On Counterfactual Explanations under Predictive Multiplicity

Counterfactual explanations are usually obtained by identifying the smallest change made to an input to change a prediction made by a fixed model (hereafter called sparse methods). Recent work, however, has revitalized an old insight: there often does not exist one superior solution to a prediction problem with respect to commonly used measures of interest (e.g. error rate). In fact, often multiple different classifiers give almost equal solutions. This phenomenon is known as predictive multiplicity (Breiman, 2001; Marx et al., 2019). In this work, we derive a general upper bound for the costs of counterfactual explanations under predictive multiplicity. Most notably, it depends on a discrepancy notion between two classifiers, which describes how differently they treat negatively predicted individuals. We then compare sparse and data support approaches empirically on real-world data. The results show that data support methods are more robust to multiplicity of different models. At the same time, we show that those methods have provably higher cost of generating counterfactual explanations under one fixed model. In summary, our theoretical and empiricaln results challenge the commonly held view that counterfactual recommendations should be sparse in general.


INTRODUCTION
Counterfactual explanations are usually obtained by identifying the smallest change made to an input vector to qualitatively influence a prediction of a pretrained classifier in a positive way; for example, from 'loan rejected' to 'awarded' or from 'high risk of cardiovascular disease' to 'low risk'. But what is a good counterfactual?
A tale of 2 camps. The literature commonly agrees that counterfactual explanations mainly serve two purposes (Ustun et al., 2019;Karimi et al., 2020a;Wachter et al., 2017): First, they should help understand a model's local decision boundary, answering questions like "Why does the model give a certain prediction for a given individual?" (purpose I). Second, counterfactual explanations should provide a recommendation/recommendations for the individual in question (purpose II). Hence, they should give answers to the question "What is the smallest change in inputs an individual needs to make in the future to receive a desired outcome?". In this work, we focus on purpose II and analyze counterfactual explanations from the recommendation perspective.
Often there exist several ways to make a reasonable recommendation. So, what constitutes a reasonable recommendation? We roughly split the current literature into two camps. The first line of work (we call them sparse counterfactuals) assumes that counterfactual recommendations with minimal change in p -norm are most desirable (Wachter et al., 2017;Grath et al., 2018;Russell, 2019;Ustun et al., 2019;Laugel et al., 2017;Karimi et al., 2020a;Tolomei et al., 2017).
The second camp (henceforth called (Data) Support counterfactuals) suggests that the norm should receive second order importance when generating counterfactual explanations. Instead, it would be more desirable to generate counterfactual recommendations that are close to correctly classified observations from the desired class and semantically meaningful (Laugel et al., 2019b,a;Pawelczyk et al., 2020;Joshi et al., 2019;Mahajan et al., 2019). We give exact definitions of both types in section 2. Finally, a recent line of work considers causal interventions to generate counterfactual explanations (Karimi et al., 2020b).
All aforementioned works assume that the pretrained classifier is given and that there exist no uncertainty as to whether it is the best possible classifier or whether it will remain the classifier of choice over time. Counterfactual recommendations are then usually generated with reference to this 'best' pretrained model. Proposal Input subset current value required 1 # credit cards 5 − → 3 2 current debt $3250 − → $1000 3 has savings account 0 − → 1 has retirement account 0 − → 1 Table 1: Stylised example from an individual who was denied credit by a fixed classifier f , i.e. sign(f (x current )) = −1, and three different associated counterfactual recommendations, i.e. sign(f (x required )) = +1. The difference between the current values and the required values are the costs of counterfactual recommendations. Example taken from Ustun et al. (2019).
Counterfactuals under model multiplicity. Recent work has revitalized an old insight (Marx et al., 2019): there often does not exist one superior solution to a prediction problem with respect to commonly used measures of interest (e.g. error rate). In fact, often multiple different models give almost equal solutions. This phenomenon is known as predictive multiplicity (Marx et al., 2019;Breiman, 2001;McCullagh and Nelder, 1989) and in this work we argue that it should shape our understanding of how counterfactual recommendations are generated.
Admitting the existence of several well performing models for the very same prediction task calls the entire business of generating counterfactual recommendations for one particular model into question. Or, as Leo Breiman already put it (Breiman, 2001): " [...] if there exist several equally good models for a given dataset [sic], each of which provides a different explanation of the datagenerating process, then how can we tell which one is correct?". Barocas et al. (2020) identify 4 hidden assumptions underlying the generation of counterfactual explanations: (A1) The underlying model is stable over time. (A2) Explanations can be offered without regard to decision making in other areas of people's lives. (A3) Counterfactual explanations map to real world actions. (A4) Inputs can be made commensurate by looking at the training data. In this work, we will investigate the effect of assumption A1 for counterfactual explanations in theory and in practice.
To get a better understanding for the underlying problem, let us consider the two following scenarios: (a) The decision maker decides to change the deployed model f at some point τ . However, up to τ , f was used to generate counterfactual recommendations.
Will the recommendations still lead to the desired outcome under the competing model g? What are the expected additional costs due to the introduction of g? Will the cost depend on whether we use a sparse or Data Support counterfactual explanation machine?
(b) The decision maker is unsure about the correct classifier f and multiple models give almost identical hold-out test error. Will the explanations E(x; f ) based on the model f generalize to a family of competing models g?
Point (b) refers to a concept usually known as 'researcher/practitioner degrees of freedom'. It describes that it is often not very clear why a certain classifier was chosen from a set of (potentially equally well performing) classifiers. On an individual end-user level, those choices make a difference and can have vast consequences. For example, they can determine whether someone gets a loan or not or whether a decision should be revised or not.
While there has been a sharp recent increase in the availability of methods that attempt to generate counterfactual recommendations (see section 2), there exists remarkably little work regarding their cost guarantees. At the same time, such guarantees might be a crucial element when deciding which method (sparse vs. data support) should be deployed in practice for consequential decisions with humans in the loop. This work attempts to close this gap.
Our contributions. In this paper, we challenge commonly held assumptions in the field of counterfactual explanations. We summarize our key contributions briefly: • Relating the costs of Sparse and Data Support counterfactuals. We theoretically relate the cost of sparse and Data Support counterfactual recommendations. When the classifier is fixed, our result shows that sparse recommendations are provably less costly than those with Data Support. Under model multiplicity, we derive conditions which depend on the relative costs of both methods.
• Cost guarantees for counterfactuals under model multiplicity. We derive an upper bound on the cost of counterfactual explanations under model multiplicity. Our upper bound is stated in terms of the risk of both classifiers and most notably depends on how differently both classifiers assign negative predictions. Our result challenges the commonly held view that a counterfactual recommendations should have the lowest possible cost in general.
• Empirical evaluation of the result. Empirically, we compare Data Support and Sparse methods.
Given one fixed classifier f , the Data Support recommendations are theoretically and empirically more costly, however, they are empirically more invariant to multiplicity of different models than sparse recommendations and result in semantically sensible recommendations.
Structure. In section 2 we give a categorization of different approaches. Section 3 contains theoretical cost guarantees, where we briefly discuss their implications.
In section 4, we describe the compared models and evaluate them both quantitatively with respect to cost and invariance to predictive multiplicity, and qualitatively with respect to their semantics. Finally, section 5 concludes.

RELATED WORK
We denote the d-dimensional feature space as X = R d and the feature vector for observation i by x ∈ X and the j-th dimesn denotes the The labels corresponding to the i-th observation are denoted by y ∈ Y = {−1, +1}. Moreover, we assume two given pretrained, not identical, classifiers f, g : R d − → R. Depending on the sign of f (x) or the sign of g(x) instances are classified. The goal is to find a counterfactual recommendation system for a given f , We also introduce the following sets: Exploring the local decision boundary. This line of work targets purpose I only. These approaches are based on perturbations and attempt to explain the sensitivity of a machine learning model to changes in its inputs by modelling the impact of local perturbations (Ribeiro et al., 2018;Adler et al., 2018;Fong and Vedaldi, 2017). Examples of perturbation-based approaches are LIME (Ribeiro et al., 2016) and SHAP (Lundberg and Lee, 2017). However, none of them attempts to make recommendations for users who are directly affected by the classifications.
Counterfactual explanations. These works target both purposes I and II. Approaches dealing with tabular data rely on solving integer programming optimization problems (Ustun et al., 2019;Russell, 2019), use decision tree based classifiers (Tolomei et al., 2017), satisfiability modulo theory (Karimi et al., 2020a) or use data density approximation (via variational autoencoders) (Joshi et al., 2019;Pawelczyk et al., 2020). Other approaches ignore tabular data entirely (Grath et al., 2018;Laugel et al., 2017), but at least allow for conditionally immutable features (e.g. has a PhD) (Lash et al., 2017). To produce counterfactuals that take on reasonable values (e. g. non negative values for wage income) most approaches let decision makers specify the set of features and their respective support subject to change. We next aim to categorize most of the aforementioned approaches.
Given inputs x ∼ p data , a binary classifier f (x) and a set of all possible counterfactual explanations, E S = {x : sign(f (x)) = +1}, a sparse counterfactual recommendation is defined as c S = arg minx ∈E S x − x p .
Owing to interpretabiliy, p is usually 1 or 2. Several works have been put forth, relying on a variant of this definition (Laugel et al., 2017;Karimi et al., 2020a;Grath et al., 2018;Russell, 2019;Ustun et al., 2019;Wachter et al., 2017;Lash et al., 2017;Mothilal et al., 2020). In fact, a subset of these works additionally considered to restrict E S further; for example some suggest to favour explanations over inputs that have shown to vary much in the past (Wachter et al., 2017), aim at generating diverse recommendations Mothilal et al. (2020) or allowed for having immutable inputs that could not be changed (e.g. Gender, Age) while searching for possible counterfactual recommendations (Lash et al., 2017;Ustun et al., 2019).

Data Support Approaches
Definition 2. (Data) Support counterfactual recommendation. Given inputs x ∼ p data , a binary classifier f (x) and a set of all admissible counterfactual explanations, E D = {x : sign(f (x) = +1 s.t. p data (x) > 0}, a data supported counterfactual recommendation is defined as c D = arg minx ∈E D x − x p .
Definition 2 essentially demands that counterfactual recommendations should be supported by the true data distribution p data . This is what is meant by data support and it comes at a cost since it is easy to see that c D ≥ c S . In proposition 1 below we refine this statement. Additionally, consider figure 1 for an example. Of course, in practice we do not know p data and therefore an explainability generator E(x; f ) would need to take density estimation into account. Notice that this notion is also distinct from actionability (Ustun et al., 2019) or plausibility (Karimi et al., 2020a). They only demand that immutable inputs shall not be changed and that columns ofx lie individually in a reasonable range. Per se, this does not imply p data (x) > 0.  In light of the fact that counterfactual recommendation machines could have a huge impact on individuals' lives, there there exists remarkably little work regarding cost guarantees. With respect to our theoretical results the most relevant work is by Ustun et al. (2019). Proposition 2 is more general (see remark 1) since it considers the case of predictive multiplicity and nonlinear classifiers. In fact, it includes their result as a special case when the considered classifiers f and g coincide and are both linear. To the best of our knowledge, our work is the first that aims at relating the cost of sparse and data support counterfactuals.

Relation between Sparse and Data support Costs
Pawelczyk et al. (2020) establish empirically that there exists a trade-off between low-cost recommendations (sparse) and those with data support (they call them attainable). Here we give a theoretical underpinning of this empirical observation. Suppose x is generated by a generative model h such that h(z) = x, where z ∈ Z = R k are latent codes with k < d. As an example, z could be standard normal distributed. If the generative model was an autoencoder, this amounts to having a perfect encoder and decoder. As in Pawelczyk et al. (2020), we consider the following explanation mechanism to devise counterfactual recommendations via a nearest neighbour search in latent space: Then the following result holds. Proposition 1 (Oracle cost inequality). The cost relation between sparse counterfactual recommendations and data supported counterfactual recommendations adheres: where S and D abbreviate sparse and data support, respectively. The proof can be found in appendix C. If we wish to obtain counterfactual recommendations with data support, proposition 1 suggests that there exists an extra cost, relative to the sparse counterfactual recommendations. In practice, however, a generative model is used for which the encoder and decoder parameters have to be estimated adequately. Therefore, the cost difference is likely to be higher since neither the encoder nor the decoder work perfectly. Our experiments in section 4 consolidate our findings.

Cost of Counterfactual Multiplicity
We start by stating the general objective. The goal is to find a minimal cost action c * which alters the given classifiers' predicted labels from sign((f (x)) = −1 and sign(g(x)) = −1 to +1. More formally, we seek: (2) Next, we state the main assumption used in proposition 1.
Assumption 1 (Pang (1997)). There exist α > 0 and 0 ≤ γ ≤ 1 such that, for all x, The assumption states that a given point x is bounded by the so-called residual. We assume the residual provides a reasonable way to bound the distance from x to a point s ∈ H classified as y = 1 or y = −1. We proceed to define the quantity for which we give an upper bound.
Definition 3 (Cost of counterfactual multiplicity). The expected cost of counterfactual explanations under classifier multiplicity for classifiers f : where the expectation is taken over the distribution of Analogs can be defined in which costs can be computed with respect to classifiers f or g only. For example, for the classifier f we would ob- where the objective in 2 would need to be altered appropriately. Definition 3 asks to find the expected minimum cost of counterfactual recommendations when we have to satisfy the constraint set out by two classifiers (see (2)).
Proposition 2 (Bounding costs of counterfactual multiplicity). Given assumption 1, the cost of counterfactual multiplicity under classifiers f and g, cost(f, g) H − f ∪H − g , is bounded from above such that, maximum risk of f and g false negative rates of f and g true negative rates of f and g (3) of counterfactual recommendation for classifier f ; Analogs can be defined for classifier g and the proof is given in appendix D. The expected cost of counterfactual explanations under predictive multiplicity does not directly depend on the overall classification error rate, but instead focuses on those individuals for whom we made negative predictions.
We would like to highlight the discrepancy term in proposition 2. Consider figure 2 for a more illustrative explanation of this term. Although the areas H + f ∩ H − g and H − f ∩ H + g are already covered by the false and true negative rates of both classifiers, the discrepancy term counts them again. Intuitively, this is due to the fact that the red junctions in the upper left corner can neither be moved to We would now like to take a step back and highlight some noteworthy real-world implications of this result: Since these areas are not admissible we have to pay an extra price for them to be moved to H + f ∩ H + g . This intuition is captured by the ∆(f, g) term in proposition 2.
• Challenge minimal cost recommendations. When assumption A1 (Barocas et al. (2020); also mentioned in the introduction) is violated, our analysis suggests that finding sparse, minimal cost counterfactual recommendations with respect to a fixed classifier f fails to reflect the real expected cost of counterfactual recommendations.
• Distort trust in automated ML. If declined end users are initially issued a list of recommended feature changes and those changes turn out to be more costly due to, say, model updates over time, then this can severely distort trust in automated decision making systems. To the best of our knowledge, a legal framework for such cases does not exist, yet.
Remark 1. If we take γ = 1 and f and g coincide, i.e. f (x) = g(x) ∀x, then our result recovers theorem 3 in Ustun et al. (2019), where γ = 1 corresponds to the case where were we look at linear classifiers.
Next we evaluate under which conditions any of the existing methods (sparse vs. data support) generate more robust counterfactual recommendations.

Relating the Cost of Negative Surprise for Sparse and Data Support Counterfactuals
We would like to find out what the additional cost induced by the classifier g would be. We call it the cost of negative surprise. Intuitively, it measures whether individuals subjected to a particular recommendation method (say sparse vs. data support recommendations) should be worried that their recommendation would change under a different classifier. If the classifiers g and f were to coincide for all instances x, then the cost of negative surprise to all individuals would be 0 since no individual would need to exert additional effort/cost to satisfy a new constraint, which is illustrated in the right panel of figure 1.
Definition 4 (Inverse cost of negative surprise). The normalized inverse cost of negative surprise under model multiplicity for classifiers f : The inverse cost is a measure of invariance of a counterfactual recommendation to different classifiers and ideally evaluates to 1. This happens when that is, in expectation there will be no additional changes to the cost of counterfactual recommendations due to the introduction of a competing classifier g.
Remark 2. Definition 4 appears cumbersome, however, it allows us to use a lower bound for Proposition 3 (Negative surprise for sparse and data support recommendations). For simplicity of the statement, suppose γ = 1.
then we must have that: The proof of Proposition 3 can be found in appendix E. It suggests a direct way to check whether counterfactual suggestions generated by the sparse methods are less prone to negative surprise than those generated by the Data Support camp. Note that the sparse explanation method could trivially satisfy this condition by generating high cost recommendations for the classifier g. For example, a sparse method could push the red junctions in the upper left of figure 2 all the way to the bottom right of the plot. However, by definition 1 sparse explanations mechanisms are not set out to do so. It would indeed be counterproductive for the generation of counterfactual recommendations that end-users can realistically translate into lived realities.
This result implies an interesting question (for future research): Can we generate invariant counterfactual recommendations with minimal costs? In the following, we do not suggest a new way to do so, but we evaluate whether existing methods already do.

EXPERIMENTS
Data sets. We conduct extensive quantitative and qualitative evaluations on two different realistic classification settings: (i) 'Give Me Some Credit' and (ii) HELOC.
"Give Me Some Credit". This data set contains 10 inputs and 8 are related to the individual's financial history. We assume that the inputs are mutable and their types are count and positive continuous, respectively. The remaining 2 features, age and # dependencies, are immutable.
HELOC. This data set has 23 inputs of which all of them are related to the individual's financial history. All the inputs are treated as count variables. We treat the Ex-ternalRiskEstimate, MSinceOldestTradeOpen and Aver-ageMInFile as immutable since they are not under the individual's direct control. The remaining inputs are treated as mutable. The data set originally holds 10000 observations, but after dropping observations with missing instances we are left with n = 8291. The idea is to train a (V)AE that deals well with tabular data and to leverage the latent space representation to search for counterfactual recommendations.

The (Local) Cost of Negative Surprise
In this section, we investigate different models' ability to generate counterfactual recommendations that generalize well across different classifiers. If they generalize well, then they have a low cost of negative surprise.
To do so, we distinguish the following two cases: (a) Holding the hypothesis class fixed, will the initially generated counterfactual recommendation under the model f θ1 generalize to changes in the parameters θ while the risk of both classifiers stays approximately the same, i.e. R(f θ1 ) ≈ R(f θ2 )? (b) Will the initially generated counterfactual recommendation under the hypothesis class F (e.g. regularized linear models) generalize to a model g from a different hypothesis class (e.g. random forest) while R(f ) ≈ R(g)? For the experiment described in (a), we do not transfer the counterfactual recommendation to any model, but only to those from the -level set. For the experiments in (b) we extend the below definition to models outside the hypothesis class F. Definition 5 ( -level set (Marx et al., 2019)). Given any classifier f and a hypothesis class F, the -level set around f is the set of all models g ∈ F that make at mostR(f ) + mistakes over the training data.
We choose = +/−0.05. To generate the models from the -level set we use the cv grid search method from scikit learn. We then use models g within the set and check whether the counterfactual recommendations generated based on f are equally valid under g. Particularly, we check two different hypothesis classes: F Linear and F RandomF orest = F RF . In practice we generatex(f ) := E(x; f ) and compute where n E is the number of individuals for which counterfactual recommendations are computed and I(·) denotes the indicator function.
Next, the results are shown in figure 3. The left y-axis depicts how many counterfactual explanations were transferable from model f to model g (It measures T .   the first place. To summarize the results, we would like to stress several points. (a) Importance of invariant explanations. This exercise underlines the importance to learn counterfactual recommendations that are invariant to small (within hypothesis class) and large (between hypothesis class) model perturbations. This is important since the effect of predictive multiplicity makes the model with respect to which we generate counterfactual recommendations look almost arbitrary.
(b) Data supported counterfactuals are more often model invariant. The OURS model generates the most robust recommendations: it outperforms GS and AR on all tasks and almost all classifiers. It performs a little worse on the HELOC data set when transferring from F RF to F Linear (right panel in figure 3d).
In this section, we have empirically investigated whether counterfactual recommendations generalize across models and are thus robust to predictive multiplicity. We found that the data support based methods had superior generalization capabilities. Proposition 1 and 2 suggest that these recommendations should also be more costly.
We investigate this shortly in the following section.

Costs of Counterfactual Recommendations
In order to evaluate the cost of counterfactual suggestions across different models, we use the following two measures (Pawelczyk et al., 2020): where the subscript denotes the j-th component of x. The total percentile shift in (4) can be thought of as a baseline measure for how attainable a certain counterfactual suggestion might be. The maximum percentile shift (MS) in (5) across all free features reflects the maximum difficulty across all inputs that are subject to change. Figure 4 shows the resulting plots. The left panel shows violinplots for the distribution of total percentile shifts and the right panel shows these plots for the maximum percentile shift. From the plots it becomes clear that the OURS method generates counterfactual recommendations that tend to have both higher total and maximum percentile shifts. This holds for both data sets.  The data density based method OURS (it uses a VAE) generates more costly counterfactual recommendations than GS and AR.
In the next section, we briefly investigate why OURS works better in producing invariant recommendations. We will also understand why it generates higher costs. On robustness. Next, we zoom into one particular set of inputs. We look at the distribution of three inputs: 30-59 days late, 60-89 days late, >89 days late, which one could summarize as timeliness of individuals' payments. The first row in figure 5 shows the distribution of the three inputs for which we have that H + f ∩ D + : in words, correctly classified individuals make their loan payments on time. The counterfactual recommendations generated by OURS, E ours (x; f ), second row of figure 5, follow this distribution quite closely. The last row shows the distribution induced by E ar (x; f ), which is not close to the one of the correctly classified individuals for # 60-89 days late.

Why Data Supported Counterfactuals tend to Generate more Invariant Explanations
On costs. Recall from section 4.2 and figure 4 that OURS' recommendations are more costly. Now, let us consider figure 5 again. To generate lower cost recommendations, AR needs to be very close to the original inputs. Thus, it often suggests to leave the timeliness inputs unchanged (third row in figure 5) or only change a subset of them. This, however, appears counter intuitive (we discuss this issue further in appendix A).

CONCLUSION
In light of the fact that counterfactual recommendations can have an huge impact on individuals' lives, there existed remarkably little work regarding cost guarantees for existing methods. In this work, we have taken a step towards filling this void. We theoretically analyzed the cost of counterfactual recommendations for sparse and data supported counterfactual recommendations. Most notably, we obtained the following insights: first, data supported counterfactual recommendations are at least as costly as sparse ones. Second, if assumption A1 (classifier is stable) is violated, the cost of counterfactual recommendations under model multiplicity can be substantially higher than under one fixed model. Therefore, counterfactual recommendations are ideally based on (explanation) models that causally (and thus invariantly) relate inputs to targets to avoid the impact of predictive multiplicity on counterfactuals.
Our results have thus guided us to an interesting question for future research: can one generate invariant counterfactual recommendations with minimal costs?
To establish trustworthy (semi-) automated ML systems with humans in the loop, it is crucial to provide counterfactual recommendations with cost guarantees, which humans can rely on when working towards their goals. Therefore, we hope that our work can help practitioners make more informed decisions on which type of recommendation method to choose in the future.  More on robustness. Recall that we wish to find recommendations for the negative predicted individuals, H − f . As opposed to the other methods, the OURS method pushes the negative predicted individuals towards data points from the correctly classified individuals, H + f ∩ D + . To show this for all explanations, we compute the first two principal components of E ar (x; f ), E gs (x; f ) and E ours (x; f ) and compare them to H − f , H + f ∩ D + (see figure 6).

Appendix B Data and Implementations
B.1 Real world example: "Give Me Some Credit" In the following, we list the specified pretrained classification models as well as the parameter specification used for the experiments. We use 80 percent of the data as our training set and the remaining part is used as the holdout test set.
Additionally, we allow f and g access to all features, i.e.. to the mutable and immutable ones.  . Recall that f (E(x; f )) = +1. AR's (red) and GS' (yellow) latent space representation of the generated counterfactual recommendations remain very close to the incorrectly classified representation (purple). OURS (blue, right most) rotates and pushes the latent space closer to the one of the correctly classified observations H + f ∩ D + (cyan).
GS (Laugel et al., 2017). GS is based on a version of the YPHL algorithm. As such we have to choose appropriate step sizes in our implementation to generate new observations from the sphere around x. We choose a step size of 0.1.
OURS (Pawelczyk et al., 2020). We used the (H)VAE implemention as described here: https://github.com/ probabilistic-learning/HI-VAE (Nazabal et al., 2018). Random search in the latent space was conducted to find counterfactual recommendations, using the YPHL algorithm (Laugel et al., 2017). We made the following choices. We set the latent space dimension of both s and z to 3 and 6, respectively. For training, we used 15 epochs.   Table 3: "Give Me Some Credit": State of inputs and likelihood models.

B.2 Real world example: HELOC
The Home Equity Line of Credit (HELOC) data set consists of credit applications made by homeowners in the US, which can be obtained from the FICO community. 1 The task is to use the applicant's information within the credit report to predict whether they will repay the HELOC account within 2 years. Table 4 gives an overview of the available inputs and the corresponding assumed likelihood models.
AR and GS As before. Additionally, we do not specify how features have to move.
OURS We set the latent space dimension of both s and z to 12 and 10, respectively. For training, we used 60 epochs. Table 4 gives details about the chosen likelihood model for each feature. The rest remains as before.

Appendix C Proof of proposition 1
Proof. Let us consider an x 1 ∈ H + f , i.e. f (x 1 ) = +1 = f (h(z)). By the assumption of the generative model in the main text, we know that h(z) = x. We have c D (z) = x−h(z) = (x−x 1 )+(x 1 −h(z)) ≤ x−x 1 + x 1 −h(z) , where we used the triangle inequality. By (1), we have that x 1 − h(z) ≤ x 1 − h(z) . Hence, we can write Input Mutable Model c D (z) ≤ 2 x 1 − h(z) = 2 x 1 − x . Now, minimizing x over E S (recall definition 1 from the main text) gives the desired result.