Sequential Fairness Auditing with Limited Output Access
arXiv:2606.30338v1 [cs.AI] 29 Jun 2026
IOANNIS PITSIORLAS* , EURECOM, France MARTHA V. SOURLA* , DaSCI, University of Granada, Spain MARIOS KOUNTOURIS, DaSCI, University of Granada, Spain External evaluations are becoming increasingly central to the governance of AI systems. In practice, however, independent auditors often have limited access to deployed models and must rely on query-based interactions. Most existing fairness evaluation methods assume static datasets and fixed-sample statistical tests, making them poorly suited to real-world auditing scenarios in which evidence must be collected sequentially under query constraints. In this work, we formulate fairness auditing as a tolerance-aware sequential hypothesis-testing problem under limited model output access. We develop a sequential generalized likelihood-ratio framework that allows auditors to accumulate evidence from a finite audit pool and stop once sufficient support for compliance or violation has been obtained. The framework is instantiated for decision-based Statistical Parity and Equal Opportunity audits, and extended to score- and logit-based proxy audits when richer observables are available. Our results show that both the fairness metric and the level of model access significantly affect audit efficiency, and that the benefits of richer output information are not uniform across auditing settings. In particular, richer outputs can substantially reduce the number of queries required for some fairness metrics and operating regimes, while offering limited gains in near-threshold cases. This work provides a practical statistical framework for sequential fairness auditing under realistic deployment constraints. Keywords: sequential hypothesis testing, algorithmic fairness, fairness auditing, limited output access, proxy audits
1
Introduction
Algorithmic decision systems are increasingly subject to regulatory oversight. Frameworks such as the EU AI Act [6] and local bias audit laws [12] require statistical evidence of compliance for deployed artificial intelligence (AI) systems. In practice, however, external auditors rarely have access to model parameters, training data, or internal documentation. Instead, auditing often occurs through query-based interaction with deployed systems, where auditors observe outputs for selected inputs and must draw conclusions from limited evidence [4, 9]. In this paper, we distinguish between exact black-box audits of decision-based fairness constraints and access-aware proxy audits that use richer observables, such as scores or logits, to study how additional observability affects sequential evidence accumulation. Most current fairness evaluation methods rely on static disparity metrics such as Statistical Parity (SP) or Equal Opportunity (EO) [7, 8] and assess compliance using fixed-sample hypothesis tests [15, 18]. These approaches are typically designed for batch evaluation on pre-collected datasets. In contrast, real-world audits often involve sequential and query-efficient evidence collection under limited query budgets, where auditors adaptively gather observations and must decide whether sufficient evidence has been obtained to certify compliance or detect violations [17]. * Both authors contributed equally to this research.
Authors’ Contact Information: Ioannis Pitsiorlas, EURECOM, France, [email protected]; Martha V. Sourla, DaSCI, University of Granada, Spain, [email protected]; Marios Kountouris, DaSCI, University of Granada, Spain, [email protected]. ECAF’26, September 02-September 04, 2026, Ghent, BE 2026.
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
2
•
Pitsiorlas et al.
Consider an external auditor evaluating a credit approval system for compliance with fairness regulations. The auditor does not have access to the model’s parameters or training data and instead interacts with the system through queries, submitting input profiles, and observing the model’s decisions. Suppose the regulator requires that the disparity in approval rates between demographic groups does not exceed a tolerance threshold δ . Because each query may correspond to a costly or limited audit interaction, the auditor seeks to determine compliance using as few queries as possible. This setting naturally leads to a sequential statistical decision problem: as evidence accumulates, the auditor must decide whether sufficient evidence exists to certify compliance, detect a violation, or continue collecting observations. Recent work has emphasized auditing under limited access to deployed systems, often framing auditing as a statistical decision problem over observable outputs [4, 13]. However, existing approaches do not provide concrete sequential procedures with explicit stopping rules for efficient auditing under query constraints. Sequential hypothesis testing provides principled tools for decision making under incremental data collection, enabling early stopping with controlled error rates [10, 16]. However, to the best of our knowledge, these methods have not been developed into a concrete generalized likelihood ratio (GLR)-based framework for tolerance-aware fairness auditing under limited access. In this work, we formalize fairness auditing as a tolerance-aware sequential hypothesis testing problem. Given a fairness metric g( f ) and regulatory tolerance δ , we consider the composite hypothesis test H0 : g( f ) ≤ δ
vs.
H1 : g( f ) > δ .
To address this problem, we adopt a GLR framework with sequential stopping boundaries inspired by Wald-type tests. Unlike fixed-sample procedures, the proposed protocol allows evidence to accumulate sequentially and terminates once sufficient statistical support is obtained or a predefined query budget is exhausted. This formulation reflects realistic regulatory settings in which small disparities may be legally permissible, and compliance is defined relative to a tolerance threshold rather than zero disparity. Our empirical study reveals several important phenomena in sequential fairness auditing. First, tolerance-aware auditing exhibits strong boundary effects: models whose fairness gaps lie near the regulatory tolerance often yield inconclusive outcomes within realistic query budgets. Second, richer output-access regimes can substantially reduce audit cost for SP and for some operating regimes, but the gains are not uniform across fairness criteria. In particular, the EO results show that richer observables do not automatically yield faster or more conclusive audits near the regulatory threshold. Third, EO audits are significantly more sample intensive than SP audits because the EO procedure operates on a conditional Y = 1 audit pool that is typically smaller, and may therefore provide fewer informative observations and less favorable group counts than the full SP pool. These findings highlight that fairness audit outcomes depend not only on the deployed model but also on the statistical protocol and level of access available to the auditor. By operationalizing fairness auditing as a sequential inference problem, our framework provides a foundation for analyzing the reliability and efficiency of real-world AI audits under realistic deployment constraints.
1.1
Contributions
Our contributions are summarized as follows: (1) Sequential formulation of fairness auditing: We formulate fairness auditing under limited model output access as a sequential statistical decision problem, where evidence is Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
Sequential Fairness Auditing with Limited Output Access
•
3
collected through query-based interaction and compliance is defined relative to a tolerance threshold. (2) Sequential GLR testing protocol: We develop a sequential GLR audit with explicit stopping rules and operational decision thresholds for composite fairness constraints. (3) Access-aware auditing analysis: We study how different access regimes affect the efficiency of fairness audits, distinguishing between decision-only audits that directly target hard-decision SP/EO estimands and proxy audits based on scores or logits when richer observables are available. (4) Empirical study: Through experiments on benchmark datasets, we identify practical phenomena in sequential fairness auditing, including increased difficulty for conditional metrics such as EO and statistical ambiguity near regulatory thresholds.
2 2.1
Related Work Statistical Fairness Evaluation
Prior work studies algorithmic fairness through statistical disparity metrics that compare predictive behavior across demographic groups. Some examples are SP, which requires equal positive prediction rates across groups, and EO, which requires equal true positive rates conditioned on the ground truth [7, 8]. These metrics and their variants are widely used to quantify group-level disparities in machine learning systems and have become common benchmarks in fairness evaluation. Several approaches incorporate statistical testing to assess whether the observed group disparities are significant. For example, hypothesis testing frameworks for fairness metrics have been studied in [15, 18]. These methods typically construct confidence intervals or perform significance tests for fairness metrics computed on fixed datasets. Most existing approaches operate in batch settings with fixed datasets and point null hypotheses. In contrast, our work considers sequential, tolerance-based auditing under limited query access.
2.2
Limited-Access Auditing and Sequential Inference
A growing body of work studies how AI systems can be audited under limited access conditions. In many real-world deployments, external auditors cannot inspect model parameters, training data, or internal decision logic, and must instead rely on query-based interactions with deployed systems. Recent work has begun to formalize the capabilities and limitations of such limited-access auditing. For example, [4] frames auditing as hypothesis testing over observable outputs, while [3] highlights the limitations of purely black-box evaluation and the potential need for additional access to ensure reliable assessments. Sequential hypothesis testing provides a natural framework for such settings. Classical methods, beginning with Wald [16], enable early stopping while controlling error rates under incremental data collection. More recent developments in time-uniform inference and confidence sequences extend these ideas to adaptive settings [10, 14]. Our setting differs from standard sequential testing in two key aspects: the null hypothesis is tolerance-based rather than point-valued, and the observation model depends on the auditor’s level of access. The use of GLR testing for such composite, access-dependent fairness auditing problems has not been systematically studied.
3
Methodology
We study fairness auditing as a sequential statistical inference problem arising from interaction with a deployed classifier through queries. In the empirical design studied in this paper, the auditor interacts with a fixed held-out Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
4
•
Pitsiorlas et al.
audit pool and the sequential procedure reveals one pool element at a time. An auditor repeatedly queries the model on inputs taken from that audit pool and observes model outputs that may vary depending on the level of access provided by the system. The objective is to determine whether the deployed model satisfies a tolerance-based fairness constraint while minimizing the number of queries required to reach a reliable decision. To this end, we formulate the audit as a sequential hypothesis testing problem and derive likelihood-based statistics that can operate under different access regimes.
3.1
Audit Target
We study the problem of query-based fairness auditing for deployed binary classifier models. An auditor interacts with a fixed model through input-output queries, and may additionally have access to limited side information, specifically model confidence scores or logits, but not model parameters or training data. Let f : X → {0, 1} denote a deployed binary classifier. Each input x ∈ X is associated with a sensitive attribute A ∈ {a, b} indicating membership in one of two protected groups. Let Q denote the reference deployment distribution over (X, A,Y ). The ground-truth label Y ∈ {0, 1}, required for EO, is available from a labeled reference pool. Operationally, the empirical study instantiates this reference distribution using a fixed held-out audit pool. Therefore, reported compliance decisions are evaluated on this pool (or its EO-specific subpool), rather than on an unobserved population beyond it. The audit target is a fairness function evaluated under Q, denoted gQ ( f ). A model is declared compliant relative to a regulatory tolerance δ > 0 if gQ ( f ) ≤ δ . The primary compliance target throughout the paper is defined for the deployed hard-decision rule f . Thus, the decision-only audit directly targets decision-based SP and EO. When richer outputs are available, we additionally consider auxiliary proxy audits based on group disparities in scores or logits. These richer-output audits preserve the same conditioning structure as the underlying fairness criterion (for example, conditioning on Y = 1 for EO), but they should be interpreted as operational surrogates rather than exact tests of the hard-decision SP/EO constraints.
3.2
Fairness Definitions
We instantiate the framework for the fairness metrics of SP [7] and EO [8]. Statistical Parity. Under distribution Q, define the group-conditional positive rates: pg := Pr( f (X) = 1 | A = g), Q
g ∈ {a, b}.
(1)
The SP disparity is defined as gSP Q ( f ) := |pa − pb |.
(2)
We consider the tolerance-based compliance hypothesis test H0SP : |pa − pb | ≤ δ
vs.
H1SP : |pa − pb | > δ .
(3)
Equal Opportunity. EO conditions on the true label Y = 1. Define qg := Pr( f (X) = 1 | A = g,Y = 1), Q
g ∈ {a, b}.
(4)
The EO disparity is gEO Q ( f ) := |qa − qb |. Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
(5)
Sequential Fairness Auditing with Limited Output Access
•
5
The corresponding compliance hypothesis test is H0EO : |qa − qb | ≤ δ
3.3
vs.
H1EO : |qa − qb | > δ .
(6)
Sequential Data and Likelihood Models
For the finite-pool audit used in the experiments, we distinguish between the SP and EO query sequences. Under SP, the auditor works with the full held-out audit pool and, at each round t, queries the next instance in a uniformly random permutation of that pool; equivalently, sampling is uniform without replacement. Under EO, inference is carried out on the filtered conditional pool obtained by restricting the held-out audit pool to instances with Y = 1. The EO query sequence is generated by a uniformly random permutation of this filtered pool, so every queried instance is EO-relevant by construction. Let Ŷt = f (Xt ) be the observed model prediction. In this finite-pool setting, the Bernoulli likelihoods below are used as operational working models for sequential evidence accumulation on the revealed observations. They are exact for independent Bernoulli sampling, but here they serve as tractable GLR-style models under without-replacement querying. SP likelihood model (binary groups). For SP, the data available at time t is EtSP = {(Ai , Ŷi ) : i = 1, ...,t}.
(7)
Under the working likelihood model, conditional on the queried sensitive attributes {Ai }ti=1 , the predicted outcomes {Ŷi }ti=1 are modeled as conditionally independent Bernoulli variables with group-specific success probabilities: Ŷi | (Ai = g) ∼ Bernoulli(pg ),
g ∈ {a, b}.
(8)
Let ng (t) := ∑ti=1 1{Ai = g} be the number of samples from group g up to time t and sg (t) := ∑ti=1 1{Ai = g, Ŷi = 1}, the corresponding number of positive outcomes, where g ∈ {a, b}. Then the conditional likelihood at time t is s
LtSP (pa , pb ) = pasa (1 − pa ) na −sa pbb (1 − pb ) nb −sb ,
(9)
where, for brevity, ng = ng (t) and sg = sg (t) for g ∈ {a, b}. EO likelihood model (binary groups). Under EO, inference is conditional on Y = 1 and is therefore formulated on the conditional reference distribution Q+ . The data is analogously defined as EtEO = {(Ai , Ŷi ) : i = 1, ...,t},
(Xi , Ai ) ∼ Q+ .
(10)
Conditional on the queried sensitive attributes, the EO predicted outcomes satisfy Ŷi | (Ai = g) ∼ Bernoulli(qg ),
g ∈ {a, b}.
(11)
Because the EO audit samples directly from the Y = 1 pool, the relevant group-wise counts are defined without an additional Yi = 1 indicator: t
mg (t) := ∑ 1{Ai = g}, i=1
t
rg (t) := ∑ 1{Ai = g, Ŷi = 1}.
(12)
i=1
Thus, the EO conditional likelihood is r
LtEO (qa , qb ) = qara (1 − qa ) ma −ra qbb (1 − qb ) mb −rb ,
(13)
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
6
•
Pitsiorlas et al.
where, again, mg = mg (t) and rg = rg (t) for g ∈ {a, b}. In the empirical study, EO can be more challenging than SP because it is conducted on a smaller conditional audit pool restricted to Y = 1, which may reduce the total number of available queries and alter the group composition of the pool.
3.4
Audit Statistics under Different Access Regimes
The information available to an auditor depends on the level of access provided by the deployed model. We consider three commonly encountered access regimes. Decision-only access (predictions only). Under decision-only access, often regarded as black-box access, the auditor observes only the binary prediction Ŷ = f (X) ∈ {0, 1} returned by the model. This setting corresponds to the classical fairness auditing scenario in which only final decisions are observable. It is also the regime that directly matches the decision-based SP and EO definitions in Section 3.2. Under this regime, outcomes for group g ∈ {a, b} are modeled as Bernoulli variables with parameter θg : Ŷi | Ai = g ∼ Bernoulli(θg ).
(14)
The sequential GLR statistic therefore uses the Bernoulli likelihood described in the previous section, where the sufficient statistics are the number of samples ng (t) and the number of positive outcomes sg (t) observed for each group under SP, and, under EO, the audit is run directly on the conditional Y = 1 pool, yielding sufficient statistics mg (t) and rg (t) defined on that EO pool. Score access. In many deployed systems, the model additionally exposes prediction scores or probabilities S(x) ∈ [0, 1], typically corresponding to the sigmoid output of a classifier. These scores contain more information than binary decisions and can be used directly by the auditor. Under score access, often referred to as gray-box access, we consider proxy audits based on group-conditional score means. For SP-style proxy auditing, we define (S)
µg := E[S(X) | A = g],
g ∈ {a, b},
(15)
(S) (S) (S) and the corresponding proxy disparity as dSP := |µa − µb |. For EO-style proxy auditing, we retain the same
conditioning structure as EO and define (S)
µg,+ := E[S(X) | A = g,Y = 1], (S)
(S)
g ∈ {a, b},
(16)
(S)
with proxy disparity dEO := |µa,+ − µb,+ |. Operationally, we model the observed scores as Gaussian with group-specific means and common variance, (S)
Si | Ai = g ∼ N (µg , σS2 ),
(17)
and analogously under the EO conditioning event Y = 1. Because these score-based quantities are not identical to hard-decision SP/EO, we use an operational tolerance in score space rather than identifying it with the hard-decision tolerance δ .
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
Sequential Fairness Auditing with Limited Output Access
•
7
Logit access. In some settings, the auditor may observe the model’s pre-sigmoid logits Z(x) rather than probabilities. Logits provide an unbounded continuous signal that often carries more information about the classifier’s internal confidence (scoring behavior). Under logit access, sometimes referred to as white-box access, although it does not require access to model parameters, we analogously define proxy audits based on group-conditional logit means. For SP-style proxy (Z) (Z) auditing, let µg := E[Z(X) | A = g], and for EO-style proxy auditing let µg,+ := E[Z(X) | A = g,Y = 1]. The (Z) (Z) (Z) (Z) (Z) (Z) corresponding proxy disparities are dSP := |µa − µb | and dEO := |µa,+ − µb,+ |. We model the observed logits using a Gaussian likelihood with group-specific means and common variance, (Z)
Zi | Ai = g ∼ N (µg , σZ2 ),
(18)
again conditioning on Y = 1 for EO-style proxy audits. Importantly, we do not identify a probability-space tolerance with a unique logit-space tolerance, since the logistic transform is nonlinear. Instead, the logit-access audit uses an operational threshold in logit space. Across regimes, the sequential stopping rule retains the same form; what changes is the observation model and, for richer observables, the disparity being audited. For the score-based and logit-based proxy audits, the Gaussian likelihoods are likewise used as working models on the revealed finite-pool observations rather than as exact without-replacement sampling laws.
3.5
Sequential Generalized Likelihood Ratio Test
To operationalize audits as statistical hypothesis tests, we adopt a GLR framework. We formulate the test using GLR because both H0 and H1 define sets of admissible parameter values rather than single distributions. For the decision-only audits targeting the hard-decision estimand, let θ = (θa , θb ) denote the vector of group-conditional Bernoulli parameters, with ( (pa , pb ), for Statistical Parity, θ= (qa , qb ), for Equal Opportunity. Define the disparity functional d(θ ) := |θa − θb |.
(19)
Given tolerance level δ > 0, define the compliance and violation parameter sets Θ0 (δ ) = {θ ∈ [0, 1]2 : d(θ ) ≤ δ }, 2
Θ1 (δ ) = {θ ∈ [0, 1] : d(θ ) > δ }.
(20) (21)
At time t, let Lt (θ ) denote the appropriate likelihood (SP or EO as defined above). The GLR statistic is Λt = log
supθ ∈Θ1 (δ ) Lt (θ ) supθ ∈Θ0 (δ ) Lt (θ )
.
(22)
For numerical convenience, it is useful to express the statistic in terms of the log-likelihood ℓt (θ ) := log Lt (θ ). Then the GLR statistic can be equivalently written as Λt = sup ℓt (θ ) − sup ℓt (θ ). θ ∈Θ1 (δ )
(23)
θ ∈Θ0 (δ )
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
8
•
Pitsiorlas et al.
For score- and logit-based proxy audits, the same GLR construction is used with θ replaced by the relevant pair of group-conditional means and with Lt taken to be the Gaussian likelihood under a common variance model. In that case, the null and alternative hypotheses are defined by the corresponding score-space or logit-space proxy disparity, rather than by the hard-decision SP/EO gap. In the Gaussian proxy tests, the common variance is treated as a nuisance parameter and profiled at each step using the pooled residual variance under the corresponding constrained or unconstrained fit. This profiling choice matches the implementation used to generate the reported results. After t audit queries, the statistic Λt is updated sequentially and compared with upper and lower stopping boundaries (u, ℓ). Because the present setting involves a composite GLR test, the classical simple SPRT thresholds are not claimed here as exact finite-sample guarantees. Instead, the boundaries are treated as operational decision thresholds for the sequential GLR audit. For nominal error levels (α, β ), we use the SPRT-inspired values u = log((1 − β )/α) and ℓ = log(β /(1 − α)). With α = 0.05 and β = 0.2, this gives u ≈ 2.77 and ℓ ≈ −1.56. In the experiments below, we use a nominal maximum query budget of B = 4000 instances. The boundaries (u, ℓ) are the fixed operational thresholds above and are held constant across all datasets, models, metrics, and access regimes. Because the present paper focuses on comparative audit behavior rather than exact finite-sample calibration, we report empirical decision frequencies and stopping times instead of claiming exact Type I/Type II guarantees. Under the finite-pool implementation, the effective stopping cap is (m)
(m)
Tmax = min{B, Npool }, (m)
(SP)
where Npool denotes the size of the audit pool for metric m. For SP, Npool is the size of the full held-out audit pool, (EO) whereas for EO, Npool is the size of the filtered Y = 1 pool and can be smaller than B. The audit rejects H0 if Λt ≥ u, accepts H0 if Λt ≤ ℓ, and continues sampling otherwise. If neither boundary is crossed within the maximum audit budget B or before the corresponding finite audit pool is exhausted, the outcome is declared inconclusive. The constrained maximizations required by the GLR reduce to one-dimensional boundary optimizations over the tolerance constraint. The full derivation of the unconstrained and constrained maximum likelihood estimates is provided in Appendix A.
4
Experimental Setup
Our experiments evaluate whether the proposed sequential auditing procedure can reliably distinguish between compliant and non-compliant models under different auditor observability regimes. In particular, we study how audit cost changes as the auditor gains progressively richer access to model outputs, ranging from decision-only access to score-level and logit-level access.
4.1
Datasets Used
We evaluate our auditing framework on two standard tabular datasets commonly used in fairness studies: the American Community Survey (ACS) and the Adult dataset. ACS (Folktables). We use the ACS Income task from the Folktables benchmark suite [5], which predicts whether an individual’s income exceeds $50,000 based on demographic and employment attributes. We focus on data from California (2018, 1-Year survey). The protected attribute is sex, with two groups: male and female. Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
Sequential Fairness Auditing with Limited Output Access
•
9
Adult (UCI). We also evaluate on the Adult dataset from the UCI repository, which has the same prediction objective (income above $50,000) and is widely used as a benchmark in fairness research. We again use sex as the protected attribute, defining male and female groups. For both datasets, we apply standard preprocessing, including one-hot encoding of categorical features and standardization of numerical variables. Each dataset is split into training and test partitions, and the held-out test partition serves as the audit pool.
4.2
Models
To study how audit behavior depends on model capacity and training stability, we construct four audited models based on multilayer perceptrons. Base Architectures. All base models are implemented as feedforward neural networks with ReLU activations and a sigmoid output layer. The Robust-Base model consists of two hidden layers with 64 and 32 units respectively, trained for 30 epochs using the Adam optimizer [11] with learning rate 10−3 and dropout rate 0.1. The UnstableBase model consists of a single hidden layer with 16 units, trained for 1 epoch with learning rate 10−2 and no regularization. This configuration induces higher variance and underfitting, leading to less stable decision boundaries. Fairness-Constrained Models. To obtain fairness-aware variants, we apply the Exponentiated Gradient reduction framework with a Demographic Parity constraint [1, 2]. The Robust-DP model is trained with tolerance parameter ε = 0.02 and up to 10 reduction iterations, while the Unstable-DP model uses ε = 0.05 and up to 2 reduction iterations. All models are treated as fixed deployed systems during auditing. The auditor does not have access to model parameters or training data.
4.3
Auditor Access Regimes
We consider three observability regimes that determine what information the auditor can access from the deployed model. • Decision-only access: the auditor observes only binary predictions f (X) ∈ {0, 1} and therefore performs the hard-decision SP/EO audit described in Section 3.2. • Score access: the auditor observes prediction scores p(X) and performs score-based proxy audits with the same SP-style or EO-style conditioning structure. • Logit access: the auditor observes the model logits z(X) prior to the final sigmoid activation and performs the analogous logit-based proxy audits. These regimes allow us to study how additional model information affects the efficiency of sequential auditing. Across all experiments, we use a nominal maximum budget of B = 4000 queried instances using the fixed operational GLR thresholds defined in Section 3.5.
4.4
Fairness Criteria
We instantiate the auditing framework using two group fairness criteria.
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
10
•
Pitsiorlas et al.
Statistical Parity. SP requires that the probability of a positive outcome be approximately equal across protected groups. For a sensitive attribute A with values in {a, b}: |Pr( f (X) = 1 | A = a) − Pr( f (X) = 1 | A = b)| ≤ δ .
(24)
Equal Opportunity. EO requires equality of true positive rates across groups: |Pr( f (X) = 1 | Y = 1, A = a) − Pr( f (X) = 1 | Y = 1, A = b)| ≤ δ .
(25)
For EO auditing, the sequential test is applied only to instances that satisfy Y = 1. Operationally, we implement this by constructing an EO-specific audit pool consisting only of positively labeled instances and then sampling directly from that pool. Throughout the experiments, the oracle compliance labels are always computed from the hard-decision SP/EO gaps in Table 1. For score and logit access, the sequential procedures are therefore interpreted as proxy audits that preserve the same SP-style or EO-style conditioning structure but operate on scores or logits rather than on hard decisions.
4.5
Audit Sampling Procedure
All experiments use uniform random sampling without replacement from a finite audit pool. For each run, the relevant audit pool is randomly shuffled, and instances are queried in that order until a stopping boundary is crossed or the available pool is exhausted. This design allows us to isolate the effect of access regime and audit statistic on stopping behavior without introducing adaptive sampling effects. For SP, the audit pool is the full held-out test partition. For EO, we first filter the held-out test partition to the subset with Y = 1 and then perform sampling directly from this conditional EO pool. Accordingly, the EO procedure operates on a smaller finite population and every EO query is informative by construction. For reproducibility, the number of queries in each audit is bounded by min(B, Npool ), where B is the nominal query budget and Npool is the size of the available audit pool. For SP, Npool corresponds to the full held-out test set, while for EO it corresponds to the subset of positively labeled instances. Group-wise counts in these pools determine how quickly the GLR statistic accumulates evidence.
4.6
Population-Level Fairness Evaluation
To interpret sequential audit outcomes, we compute population-level fairness gaps using the full test dataset. Specifically, we compute the hard-decision SP and EO gaps for each model across the entire test pool. These values provide oracle reference labels indicating whether each model is compliant or violating the tolerance δ . Importantly, this information is not available to the auditor during the auditing process and is used only for post hoc evaluation of audit correctness. Each experimental configuration is evaluated over 20 independent runs with different random seeds. Reported statistics correspond to the mean and standard deviation across these runs.
5
Numerical Results
Before evaluating sequential audit behavior, we compute the fairness gaps of all models on the full test datasets. These values serve as an empirical reference indicating whether each model is compliant or non-compliant with
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
Sequential Fairness Auditing with Limited Output Access
•
11
Table 1. Population-level fairness gaps on the test datasets.
Dataset Model
SP Gap EO Gap
ACS ACS ACS ACS Adult Adult Adult Adult
0.0287 0.0817 0.0923 0.0894 0.0043 0.1424 0.1716 0.1706
Robust-DP Unstable-DP Robust-Base Unstable-Base Robust-DP Unstable-DP Robust-Base Unstable-Base
0.0613 0.0011 0.0202 0.0085 0.3233 0.0211 0.0753 0.0819
respect to the tolerance δ . The auditor does not have access to these quantities. They are used only for post hoc evaluation of audit correctness. Table 1 reports the population-level fairness gaps for both datasets for δ = 0.05. With tolerance δ = 0.05, compliance depends on both the fairness metric and the dataset. On ACS, Robust-DP is compliant under SP but violates EO, whereas Unstable-DP violates SP but remains compliant under EO. On Adult, Robust-DP is also compliant under SP but strongly violates EO, while Unstable-DP violates SP and remains compliant under EO. These oracle gaps provide the reference labels used to interpret sequential audit outcomes. To keep the access-regime comparison focused, Tables 2–5 report the base models, while Table 1 retains the fairness-constrained models for context.
5.1
Sequential Auditing Under Different Access Regimes
We evaluate how the level of access to model outputs affects the efficiency of sequential auditing. We consider three access regimes: • Decision-only: the auditor observes only binary predictions. • Score access: the auditor observes prediction scores. • Logit access: the auditor observes logits before the sigmoid layer. All experiments use shuffled finite audit pools without replacement. Each configuration is evaluated over 20 independent audit runs with different random seeds. Reported results correspond to the mean and standard deviation of the number of queried instances required for the sequential test to terminate or for the relevant audit pool to be exhausted.
5.2
Statistical Parity
As shown in Table 2, the access-regime decisions agree empirically with the non-compliant hard-decision oracle labels for the base models. For score and logit access, these results should be interpreted as proxy audits relative to the hard-decision SP oracle. However, the number of required queries varies substantially with the level of access. Decision-only auditing consistently requires the most samples, score access reduces this cost by exploiting confidence information, and logit access provides the strongest gains.
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
12
•
Pitsiorlas et al.
Table 2. Sequential auditing under SP. The oracle column reports hard-decision SP gaps. Decision-only access corresponds to the hard-decision audit, while score and logit access denote proxy audits. Entries report the decision and mean queries to termination (± std).
Dataset Model ACS ACS Adult Adult
Oracle SP Gap Decision-only (labels) Score access (scores) Logit access (logits)
Robust-Base Unstable-Base Robust-Base Unstable-Base
0.0923 0.0894 0.1716 0.1706
Reject, 2349 ± 1345 Reject, 2412 ± 1587 Reject, 191 ± 215 Reject, 215 ± 178
Reject, 2157 ± 1443 Reject, 2406 ± 1477 Reject, 94 ± 75 Reject, 114 ± 83
Reject, 708 ± 543 Reject, 691 ± 595 Reject, 77 ± 54 Reject, 75 ± 50
Fig. 1. Sequential audit cost under SP across access regimes on the ACS and Adult datasets. Panels are shown separately. Error bars denote one standard deviation over 20 runs. Richer access reduces query cost in both datasets.
The access effect is particularly pronounced on ACS, where the SP gaps of the base models are relatively close to the tolerance threshold. For example, on Robust-Base, the mean sample requirement drops from 2349 under decision-only access to 708 under logit access. A similar pattern appears for Unstable-Base, where the mean decreases from 2412 to 691. Thus, on ACS, logit access reduces audit cost by roughly a factor of three relative to prediction-only access. The same qualitative trend holds on Adult. There, the SP violations are substantially larger, so all access regimes terminate much more quickly. Even in this easier setting, richer access remains beneficial: for Robust-Base, the mean sample requirement decreases from 191 under decision-only access to 94 under score access and 77 under logit access; for Unstable-Base, the corresponding values are 215, 114, and 75. These results indicate that richer model outputs consistently improve SP audit efficiency, although the absolute gain depends on how far the true fairness gap lies from the regulatory boundary. Figure 1 visualizes these trends for both datasets.
5.3
Equal Opportunity
Compared to SP, EO auditing is substantially more challenging, as shown in Table 3. In our implementation, this is not because non-positive instances are queried and then discarded, but because EO is conducted directly on the Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
Sequential Fairness Auditing with Limited Output Access
•
13
Table 3. Sequential auditing under EO. Oracle values are hard-decision EO gaps. Decision-only access denotes the hard-decision audit; score and logit access denote proxy audits conditioned on Y = 1. Entries report decision and mean queries (± std). “Inc.” (inconclusive) indicates no boundary crossing within the budget or EO pool
Dataset Model ACS ACS Adult Adult
Robust-Base Unstable-Base Robust-Base Unstable-Base
. Oracle EO Gap Decision-only (labels) Score access (scores) Logit access (logits) 0.0202 0.0085 0.0753 0.0819
Accept, 2711 ± 1123 Accept, 1257 ± 702 Inc., 2751 ± 1224 Inc., 2492 ± 1340
Accept, 1060 ± 1098 Accept, 550 ± 375 Inc., 2757 ± 1220 Inc., 3045 ± 952
Inc., 3329 ± 1214 Inc., 2829 ± 1487 Inc., 2512 ± 1334 Inc., 2717 ± 1171
smaller conditional audit pool restricted to Y = 1. This smaller pool can limit the total number of available queries and can also lead to less favorable group counts for evidence accumulation. This effect is already visible on ACS. Both base models are EO-compliant, and the decision-only and score-access auditors accept them in most runs, but require many more queries than under SP. For Robust-Base, the mean sample cost is 2711 under decision-only access and 1060 under score access, whereas the logit-access audit remains inconclusive on average within the available budget. A similar pattern holds for Unstable-Base, with decision-only and score access reaching acceptance at 1257 and 550 samples, respectively, while logit access again frequently fails to terminate conclusively. EO auditing is even more difficult on Adult. Both base models violate EO, but only moderately relative to the threshold, with oracle gaps of 0.0753 and 0.0819. In this near-boundary regime, all three access levels frequently terminate inconclusively within the audit budget. Mean sample counts remain high across all regimes, ranging from approximately 2492 to 3045, with no consistent efficiency gain from richer access. This indicates that, for EO, access to scores or logits does not automatically translate into faster audits when the fairness gap is not sufficiently separated from the tolerance level. Taken together, these results show that access-dependent gains are not metric-independent. Richer access consistently improves performance for the SP task in our experiments, while EO remains intrinsically harder because it conditions on positive labels. In our implementation, this additional difficulty arises from the smaller conditional EO audit pool and its group composition, rather than from post hoc discarding of sampled non-positive instances. The EO score- and logit-access results should therefore be interpreted cautiously as proxy-audit behavior rather than as evidence that richer access uniformly improves fairness auditing.
5.4
Sequential Versus Fixed-Sample Auditing
Table 4 compares the sequential GLR auditor with a fixed-sample baseline that uses the full query budget. For comparability, this table reports the decision-only hard-decision audit only. Accuracy treats inconclusive sequential outcomes as incorrect relative to the oracle label. The fixed-sample baseline evaluates the same hard-decision disparity after the full available budget, using B queries for SP and min(B, NY =1 ) queries for EO. Across both datasets, sequential auditing substantially reduces the number of required queries compared to the fixed-sample approach. This reduction is particularly pronounced on the Adult dataset under SP, where decisions are obtained with fewer than 250 samples on average, compared to the full budget of 4000.
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
14
•
Pitsiorlas et al.
Table 4. Sequential vs. fixed-sample auditing for the decision-only hard-decision auditor. Accuracy is measured relative to the oracle decision, with inconclusive outcomes counted as incorrect. For EO, the fixed-sample count is min(B, NY =1 ), which equals 3362 for Adult.
Dataset Model ACS ACS ACS ACS ACS ACS ACS ACS Adult Adult Adult Adult Adult Adult Adult Adult
Robust-Base Robust-Base Unstable-Base Unstable-Base Robust-Base Robust-Base Unstable-Base Unstable-Base Robust-Base Robust-Base Unstable-Base Unstable-Base Robust-Base Robust-Base Unstable-Base Unstable-Base
Metric
Method
Accuracy
Samples
SP SP SP SP EO EO EO EO SP SP SP SP EO EO EO EO
Sequential Fixed Sequential Fixed Sequential Fixed Sequential Fixed Sequential Fixed Sequential Fixed Sequential Fixed Sequential Fixed
0.75 1.00 0.70 0.95 0.70 0.95 0.90 1.00 1.00 1.00 1.00 1.00 0.20 1.00 0.30 1.00
2349 ± 1345 4000 2412 ± 1587 4000 2711 ± 1123 4000 1257 ± 702 4000 191 ± 215 4000 215 ± 178 4000 2751 ± 1224 3362 2492 ± 1340 3362
However, this efficiency comes with a reduction in decision accuracy in more challenging settings. In particular, under EO on the Adult dataset, the sequential auditor achieves significantly lower accuracy than the fixed-sample baseline, reflecting the difficulty of near-threshold cases and limited effective sample sizes. These results highlight a fundamental efficiency-accuracy trade-off: sequential auditing can dramatically reduce query cost, but may require larger budgets or repeated runs to match the reliability of fixed-sample testing.
5.5
Empirical Sanity Check of Decision Behavior
As shown in Table 5, the decision-only sequential auditor rarely makes incorrect decisions, with most uncertainty expressed as inconclusive outcomes. This is especially visible under EO on the Adult dataset, where the auditor often fails to terminate conclusively because the effective sample size is smaller and the fairness gaps are close to the threshold. Although the ACS Unstable-Base EO case yields occasional erroneous rejections, the overall pattern suggests conservative behavior: when evidence is weak, the auditor is more likely to remain inconclusive than to systematically misclassify the model.
6
Discussion
Our results highlight several implications for the design and interpretation of real-world fairness audits. First, audit efficiency depends strongly on the level of access available to the auditor. While regulatory settings often assume decision-only or otherwise limited access, our experiments show that richer outputs, such as scores or logits, Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
Sequential Fairness Auditing with Limited Output Access
•
15
Table 5. Empirical decision behavior of the sequential auditor for a decision-only hard-decision setting. Entries report frequencies across 20 runs.
Dataset Model ACS ACS ACS ACS Adult Adult Adult Adult
Robust-Base Unstable-Base Robust-Base Unstable-Base Robust-Base Unstable-Base Robust-Base Unstable-Base
Metric Oracle Reject Accept Inconclusive SP SP EO EO SP SP EO EO
Reject Reject Accept Accept Reject Reject Reject Reject
0.75 0.70 0.00 0.10 1.00 1.00 0.20 0.30
0.00 0.00 0.70 0.90 0.00 0.00 0.00 0.00
0.25 0.30 0.30 0.00 0.00 0.00 0.80 0.70
can substantially reduce the number of queries required to reach a decision for some tasks, particularly under SP. However, these gains are not uniform across settings and should be interpreted as proxy-audit behavior rather than exact tests of decision-based fairness. Second, tolerance-aware auditing introduces inherent statistical ambiguity near regulatory thresholds. When the true disparity lies close to the tolerance level, sequential audits often require many samples and may terminate inconclusively within realistic budgets. This highlights a fundamental tension between regulatory thresholds and statistical detectability. Third, the choice of a fairness metric plays a central role in audit complexity. EO is consistently more challenging than SP in our experiments. In our implementation, this is because EO operates on a smaller conditional audit pool restricted to Y = 1, which reduces the number of available queries and may yield less favorable group counts for evidence accumulation. More broadly, these findings demonstrate that fairness audit outcomes depend not only on the deployed model but also on the statistical testing protocol and the auditor’s level of access. This work also has several limitations. We focus on binary-group fairness in binary classification, leaving multi-group and multiclass settings to future work. The score- and logit-access settings rely on proxy disparities defined on scores and logits, and therefore do not provide exact compliance guarantees for decision-based SP/EO. The sequential GLR thresholds are treated as operational rather than exact finite-sample calibrations. Finally, the empirical study is conducted on finite audit pools sampled without replacement, while the Bernoulli and Gaussian likelihoods are used as tractable working models within the sequential procedure. Future work could explore extensions to multi-group fairness settings, adaptive query strategies for improving audit efficiency, and alternative sequential inference tools such as confidence sequences.
Acknowledgments This work was supported by the European Research Council (ERC) under the European Union’s Horizon 2020 research and innovation programme (Grant agreement No. 101003431) and by Horizon Europe/JU SNS project, ROBUST-6G (Grant agreement No. 101139068).
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
16
•
Pitsiorlas et al.
References [1] Alekh Agarwal, Alina Beygelzimer, Miroslav Dudík, John Langford, and Hanna Wallach. 2018. A Reductions Approach to Fair Classification. In Proceedings of the 35th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 80), Jennifer Dy and Andreas Krause (Eds.). PMLR, 60–69. https://proceedings.mlr.press/v80/agarwal18a.html [2] Sarah Bird, Miroslav Dudík, Richard Edgar, Brandon Horn, Roman Lutz, Vanessa Milan, Mehrnoosh Sameki, Hanna Wallach, and Kathleen Walker. 2020. Fairlearn: A Toolkit for Assessing and Improving Fairness in AI. Microsoft Technical Report MSR-TR-2020-32. https://www.microsoft.com/en-us/research/publication/fairlearn-a-toolkit-for-assessing-and-improving-fairness-in-ai/ [3] Stephen Casper, Carson Ezell, Charlotte Siegmann, Noam Kolt, Taylor Lynn Curtis, Benjamin Bucknall, Andreas Haupt, Kevin Wei, Jérémy Scheurer, Marius Hobbhahn, Lee Sharkey, Satyapriya Krishna, Marvin Von Hagen, Silas Alberti, Alan Chan, Qinyi Sun, Michael Gerovitch, David Bau, Max Tegmark, David Krueger, and Dylan Hadfield-Menell. 2024. Black-Box Access is Insufficient for Rigorous AI Audits. In The 2024 ACM Conference on Fairness, Accountability, and Transparency. ACM, 2254–2272. doi:10.1145/3630106.3659037 [4] Sarah H. Cen and Rohan Alur. 2024. From Transparency to Accountability and Back: A Discussion of Access and Evidence in AI Auditing. In Proceedings of the 4th ACM Conference on Equity and Access in Algorithms, Mechanisms, and Optimization (San Luis Potosi, Mexico) (EAAMO ’24). Association for Computing Machinery, New York, NY, USA, Article 13, 14 pages. doi:10.1145/3689904.3694711 [5] Frances Ding, Moritz Hardt, John Miller, and Ludwig Schmidt. 2021. Retiring Adult: New Datasets for Fair Machine Learning. In Advances in Neural Information Processing Systems Datasets and Benchmarks Track. https://datasets-benchmarks-proceedings.neurips. cc/paper/2021/hash/68d30a9594728bc39aa24be94b319d21-Abstract-round2.html [6] European Union. 2024. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (AI Act). Official Journal of the European Union. https://eur-lex.europa.eu/legal-content/EN/ TXT/?uri=CELEX:32024R1689 [7] Michael Feldman, Sorelle A. Friedler, John Moeller, Carlos Scheidegger, and Suresh Venkatasubramanian. 2015. Certifying and Removing Disparate Impact. In Proceedings of the 21st ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (Sydney, NSW, Australia) (KDD ’15). Association for Computing Machinery, New York, NY, USA, 259–268. doi:10.1145/2783258.2783311 [8] Moritz Hardt, Eric Price, and Nati Srebro. 2016. Equality of Opportunity in Supervised Learning. In Advances in Neural Information Processing Systems, D. Lee, M. Sugiyama, U. Luxburg, I. Guyon, and R. Garnett (Eds.), Vol. 29. Curran Associates, Inc. https: //proceedings.neurips.cc/paper_files/paper/2016/file/6a9659feb1216f14f7384ba499518b38-Paper.pdf [9] David Hartmann, Lena Pohlmann, Lelia Hanslik, Noah Gießing, Bettina Berendt, and Pieter Delobelle. 2026. Audit Me If You Can: Query-Efficient Active Fairness Auditing of Black-Box LLMs. arXiv:2601.03087 [cs.LG] https://arxiv.org/abs/2601.03087 [10] Steven R. Howard, Aaditya Ramdas, Jon McAuliffe, and Jasjeet Sekhon. 2021. Time-uniform, nonparametric, nonasymptotic confidence sequences. The Annals of Statistics 49, 2 (April 2021). doi:10.1214/20-aos1991 [11] Diederik P. Kingma and Jimmy Ba. 2015. Adam: A Method for Stochastic Optimization. In International Conference on Learning Representations. https://arxiv.org/abs/1412.6980 [12] New York City Council. 2023. New York City Local Law 144 of 2021: Automated Employment Decision Tools (AEDT) Law. NYC Department of Consumer and Worker Protection. https://rules.cityofnewyork.us/rule/automated-employment-decision-tools/ [13] Inioluwa Deborah Raji, Andrew Smart, Rebecca N. White, Margaret Mitchell, Timnit Gebru, Ben Hutchinson, Jamila Smith-Loud, Daniel Theron, and Parker Barnes. 2020. Closing the AI accountability gap: defining an end-to-end framework for internal algorithmic auditing. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (Barcelona, Spain) (FAT* ’20). Association for Computing Machinery, New York, NY, USA, 33–44. doi:10.1145/3351095.3372873 [14] Aaditya Ramdas, Peter Grünwald, Vladimir Vovk, and Glenn Shafer. 2023. Game-Theoretic Statistics and Safe Anytime-Valid Inference. Statist. Sci. 38, 4 (2023), 576 – 601. doi:10.1214/23-STS894 [15] Bahar Taskesen, Jose Blanchet, Daniel Kuhn, and Viet Anh Nguyen. 2021. A Statistical Test for Probabilistic Fairness. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency (Virtual Event, Canada) (FAccT ’21). Association for Computing Machinery, New York, NY, USA, 648–665. doi:10.1145/3442188.3445927 [16] Abraham Wald. 1947. Sequential Analysis. Wiley. [17] Tom Yan and Chicheng Zhang. 2022. Active fairness auditing. In Proceedings of the 39th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 162), Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato (Eds.). PMLR, 24929–24962. https://proceedings.mlr.press/v162/yan22c.html
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
Sequential Fairness Auditing with Limited Output Access
•
17
[18] William Yik, Limnanthes Serafini, Timothy Lindsey, and George D. Montañez. 2022. Identifying Bias in Data Using Two-Distribution Hypothesis Tests. In Proceedings of the 2022 AAAI/ACM Conference on AI, Ethics, and Society (Oxford, United Kingdom) (AIES ’22). Association for Computing Machinery, New York, NY, USA, 831–844. doi:10.1145/3514094.3534169
A
GLR Optimization
Unconstrained and Constrained Maximum Likelihood Estimates (MLE) Unconstrained MLE. Let θ̂t = (θ̂a,t , θ̂b,t ) denote the empirical rate vector at time t. The unconstrained MLE is sa sb ra rb θ̂t = , (SP), θ̂t = , (EO), (26) na nb ma mb with the convention that the test proceeds only after each group has at least one relevant observation so that the denominators are nonzero. This maximizes Lt (θ ) over the parameter space [0, 1]2 . Constrained MLE under H0 . If the empirical disparity satisfies |θ̂a − θ̂b | ≤ δ , then the unconstrained MLE already lies in Θ0 (δ ) and therefore also maximizes the likelihood under H0 . Otherwise, the maximizer must lie on the boundary |θa − θb | = δ , which can be parameterized as s ∈ {−1, +1}.
θb = θa + sδ ,
(27)
Substituting this relation into the log-likelihood yields the one-dimensional function fs (θa ) = ℓt (θa , θa + sδ ).
(28)
The feasible values of θa are those satisfying 0 ≤ θa ≤ 1,
0 ≤ θa + sδ ≤ 1.
(29)
For the Bernoulli likelihood (SP case), the derivative is d sa na − sa sb nb − sb fs (θa ) = − + − . (30) dθa θa 1 − θa θa + sδ 1 − θa − sδ An analogous expression holds for EO by replacing (ng , sg ) with (mg , rg ). Since the second derivative is always negative, the Bernoulli log-likelihood is strictly concave, the function fs (θa ) is strictly concave over its feasible domain, and therefore admits a unique maximizer for each s ∈ {−1, +1}. The constrained MLE supθ ∈Θ0 (δ ) ℓt (θ ) is obtained by computing the maximizer for both boundary cases and selecting the solution that yields the larger likelihood value. When the unconstrained MLE lies in Θ1 (δ ), the GLR statistic can be written as Λt = ℓt (θ̂t ) − sup ℓt (θ ).
(31)
θ ∈Θ0 (δ )
By symmetry, when the unconstrained MLE lies in Θ0 (δ ), the denominator is achieved at θ̂t , while the numerator is given by the supremum over Θ1 (δ ). By continuity of the log-likelihood, this supremum is obtained by the same boundary optimization on d(θ ) = δ approached from the violation side, so the complementary representation is Λt = sup ℓt (θ ) − ℓt (θ̂t ) ≤ 0.
(32)
θ ∈Θ1 (δ )
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.
18
•
Pitsiorlas et al.
Thus, the same boundary optimization resolves both acceptance-side and rejection-side computations. The same logic applies to the Gaussian proxy audits after replacing the Bernoulli log-likelihood with the corresponding Gaussian log-likelihood. These thresholds should therefore be interpreted as operational decision rules rather than exact finite-sample guarantees.
Proceedings of ECAF’26. September 02 – September 04, 2026. Ghent, BE.