By NHI Mgmt Group Editorial TeamDomain: AI SecuritySource: FiddlerPublished July 2, 2026

TL;DR: Using geolocation to infer missing race data in mortgage decisions can approximate disparities, but thresholding can overstate approval gaps and discard sample data, creating a fidelity problem for fairness measurement rather than solving it, according to Fiddler’s analysis. For IAM and governance teams, the lesson is that proxy-driven inference needs explicit validation before it is trusted in compliance, model risk, or decisioning workflows.


At a glance

What this is: This is an analysis of how geolocation can be used as a proxy for missing sensitive attribute data in mortgage fairness studies, and where that approach breaks down.

Why it matters: It matters because identity, fraud, and AI governance teams increasingly rely on proxy data to measure fairness and risk, and weak inference can distort compliance reporting and decision controls.

👉 Read Fiddler's analysis of geolocation-based race inference in mortgage fairness data


Context

When protected attribute data is missing, organisations often turn to proxies such as geography to keep fairness analysis moving. That can be better than ignoring disparity altogether, but it also introduces a measurement problem: the proxy may describe population patterns, not the individual, and the gap between those two is where governance risk starts. In mortgage decisioning, that distinction affects how confidently teams can interpret model outcomes and downstream compliance evidence.

This article sits in the broader identity verification and trust boundary problem that appears whenever organisations infer characteristics they did not directly collect. For IAM, fraud, and AI governance teams, the practical question is not whether proxy methods are clever, but whether they are sufficiently faithful to support decisions, monitoring, and regulatory defensibility.


Key questions

Q: How should teams use proxy data when protected attributes are missing?

A: Use proxy data only for controlled analysis, not as a substitute for ground truth. Teams should test how closely the proxy matches known samples, measure error, and record when the proxy is too noisy to support a defensible conclusion. If the proxy changes the result materially, the method is shaping the finding rather than revealing it.

Q: Why can threshold-based inference distort fairness results?

A: Thresholds exclude lower-confidence records, and those records are often not evenly distributed across the population. That means the remaining sample can become more homogeneous and the measured disparity can widen or shrink for reasons tied to selection bias, not actual outcome differences. Sensitivity testing is essential before using the result in governance reporting.

Q: What do organisations get wrong about inferred sensitive attributes?

A: They often treat a derived attribute as if it were the same as directly collected data. That mistake hides uncertainty, creates false confidence, and can make fairness analysis look more precise than it really is. In practice, inferred attributes should be handled as analytical inputs with known error rates, not as identity facts.

Q: How do you know if a fairness proxy is good enough?

A: A proxy is good enough only if it preserves the direction and rough magnitude of the disparity under analysis across multiple tests. If different thresholds, samples, or estimation methods produce materially different results, the proxy is too unstable for compliance-grade reporting. Stable results matter more than elegant methodology.


Technical breakdown

How geolocation becomes a probabilistic race proxy

The method maps a borrower’s state, county, and census tract to census population distributions, then treats those distributions as a probabilistic race vector. That means the model is not identifying race directly. It is inferring the most likely group membership from location-level demographics, which is inherently an approximation. The quality of the inference depends on how well the geographic mix reflects the individual, and that assumption weakens as locations become more diverse or less representative of the applicant. The core technical issue is that the proxy is population-based, not person-based.

Practical implication: validate proxy fidelity before using location-derived attributes in fairness, audit, or compliance workflows.

Why thresholding can inflate apparent disparity

Thresholding keeps only cases where the inferred probability exceeds a chosen cutoff, such as 0.5 or 0.6, and discards the rest. That makes the sample cleaner on paper, but it can bias the remaining dataset toward more homogeneous locations and distort the estimated approval gap. In fairness measurement, a stricter threshold can change both the size and direction of estimated disparities because the discarded records are not random. The problem is not just loss of volume. It is selection bias introduced by the inference rule itself.

Practical implication: test multiple thresholds and compare how much the disparity estimate changes before trusting any single result.

Weighted estimators reduce classification error but add analytical complexity

A weighted estimator avoids forcing each applicant into one inferred race category. Instead, it uses the probability vector to calculate group-level outcomes across the full sample. That can preserve more data and reduce the distortion caused by hard classification rules, but it also makes the analysis less intuitive for stakeholders who expect a single label per record. This approach is better suited to measurement than decisioning, because it describes aggregate patterns without pretending to recover a true hidden attribute for every individual.

Practical implication: prefer probabilistic aggregation for analysis, and avoid turning proxy outputs into operational identity labels.


NHI Mgmt Group analysis

Proxy fidelity is the real control issue, not proxy availability. The article shows that organisations can infer missing sensitive attributes from geolocation, but the statistical proxy is only useful if it preserves the meaning of the underlying fairness question. If the proxy changes the measured disparity, the governance output becomes a model of the proxy, not a model of the population. That is a measurement integrity problem, and it belongs in model risk review rather than being treated as a clever workaround.

Fairness analysis based on inferred identity data creates its own verification gap. When protected attributes are unavailable, teams often replace direct observation with reconstruction from indirect signals. In identity and trust workflows, that is familiar: systems routinely depend on derived or asserted attributes. The difference is that fairness work can fail silently if the surrogate is too noisy, which is why governance must treat inferred identity data as provisional evidence, not ground truth.

Thresholding is a named failure mode: selection bias through proxy certainty. The article’s example shows that requiring a high probability cutoff reduces sample size and can overstate disparities. That is not a minor analytical quirk. It is a repeatable failure mode where confidence thresholds reshape the population being measured. Practitioners should treat this as a control boundary problem, because the result depends as much on inclusion rules as on the underlying data.

Inferred sensitive attributes should be evaluated like any other high-impact model input. The same discipline used for AI governance, data lineage, and identity verification should apply here: trace provenance, quantify error, and document when the proxy is valid. Where organisations depend on inferred characteristics for compliance, the burden is on the programme to show that the approximation does not systematically distort outcomes. The operational conclusion is simple: measurement methods need their own controls.

What this signals

Proxy-based fairness measurement is becoming more common because organisations would rather estimate sensitive attributes than leave bias unmeasured. The governance challenge is that an estimated attribute can be analytically useful without being operationally authoritative. That distinction should shape how compliance teams write their evidence standards and how model risk teams review fairness claims.

Verification trust gap: when a proxy is used to stand in for missing identity data, the control question becomes whether the method changes the meaning of the outcome. Teams should track proxy sensitivity the same way they track other high-impact model inputs, and they should avoid letting convenience convert an estimate into a record of fact.

Where identity-adjacent analytics are used in regulated decisions, teams should expect more scrutiny of provenance, error rates, and the justification for any inferred attribute. The practical signal is simple: if the analysis cannot explain its own uncertainty, it should not be used as a compliance-grade control input.


For practitioners

  • Validate proxy fidelity before reporting disparities Compare inferred outcomes against known self-reported attributes in a test sample and quantify how much the proxy shifts approval rates, error rates, and subgroup variance.
  • Use probabilistic aggregation instead of hard labels Where possible, calculate fairness metrics from the full probability vector rather than collapsing records into a single inferred class with a threshold rule.
  • Document threshold sensitivity as part of model governance Run the same fairness analysis across several cutoffs and record how sample size and disparity estimates change so reviewers can see whether the result is stable.
  • Treat inferred attributes as provisional evidence Do not allow proxy-derived identity data to become an operational source of truth for decisions, approvals, or adverse action without explicit review and justification.

Key takeaways

  • Geolocation can help approximate missing sensitive attributes, but it does not recover identity with perfect fidelity.
  • Thresholding can make fairness analysis look more precise while actually increasing selection bias and distorting disparity estimates.
  • Proxy-driven measurement needs validation, sensitivity testing, and clear governance before it is used in regulated decisioning.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST AI RMF and NIST CSF 2.0 set the technical controls, while GDPR define the regulatory obligations.

FrameworkControl / ReferenceRelevance
NIST AI RMFMEASUREThe article centers on measuring bias and uncertainty in inferred attributes.
NIST CSF 2.0GV.RM-01Risk management must account for analytical uncertainty in fairness methods.
GDPRArt.5Personal data analysis and inferred attributes raise data minimisation and accuracy concerns.

Document proxy assumptions in risk registers and require review before fairness outputs are used operationally.


Key terms

  • Proxy Attribute Inference: Proxy attribute inference is the practice of estimating a sensitive characteristic, such as race or gender, from indirect signals when direct data is unavailable. It can help with analysis, but it also introduces model error and uncertainty that must be measured and disclosed.
  • Thresholded Estimator: A thresholded estimator keeps only records whose inferred probability clears a chosen cutoff. It can improve apparent confidence, but it can also bias the sample and distort outcomes if lower-confidence records are systematically excluded from the analysis.
  • Weighted Estimator: A weighted estimator uses probability values rather than hard labels to calculate group outcomes. This approach preserves more data and often reduces classification error, but it requires disciplined interpretation because it estimates aggregate patterns, not verified individual identity.
  • Proxy Fidelity: Proxy fidelity is the degree to which an inferred attribute preserves the meaning of the underlying measurement question. High fidelity means the proxy produces stable, decision-relevant results; low fidelity means the proxy changes the outcome enough that governance conclusions become unreliable.

What's in the full article

Fiddler's full post covers the analytical detail this post intentionally leaves for the source:

  • Step-by-step walkthrough of the geolocation matching method used to infer race from HMDA data
  • Comparative examples of thresholded versus weighted estimators and how each changes disparity calculations
  • Source references to Chen et al. and CFPB methodology for proxy-based fairness analysis
  • The visual logic behind the sample-size trade-off created by stricter inference thresholds

👉 The full Fiddler post shows the HMDA examples, threshold effects, and estimator comparisons in detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners build the control discipline needed to manage identity risk across modern programmes.
NHIMG Editorial Note
Published by the NHIMG editorial team on August 21, 2026.
NHI Mgmt Group — the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org