AI Ethics, Privacy & Data

Bias in machine learning is not a single phenomenon — it is a family of distinct failure modes, each arising at a different stage of the ML pipeline. Understanding the taxonomy is the prerequisite for fixing any particular instance.

Historical bias exists in the world before any model is trained. If women were historically excluded from senior roles, a model trained to predict "good leader" from historical hiring data will learn that pattern. The data is accurate; the world it reflects is unjust. No amount of better data collection fixes this without confronting the underlying social reality.

Representation bias (also called sampling bias) occurs when the training distribution does not match the deployment distribution. Buolamwini and Gebru's 2018 "Gender Shades" paper found that commercial facial recognition systems had error rates of <1% on lighter-skinned males but up to 35% on darker-skinned females — because the training corpora were heavily skewed toward lighter faces. The model was not broken; it was accurately optimized for the data it saw.

Measurement bias arises when the proxy variable used to measure the true construct is itself biased. Predicting "creditworthiness" using ZIP code encodes redlining. Predicting "recidivism" using arrest records encodes historical over-policing of minority communities. You are not measuring what you think you are measuring.

Aggregation bias occurs when a single model is applied to a heterogeneous population for which the optimal model differs by subgroup. Diabetic patients of South Asian descent have different HbA1c reference ranges than patients of European descent; a single threshold for "at risk" will mis-classify systematically.

Deployment bias occurs when a model trained for one context is applied in another. A sentiment model trained on Yelp reviews does not transfer cleanly to psychiatric intake notes.

Feedback loops amplify all of the above. A predictive policing model trained on arrest data sends more police to neighborhoods that were historically over-policed, generating more arrests there, which reinforces the model's signal. This is a closed-loop system that has no stable equilibrium except deeper entrenchment of the original bias.

The key insight is that bias is not always a bug — often it is the model performing exactly as designed, on data that reflects a biased world. The ethical question is not only "is the model accurate?" but "accurate at what, for whom, under what deployment conditions?"

import numpy as np
from sklearn.linear_model import LogisticRegression

# Synthetic hiring dataset with historical bias:
# Feature 0: skill score (0-1), Feature 1: gender (0=male, 1=female)
# Historical hiring: women hired at lower rates even at equal skill
np.random.seed(42)
n = 1000
skill = np.random.uniform(0, 1, n)
gender = np.random.randint(0, 2, n)
# Historical decision: biased threshold — women need higher skill to be hired
hired = ((skill > 0.5) & (gender == 0)) | ((skill > 0.7) & (gender == 1))

X = np.column_stack([skill, gender])
y = hired.astype(int)

model = LogisticRegression().fit(X, y)

# Model learns the bias: predicts lower hire probability for women at same skill
skill_val = 0.65
print(f"P(hired|skill=0.65, male)  = {model.predict_proba([[skill_val, 0]])[0,1]:.2f}")
print(f"P(hired|skill=0.65, female)= {model.predict_proba([[skill_val, 1]])[0,1]:.2f}")
# Even though both have identical skill, the model reproduces the historical bias.
# Removing 'gender' from features does NOT fix this if skill is correlated with gender
# in the training data — that's called 'redundant encoding'.

Once we acknowledge that models can be unfair, we want to define fairness precisely. This turns out to be surprisingly hard. There are multiple, mutually-incompatible formal definitions of fairness, and there are provable impossibility results that show we cannot simultaneously satisfy the most natural ones.

Let $Y$ be the true label, $\hat{Y}$ be the model's prediction, and $A$ be a sensitive attribute (e.g., race or gender). Define:

Demographic Parity (Statistical Parity): $P(\hat{Y}=1 | A=0) = P(\hat{Y}=1 | A=1)$. The probability of a positive prediction is the same across groups. Problem: if the base rates of $Y$ differ across groups, demographic parity forces the model to be less accurate for one group.

Equalized Odds (Hardt et al., 2016): $P(\hat{Y}=1 | A=0, Y=y) = P(\hat{Y}=1 | A=1, Y=y)$ for $y \in {0,1}$. Both true positive rates and false positive rates are equal across groups. This is stricter than demographic parity and is the basis for many legal "disparate impact" analyses.

Calibration: $P(Y=1 | \hat{Y}=p, A=a) = p$ for all $p$ and all values of $a$. The model's stated probability means the same thing regardless of group membership. This is the fairness definition used by Northpointe to defend COMPAS (the recidivism tool).

The Chouldechova-Corbett-Davies Impossibility: Chouldechova (2017) proved that when base rates differ between groups ($P(Y=1|A=0) \neq P(Y=1|A=1)$), you cannot simultaneously achieve:

1. Calibration within each group
2. Equal false positive rates across groups
3. Equal false negative rates across groups

This is not a technical limitation to be engineered around — it is a mathematical theorem. Any system must sacrifice at least one of these. The COMPAS controversy (ProPublica 2016 vs. Northpointe's rebuttal) is essentially a debate about which fairness definition should be used for pretrial risk assessment, framed as a factual dispute. ProPublica measured equalized odds violations; Northpointe measured calibration. Both were right about their respective metrics.

Individual vs. Group Fairness: All of the above are group fairness criteria. Individual fairness (Dwork et al., 2012) says: "similar individuals should be treated similarly," formalized as a Lipschitz condition on the classifier with respect to a task-specific similarity metric. But who defines "similar"? This pushes the ethical question back one level.

The practitioner's takeaway: before deploying any classifier, explicitly choose which fairness definition you are optimizing for, and explain why that choice is appropriate for the deployment context. There is no default.

# Measuring demographic parity and equalized odds violations
import numpy as np

def fairness_report(y_true, y_pred, sensitive_attr):
    groups = np.unique(sensitive_attr)
    stats = {}
    for g in groups:
        mask = sensitive_attr == g
        yt, yp = y_true[mask], y_pred[mask]
        tp = np.sum((yt == 1) & (yp == 1))
        fp = np.sum((yt == 0) & (yp == 1))
        tn = np.sum((yt == 0) & (yp == 0))
        fn = np.sum((yt == 1) & (yp == 0))
        stats[g] = {
            'selection_rate': yp.mean(),           # for demographic parity
            'tpr': tp / (tp + fn) if (tp+fn) > 0 else 0,  # true positive rate
            'fpr': fp / (fp + tn) if (fp+tn) > 0 else 0,  # false positive rate
        }
    print("Group | SelectionRate | TPR   | FPR")
    for g, s in stats.items():
        print(f"  {g}   | {s['selection_rate']:.3f}         | {s['tpr']:.3f} | {s['fpr']:.3f}")
    # Demographic parity gap:
    rates = [s['selection_rate'] for s in stats.values()]
    print(f"\nDemographic parity gap: {max(rates) - min(rates):.3f}")
    # (gap > 0.1 is a common threshold for concern)

# Synthetic example: base rates differ between groups A=0 and A=1
np.random.seed(7)
n = 500
A = np.random.randint(0, 2, n)
Y = np.where(A == 0, np.random.binomial(1, 0.4, n),
                     np.random.binomial(1, 0.2, n))  # different base rates
Yhat = np.random.binomial(1, 0.35, n)  # a naive constant-rate predictor
fairness_report(Y, Yhat, A)

Given that we understand where bias enters and how to measure it, how do we reduce it? The interventions fall into three families depending on where in the pipeline they act:

Pre-processing (data-level): Modify the training data before fitting any model.

• Reweighting/resampling: Up-weight underrepresented groups or instances where the model is likely to be biased. Kamiran & Calders (2012) showed that assigning instance weights to reduce dependence between $Y$ and $A$ in the training set can substantially reduce demographic parity violations.
• Learning fair representations (LFR): Zemel et al. (2013) train an encoder that maps inputs to a latent space where the sensitive attribute is maximally unpredictable (via an adversary) while preserving predictive information.
• Disparate impact remover: Feldman et al. (2015) repair feature distributions so that the Wasserstein distance between feature distributions across groups is reduced.

The risk: pre-processing can destroy information that is legitimately predictive, reducing accuracy for everyone. There is no free lunch.

In-processing (model-level): Incorporate fairness as a constraint or regularizer during training.

• Adversarial debiasing (Zhang et al., 2018): Train a predictor $P$ and an adversary $A$ simultaneously. $P$ tries to predict $Y$; $A$ tries to predict the sensitive attribute from $P$'s internal representations. $P$ is penalized proportionally to $A$'s success. This is a GAN-like setup where the equilibrium corresponds to representations that are predictive but not group-informative.
• Fairness constraints as Lagrangian relaxation: Add a penalty $\lambda \cdot \text{FairnessViolation}$ to the loss function. The $\lambda$ hyperparameter controls the accuracy-fairness tradeoff.
• Constrained optimization (Zafar et al., 2017): Reformulate training as a constrained optimization problem with explicit fairness constraints. More principled than regularization but harder to optimize.

Post-processing (decision-level): Modify model outputs after the model is trained.

• Threshold calibration: Use different decision thresholds for different groups to equalize TPR or FPR. Hardt et al. (2016) proved this is optimal under equalized odds among all post-processing approaches.
• Reject option classification: Near the decision boundary (where the model is most uncertain), defer the decision to a human or use a more conservative rule.

The accuracy-fairness tradeoff is real but not always severe. Research by Dutta et al. (2020) found that in many real datasets, the Pareto frontier between accuracy and fairness is not steep — substantial fairness gains are achievable at modest accuracy cost. But the tradeoff depends heavily on the dataset, the fairness definition, and the baseline model. Empirical measurement is always required.

# Threshold calibration for equalized odds (post-processing)
import numpy as np
from scipy.optimize import minimize_scalar

def find_fair_threshold(scores, y_true, sensitive_attr, target_group=1, ref_group=0):
    """
    Find per-group thresholds that equalize TPR across groups.
    Returns (threshold_ref, threshold_target).
    """
    def tpr_at_threshold(scores, labels, t):
        preds = (scores >= t).astype(int)
        tp = np.sum((labels == 1) & (preds == 1))
        fn = np.sum((labels == 1) & (preds == 0))
        return tp / (tp + fn) if (tp + fn) > 0 else 0.0

    ref_mask = sensitive_attr == ref_group
    tgt_mask = sensitive_attr == target_group

    # Fix reference group threshold at 0.5; find target threshold that matches TPR
    t_ref = 0.5
    tpr_ref = tpr_at_threshold(scores[ref_mask], y_true[ref_mask], t_ref)

    def objective(t):
        return abs(tpr_at_threshold(scores[tgt_mask], y_true[tgt_mask], t) - tpr_ref)

    result = minimize_scalar(objective, bounds=(0.01, 0.99), method='bounded')
    return t_ref, result.x

# Usage: apply group-specific thresholds at inference time
# preds = np.where(sensitive_attr == 0, scores >= t_ref, scores >= t_target)

Privacy is not merely a legal right — it is an enabling condition for autonomy, dissent, and the exercise of other rights. As Justice Sotomayor wrote in United States v. Jones (2012): "Awareness that the Government may be watching chills associational and expressive freedoms."

Modern surveillance operates through layered architectures:

Data collection layer: Smartphones, smart speakers, fitness trackers, browser cookies, loyalty card programs, CCTV networks, and ISP traffic logs generate continuous, fine-grained behavioral streams. The key insight is that metadata is content. Stewart Baker (former NSA General Counsel) said it directly: "Metadata absolutely tells you everything about somebody's life." Knowing who you called, when, from where, and for how long is often more revealing than the content of the call.

Aggregation and inference layer: Individual datasets, innocuous in isolation, become highly invasive when joined. Sweeney (2000) showed that 87% of Americans can be uniquely identified by the combination of {ZIP code, birth date, gender} alone — a classic demonstration of the aggregation attack. De-anonymization attacks on Netflix's "anonymized" rating dataset (Narayanan & Shmatikoff, 2008) and on mobility traces (de Montjoye et al., 2013) showed that supposedly anonymized datasets can often be re-identified using auxiliary information.

Centralized surveillance: The 2013 Snowden revelations documented PRISM (direct collection from Google, Apple, Microsoft, Facebook) and XKeyscore (Internet traffic interception). CCTV systems in the UK and China, combined with facial recognition, enable real-time tracking of individuals across cities. China's Social Credit System integrates financial, judicial, and behavioral data into a unified score with material consequences.

Commercial surveillance (surveillance capitalism): Shoshana Zuboff's framework describes how behavioral data is extracted from human experience, processed into "behavioral surplus" beyond what is needed for service improvement, and fed into prediction products sold to advertisers and others. The revenue is not from selling goods or services to users; it is from selling predictions about users' future behavior. This creates a systematic incentive to maximize data extraction, regardless of user welfare.

Networked surveillance: Even users who opt out are affected by the behavior of their contacts. Matz et al. (2017) showed that Facebook "Likes" by your friends, combined with the friends-of-friends graph, can predict your personality traits with high accuracy — without your consent or participation.

Chilling effects as systemic harm: Penney (2016) documented a 20% drop in Wikipedia traffic to terrorism-related articles after the 2013 NSA revelations — a measurable chilling of legitimate research. Surveillance does not need to be used against you to harm you; the awareness of surveillance is itself the harm.

# Demonstrating the aggregation attack: re-identification from quasi-identifiers
# Even seemingly harmless data can uniquely identify individuals

from itertools import combinations
import pandas as pd
import numpy as np

def quasi_identifier_uniqueness(df, attributes):
    """
    For each subset of 'attributes', compute the fraction of rows
    that are unique (i.e., form a group of size 1) — the re-identification risk.
    """
    results = []
    for r in range(1, len(attributes) + 1):
        for combo in combinations(attributes, r):
            groups = df.groupby(list(combo)).size()
            unique_frac = (groups == 1).sum() / len(df)
            results.append({'attrs': combo, 'unique_fraction': unique_frac})
    return pd.DataFrame(results).sort_values('unique_fraction', ascending=False)

# Synthetic dataset: ZIP, birth_year, gender
np.random.seed(0)
n = 1000
df = pd.DataFrame({
    'zip':        np.random.choice([10001, 10002, 10003, 10004, 10005], n),
    'birth_year': np.random.randint(1950, 2005, n),
    'gender':     np.random.choice(['M', 'F', 'NB'], n),
    'name':       [f'Person_{i}' for i in range(n)]  # this is the secret
})
result = quasi_identifier_uniqueness(df, ['zip', 'birth_year', 'gender'])
print(result.head(10))
# On real US Census data, (zip, birth_year, gender) uniquely identifies ~20-40%;
# adding even one more field (e.g., employer) can reach 87%+ as Sweeney showed.

Informal privacy guarantees ("we anonymize your data") have repeatedly failed under re-identification attacks. Differential privacy (DP), introduced by Dwork, McSherry, Nissim, and Smith in 2006, provides the first mathematically rigorous privacy guarantee.

The core intuition: A randomized algorithm $\mathcal{M}$ is $\epsilon$-differentially private if the output distribution changes by at most a multiplicative factor of $e^\epsilon$ when any single individual's record is added or removed from the input. More precisely, for all datasets $D$ and $D'$ differing in exactly one record, and for all possible outputs $S$: $$P[\mathcal{M}(D) \in S] \leq e^\epsilon \cdot P[\mathcal{M}(D') \in S]$$

$\epsilon$ is the privacy budget (also called the "privacy loss parameter"). $\epsilon = 0$ is perfect privacy (the output is independent of any individual's data). $\epsilon = \infty$ is no privacy. In practice, $\epsilon \leq 1$ is considered strong; $\epsilon \leq 10$ is moderate; Google and Apple use $\epsilon$ values of 1–8 in production systems.

The Laplace mechanism: To compute a numeric statistic $f$ on a dataset with differential privacy, add Laplace noise calibrated to the sensitivity of $f$ (how much can one person's record change $f$?) divided by $\epsilon$: $$\mathcal{M}(D) = f(D) + \text{Lap}\left(\frac{\Delta f}{\epsilon}\right)$$ For a simple count query, $\Delta f = 1$ (one person can change the count by at most 1). For a sum query bounded in $[0, B]$, $\Delta f = B$.

Composition: If you run $k$ mechanisms each with budget $\epsilon_i$, the total privacy loss is at most $\sum_i \epsilon_i$ (sequential composition). This means privacy is a finite resource — once spent, it cannot be recovered. Repeated queries on the same dataset consume privacy budget.

Local vs. central DP: In central DP, a trusted curator holds the raw data and releases noisy statistics. In local DP, each user randomizes their own data before sending it — no trust in the curator required. Apple's iOS keyboard and emoji usage collection uses local DP (RAPPOR-like). Google's Chrome telemetry uses local DP. Local DP requires much more noise for the same accuracy, typically $O(\sqrt{n})$ more, but provides a stronger trust model.

DP-SGD: Abadi et al. (2016) showed how to train neural networks with DP guarantees via noisy gradient descent: clip gradients to bound per-example sensitivity, then add Gaussian noise. This is now implemented in TensorFlow Privacy and PyTorch Opacus. The cost is a reduction in model utility, especially for minority subpopulations — a fairness-privacy tension.

What DP does NOT guarantee: It does not prevent the output from being correlated with sensitive attributes in the original data (if those attributes are in the data). It does not prevent inference attacks that use external auxiliary information. It is a statement about what the algorithm leaks, not about what an adversary can infer from other sources.

import numpy as np

def laplace_mechanism(true_value, sensitivity, epsilon):
    """Add Laplace noise for epsilon-differential privacy."""
    scale = sensitivity / epsilon
    noise = np.random.laplace(0, scale)
    return true_value + noise

def private_histogram(data, bins, sensitivity=1, epsilon=1.0):
    """
    Differentially private histogram over integer data.
    sensitivity=1 because adding/removing one person changes one bin count by 1.
    """
    counts, edges = np.histogram(data, bins=bins)
    noisy_counts = np.array([
        max(0, int(round(laplace_mechanism(c, sensitivity, epsilon))))
        for c in counts
    ])
    return noisy_counts, edges

# Demonstrate: privacy budget vs. accuracy tradeoff
np.random.seed(42)
ages = np.random.normal(35, 10, 10000).astype(int).clip(18, 80)
bins = range(18, 82, 5)

true_hist, edges = np.histogram(ages, bins=bins)

for eps in [0.1, 1.0, 10.0]:
    noisy_hist, _ = private_histogram(ages, bins=bins, epsilon=eps)
    error = np.mean(np.abs(true_hist - noisy_hist))
    print(f"epsilon={eps:4.1f} | mean absolute error per bin: {error:.1f}")
# As epsilon increases (less privacy), error decreases (more accuracy)
# This is the fundamental privacy-utility tradeoff

Classical information ethics frameworks like "informed consent" were designed for medical trials — a setting where data is collected for a specific, disclosed purpose, from an identified subject, who can meaningfully weigh the risks. Modern data pipelines violate every one of these conditions.

The consent fiction: "I agree" dialogs are not meaningful consent. Mcdonald and Cranor (2008) estimated that reading every privacy policy you encounter would take 76 work days per year. When consent is nominally required but practically impossible to give meaningfully, "consent" functions as legal cover for extraction, not as a genuine mechanism for user autonomy.

Contextual integrity (Nissenbaum, 2004): A more principled framework than consent. Information flows appropriately when they match the norms of the context in which information was shared. Your medical records shared with your doctor flow appropriately to your specialist; they do not flow appropriately to your employer, even with "consent" obtained under economic duress. Contextual integrity explains why Facebook's News Feed (2006) caused a privacy backlash even though it only surfaced public information — the context (semi-public profile viewing) did not match the new context (broadcast feed).

Data as labor (Lanier, Posner/Weyl): Jaron Lanier and Glen Weyl argue that behavioral data should be treated as labor contributed by users, entitling them to compensation. Under this framework, the current arrangement — where users provide data for free and platforms monetize it — is extractive rather than mutually beneficial. Policy proposals include data dividends (California), data portability requirements (GDPR Article 20), and data unions.

The training data problem: Generative AI models are trained on text, images, and code scraped from the internet, much of it copyrighted or produced by identifiable individuals. The legal status is contested (several US lawsuits in 2023–2024). The ethical questions are sharper: is it ethical to train on data whose original creators did not consent to model training? Does the model "memorize" personal data in ways that can be extracted?

Data colonialism: Couldry and Mejias (2019) argue that the data economy replicates colonial extraction patterns: raw data is extracted from users in the Global South, processed and monetized in the Global North, and the resulting products sold back. The value flows in one direction; the infrastructure for data-driven decision-making is concentrated in a few jurisdictions.

Minimal collection and purpose limitation: GDPR Articles 5(1)(b) and 5(1)(c) codify two important principles: purpose limitation (data collected for one purpose cannot be used for a different one) and data minimisation (collect only what is necessary for the stated purpose). These are good engineering principles as well as legal requirements — less data means smaller attack surface, lower storage cost, and fewer liability risks.

# Illustrating purpose limitation and data minimisation in system design
# Good practice: collect only what you need, enforce at schema level

from dataclasses import dataclass, field
from typing import Optional
import hashlib

@dataclass
class UserForRecommendation:
    """Minimal profile for a product recommendation engine.
    Principle: collect only features the model actually uses.
    """
    # Needed for collaborative filtering
    user_id_hash: str          # hashed, not raw PII
    age_bucket: str            # '18-24', '25-34', etc. NOT birth date
    purchase_categories: list  # NOT individual items (more private)
    # NOT collected: name, email, precise location, device ID

    @classmethod
    def from_raw(cls, raw_user: dict, purpose: str = 'recommendation'):
        """Purpose-bound constructor: only extracts fields needed for this purpose."""
        assert purpose == 'recommendation', \
            f"This schema is only valid for 'recommendation', not '{purpose}'"
        age = raw_user.get('age', 0)
        bucket = '18-24' if age < 25 else ('25-34' if age < 35 else '35+')
        uid_hash = hashlib.sha256(str(raw_user['user_id']).encode()).hexdigest()[:16]
        return cls(
            user_id_hash=uid_hash,
            age_bucket=bucket,
            purchase_categories=raw_user.get('category_history', [])
        )

# The schema itself enforces that you cannot accidentally use raw PII
# in the recommendation pipeline, because the raw fields are never extracted.

Accountability requires that when a system causes harm, there is a clear chain of responsibility and a mechanism for redress. Transparency requires that the system's behavior can be understood by those it affects. Both are difficult to achieve with modern machine learning systems.

The right to explanation: GDPR Article 22 establishes that individuals subject to automated decision-making that significantly affects them have the right to an explanation and the right to human review. The exact legal scope is contested, but the engineering challenge is clear: how do you explain a 100-layer neural network's decision to a loan applicant?

Feature importance methods:

• LIME (Local Interpretable Model-agnostic Explanations): Fit a simple linear model in a neighborhood around the prediction to be explained. The linear model's coefficients are the explanation. Computationally cheap; unstable (small perturbations can change the explanation significantly).
• SHAP (SHapley Additive exPlanations): Assigns each feature a contribution based on Shapley values from cooperative game theory — the average marginal contribution of each feature across all possible feature coalitions. Theoretically grounded; consistent and locally accurate. Computationally expensive for deep models.
• Attention weights: Often cited as explanations for Transformer models but Jain & Wallace (2019) showed that attention weights do not reliably indicate which inputs influenced the output.

Limitations of post-hoc explanations: All of the above are approximations of a black box. Rudin (2019) argues in "Stop Explaining Black Box Machine Learning Models" that in high-stakes domains (criminal justice, medicine, loan decisions), we should use inherently interpretable models (decision trees, rule lists, scorecards) and incur the accuracy cost, rather than use black boxes with unreliable post-hoc explanations. This is a minority but important view.

Model cards and datasheets: Mitchell et al. (2019) proposed model cards — standardized documentation for ML models covering intended use, performance metrics across subgroups, and limitations. Gebru et al. (2021) proposed datasheets for datasets — analogous documentation for training data. These are transparency tools, not guarantees.

Algorithmic auditing: Third-party auditing of AI systems — analogous to financial auditing — is now mandated in some contexts (NYC Local Law 144, which requires bias audits of automated employment decision tools). Technical approaches include: black-box audit via API queries (Sandvig et al., 2014), subgroup performance analysis, counterfactual testing ("would the decision change if race/gender were different?"), and differential testing (feeding matched pairs differing only in sensitive attributes).

Accountability gaps in AI supply chains: Modern AI systems are assembled from components: pre-trained foundation models, fine-tuning pipelines, deployment infrastructure, API calls to third-party models. When harm occurs, responsibility is diffused across this supply chain. Legal frameworks have not yet caught up.

# SHAP values: explaining a gradient boosting model's decisions
import numpy as np

# Pseudocode for computing SHAP values via the TreeExplainer
# (requires: pip install shap xgboost)
"""
import shap
import xgboost as xgb
from sklearn.datasets import load_breast_cancer
from sklearn.model_selection import train_test_split

X, y = load_breast_cancer(return_X_y=True, as_frame=True)
X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=0)

model = xgb.XGBClassifier(n_estimators=100, max_depth=3, random_state=0)
model.fit(X_train, y_train)

explainer = shap.TreeExplainer(model)
shap_values = explainer.shap_values(X_test)

# For instance 0: each feature's contribution to the log-odds of prediction
print("Feature contributions for sample 0:")
for fname, sv in sorted(zip(X.columns, shap_values[0]),
                         key=lambda x: abs(x[1]), reverse=True)[:5]:
    direction = 'increases' if sv > 0 else 'decreases'
    print(f"  {fname}: {sv:+.3f} ({direction} probability of malignant)")

# SHAP satisfies: sum(shap_values) + expected_value = model output
# This makes explanations locally faithful by construction.
"""

# The key properties SHAP guarantees (unlike LIME):
# 1. Local accuracy: explanation sums to model output
# 2. Consistency: if a feature's contribution increases in all coalitions, its SHAP value increases
# 3. Dummy: features that never change the output get SHAP value 0
print("SHAP properties ensure principled, game-theoretically grounded feature attribution.")

Engineering decisions are ethical decisions. Choosing a loss function, a train/test split strategy, a fairness definition, a data retention policy — all of these embed normative assumptions. The professional responsibility of an engineer includes being able to articulate and defend those assumptions. Classical ethical theories provide the vocabulary.

Consequentialism (utilitarianism): An action is right if it maximizes overall welfare. In AI: optimize for a metric that aggregates societal benefit. The challenge is that aggregation can justify sacrificing minorities for majority benefit — a predictive policing system that reduces total crime while increasing false arrests for one community might look good in aggregate. Expected value calculations also require commensuration (how do you weigh privacy against convenience?) and accurate probability estimates, both of which are unreliable.

Deontology (Kant): An action is right if it conforms to a universal moral rule, regardless of consequences. The categorical imperative: act only according to principles you could will to be universal laws. In AI: treat users as ends in themselves, never merely as means. This grounds privacy as an absolute right (not to be traded for utility) and prohibits deception regardless of consequences. Deontological constraints translate naturally to system requirements: never collect data not consented to; never use a model for purposes outside its stated scope.

Virtue ethics (Aristotle): What would a person of good character do? Rather than optimizing a metric or following a rule, ask: what practices and dispositions should AI teams embody? This framing is useful for organizational ethics — the question is not just "did we violate a rule?" but "are we the kind of team that surfaces ethical concerns early, disagrees with product decisions when warranted, and takes responsibility for downstream harms?"

Contractualism (Rawls): Principles are just if they would be agreed to by rational parties behind a "veil of ignorance" — not knowing their position in the resulting society. The maximin principle: design systems that maximize the welfare of the worst-off group. In AI fairness: a system is ethically acceptable only if you would accept it if you did not know which group you would be assigned to. This is structurally similar to equalized odds — it prioritizes the worst-case group outcome.

Feminist ethics of care: Emphasizes relationships, context, and the particular. Rejects universal rules in favor of attending to the concrete needs and vulnerabilities of those affected. In AI: human oversight is not merely a legal requirement but a moral imperative; the people most harmed by AI systems are typically those with the least voice in their design.

The frameworks in practice: Real ethical decisions typically invoke multiple frameworks. When they agree, you have stronger justification. When they conflict, you have a genuine dilemma that requires deliberation, not calculation. The skill is knowing which framework to lead with in which context — consequentialist reasoning is appropriate for resource allocation under uncertainty; deontological constraints are appropriate for individual rights; virtue ethics is appropriate for organizational culture.

Ethics without enforcement is advisory. Understanding the legal frameworks that govern AI and data is a professional requirement for any engineer working at scale.

GDPR (General Data Protection Regulation, EU, 2018): The most comprehensive data protection framework in the world. Key principles relevant to engineers:

• Lawful basis: Data processing requires one of six lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests). "Legitimate interests" is frequently misused as a catch-all.
• Data subject rights: Right of access (Article 15), rectification (16), erasure / "right to be forgotten" (17), portability (20), and objection (21). Engineers must implement infrastructure to honor these rights — often non-trivially in distributed systems.
• Privacy by design and by default (Article 25): Data protection must be built into systems from the start, not bolted on. Default settings must be the most privacy-protective available.
• Data Protection Impact Assessment (DPIA, Article 35): Required before deploying high-risk processing (profiling, biometric data, large-scale monitoring).
• Penalties: Up to €20M or 4% of global annual revenue, whichever is higher. Meta fined €1.2B in 2023.

CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act): US analogue, weaker than GDPR. Grants Californians rights to know, delete, opt out of sale, and non-discrimination. The CPRA (2023) added a right to correct inaccurate data and established the California Privacy Protection Agency (CPPA) as an independent enforcement body.

Illinois BIPA (Biometric Information Privacy Act, 2008): Regulates collection of biometric identifiers (fingerprints, facial geometry, iris scans). Requires written consent and a retention/destruction policy. Private right of action (unlike GDPR/CCPA): $1,000–5,000 per violation. Led to large settlements against Facebook (face recognition, $650M) and Google ($100M).

EU AI Act (2024): The first comprehensive AI-specific regulation. Classifies AI systems by risk:

• Unacceptable risk (prohibited): social scoring by governments, real-time remote biometric identification in public spaces (with narrow exceptions), manipulative AI that exploits subconscious vulnerabilities.
• High risk (conformity assessment required): AI in critical infrastructure, education, employment, essential services, law enforcement, migration, administration of justice.
• Limited risk: Disclosure obligations (e.g., chatbots must disclose they are AI).
• Minimal risk: No obligations. Foundation models / "General Purpose AI" (GPAI) face additional transparency and systemic-risk requirements.

US Section 230 and its limits: Section 230 of the Communications Decency Act immunizes platforms from liability for user-generated content and for good-faith moderation. It does not immunize platforms from liability for their own algorithmic recommendations — a distinction that is increasingly litigated (Gonzalez v. Google, 2023).

# GDPR 'right to erasure' implementation sketch in a user database
# Article 17: 'right to be forgotten' requires deletion of personal data
# This is non-trivial in ML systems because training data may be baked into models

def gdpr_erasure_handler(user_id: str, db, model_registry):
    """
    Steps for GDPR Article 17 compliance:
    1. Delete from operational databases
    2. Delete from data warehouse / analytics
    3. Remove from ML training datasets (or log for next retrain)
    4. If user data was used for model training, assess whether model unlearning is required
    5. Propagate deletion to data processors (Article 28 obligations)
    6. Log the erasure request and action taken (for accountability)
    """
    # Step 1: Hard delete from operational DB
    db.execute("DELETE FROM users WHERE user_id = ?", (user_id,))
    db.execute("DELETE FROM user_events WHERE user_id = ?", (user_id,))

    # Step 2: Mark for deletion from analytics (may require quarantine period)
    db.execute(
        "INSERT INTO erasure_queue(user_id, requested_at, status) VALUES (?, NOW(), 'pending')",
        (user_id,)
    )

    # Step 3: Check if user data is in active training sets
    affected_models = model_registry.models_trained_on(user_id)
    if affected_models:
        # Machine unlearning is an active research area; for now, schedule retrain
        for model_id in affected_models:
            model_registry.schedule_retrain_without(model_id, user_id)

    # Step 4: Log for audit trail (keep the *fact* of erasure, not the PII)
    db.execute(
        "INSERT INTO audit_log(event, user_id_hash, timestamp) VALUES ('erasure', hash(?), NOW())",
        (user_id,)
    )
    # NOTE: 'user_id_hash' stored, not the raw ID — you need to prove erasure happened
    # but cannot store the PII to prove it. This is a genuine compliance tension.

Abstract principles become concrete through case studies. The following are real, well-documented instances of AI-related harm, analyzed through the technical and ethical frameworks above.

COMPAS (Correctional Offender Management Profiling for Alternative Sanctions): A recidivism risk scoring tool used by courts in multiple US states for bail, sentencing, and parole decisions. ProPublica's 2016 analysis found that Black defendants scored higher on the "high risk" scale than white defendants when controlling for actual re-offense rates — a false positive rate disparity of roughly 2:1. Northpointe (the developer) responded that the tool is calibrated (the score means the same thing across groups). Both claims are mathematically correct; this is the impossibility theorem in practice. Key issue: the tool's outputs were used by judges without adequate explanation of its limitations, and defendants had no mechanism to challenge the score.

Amazon hiring algorithm (2018): Amazon trained a model to screen resumes using historical hiring decisions as ground truth. Since men were historically hired at higher rates for technical roles, the model learned to penalize resumes that included the word "women's" (as in "women's chess club") and downgraded graduates of all-women's colleges. Amazon disbanded the project. This is a textbook case of historical bias encoded via proxy variables.

Automated facial recognition in policing: Robert Williams (Detroit, 2020) was arrested based on a facial recognition match that was incorrect. He spent 30 hours in jail before the error was identified. The system's error rate on darker-skinned faces was documented in the Gender Shades study. Detroit PD was using a system whose known limitations were not disclosed to the officer or to the court. This is a case where deployment context (high-stakes, no human verification of match) made an imperfect technology actively harmful.

Allegheny Family Screening Tool: Used in Allegheny County, PA, to screen families for child welfare risk. Eubanks (2018) documented how the tool disproportionately flags low-income families because poverty-correlated variables (public benefits history, housing instability) are used as proxies for risk. The tool encodes the surveillance apparatus of the social services system — poor families are visible in the data in ways that wealthy families are not. This is a measurement bias problem: what is being measured is not risk, but visibility.

Content moderation at scale: Facebook's internal research (leaked 2021) showed that the recommendation algorithm amplified outrage and polarization because such content maximized engagement. The company's own researchers found that changes to reduce this were deprioritized for business reasons. This is an example of optimization target misalignment: the objective function (engagement) was not aligned with the stated mission (connecting people) or with user welfare.

Lessons across cases:

1. Harm is not always caused by technical failure. It is often caused by deployment choices, misuse, or misalignment between optimization targets and human values.
2. "It's just a tool" is not a defense. The same technical system (facial recognition, risk scoring) can be safe or unsafe depending on deployment context, disclosure, and appeal mechanisms.
3. Harms are disproportionately borne by people who are already marginalized. This is not coincidental — it follows from the fact that historical data encodes historical power structures.

Individual engineers make choices that have collective consequences. Understanding professional responsibility in the context of AI ethics requires confronting the limits of individual action within institutional structures.

The ACM Code of Ethics (2018) articulates principles including: contribute to society and human well-being; avoid harm; be honest and trustworthy; be fair and take action not to discriminate; respect privacy; honor confidentiality. The critical clause: "If a professional organization or employer requires adherence to a code of ethics that conflicts with these principles, the professional should consider whether it is appropriate to resign."

Weapons of math destruction (O'Neil, 2016): Cathy O'Neil identifies three characteristics of harmful algorithms: opacity (affected parties cannot understand or challenge them), scale (they affect millions simultaneously), and damage feedback loops (they punish people for being poor, sick, or vulnerable in ways that make those conditions worse). The engineer's responsibility is to assess these three dimensions before deployment.

Organizational ethics and whistleblowing: Most harm from AI systems is not caused by malicious engineers; it is caused by institutional incentives that prioritize speed and growth over safety. The Google walkout (2018, over military AI contracts and harassment), the internal Facebook research on Instagram and teen mental health (2021), and Timnit Gebru's dismissal from Google (2020, over an AI ethics paper) are examples of the tension between individual ethical judgment and institutional pressure. The engineer's options include: internal escalation, documentation, anonymous reporting, external whistleblowing, and resignation. None of these are cost-free.

Participatory design and affected communities: The most underutilized tool in AI ethics is direct involvement of affected communities in system design. Participatory design (Schuler & Namioka, 1993) argues that systems should be co-designed with the people who will use and be affected by them. For high-stakes AI (welfare algorithms, risk scoring, content moderation), this means including advocacy organizations, affected community members, and domain experts in the design process — not as checkbox consultation but as genuine co-designers.

The limits of individual ethics: Individual engineers choosing ethically cannot substitute for structural regulation. A single engineer who refuses to build a biased hiring tool will be replaced. What changes systems is: legal requirements, market pressure from informed consumers, organized labor (tech workers as a political constituency), and regulatory enforcement. Individual ethical clarity is a necessary but not sufficient condition for systemic change. This is not a reason for cynicism — it is a reason to understand that ethics has a collective dimension that purely individual frameworks miss.