Stress Test for AI Fairness Reveals Which Algorithms Break First Under Biased Labels

Machine learning systems now decide who gets a loan, who passes a job screening, and who receives a high-risk score in a courtroom. But what happens to those decisions when the data used to train the models is quietly, systematically unfair? A team of Brazilian researchers has built a rigorous answer to that question, and their findings should unsettle anyone who assumes a model that looks fair on paper will stay fair in the wild. In a study published in the International Journal of Data Science and Analytics, Rodrigo Pagliusi, Leandro Alvim, and colleagues at the Universidade Federal do Rio de Janeiro introduce SLF–FST, short for Systematic Label Flipping for Fairness Stress Testing, a framework that deliberately poisons training labels against a protected group and watches, step by step, how both accuracy and fairness collapse.

The inspiration comes from a discipline far removed from computer science. Engineers stress-test bridges by loading them beyond expected limits; banks stress-test portfolios against market crashes. The researchers translated that philosophy into machine learning by asking a deceptively simple question: not whether a model is fair under the data it happens to receive, but how quickly it stops being fair as the training environment deteriorates. Static fairness audits, the kind most organizations run before deployment, capture a single snapshot. SLF–FST instead produces a movie, tracing the joint trajectory of predictive performance and group-based fairness metrics as bias intensity climbs from zero to twenty percent.

Technically, the framework works by selectively flipping class labels in a way that is conditioned on group membership. The method targets two specific subsets of the training data: instances from the protected group with positive outcomes, and instances from the privileged group with negative outcomes. Flipping the first set converts favorable outcomes into unfavorable ones, while flipping the second does the opposite, systematically inflating the apparent success rate of the privileged group while suppressing that of the protected group. A parameter called the pollution rate controls how many eligible labels are corrupted, ranging from five to twenty percent in the experiments. Crucially, only labels change; the feature distributions remain untouched, so any degradation in model behavior can be attributed directly to the injected bias rather than to artifacts of data manipulation.

The researchers also developed three distinct injection strategies that differ in how instances are selected for corruption. The LOW strategy targets instances where an auxiliary Random Forest estimator is most uncertain, meaning cases sitting near the decision boundary. The HIGH strategy flips labels the estimator is most confident about, directly contradicting the strongest feature-label relationships in the data. The RANDOM strategy selects instances uniformly at random from the eligible subsets, ignoring confidence entirely. Each strategy was designed to test a different hypothesis about how structured bias propagates through a learning algorithm, and the results largely confirmed the team’s expectations.

The experimental scale was substantial. The team trained four classifier families, Decision Tree, Logistic Regression, Random Forest, and a feedforward Neural Network, on three widely used benchmark datasets: Adult, which predicts whether income exceeds fifty thousand dollars; Bank Marketing, which predicts subscription to a financial product; and COMPAS, the notorious criminal recidivism dataset whose racially disparate risk assessments helped ignite the algorithmic fairness debate. Each dataset carries a designated sensitive attribute: gender for Adult, marital status for Bank Marketing, and race for COMPAS. The entire pipeline, including stratified fivefold cross-validation and Bayesian hyperparameter optimization with Optuna, was repeated eight times, producing a total of 6,240 trained models. Notably, no fairness metric was used during hyperparameter tuning, mirroring common real-world development practice and allowing the impact of biased data to be observed in isolation.

The headline finding concerns which algorithms break first. Random Forests, benefiting from the averaging power of an ensemble, proved the most robust to injected bias, degrading the most gracefully as pollution rates rose. Logistic Regression exhibited the highest sensitivity, with the most pronounced decline in both predictive accuracy and fairness on the COMPAS dataset. Neural Networks and Decision Trees landed in the intermediate zone. The explanation for Logistic Regression’s fragility lies in its linear decision boundary: because the model fits a single separating hyperplane, accumulated perturbations to high-confidence instances can force an abrupt, large-scale shift in that boundary, whereas ensembles of trees absorb individual distortions through majority voting.

The three injection strategies produced a striking and somewhat counterintuitive pattern. The HIGH strategy, which contradicts the strongest feature-label associations, caused the most severe damage to predictive performance but comparatively smaller increases in measured unfairness. The LOW strategy did the opposite: it amplified group disparities substantially while leaving overall accuracy largely intact, because the flipped instances occupied ambiguous regions of the feature space where the model was already uncertain. This makes LOW the standout choice for fairness stress testing in practice, since it isolates fairness degradation from accuracy loss and produces deterministic, reproducible results. RANDOM fell between the two, adding variability without the targeting precision of the confidence-guided approaches.

The study also documented subtle, dataset-specific behaviors that a static audit would never catch. On the Bank Marketing dataset, Statistical Parity initially decreased when bias was first injected, because the protected group started with a higher proportion of positive outcomes, and early flips temporarily balanced the two groups before the disparity reversed and grew. On Adult, Logistic Regression under the HIGH strategy showed an S-shaped performance curve, dipping sharply at ten percent pollution before partially recovering as flipped labels became more evenly distributed across classes. In COMPAS, aggressive flipping occasionally disrupted spurious correlations that the linear model would otherwise exploit, counterintuitively improving some fairness metrics. These anomalies matter because they demonstrate that fairness and accuracy interact in non-linear, model-dependent ways that single-point evaluations fundamentally cannot capture.

The practical implications extend well beyond the laboratory. The authors position SLF–FST as a pre-deployment auditing mechanism: by identifying the pollution rate at which a given model’s fairness metrics cross an unacceptable threshold, practitioners can quantify how much label bias their system can tolerate before it fails. This failure threshold is exactly the kind of information that regulators and auditors increasingly demand, and the framework’s model-agnostic design means it can be applied to any classifier without modification. The code and datasets are publicly available on GitHub, and the paper is open access, lowering the barrier for organizations to adopt the protocol.

The researchers are candid about limitations. The confidence-guided strategies depend on an auxiliary estimator, and the results characterize a Random-Forest-guided instantiation specifically; different ranking models could select different samples and shift the degradation trajectories. The study also confines itself to binary classification and a single sensitive attribute per dataset, leaving multi-class settings and intersectional identities for future work. Still, the core message stands with unusual clarity: robustness to biased data is a property that varies dramatically across algorithms, and it cannot be inferred from how a model performs on clean data. As machine learning systems take on higher-stakes decisions, the question is no longer only whether a model is fair today, but whether it can survive the biased world it will actually be trained in. Stress testing, this study suggests, is how we find out before it matters.

Subject of Research: A fairness stress-testing framework that injects progressive group-conditional label bias to measure how classification algorithms degrade in accuracy and fairness.

Article Title: SLF–FST: a framework for stress-testing fairness under progressive label bias

Article References: Pagliusi, R., Alvim, L., Ferreira, R. S., Canalli, Y., Braida, F., & Zimbrão, G. (2026). SLF–FST: a framework for stress-testing fairness under progressive label bias. International Journal of Data Science and Analytics, 22(1), Article 319. https://doi.org/10.1007/s41060-026-01294-4

Image Credits: AI Generated

DOI: 10.1007/s41060-026-01294-4

Keywords: algorithmic fairness, machine learning, label bias, stress testing, COMPAS, Random Forest, Logistic Regression, bias injection, fairness metrics, classifier robustness, pre-deployment auditing, responsible AI