓ -33.34% ✓ eg -2.67% ✓ -0.51% ✓ -25.67% ✓ -29.85% ✓ Bank (age) orig 4.08% ✓ 1.55% ✓ -39.70% ✓ -35.04% ✓ syn 4.38% 1.45% ✓ -37.33% ✓ -34.35%* ✓ rew 2.92% ✓ 1.80% ✓ -33.71% ✓ -35.28% ✓ dir 4.62% ✓ 2.00% ✓ -40.86% ✓ -36.05% ✓ eg -9.42% ✓ -14.30% ✓ -26.90% ✓ -23.37% ✓ COMPAS (race) orig 12.77% ✓ 13.93% ✓ -29.93% ✓ -36.70% ✓ syn 7.88% ✓ 14.82% ✓ -22.47% ✓ -40.39%* ✓ rew 14.72% ✓ 17.06% ✓ -31.40% ✓ -43.02%* ✓ dir 1.82% ✓ 13.84% ✓ -15.64% ✓ -37.84%* ✓ eg 24.71% ✓ 20.82% ✓ -54.44%* ✓ -43.40%* ✓ TABLE I: Subpopulation utility difference (difference between the test accuracy for the subpopulation before and after application of DP) and privacy risks for subpopulation after the application of DP (DPRF vs. RF) across fairness mitigators for OQTA setup. Rows show datasets with fairness mitigators. Asterisks (*) mark low-utility subgroups (¡ 5%) whereas tick (✓) means that the privacy risk is minimized for the given subpopulation (privacy risk goes down to 50± 2%). Values are averaged over 20 runs, while the standard deviation is in the interval [0;0.06]. G0−G_0^- G1−G_1^- G0+G_0^+ G1+G_1^+ Dataset Mitigator Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Synthetic (G) orig -23.76% 6.10% 3.86% -4.01% ✓ syn -44.29% 0.32% ✓ 28.34% ✓ 3.89% ✓ rew -27.08% 12.06% 5.13% -8.31% ✓ dir -14.13% 6.46% 1.29% ✓ -10.77% eg -30.06% -55.25% ✓ 12.70% 22.10% Bank (age) orig 14.00% ✓ 3.39% ✓ -55.47%* ✓ -42.63%* ✓ syn 10.94% ✓ 2.91% ✓ -48.50%* ✓ -38.41%* ✓ rew 12.46% ✓ 3.40% ✓ -51.93%* ✓ -42.94%* ✓ dir 11.04% ✓ 3.04% ✓ -44.91%* ✓ -40.36%* ✓ eg 13.42% ✓ 3.46% ✓ -54.62%* ✓ -43.12%* ✓ COMPAS (race) orig 11.57% ✓ 9.51% ✓ -34.82% ✓ -28.13% ✓ syn 11.57% ✓ 9.51% ✓ -34.82% ✓ -28.13% ✓ rew 10.17% ✓ 11.80% ✓ -33.49% ✓ -31.75% ✓ dir 11.58% ✓ 13.19% ✓ -37.42% ✓ -34.00% ✓ eg 22.15% ✓ 21.66% ✓ -53.32%* ✓ -45.51%* ✓ MEPS (race) orig 3.26% ✓ 6.51% ✓ -31.66%* ✓ -38.48%* ✓ syn 4.02% ✓ 7.15% ✓ -34.58%* ✓ -39.79%* ✓ rew 3.31% ✓ 6.10% ✓ -32.11%* ✓ -37.88%* ✓ dir 3.11% ✓ 6.25% ✓ -31.11%* ✓ -36.77%* ✓ eg 3.28% ✓ 6.15% ✓ -30.96%* ✓ -38.01%* ✓ Post-processing methods also exhibit unique dynamics. For example, the CPP mitigator consistently yields privacy risks near 0.5, the level expected from random guessing in membership inference attacks, seemingly indicating strong privacy. However, our evaluation emphasizes the balance between utility, fairness, and privacy. CPP’s main limitation is its uneven and unpredictable impact on subgroup utility. As illustrated in Figure 3, while test accuracies decline significantly, these declines are not concentrated among underrepresented groups. In several datasets (e.g., COMPAS (Gender), COMPAS (Race), LawSchoolGPA (Gender)), minority groups occasionally retain or even improve their accuracy, whereas majority groups decline. This suggests that CPP redistributes errors in a non-systematic manner, undermining overall utility and consistency. Fairness metrics similarly shift in dataset-specific ways without a clear trend of improvement (Please refer to Appendix D). Taken together, these results show that although CPP often achieves privacy levels close to random guessing, it does not reliably preserve subgroup utility. Detailed per-group test accuracies and fairness comparisons with the original model and CPP are provided in Appendix D. Across all datasets and models, we observe a consistent relationship between subpopulation size and privacy vulnerability: larger groups tend to exhibit lower membership inference risk, whereas the smallest subpopulations are the most exposed. The distribution of samples across subpopulations is shown in Figure 4. Measuring size by each subgroup’s relative representation, we find that majority groups, such as the Privileged Unfavorable group in Bank or the Unprivileged Favorable group in MEPS19, consistently exhibit lower privacy risk than small, underrepresented subpopulations. This pattern is robust across all attacks (see Figure 2 and Appendix A) and empirically supports the conclusion of Kulynych et al. [26] that minority groups face disproportionately higher vulnerability to membership inference. Taken together, these results demonstrate that subpopulation prevalence remains a key determinant of individual privacy risk, even in the presence of fairness-enhancing algorithms designed to reduce disparities. 7.2 Impact of Differential Privacy To the best of our knowledge, this is the first detailed analysis of how DP affects subpopulation-level privacy risks in the presence of various fairness-enhancing techniques. Our analysis reveals that the application of DP is highly effective at reducing subpopulation privacy risks, as shown in Tables I–I. This pattern holds across all fairness mitigators demonstrating that DP can offer strong protection against membership inference privacy risk across the subgroups when different fairness-enhancing techniques are applied. However, this reduction in privacy risk comes at a significant cost to model utility at the subpopulation level. As shown in Table I, while some subgroups exhibit only modest drops or even slight improvements in test accuracy, privileged subpopulations, those denoted as G0+G_0^+ and G1+G_1^+, suffer from drastic decreases in predictive performance. In many instances, the test accuracy for these groups approaches zero (those denoted with asterisk which shows test accuracy got less than 5%), suggesting that the addition of DP noise severely compromises the model’s ability to learn from these examples. Utility and privacy risks for all other datasets and the OT attack, together with the results of DP-SGD are reported in Appendix B, where we observe the same pattern across datasets, further strengthening our empirical findings. Figure 5 illustrates how test accuracy changes across different ϵε values (1, 10, 50). When analyzing how DP interacts with fairness mitigators, we find that almost all mitigators benefit from reduced privacy risks, each achieving ✓-level risk levels across all subgroups. This suggests that DP’s privacy protection is largely invariant to the chosen fairness strategy. However, utility impacts vary: REW tends to preserve utility more effectively for unfavorable subgroups, while EGR generally causes the greatest accuracy drops for favorable ones. SYN and DIR fall in between, with a dataset-specific variation. Thus, the utility cost of DP interacts non-trivially with the chosen fairness method. When it comes to the effect on fairness, most mitigators tend to exhibit improved fairness after DP is applied-except for REW, whose behavior is more variable. Interestingly, the uniform reduction in subgroup accuracies caused by DP can lead to numerically better fairness metrics, as the performance gap between groups narrows. However, this comes at a cost: the improvements in fairness often reflect overall degradation, not actual performance gains. In other words, while the model may appear fairer on paper, it becomes less useful in practice. This trade-off underscores that in certain applications, DP can significantly reduce privacy risks while preserving the model’s overall performance. However, this benefit is not uniformly distributed: while most subpopulations retain acceptable levels of accuracy, certain subgroups suffer dramatic reductions in performance, sometimes to the point of exhibiting almost no learning. This divergence highlights that even when DP is tuned to achieve a favorable balance between utility and privacy at an aggregate level, its impact on certain subpopulations can be disproportionately negative. Importantly, fairness-enhancing algorithms do not affect DP-induced utility loss uniformly. Instead, their interaction with DP is mitigator-dependent. Consistent with our analysis, REW tends to preserve subgroup utility more effectively for unfavorable subgroups, whereas EGR generally causes the largest accuracy drops for favorable subgroups. SYN and DIR typically exhibit intermediate, dataset-dependent behavior. Overall, we do not observe a uniform trend in which fairness mitigators consistently improve or consistently worsen utility under DP. Rather, the effect varies across mitigators, subgroups, and datasets, reinforcing that the interaction between DP and fairness methods is non-trivial and must be evaluated at the subpopulation level. Additional experiments at intermediate privacy budgets (ϵ∈3,5ε∈\3,5\) confirm these patterns while revealing a compounded disadvantage for underrepresented subgroups (details in Table VII): in COMPAS (Race), the underrepresented favorable group (G1+G_1^+) retains ✓-level privacy under only 1 of 5 mitigators at ϵ=3ε=3 and 0 of 5 at ϵ=5ε=5, while simultaneously suffering utility drops of up to 49%, whereas other subgroups maintain privacy protection across all ϵε values. 7.3 Impact of Machine Learning Models Our analysis shows that the privacy impact of fairness mitigation techniques is closely related to the model architecture. In particular, more complex models tend to increase privacy risks. For example, across subpopulations in the Bank and MEPS19 datasets, privacy risk generally rises in the order of Neural Networks, Decision Trees, and then Random Forests (Figures 1, 2, 7–11). This trend highlights the role of model complexity and overfitting in driving membership inference vulnerability. Neural Networks, in particular, display mixed outcomes: techniques like synthetic data generation amplify subgroup risks in some cases, while other mitigators show inconsistent patterns of protection. These findings challenge the idea that fairness interventions always deteriorates privacy and instead reveal that the interplay between model choice, complexity, and mitigation strategy can create new privacy-fairness tradeoffs. 7.4 Discussion Our results across Sections 7.1–7.3 reveal several cross-cutting patterns that merit joint consideration. Fairness mitigators and privacy risk. No single fairness-enhancing method consistently reduces privacy risk across all models and datasets. EGR achieves the strongest privacy-risk reductions for RF but performs poorly on simpler models (DT, N), while REW offers modest but stable privacy improvements alongside reliable fairness gains. SYN is effective on specific datasets (e.g., Bank, COMPAS) but lacks generalizability, and DIR behaves inconsistently, sometimes increasing privacy risk. Post-processing via CPP achieves near-random-guessing privacy levels but at the cost of unpredictable subgroup utility redistribution, undermining its practical reliability. Crucially, all mitigators preserve overall accuracy within ± 1–3%, yet subpopulation-level utility shifts can reach up to ± 33%, highlighting that aggregate metrics mask significant subgroup disparities. The role of subpopulation size. Across all experiments, subpopulation size emerges as a persistent driver of privacy vulnerability: smaller subgroups consistently face higher membership inference risk, regardless of the mitigator or attack applied. This pattern persists even after fairness interventions, indicating that current mitigation strategies do not neutralize the structural disadvantage of underrepresentation. Differential Privacy: protection with uneven costs. DP reliably suppresses membership inference risk across all mitigators and subgroups, often to near-random-guessing levels. However, its utility cost is distributed unevenly: certain subgroups, particularly privileged and underrepresented favorable groups, experience accuracy collapses to near zero. The interaction between DP and fairness mitigators is non-trivial: REW tends to preserve subgroup utility more effectively under DP, while EGR causes the largest accuracy drops for favorable subgroups. Furthermore, apparent fairness improvements under DP often reflect uniform accuracy degradation rather than genuine gains, as performance gaps narrow primarily because all groups lose utility. Intermediate privacy budgets (ϵ∈3,5ε∈\3,5\) reveal compounded disadvantages for underrepresented subgroups, who lose both privacy protection and utility simultaneously. Model complexity as a mediating factor. Privacy risk generally increases with model complexity, and this ordering interacts with the choice of mitigator. Fairness interventions that reduce privacy risk for complex models (e.g., EGR on RF) may amplify it for simpler ones, challenging the assumption that fairness interventions uniformly affect privacy in a single direction. Practical recommendations. Given the dataset-, model-, and subgroup-dependent nature of these trade-offs, practitioners should select strategies based on their primary objective: • If privacy is paramount: combine DP with lower-complexity models and conservative mitigators such as REW, while monitoring subgroup utility for disproportionate degradation. • If fairness is the priority: EGR and REW offer strong fairness gains, with the caveat that EGR may increase privacy risk for simpler model classes. • If utility preservation is critical: avoiding DP and relying on pre- or in-processing mitigators helps maintain predictive performance, though subpopulation-level accuracy should still be verified. In all cases, evaluation at the subpopulation level is essential, as aggregate metrics consistently fail to capture the disparities observed across our experiments. 8 Conclusions In this work, we presented a comprehensive subpopulation-level analysis of the trade-offs between fairness, privacy, and utility. By evaluating a wide range of model families, membership inference attacks, and fairness mitigation strategies, we demonstrate that aggregate metrics consistently obscure critical disparities that emerge at the subgroup level. Our research makes three primary contributions to the field. First, we provide the first detailed assessment of the interaction between Differential Privacy (DP) and fairness-enhancing algorithms through a subpopulation lens, revealing that privacy protection often imposes an uneven utility cost on the very groups fairness interventions aim to protect. Second, we introduced a subpopulation-level adaptation of the Likelihood Ratio Attack (LiRA), enabling a more granular audit of membership inference vulnerability. Third, our findings empirically confirm that underrepresented groups bear a disproportionate privacy risk, a structural disadvantage that existing fairness mitigators do not inherently resolve. The central takeaway of our study is that there is no universal solution for balancing fairness, privacy, and utility. These trade-offs are not static; they are deeply dependent on dataset characteristics, model architecture, and subgroup definitions. Consequently, we argue that these objectives must be evaluated jointly and at a granular level to ensure that fairness interventions do not inadvertently introduce new forms of privacy-related harm. Our framework provides a rigorous foundation for future research into optimizing these three pillars of trustworthy AI simultaneously, ensuring that the benefits of machine learning are distributed equitably across all populations. 9 Ethical and Potential Harm Considerations This study follows EuroS&P guidelines on proactive harm prevention. All experiments use publicly available benchmark datasets containing no personally identifiable information, and the attacks (LiRA, OQTA, OTA) run only in controlled, simulated settings; no deployed systems or real users are targeted. We also note that fairness interventions may unintentionally reduce subgroup utility, and our analysis discusses these risks to help practitioners avoid harmful misapplications. Our work aims to promote safer and more equitable ML systems and introduces no actions that could directly harm individuals or groups. 10 Open Science and Data Availability In accordance with EuroS&P’s Open Science expectations, we aim to make our work as transparent and reproducible as possible. All datasets used in this study are publicly available benchmark datasets, and we provide full details of preprocessing and experimental configuration to enable exact replication. The source code used to run all experiments, generate figures, and reproduce the results in this paper is released under an open license and can be accessed at: https://anonymous.4open.science/r/eurosp-2026-submission-395/. No proprietary, sensitive, or restricted data are used, and all artifacts required for reproducibility are openly shared. 11 Acknowledgments Umid Suleymanov and Murat Kantarcioglu were supported in part by The Commonwealth cyber initiative grants. The authors also thank ADA University’s Center for Data Analytics Research (CeDAR) for providing computing resources. We used AI assistance solely for improving grammar, clarity, and LaTeX formatting of text and mathematical expressions, in accordance with conference policies. In Section 6, large language models were used to help check and refine intermediate steps of some mathematical derivations; all final formulations and arguments were independently verified by the authors. The system was not used to generate scientific ideas, experimental designs, analyses, results, or claims presented in this paper. References [1] Martin Abadi, Andy Chu, Ian Goodfellow, H. Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS ’16, page 308–318, New York, NY, USA, 2016. Association for Computing Machinery. [2] Alekh Agarwal, Alina Beygelzimer, Miroslav Dudik, John Langford, and Hanna Wallach. A reductions approach to fair classification. In Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 60–69. PMLR, 2018. [3] V. Aithal and R. D. Jathanna. Credit risk assessment using machine learning techniques. International Journal of Innovative Technology and Exploring Engineering, 9(1):3482–3486, 2019. [4] Qeethara Al-Shayea. Evaluating marketing campaigns of banking using neural networks. Lecture Notes in Engineering and Computer Science, 2:759–761, 07 2013. [5] Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. Differential privacy has disparate impact on model accuracy. In Advances in Neural Information Processing Systems, volume 32, 2019. [6] R. K. E. Bellamy, K. Dey, M. Hind, S. C. Hoffman, S. Houde, K. Kannan, P. Lohia, J. Martino, S. Mehta, A. Mojsilović, S. Nagar, K. Natesan Ramamurthy, J. Richards, D. Saha, P. Sattigeri, M. Singh, K. R. Varshney, and Y. Zhang. Ai fairness 360: An extensible toolkit for detecting and mitigating algorithmic bias. IBM Journal of Research and Development, 63(4/5):4:1–4:15, 2019. [7] Blake Bullwinkel, Chris Waites, Stephen Ranshous, Daniel Kifer, and Michael Hay. Evaluating the fairness impact of differentially private synthetic data. arXiv preprint arXiv:2205.04321, 2022. [8] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), pages 1897–1914. IEEE, 2022. [9] Hongyan Chang and Reza Shokri. On the privacy risks of algorithmic fairness. arXiv preprint arXiv:2011.03731, 2021. [10] Nitesh V. Chawla, Kevin W. Bowyer, Lawrence O. Hall, and W. Philip Kegelmeyer. Smote: synthetic minority over-sampling technique. J. Artif. Int. Res., 16(1):321–357, June 2002. [11] R Dennis Cook and Sanford Weisberg. Residuals and influence in regression. New York: Chapman and Hall, 1982. [12] Julia Dressel and Hany Farid. The accuracy, fairness, and limits of predicting recidivism. Science Advances, 4(1):eaao5580, 2018. [13] Mengnan Du, Subhabrata Mukherjee, Guanhong Wang, Raphael Tang, Ahmed Hassan Awadallah, and Xia Hu. Fairness via representation neutralization. arXiv preprint arXiv:2106.12674, 2021. [14] Michael Feldman, Sorelle A. Friedler, John Moeller, Carlos Scheidegger, and Suresh Venkatasubramanian. Certifying and removing disparate impact. In Proceedings of the 21st ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 259–268. ACM, 2015. [15] Vitaly Feldman. Does learning require memorization? a short tale about a long tail, 2021. [16] Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 2881–2891. Curran Associates, Inc., 2020. [17] Ferdinando Fioretto, Chi Tran, Pascal Van Hentenryck, and Kai Zhu. Differential privacy and fairness in decisions and learning tasks: A survey. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence (IJCAI), pages 5470–5477, July 2022. [18] Ferdinando Fioretto, Cuong Tran, and Pascal Van Hentenryck. Decision making with differential privacy under a fairness lens, 2024. [19] Léo Grinsztajn, Edouard Borchi, and Gaël Varoquaux. Why do tree-based models still outperform deep learning on typical tabular data? In Advances in Neural Information Processing Systems, volume 35, pages 507–520, 2022. [20] Frank R Hampel, Elvezio M Ronchetti, Peter J Rousseeuw, and Werner A Stahel. Robust statistics: the approach based on influence functions. John Wiley & Sons, 1986. [21] Victor Hansen, Atula Neerkaje, Ramit Sawhney, Lucie Flek, and Anders Søgaard. The impact of differential privacy on group disparity mitigation. In Kevin Duh, Helena Gomez, and Steven Bethard, editors, Findings of the Association for Computational Linguistics: NAACL 2024, pages 3952–3965, Mexico City, Mexico, June 2024. Association for Computational Linguistics. [22] Naoise Holohan, Stefano Braghin, Pól Mac Aonghusa, and Siobhán Levacher. Diffprivlib: The ibm differential privacy library. arXiv preprint arXiv:1907.02444, 2019. [23] Matthew Jagielski, Michael Kearns, Jieming Mao, Alina Oprea, Aaron Roth, Saeed Sharifi Malvajerdi, and Jonathan Ullman. Differentially private fair learning. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 3000–3008. PMLR, 09–15 Jun 2019. [24] Faisal Kamiran and Toon Calders. Data preprocessing techniques for classification without discrimination. Knowledge and Information Systems, 33(1):1–33, 2012. [25] Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International Conference on Machine Learning (ICML), pages 1885–1894. PMLR, 2017. [26] Bogdan Kulynych, Mohammad Yaghini, Giovanni Cherubin, Michael Veale, and Carmela Troncoso. Disparate vulnerability to membership inference attacks. Proceedings on Privacy Enhancing Technologies, 2022(1):460–480, 2022. [27] Karima Makhlouf, Tamara Stefanovic, Heber H. Arcolezi, and Catuscia Palamidessi. A systematic and formal study of the impact of local differential privacy on fairness: Preliminary results, 2024. [28] Paul Mangold, Michaël Perrot, Aurélien Bellet, and Marc Tommasi. Differential privacy has bounded impact on fairness in classification, 2023. [29] Sasi Kumar Murakonda and Reza Shokri. Ml privacy meter: Aiding regulatory compliance by quantifying the privacy risks of machine learning. arXiv preprint arXiv:2007.09339, 2020. [30] Abolfazl Nadi and Hadi Moradi. Increasing the views and reducing the depth in random forest. Expert Systems with Applications, 138:112801, 2019. [31] Roberto Pagliari, Peter Hill, Po-Yu Chen, Maciej Dabrowny, Tingsheng Tan, and Francois Buet-Golfouse. A comprehensive sustainable framework for machine learning and artificial intelligence, 2024. [32] Geoff Pleiss, Manish Raghavan, Felix Wu, Jon Kleinberg, and Kilian Q. Weinberger. On fairness and calibration. In Advances in Neural Information Processing Systems, volume 30, 2017. [33] Shai Shalev-Shwartz and Shai Ben-David. Understanding Machine Learning: From Theory to Algorithms. Cambridge University Press, USA, 2014. [34] Huan Tian, Guangsheng Zhang, Bo Liu, Tianqing Zhu, Ming Ding, and Wanlei Zhou. When fairness meets privacy: Exploring privacy threats in fair binary classifiers via membership inference attacks. pages 512–520, 08 2024. [35] Cuong Tran, My H. Dinh, and Ferdinando Fioretto. Differentially empirical risk minimization under the fairness lens, 2022. [36] Stacey Truex, Ling Liu, Mehmet Emre Gursoy, Wenqi Wei, and Lei Yu. Effects of differential privacy and data skewness on membership inference vulnerability. In Proceedings of the 2019 IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), pages 82–91. IEEE, 2019. [37] Mohammad Yaghini, Bogdan Kulynych, and Carmela Troncoso. Disparate vulnerability: on the unfairness of privacy attacks against machine learning. arXiv preprint arXiv:1906.00389, 2019. [38] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. In Proceedings of the 2018 IEEE 31st Computer Security Foundations Symposium (CSF), pages 268–282. IEEE, 2018. [39] Da Zhong, Haipei Sun, Jun Xu, Neil Zhenqiang Gong, and Wendy Hui Wang. Understanding disparate effects of membership inference attacks and their countermeasures. In Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, pages 62–75, 2022. [40] Yan Zhou, Murat Kantarcioglu, and Chris Clifton. On Improving Fairness of AI Models with Synthetic Minority Oversampling Techniques, pages 874–882. SIAM, 2023. Appendix A Privacy Risk Graphs Figure 7: Decision Tree privacy risk results under LiRA attack for: Bank (Age), COMPAS (Race), and MEPS (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model. Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 8: Random Forest privacy risk results under LiRA attack for: Bank (Age), COMPAS (Race), and MEPS (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model.Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 9: Random Forest privacy risk results under OQTA for: Bank (Age), COMPAS (Race), and MEPS (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model. Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 10: Neural Network privacy risk results under LiRA attack for: Bank (Age), COMPAS (Race), and MEPS (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model.Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 11: Neural Network privacy risk results under OQTA for: Bank (Age), COMPAS (Race), and MEPS (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model. Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 12: Decision Tree privacy risk results under OT attack for: COMPAS (Gender), Law (Gender), and Law (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model. Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 13: Random Forest privacy risk results under OT attack for: COMPAS (Gender), Law (Gender), and Law (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model. Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 14: Neural Network privacy risk results under OT attack for: COMPAS (Gender), Law (Gender), and Law (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model. Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 15: Decision Tree privacy risk results under OQTA for: German (Age), German (Gender), Law School GPA (Gender), and Law School GPA (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques.The red dashed line indicates baseline risk from the original unmitigated model. Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 16: Random Forest privacy risk results under OT attack for: German (Age), German (Gender), Law School GPA (Gender), and Law School GPA (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model. Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Figure 17: Neural Network privacy risk results under LiRA attack for: German (Age), German (Gender), Law School GPA (Gender), and Law School GPA (Race) datasets. Visualizes subpopulation privacy risks across different fairness mitigation techniques. The red dashed line indicates baseline risk from the original unmitigated model.Values are averaged over 20 runs, while the standard deviation is shown with error bars. The horizontal range is dynamic for better visibility. Appendix B DP Utility and Privacy Risk Graphs TABLE IV: Subpopulation utility difference (difference between the test accuracy for the subpopulation before and after application of DP) and privacy risks for subpopulation after the application of DP (DP - SGD vs. N) across fairness mitigators for LiRA setup. Rows show datasets with fairness mitigators. Asterisks (*) mark low-utility subgroups (¡ 5%) whereas tick (✓) means that the privacy risk is minimized for the given subpopulation (privacy risk goes down to 50± 2%). Values are averaged over 20 runs, while the standard deviation is in the interval [0;0.06]. G0−G_0^- G1−G_1^- G0+G_0^+ G1+G_1^+ Dataset Mitigator Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Synthetic (G) orig -66.20%* -71.26% ✓ 65.38% ✓ 20.60% ✓ syn -34.61% ✓ -17.41% ✓ 19.68% ✓ -11.84% ✓ dir -83.33%* -60.66% ✓ 83.33% ✓ 31.53% ✓ rew -100.00%* ✓ -93.39%* ✓ 100.00% ✓ 23.91% ✓ eg -6.42% -0.61% ✓ 0.52% ✓ -0.46% ✓ Bank (age) orig 12.930 216 472 979 9912.930\,216\,472\,979\,99% ✓ 3.999 855 839 362 493.999\,855\,839\,362\,49% ✓ −48.668 730 660 345 3-48.668\,730\,660\,345\,3% ✓ −43.610 148 979 085 72-43.610\,148\,979\,085\,72% ✓ syn 0.753 099 910 774 990.753\,099\,910\,774\,99% ✓ 0.399 466 913 372 450.399\,466\,913\,372\,45% ✓ −1.073 060 550 224 07-1.073\,060\,550\,224\,07%* ✓ −0.234 532 872 182 03-0.234\,532\,872\,182\,03%* ✓ dir −4.329 195 374 962 58-4.329\,195\,374\,962\,58% ✓ −1.085 329 459 139 53-1.085\,329\,459\,139\,53% ✓ 11.369 988 703 272 9311.369\,988\,703\,272\,93% ✓ 13.723 619 457 460 3213.723\,619\,457\,460\,32% ✓ rew −0.114 000 527 361 14-0.114\,000\,527\,361\,14% ✓ 0.466 576 604 202 460.466\,576\,604\,202\,46% ✓ −1.922 278 753 962 36-1.922\,278\,753\,962\,36% ✓ −1.007 205 894 831 21-1.007\,205\,894\,831\,21% ✓ eg −10.522 650 774 762 5-10.522\,650\,774\,762\,5% ✓ −1.509 871 701 142 25-1.509\,871\,701\,142\,25% ✓ 16.192 462 647 02416.192\,462\,647\,024% ✓ 0.889 865 039 567 420.889\,865\,039\,567\,42% ✓ COMPAS (race) orig −2.868 899 946 350 74-2.868\,899\,946\,350\,74% ✓ 8.555 829 379 125 118.555\,829\,379\,125\,11% ✓ −7.583 954 195 445 64-7.583\,954\,195\,445\,64% ✓ −26.271 489 485 763 6-26.271\,489\,485\,763\,6%* ✓ syn −0.536 017 957 726 6-0.536\,017\,957\,726\,6% ✓ 10.374 998 826 684 7110.374\,998\,826\,684\,71% ✓ −8.064 836 591 431 24-8.064\,836\,591\,431\,24% ✓ −31.229 248 179 034 14-31.229\,248\,179\,034\,14%* ✓ dir −0.416 124 704 154 7-0.416\,124\,704\,154\,7% ✓ −1.936 082 655 282-1.936\,082\,655\,282% ✓ −0.398 337 153 927 74-0.398\,337\,153\,927\,74% ✓ 6.776 744 533 468 026.776\,744\,533\,468\,02% ✓ rew −3.092 771 200 217 65-3.092\,771\,200\,217\,65% ✓ −6.945 419 894 279 51-6.945\,419\,894\,279\,51% ✓ 3.343 163 020 325 363.343\,163\,020\,325\,36% ✓ 6.905 299 450 190 446.905\,299\,450\,190\,44% ✓ eg 22.561 638 032 269 4822.561\,638\,032\,269\,48% ✓ 20.885 133 795 967 2320.885\,133\,795\,967\,23% ✓ −38.207 297 296 379 7-38.207\,297\,296\,379\,7%* ✓ −72.860 693 350 539 75-72.860\,693\,350\,539\,75%* ✓ TABLE V: Subpopulation utility difference (difference between the test accuracy for the subpopulation before and after application of DP) and privacy risks for subpopulations after the application of DP (DP-SGD vs. N) across fairness mitigators for OQTA setup. Rows show datasets with fairness mitigators. Asterisks (*) mark low-utility subgroups (¡ 5%) whereas tick (✓) means that the privacy risk is minimized for the given subpopulation (privacy risk goes down to 50± 2%). Values are averaged over 20 runs, while the standard deviation is in the interval [0;0.06]. G0−G_0^- G1−G_1^- G0+G_0^+ G1+G_1^+ Dataset Mitigator Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Law (race) orig +0.00%* ✓ +0.00%* +0.00% ✓ +0.00% ✓ syn +0.00%* +0.00%* +0.00% ✓ +0.00% ✓ rew +0.00%* +0.00%* +0.00% ✓ +0.00% ✓ dir +0.00%* ✓ +0.00%* +0.00% ✓ +0.00% ✓ eg +0.00%* +0.00%* +0.00% ✓ +0.00% ✓ Law (gender) orig +0.00%* +0.00%* +0.00% ✓ +0.00% ✓ syn +0.00%* +0.00%* +0.00% ✓ +0.00% ✓ rew +0.00%* +0.00%* +0.00% ✓ +0.00% ✓ dir +0.00%* +0.00%* +0.00% ✓ +0.00% ✓ eg +0.00%* +0.00%* +0.00% ✓ +0.00% ✓ MEPS (race) orig +2.31% ✓ +9.51% ✓ -27.12%* ✓ -48.80%* ✓ syn +7.10% ✓ +10.77% ✓ -43.60%* -47.40%* ✓ rew +6.46% ✓ +10.18% ✓ -39.53%* ✓ -40.17%* ✓ dir +2.36% ✓ +9.38% ✓ -28.09%* ✓ -48.41%* ✓ eg +7.25% ✓ +11.41% ✓ -35.55%* ✓ -43.91%* ✓ TABLE VI: Subpopulation utility difference (difference between the test accuracy for the subpopulation before and after application of DP) and privacy risks for subpopulation after the application of DP (DPRF vs. RF) across fairness mitigators for OTA setup. Rows show datasets with fairness mitigators. Asterisks (*) mark low-utility subgroups (¡ 5%) whereas tick (✓) means that the privacy risk is minimized for the given subpopulation (privacy risk goes down to 50± 2%). Values are averaged over 20 runs, while the standard deviation is in the interval [0;0.06]. G0−G_0^- G1−G_1^- G0+G_0^+ G1+G_1^+ Dataset Mitigator Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Synthetic (G) orig -26.55% 2.16% ✓ 1.02% -10.43% ✓ syn -35.42% -1.61% ✓ 13.77% ✓ -15.41% ✓ dir -16.86% 1.13% ✓ 1.59% ✓ -9.45% ✓ rew -29.16% 3.44% ✓ 3.14% -11.72% ✓ eg -39.78%* -88.15%* ✓ 8.27% 8.80% ✓ Bank (age) orig 10.62% ✓ 2.49% ✓ -48.10% ✓ -39.00%* ✓ syn 6.99% ✓ 1.94% ✓ -39.86%* ✓ -33.95%* ✓ dir 12.02% 2.38% -50.37% -37.43%* rew 7.74% ✓ 2.61% ✓ -43.30% ✓ -40.20%* ✓ eg 8.05% ✓ 1.83% ✓ -44.52%* ✓ -41.64%* ✓ COMPAS (race) orig 8.19% ✓ 10.86% ✓ -27.48% ✓ -33.29% ✓ syn 8.19% ✓ 10.86% ✓ -27.48% ✓ -33.29% ✓ dir 7.73% ✓ 13.92% ✓ -28.70% ✓ -37.64% ✓ rew 6.14% ✓ 13.80% ✓ -25.25% ✓ -37.38% ✓ eg 23.69% ✓ 24.78% ✓ -57.67%* ✓ -54.28%* ✓ TABLE VII: Subpopulation utility difference and privacy risks for DPRF vs. RF at intermediate privacy budgets (ϵ∈3,5ε∈\3,5\) across fairness mitigators (OQTA attack). Asterisks (*) mark low-utility subgroups (<5%<5\%); tick (✓) indicates minimized privacy risk (50±2%50± 2\%). G0−G_0^- G1−G_1^- G0+G_0^+ G1+G_1^+ Dataset ϵε Mitigator Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy Utility Diff. Privacy COMPAS (Race) 3 orig +11.15% ✓ +9.73% -32.35% ✓ -29.05% syn +11.15% ✓ +9.73% -32.35% ✓ -29.05% rew +9.74% ✓ +12.01% -31.02% ✓ -32.66% dir +10.33% ✓ +14.02% -34.75% ✓ -35.15% ✓ eg +24.01% ✓ +24.31% -56.24%* ✓ -48.68%* 5 orig +8.81% ✓ +9.56% ✓ -30.81% ✓ -27.84% syn +8.81% ✓ +9.56% ✓ -30.81% ✓ -27.84% rew +7.40% ✓ +11.84% ✓ -29.47% ✓ -31.45% dir +10.26% ✓ +12.88% ✓ -34.47% ✓ -32.93% eg +20.78% ✓ +21.39% ✓ -52.47%* ✓ -45.16%* Synthetic (G) 3 orig -25.76%* +4.08% +3.52% -0.63% ✓ syn -41.75% -1.59% ✓ +28.86% ✓ +5.49% ✓ rew -29.69%* +10.05% +4.79% -4.93% ✓ dir -20.62%* +8.58% +1.87% ✓ -12.46% eg -30.06%* -55.25%* ✓ +12.70% +22.10% ✓ 5 orig -25.76%* +4.20% +3.52% -0.60% ✓ syn -41.75% -1.55% ✓ +28.86% ✓ +5.49% ✓ rew -29.69%* +10.17% +4.79% -4.90% ✓ dir -20.62%* +8.58% +1.87% ✓ -12.46% eg -30.06%* -55.25%* ✓ +12.70% +22.10% ✓ Appendix C Fairness Graphs Figure 18: Decision Tree fairness metric (balanced accuracy) results under LiRA attack for all datasets. Figure 19: Decision Tree fairness metric (disparate impact) results under LiRA attack for all datasets. Lower values indicate better fairness. Figure 20: Neural Network fairness metric (average odds difference) results under LiRA attack for all datasets. Lower values indicate better fairness. Figure 21: Neural Network fairness metric (statistical parity difference) results under LiRA attack for all datasets. Lower values indicate better fairness. Figure 22: Random Forest fairness metric (equal opportunity difference) results under LiRA attack for all datasets. Lower values indicate better fairness. Figure 23: Random Forest fairness metric (theil index) results under LiRA attack for all datasets. Lower values indicate better fairness. Figure 24: DPRF fairness metric (balanced accuracy) results under LiRA attack for all datasets. Figure 25: DPRF fairness metric (disparate impact) results under LiRA attack for all datasets. Lower values indicate better fairness. Appendix D CPP Graphs D.1 CPP Fairness Figures (OTA) Figure 26: Average Odds Difference (absolute). Lower is better. Bars compare the original model (Orig) vs. the post-processed model (CPP) across datasets. Figure 27: Statistical Parity Difference (absolute). Lower is better. Absolute gaps are shown for quick comparison; signed values (bias direction) are available on request or can be added to the appendix if needed. Figure 28: Equal Opportunity Difference (absolute). Lower is better. Figure 29: Disparate Impact (absolute, transformed). Lower is better (0 indicates parity under our definition). Figure 30: Balanced Accuracy (raw). Higher is better. Shows the utility impact of CPP at the aggregate level. Figure 31: Theil Index. Lower is better; measures inequality in predicted outcomes across groups. D.2 CPP Utility Figures (Subpopulation Test Accuracies) under OTA setup Figure 32: Subpopulation: Unprivileged Unfavorable. Test accuracies by dataset for Orig vs. CPP. Hatched bars mark datasets where this subpopulation is underrepresented. Figure 33: Subpopulation: Unprivileged Favorable. Test accuracies by dataset for Orig vs. CPP. Hatched bars mark datasets where this subpopulation is underrepresented. Figure 34: Subpopulation: Privileged Unfavorable. Test accuracies by dataset for Orig vs. CPP. Hatched bars mark datasets where this subpopulation is underrepresented. Figure 35: Subpopulation: Privileged Favorable. Test accuracies by dataset for Orig vs. CPP. Hatched bars mark datasets where this subpopulation is underrepresented. Appendix E OQTA Algorithm Details E.1 Algorithm The full pseudocode for OQTA is shown in Algorithm 36. Figure 36: Optimized Quantile Threshold Attack 1:Input: Target model A, target dataset targetD_target, population dataset populationD_population, quantiles Q (e.g., logspace(-5,0,100)) 2:Output: Privacy risk metrics for all subgroups 3:Split targetD_target into TARGET_MEMBER (train subset) and TARGET_NON_MEMBER (test subset). 4:Use populationD_population as REFERENCE_MEMBER. 5:Extract subgroup labels g[i]g[i] based on sensitive attributes and true labels. 6:Initialize metrics for each subgroup. 7:for all GgyG_g^y in subgroups do 8: Compute loss distribution from population data: 9: LDg,y(pop)←ℓ(A,z)∣z∈population,z∈GgyLD_g,y^(pop)←\\, (A,z) z _population,\,z∈ G_g^y\ 10: Compute loss distribution from target data: 11: LDg,y(target)←ℓ(A,z)∣z∈(TARGET_MEMBER∪TARGET_NON_MEMBER),z∈GgyLD_g,y^(target)←\\, (A,z) z∈( TARGET\_MEMBER∪ TARGET\_NON\_MEMBER),\,z∈ G_g^y\ 12: Initialize g,y←∅ τ_g,y← ⊳ List of candidate thresholds 13: for all α∈α do 14: τ←quantile_threshold(LDg,y(pop),α)τ← quantile\_threshold (LD_g,y^(pop),\,α ) 15: g,y←g,y∪τ τ_g,y← τ_g,y∪\τ\ 16: end for 17: Initialize best_accuracy←0best\_accuracy← 0; τ(g,y)←∅τ^(g,y)← 18: for all τ∈g,yτ∈ τ_g,y do 19: Compute accuracy on LDg,y(target)LD_g,y^(target) 20: if accuracy>best_accuracyaccuracy>best\_accuracy then 21: best_accuracy←accuracybest\_accuracy 22: τ(g,y)←τ^(g,y)←τ 23: end if 24: end for 25: ⊳ Threshold derived from population data, selected via target data’s best accuracy 26:end for 27:Perform membership inference: 28:for all z=(x,g,y)z=(x,g,y) in TARGET_MEMBER∪TARGET_NON_MEMBER TARGET\_MEMBER∪ TARGET\_NON\_MEMBER do 29: ℓz←ℓ(A,z) _z← (A,z) 30: (z)←1,if ℓz<τ(g,y),0,otherwiseA(z)← cases1,&if _z<τ^(g,y),\\ 0,&otherwise cases 31:end for 32:for all GgyG_g^y in subgroups do 33: Compute Accuracy and privacy risk (PR) for GgyG_g^y 34:end for 35:return Aggregated privacy metrics for all subgroups E.2 Subgroup Encodings Group indices g[i]g[i] are computed using: g[i]=ytrue[i]+(sfeatures[i]+1)⋅2g[i]=y_true[i]+(s_features[i]+1)· 2 where sfeatures[i]s_features[i] indicates whether the sample is from the privileged (1) or unprivileged (0) group, and ytrue[i]y_true[i] is the ground truth label. This results in four subgroups: • G0−G_0^-: Unprivileged, Unfavorable (g=2g=2) • G0+G_0^+: Unprivileged, Favorable (g=3g=3) • G1−G_1^-: Privileged, Unfavorable (g=4g=4) • G1+G_1^+: Privileged, Favorable (g=5g=5) E.3 Threshold Computation Details Thresholds are computed from the population loss distribution using log-spaced quantiles: Quantiles=logspace(−5,0,100)Quantiles=logspace(-5,0,100) where logspace(a=−5,b=0,n=100)logspace(a=-5,b=0,n=100) generates n values evenly spaced between 10a10^a and 10b10^b on a logarithmic scale. Linear interpolation is applied between cumulative distribution values to compute each candidate threshold τ. The final τ(g,y)τ^(g,y) is the threshold that achieves the highest balanced accuracy when applied to the target set. Appendix F Subpopulation Utility Under Fairness Mitigators TABLE VIII: LiRA (DT): subpopulation test accuracy under fairness mitigators. Dataset Subgroup Orig SYN DIR REW EGR Synthetic (G) G0−G_0^- 0.33 0.50 0.26 0.35 0.45 G0+G_0^+ 0.94 0.77 0.95 0.91 0.88 G1−G_1^- 0.88 0.89 0.89 0.85 0.83 G1+G_1^+ 0.87 0.86 0.87 0.88 0.87 Bank (Age) G0−G_0^- 0.85 0.90 0.82 0.89 0.88 G0+G_0^+ 0.50 0.33 0.51 0.34 0.41 G1−G_1^- 0.96 0.96 0.96 0.96 0.96 G1+G_1^+ 0.46 0.44 0.45 0.45 0.46 COMPAS (Race) G0−G_0^- 0.65 0.67 0.70 0.72 0.66 G0+G_0^+ 0.62 0.59 0.58 0.55 0.57 G1−G_1^- 0.76 0.76 0.77 0.72 0.73 G1+G_1^+ 0.44 0.44 0.42 0.49 0.46 MEPS (Race) G0−G_0^- 0.96 0.95 0.96 0.94 0.95 G0+G_0^+ 0.34 0.33 0.33 0.38 0.35 G1−G_1^- 0.91 0.91 0.90 0.91 0.91 G1+G_1^+ 0.40 0.40 0.42 0.40 0.38 TABLE IX: OQTA (DT): subpopulation test accuracy under fairness mitigators. Dataset Subgroup Orig SYN DIR REW EGR Synthetic (G) G0−G_0^- 0.20 0.52 0.06 0.54 0.42 G0+G_0^+ 0.93 0.66 0.99 0.80 0.79 G1−G_1^- 0.65 0.66 0.64 0.56 0.58 G1+G_1^+ 0.68 0.65 0.71 0.77 0.75 Bank (Age) G0−G_0^- 0.84 0.83 0.84 0.89 0.87 G0+G_0^+ 0.54 0.46 0.47 0.44 0.48 G1−G_1^- 0.95 0.96 0.95 0.95 0.95 G1+G_1^+ 0.47 0.44 0.47 0.50 0.48 COMPAS (Race) G0−G_0^- 0.65 0.65 0.67 0.65 0.66 G0+G_0^+ 0.58 0.58 0.55 0.58 0.56 G1−G_1^- 0.72 0.72 0.68 0.67 0.66 G1+G_1^+ 0.46 0.46 0.47 0.49 0.50 MEPS (Race) G0−G_0^- 0.94 0.95 0.94 0.93 0.93 G0+G_0^+ 0.34 0.31 0.32 0.35 0.35 G1−G_1^- 0.89 0.91 0.88 0.89 0.89 G1+G_1^+ 0.40 0.35 0.41 0.38 0.37 TABLE X: OTA (DT): subpopulation test accuracy under fairness mitigators. Dataset Subgroup Orig SYN DIR REW EGR CPP Synthetic (G) G0−G_0^- 0.34 0.47 0.32 0.36 0.54 0.05 G0+G_0^+ 0.93 0.74 0.93 0.90 0.84 0.95 G1−G_1^- 0.88 0.89 0.88 0.87 0.87 0.05 G1+G_1^+ 0.87 0.86 0.87 0.87 0.86 0.95 Bank (Age) G0−G_0^- 0.82 0.90 0.79 0.89 0.89 0.47 G0+G_0^+ 0.58 0.35 0.56 0.43 0.46 0.56 G1−G_1^- 0.95 0.96 0.93 0.95 0.96 0.96 G1+G_1^+ 0.51 0.51 0.53 0.57 0.51 0.52 COMPAS (Race) G0−G_0^- 0.69 0.69 0.67 0.71 0.70 0.98 G0+G_0^+ 0.60 0.60 0.60 0.57 0.60 0.35 G1−G_1^- 0.77 0.77 0.74 0.69 0.70 0.72 G1+G_1^+ 0.44 0.43 0.46 0.51 0.53 0.43 MEPS (Race) G0−G_0^- 0.95 0.95 0.95 0.94 0.94 0.94 G0+G_0^+ 0.35 0.33 0.35 0.38 0.37 0.43 G1−G_1^- 0.89 0.91 0.89 0.90 0.92 0.90 G1+G_1^+ 0.43 0.40 0.44 0.40 0.37 0.44