Paper deep dive
BiasFlow: Geometric Monitoring and Backbone Regularization for Spurious Feature Reliance
Haojin Deng, Zhiping Lin, Yimin Yang
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Worst-group accuracy (WGA) evaluates a trained predictor but does not characterize how its frozen backbone behaves when a new head is learned. We introduce BiasFlow, a hook-based toolkit for monitoring class-attribute centroid alignment (IBMI), within-class centroid separation (W-IBMI), and feature-projection sensitivity. IBMI is confounded by class-attribute correlation and is not a measure of causal feature reliance. We pair these diagnostics with BiasFlow Regularization (BFR), a supervised, composable class-conditional centroid-alignment penalty. W-IBMI verifies the quantity BFR optimizes; it is scale dependent and does not independently establish attribute removal. Across the reported small-scale benchmarks, adding BFR improves or preserves mean WGA, with gains up to +26.0 pp on UrbanCars. The principal independent stress test freezes CelebA-Std backbones and trains fresh heads on biased data: BFR+GroupDRO improves WGA from 40.7% to 64.1%, while Male probe accuracy decreases from 92.5% to 72.2%. Attribute information remains recoverable, and cross-task results are mixed. A controlled synthetic-watermark ImageNet experiment additionally improves watermark-shift accuracy by +23.0 pp under matched training. These results support evaluating centroid geometry and resistance to biased head retraining alongside WGA, within the tested protocols.
Tags
Links
- Source: https://arxiv.org/abs/2610.06846v1
- Canonical: https://arxiv.org/abs/2610.06846v1
PDF not stored locally. Use the link above to view on the source site.
Full Text
81,126 characters extracted from source content.
Expand or collapse full text
BiasFlow: Geometric Monitoring and Backbone Regularization for Spurious Feature Reliance Haojin Deng, Zhiping Lin, and Yimin Yang †thanks: This work was supported in part by the Natural Sciences and Engineering Research Council of Canada (NSERC) Discovery Grant Program under Grant RGPIN-2025-06527, in part by the NSERC Alliance Program under Grant ALLRP 583061-23, and in part by the Western Research Award.†thanks: H. Deng is with the Department of Electrical and Computer Engineering, Western University, London, Canada.†thanks: Z. Lin is with the School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore.†thanks: Y. Yang is with the Department of Electrical and Computer Engineering, Western University, London, Canada, and also with the Vector Institute, Toronto, Canada. Abstract Worst-group accuracy (WGA) evaluates a trained predictor but does not characterize how its frozen backbone behaves when a new head is learned. We introduce BiasFlow, a hook-based toolkit for monitoring class–attribute centroid alignment (IBMI), within-class centroid separation (W-IBMI), and feature-projection sensitivity. IBMI is confounded by class–attribute correlation and is not a measure of causal feature reliance. We pair these diagnostics with BiasFlow Regularization (BFR), a supervised, composable class-conditional centroid-alignment penalty. W-IBMI verifies the quantity BFR optimizes; it is scale dependent and does not independently establish attribute removal. Across the reported small-scale benchmarks, adding BFR improves or preserves mean WGA, with gains up to +26.0+26.0 p on UrbanCars. The principal independent stress test freezes CelebA-Std backbones and trains fresh heads on biased data: BFR+GroupDRO improves WGA from 40.7%40.7\% to 64.1%64.1\%, while Male probe accuracy decreases from 92.5%92.5\% to 72.2%72.2\%. Attribute information remains recoverable, and cross-task results are mixed. A controlled synthetic-watermark ImageNet experiment additionally improves watermark-shift accuracy by +23.0+23.0 p under matched training. These results support evaluating centroid geometry and resistance to biased head retraining alongside WGA, within the tested protocols. Index Terms: Spurious correlations, debiasing, representation learning, geometric probing, worst-group accuracy, backbone regularization, feature space analysis, deep learning. I Introduction Spurious correlations can arise when a target label co-occurs with a task-irrelevant attribute in the training data. Empirical Risk Minimization (ERM) may exploit such correlations and fail when they change [1]. This problem occurs in facial attribute recognition [2] and visual group-shift benchmarks [3]. Fig. 1: t-SNE of CelebA-Std ResNet-18 features, seed 1 (Blond Hair target, Male attribute). Baseline and BFR panels illustrate different within-class subgroup layouts. BFR reduces the targeted centroid discrepancy; two-dimensional mixing does not establish concept erasure or causal feature use. Over the past several years, the community has developed a rich family of debiasing methods aimed at minimizing spurious reliance while preserving overall model performance. Loss-reweighting strategies such as LfF [4] and JTT [5], head-retraining approaches such as DFR [6], adversarial discoverers such as DebiAN [7], and group-robust optimizers such as GroupDRO [3] have all reported substantial improvements on the standard evaluation benchmark: Worst-Group Accuracy (WGA), the minimum accuracy over evaluated groups defined by the cross-product of class and spurious attribute. WGA is the minimum accuracy over predefined evaluation groups; it does not summarize confidence margins, representation geometry, or the behavior of a subsequently trained classifier. Models with different representations can have the same WGA. DFR [6] demonstrates that a group-balanced head can improve WGA while its input backbone is held fixed. This is a useful strategy, not evidence that the original classifier necessarily uses every attribute encoded by its backbone. We ask the narrower question of whether a frozen representation remains susceptible to a new head trained under the original biased distribution, consistent with the distinction between representation and classifier studied in [8, 1]. We introduce BiasFlow to inspect this distinction through geometric measurements and head-retraining stress tests. The Inter-class Bias-alignment Metric Index (IBMI) measures centroid alignment with a pooled, user-specified attribute direction. Because class composition contributes to that direction, a high IBMI can occur even without within-class attribute separation. We therefore interpret IBMI as an observational summary, not proof of reliance or contamination. DFR preserves its own first-stage backbone during head retraining; equality with a separately trained ERM run requires identical checkpoint and probe conditions, which the audit does not enforce. The projection probe defines signed group accuracy changes, but the retained figure plots unsigned AblGap. Its nonnegative bars establish neither exploitation nor interference. The independent stress test is particularly informative on CelebA-Std11 1 CelebA-Std uses Blond Hair as target and Male as the spurious attribute, with the Blond-Male group rare [3].. GroupDRO achieves 86.3%86.3\% end-to-end WGA, but a fresh head trained on the standard biased data over its frozen backbone obtains 40.7%40.7\%, close to ERM’s 40.0%40.0\% (Table IX). Male probe accuracy is 92.5%92.5\%. These are distinct observations: a new biased head performs poorly, and a separate probe can recover the attribute. Neither establishes that GroupDRO’s original head uses Male causally. Our intervention is deliberately restricted to the first moments of class-conditional attribute groups. BiasFlow Regularization (BFR) penalizes the distance between their feature centroids during backbone training. It belongs to the established family of conditional representation-alignment methods [9, 10, 11]; its role here is a simple composable intervention paired with geometric monitoring and a frozen-backbone evaluation. Equal centroids do not imply equal feature distributions or attribute erasure. BFR reduces the objective-aligned W-IBMI statistic in most configurations (Table IV). More independently, BFR+GroupDRO yields 64.1%64.1\% biased-head WGA and 72.2%72.2\% Male probe accuracy, compared with 40.7%40.7\% and 92.5%92.5\% without BFR. The former tests resistance to biased head retraining; the latter measures recoverability under the specified probe. Figure 1 illustrates within-class subgroup mixing in a two-dimensional visualization, which should not be interpreted as proof of complete distribution alignment. Our contributions are summarized as follows: • Geometric monitoring with explicit scope. BiasFlow reports pooled centroid alignment, class-conditional centroid separation, and projection sensitivity. We specify class-composition and scale limitations, and distinguish the unsigned AblGap from signed group accuracy drops. These summaries complement WGA; they do not certify fairness, causal reliance, or concept removal. • Composable supervised centroid regularization. BFR applies class-conditional centroid alignment to the evaluated training objectives. We retain the reported WGA results, including the near-neutral Waterbirds JTT case, and distinguish supervised comparisons from gains over methods without training-time attribute labels. We do not claim that conditional alignment itself is new or that BFR outperforms unevaluated representation-level methods. • Frozen-backbone stress testing. Fresh biased heads on CelebA-Std provide the primary independent evidence: GroupDRO’s backbone supports 40.7%40.7\% WGA, versus 64.1%64.1\% for BFR+GroupDRO. Appendix experiments report continued ERM training, Smiling transfer, and alternative attribute probes, including negative outcomes. A separate controlled synthetic-watermark study tests a large-scale nuisance intervention under matched training. I Related Work Spurious-correlation mitigation includes predictive-loss methods, head retraining, and a substantial literature on representation alignment, adversarial removal, and concept erasure. We discuss these families to position BFR as a centroid-level instance of representation regularization rather than the first representation-level intervention. I-A Predictive-Loss and Head-Retraining Methods The baselines evaluated here span sample reweighting, head retraining, and group-supervised robust optimization. Reweighting and group-loss training can change the entire network, including the backbone; only the head-retraining stage of DFR explicitly leaves the backbone fixed. Loss-Reweighting Approaches. These methods aim to improve Worst-Group Accuracy (WGA) by dynamically altering the importance of training samples without requiring explicit group annotations. Just Train Twice (JTT) [5] identifies misclassified samples from a standard ERM model and upweights them in a second training phase. Learning from Failure (LfF) [4] simultaneously trains a biased network to amplify prejudice and a debiased network that focuses on samples the biased model struggles with. Similarly, Debiasing Alternate Networks (DebiAN) [7] employs an adversarial setup to discover and unlearn unknown biases. These methods can shift the final decision rule toward minority or shortcut-conflicting samples, but they regulate training through sample weights rather than explicit representation constraints. Consequently, the backbone remains free to encode spurious attributes even when the output classifier becomes more robust. Classification Head Retraining. DFR [6] retrains a linear head on balanced data over a frozen ERM-trained backbone. It demonstrates that useful core features can already be present. Our stress test concerns a later biased head, not a defect in the balanced DFR decision rule. Head retraining preserves an existing representation and can avoid the cost of relearning it. BFR instead changes the backbone during its training stage. These interventions answer different questions: robust prediction with a selected head, versus the behavior of new heads on frozen features. Neither approach universally dominates, particularly when transferred tasks benefit from the targeted attribute. Debiasing with Explicit Bias Annotations. When spurious group labels are available, methods can directly enforce robustness. Invariant Risk Minimization (IRM) [12] seeks representations that support invariant prediction across training environments, offering a theoretical route to avoiding environment-specific shortcuts. Group Distributionally Robust Optimization (GroupDRO) [3] minimizes the maximum loss across predefined groups. Recent advancements have extended this paradigm: Hierarchical Group DRO [13] addresses both inter-group and intra-group distributional shifts through a multi-level ambiguity set, while LISA (Learning Invariant Predictors with Selective Augmentation) [14] leverages group labels to perform selective mixup interpolation, effectively canceling out spurious correlations during training. These methods enforce outcome robustness through group-level losses or augmentations, but high WGA does not by itself certify that the backbone has become invariant to the spurious attribute. Training data (x,y,s1,…,sK)(x,y,s_1,…,s_K)Backbone fθ(x)=zf_θ(x)=zTask head h(z)h(z)Prediction y y; base training loss(a) Monitor feature geometry(b) Regularize within each class(c) Test the frozen backboneForward hooks capture backbone featuresz1z_1z2z_2y=0y=0y=1y=1Δ0 _0Δ1 _1 IBMI: pooled class–attribute alignment AblGap: unsigned projection asymmetry Pooled geometry can reflect class composition. Projection sensitivity is not causal feature use. BFR-inv targets conditional first momentsz1z_1z2z_2y=0y=0y=1y=1 Linv=1C∑c‖μc,1−μc,0‖2d L_inv= 1C _c \| _c,1- _c,0\|^2d L=Lbase+λ1K∑kLinv(k) L=L_base+λ 1K _kL_inv^(k) Train fθf_θ using class and attribute labels. Match first moments, not full distributions. Freeze fθf_θ fixed features z Fresh task head Train on biased training features Attribute probe Train on validation features Original-task test WGA Test attribute accuracy Test susceptibility to biased head training. Measure remaining attribute recoverability. W-IBMI: objective-aligned verification; scale dependent Predictive evidence: WGA and new heads s=0s=0s=1s=1Group centroid; Δc=μc,1−μc,0 _c= _c,1- _c,0Schematic geometry; no measured points or distances Fig. 2: BiasFlow workflow and evidence roles. (a) Forward hooks expose centroid geometry and unsigned projection sensitivity. Blue circles and orange triangles denote attribute values, dashed ellipses denote target classes, and open markers denote group centroids. (b) BFR-inv penalizes within-class centroid differences, averaged over annotated attributes during backbone training; W-IBMI is scale-dependent, objective-aligned verification. (c) Frozen-backbone tests fit a fresh task head on biased training features and a separate attribute probe on validation features, then evaluate on test features. Geometry is schematic, not measured data. Centroid alignment and projection sensitivity do not establish concept erasure or a causal intervention-selection rule; predictive evidence is limited to the tested protocols. I-B Latent and Causal Fairness Metrics To look beyond output accuracy, recent work has developed metrics to quantify bias directly within learned features. Observational Probes. Information-theoretic approaches measure statistical dependence. For instance, InfoFair [15] minimizes variational mutual information between outcomes and sensitive attributes, while Gowri et al. [16] propose scalable approximations for high-dimensional latent mutual information. Geometrically, Zhou et al. [17] introduce Fair CCA to minimize correlation disparity across groups via canonical correlations, and Frolov and Oseledets [18] use principal angle alignments to quantify subspace relationships. These metrics expose structure that output accuracy cannot see, but they are generally not designed as lightweight monitoring tools for debiasing pipelines or tied to a corresponding backbone-level training objective. Interventional Probing. Interventional metrics test whether representations actively influence predictions rather than merely encoding information. Guerner et al. [19] perform feature-space interventions on learned subspaces to verify if specific concepts drive model predictions, offering stronger evidence of debiasing than observational correlation. However, such probes are usually used as post-hoc analyses; they rarely distinguish whether a spurious feature is being exploited as a shortcut or acting as interference, and they do not prescribe how to reshape the backbone. I-C Relationship to Prior Work Conditional alignment is established prior work. Conditional Learning of Fair Representations [9] aligns representations across demographic groups conditional on class to address equalized error rates. Correct-N-Contrast (CNC) [10] uses an ERM model to identify same-class examples with different spurious cues and learns aligned representations contrastively without training-time attribute labels; it also connects alignment to worst-group error. BFR uses supplied attribute labels and a first-moment penalty, so it offers neither CNC’s annotation advantage nor full conditional distribution matching. Learning Not to Learn [20] adversarially suppresses bias information through a feature–bias mutual-information objective. EnD [21] regularizes intermediate representations by entangling same-target features and disentangling bias-related features. LEACE [22] performs closed-form linear concept erasure with guarantees for the transformed representation; BFR’s approximate conditional centroid alignment has no comparable erasure guarantee. Spurious Correlation-Aware Embedding Regularization (SCER) [11] derives core and spurious directions from group-wise mean embeddings and regularizes the embedding space for worst-group robustness. SCER is especially close in its use of group means, while its direction- and classifier-based theoretical motivation differs from BFR’s direct within-class centroid penalty. Our contribution is the monitoring and evaluation workflow around a composable penalty. The experiments do not include these close representation-level baselines and cannot establish superiority over them. I Methodology: BiasFlow and Representation Regularization BiasFlow collects latent features with forward hooks to compute observational geometry and feature-projection sensitivity without changing baseline training. BFR is a separate supervised training penalty applied to the features. Figure 2 summarizes the workflow. The metric limitations below apply to all models, including ordinary ERM backbones, rather than arising only after BFR. Notation. Let fθ(x)∈ℝdf_θ(x) ^d denote the backbone feature embedding of input x, y∈1,…,Cy∈\1,…,C\ the class label, s∈0,1s∈\0,1\ the binary spurious attribute, μc _c the empirical centroid of class c, and SBS_B the between-class scatter matrix. These symbols are shared across both components below. I-A BiasFlow Diagnostic: IBMI-based Geometric Probing The first component of BiasFlow instruments any backbone via forward hooks to compute a hierarchy of geometric metrics that quantify spurious entanglement at the representation level, without modifying training. Geometric foundations. We define μc _c as the empirical class centroid and wclsw_cls as the principal eigenvector of the between-class scatter matrix SBS_B, following Fisher [23]. The spurious direction wspurw_spur is the unit vector connecting the two spurious-group centroids: wspur=μ(s=1)−μ(s=0)‖μ(s=1)−μ(s=0)‖2.w_spur\;=\; μ(s=1)-μ(s=0)\|μ(s=1)-μ(s=0)\|_2\,. (1) Here s is a user-specified attribute such as Male, background, a co-occurring object, or a synthetic watermark. The pooled mean satisfies μ(s)=∑cP(y=c∣s)μ(y=c,s)μ(s)= _cP(y=c s)μ(y=c,s). Thus wspurw_spur can contain class-composition differences even when μ(y=c,s=1)=μ(y=c,s=0)μ(y=c,s=1)=μ(y=c,s=0) for every class. We call it an attribute-associated direction rather than a causally isolated spurious factor. It is recomputed per model, so cross-model differences also involve changes in the probe axis. If the centroid difference vanishes, the direction is undefined and the corresponding statistic should be marked unavailable. Inter-class Bias-alignment Metric Index (IBMI). IBMI measures the variance of equally weighted class centroids projected on wspurw_spur, relative to the largest eigenvalue of their scatter. For C>1C>1, let μ¯=C−1∑cμc μ=C^-1 _c _c and SB=(C−1)−1∑c(μc−μ¯)(μc−μ¯)⊤S_B=(C-1)^-1 _c( _c- μ)( _c- μ) . Use the same sample-variance normalization in the numerator: IBMI=Varc(⟨μc,wspur⟩)λmax(SB)+ε,IBMI\;=\; Var_c ( _c,w_spur ) _ (S_B)+ \,, (2) where ε>0 >0 stabilizes division. The numerator equals wspur⊤SBwspurw_spur S_Bw_spur, so the Rayleigh bound gives 0≤IBMI≤10 ≤ 1 for a unit axis and positive-semidefinite SBS_B. Degenerate class scatter has no useful alignment interpretation and is treated as unavailable by the probe. For two noncoincident class centroids, IBMI is a squared cosine between the class- and attribute-centroid directions, up to ε . This is a standard geometric quantity, not a novel dependence estimator. High IBMI does not establish within-class attribute encoding or classifier use. Within-Class IBMI (W-IBMI). W-IBMI measures class-conditional centroid separation using the same supplied attribute labels as BFR. It avoids the pooled-axis confounding mechanism in its definition, but closely matches the BFR-inv objective. With class–attribute imbalance, successful centroid alignment can leave a pooled axis dominated by class composition, so IBMI may increase toward one despite the reduction in within-class separation. This is a limitation of interpreting pooled alignment as bias, not a reason to treat W-IBMI as independent validation: W-IBMI=1C∑c=1C‖μ(y=c,s=1)−μ(y=c,s=0)‖2d,W -IBMI\;=\; 1C _c=1^C \|μ(y=c,\,s=1)-μ(y=c,\,s=0) \|^2d\,, (3) where division by d reports squared centroid distance per feature coordinate. It does not make the metric scale invariant or comparable across architectures: replacing z by αzα z multiplies W-IBMI by α2α^2, even if an inverse head-weight rescaling leaves predictions unchanged. We retain the reported values as objective-aligned verification statistics under each feature convention. They are not used to rank architectures or prove removal of attribute information. IBMI and W-IBMI are descriptive first-moment summaries. Equal within-class centroids do not imply equal conditional distributions or prevent attribute prediction through other feature structure. Attribute probes and biased-head WGA therefore supply separate operational evidence. Balanced or class-residualized axes, normalized or whitened distances, feature norms, and distributional measures would be useful additional validations; no such new measurements are claimed here. I-B AblGap: Feature-Space Ablation Probe IBMI and W-IBMI quantify the geometric presence of spurious structure in the backbone, but do not reveal the functional role that structure plays in the model’s decisions. BiasFlow therefore includes a complementary feature-space ablation probe, the Ablation Gap (AblGap), which measures the accuracy consequence of projecting out the empirical prespecified-attribute direction from the feature space. Like IBMI, AblGap should be interpreted as a sensitivity test for a user-specified attribute direction, not as proof that this direction is a causally pure spurious factor. Definition. Given feature z=fθ(x)z=f_θ(x) and prespecified attribute direction wspurw_spur, we project out the corresponding component: z~=z−⟨z,wspur⟩wspur. z\;=\;z\;-\; z,\,w_spur \,w_spur\,. (4) Let RD_R and UD_U be the spurious-related and spurious-unrelated groups. The accuracy drop after projection for group g∈R,Ug∈\R,U\ is: ΔAccg=Accg(z)−Accg(z~), _g\;=\;Acc_g(z)\;-\;Acc_g( z)\,, (5) and AblGap =|ΔAccR−ΔAccU|=| _R- _U| captures the asymmetry between groups. Signed projection sensitivity. AblGap is nonnegative and measures group asymmetry; it has no exploitation/interference sign. The sign belongs to ΔAccR _R: a positive value means the removed component helped the fixed head on group R, and a negative value means projection helped that group. We use exploitation-like and interference-like as tentative interpretations. Since the projected direction can include class information and projection creates a feature-space perturbation, neither sign isolates the underlying attribute causally. The retained CelebA and UrbanCars plot does not report the signed group drops; controlled validation of both sign interpretations and intervention selection remains future work. The probe is applied to trained baseline models before BFR intervention, not to an untrained model or to a dataset in isolation. I-C BiasFlow Regularization (BFR) We test whether supervised within-class centroid alignment changes the behavior of the evaluated backbones. BFR adds a geometric penalty to the base training loss (cross-entropy in the ERM case): Ltotal=LCE+λ⋅Lgeo,L_total\;=\;L_CE\;+\;λ· L_geo\,, (6) where λ is an effective scheduled weight. BFR-inv is the principal intervention; BFR-orth and BFR-spectral are additional modes evaluated in the appendix. The schedule and centroid handling are specified below. No validated exploitation/interference rule is used to choose a mode. I-C1 Within-Class Invariance Loss (BFR-inv) The inv mode directly targets the within-class component of spurious geometry. It aims to reduce the within-class spurious centroid signal by pulling the related (s=1s=1) and unrelated (s=0s=0) subsets of each class c toward the same feature centroid: Linv=1C∑c=1C‖μ(y=c,s=1)−μ(y=c,s=0)‖2d,L_inv\;=\; 1C _c=1^C \|μ(y=c,s=1)-μ(y=c,s=0)\|^2d\,, (7) where d is the feature dimension. Mechanism and scope. This penalty aligns first moments conditional on the target label. It does not impose independence of the attribute and representation, align all distributions, or guarantee erasure accessible to every classifier. We verify optimization with W-IBMI and evaluate independent predictive consequences using WGA and frozen-backbone stress tests. Multiple attributes. With K annotated binary attributes, the implementation uses Lgeo=K−1∑k=1KLinv(k)L_geo=K^-1 _k=1^KL_inv^(k), each computed separately conditional on class and attribute sks_k. CelebA-MB uses Male and Young, and UrbanCars uses background and co-occurring object. Both labels are required. This marginal alignment does not explicitly align all joint attribute combinations or constrain their interactions. Centroid estimates and gradients. For each (c,sk)(c,s_k) cell with at least two minibatch examples, the loss uses the current differentiable batch mean. A detached running buffer is initialized at the first qualifying batch and then updated as m←αm+(1−α)μ^m←α m+(1-α) μ, with α=0.9α=0.9. If a cell has fewer than two examples, its previous detached buffer is used; if no buffer exists, that class–attribute pair is skipped. The loss averages over classes with both centroids available and then over attributes. Gradients propagate only through current batch means. A term using two stored means has no backbone gradient, although it contributes to the reported scalar loss. Rare groups may receive delayed or intermittent alignment signals and stale estimates as the backbone evolves. Weight schedule. For total training epochs T, let ewe_w be the integer warmup length (fractional warmup overrides an absolute value), r the configured ramp fraction, and q an optional stop fraction. The effective weight is zero for e≤ewe≤ e_w and, when enabled, for e>⌊qT⌋e> qT . Otherwise it is λmax _ if r=0r=0, or λmaxmin1,(e−ew)/max(1,⌊rT⌋) _ \1,(e-e_w)/ (1, rT )\. This is a configured epoch schedule, not a feedback-adaptive optimizer. Dataset and method overrides must be interpreted per run. IV Experimental Results IV-A Experimental Setup TABLE I: Training hyperparameters per dataset. Method-level overrides (below the rule) apply on top of dataset defaults. wd = weight decay, mom = momentum, bs = batch size. Dataset Arch Opt lr wd mom bs Epochs CelebA (R18) R18 SGD 1e-4 1e-4 0.9 128 50 CelebA (R50) R50 SGD 1e-4 1e-4 0.9 128 50 CelebA-MB R18 SGD 1e-3 1e-4 0.8 64 50 UrbanCars R50 SGD 1e-3 1e-3 0.1 128 60 Waterbirds R50 SGD 1e-3 1e-4 0.9 128 300 Method overrides (applied on top of dataset defaults): LfF / DebiAN — Adam 1e-4 0.0 — 256 same JTT (CelebA) — SGD 1e-5 0.1 0.9 128 +1 stage JTT (UrbanCars) — SGD 1e-5 0.1 0.9 128 +3 stage JTT (Waterbirds) — SGD 1e-5 0.1 0.9 128 +60 stage DFR — — same same — same +5 L-BFGS The small-scale audit covers CelebA-Std [2, 3] (Blond Hair/Male, ResNet-18 and ResNet-50 [24]), CelebA-MB (Smiling/Male and Young, eight joint evaluation groups), UrbanCars [25] (urban/country with background and co-occurring-object attributes), and Waterbirds [3] (bird type/background). A separate ImageNet-1K [26] experiment introduces a synthetic watermark during training (Section IV-F). We compare ERM, LfF, JTT, DFR, DebiAN, and GroupDRO, with and without BFR. Reported benchmark values summarize three seeds. CelebA-Std uses validation WGA selection, whereas CelebA-MB and UrbanCars use validation average accuracy for the recorded runs. This difference can distort WGA comparisons and does not arise from a principled lack of group labels: BFR requires these annotations. We preserve existing results rather than retrospectively selecting unrecorded checkpoints. Unified reimplementations differ materially from some published baselines, particularly LfF on CelebA-R50; gains describe these implementations, not superiority over the original methods. Table I lists dataset defaults and method overrides. BFR uses λ=20λ=20 by default and λ=1λ=1 for JTT, based on the reported sensitivity study rather than a general optimality rule. The centroid buffer uses α=0.9α=0.9; the default absolute warmup is five epochs, with fractional warmup/ramp/stop settings available in the implementation. Probes are scheduled every five epochs. Saved per-run schedules and checkpoint selection are necessary to reproduce a particular result; a rare-group or EMA sensitivity study is not included. IV-B Backbone Geometry Audit TABLE I: IBMI of trained backbones (reported 3-seed means and standard deviations; UrbanCars reports mean background/object values). IBMI is a class-confounded centroid-alignment summary, not actual feature reliance. DFR freezes its own first-stage backbone, which need not equal the separately trained ERM run. ∗Low-IBMI cases discussed in the text. N/A marks an unavailable configuration; GroupDRO uses ResNet-50 for the reported CelebA-MB configuration. Method CelebA R18 CelebA R50 CelebA-MB R18 UrbanCars† R50 Waterbirds R50 ERM 0.404±0.0080.404±0.008 0.559±0.0040.559±0.004 0.274±0.0100.274±0.010 0.2170.217 / 0.4890.489 0.357±0.0290.357±0.029 LfF 0.681±0.0550.681±0.055 0.881±0.0030.881±0.003 0.940±0.0170.940±0.017 0.1080.108 / 0.4210.421 0.650±0.0590.650±0.059 JTT 0.609±0.0100.609±0.010 0.647±0.0160.647±0.016 0.013±0.014∗0.013±0.014^* 0.1580.158 / 0.0750.075 0.060±0.012∗0.060±0.012^* DFR 0.502±0.0190.502±0.019 0.559±0.0040.559±0.004 0.468±0.0170.468±0.017 0.2120.212 / 0.4740.474 0.331±0.0040.331±0.004 DebiAN 0.513±0.0330.513±0.033 0.896±0.0080.896±0.008 0.951±0.0140.951±0.014 0.0890.089 / 0.3120.312 0.597±0.0340.597±0.034 GroupDRO 0.466±0.0230.466±0.023 0.650±0.0040.650±0.004 N/A‡ 0.044±0.0140.044±0.014 / 0.372±0.0180.372±0.018 0.329±0.0030.329±0.003 †UrbanCars reports IBMI for two spurious attributes (background-correlation / co-occurring-object), 3-seed mean. IBMI is evaluated on converged backbones using the BiasFlow probe. IBMI describes the alignment of class centroids with the pooled attribute-centroid axis. Low values indicate weak alignment in this geometry; high values indicate co-alignment, which can arise from class composition alone. Neither establishes a clean or contaminated backbone in a causal sense. Table I reports IBMI for all baseline methods across all datasets and architectures. No output-level method systematically reduces backbone IBMI below ERM, and several make it substantially worse. DFR/ERM provenance. The earlier assertion that the DFR row equals ERM by construction was incorrect for this audit. The saved baseline sweep invokes DFR with its own first-stage training rather than an ERM checkpoint, and the trainer freezes that first-stage model only during head retraining. Separate training, checkpoint selection, and probe evaluation can therefore yield different IBMI. We retain the recorded values (0.4040.404/0.5020.502 on CelebA-R18, 0.2740.274/0.4680.468 on CelebA-MB, and 0.3570.357/0.3310.331 on Waterbirds for ERM/DFR), remove claims of shared-checkpoint identity, and do not interpret these differences as an effect of head retraining. The run configuration explains a source of mismatch, but a checkpoint-by-checkpoint identity/probe audit is still needed to certify numerical provenance across every table cell. LfF and DebiAN have larger recorded IBMI than ERM on CelebA and Waterbirds: for example, the CelebA-R50 values are 0.8810.881 and 0.8960.896 versus 0.5590.559. This reports an alignment difference; without controlled axes or interventions it does not identify a mechanism such as increased encoding or prove that the original head relies more on the attribute. GroupDRO’s outcome robustness can likewise coexist with pooled alignment. JTT has low IBMI on Waterbirds (0.0600.060 versus ERM 0.3570.357) and CelebA-MB (0.0130.013 versus 0.2740.274). These are dataset-specific alignment outcomes, not anomalies to discard or evidence that JTT universally removes attribute information. A causal explanation would require controlled measurement beyond the present audit. The audit shows that output performance and the reported centroid geometry do not move uniformly together. The independent frozen-backbone analysis is needed to assess whether these differences have a practical consequence under new head training. IV-C AblGap Analysis Figure 3 reports unsigned AblGap on converged baseline backbones for CelebA-Std and UrbanCars. The original plotting script reads the recorded AblGap fields, not signed ΔAccR _R. We retain those values and correct the axis description. AblGap measures the absolute difference in projection-induced accuracy changes between attribute groups. JTT’s CelebA-Std AblGap is 55.555.5 p, a large asymmetry in group-specific projection sensitivity. All displayed bars are nonnegative by definition, so their signs cannot establish exploitation. Without the signed group drops, neither an exploitation nor an interference regime can be certified from this figure. Class-composition confounding further limits causal interpretation. The experiment documents projection sensitivity rather than validated intervention selection. Fig. 3: Unsigned AblGap on CelebA-Std and UrbanCars, using the original plotted seed values. AblGap is |ΔAccR−ΔAccU|| _R- _U|, reported in p. Larger values indicate more asymmetric projection sensitivity across groups. The bars do not show the sign of either accuracy change, and cannot distinguish exploitation from interference. IV-D Comparison with Debiasing Baselines We now evaluate whether backbone-level geometric regularization translates to improved fairness across all datasets: CelebA-Std (Blond Hair target, Male spurious), CelebA-MB (Smiling target, Male + Young spurious), UrbanCars (scene classification, background + object spurious), and Waterbirds (bird type target, background spurious). We report Worst-Group Accuracy (WGA), the accuracy of the worst-performing subgroup defined by the cross-product of class label and spurious attribute. Higher WGA indicates fairer performance. Tables I, V, and VI report WGA for all baselines with and without BFR-inv across all datasets and architectures. BFR improves or preserves WGA across all configurations, with the smallest gain observed for JTT on Waterbirds and average accuracy preserved within 00–22 p throughout. BFR’s reported gains vary by dataset and base method. DFR changes only its head during the second stage, whereas LfF, JTT, DebiAN, and GroupDRO can change their backbones throughout training. Their WGA objectives do not explicitly enforce BFR’s centroid constraint. The observed gain ordering should not be read as a demonstrated correlation between IBMI and treatment benefit or as evidence that reweighting leaves representations unchanged. The relationship also explains why BFR is most valuable as a compositional module rather than a standalone method. On CelebA-MB, where the multi-bias structure makes output-level corrections less effective, gains are largest precisely because no baseline method can address both spurious axes simultaneously through head compensation alone. Supervision. BFR requires spurious attribute labels and belongs to the same supervised category as GroupDRO [3]. Gains over unsupervised methods (LfF, JTT, DebiAN) reflect both the geometric intervention and the additional supervision signal; absolute comparisons should be interpreted accordingly. A single hyperparameter rule λ=20λ=20 governs all configurations, reduced to λ=1λ=1 for JTT to prevent competing gradient signals with its 50×50× sample upweighting; see the supplementary material for the λ sensitivity sweep. TABLE I: WGA (%) on CelebA-Std (ResNet-18) and CelebA-MB (ResNet-18). 3 seeds, mean± . Bold: higher WGA between Reproduced and +BFR for each method. Italics: published number for reference. †Supervised method. ‡Published DFR (92.9) uses ResNet-50 + sklearn solver; our R18 reproduction uses L-BFGS head, explaining the gap. CelebA-Std (ResNet-18) CelebA-MB (ResNet-18) Method Paradigm Published WGA Reproduced WGA +BFR WGA Reproduced WGA +BFR WGA ERM Baseline 37.9 43.9± 1.2 54.6± 2.6 40.3± 1.6 53.9± 2.7 LfF Loss-reweight 43.3 58.7± 2.1 61.7± 2.3 49.1± 3.3 67.7± 2.3 JTT Loss-reweight 81.1 81.1± 0.4 82.2± 0.5 62.7± 3.8 69.3± 2.6 DFR†‡ Head-retrain 92.9 80.6± 2.5 81.9± 1.0 73.9± 0.8 75.7± 1.0 DebiAN Loss-reweight 52.9 64.4± 3.2 65.4± 5.3 46.9± 4.2 58.4± 2.4 GroupDRO† Supervised 88.9 86.3± 0.5 88.0± 1.5 55.7± 0.5 68.3± 4.4 CelebA-Std reproduced numbers use WGA-based model selection (best validation worst-group accuracy), matching the standard benchmark protocol. CelebA-MB uses accuracy-based model selection. For CelebA-MB, all methods are compared within the same controlled implementation. W-IBMI tracks BFR’s intended geometric effect. W-IBMI is an objective-aligned verification metric: its reduction shows that the targeted first-moment discrepancy decreased under the chosen feature convention. Its formula matches BFR-inv apart from estimation details, so it is not independent evidence of attribute removal. Figure 4 illustrates the pooled-axis limitation: IBMI can rise toward one while within-class centroid distance falls. Both summaries use model-dependent features; feature scale and class composition must be considered. Table IV preserves the original measurements, including the BFR+GroupDRO R50 exception. Fig. 4: Recorded IBMI and W-IBMI trajectories for ERM and BFR+ERM on CelebA-Std. Pooled centroid alignment can increase as the attribute axis becomes dominated by class composition. W-IBMI tracks the centroid penalty being optimized, rather than independent concept erasure. TABLE IV: Reported W-IBMI before and after BFR-inv (3-seed means). This scale-dependent first-moment statistic verifies an objective-aligned effect within each feature convention; it cannot rank architectures or certify erasure. ∗BFR+GroupDRO R50 does not reduce W-IBMI; JTT+BFR Waterbirds retains a larger residual than most other configurations. CelebA R18 CelebA R50 Waterbirds R50 Method Base +BFR Base +BFR Base +BFR ERM 0.0900.090 0.0010.001 0.0180.018 0.0020.002 0.0270.027 0.0010.001 LfF 0.2980.298 0.0000.000 0.0820.082 0.0000.000 0.1580.158 0.0000.000 JTT 0.0370.037 0.0010.001 0.0080.008 0.0010.001 0.0130.013 0.004‡0.004 DFR 0.0630.063 0.0010.001 0.0180.018 0.0020.002 0.0260.026 0.0010.001 DebiAN 0.1540.154 0.0010.001 0.0600.060 0.0010.001 0.1160.116 0.0010.001 GroupDRO 0.0740.074 0.0000.000 0.0190.019 0.022∗0.022^* 0.0240.024 0.0010.001 ‡BFR+JTT Waterbirds W-IBMI =0.004=0.004 (vs. ≈0.001≈\!0.001 for others), consistent with partial centroid collapse under JTT’s conflicting 50×50× upweighting schedule. Fig. 5: t-SNE of CelebA-MB ResNet-18 features (Smiling target; Male and Young annotated attributes). Color encodes target and Male; shape encodes Young. Baseline panels show subgroup separation; BFR panels illustrate more within-class mixing. BFR averages separate class-conditional penalties for the two supplied attributes. The visualization does not establish joint distribution alignment or lack of attribute recoverability. ResNet-50 results (Table V). The CelebA-Std ResNet-50 configuration with ImageNet pretraining also has positive reported WGA gains, including LfF (+6.7+6.7 p) and DFR (+4.1+4.1 p). GroupDRO reaches 88.5%88.5\%, below the separately published HierDRO value of 90.4%90.4\%. This is an architecture-specific replication within the reported pipeline, not evidence of unrestricted generalization. TABLE V: WGA (%) on CelebA-Std (ResNet-50, ImageNet pretrained). 3 seeds, mean± , WGA-based model selection. Bold: higher WGA between Reproduced and +BFR for each method. Italics: published number for reference. †Supervised method. WGA (%) Method Paradigm Published Reproduced +BFR ERM Baseline 47.7 49.1±1.649.1±1.6 50.6±0.550.6 0.5 LfF Loss-reweight 77.2 55.9±5.955.9±5.9 62.6±8.162.6 8.1 JTT Loss-reweight 81.5 80.2±0.280.2±0.2 82.1±0.282.1 0.2 DFR† Head-retrain 80.7 81.3±1.881.3±1.8 85.4±2.285.4 2.2 DebiAN Loss-reweight — 62.6±3.362.6±3.3 64.1±3.064.1 3.0 GroupDRO† Supervised 89.3 88.0±0.788.0±0.7 88.5±0.588.5 0.5 HierDRO† Supervised ref. 90.4 — — All results use WGA-based model selection (best validation worst-group accuracy). DFR freezes its own ERM-trained first-stage backbone for L-BFGS head retraining. The audit does not establish identity with the separate ERM checkpoint. TABLE VI: WGA (%) and ID Accuracy (%) on scene/object datasets (3 seeds, mean± ). Bold: higher value between base and +BFR for each reported metric within each method. †Supervised method. UrbanCars (R50) Waterbirds (R50) Method Paradigm ID Acc (base / +BFR) WGA (base / +BFR) Avg Acc (base / +BFR) WGA (base / +BFR) ERM Baseline 97.5±0.397.5 0.3 / 96.4±0.696.4±0.6 56.7±0.556.7±0.5 / 82.7±0.582.7 0.5 91.291.2 / 94.094.0 79.0±0.179.0±0.1 / 83.2±1.483.2 1.4 LfF Loss-reweight 97.2±1.797.2±1.7 / 97.4±0.997.4 0.9 67.7±3.667.7±3.6 / 85.6±2.885.6 2.8 91.991.9 / 92.792.7 79.4±1.579.4±1.5 / 86.5±1.686.5 1.6 JTT∗ Loss-reweight 91.6±1.491.6±1.4 / 91.9±1.791.9 1.7 56.7±2.556.7±2.5 / 60.1±2.360.1 2.3 88.188.1 / 88.388.3 80.8±3.880.8±3.8 / 80.9±3.880.9 3.8 DFR† Head-retrain 86.8±0.686.8±0.6 / 88.4±0.188.4 0.1 78.1±0.278.1±0.2 / 83.9±1.683.9 1.6 93.393.3 / 93.093.0 91.3±0.591.3±0.5 / 91.4±0.591.4 0.5 DebiAN Loss-reweight 98.1±1.198.1 1.1 / 97.5±0.397.5±0.3 63.7±2.663.7±2.6 / 79.6±2.679.6 2.6 91.091.0 / 93.893.8 80.1±2.480.1±2.4 / 87.9±1.387.9 1.3 GroupDRO† Supervised 74.1±1.274.1±1.2 / 87.5±0.287.5 0.2 74.1±1.274.1±1.2 / 87.5±0.287.5 0.2 94.094.0 / 94.294.2 88.8±1.188.8±1.1 / 89.9±0.589.9 0.5 Waterbirds uses val-WGA model selection (standard benchmark protocol). ∗BFR+JTT uses λ=1λ=1 to avoid gradient conflict with JTT’s 50×50× upweighting on the 300-epoch schedule. Scene and object datasets (Table VI). UrbanCars has the largest reported WGA gain (+26.0+26.0 p for BFR+ERM). On Waterbirds the mean gains are positive, but BFR+JTT is effectively neutral (80.9%80.9\% versus 80.8%80.8\%); the appendix records sensitivity to stronger regularization. The preserved table results characterize the tested pipelines, not a verified single-direction mechanism or universal accuracy preservation. Table IV shows substantial reductions in the targeted centroid statistic in most settings, with the explicit BFR+GroupDRO R50 exception and a Waterbirds JTT residual of 0.0040.004. These are first-moment changes under a fixed reporting convention. Figure 5 is a qualitative visualization of attribute-wise supervised alignment, not proof that all four joint subgroups have identical distributions. The frozen-head and attribute-probe experiments assess practical consequences independently of this loss-aligned statistic. IV-E Comparison with Supervised Methods Since BFR requires spurious attribute labels at training time, it belongs to the same supervised category as GroupDRO [3]. Table VII reports results when BFR is applied on top of GroupDRO directly. The BFR+GroupDRO comparison keeps training-time attribute supervision in both methods and is therefore more informative about the added penalty than comparisons with unannotated baselines. Recorded gains are largest on CelebA-MB (+12.5+12.5 p) and UrbanCars (+13.3+13.3 p). GroupDRO trains the whole model, while BFR imposes an additional centroid constraint; the gains do not establish separate head-only and backbone-only failure modes. TABLE VII: GroupDRO vs. BFR+GroupDRO (3 seeds, mean± ). WGA (%). BFR adds gains to the evaluated supervised GroupDRO baseline. Method CelebA-Std CelebA-Std CelebA-MB UrbanCars (R18) (R50) (R18) (R50) GroupDRO 86.3±0.586.3±0.5 88.0±0.788.0±0.7 55.7±0.555.7±0.5 74.1±1.274.1±1.2 BFR + GroupDRO 88.0±1.588.0 1.5 88.5±0.588.5 0.5 68.3±4.468.3 4.4 87.5±0.287.5 0.2 Δ WGA (p) +1.7+1.7 +0.5+0.5 +12.5+12.5 +13.3+13.3 CelebA-Std uses WGA-based model selection; CelebA-MB and UrbanCars use accuracy-based selection. Waterbirds GroupDRO (88.8±1.188.8±1.1 base, 89.9±0.589.9±0.5 +BFR, Δ+1.1 +1.1 p) is included in Table VI. IV-F Controlled Synthetic-Watermark ImageNet Study CelebA uses demographic attributes, while UrbanCars and Waterbirds use contextual attributes. We separately test a controlled synthetic watermark on ImageNet-1K to assess a known training-time nuisance under matched ERM and BFR training. This is a supervised synthetic-spurious-feature experiment. Setup. The reported experiment injects a watermark into ImageNet-1K training images with probability p=0.5p=0.5 and trains matched ResNet-50 ERM and BFR+ERM models from scratch for 90 epochs. Watermark-related evaluation is motivated by ImageNet-W [25] and SEBRA [27]. Because training includes an explicitly injected, annotated watermark, this is not the canonical evaluation of naturally trained ImageNet models on ImageNet-W. We retain the reported IN-W label for the evaluation split, but make no directly comparable canonical-benchmark or state-of-the-art claim. Table VIII also reports clean validation and four additional shifts. Results. Under this controlled training protocol, IN-W accuracy increases from 52.6%52.6\% to 75.6%75.6\% (+23.0+23.0 p), while clean validation accuracy remains 76.0%76.0\%. The four other reported shifts change by less than 22 p. W-IBMI decreases from 0.1130.113 to <0.001<0.001 and unsigned AblGap from 0.1610.161 to 0.0010.001; these are, respectively, objective-aligned centroid distance and group-asymmetric projection sensitivity, not two independent demonstrations of watermark erasure. The geometry rows contain point summaries without reported per-seed uncertainty, unlike the accuracy rows. The independent accuracy comparison supports utility under this synthetic intervention, but not general improvement on unrelated OOD shifts. TABLE VIII: Controlled synthetic-watermark training on ImageNet-1K, ResNet-50. Accuracy rows retain 3-seed means and standard deviations; IN-W denotes the reported watermark-shift evaluation after injected-watermark training, not a canonical natural-training comparison. Geometry rows retain point summaries: W-IBMI is objective aligned and scale dependent; AblGap is unsigned. Accuracy changes are in p. ERM BFR Δ OOD accuracy (%, ↑ ) Val (ID) 76.0±0.176.0±0.1 76.0±0.176.0±0.1 0.0 +0.0 IN-W 52.6±0.652.6±0.6 75.6±0.175.6 0.1 +23.0+23.0 IN-R 36.2±0.636.2±0.6 36.5±0.236.5±0.2 +0.3+0.3 IN-Stylized 52.1±1.052.1±1.0 53.2±0.553.2±0.5 +1.1+1.1 mixed_same 87.2±0.387.2±0.3 87.3±0.187.3±0.1 +0.1+0.1 mixed_rand 80.7±0.680.7±0.6 81.3±0.581.3±0.5 +0.6+0.6 BiasFlow geometry (↓ ) W-IBMI 0.1130.113 <0.001<0.001 −0.113-0.113 AblGap 0.1610.161 0.0010.001 −0.160-0.160 Implication. The synthetic study provides a matched large-scale example in which BFR improves watermark-shift accuracy while preserving the reported clean accuracy. Canonical ImageNet-W evaluation without synthetic watermark injection, and comparisons with equally supervised representation-level methods, remain separate experiments. IV-G Backbone and Head Contribution Analysis We freeze the converged CelebA-Std ResNet-18 backbones and learn new linear heads. Balanced mode uses group-balanced validation examples with L-BFGS; biased mode uses the standard training distribution with SGD; attribute-probe mode trains an SGD linear classifier on validation features to predict Male and evaluates it on the test set. This is the saved probe implementation, rather than a separately fitted logistic-regression solver. Table IX reports three-seed means, with variability reconstructed from saved per-seed outputs in Appendix G. Balanced and biased modes differ in data and solver, so their difference is a protocol stress test, not a causal decomposition or an optimal-head bound. Balanced mode yields approximately 79–84% WGA across the evaluated backbones under the supplied balancing and solver. This shows useful target signal is available under this protocol; it does not establish the best possible head or representation invariance. Biased mode supplies the principal independent test, since it does not reuse the centroid formula. GroupDRO’s frozen backbone yields 40.7%40.7\% WGA with a fresh biased head despite 86.3%86.3\% with its original head. BFR+GroupDRO yields 64.1%64.1\% with the fresh biased head, a 23.423.4 p gain over GroupDRO, while BFR+LfF gains 15.215.2 p over LfF. The strongest increment is therefore GroupDRO, not LfF. Other increments include the smaller DFR change (42.2%42.2\% to 44.4%44.4\%). The results support reduced susceptibility to this particular head-training procedure. Changes in optimization, margins, and available task signal can also affect WGA, so the original-head drop is not pure head compensation or a causal attribution to Male. Attribute-probe mode finds Male test accuracy of roughly 90–93% for the base backbones, and lower accuracy after BFR. However, Male remains recoverable: BFR+ERM, BFR+JTT, BFR+DFR, and BFR+GroupDRO obtain 80.0%80.0\%, 86.6%86.6\%, 67.5%67.5\%, and 72.2%72.2\%. We report differences descriptively without a statistical-equivalence claim. Raw accuracy is affected by label imbalance, class correlation, and probe optimization; a class-balanced or class-conditional test would more directly separate residual encoding from composition. Attribute availability to a new probe does not show that the original classifier uses it. TABLE IX: Frozen-backbone stress tests on CelebA-Std (R18), three-seed means. Biased WGA is test WGA of a fresh SGD task head fitted on biased training features. Male Probe is test accuracy of an SGD linear attribute classifier fitted on validation features. Each pair is base / +BFR; bold marks higher WGA or lower attribute-probe accuracy. Lower probe accuracy indicates reduced recoverability under this protocol, not certified erasure. Per-seed variability is in Appendix G. Method Paradigm Biased WGA (↑ ) Male Probe (↓ ) (base / +BFR) (base / +BFR) ERM Baseline 40.040.0 / 44.644.6 93.293.2 / 80.080.0 LfF Loss-rewt. 44.844.8 / 60.060.0 90.690.6 / 61.461.4 JTT Loss-rewt. 36.536.5 / 42.242.2 93.493.4 / 86.686.6 DFR Head-retrain 42.242.2 / 44.444.4 91.991.9 / 67.567.5 DebiAN Loss-rewt. 45.445.4 / 52.652.6 92.892.8 / 65.265.2 GroupDRO Supervised 40.740.7 / 64.164.1 92.592.5 / 72.272.2 V Discussion and Analysis WGA and backbone geometry are decoupled. A predictor’s WGA and the performance of a new head on its frozen backbone characterize different evaluation procedures. GroupDRO’s 86.3%86.3\% original-head WGA and 40.7%40.7\% biased-head WGA illustrate this distinction; BFR+GroupDRO increases the latter to 64.1%64.1\%. This supports reporting fresh-head stress tests alongside outcome metrics. Continued-training and Smiling-transfer results are mixed and do not certify robustness under arbitrary fine-tuning, tasks, or shifts. Alignment differences do not establish a mechanism. LfF and DebiAN have higher reported pooled IBMI than ERM in several configurations. This can reflect changes in class geometry, attribute variation, or the model-specific axis. The audit does not isolate those explanations or show that reweighting intrinsically worsens representations. Stronger representation-level baselines and fixed or conditional axes are needed to assess this question. Backbone geometry scales to large benchmarks. The controlled synthetic-watermark experiment supports the utility of the supervised penalty under matched large-scale training: watermark-shift accuracy improves by 23.023.0 p, with clean accuracy unchanged at the reported precision. Its deliberately altered training protocol limits comparison with canonical ImageNet-W results. The small changes on four other shifts do not establish general OOD robustness. Metric scope and limitations. IBMI measures centroid alignment, W-IBMI measures a scale-dependent centroid penalty, and AblGap measures asymmetric sensitivity to projection. They do not measure total attribute information or certify fairness. Class-composition confounding applies to IBMI and projection sensitivity even before intervention. Low W-IBMI does not imply linear unrecoverability, as the Male probes demonstrate. Interference-like negative projection drops and diagnostic mode selection are not experimentally validated here. BFR requires all targeted attribute labels; attribute-wise penalties do not guarantee joint invariance. Detached EMA fallback can become stale and gives no gradient for absent groups when both centroids come from memory. Rare-group sampling, EMA sensitivity, balanced independent probes, and normalized geometry remain untested. Model-selection differences and baseline reproduction gaps restrict comparative claims. The strongest independent evidence is same-task biased-head resistance; cross-task utility and information preservation must be evaluated for each target task. BiasFlow combines lightweight centroid diagnostics with projection sensitivity and fresh-head evaluation. The retained experiments show that WGA alone does not determine frozen-backbone behavior under biased head retraining. BFR, a supervised class-conditional centroid-alignment penalty related to existing representation-learning work, improves or preserves the reported mean WGA across the evaluated configurations and improves biased-head WGA most clearly for GroupDRO on CelebA-Std. W-IBMI verifies the optimized first-moment discrepancy, while probes show reduced but persistent attribute recoverability. The synthetic-watermark ImageNet study supports a matched nuisance intervention rather than canonical ImageNet-W superiority. Representation-level baseline comparisons, controlled metric validation, consistent checkpoint selection, rare-group analysis, and broader transfer evaluation remain necessary to substantiate stronger claims. Appendix: Additional Methods and Stress Tests Appendix A Additional BFR Variants The main paper uses BFR-inv as the geometric regularization penalty, defined as Linv=1C∑c=1C‖μ(y=c,s=1)−μ(y=c,s=0)‖2d,L_inv\;=\; 1C _c=1^C \|μ(y=c,s=1)-μ(y=c,s=0)\|^2d, (S1) which collapses within-class spurious centroid separation in the backbone feature space (d is the feature dimension). We also developed two alternative variants, BFR-orth and BFR-spectral, that target different aspects of backbone spurious geometry. Their definitions are included here for completeness, and a head-to-head WGA comparison against BFR-inv follows in Section B. A.1 Orthogonality Loss (BFR-orth) The orth mode is the most lightweight geometric intervention. It penalizes the alignment between the class-discriminative direction (dcls=μ(y=1)−μ(y=0)d_cls=μ(y=1)-μ(y=0)) and the spurious direction (dspur=μ(s=1)−μ(s=0)d_spur=μ(s=1)-μ(s=0)): Lorth=cos2(dcls,dspur)=(⟨dcls,dspur⟩‖dcls‖⋅‖dspur‖)2.L_orth\;=\; ^2(d_cls,d_spur)\;=\; ( d_cls,d_spur \|d_cls\|·\|d_spur\| )^2\,. (S2) Mechanism and scope. BFR-orth penalizes pooled centroid-direction alignment. Because the attribute direction can include class-composition effects, minimizing this quantity may also suppress useful target geometry. The reported ablation does not establish a regime-selection rule or a general preference for this mode in multi-attribute settings. A.2 Spectral Variance Loss (BFR-spectral) Unlike orth (which only targets class-boundary alignment) and inv (which targets class-conditional centroids), the spectral mode penalizes the fraction of total feature variance that aligns with the spurious direction: Lspectral=Var(z⋅wspur)Vartotal(z),L_spectral\;=\; Var(z· w_spur)Var_total(z)\,, (S3) where Vartotal(z)Var_total(z) is the total per-sample variance after mean-centering. Mechanism and scope. BFR-spectral penalizes variance along the estimated attribute-associated direction. Its empirical failures in the mode ablation show that removing such variance can damage target prediction. It has no demonstrated interference-removal guarantee. Appendix B BFR Regularization Mode Ablation BFR regularization mode. Table S1 compares the three BFR regularization modes on CelebA-Std R18 (seed=1). inv strictly dominates orth and spectral on WGA across all methods. orth only requires the class-boundary direction to be orthogonal to the spurious axis, leaving within-class spurious information intact; a linear head trained on biased data can still find and exploit this information through other feature directions. inv directly collapses within-class spurious structure, preventing any head from exploiting it regardless of training signal. spectral achieves the strongest IBMI reduction (ERM IBMI=0.025) but over-suppresses feature variance along the spurious direction, inadvertently removing discriminative information and hurting WGA. TABLE S1: BFR mode ablation on CelebA-Std R18, seed=1, λ=20λ=20. WGA (%). Bold: best per method. Mode ERM LfF JTT DFR DebiAN Baseline (no BFR) 38.3 50.9 75.7 79.6 66.5 orth 37.8 62.8 76.9 78.3 66.1 spectral 39.5 40.0 0.6 38.3 46.7 inv 61.1 82.8 78.8 81.1 77.2 Appendix C λ Sensitivity for BFR-inv The one-seed mode ablation favors inv for the tested CelebA-Std setup. Table S2 varies λ for this mode. ERM improves through λ=30λ=30, while LfF, DFR, and DebiAN peak at 20 in this sweep. JTT is sensitive to stronger penalties: at λ=30λ=30, the accuracy-selected checkpoint has zero WGA, while a WGA-selected checkpoint reaches 73.9%73.9\%. This is a checkpoint-selection issue as well as a regularization sensitivity result; the experiment does not isolate a gradient-conflict mechanism. We retain the empirical defaults of 20 for most methods and 1 for JTT, including the near-neutral Waterbirds comparison (80.9±3.8%80.9± 3.8\% versus 80.8±3.8%80.8± 3.8\%). These settings are not a universally validated tuning rule. TABLE S2: λ sensitivity for BFR-inv on CelebA-Std R18, seed=1. WGA (%), accuracy-based model selection. Bold: selected value per method. ∗Accuracy-selected checkpoint has WGA==0; WGA-selected checkpoint achieves 73.973.9. Method λ=5λ=5 λ=10λ=10 λ=20λ=20 λ=30λ=30 Trend ERM 48.9 55.6 61.1 64.4 ↑ monotone LfF 82.2 82.2 82.8 80.0 peaked at 20 JTT 78.8 78.6 76.1 0.0∗0.0^* ↓ , collapses at 30 DFR 75.6 79.4 81.1 77.2 peaked at 20 DebiAN 66.1 71.7 77.2 46.7 peaked at 20 Selected λ: 1 for JTT; 20 for all others. Appendix D Continued-Training Durability We further evaluate whether the WGA obtained by each method remains useful after ordinary training pressure is resumed. Starting from each converged checkpoint, we continue standard ERM training for 30 epochs on the original biased CelebA-Std training set and the original Blond classification task. This protocol is a durability test for the learned representation: if a method mainly changes the final decision rule while leaving shortcut structure available in the backbone, continued ERM training can again favor that structure. Table S3 reports WGA at the starting checkpoint and after 30 epochs. BFR gives higher checkpoint WGA for every base method and higher final WGA for five of the six methods. The clearest case is DFR, where the final WGA after continued training is 63.5%63.5\% with BFR compared with 43.7%43.7\% without BFR. BFR also yields higher final WGA for ERM, JTT, DebiAN, and GroupDRO, while BFR-LfF remains comparable but slightly lower than LfF. Figure S1 shows the full 30-epoch trajectory. We use this result as supporting evidence for durability rather than as the primary BFR claim: BFR most strongly improves retained WGA when paired with DFR, consistent with the view that geometric regularization is most useful when the downstream procedure would otherwise rely on a head-level correction over a contaminated backbone. TABLE S3: Continued-training durability on CelebA-Std: WGA (%) after standard ERM continuation on the original Blond classification task and biased training distribution. Each metric is reported as base / +BFR. Bold marks the higher WGA within each pair. Method Initial WGA (base / +BFR) Final WGA (base / +BFR) ERM 43.9±1.243.9± 1.2 / 54.6± 2.6 40.9±2.740.9± 2.7 / 42.6± 1.1 LfF 58.7±2.158.7± 2.1 / 61.7± 2.3 46.9± 0.3 / 46.1±2.146.1± 2.1 JTT 81.1±0.481.1± 0.4 / 82.2± 0.5 42.8±2.042.8± 2.0 / 44.8± 2.1 DFR 80.6±2.580.6± 2.5 / 81.9± 1.0 43.7±3.343.7± 3.3 / 63.5± 12.7 DebiAN 64.4±3.264.4± 3.2 / 65.4± 5.3 43.7±3.643.7± 3.6 / 45.7± 2.5 GroupDRO 86.3±0.586.3± 0.5 / 88.0± 1.5 42.6±2.742.6± 2.7 / 44.4± 0.5 Fig. S1: WGA over 30 epochs of ERM continuation from each method’s converged checkpoint on the original CelebA-Std Blond classification task. BFR-DFR reaches 63.5%63.5\% final WGA, substantially above DFR without BFR, indicating stronger retained WGA after continued training. Appendix E Cross-Task Transfer Stress Test As an auxiliary stress test, we ask whether the backbone change reported in the main paper’s frozen-head probing analysis carries over to a different CelebA task. This experiment is not intended as the primary evidence for BFR’s backbone-level effect; the main evidence is the same-task frozen-head and Male-probe result. Here, we freeze the Blond/Male-trained backbone and train a fresh linear head on Smiling prediction using the standard biased downstream training data. This setting is deliberately outside the direct target of BFR. BFR suppresses the Male-aligned structure learned for Blond classification, whereas Smiling is a different target for which Male-correlated visual structure may be partially useful rather than purely spurious. Therefore, the appropriate interpretation is not that BFR should improve every cross-task metric. Instead, the experiment tests whether reducing the targeted spurious axis can improve downstream group balance when that axis is reused as a shortcut, and where this benefit stops when the new task uses related information. Table S4 therefore reports biased-head transfer metrics directly, rather than a difference between two WGA values from different head-training protocols. We include overall accuracy, mean group accuracy across the four Smiling/Male groups, WGA, and group disparity. This avoids making the conclusion depend on a gap between two worst-group statistics. BFR+GroupDRO improves the reported Smiling-transfer metrics: overall accuracy 80.4%80.4\% to 82.4%82.4\%, mean group accuracy 79.8%79.8\% to 82.1%82.1\%, WGA 74.0%74.0\% to 79.6%79.6\%, and disparity 9.5%9.5\% to 5.5%5.5\%. ERM also improves across these metrics, whereas DFR trades lower overall accuracy for better WGA. LfF, JTT, and DebiAN have lower transferred WGA with BFR. This mixed result defines the tested scope and does not establish a causal explanation for the gains or a universal transfer benefit. TABLE S4: Cross-task transfer to Smiling prediction with the Blond/Male backbone frozen and a fresh biased downstream head trained on standard Smiling data. Acc is overall accuracy; Mean Group Acc averages the four Smiling/Male groups; Group Disparity is the best-group minus worst-group accuracy. 3 seeds, mean± . Each metric is reported as base / +BFR, and bold marks the better value within each pair. Method Paradigm Acc (↑ ) Mean Group Acc (↑ ) WGA (↑ ) Group Disparity (↓ ) ERM Baseline 81.1±0.581.1± 0.5 / 81.9± 0.8 80.3±0.580.3± 0.5 / 81.2± 0.8 74.2±0.574.2± 0.5 / 76.9± 1.3 10.4±0.410.4± 0.4 / 6.5± 0.5 LfF Loss-rewt. 77.8± 2.1 / 77.1±4.677.1± 4.6 77.1± 2.1 / 76.5±4.676.5± 4.6 71.0± 1.5 / 70.2±6.370.2± 6.3 10.9± 0.2 / 11.9±2.411.9± 2.4 JTT Loss-rewt. 80.1± 0.4 / 79.4±0.379.4± 0.3 79.2± 0.4 / 78.3±0.378.3± 0.3 71.3± 0.5 / 68.0±0.468.0± 0.4 13.1± 0.7 / 16.6±0.916.6± 0.9 DFR Head-retrain 80.1± 0.3 / 78.6±0.678.6± 0.6 79.3± 0.4 / 78.1±0.678.1± 0.6 72.7±0.672.7± 0.6 / 73.5± 1.1 10.8±0.210.8± 0.2 / 7.1± 1.6 DebiAN Loss-rewt. 80.2± 2.1 / 75.7±5.775.7± 5.7 79.4± 2.2 / 75.2±5.875.2± 5.8 72.9± 2.6 / 69.5±9.769.5± 9.7 11.3±0.811.3± 0.8 / 10.9± 6.4 GroupDRO Supervised 80.4±0.480.4± 0.4 / 82.4± 0.3 79.8±0.479.8± 0.4 / 82.1± 0.4 74.0±0.774.0± 0.7 / 79.6± 0.3 9.5±0.39.5± 0.3 / 5.5± 0.4 Appendix F Attribute Selectivity Analysis Setup. All experiments in this subsection use models trained on CelebA-Std for the Blond Hair classification task, with Male as the spurious attribute that BFR is instructed to suppress. After training, we freeze the backbone and train lightweight linear probes on the frozen features to predict a range of other CelebA attributes. These attributes were never part of the training objective and were not the spurious axis BFR was instructed to suppress. This design isolates the question: does BFR primarily suppress the Male representational axis, or does it degrade the backbone’s encoding of unrelated attributes as well? If BFR is targeted, probes for attributes with low correlation to Male (|r|≈0|r|≈0) should be unaffected, while probes for attributes that share geometric structure with Male (|r|→1|r|→1) should degrade proportionally, since reducing the Male axis can also reduce whatever signal those attributes were borrowing from it. A centroid penalty may change information useful for other tasks. We examine alternative groupings and probes for attributes with different label correlations to Male. These correlations are observational descriptors and do not identify orthogonal feature subspaces. Alternative evaluation groups. On the original Blond task, the recorded BFR-DFR and BFR-GroupDRO comparisons are within approximately 11 p under Young, Heavy_Makeup, Attractive, and Wearing_Lipstick grouping. This tests the existing predictor under alternative group definitions; it does not show that those attributes remain equally encoded. Separate attribute probes in Table S5 show losses for several of these attributes. Attribute correlation spectrum. We train linear probes for 12 CelebA attributes on the frozen backbone, spanning |r|=0.013|r|=0.013 (Narrow_Eyes, geometrically independent of Male) to |r|=1.000|r|=1.000 (Male itself, the spurious axis BFR regularizes against), and report each method’s per-attribute probe accuracy for both the Base and the +BFR backbone (Table S5). TABLE S5: Attribute correlation spectrum on CelebA-Std with ResNet-18, averaged over 3 seeds. Backbones are trained for Blond Hair classification with Male as the BFR-targeted spurious attribute, then frozen for linear-probe evaluation across 12 CelebA attributes sorted by |r(attr,Male)||r(attr,\,Male)|. Each method reports Base (no BFR) / +BFR / Δ (BFR−-Base). The bottom row reports Spearman ρ between |r||r| and probe accuracy; bold marks the more selective Base/+BFR value within each method. ERM LfF JTT DFR DebiAN GroupDRO Attribute |r||r| Base +BFR Δ Base +BFR Δ Base +BFR Δ Base +BFR Δ Base +BFR Δ Base +BFR Δ Narrow_Eyes .013 85.3 85.3 −0.0-0.0 85.1 85.1 +0.0+0.0 85.2 85.1 −0.1-0.1 85.1 85.1 +0.0+0.0 85.1 85.1 −0.0-0.0 85.3 85.1 −0.2-0.2 Blurry .026 95.5 95.1 −0.4-0.4 95.2 94.9 −0.3-0.3 95.6 95.0 −0.5-0.5 95.4 94.9 −0.4-0.4 95.3 95.0 −0.3-0.3 95.5 94.9 −0.5-0.5 Straight_Hair .063 81.2 79.7 −1.5-1.5 79.9 79.0 −0.9-0.9 81.5 79.5 −2.0-2.0 80.3 79.0 −1.2-1.2 80.1 79.0 −1.1-1.1 81.3 79.4 −1.9-1.9 Pale_Skin .076 96.0 95.8 −0.2-0.2 95.9 95.8 −0.1-0.1 96.0 95.8 −0.2-0.2 95.9 95.8 −0.1-0.1 96.0 95.8 −0.2-0.2 96.0 95.8 −0.2-0.2 Mouth_Open .100 74.7 75.4 +0.7+0.7 68.2 62.9 −5.3-5.3 74.3 69.6 −4.7-4.7 73.2 65.7 −7.4-7.4 74.3 61.2 −13.2-13.2 74.2 73.9 −0.3-0.3 Brown_Hair .109 85.7 85.1 −0.7-0.7 85.6 82.2 −3.4-3.4 86.4 84.8 −1.5-1.5 84.8 82.2 −2.5-2.5 86.0 82.7 −3.3-3.3 85.8 85.5 −0.3-0.3 Black_Hair .111 85.5 82.8 −2.8-2.8 82.9 74.8 −8.1-8.1 86.1 82.0 −4.2-4.2 83.0 73.1 −9.9-9.9 85.0 77.2 −7.8-7.8 85.9 82.5 −3.4-3.4 Attractive .302 78.1 72.6 −5.6-5.6 77.1 64.4 −12.7-12.7 78.0 73.4 −4.6-4.6 77.2 64.0 −13.2-13.2 77.7 65.3 −12.4-12.4 77.6 68.7 −8.9-8.9 Young .440 83.9 81.2 −2.7-2.7 82.6 76.4 −6.3-6.3 83.2 80.2 −3.0-3.0 83.1 75.9 −7.2-7.2 83.5 77.6 −5.9-5.9 83.7 80.1 −3.6-3.6 Heavy_Makeup .681 86.5 76.7 −9.8-9.8 84.3 63.8 −20.5-20.5 86.4 79.1 −7.3-7.3 85.3 64.5 −20.8-20.8 86.2 65.5 −20.7-20.7 85.5 70.2 −15.3-15.3 Wearing_Lipstick .789 89.2 76.6 −12.5-12.5 87.6 58.0 −29.6-29.6 89.3 81.0 −8.2-8.2 87.6 59.4 −28.2-28.2 89.2 61.8 −27.5-27.5 88.4 67.8 −20.6-20.6 Male (spurious) 1.00 93.2 80.0 −13.2-13.2 90.6 61.4 −29.2-29.2 93.4 86.6 −6.9-6.9 91.9 67.4 −24.5-24.5 92.8 65.2 −27.6-27.6 92.5 72.2 −20.3-20.3 Spearman ρ(|r|,acc)ρ(|r|,acc) +0.12+0.12 −0.53-0.53 −0.65-0.65 −0.01-0.01 −0.80-0.80 −0.79-0.79 +0.11+0.11 −0.26-0.26 −0.37-0.37 +0.06+0.06 −0.75-0.75 −0.81-0.81 +0.08+0.08 −0.69-0.69 −0.77-0.77 +0.08+0.08 −0.71-0.71 −0.79-0.79 Male probe accuracy measures recoverability under the fitted linear probe, not use by the original Blond classifier. BFR lowers this accuracy but does not make Male linearly unrecoverable in the reported tests. The study therefore evaluates partial suppression and retained utility, not perfect erasure. Low label correlation with Male also does not establish an orthogonal feature subspace or equal task difficulty. We retain Spearman correlations between attribute–Male label correlation and raw attribute-probe accuracy as descriptive summaries. They shift from [−0.01,+0.12][-0.01,+0.12] for base backbones to [−0.80,−0.26][-0.80,-0.26] with BFR. These raw accuracies depend on attribute prevalence and task difficulty, so the rank correlations alone do not prove selective feature removal or reveal a geometrically isolated Male axis. The paired per-attribute changes are more informative about the limits of the intervention. BFR-JTT has the smallest recorded correlation change (Δρ=−0.37 ρ=-0.37), while several stronger variants have larger shifts. The table also shows important collateral losses on weakly Male-correlated tasks, including Mouth_Open (up to 13.213.2 p lower) and Black_Hair (up to 9.99.9 p lower). These negative results restrict claims of information preservation. Averaging or rank summaries do not eliminate those losses. Fig. S2: Attribute-probe accuracy differences relative to ERM vs. absolute label correlation with Male, for BFR-DFR and BFR-GroupDRO. The saved plotting source uses ERM as the reference for both curves; this is not the paired BFR-minus-corresponding-base comparison in Table S5. Larger losses occur for several Male-correlated attributes, with exceptions and collateral losses at low correlation. The plot does not isolate the within-method effect of BFR or establish a distinct erased subspace. Appendix G Frozen-Backbone Probe Details This table reconstructs means and sample standard deviations from the saved per-seed JSON outputs (seeds 1, 245, 392) for the experiments already reported in the main paper. It adds no new training or evaluations. All backbones remain fixed. The task heads use SGD on biased training features or L-BFGS on balanced validation features; the Male probe uses SGD on validation features and test evaluation. Separate backbone paths are recorded for base DFR and ERM, so these are not a shared-checkpoint identity test. Raw attribute accuracy is not corrected for label prevalence. Three seeds provide limited uncertainty characterization and no significance or equivalence test is claimed. TABLE S6: Existing frozen-backbone probe results, mean ± sample standard deviation over three seeds, percentages. Each pair is base / +BFR. Balanced WGA is included as a protocol check, not an optimal-head bound. Method Biased test WGA Male test accuracy Balanced test WGA ERM 40.0±1.540.0± 1.5 / 44.6±5.344.6± 5.3 93.2±0.193.2± 0.1 / 80.0±0.180.0± 0.1 83.3±2.983.3± 2.9 / 81.3±5.081.3± 5.0 LfF 44.8±5.244.8± 5.2 / 60.0±3.560.0± 3.5 90.6±2.590.6± 2.5 / 61.4±7.161.4± 7.1 80.2±4.580.2± 4.5 / 82.6±2.682.6± 2.6 JTT 36.5±2.236.5± 2.2 / 42.2±0.642.2± 0.6 93.4±0.393.4± 0.3 / 86.6±0.486.6± 0.4 81.3±1.381.3± 1.3 / 79.6±1.879.6± 1.8 DFR 42.2±1.042.2± 1.0 / 44.4±3.644.4± 3.6 91.9±0.291.9± 0.2 / 67.5±1.167.5± 1.1 80.2±3.980.2± 3.9 / 79.8±0.679.8± 0.6 DebiAN 45.4±0.645.4± 0.6 / 52.6±2.752.6± 2.7 92.8±1.192.8± 1.1 / 65.2±8.965.2± 8.9 80.0±2.980.0± 2.9 / 79.6±0.879.6± 0.8 GroupDRO 40.7±2.540.7± 2.5 / 64.1±3.564.1± 3.5 92.5±0.192.5± 0.1 / 72.2±2.772.2± 2.7 81.3±2.281.3± 2.2 / 84.4±6.284.4± 6.2 References [1] R. Geirhos, J. Jacobsen, C. Michaelis, M. Zeiler, W. Brendel, M. Bethge, and F. A. Wichmann (2020) Shortcut learning in deep neural networks. Nature Machine Intelligence 2 (11), p. 665–673. Cited by: §I, §I. [2] Z. Liu, P. Luo, X. Wang, and X. Tang (2015) Deep learning face attributes in the wild. In International Conference on Computer Vision (ICCV), p. 3730–3738. Cited by: §I, §IV-A. [3] S. Sagawa, P. W. Koh, T. B. Hashimoto, and P. Liang (2020) Distributionally robust neural networks for group shifts: on the importance of regularization for worst-case generalization. In International Conference on Learning Representations (ICLR), Cited by: §I, §I, §I-A, §IV-A, §IV-D, §IV-E, footnote 1. [4] J. Nam, H. Cha, S. Ahn, J. Lee, and J. Shin (2020) Learning from failure: training debiased classifier from biased classifier. In Advances in Neural Information Processing Systems (NeurIPS), Vol. 33, p. 20673–20684. Cited by: §I, §I-A. [5] E. Z. Liu, B. Haghgoo, A. S. Chen, A. Raghunathan, P. W. Koh, S. Sagawa, P. Liang, and C. Finn (2021) Just train twice: improving group robustness without training group information. In International Conference on Machine Learning (ICML), p. 6781–6792. Cited by: §I, §I-A. [6] P. Kirichenko, P. Izmailov, and A. G. Wilson (2023) Last layer re-training is sufficient for robustness to spurious correlations. In International Conference on Learning Representations (ICLR), Cited by: §I, §I, §I-A. [7] Z. Li, A. Hoogs, and C. Xu (2022) Discover and mitigate unknown biases with debiasing alternate networks. In European Conference on Computer Vision (ECCV), Cited by: §I, §I-A. [8] B. Kang, S. Xie, M. Rohrbach, Z. Yan, A. Gordo, J. Feng, and Y. Kalantidis (2020) Decoupling representation and classifier for long-tailed recognition. In International Conference on Learning Representations, Cited by: §I. [9] H. Zhao, A. Coston, T. Adel, and G. J. Gordon (2020) Conditional learning of fair representations. In International Conference on Learning Representations, External Links: Link Cited by: §I, §I-C. [10] M. Zhang, N. S. Sohoni, H. R. Zhang, C. Finn, and C. Ré (2022) Correct-n-contrast: a contrastive approach for improving robustness to spurious correlations. In Proceedings of the 39th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 162, p. 26484–26516. External Links: Link Cited by: §I, §I-C. [11] S. Park, J. Kim, H. Lee, S. Yoo, and K. Song (2026) Spurious correlation-aware embedding regularization for worst-group robustness. In International Conference on Learning Representations, External Links: Link Cited by: §I, §I-C. [12] M. Arjovsky, L. Bottou, I. Gulrajani, and D. Lopez-Paz (2019) Invariant risk minimization. arXiv preprint arXiv:1907.02893. Note: Introduces Colored MNIST Cited by: §I-A. [13] S. H. Jo, S. Kim, and M. Chae (2026) Mitigating spurious correlation via distributionally robust learning with hierarchical ambiguity sets. In International Conference on Learning Representations (ICLR), Cited by: §I-A. [14] H. Yao, Y. Wang, S. Li, L. Zhang, J. Zou, and C. Finn (2022) Improving out-of-distribution robustness via selective augmentation. In International Conference on Machine Learning (ICML), Cited by: §I-A. [15] J. Kang, Y. Zhu, Y. Xia, J. Luo, and H. Tong (2022) InfoFair: information-theoretic intersectional fairness. arXiv preprint arXiv:2212.14453. Cited by: §I-B. [16] G. Gowri, X. Lun, A. M. Klein, and P. Yin (2024) Approximating mutual information of high-dimensional variables using learned representations. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §I-B. [17] Z. Zhou, D. A. Tarzanagh, B. Hou, B. Tong, J. Xu, Y. Feng, Q. Long, and L. Shen (2023) Fair canonical correlation analysis. In Advances in Neural Information Processing Systems (NeurIPS), Vol. 36. Cited by: §I-B. [18] E. Frolov and I. Oseledets (2019) Quantifying the alignment of graph and features in deep learning. IEEE Transactions on Signal and Information Processing over Networks 6, p. 127–136. Cited by: §I-B. [19] C. Guerner, T. Liu, A. Svete, A. Warstadt, and R. Cotterell (2023) A geometric notion of causal probing. arXiv preprint arXiv:2307.15054. Cited by: §I-B. [20] B. Kim, H. Kim, K. Kim, S. Kim, and J. Kim (2019) Learning not to learn: training deep neural networks with biased data. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 9012–9020. External Links: Link Cited by: §I-C. [21] E. Tartaglione, C. A. Barbano, and M. Grangetto (2021) EnD: entangling and disentangling deep representations for bias correction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, External Links: Link Cited by: §I-C. [22] N. Belrose, D. Schneider-Joseph, S. Ravfogel, R. Cotterell, E. Raff, and S. Biderman (2023) LEACE: perfect linear concept erasure in closed form. In Advances in Neural Information Processing Systems, Vol. 36. External Links: Link Cited by: §I-C. [23] R. A. Fisher (1936) The use of multiple measurements in taxonomic problems. Annals of Eugenics 7 (2), p. 179–188. Cited by: §I-A. [24] K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), p. 770–778. Cited by: §IV-A. [25] Z. Li, I. Evtimov, A. Gordo, C. Hazirbas, T. Hassner, C. C. Ferrer, C. Xu, and M. Ibrahim (2023) A whac-a-mole dilemma: shortcuts come in multiples where mitigating one amplifies others. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 20071–20082. External Links: Document Cited by: §IV-A, §IV-F. [26] O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. S. Bernstein, A. C. Berg, and L. Fei-Fei (2015) ImageNet large scale visual recognition challenge. International Journal of Computer Vision 115 (3), p. 211–252. External Links: Document Cited by: §IV-A. [27] A. Kappiyath, A. Chaudhuri, A. K. Jaiswal, Z. Liu, Y. Li, X. Zhu, and L. Yin (2025) SEBRA: debiasing through self-guided bias ranking. In International Conference on Learning Representations (ICLR), Cited by: §IV-F.