Fair Bandits Under Privacy and Adversarial Constraints

Differential privacy (DP) is widely used in contextual bandits to protect sensitive user data. In this paper, we show how an adversary can conceal fairness-targeted corruptions within DP noise while overcoming its smoothing effect on reward estimates, which otherwise makes non-smooth reward functions less sensitive to small perturbations. The attack can maximize group regret disparity under a KL budget relative to the DP noise. We analyze four methods for spending the attack budget: Variant I (diffuse) spreads the perturbation uniformly across all dimensions, Variant II (concentrated) aligns the perturbation with the group-boundary normal, Variant III (burst) concentrates the budget into a short temporal window, and Variant IV (adaptive) conditions the perturbation direction on the observed noisy context. Experiments on six bandit algorithms across three real-world datasets show that the concentrated attack causes the largest fairness damage at a modest regret cost, and DP with per-dimension monitoring protects group fairness.