A Fair Adversarial Training Framework for Jointly Improving Fairness and Adversarial Robustness in Artificial Intelligence Systems

Abstract

Artificial Intelligence (AI) systems deployed in high-stakes domains are increasingly challenged by algorithmic bias and adversarial vulnerabilities, yet these two problems are commonly studied independently. This study investigates algorithmic bias as a measurable security vulnerability and evaluates mitigation strategies that jointly address fairness and adversarial robustness. An explanatory quantitative experimental design was employed using the FairFace benchmark dataset. Four mitigation approaches were evaluated against a Baseline model: Domain-Adversarial Neural Networks (DANN), Projected Gradient Descent Adversarial Training (PGDAT), Fair Adversarial Training (FAT), and Fair Adversarial Attack Learning (FAAL). Model performance was assessed using the Balanced Subgroup Error Rate (BSER), Adversarial BSER, and a proposed Attack Surface Ratio (ASR) metric. The Baseline model achieved an overall accuracy of 42.19% and exhibited substantial subgroup disparities, with Clean BSER values ranging from 0.3254 for Black Males to 0.8561 for Middle Eastern Females, confirming severe intrinsic algorithmic bias. Under adversarial attack, vulnerable subgroups experienced significantly increased exploitation risk, with ASR values reaching 2.49 for Black Males and 2.37 for White Males, demonstrating that algorithmic bias enlarges the attack surface of AI systems. DANN achieved the strongest fairness improvement, raising overall accuracy to 67.47% and significantly reducing subgroup disparities, but simultaneously increased adversarial vulnerability, with the Black Male subgroup recording the highest ASR value of 5.14. PGDAT produced the strongest robustness performance, improving accuracy to 56.40% and reducing ASR by 39.32% for Black Males and 25.85% for White Males, although fairness disparities persisted. The integrated FAT model produced moderate joint improvements but failed to achieve statistically significant gains over the Baseline, while FAAL exhibited severe optimisation instability, producing extreme ASR values of 12.78 and 16.50 for the Southeast Asian Male and Female subgroups, respectively. A one-way ANOVA revealed significant differences among models for fairness performance (F = 12.0750, p = 0.00000021), whereas differences in adversarial robustness were not statistically significant (F = 2.0239, p = 0.1014). These findings provide empirical evidence that algorithmic bias functions as an exploitable security vulnerability and demonstrate a persistent trade-off between fairness and robustness in AI systems.