Ulrich Aivodji

Eliott Baltz

Master's Research - École de technologie suprérieure

eliott.baltz@mila.quebec

Zahra Batool

Postdoctorate - École de technologie suprérieure

zahra.batool@mila.quebec

chayma.benabdeljelil@mila.quebec

Chayma Ben Abdeljelil

Master's Research - École de technologie suprérieure

Meghana Bhange

PhD - École de technologie suprérieure

Co-supervisor :

meghana.bhange@mila.quebec

Collaborating researcher - Simon Fraser University

ayana.hussain@mila.quebec

Google Scholar

Patrik Kenfack

PhD - École de technologie suprérieure

Co-supervisor :

patrik.kenfack@mila.quebec

Website

eirini.angeloudi@mila.quebec

Google Scholar

Killijian Marc-Olivier

Independent visiting researcher - UQAM

Louis Tremblay Thibault

PhD - École de technologie suprérieure

louis.tremblay-thibault@mila.quebec

Website

Yingke Wang

Collaborating researcher - University of Waterloo

yingke.wang@mila.quebec

Itai Zehavi

Research Intern - École de technologie suprérieure (ÉTS)

itai.zehavi@mila.quebec

Publications

Quantifying the Privacy of Counterfactuals by Leveraging Membership Inference Attacks Against Synthetic Data

Maryam Babaei

Yingke Wang

Hadrien Lautraite

Héber H. Arcolezi

Sébastien Gambs

Counterfactuals are typically used in high-stakes decision areas to explain a machine learning model by showing how changes to the user prof… (see more)iles result in the desired outcome. However, explaining the model's decisions through counterfactuals can also be exploited by an adversary to conduct privacy attacks against the model or its training data. Drawing on the analogy that counterfactuals provide realistic substitutes for real training data, similar to synthetic data, we demonstrate in this paper how it is possible to successfully perform privacy attacks on counterfactuals by drawing on the attacks developed against synthetic data. More precisely, we investigate the effectiveness of the membership inference attacks designed for synthetic data on various types of counterfactuals. Additionally, while existing membership inference attacks against counterfactuals usually require to be able to query the model, we show how it is possible to perform successful membership inference attacks using only a set of counterfactuals, with no access to the model from which they are generated. Our results demonstrate that model developers should be more cautious when releasing counterfactuals to various users, as it can lead to a privacy breach.

2026-06-24

ACM Conference on Fairness, Accountability, and Transparency (published)

arxiv.org

Discovering Latent Groups for Robust Classification

Ankur Garg

Vincent Michalski

Machine learning models exploit spurious correlations, achieving high average accuracy but failing disproportionately on underrepresented su… (see more)bgroups. Existing methods address this by adjusting network parameters, guided either by subgroup annotations or inferred pseudo-group labels. Yet at inference, these methods produce only a class prediction, with no insight into a sample's latent subgroup. We propose neural classification trees (NCT), a framework that achieves robustness by encoding subgroup structure in its tree-shaped architecture. By routing each sample to an "easy" or "hard" node of this tree -- based on prediction correctness -- and reusing these routes as pseudo-labels for the next iteration, NCT disentangles conflicting subgroups, without requiring subgroup supervision. We evaluate NCT on five benchmarks spanning binary and multi-class spurious correlations. Our experiments show that the learned tree topology provides strong interpretability by consistently isolating minority subgroups, which provides a transparent mapping between the model architecture and the data's latent group structure, while yielding competitive robustness with state-of-the-art methods.

2026-06-21

arXiv (preprint)

arxiv.org

IDP-Bench: Benchmarking ability of LLMs to protect personal information in interdependent privacy contexts

Ayana Hussain

Soumya Sharma

Golnoosh Farnadi

Nicholas Vincent

Héber Hwang Arcolezi

Large language models (LLMs) are becoming widely deployed as personal AI assistants with access to sensitive user data, making privacy a maj… (see more)or challenge for their design and evaluation. Prior work focuses mainly on individual-level risks, overlooking \textbf{interdependent privacy (IDP)}--where one person's data may be revealed by others without their knowledge or consent. We address this gap by introducing \textbf{IDP-Bench}: the first LLM benchmark for IDP scenarios, grounded in the Contextual Integrity (CI) framework. We evaluate eight open-source LLMs on their understanding of IDP scenarios across three levels of IDP reasoning using two LLM judges. Results show strong co-ownership recognition (6/8 models exceed 90\%) but persistent weaknesses in identifying CI parameters (information attribute, primary subject) and IDP-specific parameters such as secondary subjects, where 7/8 models score below 74\%. Models also struggle to judge sharing appropriateness (5/8 scoring below 77\%). While the ability to judge the appropriateness of sharing improves with scale, performance tends to decline in smaller models, and prompt sensitivity remains high on IDP-specific questions--highlighting the need for more targeted study of IDP in LLM privacy research. Data \& code available \href{https://github.com/tisl-lab/Interdependent_Privacy_Bench}{here}.

2026-06-05

arXiv (preprint)

arxiv.org

Training Fair Tabular Foundation Models

Patrik Kenfack

Jesse C. Cresswell

Anthony L. Caterini

Tabular Foundation Models (TFMs) have emerged as leading methods for tabular predictive tasks, leveraging in-context learning to predict on … (see more)new data without task-specific training. Despite the increased use of TFMs in high-stakes decision-making, their fairness properties remain largely unexplored. In this work, we incorporate fairness constraints directly into TFM training, enabling fair predictions in a single forward pass. Our approach addresses two key challenges: limited access to sensitive attributes in training data, and the incompatibility of existing fairness techniques with the in-context learning paradigm. We propose \ftfm{}, a scalable training strategy based on synthetic fairness tasks and a fairness-aware architecture using a gradient reversal layer, which encourages the model to learn representations invariant to sensitive attributes. Experiments on 120 fairness tasks show consistent improvements in fairness while maintaining competitive accuracy.

2026-05-24

FMSD @ International Conference on Machine Learning (oral)

openreview.net

Model Stealing Through the Lens of Model Multiplicity

Eliott Baltz

Satoshi Hara

Model stealing attacks, where adversaries create high-fidelity surrogate models, are a significant threat to the intellectual property of ma… (see more)chine learning services. Conventional wisdom suggests these surrogates could provide adversaries with economic leverage comparable to the original service providers. This paper challenges this assumption by evaluating model stealing attacks beyond mere fidelity to the target model. Because query-based extraction provides only partial supervision of the target's input-output behavior, the surrogate is not uniquely identified: many near-optimal surrogates can achieve comparable fidelity while differing in deployment-relevant properties. Instead of performing a classic learning-based model stealing attack, we compute the Rashomon Set (i.e., the set of almost-equally-accurate models) of surrogate models, and evaluate its diversity using multiplicity metrics (ambiguity, discrepancy and rashomon capcity) and group fairness metrics. Our experiments on real-world datasets reveal that despite exhibiting similar fidelity to the target model, surrogate models can display significant variances in other critical performance metrics. These findings cast doubt on the presumed equivalence between high-fidelity surrogates and the target model in practical deployment scenarios.

2026-05-19

DMP @ Canadian Conference on Artificial Intelligence and Conference on Robots and Vision (oral)

openreview.net

Challenges in Using LLM Agents to Validate Agent Governance

Ayana Hussain

Héber Hwang Arcolezi

The increasing deployment of Large Language Models (LLMs) as autonomous agents has intensified the need for credible and trustworthy methods… (see more) to evaluate governance interventions. Motivated by recent research, this work considers the use of LLM and agent-based simulations to evaluate AI agent governance mechanisms before real-world deployment. While conceptually appealing, this approach introduces various challenges. We examine three such problems: (1) obtaining ground truth for validation, (2) determining whether observed behaviors represent actual agent operations or simulation artifacts, and (3) obtaining consent for data use, and addressing ethical concerns about computational surrogates replacing real users. We also outline considerations based on documented limitations, aiming to catalyze workshop discussion on trustworthy and reliable evaluation methods for agent governance.

2026-05-08

PoliSim @ ACM Conference on Human Factors in Computing Systems (published)

openreview.net

Fairwashing: the risk of rationalization

Hiromi Arai

Olivier Fortineau

Sébastien Gambs

Satoshi Hara

Alain Tapp

Black-box explanation is the problem of explaining how a machine learning model -- whose internal logic is hidden to the auditor and general… (see more)ly complex -- produces its outcomes. Current approaches for solving this problem include model explanation, outcome explanation as well as model inspection. While these techniques can be beneficial by providing interpretability, they can be used in a negative manner to perform fairwashing, which we define as promoting the false perception that a machine learning model respects some ethical values. In particular, we demonstrate that it is possible to systematically rationalize decisions taken by an unfair black-box model using the model explanation as well as the outcome explanation approaches with a given fairness metric. Our solution, LaundryML, is based on a regularized rule list enumeration algorithm whose objective is to search for fair rule lists approximating an unfair black-box model. We empirically evaluate our rationalization technique on black-box models trained on real-world datasets and show that one can obtain rule lists with high fidelity to the black-box model while being considerably less unfair at the same time.

2019-05-23

Proceedings of the 36th International Conference on Machine Learning (published)