Paper deep dive
SOMtime the World Ain$'$t Fair: Violating Fairness Using Self-Organizing Maps
Joseph Bingham, Netanel Arussy, Dvir Aran
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 7/20/2026, 10:28:29 PM
Summary
The paper 'SOMtime the World Ain't Fair' demonstrates that unsupervised representation learning using Self-Organizing Maps (SOMs) can inadvertently encode sensitive attributes (like age and income) as dominant latent axes, even when these attributes are withheld from training. This phenomenon, termed 'structured sensitive-attribute leakage,' violates the assumption of 'fairness through unawareness.' The authors propose 'SOMtime,' an auditing tool that reveals this leakage via monotonic orderings in the embedding space, showing higher correlation with sensitive attributes than PCA, UMAP, t-SNE, or autoencoders. Theoretical analysis proves that such leakage imposes lower bounds on downstream fairness violations for Lipschitz functions.
Entities (11)
Relation Signals (8)
SOMtime → uses → Self-Organizing Maps
confidence 98% · Using SOMtime, a topology-preserving representation method based on high-capacity Self-Organizing Maps
SOMtime → demonstrates → Structured sensitive-attribute leakage
confidence 95% · Using SOMtime... we demonstrate that sensitive attributes such as age and income emerge as dominant latent axes... We characterize this phenomenon as structured sensitive-attribute leakage
Structured sensitive-attribute leakage → violates → Fairness through unawareness
confidence 93% · These findings establish that fairness through unawareness fails at the representation level
SOMtime → evaluatedon → Census Income
confidence 92% · On two large-scale real-world datasets (...and the Census-Income dataset)
SOMtime → evaluatedon → World Values Survey
confidence 92% · On two large-scale real-world datasets (the World Values Survey across five countries...)
SOMtime → outperforms → UMAP
confidence 90% · SOMtime recovers monotonic orderings... whereas PCA and UMAP typically remain below 0.23
SOMtime → outperforms → PCA
confidence 90% · SOMtime recovers monotonic orderings... achieving Spearman correlations of up to 0.85, whereas PCA... typically remain below 0.23
SOMtime → →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Unsupervised representations are widely assumed to be neutral with respect to sensitive attributes when those attributes are withheld from training. We show that this assumption is false. Using SOMtime, a topology-preserving representation method based on high-capacity Self-Organizing Maps, we demonstrate that sensitive attributes such as age and income emerge as dominant latent axes in purely unsupervised embeddings, even when explicitly excluded from the input. On two large-scale real-world datasets (the World Values Survey across five countries and the Census-Income dataset), SOMtime recovers monotonic orderings aligned with withheld sensitive attributes, achieving Spearman correlations of up to 0.85, whereas PCA and UMAP typically remain below 0.23 (with a single exception reaching 0.31), and against t-SNE and autoencoders which achieve at most 0.34. Furthermore, unsupervised segmentation of SOMtime embeddings produces demographically skewed clusters, demonstrating downstream fairness risks without any supervised task. These findings establish that \textit{fairness through unawareness} fails at the representation level for ordinal sensitive attributes and that fairness auditing must extend to unsupervised components of machine learning pipelines. We have made the code available at~ this https URL
Tags
Links
- Source: https://arxiv.org/abs/2602.18201v2
- Canonical: https://arxiv.org/abs/2602.18201v2
Trouble viewing inline? Open PDF directly →
Full Text
66,873 characters extracted from source content.
Expand or collapse full text
SOMtime the World Ain’t Fair: Violating Fairness with Self-Organizing Maps Joseph Bingham1,∗, Netanel Arussy2, Dvir Aran1,2 Abstract Unsupervised representations are widely assumed to be neutral with respect to sensitive attributes withheld from training. We show this assumption is false. Using SOMtime, a topology-preserving representation based on high-capacity Self-Organizing Maps, we demonstrate that sensitive attributes such as age and income emerge as dominant latent axes in unsupervised embeddings even when explicitly excluded from the input. On two real-world datasets (World Values Survey across five countries, Census-Income (KDD)), SOMtime recovers monotonic orderings aligned with withheld attributes, achieving Spearman correlations up to 0.85 along a single theoretically named axis, whereas PCA, UMAP, t-SNE, autoencoders, and Isomap—evaluated under both per-axis maximum and the more permissive rotation-invariant maximum across all linear directions of their embedding—remain at most 0.44. We characterize this phenomenon as structured sensitive-attribute leakage: information not merely present, but organized along an interpretable geometric axis. We prove that structured leakage at correlation level r induces a quantitative lower bound on the worst-case group-disparate output of any Lipschitz task acting on the embedding, formalizing the bridge from monotonic ordering to fairness violation. Because the leakage takes the form of a named axis rather than diffuse dependence across coordinates, SOMtime makes structured leakage auditable before downstream clustering, recommendation, or visualization tasks are run. Our findings establish that auditing for sensitive-attribute leakage must extend beyond probing classifiers and beyond supervised pipelines to the unsupervised representations that increasingly serve as foundational building blocks of modern ML systems. Introduction Modern machine learning pipelines increasingly rely on unsupervised representations as foundational building blocks. Clustering, dimensionality reduction, and learned embeddings are used for customer segmentation, data exploration, visualization, and as preprocessing steps for downstream prediction (Mehrabi et al. 2021). These representations are often assumed to be neutral, particularly when sensitive attributes such as age, gender, race, or income are deliberately withheld from the input features. This assumption, known as fairness through unawareness (Dwork et al. 2012), has been widely critiqued in the supervised setting: models can reconstruct sensitive attributes from proxy features and reproduce discriminatory patterns even when the protected variable is absent from training (Kleinberg et al. 2016; Rabonato and Berton 2024; Mehrabi et al. 2021). The fairness community has focused predominantly on supervised predictors, however, leaving open whether unsupervised representations themselves encode sensitive information, and how severely. This gap matters: when an unsupervised embedding organizes data along a sensitive axis, any downstream use (clustering, recommendation, visualization) inherits a fairness risk before any supervised task is defined. Collaborative filtering embeddings capture user demographics absent demographic features (Ekstrand and Kluver 2021), fair clustering documents demographically imbalanced partitions (Chierichetti et al. 2017; Ghadiri et al. 2021), and t-SNEs are dominated by sensitive structure (Peltonen et al. 2023). In this work, we make four contributions: Structured sensitive-attribute leakage. We define and demonstrate structured leakage: information not merely recoverable from an embedding but organized along an interpretable geometric axis. A topology-based auditing method. We propose SOMtime, based on high-capacity Self-Organizing Maps (Kohonen 1990), as an unsupervised auditing tool that exposes structured leakage as a single named axis. SOMtime reveals global sensitive structure—monotonic orderings and gradients—attenuated or invisible in PCA (Maćkiewicz and Ratajczak 1993), UMAP (McInnes et al. 2020), t-SNE (van der Maaten and Hinton 2008), autoencoders, and Isomap, under both per-axis and rotation-invariant correlation metrics. Isomap is included specifically to test whether the advantage is general to topology preservation or specific to SOMs; we find it is the latter. Theoretical bridge from ordering to disparity. We prove that structured leakage at Pearson correlation level r implies an exact group-mean separation of |r|σζ/p(1−p)|r| _ζ/ p(1-p) along the leaking direction, and a corresponding lower bound on worst-case group-disparate output for any Lipschitz downstream consumer. We further characterize the structural asymmetry between PCA (which suppresses low-variance distributed signal) and SOMs (which preserve Lipschitz-continuous signal regardless of variance). Implications for downstream fairness. We argue that auditing for sensitive-attribute leakage must operate at the representation level and include unsupervised components, motivating new auditing strategies that go beyond probing tests. Figure 1: The SOMtime pipeline. (a) High-dimensional tabular data with sensitive attributes withheld. (b) A Self-Organizing Map learns a topology-preserving discretization. (c) Activation patterns across the SOM. (d) Observations mapped to a 3D embedding (BMU coordinates + activation energy), colored by withheld sensitive attribute (age group). The SOM embedding arranges observations along a monotonic axis aligned with the withheld sensitive attribute, revealing structured information leakage invisible to standard methods. (e) Trajectory of ordered centroid progressions of protected values recovered. We study this empirically on two datasets: the World Values Survey (WVS) (Haerpfer et al. 2020; Adilazuarda et al. 2025; Li et al. 2024; Zhao et al. 2024) and Census-Income (KDD) (3). We withhold sensitive attributes entirely from representation learning and measure their emergence as latent structure. SOMtime achieves Spearman correlations up to 0.85 between its activation z-axis and withheld attributes, while baselines under both per-axis and rotation-invariant maxima reach at most 0.44. Background and Related Work Auditing Unsupervised Representations Fairness through unawareness—removing sensitive attributes from inputs to prevent discrimination—is well documented as insufficient (Dwork et al. 2012; Liu et al. 2026): proxy features enable reconstruction of withheld information and discriminatory patterns (Mehrabi et al. 2021). The vast majority of fairness criteria (demographic parity, equalized odds, calibration (Kleinberg et al. 2016)) are defined with respect to outcome labels and apply to supervised tasks (Rabonato and Berton 2024). Whether unsupervised representations are “fair”, and how to audit fairness in the absence of a label, remains underexplored. Fairness in Unsupervised Learning Fair clustering introduces balanced subsets (Chierichetti et al. 2017) or group-balance constraints (Kleindessner et al. 2019; Ahmadian et al. 2019; Ghadiri et al. 2021) to control demographic composition of clusters (Chhabra et al. 2021). Fair representation learning learns latents predictive of useful features but uninformative of protected attributes (Zemel et al. 2013), often via adversarial training (Yusuke Iwasawa 2018; Madras et al. 2018), MMD matching (Louizos et al. 2017), or concept erasure (Ravfogel et al. 2020); standard autoencoders are also widely used as general-purpose nonlinear baselines (Hinton and Salakhutdinov 2006). Fair dimensionality reduction includes the “price of fair PCA” (Samadi et al. 2018), fairness-aware nonlinear embeddings (Peltonen et al. 2023), and conditional t-SNE that factors out specified structure (Kang et al. 2021). Auditing for sensitive-attribute leakage commonly uses probing classifiers (Mehrabi et al. 2021), primarily applied to supervised embeddings; mutual information estimation (Moyer et al. 2018) provides a more general measure of dependence but is demanding and less interpretable for continuous ordinal attributes. Topology-Preserving Representations and the Auditing Gap Self-Organizing Maps (SOMs) (Kohonen 1990) learn topology-preserving discretizations of high-dimensional data onto a lattice of prototype vectors. While SOMs are widely used for clustering and visualization, they have seen little treatment in recent fairness literature, which has focused on deep learning and differentiable embeddings. Critically, prior work on auditing fairness in unsupervised learning focuses on local separability (whether groups are locally distinguished) or classification leakage (whether a probe can predict group membership). We identify a distinct underexamined form of leakage: global geometric ordering. When an unsupervised representation arranges observations along a monotonic axis aligned with s, this is qualitatively different from local separability and from latent extractability: standard low-dimensional embeddings (PCA, UMAP) attenuate this signal, while high-capacity SOMs amplify it, making it visible to inspection rather than only to a probe. Direction-Finding Audits. Concept activation vectors, linear probes, and mutual information estimators (e.g., MINE) search for directions or scalar statistics capturing attribute leakage. SOMtime differs in two respects: it requires no parametric probe (the leaking direction is identified by post-hoc correlation, not gradient fitting), and the geometric signature it produces is interpretable in a way that scalar MI estimates are not. We view these methods as complementary and direct comparison to MINE-style audits in continuous ordinal settings as a natural extension. Other Manifold Methods. A wider family preserves manifold structure, including Isomap, Laplacian eigenmaps, diffusion maps, neural gas, and growing SOMs. We include Isomap as a baseline to test whether SOMtime’s advantage stems from topology preservation generally or from SOMs specifically; comparison against the others is left to future work. Method: SOMtime as an Auditing Tool We position SOMtime not as a solution to fairness, but as a lens that makes sensitive structure in unsupervised representations explicit. Problem Setup We consider a dataset-agnostic unsupervised setting. Each observation is a fixed-length feature vector i∈ℝdx_i ^d, optionally associated with a sensitive attribute sis_i that is withheld from all representation learning. All representation learning steps are fully unsupervised with respect to s; sensitive attributes are used only for post-hoc auditing. Self-Organizing Map Representation We map the input data into a two-dimensional discrete latent space using a Self-Organizing Map (SOM). Let X∈ℝN×dX ^N× d denote the input matrix. The SOM consists of a square lattice of K×K× K units, where each unit j is associated with a prototype vector j∈ℝdw_j ^d. For each input observation ix_i, the best-matching unit (BMU) is defined as j∗=argminj‖i−j‖.j^*= _j\|x_i-w_j\|. Prototype vectors are updated according to j(t+1)=j(t)+α(t)h(j,j∗,t)(i−j(t)),w_j(t+1)=w_j(t)+α(t)\,h(j,j^*,t)\,(x_i-w_j(t)), where α(t)α(t) is a learning rate and h(⋅)h(·) is a Gaussian neighborhood function defined over the lattice topology. In contrast to conventional SOM usage for two-dimensional visualization, we employ a map with a large number of neurons (K=5⋅N0.54K=5· N^0.54), following a slight modification of the heuristic proposed by Vesanto and Alhoniemi (2000). We verify in the supplementary material that SOMtime’s recovery of the withheld sensitive attribute is stable across a 5×5× range of lattice-size scalings and that the chosen learning rate (0.750.75) sits at a clear local optimum. 3D Embedding and Axis Recovery To enable continuous analysis, we transform the discrete SOM grid into 3D: each observation inherits the (x,y)(x,y) coordinates of its BMU and a third coordinate zi=‖i−j∗‖z_i=\|x_i-w_j^*\|, the per-observation quantization error. The resulting embedding i∈ℝ3z_i ^3 preserves local neighborhood relations while enabling global geometric analysis. To assess whether the representation encodes a global ordering aligned with s, we analyze the geometry of SOM unit centroids. Cluster centers from the SOM distance map are computed in XY-space, then mapped to centroid activations on the distance map. We then construct a trajectory adjacency matrix on these centroids via a greedy nearest-neighbour procedure that enforces monotonic progression along the axis (in supplementary). A representation exhibits global geometric ordering with respect to s if there is a path along which s varies monotonically—distinct from local separability, which measures if observations with similar s are nearby. We quantify ordering strength via the Spearman correlation ρ between s and position along the recovered path. Auditing via Correlation Analysis We assess alignment between s and the learned representation via two complementary metrics, both reported in Table 2. The first is the per-axis maximum correlation between s and any single coordinate of the embedding (the metric used in the original conference version). The second is the rotation-invariant maximum: the multiple correlation R2 R^2 from cross-validated ridge regression of s on the full embedding, equivalent to the maximum Pearson correlation along any unit direction in the embedding space; the Spearman analogue rank-transforms both sides before regression. We use 5-fold cross-validation; a CV R2≤0R^2≤ 0 is reported as 0, indicating no linear projection generalizes better than the constant. The rotation-invariant metric addresses the concern that per-axis correlations underestimate leakage in rotation-equivariant embeddings (UMAP, t-SNE, AE) whose coordinate axes are arbitrary up to rotation. For SOMtime we report only the correlation along the activation z-axis, in both metric columns. This is strictly stricter than the rotation-invariant baseline metric: SOMtime is committed in advance to one named direction while baselines are evaluated over all linear combinations. The evaluation is purely diagnostic: s is never used during training, embedding construction, or ordering extraction. Theoretical Analysis Defining Structured Leakage Let E:→⊆ℝdzE:X ^d_z be an embedding and s:→s:X a sensitive attribute withheld from E. For a unit vector ^∈dz−1 v ^d_z-1, write ζ^():=⟨^,E()⟩ _ v(x):= v,E(x) . Definition 1 (Structured leakage). An embedding E exhibits structured leakage with respect to s at correlation level r∈[0,1]r∈[0,1] if there exists a unit direction v such that the absolute Pearson correlation |ρp(ζ^(X),s)|≥r| _p( _ v(X),s)|≥ r. The Spearman analogue |ρs(ζ^(X),s)|≥r| _s( _ v(X),s)|≥ r provides a rank-based version, which coincides with the Pearson version when ζ _ v and s are related by a monotonic transformation. Remark. Structured leakage is distinct from probe-recoverable leakage, the condition that some classifier h:→h:Z predicts s from E(X)E(X) with above-chance accuracy. An embedding may be probe-recoverable without being structurally leaking, because probe-recoverability admits arbitrarily complex (e.g., nonlinear or multi-axis) decoders, whereas structured leakage requires that s be encoded along a single linear direction. Our autoencoder ablation (supplemental material) is consistent with this distinction. An empirical signature of structured leakage at the cluster level is that the trajectory recovery procedure (supplementary), applied to BMU centroids of the embedding, produces a trajectory whose ordering matches the natural ordering of s (Table 3). Structured Leakage Implies Downstream Disparity Proposition 1 (Disparity bound under structured leakage). Let E exhibit structured leakage with respect to s at Pearson correlation level r along direction v, with ζ():=⟨^,E()⟩ζ(x):= v,E(x) . Suppose s takes binary values 0,1\0,1\ with ℙ(s=1)=p∈(0,1)P(s=1)=p∈(0,1). (a) The group-conditional means of ζ satisfy |[ζ(X)∣s=1]−[ζ(X)∣s=0]|=|r|σζp(1−p), |\,E[ζ(X) s=1]-E[ζ(X) s=0]\, |\;=\; |r|\, _ζ p(1-p), where σζ:=Var(ζ(X)) _ζ:= Var(ζ(X)). This is an exact equality. (b) The linear functional g∗():=⟨^,⟩g^*(z):= v,z is 11-Lipschitz and produces group-disparate output equal to |r|σζ/p(1−p)|r| _ζ/ p(1-p). (c) The worst-case group-mean disparity over L-Lipschitz functions g:→ℝg:Z is bounded below by the disparity achieved by the leaking-direction functional: supgL-Lip|[g(E(X))|s=1]−[g(E(X))|s=0]|≥L⋅|r|σζp(1−p), _g\ L-Lip\! |\,E[g(E(X))|s=1]-E[g(E(X))|s=0]\, |\;≥\; L·|r|\, _ζ p(1-p), attained by L⋅g∗L· g^*. Proof. Let μk:=[ζ(X)∣s=k] _k:=E[ζ(X) s=k]. Direct computation gives Cov(ζ,s)=p(1−p)(μ1−μ0)Cov(ζ,s)=p(1-p)( _1- _0) and Var(s)=p(1−p)Var(s)=p(1-p). Substituting into the Pearson definition yields |μ1−μ0|=|r|σζ/p(1−p)| _1- _0|=|r| _ζ/ p(1-p), giving (a). For (b), g∗(E())=ζ()g^*(E(x))=ζ(x) and Cauchy–Schwarz gives the 11-Lipschitz property. For (c), the function L⋅g∗L· g^* is L-Lipschitz, and applying (a) to it gives group-mean disparity equal to L⋅|r|σζ/p(1−p)L·|r| _ζ/ p(1-p); the supremum over all L-Lipschitz g is at least as large. ∎ Remark (Relationship to the Wasserstein bound). By Kantorovich–Rubinstein duality, the universal upper bound on L-Lipschitz group-mean disparity is L⋅W1(PE(X)|s=1,PE(X)|s=0)L· W_1(P_E(X)|s=1,P_E(X)|s=0); the quantity |r|σζ/p(1−p)|r| _ζ/ p(1-p) is a lower bound on this Wasserstein distance. Part (c) therefore establishes that worst-case Lipschitz-induced disparity is nonzero whenever structured leakage is present; tightening toward the Wasserstein quantity requires distributional information beyond Pearson correlation. Remark. The result extends to ordinal s with K values by applying (a) pairwise. The Spearman version follows by applying the same argument to rank-transformed variables. Corollary 1 (Demographic parity violation). Under the conditions of Proposition 1, let C:→c1,…,cMC:Z→\c_1,…,c_M\ be any partition obtained by thresholding ζ. Then for at least one cluster cmc_m, |ℙ(C=cm∣s=1)−ℙ(C=cm∣s=0)|>0|P(C=c_m s=1)-P(C=c_m s=0)|>0 whenever |r|>0|r|>0. The magnitude of the worst-case cluster-level disparity is bounded below by a strictly increasing function of |r||r|. Proposition 1 provides the bridge from monotonic ordering to fairness violation that grounds the rest of the paper. The empirical Pearson correlations reported in Table 2 (up to 0.800.80 for WVS Canada) translate via part (a) into a guaranteed group-mean separation of approximately 1.6σζ1.6 _ζ for balanced binary subgroups, and via part (c) into a guaranteed lower bound on the worst-case Lipschitz-induced downstream disparity. The result also formalizes the generalization of the critique of fairness through unawareness (Mehrabi et al. 2021) from supervised to unsupervised settings. Mechanism: Variance Bias of PCA, Locality Preservation of SOMs Lemma 1 (PCA variance bias). Let ∈ℝdX ^d be centered with covariance Σ=Λ⊤ =V , λ1≥⋯≥λd≥0 _1≥·s≥ _d≥ 0. Suppose s=⊤+εs= β X+ with ε⟂ . Let γi:=⟨i,⟩ _i:= _i, β . Then |ρi|=|γi|λi/σs| _i|=| _i| _i/ _s, and PCA truncation to the top K components captures squared correlation ∑i≤Kγi2λi/σs2 _i≤ K _i^2 _i/ _s^2, suppressing signal in components i>Ki>K. Proof. Cov(s,⟨i,⟩)=⊤Σi=γiλiCov(s, _i,X )= β _i= _i _i, and Var(⟨i,⟩)=λiVar( _i,X )= _i. Direct substitution gives this form. ∎ The crucial consequence is that the eigenvalue ordering has, in general, no relationship to the coefficients |γi|| _i| that determine where the s-signal lives. In real tabular data where s correlates weakly with many features (Table 1), the coefficients γi _i are distributed across many eigenvectors. Truncating to the top K principal components discards exactly the signal we wish to audit for. UMAP and t-SNE impose related low-dimensional bottlenecks, so the same suppression argument applies. Definition 2 (Topology-preserving SOM). A trained K×K× K SOM with prototypes i\w_i\ is ϵε-topology-preserving on data X if for any two lattice-adjacent units i,ji,j: ‖i−j‖≤ϵ\|w_i-w_j\|≤ε. Proposition 2 (Preservation of Lipschitz sensitive attributes). Suppose X lies on a manifold ℳM, and s:ℳ→ℝs:M is LsL_s-Lipschitz under the Euclidean metric. If a trained SOM is ϵε-topology-preserving (Definition 2) and its prototypes lie on or near ℳM, then for any lattice-adjacent prototypes: |s(i)−s(j)|≤Lsϵ.|s(w_i)-s(w_j)|\;≤\;L_s\,ε. Proof. |s(i)−s(j)|≤Ls‖i−j‖≤Lsϵ|s(w_i)-s(w_j)|≤ L_s\|w_i-w_j\|≤ L_sε. ∎ Remark (Status of topology preservation). Proposition 2 is conditional on the SOM achieving topology preservation at lattice resolution ϵε. For 1D SOMs, convergence to a topology-preserving configuration is proven under standard conditions (Kohonen 1990). For 2D SOMs, a fully general convergence proof remains open, but topology preservation is empirically robust under standard Kohonen training when the lattice resolution exceeds the intrinsic dimension of the data manifold (Vesanto and Alhoniemi 2000). The scaling K=5⋅N0.54K=5· N^0.54 used here follows this empirical guidance and yields lattices on which topology preservation is verifiable post-hoc via the per-unit quantization error. Remark (Local preservation vs. global emergence). Proposition 2 establishes that lattice-adjacent prototypes have s-values differing by at most LsϵL_sε, which is a local preservation guarantee on the SOM’s discrete grid. It does not by itself prove that a single global monotone axis on the lattice must emerge with respect to s. The emergence of such a global axis depends additionally on the topology of s along the underlying manifold: when s is well-described by a single monotonic function of a one-dimensional intrinsic coordinate (as is the case for age along the ethical-development gradient that organizes survey responses), local preservation chains into global ordering through the lattice. When s depends on multiple independent intrinsic coordinates, local preservation may yield a global gradient field rather than a single ordered axis. A complete geometric characterization of when local preservation implies global monotone ordering is beyond the scope of this paper; our empirical results (Section V) demonstrate that the single-axis case captures the WVS and Census attributes we study. Remark (Local preservation vs. global emergence). Proposition 2 gives a local preservation guarantee on lattice-adjacent prototypes; it does not by itself prove that a single global monotone axis must emerge. Emergence depends on the topology of s along the manifold: when s is described by a single monotonic function of a one-dimensional intrinsic coordinate (as with age along the ethical-development gradient that organizes survey responses), local preservation chains into global ordering. When s depends on multiple intrinsic coordinates, a gradient field may emerge instead. Our empirical results demonstrate that the single-axis case captures the WVS and Census attributes we study. The contrast between Lemma 1 and Proposition 2 is the structural asymmetry the paper exploits. PCA’s recovery of s depends on alignment between the eigenvalue ordering of Σ and the coefficients β, and is suppressed when s is carried by low-variance directions. The SOM’s preservation of s depends only on the Lipschitz continuity of s along the manifold, a property of s rather than of the data covariance. Experimental Protocol Implementation Details All experiments are implemented in Python using standard scientific computing libraries. SOM hyperparameters are fixed across all experiments and not tuned using sensitive attribute labels: σ=0.7σ=0.7, learning rate =0.75=0.75, with lattice dimension K=5⋅N0.54K=5· N^0.54. A question is retained only if it has no missing values. Since SOM, t-SNE, and UMAP all involve stochastic initialization, reported results are averaged over five independent runs; standard deviations were below 0.03 for all Spearman correlations. SOM hyperparameters are fixed across all experiments and not tuned using sensitive labels: σ=0.7σ=0.7, learning rate =0.75=0.75, K=5⋅N0.54K=5· N^0.54. Questions with any missing values are dropped. SOM, t-SNE, and UMAP results are averaged over five runs; σ below 0.030.03 for all Spearman correlations. Datasets World Values Survey (WVS). The WVS (Haerpfer et al. 2020) is a globally representative dataset capturing political, cultural, and moral values, recently used in top-tier ML venues (Adilazuarda et al. 2025; Li et al. 2024; Zhao et al. 2024). We use data from five countries: Canada (N=4,018N\!=\!4,018), Romania (N=3,200N\!=\!3,200), Germany (N=1,528N\!=\!1,528), China (N=3,036N\!=\!3,036), and USA (N=2,609N\!=\!2,609), with age as the withheld sensitive attribute. We use a subset of 22 questions on ethics and morals. Table 1 reports mean correlations. Table 1: Correlation of questions from WVS and Census (KDD) with the sensitive attribute of age. Max and mean correlations across used questions are given, alongside the number of responses. Dataset Domain Max Mean Responses WVS Canada -0.35 -0.09 4,018 Romania -0.15 0.03 3,200 Germany -0.34 -0.07 1,528 China -0.25 -0.05 3,036 USA -0.26 -0.07 2,609 Census (KDD) Age 0.27 -0.05 27,024 Income 0.12 -0.04 Capital Gains 0.10 0.07 Census-Income (KDD). The Census-Income dataset (3) is a standard UCI benchmark containing 299,285 records with 40 demographic and economic features from the 1994 and 1995 Current Population Surveys. We treat age, income, and capital gains as withheld sensitive attributes. We applied three preprocessing steps before representation learning. First, we removed columns without a clean numerical or ordinal encoding, since baselines do not handle arbitrary categoricals uniformly. Second, for each withheld attribute s, we removed columns whose absolute Pearson correlation with s exceeded 0.30.3 on the encoded data—a threshold chosen above the maximum surviving correlation in WVS (|ρ|≤0.35|ρ|≤ 0.35; Table 1) so the two datasets place comparable demands on embedding methods. After filtering, 25 of the original 40 columns remained, the strongest surviving correlation against age being |ρ|=0.27|ρ|=0.27. Third, we dropped records with missing values; WVS missingness has consistent semantics representable as −1-1, but Census missingness is ambiguous. The resulting 27,024 observations yield statistically significant p-values for all reported correlations. The proxy-removal step warrants explanation because it can be misread as curating the data in our favour. The opposite is the case. Columns most strongly correlated with s are exactly the columns through which any unsupervised method, PCA included, would recover s trivially; removing them makes the recovery problem harder, and harder uniformly across methods. What remains is a regime in which no single feature is a useful indicator of the sensitive attribute—the strongest surviving correlation against age is 0.270.27, and the mean across features is near zero. A method that recovers s from this data does so by aggregating distributed, individually weak signals into coherent geometric structure—precisely the threat model that separates structured leakage from probe-recoverable leakage. It is also the realistic threat model in practice: embeddings that get audited at all will typically have had their strongest proxies removed by responsible data hygiene before any auditing tool sees them. The sensitive attribute is used only at this preprocessing stage and at post-hoc validation, never during representation learning, hyperparameter selection, or trajectory recovery. WVS required no analogous filtering: no single WVS feature exceeds |ρ|=0.35|ρ|=0.35 with age (Table 1), so the low-proxy regime that the Census preprocessing produces is WVS’s default. Proxy removal makes the recovery problem harder, uniformly across methods: it eliminates columns through which any unsupervised method would recover s trivially. What remains is a regime in which no single feature is a useful indicator (strongest surviving correlation against age: 0.270.27). A method that recovers s from this data must aggregate distributed weak signals into coherent geometric structure—precisely the threat model that separates structured leakage from probe-recoverable leakage, and the realistic threat model in practice, since audited embeddings will typically have had their strongest proxies removed by responsible data hygiene. The sensitive attribute is used only at this preprocessing stage and at post-hoc validation, never during representation learning or trajectory recovery. WVS required no analogous filtering; no features exceeds |ρ|=0.35|ρ|=0.35 with age. Table 2: Sensitive attribute leakage. Per-axis columns: max absolute correlation between any single embedding coordinate and the withheld s, best across dimensionalities d∈2,…,50d∈\2,…,50\. Rotation-invariant columns (-I): multiple correlation R2 R^2 from cross-validated ridge regression of s on the full embedding (max correlation along any unit direction). SOMtime uses only its z-axis—a stricter protocol than all baselines. Zero -I entries indicate cross-validated R2≤0R^2≤ 0. ISO country codes. All non-zero per-axis correlations have p<10−3p<10^-3 except UMAP on Census Gains (ρ=0.002ρ=0.002, p=0.89p=0.89). σ across 5 runs <0.03<0.03. Dataset Domain PCA PCA-I UMAP UMAP-I t-SNE t-SNE-I AE AE-I Isomap Isomap-I SOMtime P. S. P. S. P. S. P. S. P. S. P. S. P. S. P. S. P. S. P. S. P. S. WVS CA 0.25 0.22 0.41 0.44 0.31 0.31 0.43 0.42 0.22 0.21 0.28 0.27 0.33 0.34 0.41 0.42 0.24 0.25 0.42 0.43 0.75 0.85 RO 0.06 0.04 0.19 0.17 0.06 0.05 0.00 0.00 0.06 0.05 0.00 0.00 0.16 0.15 0.06 0.00 0.06 0.08 0.00 0.00 0.66 0.59 DE 0.16 0.18 0.40 0.42 0.17 0.19 0.31 0.30 0.19 0.35 0.17 0.19 0.29 0.29 0.38 0.37 0.19 0.21 0.37 0.37 0.79 0.73 CN 0.22 0.22 0.30 0.30 0.21 0.20 0.24 0.22 0.24 0.23 0.21 0.20 0.19 0.25 0.26 0.24 0.23 0.22 0.25 0.25 0.80 0.58 US 0.20 0.23 0.24 0.29 0.33 0.34 0.18 0.23 0.25 0.24 0.00 0.00 0.27 0.29 0.13 0.22 0.26 0.26 0.19 0.23 0.80 0.52 Census (KDD) Age 0.17 0.11 0.28 0.36 0.08 0.09 0.00 0.00 0.08 0.10 0.00 0.04 0.20 0.22 0.03 0.09 0.08 0.10 0.00 0.07 0.50 0.83 Income 0.31 0.21 0.32 0.28 0.07 0.07 0.00 0.00 0.08 0.08 0.00 0.00 0.22 0.25 0.21 0.00 0.08 0.08 0.06 0.05 0.48 0.69 Gains 0.23 0.11 0.00 0.08 0.01 0.00 0.00 0.00 0.02 0.04 0.00 0.00 0.35 0.40 0.00 0.00 0.04 0.06 0.00 0.00 0.34 0.43 Baselines We compare against five widely used unsupervised dimensionality reduction techniques. PCA: linear embedding via principal component analysis. UMAP: nonlinear embedding with default parameters. t-SNE: nonlinear embedding optimized for local neighborhood structure. Isomap: topology-preserving manifold learner that embeds data via classical MDS on geodesic distances over a k-N graph; included specifically to test whether SOMtime’s auditing advantage stems from topology preservation in general or from the SOM’s competitive-learning dynamics in particular. Autoencoder (AE): nonlinear encoder–decoder networks at three scales (small ≈7K≈\!7K, medium ≈95K≈\!95K, large ≈1.4M≈\!1.4M parameters), bottleneck dimensionalities ∈3,10,22∈\3,10,22\; the large configuration is capacity-matched to the SOM. For PCA, UMAP, t-SNE, and Isomap we report the best correlation across the full dimensionality sweep d∈2,3,…,50d∈\2,3,…,50\, which lets each baseline “choose” the dimensionality (including standard 2D/3D visualization) most likely to expose s. Max-over-d values cluster within roughly 2% across the range for all methods, so the choice of d does not materially affect results. We also performed full hyperparameter ablations within each method and selected best values per dataset. A probing classifier requires labeled sensitive attributes and is therefore a supervised auditing tool. SOMtime, by contrast, reveals sensitive structure as an emergent geometric property of the representation. For the leakage evaluation (Experiment 1, Table 2) we apply both protocols described above: per-axis max (columns PCA, UMAP, t-SNE, AE, Isomap) reports the original conference comparison; rotation-invariant (-I columns) reports the maximum correlation across any linear direction, removing axis-orientation bias against rotation-equivariant baselines. For both, SOMtime is evaluated along its single named z-axis. For Experiment 2 (global ordering) we extract a single 1D summary axis—the strongest principal component for baselines, the graph-diameter path along the SOM lattice for SOMtime—and report its Spearman correlation with s. Experiments Experiment 1: Sensitive Attribute Recoverability. For each method, we compute the embedding with s withheld, then measure the max correlation between s and a linear projection of the embedding under both protocols (Table 2). Experiment 2: Global Ordering Emergence. We extract the dominant 1D latent axis from each representation and compute its Spearman correlation with the sensitive attribute. Experiment 3: Recovering Sensitive Topology from 3D Embedding. We construct full trajectory-based ordering of the sensitive attribute of age in the 3D embedding, beyond the known age groupings. Results Sensitive Attribute Leakage Table 2 reports per-axis correlations between each embedding and the withheld sensitive attribute, the metric used in the original conference version. SOMtime’s correlation along its activation z-axis exceeds the per-axis maximum of any baseline on every (dataset, attribute) pair. On WVS, SOMtime attains Spearman correlations of 0.52–0.85 with age across five countries, while PCA, UMAP, t-SNE, and AE reach at most 0.34. On Census, SOMtime achieves Spearman correlations of 0.83 (age), 0.69 (income), and 0.43 (gains), against baseline maxima of 0.22, 0.25, and 0.40 respectively. Rotation invariance does not close the gap. Under the rotation-invariant metric (Table 2, -I columns), every baseline number stays the same or increases, since the metric is strictly more permissive than per-axis maximum. SOMtime’s lead is preserved on every dataset. The strongest baseline (PCA on most tasks) reaches at most 0.44 (WVS Canada Spearman), still well below SOMtime’s 0.85, and the factor-of-difference between SOMtime and the strongest baseline ranges from 1.7×1.7× to 5.4×5.4× across all eight (dataset, attribute) pairs. PCA benefits most, consistent with Lemma 1: PCA’s coordinates are linear projections of the input, so any input-linear signal in s is preserved, just distributed across components. UMAP, t-SNE, and AE benefit less or not at all—their nonlinear bottlenecks destroy the linear-projection signal the metric is designed to detect. Several baseline cells read 0.000.00, corresponding to cross-validated R2≤0R^2≤ 0: WVS Romania, Census Age, Census Income, and Census Capital Gains all contain baselines that fail this generalization test entirely, while SOMtime’s z-axis Spearman on the same data is 0.59, 0.83, 0.69, and 0.43 respectively. The gap is largest where the signal is weakest. The ratio of SOMtime’s Spearman to the strongest baseline’s rotation-invariant Spearman grows as the per-feature signal weakens. WVS Canada has the strongest per-feature correlations (|ρ||ρ| up to 0.35 in Table 1) and shows SOMtime’s smallest relative gap (1.9×1.9×, 0.85 vs. 0.44). Gains has the weakest per-feature correlations (|ρ||ρ| up to 0.10) and the largest relative gap (5.4×5.4×, 0.43 vs. 0.08). This pattern is consistent with the mechanism formalized by Lemma 1 and Proposition 2: when s is carried by a strong, near-linear signal, even projection-based methods can recover it; when s is distributed across many features with weak per-feature correlation, the SOM’s locality-based preservation is the only mechanism that consistently aggregates the distributed signal into a recoverable axis. By Proposition 1(c), the correlations in Table 2 translate directly into a lower bound of L⋅|r|σζ/p(1−p)L·|r| _ζ/ p(1-p) on the worst-case group-disparate output of any L-Lipschitz downstream consumer of the embedding. The gap is largest where the signal is weakest. SOMtime’s advantage over the strongest baseline grows as per-feature signal weakens: WVS Canada (max |ρ|=0.35|ρ|=0.35) has the smallest relative gap (1.9×1.9×); Census Gains (max |ρ|=0.10|ρ|=0.10) has the largest (5.4×5.4×). This is exactly the mechanism of Lemma 1 and Proposition 2: strong linear signals are recoverable by projection-based methods; distributed weak signals require the SOM’s locality-based aggregation. By Proposition 1(c), the correlations in Table 2 translate into a lower bound of L⋅|r|σζ/p(1−p)L·|r| _ζ/ p(1-p) on the worst-case group-disparate output of any L-Lipschitz downstream consumer. A natural concern is whether SOMtime’s advantage reflects the SOM’s higher parameter count rather than its topological inductive bias. We evaluated autoencoders at three capacity scales (supplemental material). The large autoencoder (1.4M1.4M parameters) with a 22-dimensional bottleneck achieves near-perfect reconstruction (MSE=0.001MSE=0.001) yet attains a maximum per-axis Spearman correlation of only 0.340.34 (Table 2) and a rotation-invariant Spearman of 0.420.42 (Table 2) on WVS Canada—both well below SOMtime’s 0.850.85. Critically, increasing autoencoder capacity does not improve sensitive-attribute recovery proportionally: capacity buys reconstruction fidelity but not the geometric organization that makes s recoverable along a low-dimensional axis. This indicates that the phenomenon we observe is specific to the SOM’s competitive learning dynamics and fixed lattice, which concentrate distributed sensitive signals into geometric structure—exactly as Proposition 2 predicts. We evaluated autoencoders at three scales (supplement). The large AE (1.4M1.4M parameters, 22-dim bottleneck) achieves near-perfect reconstruction (MSE=0.001MSE=0.001) yet reaches only 0.340.34 per-axis and 0.420.42 rotation-invariant Spearman on WVS Canada—well below SOMtime’s 0.850.85. Capacity buys reconstruction fidelity but not the geometric organization that makes s recoverable along a low-dimensional axis, isolating the phenomenon to the SOM’s competitive learning dynamics as Proposition 2 predicts. Topology preservation alone does not explain SOMtime’s advantage. A second concern is whether any topology-preserving manifold learner would reproduce SOMtime’s signature, generalizing the contribution beyond SOMs. Isomap addresses this: it is competitive with PCA, UMAP, and AE on WVS, reaching rotation-invariant Spearman 0.430.43 on CA and 0.370.37 on DE, but does not approach SOMtime on any dataset. On RO, Age, and Gains, Isomap’s rotation-invariant Spearman is essentially zero, while SOMtime’s z-axis Spearman is 0.590.59, 0.830.83, and 0.430.43. Topology preservation in the geodesic-MDS sense is therefore insufficient; what produces structured leakage is the combination of competitive prototype learning, fixed lattice topology, and the named activation-energy axis that aggregates distributed weak signals into an interpretable direction. Isomap, like PCA, depends on capturing variance structure (along geodesics rather than principal directions) and is therefore vulnerable to the same suppression of low-variance distributed signal that Lemma 1 formalizes; the SOM’s competitive learning does not weight directions by variance. Topology preservation alone does not explain SOMtime’s advantage. Isomap tests whether any topology-preserving learner would reproduce SOMtime’s signature. It reaches rotation-invariant Spearman 0.430.43 on CA and 0.370.37 on DE (competitive with PCA/UMAP/AE), but is essentially zero on RO, Age, and Gains where SOMtime’s z-axis Spearman is 0.590.59, 0.830.83, and 0.430.43. Topology preservation in the geodesic-MDS sense is insufficient. Isomap, like PCA, captures variance structure (along geodesics rather than principal directions) and is thus vulnerable to the low-variance-distributed-signal suppression Lemma 1 formalizes. The SOM’s competitive learning does not weight directions by variance. We did not extend the trajectory recovery procedure to baseline embeddings. The rotation-invariant correlations in Table 2 establish that baselines lack a linearly recoverable monotone direction at the level SOMtime exposes; a rotation-invariant trajectory analysis remains an appropriate extension for capturing potential nonlinear orderings the multiple-correlation metric would miss. Figure 2: Sensitive attribute emergence in SOMtime. Age groups form a monotonic ordering along the learned surface. Colors: purple, blue, green, yellow, orange. Cyan: NA. Global Ordering Emergence Figure 2 visualizes the SOM embedding for WVS Canada. Age groups form a clear monotonic ordering along the SOM’s latent surface; cyan markers (non-respondents) are randomly distributed near the center, consistent with absence of age-related signal. On WVS Canada, SOMtime’s graph-diameter path achieves ρ=0.85ρ=0.85 with age; PC1 of each baseline embedding attains substantially weaker correlation across all five WVS countries and Census. The SOM’s topology-preserving competitive learning with high lattice resolution amplifies the distributed signal of age across correlated survey responses into coherent geometric structure. WVS SOMs were trained country-by-country; a single SOM recovers age, income, and gains on Census. Low pairwise correlations between Census attributes (age-income −0.11-0.11, income-gains 0.070.07, age-gains 0.150.15) show independent recovery of multiple sensitive attributes; Capital Gains shows the algorithm does not recover them equally. Recovering Sensitive Topology from 3D Embedding Table 3 reports accuracy in recovering sensitive attribute groups from non-sensitive data. Accuracy here refers to whether a true edge A→BA→ B (e.g., age group 25−3525-35 followed by 35−4535-45) is detected by the trajectory recovery procedure (supplementary). SOMtime achieves 100% recovery of age for multiple WVS countries, 0.82 for Census age, and 0.76 for Census income—far above the chance rate of 1/5!≈0.0081/5!≈ 0.008 for 5 ordered groups. This empirical recovery realises Corollary 1: clustering an embedding with structured leakage produces axis-aligned group-disparate partitions. Table 3: Accuracy of recovered topology ordering per domain. WVS: we omit centroids denoting non-respondents. Dataset Domain Recovery Accuracy WVS Canada 1.00 Romania 1.00 Germany 1.00 China 0.60 USA 0.80 Census (KDD) Age 0.82 Income 0.76 Capital Gains 0.22 Discussion We frame SOMtime as an auditing tool that makes structured leakage visible, not as a fairness solution. Probing classifiers and SOMtime are complementary: probes assess worst-case extractability with label access; SOMtime assesses whether s is a dominant organizing principle without label access. Structured Leakage and Fairness Violation Are Equivalent in Unsupervised Pipelines Our finding is the unsupervised analogue of the classical critique of fairness through unawareness (Dwork et al. 2012; Kleinberg et al. 2016; Mehrabi et al. 2021): a topology-preserving representation encodes s as a dominant organizing axis, and any downstream consumer inherits s-dependence. The privacy–fairness distinction (Liu et al. 2026; Rabonato and Berton 2024) sharpens the claim: structured leakage is not recoverability, it is organization. Distance-, density-, and partition-based operations interact with that organization mechanically, producing s-dependent outcomes whether or not a probe is ever trained. The implication for practitioners: auditing for structured leakage is auditing for fairness, in the same way that monitoring proxy-feature correlations is fairness auditing in the supervised setting. Probing classifiers remain useful for adversarial worst-case extractability, but do not detect the ambient s-dependence that all downstream consumers of a leaking embedding will produce by default. SOMtime fills this gap. Limitations and Ethical Considerations We do not propose a fairness mitigation. Three directions follow naturally: routine auditing combining probing-classifier tests (Yusuke Iwasawa 2018; Madras et al. 2018) with global ordering checks; fairness-aware SOM regularization (Chierichetti et al. 2017); and topology-aware lattice constraints balancing neuron occupancy across groups (Samadi et al. 2018; Peltonen et al. 2023). We focus on ordinal attributes (age, income); categorical attributes (race, gender) would require different metrics. Datasets are tabular; extension to image, text, or graph embeddings, and scalability beyond N≈27,000N≈ 27,000, remain future work. SOMtime is designed as an auditing tool, but the same machinery can recover demographic structure from data with sensitive attributes deliberately withheld—the inverse use. This strengthens the case that fairness through unawareness is a weak defense and that responsible deployment requires explicit auditing. Organizations should constrain SOMtime to audit-only workflows producing summary leakage measures for governance, with standard data-protection controls (access logging, role-based authorization, retention limits). The methods are unlikely to expand profiling capability beyond what trained probes achieve on the same embeddings, but the geometric visibility makes the risk salient enough to justify explicit governance. Conclusion Unsupervised learning is not neutral. Purely unsupervised representations can encode withheld sensitive attributes as emergent geometric structure; topology-preserving methods like Self-Organizing Maps are particularly effective at organizing this structure along a single interpretable axis; and structured leakage at correlation level r implies a quantitative lower bound on the worst-case group-disparate output of any Lipschitz consumer. On two real-world datasets, SOMtime exposed monotonic orderings aligned with age and income along a single named direction, while PCA, UMAP, t-SNE, AE, and Isomap—evaluated under the rotation-invariant maximum—attained at most half the Spearman SOMtime did along its theoretically named axis. The Isomap result is significant: a topology-preserving manifold learner is not sufficient to reproduce SOMtime’s signature, isolating the SOM’s competitive-learning prototype updates and named activation-energy axis as the operative mechanism. These findings carry a clear implication: auditing for sensitive-attribute leakage must extend beyond probing classifiers and beyond supervised predictors to the unsupervised representations that increasingly serve as the foundation of modern ML pipelines. GenAI Disclosure LLMs were used to assist with editing and grammar of text. All ideas, concepts, results, and writing/running of code were done by humans alone. Trajectory Recovery Procedure This procedure is referenced from the Method section of the main paper. Given centroids of the SOM units in 3D embedding coordinates (BMU (x,y)(x,y) position plus activation z), Algorithm 1 greedily constructs a directed adjacency matrix encoding monotone progression along the activation axis. Each unit is connected to its nearest neighbour with strictly higher activation, with normalization in the (x,y)(x,y) dimensions and scaling of the activation dimension by the lattice size K so that adjacency reflects local proximity on the lattice while activation differences dominate at the global scale. Algorithm 1 Trajectory Adjacency Matrix Construction 0: ∈ℝn×3C ^n× 3: Centroids (x, y, z = activation) 0: K∈ℝK : Dimension of SOM 0: ∈0,1n×nA∈\0,1\^n× n: Adjacency matrix 1: ←n×nA 0_n× n 2: for i=1i=1 to n do 3: if ∑kAk,i>0 _kA_k,i>0 or ∑kAi,k>0 _kA_i,k>0 then 4: continue 5: end if 6: dmin←∞;j∗←−1d_ ←∞;\ j^*←-1 7: for j=1j=1 to n do 8: if i=ji=j then 9: continue 10: end if 11: ~i←(Ci,1∑kCk,1,Ci,2∑kCk,2,K⋅Ci,3) c_i← ( C_i,1 _kC_k,1, C_i,2 _kC_k,2,K· C_i,3 ) 12: ~j←(Cj,1∑kCk,1,Cj,2∑kCk,2,K⋅Cj,3) c_j← ( C_j,1 _kC_k,1, C_j,2 _kC_k,2,K· C_j,3 ) 13: d←‖~i−~j‖2d←\| c_i- c_j\|_2 14: if d<dmind<d_ and Ci,3<Cj,3C_i,3<C_j,3 then 15: j∗←j;dmin←dj^*← j;\ d_ ← d 16: end if 17: end for 18: if j∗≠−1j^*≠-1 then 19: Ai,j∗←1A_i,j^*← 1 20: end if 21: end for 22: return A Ablation Study of AE Size This appendix presents the autoencoder capacity ablation referenced in Section V (Results) of the main paper. The large autoencoder with 1.4M parameters and 22-dimensional bottleneck achieves near-perfect reconstruction (MSE =0.001=0.001) but does not approach SOMtime’s per-axis Spearman correlation, demonstrating that capacity alone is not sufficient to reproduce SOMtime’s auditing signature. Table 4: Autoencoder capacity ablation across all datasets (age as withheld sensitive attribute for WVS; age and income for Census). Maximum per-axis |ρ||ρ| Spearman correlation. Reconstruction MSE on standardized features shown in parentheses. WVS (Age) Census (KDD) Model Params Bneck Canada Romania Germany China USA Age Income Small autoencoders (∼ 7–9K params) AE-small 7K 3d 0.29 (0.446) 0.09 (0.419) 0.28 (0.434) 0.25 (0.372) 0.25 (0.469) 0.20 (0.168) 0.17 (0.168) AE-small 8K 10d 0.19 (0.152) 0.08 (0.164) 0.24 (0.148) 0.23 (0.116) 0.24 (0.163) 0.17 (0.009) 0.13 (0.009) AE-small 9K 22d 0.28 (0.031) 0.13 (0.022) 0.22 (0.063) 0.25 (0.023) 0.20 (0.054) 0.20 (0.001) 0.18 (0.001) Medium autoencoders (∼ 91–97K params) AE-medium 94K 3d 0.22 (0.304) 0.10 (0.262) 0.23 (0.297) 0.19 (0.246) 0.29 (0.342) 0.18 (0.073) 0.15 (0.073) AE-medium 95K 10d 0.21 (0.065) 0.08 (0.047) 0.28 (0.047) 0.23 (0.039) 0.22 (0.075) 0.19 (0.001) 0.08 (0.001) AE-medium 97K 22d 0.23 (0.004) 0.09 (0.005) 0.28 (0.014) 0.21 (0.006) 0.25 (0.013) 0.21 (0.001) 0.22 (0.001) Large autoencoders (∼ 1.4M params) AE-large 1.4M 3d 0.19 (0.124) 0.05 (0.075) 0.25 (0.108) 0.23 (0.105) 0.23 (0.150) 0.22 (0.014) 0.14 (0.014) AE-large 1.4M 10d 0.24 (0.002) 0.11 (0.002) 0.26 (0.003) 0.19 (0.002) 0.26 (0.002) 0.20 (0.0002) 0.25 (0.0002) AE-large 1.4M 22d 0.34 (0.001) 0.15 (0.001) 0.29 (0.002) 0.23 (0.002) 0.27 (0.002) 0.21 (0.0001) 0.17 (0.0001) SOMtime 0.85 0.59 0.73 0.58 0.52 0.83 0.69 SOM params 4.28M 3.35M 1.51M 3.16M 2.66M 2.05M 2.05M Values shown as |ρ|Spearman|ρ|_Spearman (Recon. MSE). All p-values <0.01<0.01. Hyperparameter Sensitivity The SOM hyperparameters used throughout the main experiments—lattice dimension K=5⋅N0.54K=5· N^0.54, neighborhood width σ=0.7σ=0.7, and learning rate 0.750.75—were fixed before any sensitive-attribute correlation was computed and are not tuned using sensitive-attribute labels. To verify that these choices do not coincide with isolated sensitive sweet spots, we report sensitivity sweeps for the two most consequential hyperparameters on WVS Canada (age as the withheld sensitive attribute), holding all other settings fixed. Lattice Size The lattice dimension K=5⋅N0.54K=5· N^0.54 follows a slight modification of the heuristic of Vesanto and Alhoniemi (2000), which balances representational capacity against computational cost. Table 5 reports sensitivity to the exponent of the scaling rule across a fine grid from N0.40N^0.40 to N0.60N^0.60. Table 5: SOMtime sensitivity to the lattice-size exponent on WVS Canada (age withheld). Spearman ρ between the activation z-axis and the withheld age attribute is reported for nine values of the exponent in the scaling rule K=5⋅NcK=5· N^c, with c∈[0.40,0.60]c∈[0.40,0.60]. Scaling Spearman ρ 5⋅N0.405· N^0.40 0.70 5⋅N0.455· N^0.45 0.80 5⋅N0.505· N^0.50 0.81 5⋅N0.515· N^0.51 0.81 5⋅N0.525· N^0.52 0.82 5⋅N0.535· N^0.53 0.84 ⋅0.545· N^0.54 (used in paper) 0.85 5⋅N0.555· N^0.55 0.85 5⋅N0.605· N^0.60 0.84 Three patterns are visible. First, the Spearman rises smoothly and monotonically with the exponent from 0.400.40 (ρ=0.70ρ=0.70) to 0.540.54 (ρ=0.85ρ=0.85), with no local extrema along the climb. Second, the chosen exponent of 0.540.54 marks the precise beginning of a plateau: 0.540.54 and 0.550.55 both attain ρ=0.85ρ=0.85, and the value at 0.600.60 (ρ=0.84ρ=0.84) is within 0.010.01 of the peak. Third, the smoothness of the curve means no value in the explored range produces sensitive-attribute structure that deviates materially from the rest: the Spearman varies within a 0.150.15 window across the entire 5×5× range of effective lattice resolutions implied by c∈[0.40,0.60]c∈[0.40,0.60]. This is the sensitivity profile predicted by Proposition 2 of the main paper: smaller exponents correspond to coarser lattice resolution ϵε, loosening the LsϵL_sε preservation bound and allowing sensitive-attribute structure to fall through the resolution of the SOM. Increasing the exponent past 0.540.54 tightens ϵε further but does not improve preservation, because the additional resolution captures structure orthogonal to the s-aligned direction rather than refining it. The Vesanto–Alhoniemi heuristic therefore selects the minimum lattice resolution sufficient to recover the structured leakage signal on this data, with no apparent gains from further scaling. Learning Rate The learning rate α=0.75α=0.75 controls how aggressively prototype vectors are updated toward each presented input during competitive learning. Table 6 reports sensitivity across four values spanning low, moderate, and high settings. Table 6: SOMtime sensitivity to learning rate on WVS Canada (age withheld). Spearman ρ between the activation z-axis and the withheld age attribute is reported for four learning-rate values. Learning rate α Spearman ρ 0.25 0.62 0.50 0.77 0.750.75 (used in paper) 0.85 1.00 0.73 The learning rate exhibits a unimodal sensitivity curve with the peak at 0.750.75 and graceful degradation in both directions. This shape has a clear mechanistic interpretation. At low learning rates (α=0.25α=0.25), prototype updates are too small for the SOM to fully discover the data manifold during training; the lattice under-fits, distributed sensitive signals are averaged out across neurons rather than concentrated along the activation axis, and the per-axis Spearman drops to 0.620.62. At high learning rates (α=1.00α=1.00), late-stage updates can overwrite the topology established by earlier samples, breaking the topology-preservation property on which Proposition 2 of the main paper depends; the lattice retains capacity but loses the locally consistent ordering needed for s to align with the activation axis, and the per-axis Spearman drops to 0.730.73. The degradation is asymmetric—steeper on the high side (−0.12-0.12) than on the low side (−0.08-0.08 at the corresponding distance)—which is consistent with the topology-preservation mechanism: insufficient learning degrades performance gradually, while excessive learning can actively destroy lattice structure. Summary Both sensitivity curves confirm that the SOMtime hyperparameters used throughout the paper sit at the principled choice from prior literature (K) or near a clear local optimum (α), rather than at a brittle artefact-generating configuration. The Spearman correlation degrades smoothly under hyperparameter perturbation, and the magnitudes of degradation under the explored range remain comfortably above any baseline result in Table 1 of the main paper: the lowest SOMtime Spearman observed in any ablation cell, 0.620.62, still exceeds the highest rotation-invariant Spearman of any baseline (0.440.44 for PCA on WVS Canada) by a comfortable margin. SOMtime’s advantage over the baselines is therefore not contingent on hyperparameter tuning to a specific configuration. References F. Adilazuarda, C. C. Liu, I. Gurevych, and A. F. Aji (2025) From surveys to narratives: rethinking cultural value adaptation in LLMs. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, C. Christodoulopoulos, T. Chakraborty, C. Rose, and V. Peng (Eds.), Suzhou, China, p. 18063–18090. External Links: Link, Document, ISBN 979-8-89176-332-6 Cited by: Introduction, Datasets. S. Ahmadian, A. Epasto, R. Kumar, and M. Mahdian (2019) Clustering without over-representation. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD ’19, New York, NY, USA, p. 267–275. External Links: ISBN 9781450362016, Link, Document Cited by: Fairness in Unsupervised Learning. [3] (2000) Census-Income (KDD). Note: UCI Machine Learning RepositoryDOI: https://doi.org/10.24432/C5N30T Cited by: Introduction, Datasets. A. Chhabra, K. Masalkovaitė, and P. Mohapatra (2021) An overview of fairness in clustering. 9 (), p. 130698–130720. External Links: Document Cited by: Fairness in Unsupervised Learning. F. Chierichetti, R. Kumar, S. Lattanzi, and S. Vassilvitskii (2017) Fair clustering through fairlets. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS’17, Red Hook, NY, USA, p. 5036–5044. External Links: ISBN 9781510860964 Cited by: Introduction, Fairness in Unsupervised Learning, Limitations and Ethical Considerations. C. Dwork, M. Hardt, T. Pitassi, O. Reingold, and R. Zemel (2012) Fairness through awareness. In Proceedings of the 3rd Innovations in Theoretical Computer Science Conference, ITCS ’12, New York, NY, USA, p. 214–226. External Links: ISBN 9781450311151, Link, Document Cited by: Introduction, Auditing Unsupervised Representations, Structured Leakage and Fairness Violation Are Equivalent in Unsupervised Pipelines. M. D. Ekstrand and D. Kluver (2021) Exploring author gender in book rating and recommendation. Vol. 31, p. 377–420 (en). Cited by: Introduction. M. Ghadiri, S. Samadi, and S. Vempala (2021) Socially fair k-means clustering. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, FAccT ’21, New York, NY, USA, p. 438–448. External Links: ISBN 9781450383097, Link, Document Cited by: Introduction, Fairness in Unsupervised Learning. C. Haerpfer, R. Inglehart, A. Moreno, C. Welzel, K. Kizilova, J. Diez-Medrano, M. Lagos, P. Norris, E. Ponarin, and B. Puranen (2020) World values survey wave 7 (2017-2020) cross-national data-set. World Values Survey Association. Cited by: Introduction, Datasets. G. E. Hinton and R. R. Salakhutdinov (2006) Reducing the dimensionality of data with neural networks. 313 (5786), p. 504–507 (en). Cited by: Fairness in Unsupervised Learning. B. Kang, D. G. García, J. Lijffijt, R. Santos-Rodríguez, and T. de Bie (2021) Conditional t-sne: more informative t-sne embeddings. In 2021 IEEE 8th International Conference on Data Science and Advanced Analytics (DSAA), Vol. , p. 1–2. External Links: Document Cited by: Fairness in Unsupervised Learning. J. M. Kleinberg, S. Mullainathan, and M. Raghavan (2016) Inherent trade-offs in the fair determination of risk scores. abs/1609.05807. External Links: Link, 1609.05807 Cited by: Introduction, Auditing Unsupervised Representations, Structured Leakage and Fairness Violation Are Equivalent in Unsupervised Pipelines. M. Kleindessner, S. Samadi, P. Awasthi, and J. Morgenstern (2019) Guarantees for spectral clustering with fairness constraints. In International Conference on Machine Learning, External Links: Link Cited by: Fairness in Unsupervised Learning. T. Kohonen (1990) The self-organizing map. Proceedings of the IEEE 78 (9), p. 1464–1480. External Links: Document Cited by: Introduction, Topology-Preserving Representations and the Auditing Gap, Remark. C. Li, M. Chen, J. Wang, S. Sitaram, and X. Xie (2024) CultureLLM: incorporating cultural differences into large language models. In Advances in Neural Information Processing Systems, A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang (Eds.), Vol. 37, p. 84799–84838. External Links: Document, Link Cited by: Introduction, Datasets. S. Liu, Z. Qin, X. Hou, Y. Wang, Z. Wang, and Z. Peng (2026) Fairness-aware graph representation learning through bias disentanglement. 193, p. 108034. External Links: ISSN 0950-5849, Document, Link Cited by: Auditing Unsupervised Representations, Structured Leakage and Fairness Violation Are Equivalent in Unsupervised Pipelines. C. Louizos, K. Swersky, Y. Li, M. Welling, and R. Zemel (2017) The variational fair autoencoder. External Links: 1511.00830, Link Cited by: Fairness in Unsupervised Learning. A. Maćkiewicz and W. Ratajczak (1993) Principal components analysis (PCA). 19 (3), p. 303–342 (en). Cited by: Introduction. D. Madras, E. Creager, T. Pitassi, and R. S. Zemel (2018) Learning adversarially fair and transferable representations. abs/1802.06309. External Links: Link, 1802.06309 Cited by: Fairness in Unsupervised Learning, Limitations and Ethical Considerations. L. McInnes, J. Healy, and J. Melville (2020) UMAP: uniform manifold approximation and projection for dimension reduction. External Links: 1802.03426, Link Cited by: Introduction. N. Mehrabi, F. Morstatter, N. Saxena, K. Lerman, and A. Galstyan (2021) A survey on bias and fairness in machine learning. 54 (6). External Links: ISSN 0360-0300, Link, Document Cited by: Introduction, Introduction, Auditing Unsupervised Representations, Fairness in Unsupervised Learning, Structured Leakage Implies Downstream Disparity, Structured Leakage and Fairness Violation Are Equivalent in Unsupervised Pipelines. D. Moyer, S. Gao, R. Brekelmans, G. V. Steeg, and A. Galstyan (2018) Invariant representations without adversarial training. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, NIPS’18, Red Hook, NY, USA, p. 9102–9111. Cited by: Fairness in Unsupervised Learning. J. Peltonen, W. Xu, T. Nummenmaa, and J. Nummenmaa (2023) Fair neighbor embedding. In Proceedings of the 40th International Conference on Machine Learning, A. Krause, E. Brunskill, K. Cho, B. Engelhardt, S. Sabato, and J. Scarlett (Eds.), Proceedings of Machine Learning Research, Vol. 202, p. 27564–27584. External Links: Link Cited by: Introduction, Fairness in Unsupervised Learning, Limitations and Ethical Considerations. R. T. Rabonato and L. Berton (2024) A systematic review of fairness in machine learning. 5 (3), p. 1943–1954. External Links: Document Cited by: Introduction, Auditing Unsupervised Representations, Structured Leakage and Fairness Violation Are Equivalent in Unsupervised Pipelines. S. Ravfogel, Y. Elazar, H. Gonen, M. Twiton, and Y. Goldberg (2020) Null it out: guarding protected attributes by iterative nullspace projection. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, D. Jurafsky, J. Chai, N. Schluter, and J. Tetreault (Eds.), Online, p. 7237–7256. External Links: Link, Document Cited by: Fairness in Unsupervised Learning. S. Samadi, U. T. Tantipongpipat, J. Morgenstern, M. Singh, and S. S. Vempala (2018) The price of fair PCA: one extra dimension. abs/1811.00103. External Links: Link, 1811.00103 Cited by: Fairness in Unsupervised Learning, Limitations and Ethical Considerations. L. van der Maaten and G. Hinton (2008) Visualizing data using t-sne. 9 (86), p. 2579–2605. External Links: Link Cited by: Introduction. J. Vesanto and E. Alhoniemi (2000) Clustering of the self-organizing map. 11 (3), p. 586–600. External Links: Document Cited by: Lattice Size, Self-Organizing Map Representation, Remark. Y. M. Yusuke Iwasawa (2018) Censoring representations with multiple-adversaries over random subspaces. External Links: Link Cited by: Fairness in Unsupervised Learning, Limitations and Ethical Considerations. R. Zemel, Y. Wu, K. Swersky, T. Pitassi, and C. Dwork (2013) Learning fair representations. In Proceedings of the 30th International Conference on Machine Learning, S. Dasgupta and D. McAllester (Eds.), Proceedings of Machine Learning Research, Vol. 28, Atlanta, Georgia, USA, p. 325–333. External Links: Link Cited by: Fairness in Unsupervised Learning. W. Zhao, D. Mondal, N. Tandon, D. Dillion, K. Gray, and Y. Gu (2024) WorldValuesBench: a large-scale benchmark dataset for multi-cultural value awareness of language models. External Links: 2404.16308, Link Cited by: Introduction, Datasets.