FAccT 2026 · Montréal

When a credit decision should not flip.

Counterfactual fairness at the individual level — when the data
an algorithm depends on is split across banks, bureaus, and payrolls.

Toward Individual Fairness Without Centralized Data: Selective Counterfactual Consistency for Vertical Federated Learning

Dawood Wasif1, Chandan K. Reddy1, Terrence J. Moore2, Jin-Hee Cho1

1Virginia Tech  ·  2U.S. Army Research Laboratory

Paper (PDF) Code BibTeX
98%
Flip rate reduction
vs strongest baseline
3domains
Credit · Healthcare
Criminal Justice
Never
leaves
Sensitive attribute stays
with the trusted party
−4.6pp
Attribute inference
attack success rate
The Story

Fair decisions don't need centralized data. They need stable decisions.

Federated learning was meant to solve a governance problem: banks, hospitals, and agencies can't — and in many jurisdictions, mustn't — pool raw data. Vertical federated learning (VFL) goes further: each institution holds different columns of the same people.

But fairness doesn't care that the data is split. A 25-year-old applicant still deserves a decision that wouldn't flip if she were 30 instead, holding her policy-relevant qualifications constant. Group-level fairness constraints — demographic parity, equalized odds — can be satisfied in aggregate while specific individuals still experience arbitrary flips under hypothetical sensitive-attribute changes.

And in VFL, three things make this harder:

  • The sensitive attribute may be held privately by one party.
  • Proxies for it are scattered across institutions.
  • Sensitive influence only emerges after aggregation at the server.

Most prior work either presumes a fully-specified causal graph (rarely available) or enforces representation invariance that blurs the line between legitimate pathways and impermissible proxies.

  • The target: per-individual counterfactual stability, not group parity.
  • The setting: features split across parties; sensitive attribute privately held.
  • The mechanism: discover feature roles under DP, edit only policy-permitted mediators, enforce consistency at the server.
  • The evidence: flip rates collapse by up to 98% on real credit / health / justice data, with attribute-inference leakage reduced.
  • The caveat: consistency is not justice — the policy specification must still be defensible.
Method

Features have roles. Treating them all the same is the mistake.

SCC-VFL partitions each party's features into three groups under a declared policy. The roles determine what moves under a counterfactual — and what must stay fixed.

N · Non-descendants
Held fixed under a counterfactual intervention. Identity features that don't change when the protected attribute changes.
e.g. loan amount, loan duration
M · Permitted mediators
May change on-support under the intervention. Pathways policy deems acceptable.
e.g. employment tenure, credit history
P · Impermissible proxies
Pass through unchanged, but an adversary suppresses their residual sensitive signal.
e.g. housing status (when it encodes age)
Bank A ACCOUNT · HISTORY Employer INCOME · PAYROLL Bureau RISK · COLLATERAL s · TRUSTED HOLDER STEP 1 Mask discovery under differential privacy N   non-descendants M   mediators P   proxies STEP 2 Masked CF edit edit M on-support fix N exactly guard P via adversary party-local · never leaves STEP 3 Server SCC loss Ltask + λ · LSCC penalize ŷ − ŷcf DP sketch z_s non-descendants copied  ·  mediators edited to target s′  ·  proxies guarded against leakage
Three-step pipeline. Step 1 runs under differential privacy on a sketch of the sensitive attribute. Step 2 is party-local and never reveals raw features. Step 3 fuses original and counterfactual representations at the server and penalizes decision changes.

What the loss actually says

The server-side objective combines the usual task loss with a selective counterfactual consistency penalty:

$$ \underbrace{\frac{1}{n}\sum_{i=1}^{n} \ell\bigl(f_\theta(z_i), y_i\bigr)}_{\text{supervised utility}} \;+\; \lambda \cdot \underbrace{\frac{1}{n}\sum_{i=1}^{n} \bigl\| f_\theta(z_i) - f_\theta(z_i^{cf}) \bigr\|_p}_{\text{SCC: penalize flips under CF}} \;+\; \underbrace{\sum_{p=1}^{m}\bigl[\alpha' \mathcal{V}^{(p)}_{\text{id}} + \beta' \mathcal{V}^{(p)}_{\text{supp}} - \eta' \mathcal{V}^{(p)}_{\text{leak}}\bigr]}_{\text{per-party validity}} $$

The second term is the heart of it: for every individual $i$, any difference between the prediction on their real input and on their masked counterfactual is penalized. Because the counterfactual only edits M, freezes N, and guards P, the penalty targets impermissible sensitive influence — not legitimate causal pathways.

End-to-end architecture

SCC-VFL architecture: server coordinates descendant discovery, DP sketcher, and SCC loss; contributors apply server mask, generate mediator counterfactuals via cVAE, minimize leakage via proxy adversary, and run local prediction.

Server (top) discovers descendants, releases the DP sketch, and enforces the SCC loss at fusion. Each contributor (bottom) applies the server-provided mask and trains a conditional VAE that edits only mediator coordinates, while a proxy adversary suppresses residual sensitive signal.

Worked example · credit

What does this look like for one applicant?

A concrete walkthrough of how SCC-VFL enforces counterfactual stability in a lending decision. Policy roles are illustrative; the mechanics generalize.

A 25-year-old applies for a loan. Protected attribute: age, not a model input.

A policy review — with input from legal, compliance, and stakeholder representatives — partitions the features:

Original input  ·  $s=\text{young}$

loan_amountN · fixed
loan_durationN · fixed
employment_tenureM · editable
credit_historyM · editable
housing_statusP · guarded
dependentsP · guarded
Intervention · s → s'

Counterfactual  ·  $s'=\text{older}$

loan_amount= unchanged
loan_duration= unchanged
employment_tenure↑ on-support
credit_history↑ on-support
housing_statusguarded · adv.
dependentsguarded · adv.

What happens: The party-local cVAE generates plausible values for employment_tenure and credit_history under the older age group, conditioned on the non-descendants. Proxy features pass through, but an adversary tries and fails to recover the original age from them. The server fuses both representations and compares predictions.

Verdict
If the lending decision substantially changes, the SCC penalty flags it as age-driven. If it remains stable, the applicant's decision is consistent under the declared policy — without the model ever seeing the raw sensitive attribute.
Important caveat Consistency is not justice. A system can be consistently discriminatory if the policy behind the $N/M/P$ partition encodes biased or unjustified judgments about which pathways should be permissible. SCC-VFL enforces the provided policy; it does not decide it. The partition should be documented, versioned, and contestable.
Results

Flip rates collapse. Accuracy holds. Privacy leakage drops.

Across three real-world domains and both IID and demographic-shift splits, SCC-VFL produces models that are much more stable per individual, with no meaningful accuracy loss.

Flip rate (%) under counterfactual intervention — lower is better

German Credit  ·  Non-IID
0.12%
vs. 6.24% (Policy-blind), 8.22% (Adv-NoMask). A ~98% reduction over the strongest baseline.
UCI Heart Disease  ·  Non-IID
0.05%
vs. 15.2% (Adv-NoMask). Accuracy also improves to 94.9% — no utility trade-off.
COMPAS Cox  ·  Non-IID
0.02%
vs. 0.34% (best baseline). SCG collapses to 0.0255 from ~0.38.
Performance comparison table across German Credit, UCI Heart Disease, and COMPAS Cox datasets under IID and Non-IID splits. SCC-VFL achieves lowest SCG and FR throughout while maintaining competitive accuracy.
Table 2. Utility vs. fairness across all three datasets and both splits. SCC-VFL attains the lowest Selective Consistency Gap (SCG) and Flip Rate (FR) in all six blocks, while matching or beating the best baseline on LogLoss in most cases. Accuracy stays within ~1 point of the best baseline and in some blocks exceeds it. Mean ± std over 30 seeds.

Does this come at the cost of privacy leakage?

No — the opposite. We evaluated two post-hoc threat models: an attribute inference attacker trained on frozen latent representations, and a subspace-constrained PGD adversary that perturbs only mediator coordinates. SCC-VFL reduces both.

Two plots: (a) Attribute Inference Attack success rate vs attacker epochs shows SCC-VFL stays at ~0.58 while baselines climb to ~0.62. (b) Subspace-PGD attack success rate vs epsilon shows SCC-VFL at roughly half the success rate of the strongest baseline at every epsilon.
Figure 5. Left: AIA success rate at increasing attacker training budgets. SCC-VFL plateaus 4–5 points below all baselines at 80 epochs. Right: Subspace-PGD attack on mediator coordinates. SCC-VFL is consistently the most robust, reaching just 9.3% at $\epsilon=0.2$ — about half the success of Adv-NoMask (21.7%).

What ablation confirms

Removing mask discovery doubles SCG and triples FR. Removing the generator (consistency-only) is the worst setting — SCG rises ~5×. Removing the consistency term (masks + generator only) still leaves FR ~6× higher than the full model. All three components matter.

Who this is for

Not a fairness silver bullet. A tool for accountability.

For researchers

SCC-VFL is the first server-centric framework to bring causal, per-instance fairness into VFL under realistic privacy constraints. The mask discovery is graph-free and DP-protected; the generator is a conditional VAE that edits only permitted mediators; the server enforces consistency at fusion.

For practitioners deploying VFL

The paper specifies a Policy Card protocol in Appendix D: who owns the $N/M/P$ decision, what evidence counts, how appeals work, and how mask refreshes are logged. You can audit whether a deployed model still satisfies its declared counterfactual semantics.

For policy audiences

Anti-discrimination law (e.g., ECOA in the US, EU non-discrimination frameworks) cares about whether decisions depend on protected attributes. SCG and Flip Rate are auditable, per-individual metrics that quantify this — not just in aggregate, but at the resolution of a single affected person.

What it doesn't solve

The $N/M/P$ partition is a normative choice. If it encodes biased judgments about which causal pathways are permissible, the model will be consistently discriminatory. Deployments must pair SCC with group-level audits, policy review, and rollback processes.

Cite this work

BibTeX

@inproceedings{wasif2026sccvfl,
  title     = {Toward Individual Fairness Without Centralized Data: Selective Counterfactual Consistency for Vertical Federated Learning},
  author    = {Wasif, Dawood and Reddy, Chandan K. and Moore, Terrence J. and Cho, Jin-Hee},
  booktitle = {The 2026 ACM Conference on Fairness, Accountability, and Transparency (FAccT '26)},
  year      = {2026},
  address   = {Montreal, QC, Canada},
  publisher = {Association for Computing Machinery},
  isbn      = {979-8-4007-2596-8/2026/06},
  doi       = {10.1145/3805689.3812242},
  url       = {https://doi.org/10.1145/3805689.3812242}
}