concern is whether their outputs are grounded in accurately captured prior concepts or derived from factual training
data. In this context, *fact tracing* and *concept probing* have emerged as essential analytical tools for tackling these tasks.

**3.2.1 Problem Settings**

*Fact tracing* seeks to identify and verify the specific training data sources that contribute to a model’s generated output, helping to establish the factual basis of its responses. For LLMs, an important implication of fact tracing is to resolve the *hallucination* phenomenon (Huang et al., 2025), where models generate misleading or entirely fabricated information, making it difficult for researchers and users to assess the reliability and authenticity of the generated content. To address this issue, researchers have started exploring techniques such as question-answering attribution (Bohnet et al., 2022), which focuses on benchmarking and building systems that trace model responses back to their source data. These efforts underscore the growing need for methods that enhance transparency and trust in LLMs’ outputs.

In contrast, *concept probing* aims to disentangle and analyze the internal representations of abstract concepts within the model that stem from the training data. While the notion of “concept” is often vague and can vary depending on the specific context, there are growing efforts that focus on common use cases such as multi-lingual LLMs (Choenni et al., 2023, 2024b,a) and generative diffusion models (Brokman et al., 2024). For instance, concept probing for diffusion models is usually coined as *image tracing*, as it involves identifying training images with certain high-level concepts such as style, subject, or category that contribute to a generated image (Xie et al., 2024a).

By systematically applying these techniques, researchers can better interpret model behavior, assess reliability, and
mitigate risks associated with misinformation.

**General data-attribution-based fact tracing pipeline.** Let $\mathcal{F}$ denote the set of factual knowledge or concepts of interest. In fact tracing or concept probing for generative models, the goal is to identify which portion of the training data help the model to acquire certain facts. A fact tracing or concept probing pipeline typically starts by observing that the model tends to prefer a given fact or concept over its negation, i.e. $p(t) > p(\neg t)$ for $t \in \mathcal{F}$, where $t$ is a specific fact, $\neg t$ is its counterfactual, and $p(\cdot)$ denotes the probability of the model giving a certain prediction. In contrast to fact tracing, hallucination detection focuses on the set of logical negations $\neg \mathcal{F} = \{\neg t \mid t \in \mathcal{F}\}$, identifying instances where the model generates unsupported or fabricated content.

Once the target facts for attribution $\mathcal{F}$ is defined, data attribution methods can be applied to trace the model's behavior on $\mathcal{F}$ back to its training data. Specifically, these methods aim to answer: *How would the model's behavior on *$\mathcal{F}$* change if certain training instances were removed, and how significant would that change be?* To formalize this, one can define a loss function $\ell(t)$ as the target function, where $\ell(\cdot)$ quantifies the model's loss in predicting a particular fact or concept. With such target functions, data attribution methods estimate the influence of each training instance on the model's alignment with the facts. The greater the counterfactual effect, the more significant the training sample is in causing the model to generate a fact, either correctly or incorrectly.

**3.2.2 Landscape of Data Attribution-based Fact Tracing**

A common approach in both fact tracing and concept probing methods is first to estimate the *relevance score* $s_i$ of every
training entity *i* in the training dataset w.r.t. a given target test data point. Then, a simple top-*k* selection is applied to
select *k* data points with the highest relevance scores as the tracing/probing results. Fact tracing and concept probing
have been a common downstream evaluation task for the development of data attribution methods, which we will
elaborate on in Section 4.2.2.

**Attribution algorithm.** A common attribution algorithm for fact tracing and concept probing for LLMs is the influence function family (Akyürek et al., 2022; Wu et al., 2024b; Chang et al., 2025; Kwon et al., 2024) and its variants, such as TracIn (Lin et al., 2024b; Choenni et al., 2023, 2024b) and TRAK (Choenni et al., 2024a), where they often include additional normalization/denoising strategies (Akyürek et al., 2022; Wu et al., 2024b; Chang et al., 2025).

*Influence function.* Since fact tracing and concept probing are mainly used for large-scale generative models, the Grad-Dot family methods become the most feasible approach to attribute these models for their efficiency and simplicity.

In the domain of fact tracing, Akyürek et al. (2022) directly applies gradient similarity to real-world and synthetic factual
datasets. While this approach achieves reasonable results, future studies (Wu et al., 2024b; Chang et al., 2025) suggest
that some more normalization or denoising strategies are still needed for better approximation. Specifically, TRACK-
STAR (Chang et al., 2025) proposes to normalize the raw gradients with the second moment $E_x((\nabla Loss(x, \theta))^2)$
before projecting them to a lower dimension. Apart from that, it also adopts a task-specific Gauss-Newton approximation
to the loss Hessian, which means that the final estimation comes from both the training and testing data distribution.
While Hessian can be effective for fact tracing, Wu et al. (2024b) proposes DDA, which is a Hessian-free attribution
method aiming to debias and denoise the gradient dot product. For debiasing, it reanalyzes the effect of the false
assumption of empirical risk minimization, and incorporates a correction term based on the initial state of the model.
Denoising involves averaging the influence score over several epochs, which eliminates influence score discrepancies
due to the overfitting or underfitting of the model during training. Finally, a contrastive influence score is computed
after the debiasing and denoising procedures.

Such Gradient-Dot family methods are also widely used for concept probing. In a multilingual setting, TracIn (Choenni et al., 2024b, 2023) and TRAK (Choenni et al., 2024a) are applied to investigate how different concept dynamics, such as values shifts, data sharing, happen when fine-tuning the LLMs on different languages. A parallel line of research investigates concept dynamics in diffusion models (Xie et al., 2024a; Kwon et al., 2024), where, in particular, Xie et al. (2024a) extends TracIn to diffusion settings by incorporating gradient normalization to correct for time-step bias inherent in image generation and applying the method to image tracing.

*Datamodels.* MONTRAGE(Brokman et al., 2024) is a gradient-free attribution method designed specifically for diffusion models. It traces how internal representations evolve throughout diffusion models fine-tuning, and generalizes the attribution to unseen generations by training an attribution model.

*Contrastive-based tracing.* While TDA methods are effective at estimating counterfactual loss changes, they tend to be less effective than retrieval-based methods for tasks such as fact tracing or hallucination tracing. In order to mitigate this problem, Contrastive Error Attribution (CEA) proposes to use contrast-based tracing instead of influence-based tracing. Unlike influence functions, which estimate the counterfactual change in loss or log probability, contrastive-based tracing focuses on how the probability of the model generating a correct output is higher than that of an incorrect one. Such idea can be applied to different attribution methods, such as datamodels or gradient dot-product (Chang et al., 2025).

*Iterative attribution.* Han et al. (2023) applies ORCA, an iterative attribution method, to understanding the in-context learning (ICL) phenomenon in LLM pre-training. ORCA keeps track of a supportive subset within the pre-training data. During each iteration, the algorithm identifies the pre-training subset with the highest gradient cosine similarity to the ICL downstream tasks. This subset is added to the supportive set, and the model is updated using the cumulative supportive set. It turns out that the supportive subset for ICL tends to include rare tokens and is more domain-relevant, making it more challenging for LLMs.

**Target function.** The most common target function used in both fact tracing and concept probing is the per-sample test loss (Choenni et al., 2023, 2024a), together with normalization w.r.t. the norm of the per-sample to mitigate the outlier effects (Akyürek et al., 2022; Wu et al., 2024b; Chang et al., 2025; Kwon et al., 2024; Xie et al., 2024a).

*Target subset.* While the loss function is relatively fixed among studies on fact tracing and concept probing, the specific target data subsets still vary depending on different applications. One selection of the target subset is the test data on which the model produces correct prediction. This choice is commonly used in either fact tracing or concept probing, since only the acquired knowledge or concepts are trackable inside the model. For instance, Akyürek et al. (2022) suggests performing TDA on the Finetune-learned (FL) slice of the test samples. This approach ensures that the model learns the factual knowledge during the fine-tuning process rather than the pretraining. In concept probing, Choenni et al. (2024b, 2023) also focus on the set of samples that the model labeled correctly, thereby narrowing the scope of their studies to training samples that influence correct predictions.

Another approach to selecting the target subset occurs in hallucination tracing, where the goal is to identify the causes of
false predictions. In this case, the target subset usually consists of the test samples on which the model makes incorrect
predictions. Wu et al. (2024b) selects 4 typical hallucination types and performs contrastive data attribution based on
a mixture of positive and negative test samples. Chang et al. (2025) conducts a case study on the training samples
retrieved by a subset of 1,592 mislabeled test examples, attributing the incorrect predictions to model guesses based on
incomplete information in the training data.

**Data granularity.** In the context of LLMs, example-level (Lin et al., 2024b; Akyürek et al., 2022; Wu et al., 2024b; Chang et al., 2025; Choenni et al., 2023, 2024b,a; Han et al., 2023) attribution is the most common use cases for fact tracing and concept probing, due to compute limitations. However, RapidIn (Lin et al., 2024b) enables token-level attribution by efficient projection and caching strategies.

For diffusion models, on the other hand, each individual image is the natural attribution unit (Xie et al., 2024a; Kwon et al., 2024; Brokman et al., 2024), making example-level attribution straightforward.

**Scope of tracing** Training a modern large-scale generative model typically involves two stages, pre-training and fine-tuning. As a result, the scope of fact tracing and concept probing can also divided into two categories: tracing the pre-training data and tracing the fine-tuning data.
*Fine-tuning data.* Most studies on fact-tracing and concept probing focus on attributing the fine-tuning data(Lin et al., 2024b; Akyürek et al., 2022; Wu et al., 2024b; Kwon et al., 2024; Choenni et al., 2023, 2024b,a; Han et al., 2023). Attributing fine-tuning data is more tractable due to its smaller scale, but special care must be taken, as the influence may stem not only from the fine-tuning data but also from the pre-training data. To address this, for instance, Akyürek et al. (2022) selects the finetune-learned set as the attribution targets to mitigate the influence of pre-training stage. For hallucination tracing, Wu et al. (2024b) introduces perturbations absent from the pre-training data to the fine-tuning set. Those adaptations are important for justification of the tracining procedure.

*Pre-training data.* Attributing the full pre-training data can be challenging, but is still tractable with suitable attributing algorithms(Xie et al., 2024a; Han et al., 2023; Chang et al., 2025). With ORCA, Han et al. (2023) attributes the in-context learning behavior of LLMs to 2.5 million pre-training instances and billions of tokens on OPT-6.7B. Chang et al. (2025) scales the influence function to use cases with over 160 billion tokens and an 8B-parameter language model by leveraging efficient gradient projection and Hessian approximation.

### 3.2.3 Discussion

Data attribution provides a data-centric framework for understanding how generative models acquire and express specific facts or concepts. In both fact tracing and concept probing, attribution-based methods aim to identify the training examples that causally influence a model’s outputs—offering explanations grounded in the data itself. This contrasts with classical approaches that rely on textual similarity, retrieval heuristics, or probing internal representations. For example, fact tracing is often framed as a retrieval task, using methods like BM25, embedding similarity, or fine-tuned language models (e.g., T5/mT5) to locate textually relevant training data (Robertson et al., 1994; Rajani et al., 2020; Lee et al., 2024; Raffel et al., 2020; Xue et al., 2021; Menick et al., 2022). Likewise, concept probing methods such as linear classifiers or neuron activation analyses (Tenney et al., 2019; Dai et al., 2021) aim to interpret learned representations without directly attributing them to the data. While effective in certain settings, these alternatives generally measure correlation rather than causal contribution—something data attribution methods are specifically designed to capture.

By quantifying the influence of individual training examples, data attribution offers a unified lens on both fact tracing and concept probing. This is particularly effective in fine-tuning settings, where training sets are smaller and attribution becomes more tractable. However, these methods often require gradient-based computation and white-box access, limiting their scalability and applicability in black-box or large-scale pretraining contexts. A further challenge lies in the inherent mismatch between factual overlap (used in traditional fact tracing) and causal influence (captured by data attribution) (Chang et al., 2025; Wang et al., 2025a). Moreover, the ambiguous nature of “concepts” and the multi-stage training pipelines of modern models complicate attribution, making it difficult to isolate responsible training data even when full model access is available.

**Unique difficulties and challenges.** Despite their interpretability, most data attribution-based approaches rely on gradient-based influence estimates, which require full (white-box) model access. In real-world settings—especially for commercial or proprietary models—only black-box access is available, severely limiting applicability. Additionally, establishing ground truth for what data “caused” a model to learn a particular fact or concept is difficult in practice. This is exacerbated by the vague and often task-specific definitions of concepts and the presence of multi-stage pretraining and fine-tuning, which further obscure the traceability of learned information to specific data sources.

Empirical results further highlight the limitations of directly applying current data attribution methods to fact tracing. Extensive negative results shows that existing data attribution methods often perform worse than trivial retrieval-based baselines like BM25. These traditional methods, though rely only on lexical overlap, surprisingly outperform complex data attribution methods in identifying training examples related to factual outputs. To improve the performance of attribution methods in this area, recent work has introduced non-trivial adaptations like contrastive-based data tracing.

Nevertheless, the evaluation methodology in this domain presents several important concerns. In many existing benchmarks, the factual outputs and source inputs exhibit high lexical overlap, which inherently favors baseline methods like BM25 that rely on surface-level matching. When such overlaps are manually reduced or removed, data attribution methods often perform more competitively. For instance, Wang et al. (2025a) observed greater performance headroom for attribution methods when evaluating fact tracing under paraphrased conditions, where lexical similarity was mitigated.

Moreover, while retrieval-based evaluation is efficient and easy to implement, it may fail to reflect the true training dynamics of small language models. Park et al. (2023) demonstrated this by removing the top-retrieved data points based on either BM25, TRAK, or ground truth from the training set and retraining the model. Surprisingly, removing the TRAK-selected instances caused a larger drop in evaluation performance than removing those identified by BM25 or even those matching the ground truth. This suggests that, especially for smaller models, attribution may behave in
counterintuitive ways, and direct lexical matching between training data and factual outputs may not provide a reliable reference. Fortunately, this misalignment between human intuition and model learning behavior appears to diminish as model improves. Newer generations of LLMs tend to demonstrate more consistent attribution patterns, as shown in Chang et al. (2025), providing a better understanding of the connection between training data and model behavior.

### 3.2.4 Recommendation

While data attribution-based methods provide an intuitive approach to fact tracing and concept probing, their effectiveness depends on a clear dependency between the model's learned facts and concepts and its training data. If the model has already acquired the relevant knowledge during pre-training or derives it through complex reasoning, data attribution-based methods may be less effective than classical approaches (Akyürek et al., 2022). In such cases, more computationally expensive alternatives—such as training LLMs to cite corresponding sources during the pre-training phase—may be more suitable (Menick et al., 2022). Addressing these limitations and enhancing data attribution-based methods remains a crucial direction for future research.

Moreover, the current literature on data attribution is still relatively underexplored, as existing studies primarily rely on the classical loss-based attribution metrics. While it is reasonable to assume that the presence of factual knowledge or relevant concepts in training data would lead to a decrease in loss—thereby justifying the use of such metrics—the effectiveness of alternative target functions remains largely unknown. Investigating new attribution metrics and their potential impact on fact tracing is a promising avenue for future research.

## 3.3 Adversarial Attack and Defense

As AI systems are increasingly deployed in high-stakes applications, ensuring their robustness and safety has become a key concern. Adversarial attacks aim to exploit model vulnerabilities for malicious purposes, while defenses seek to detect and mitigate such threats. Data attribution methods—originally developed for interpretability and data-centric analysis—have found applications in both attacking and defending machine learning systems. However, due to the high computational cost of attribution algorithms, adversarial attacks have been almost exclusively explored in non-generative settings, and defense strategies for large generative models like LLMs remain relatively underdeveloped.

Despite the focus of this survey on generative models, data attribution methods have been extensively studied and applied in non-generative settings. In the contexts like image classifiers, semantic models, recommender systems, or graph neural networks, attribution techniques offer a straightforward way to assess the influence of individual data points on model behavior. Adversaries can exploit these methods to strategically insert, remove, or modify training samples, thereby manipulating model predictions. Conversely, defenders leverage attribution to detect malicious data and enhance robustness of these models. Many of these techniques can be adapted to generative models like LLMs with minimal modifications. For instance, attribution-based attacks in discriminative settings inspire analogous threats in generative AI, such as jailbreaking prompts or safety-alignment bypasses. Specifically, we also discuss in detail the attacks and defenses on a special type of learning algorithm recommendation systems, due to their similarities with LLMs. Like LLMs, modern recommendation systems increasingly rely on user-contributed data and interactive feedback loops, making them vulnerable to adversarial manipulation. By analyzing attacks and defenses in recommendation systems, we gain insights into both systematic attack methods and emerging threats in generative AI.

In the following sections, we will first explore attribution methods in non-generative models to establish foundational concepts, then extend the discussion to generative settings, highlighting key adaptations in the context of generative models.

#### 3.3.1 Overview of Data Attribution-based Adversarial Attack and Defense

Attribution-based techniques provide a natural mechanism for both launching and defending against data-centric adversarial attacks. On the defense side, these methods can help identify harmful or toxic training examples, diagnose vulnerabilities, and sanitize training sets—often in conjunction with interpretability tools or robustness pipelines. On the attack side, the key insight is that attribution algorithms like influence functions exhibit counterfactual predictability. This allows adversaries to craft training points that systematically steer model predictions, inject biases, or interfere with model updates in a controlled way.

#### 3.3.2 Problem Settings

Data attribution-based attacks or defenses can be applied to various realistic settings. On the attackers' side, most strategies fall under *backdoor attack*, *membership inference*, or *data poisoning*, and these methods have been used to target various machine learning domains, including recommendation systems (Wu et al., 2021; Fang et al., 2020;
Huang and Li, 2023; Wu et al., 2023a), image or semantic classification (Yang et al., 2023; Cohen and Giryes, 2024; Jagielski et al., 2021), language generation (He et al., 2024), reinforcement learning (Lobo et al., 2022), graph neural networks (Wang et al., 2024a) and machine learning services Huang et al. (2024). On the defenders' side, attribution methods majorly contribute to data cleaning, i.e. identifying and removing the negatively influential data points. Most efforts have focused on language modeling, particularly in areas such as toxicity detection (Han and Tsvetkov, 2020), jailbreak behavior tracing (Xie et al., 2024b; Lin et al., 2024b), and privacy protection (Liu and Yang, 2024).

On thing worth mentioning is that, while data attribution methods are powerful at launching attacks, they can also become the victims to some carefully designed adversarial attacks (Ju et al., 2022; Marchant et al., 2022; Wang et al., 2025c). These potential vulnerabilities pose threats to data economy and algorithm reliability.

**Attack and defense strategies.** We focus on three common attacks: (1) *backdoor attacks*, which implant triggers via input or label transformations, so that the model predicts attacker-chosen labels while behaving normally otherwise, (2) *data poisoning*, which alters the training distribution or specific samples to steer the learned model toward malicious outputs, and (3) *membership inference*, which infers whether a given example was in the training set. While these attack strategies pose threats to model safety, we also introduce data cleaning, which fix the model by detecting and removing malicious data.

*Data-attribution-based backdoor attack.* Backdoor attack is a kind of stealthy attack where the adversary aims to embed hidden behaviors in the model. The backdoor procedure is usually defined as two transformations on the inputs and labels, $B_X: \mathcal{X} \to \mathcal{X}$ and $B_Y: \mathcal{Y} \to \mathcal{Y}$. The input transformation $B_X$ inserts a backdoor trigger, which misleads the model to predict the output as the perturbation label $y_{perturb}$. To launch an attack, the adversary will introduce the malicious inputs $((B_X(x), B_Y(y))$, transformed from the benign input pair $(x, y)$, to steer the behavior of the model and implant the trigger.

To make the attack even more stealthy, camouflage samples are leveraged to hide the true intension of the adversary. Specifically, the adversary will involve another set of partially perturbed training samples $((B_X(x), y)$ in the training set, so that the ground truth outputs remain unflipped. One application of data attribution methods on backdoor attack is to improve the design of the camouflage samples, by making them even more confusing and malicious. Using gradient ascent, camouflage samples can be updated to increase their influence on the loss on true backdoor samples. By doing so, these seemingly benign samples can be perturbed to mimic the backdoor samples, so that the true backdoor samples can be hidden.

*Data-attribution-based data poisoning.* Unlike backdoor attacks, data poisoning focuses on directly perturbing the model's behavior without relying on any triggering signals. Generally, we denote a generative model as $p(\cdot | x_0; \theta, \mathcal{X})$, where $x_0$ is a specific input to the model, $\mathcal{X}$ is the training distribution, and $\theta$ represents the model's final parameters. The model estimates the output distribution, which ideally follows some benign distribution $\mathcal{Y}_{benign}$, i.e., $p(\cdot | x_0; \theta, \mathcal{X}) \sim \mathcal{Y}_{benign}$. The ultimate goal of the adversary is to manipulate the training distribution into $\mathcal{X}_{adv}$, such that after training, the updated model parameters $\theta_{adv}$ lead to an output distribution aligned with some malicious target $\mathcal{Y}_{malicious}$, i.e., $p(\cdot | x_0; \theta_{adv}, \mathcal{X}_{adv}) \sim \mathcal{Y}_{malicious}$.

In this scenario, one can use the model's loss on the malicious distribution, $\ell(y_m | x_0; \theta, \mathcal{X})$, where $y_m \sim \mathcal{Y}_{malicious}$, as the target function. Data attribution methods can assist in data poisoning attacks in two main ways. First, poisoning can be formulated similarly to data selection, where the adversary removes training data with benign effects and retains those that exhibit perturbative influence on the target function, estimated via counterfactual prediction. Interestingly, the counterpart of data poisoning, *data cleaning*, can also be facilitated by data attribution methods in a similar manner, which removing the perturbative data instead of the benign ones. Second, instead of removing data, the adversary may perturb selected training samples. A typical approach is to perform gradient ascent (Koh and Liang, 2017), increasing the influence of these samples on the target loss. Since such perturbations are often imperceptible to humans, poisoning through training sample modification remains stealthy and difficult to detect.

*Data-attribution-based membership inference.* Membership inference attacks aim to determine whether a data sample $x_0$ belongs to the original training set $\mathcal{X}$ of a specific model. Self-influence turns to be an effective approach to membership attacks (Cohen and Giryes, 2024), as unseen data points tend to have large influences on the loss of a test point with the same label. Consequently, if the influence of a data sample on itself is large, it is likely not used as a part of the training set of the model.

**Victim models.** Various machine learning models are subject to data-attribution-based adversarial attacks. The most systematic attack approaches are developed on the recommendation systems and discriminative models. With the rise of generative models, it turns out that many attack approaches can be transferred to this new setting, with minor adaptions.
**Recommendation systems.** Recommendation systems are some specific learning algorithms that are usually vulnerable to attacks due to their transparency. Notably, the sequential modeling nature of the advanced recommendation systems make them similar to generative models. In some recommendation systems, such as Amazon and Yelp, historical user ratings used to train the recommendation algorithm are publicly accessible. Besides, some recommendation algorithms are also reported, making them also exposed to the attackers. To attack a recommendation system, adversaries can inject a small number of fake users, each with carefully crafted rating histories, in order to indirectly influence the parameter updates of the system. Attacks on recommendation systems typically fall into three categories: *promotion attacks, demotion attacks, and availability attacks* (Li et al., 2016), and data attribution is widely exploited in the first two. Promotion attacks aim to promote a given item, improving its ranking relative to others in the system. On the contrary, demotion attacks pursue the opposite goal by suppressing the ranking of a target item. Both attacks can be regarded as special cases of *data poisoning*, where the injected fake data serve as toxic samples, and the intended poisoning effect corresponds to the promotion or demotion of targeted items. Availability attacks, on the other hand, aim to maximize recommendation errors and disrupt the overall recommendation algorithm. This type of attack remains relatively unexplored in the context of data attribution and falls outside the scope of this survey.

**Discriminative models.** Discriminative models can also fall victims to data attribution-based attacks, with the three typical classes of attacks, *backdoor attack* (Huang et al., 2024), *data poisoning* (Koh and Liang, 2017; Lobo et al., 2022; Wang et al., 2024a; Jagielski et al., 2021; He et al., 2024), and *membership inference* (Cohen and Giryes, 2024) well developed in theory.

In a backdoor attack, the adversary injects a small number of *backdoor samples* into the training dataset. These samples are crafted to induce a specific misbehavior in the model. The ultimate goal is to cause the discriminative model to misclassify any test input that contains a *backdoor trigger*, typically a imperceptible perturbation, into a target class designated by the attacker, while maintaining normal performance on clean inputs. Meanwhile, in order to conceal the attack behavior, some benign-looking *camouflage samples* may also be injected during training. Huang et al. (2024) investigate backdoor attacks in the context of Machine-Learning-as-a-Service (MLaaS), where backdoor samples are introduced through user-contributed data.

Data poisoning, on the other hand, broadly refers to the manipulation of the training data to degrade the overall performance of the model or to intentionally steer its behavior. Some data poisoning attacks are *targeted*, where the adversary aims to alter the model’s behavior on a specific subset of data. For example, Jagielski et al. (2021) explore poisoning attacks that focus on a target subpopulation, while leaving the rest of the population unaffected. In contrast, *untargeted* data poisoning attacks aim to degrade the model’s general performance, without targeting any particular subset, which is a more common objective in some more complicated models, such as LLMs.

Membership inference attacks (Cohen and Giryes, 2024) are another class of privacy-focused attacks that aim to determine whether a specific data sample was included in the training set of a given machine learning model. These attacks are particularly concerning in high-stakes domains, where models trained on sensitive user data. The model may leak private information through their parameters under membership inference attacks launched by adversaries.

While data attribution can be leveraged to launch attacks on machine learning models, it also plays an important role in defending them, particularly through *data cleaning*. For example, Han and Tsvetkov (2020) strengthen toxicity detectors by identifying mislabeled training samples.

**Generative models.** Recent studies have extended data attribution-based attacks and defenses to generative models, especially for LLMs, where safety is a growing concern. These techniques are often similar to those used for discriminative models or recommendation systems, but require key adaptations to account for the larger model scale and the sequential nature of LLMs. Most research in this area still centers on *data poisoning*, while *backdoor attacks* and *membership inference* remain relatively underexplored. He et al. (2024), for example, demonstrate that carefully selected benign data can be used to trigger toxic behaviors in LLMs.

In response to rising safety concerns, data attribution methods have also been adopted for training data sanitization in LLMs, including the detection of jailbreaking prompts and toxic examples. Xie et al. (2024b) leverage attribution techniques to identify and remove backdoor and poisoning samples from LLM training datasets.

**Data attribution as victims.** Interestingly, data attribution methods themselves are vulnerable to adversarial attacks, which can undermine their reliability in applications such as data valuation and machine unlearning. Wang et al. (2025c) investigate how attribution results can be manipulated even under limited adversarial knowledge. Similarly, Marchant et al. (2022) demonstrate that the computational cost of data attribution-based algorithms, such as data unlearning, can be significantly inflated by adversarial samples. Since these examples are out of the scope of the applications of data attribution, we will omit the details in the following sections.
### 3.3.3 Attack and Defense on Recommendation Systems

Data attribution methods are especially effective in promotion and demotion attacks for recommendation systems. The core objective of promotion and demotion attacks is to increase or decrease the ranking of a target item relative to all other items in the system, ideally affecting the preferences of as many users as possible. Taking promotion attacks as an example, the attack loss is often heuristically defined as

$$ \mathcal{L}_{atk} = \sum_{i} \sum_{j \in \Gamma_{i,k}} g(\hat{r}_{i,j} - \hat{r}_{i,t}), $$

where $\hat{r}_{i,j}$ denotes the predicted rating score of user $i$ on item $j$, $\Gamma_{i,k}$ represents the top-k recommendation list of user $i$, and $g$ is a continuous, monotonically decreasing function, such as the Wilcoxon-Mann-Whitney loss function (Backstrom and Leskovec, 2011). By minimizing this loss, the predicted score of target item $t$ is maximized and its ranking is improved. Demotion attacks follow a similar formulation, but with the objective reversed; thus, we omit the details here. We will introduce a few typical promotion attacks on recommendation systems in this section and summarize the details in Table 12.

**Attack knowledge.** To launch a successful attack on recommendation systems, attackers typically need access to the *model architecture* and *training data*. In the full-knowledge setting, the adversary knows the exact model architecture, the complete training dataset, and consequently the model parameters. While this assumption may appear strong, the attacks described above can also be extended to partial-knowledge settings, where the model is a black box and the adversary lacks full access to the training data. In practice, adversaries can often crawl partial training data from public sources on the web. Even if the exact model architecture remains unknown, the transferability of attacks enables adversaries to train a surrogate model that approximates the behavior of the target model. With white-box access to the surrogate model, the attacker can design and optimize their attack strategy, which can then transfer effectively to the real system.

**Attribution algorithm.** Influence functions (Koh and Liang, 2017) are the most common data attribution methods adapted for the minimization of the promotion attack loss $\mathcal{L}_{atk}$, due to their excellent counterfactual predictability. One application of influence functions is to evaluate how individual users affect the behavior of a *recommendation system*, which provides the *importance estimation* for a data record or a user. On the other hand, influence functions can also be used to estimate the impact of fake users on the *attack loss*, thereby serving as a form of *threat estimation*.

Even before the era of generative model, influence functions play a critical role in *importance estimation*. Fang et al. (2020) investigate how users' ratings influence the model's prediction on a target item $t$. Based on this analysis, they identify a set of *influential users* whose ratings yield the highest influence scores, and restrict the optimization of the attack loss $\mathcal{L}_{atk}$ to this subset of users, therefore improving the attack's efficiency and effectiveness. In contrast, Huang and Li (2023) focus on maximizing the estimated influence of the single-injected fake user on the model's training loss. To achieve this, they first compute influence scores for all real users and then train a three-layer neural network to predict influence scores for fake users. During optimization, the estimated influence of the fake user is jointly optimized along with the attack loss.

In the context of *threat estimation*, the application of data attribution methods are not that straightforward. Since fake users are not part of the original training set, influence functions cannot be directly applied. To address this, the influence of injecting a fake user is decomposed into two components. The first component, denoted as $\mathcal{I}_{copy}$, represents the influence of duplicating an existing real user from the system. The second component $\mathcal{I}_{pert}$, captures the additional influence introduced by perturbing the copied user into the desired fake profile. By carefully selecting the real user to copy, $\mathcal{I}_{copy}$ can be reduced to zero, allowing the estimation to focus only on $\mathcal{I}_{pert}$.

Building on this formulation, INFMIX (Wu et al., 2023a) proposes a discrete fake user profile sampling method called USERMIX, which selects fake user candidates based on their estimated influence on reducing the attack loss. TrialAttack (Wu et al., 2021) further incorporates a generative model, generative adversarial networks (GAN) into the framework to maximize the stealth of the attack. It trains a supervised model to predict the influence of fake users, aiming to maximize their effect using a GAN-based architecture. Specifically, the GAN here follows the same methodology as those used for image generation, while the discriminator attempts to distinguish fake users from real ones, the generator is trained to generate deceptive fake users that could fool the detector and also simultaneously maximize the predicted influence of its generation. This adversarial design enhances the subtlety and effectiveness of the attack.

Notably, attacks based on heuristic attack losses remain defensible through influence function-based methods. Wu et al. (2023a) propose APT, a defense strategy that aims to "fight poison with poison." While adversarial attacks typically
inject fake users that increase the empirical risk, APT counters this by injecting specially crafted users, the ERM users, that minimize the empirical risk. The key idea is to reformulate the influence estimation by simply replacing the attack loss $L_{atk}$ with the empirical risk loss $L_{ER}$. This allows the defender to identify and inject users that steer the model toward adversarial robustness, effectively neutralizing the adversarial influence.

**Target function.** The target function of a data attribution-based attack varies depending on the specific role played by the attribution method. When used as an *importance estimator*, the target function can be defined as the predicted ranking score (Fang et al., 2020) or the overall training loss (Huang and Li, 2023). These choices aim to quantify the influence or importance of a particular rating or user with respect to the model’s decision or behavior, guiding the attacker in selecting or crafting inputs that most effectively manipulate the system.

For threat estimators (Wu et al., 2023a, 2021), the target function is the *attack loss* $L_{atk}$. The counterfactual of interest is the change in attack loss resulting from the insertion of a fake user. Ideally, the fake user should have a negative overall influence on the attack loss, hence increasing the likelihood that the target item is successfully promoted or demoted.

**Data granularity.** The granularity of data attribution on recommendation systems can differ from *per-record* to *per-user*. One single user can contribute several ratings or data records to the system, and each of them will have their own influence. Fang et al. (2020) focus on *per-record* influence of each single user-rating pair. It estimates the counterfactual effect of removing a single rating from a user independently, and sum up those influence as the overall influence estimate for a user. Huang and Li (2023); Wu et al. (2023a, 2021), on the other hand, directly perform *per-user* attribution.

<table><caption>Table 12: Comparison of data-attribution-based attacks and defenses on recommendation systems.</caption><thead><tr><th>References</th><th>Attribution Method</th><th>Target Function</th><th>Granularity</th><th>Strategy</th></tr></thead><tbody><tr><td>Fang et al. (2020)</td><td>IF</td><td>Predicted Ranking Score</td><td>Per-record</td><td>Data poisoning</td></tr><tr><td>Huang and Li (2023)</td><td>IF</td><td>Training Loss</td><td>Per-user</td><td>Data poisoning</td></tr><tr><td>Wu et al. (2023a)</td><td>IF</td><td>Attack Loss</td><td>Per-user</td><td>Data poisoning</td></tr><tr><td>Wu et al. (2021)</td><td>IF</td><td>Attack Loss</td><td>Per-user</td><td>Data poisoning</td></tr><tr><td>Wu et al. (2023a)</td><td>IF</td><td>Empirical Risk Loss</td><td>Per-user</td><td>Data cleaning (via injection)</td></tr></tbody></table>

### 3.3.4 Attack and Defense on Discriminative and Generative Models

Influence functions and their variants have proven effective in attacking a wide range of discriminative or generative models, spanning image processing, natural language processing, and even LLMs. These methods support various types of attacks, such as *backdoor attacks*, *data poisoning*, and *membership inference*. On the other hand, they are also effective for defending against attacks by identifying and removing malicious or veiled training samples, as a process known as *data cleaning*. In the following sections, we provide a detailed overview of how attribution methods are adapted and applied across these different domains, as well as a summary of representative works in Table 13.

*Attack knowledge.* Most of the attacks assume a white-box setting, meaning that the *model architecture*, the *training data* and hence the *model parameters* known to the adversaries (Yang et al., 2023; Cohen and Giryes, 2024; He et al., 2024). However, some studies (Jagielski et al., 2021; Huang et al., 2024) also investigate attacks launched with auxiliary data that simulates the distribution of real training data and surrogate models trained on those data.

**Backdoor attacks.** Huang et al. (2024) introduce UBA-inf, a stealthy yet persistent unlearning-activated backdoor attack targeting Machine-Learning-as-a-Service (MLaaS) platforms. In this setting, adversaries can upload customized data via user contribution mechanisms, and the model is periodically updated using continual learning. UBA-inf leverages influence functions to iteratively update the camouflage samples throughout the continual learning process, enhancing the concealment of the backdoor.

In each training iteration, the adversary uses influence function to estimate how perturbing a camouflage sample $\tilde{z}$ will affect the loss on the backdoor samples, by using the training loss on the backdoor samples as the target function. The camouflage samples are then perturbed in the direction that maximizes their positive influence on the backdoor objective. This influence-driven camouflage perturbation not only improves stealth of the attack, but also enables the backdoor to be more efficiently recovered during the unlearning phase, requiring fewer samples to reactivate the malicious behavior.
**Data poisoning.** Data poisoning is one of the most common types of attacks that can be facilitated by influence functions. Poisoning attacks can be *targeted*, aiming to manipulate the model's behavior on specific inputs. As foundational examples, Koh and Liang (2017); Yang et al. (2023) show that influence functions can be used to cause a classifier to misclassify a particular target sample by perturbing or removing training points to increase the test loss on that sample. Building on this idea, Jagielski et al. (2021) extend the attack to subpopulations, aiming to maximize the degradation of model performance on a targeted group while minimizing the impact on unrelated data. To achieve this, they introduce two filtering algorithms to identify and match samples belonging to some specific subpopulations.

In contrast, *untargeted* data poisoning aims to broadly degrade a model's overall performance rather than focusing on specific samples or subpopulations. He et al. (2024) introduce a novel approach that uses two small anchor datasets: $D_{harmful}$, which contains jailbreaking samples paired with harmful instructions, and $D_{safe}$, which includes the same instructions but paired with safe, aligned responses. The adversary then searches a pool of benign candidate data to find samples that exhibit high gradient similarity with $D_{harmful}$ and low similarity with $D_{safe}$. Surprisingly, they find that LLMs can be effectively poisoned using only benign-looking data selected through this gradient-based filtering process.

In this type of attacks, the target function is often the quantity that the attacker wants to perturb. For example, the test loss or test predictions are commonly used as target functions (Koh and Liang, 2017; Jagielski et al., 2021; Yang et al., 2023; He et al., 2024), as their gradients reveal how to degrade the model's performance on specific test instances. In the context of reinforcement learning (Lobo et al., 2022), the target function becomes the value function, guiding perturbations that directly manipulate expected returns.

**Membership inference.** Membership inference attacks aim to determine whether a given data sample was part of a model's training set, potentially leading to privacy breaches. In this case, self-influence serves as an effective target function. Cohen and Giryes (2024) propose a self-influence-based attack strategy, which evaluates the influence of a data point on its own. Specifically, if a sample is correctly classified and its self-influence falls within a certain range, being not too small or too large, it is considered to be a member of the training set. To account for the variability introduced by data augmentations, the self-influence is averaged over several augmented versions of the sample. This method proves highly effective, demonstrating robust performance across multiple datasets and highlighting the potential of self-influence as a powerful signal for membership inference.

**Data cleaning.** In contrast to adversarial uses, influence functions can also serve as an effective defense mechanism by identifying and removing poisoned or harmful training samples, a process known as *data cleaning*. This typically requires a small held-out dataset that reveals undesirable model behavior, such as misclassification (Han and Tsvetkov, 2020), jailbreaking (Xie et al., 2024b; Lin et al., 2024b), or privacy leakage (Liu and Yang, 2024). The influence of each training instance on this held-out set is computed, and samples with the highest influence scores are considered responsible for degrading the model's benign behavior.

On top of this idea, GradSafe (Xie et al., 2024b) further identifies safety-critical parameter slices in the model using cosine similarity, then computes the average gradient similarity on these parameter slices. Additionally, they propose an adaptive variant of GradSafe, which replaces the averaging with a logistic regression model trained to reweight gradient similarities across parameter slices based on their estimated importance.

Liu and Yang (2024), on the other hand, introduce Heuristically Adjusted Influence Functions (HAIF), which apply heuristic scaling to down-weight training samples with large gradient norms. This adjustment mitigates the error caused by extreme gradients and leads to more accurate identification of privacy-leaking samples.

<table><caption>Table 13: Comparison of data-attribution-based attacks and defenses on discriminative and generative models.</caption><thead><tr><th>References</th><th>Attribution Method</th><th>Target Function</th><th>Granularity</th><th>Strategy</th></tr></thead><tbody><tr><td>Huang et al. (2024)</td><td>IF</td><td>Backdoor Loss</td><td>Per-example</td><td>Backdoor Attack</td></tr><tr><td>Koh and Liang (2017)</td><td>IF</td><td>Validation Loss</td><td>Per-example</td><td>Targeted Data Poisoning</td></tr><tr><td>Yang et al. (2023)</td><td>IF</td><td>Validation Loss</td><td>Per-example</td><td>Targeted Data Poisoning</td></tr><tr><td>Jagielski et al. (2021)</td><td>IF</td><td>Validation Loss</td><td>Per-example</td><td>Targeted Data Poisoning</td></tr><tr><td>He et al. (2024)</td><td>Grad-Similarity</td><td>Validation Loss</td><td>Per-example</td><td>Untargeted Data Poisoning</td></tr><tr><td>Cohen and Giryes (2024)</td><td>IF</td><td>Self-Influence</td><td>Per-example</td><td>Membership Inference</td></tr><tr><td>Han and Tsvetkov (2020)</td><td>IF</td><td>Validation Loss</td><td>Per-example</td><td>Data Cleaning</td></tr><tr><td>Xie et al. (2024b)</td><td>Grad-Similarity</td><td>Validation Loss</td><td>Per-example</td><td>Data Cleaning</td></tr><tr><td>Lin et al. (2024b)</td><td>IF</td><td>Validation Loss</td><td>Per-example</td><td>Data Cleaning</td></tr><tr><td>Liu and Yang (2024)</td><td>HAIF</td><td>Validation Loss</td><td>Per-example</td><td>Data Cleaning</td></tr></tbody></table>
### 3.3.5 Discussion

Despite the growing urgency to secure generative AI systems, especially LLMs, data attribution methods remain underutilized in adversarial settings. Most attribution-based strategies have been developed for data poisoning attacks and dataset sanitization in non-generative, discriminative models, largely due to their high computational cost and reliance on white-box access. These requirements make them ill-suited for large-scale generative models, where training data is vast, access is restricted, and real-time responsiveness is essential.

In contrast, classical adversarial approaches have rapidly matured across both attack and defense. Black-box attacks often exploit prompt engineering, such as paraphrasing or template perturbation, to trigger undesired behaviors without model access (Jin et al., 2020; Yi et al., 2024). White-box strategies further optimize prompts or train surrogate models to design highly transferable adversarial inputs (Zou et al., 2023; Zhang et al., 2023c; Qi et al., 2024). On the defense side, black-box methods include prompt filtering and randomized perturbations (Jain et al., 2023; Cao et al., 2024a), while white-box defenses use fine-tuning, interpretability tools, or auxiliary models to detect unsafe inputs (Bianchi et al., 2024; Xie et al., 2024b; Zhang et al., 2025d). These methods have proven to be more efficient and scalable than attribution-based ones, particularly in real-world deployments.

That said, data attribution offers unique benefits not captured by these classical techniques. By tracing model behaviors back to specific training examples, attribution enables causally grounded analyses of adversarial vulnerabilities and a principled way to clean or curate datasets. This is especially valuable for defense: identifying toxic, biased, or jailbreaking-prone data can lead to interpretable and targeted mitigation strategies. While attribution-based attacks remain largely limited to toy or fine-tuning-scale models, their interpretability and data-centric perspective provide a complementary angle to existing adversarial toolkits.

Finally, we remark that this section focuses on the *application* of attribution methods for adversarial attack and defense. A distinct but growing body of work aims to *attack attribution methods themselves*, e.g., by misleading influence estimates (Ju et al., 2022; Wang et al., 2025c), which we leave outside the scope of this survey.

**Unique difficulties and challenges.** Despite their interpretability and data-centric appeal, attribution-based adversarial methods face several fundamental limitations in generative settings. Most rely on computationally intensive influence estimation techniques involving higher-order gradients, which scale poorly to modern LLMs. These methods also assume white-box access to model parameters and training procedures—an unrealistic requirement for proprietary or production-scale systems. Additionally, the long-range dependencies and multi-stage training pipelines characteristic of generative models make it difficult to attribute specific behaviors to individual training examples. Even when technically feasible, the resulting signals may be too diffuse or unstable to support reliable attack or defense. From a practical standpoint, attribution-based methods currently lack the scalability, flexibility, and robustness of classical adversarial techniques and are unlikely to match them in providing certified guarantees against adaptive attacks.

### 3.3.6 Recommendation

Looking forward, the utility of data attribution in adversarial settings may lie more in defense than in attack. While attribution-based attacks face significant scalability and access constraints, emerging work on black-box influence estimation (Jiao et al., 2024) suggests it may be possible to design lightweight defenses that flag or filter harmful training data without full model access. Integrating such methods into generative training pipelines could improve transparency and safety with minimal overhead. Nonetheless, attribution is unlikely to replace conventional adversarial techniques; its primary contribution may instead be as a diagnostic or forensic tool, offering interpretable insights into the data-driven roots of model vulnerabilities.

## 3.4 Data Economy

Data economy is “a global digital ecosystem where data is gathered, organized, and exchanged to create economic value” (Sestino et al., 2025). It demands the development of new methods for valuing data, ensuring fair compensation for its use, and designing equitable data markets. The rise of generative AI has intensified challenges related to data economy, affecting industries such as music, media, and beyond.

### 3.4.1 Overview of Data Attribution-based Data Economy

Data attribution in the context of data economy aims to address two key questions:

1. How can we fairly assign credit to data contributors whose data was used during training?

2. How can we construct equitable, collaborative, and reliable data markets based on these contributions?
To address (1), data attribution methods such as Data Shapley (Ghorbani and Zou, 2019) and influence functions (Koh and Liang, 2017) are employed. These methods assign a value to each individual data point based on its contribution to a predefined utility function-a process known as *data valuation*. Building on this, (2) involves designing allocation rules based on the valuation results, enabling data contributors to be rewarded through revenue sharing, data incentives, and more, thereby fostering a sustainable and mutually beneficial data economy. We will call this process of stimulation and compensation as *data compensation*.

### 3.4.2 Problem Settings

As discussed in the previous section, *data valuation* and *data compensation* are two core research direction in the context of data economy.

*Data valuation.* *Data valuation* assigns a single value to quantify the contribution of an individual data point to a utility function *v*, where *v* can be any metric of interest, such as empirical risk or accuracy. An ideal data valuation method should be *equitable*, satisfying the four desirable properties defined in Section 2.3.1: **Null Player**, **Symmetry**, **Additivity**, and **Efficiency**.

Data attribution scores provide a natural framework for quantifying data valuation. Among all attribution methods, data Shapley (Ghorbani and Zou, 2019) and its variants are the most common algorithm used for data valuation. They adopt a cooperative game theory perspective and naturally satisfy all four properties. Gradient-based methods, such as influence functions, are also widely used due to their direct connection to the utility function and their computational efficiency. However, they are not fully *equitable*. Due to their leave-one-out nature, most influence function methods fail to satisfy **Additivity** and **Efficiency**.

*Data compensation.* While *data valuation* identifies the importance of each data sample, *data compensation* focuses on translating these valuations into fair and practical rewards for data contributors. Compensation is a necessary step, as data value does not directly correspond to actual rewards, due to complex market dynamics and the buyer-seller relationship in data economy. A typical example is the free data market. Zhang et al. (2025b) systematically shows that without appropriate pricing mechanisms, the outcome can end up with a lose-lose situation for both buyers and sellers.

The complexity of the market is further reflected in the diversity of revenue sources and the various forms that rewards can take. In the domain of generative AI, data valuation methods can attribute specific generations back to copyrighted training samples (Deng et al., 2024b; Wang et al., 2024c). However, determining fair compensation remains ambiguous, as revenue may originate from various sources, and generated content may differ in popularity. Moreover, rewards can take different forms. For instance, Tay et al. (2022) explores data rewards, where contributors receive synthesized data generated by a model collaboratively trained on all contributors' data.

Privacy and fairness are also critical concerns in the compensation process. Data valuation typically requires access to the underlying data, which introduces risks such as data leakage or theft by buyers. Conversely, revealing the valuation algorithm to sellers may expose the system to manipulation. To address these issues, Tian et al. (2022) proposes a framework that enables secure data valuation while ensuring proper compensation for data providers.

### 3.4.3 Data Valuation and Compensation in the Data Economy

**Attribution algorithms.** Data Shapley (Tian et al., 2022) and variants of influence function, such as TracIn (Pruthi et al., 2020), TRAK (Park et al., 2023) are the most common algorithms used in data economy. In addition to assigning a value or score to each data point, they can also be leveraged to ensure the fair distribution of the rewards.

*Data valuation.* The most straightforward approach to data valuation is through Data Shapley $\phi_i$ (Ghorbani and Zou, 2019; Wang et al., 2024c; Tian et al., 2022; Tay et al., 2022), which is originally approximated via Monte Carlo sampling. From a game-theoretic perspective, Data Shapley distributes the total reward for the collective contribution of all data points in an equitable manner. Recent works, such as in-run Shapley value estimation (Wang et al., 2025a), have further improved the scalability of this method for large models. In addition, Tian et al. (2022) proposes training a set function model on a small subset of pre-computed Shapley values, which can then be used to predict the value of the remaining data points efficiently.

Other methods, such as influence functions, while not strictly *equitable*, are still widely used in data valuation due to their strong counterfactual estimation capabilities. For example, Deng et al. (2024b) employ TracIn and TRAK to trace generative AI outputs in music back to the original copyrighted training samples, demonstrating both the consistency and practical utility of these techniques. In addition, model-agnostic approaches have also been explored for data valuation. LAVA (Just et al., 2023), for instance, assigns value to each data sample based on its sensitivity to the class-wise Wasserstein distance between training and validation sets. This approach indirectly links each training sample to validation performance, offering a flexible and scalable alternative without dependency on any specific model.
*Data compensation.* In some of the cases, data compensation can be simply done in proportion to the data values (Wang et al., 2024c), which basically ensures the fairness. In free market settings, where things are complicated by the buyer-seller relationship, Zhang et al. (2025b) highlights the risks of exploitative pricing and advocates for setting the price based on the buyer's maximum willingness to pay (MWP), which is a value determined by both the marginal utility gain from the acquired data and the buyer's budget surplus.

Another interesting case of data compensation is distributing data rewards. In the setting of Collaborative Generative Modeling (CGM), the goal is to train a generative model using datasets $D_1, ..., N$ provided by $N$ contributors and to fairly allocate synthetic data rewards sampled from the model back to those contributors. Data Shapley can be integrated with Maximum Mean Discrepancy (MMD) (Gretton et al., 2012), a statistical metric that quantifies the difference between two distributions, to guide fair compensation. For each contributor $i$, a larger MMD-based data value $v(D_i)$ is assigned if the distribution of their data is more aligned with the joint distribution used for training and the synthetic samples, i.e., if the MMD between their data distribution and the global distribution is small. This indicates that their data plays a more central role in the generation of synthetic outputs. The final upper bound on reward for contributor $i$ is then computed as

$$r_i = v(D_i) \cdot \left( \frac{\phi_i}{\max_j(\phi_j)} \right)^\rho,$$

where $\phi_i$ is the Shapley value of contributor $i$, normalized by the maximum Shapley value across all contributors, and $\rho$ is a tunable parameter controlling reward sensitivity to Shapley values. During the reward allocation phase, synthetic data is randomly sampled and added to the reward pool $R_i$ for contributor $i$, until their updated data value $v(D_i \cup R_i)$ exceeds the bound $r_i$. This approach ensures that each contributor receives synthetic data that is beneficial to them and that larger contributions are rewarded more generously—promoting both fairness and utility in the data economy.

Privacy and security are additional concerns in the compensation process. Tian et al. (2022) propose a framework where the data remains encrypted to the buyer until payment is completed, which enhances data security and ensures fairness in compensation. Since the specifics of the encryption scheme fall outside the scope of this survey, we omit the technical details here.

**Target function.** The target function used in Data Shapley algorithms are often referred to as the utility function, which can take various forms depending on the application. In the context of generative AI copyright tracing, a common choice is the *log-likelihood* of a given generation (Deng et al., 2024b; Wang et al., 2024c), which evaluates the extent to which specific copyrighted training samples contribute to the generated output. Alternatively, distributional metrics can also serve as the utility function. For instance, Tay et al. (2022) adopt an MMD-based score to quantify each contributor's influence on the overall distribution learned by the generative model. In other settings, standard performance metrics (e.g., accuracy or loss on a validation set) may also be used as the utility target.

**Data granularity.** The granularity of attribution in data valuation or compensation can be either per-example or per-dataset. In practice, data contributors typically provide an entire dataset to the buyer, while Data Shapley is computed at the level of individual data points, as they represent the fundamental units of contribution. Due to the *Additivity* property of Shapley values, this two settings have almost no difference, as the value of a dataset is simply the sum of the Shapley values of its constituent data points.

### 3.4.4 Discussion

Classical approaches in data economy and AI often assess data through a combination of intrinsic and extrinsic factors. Raskar et al. (2019) note that “data valuation use-cases can be performed via intrinsic factors of evaluation such as based on quality of information within the dataset or via extrinsic factors of evaluation such as based on demand-supply, market economics, game-theoretic mechanisms and speculative market forces, or via a combination of both.” The first part of this statement aligns with techniques in *data valuation*, which aim to reveal the inherent value or utility of the data. The latter part reflects the practical considerations involved in *data compensation*, where contributors are rewarded not only according to intrinsic value but also based on market dynamics such as demand and supply. We refer interested readers to recent surveys for a broader overview of this topic (Liang et al., 2018; Sim et al., 2022; Zhang et al., 2023b).

Data attribution methods stand out among data assessment approaches due to their ability to provide valuable insights into the training mechanisms. These methods are often grounded in solid theoretical foundations, offering principled and quantifiable measures of data contributions through frameworks such as Shapley values. As a result, compensation based on attribution methods is generally considered more equitable and fair. In contrast, the emerging paradigm of “data labor” reconceptualizes user data from free capital to recognized labor. In this model, users would be rewarded for
their contributions, potentially improving data quality, encouraging innovation, and providing a more equitable share of value (Arrieta-Ibarra et al., 2018). However, these traditional approaches often rely on heuristic assessments, such as the difficulty of data acquisition or market-driven pricing. These methods lack principled guarantees, and when applied exploitatively, they risk undermining the long-term sustainability of the data economy (Zhang et al., 2025b).

**Unique difficulty and challenges.** Data attribution methods, while theoretically robust, can be prone to adversarial attacks (Wang et al., 2025c). This introduces vulnerabilities into data valuation and marketplace systems. Moreover, data attribution methods typically require direct access to training data—a condition that is often unmet in large generative AI systems.

### 3.4.5 Recommendation

When training data is accessible, data attribution methods are particularly suited for assessing and compensating data contributions, as they offer theoretically grounded and equitable allocations, through frameworks such as Shapley values and influence functions. These methods enable a principled understanding of each data point's impact on the model's performance, making them a natural choice for fair reward distribution in collaborative learning settings.

However, in scenarios where training data is not directly accessible—either due to privacy constraints, security concerns, or technical limitations—classical approaches may be more practical. These methods typically rely on extrinsic signals such as market demand, acquisition cost, or supply scarcity, and while they lack formal fairness guarantees, they can still provide useful heuristics for data valuation and pricing in real-world markets.

## 3.5 Other Applications

While core applications of data attribution—such as data selection, fact tracing and concept probing, adversarial attack and defense, as well as data economy—have received growing attention, several emerging domains have begun to explore their potential. These newer applications, though less mature, highlight the versatility of data attribution and suggest promising future directions. In this section, we discuss three such areas: artifact detection and bias mitigation, memorization and privacy leakage detection, and machine unlearning. For each, we define the problem setting and examine how attribution techniques help address its central challenges.

### 3.5.1 Artifact Detection and Bias Mitigation

**Problem setting.** Modern ML systems are vulnerable to learning spurious patterns or encoding social and structural biases embedded in their training data. These artifacts, such as confounding visual cues in medical imaging or demographic correlations in NLP, can degrade generalization and produce unfair behavior. A central challenge is to identify the specific training examples that introduce such undesirable behaviors and to develop mechanisms to remove, down-weight, or mitigate their influence. This requires both fine-grained accountability and task-specific interpretability.

**Data-attribution-based artifact detection and bias mitigation.** Data attribution provides a principled framework for tracing model behavior back to individual training examples. The effectiveness of this approach hinges on two components: (1) the design of an appropriate *target function* to measure the undesirable behavior, and (2) a mitigation strategy that acts on the attribution scores computed with respect to that function.

*Artifact detection.* In artifact detection, the goal is to isolate confounding examples that undermine robustness: typically, those that lead to *incorrect predictions* or abnormally high confidence on carefully chosen validation instances. By leveraging attribution methods' ability to estimate counterfactuals, researchers can assess how the inclusion or removal of a specific training example affects model performance on a validation set. A common target function for this purpose is the *validation loss* on test instances suspected of being influenced by artifacts. Attribution scores with respect to this target reveal whether a training point contributes to misbehavior, such as reduced prediction confidence or spurious performance gains.

We highlight two representative works that adopt this paradigm. An early example is Han et al. (2020), which focuses on NLP classification tasks such as sentiment analysis and natural language inference. They apply influence functions using validation loss as the target function and examine the training points with the highest attribution scores. As an early exploration, their approach is straightforward: they analyze which training examples most increase validation loss when removed, identifying potential artifacts via simple ranking.

A more recent study by Pezeshkpour et al. (2022) considers large-scale text generation tasks and proposes a more fine-grained attribution method. They first compute instance-level influence scores using validation loss on a hand-
selected test set as the target. Then, to localize artifacts within each example, they combine data attribution with feature
attribution: they compute input gradient-based saliency maps by taking the gradient of the influence score with respect
to each input token. This two-step approach allows them to not only identify problematic training samples, but also
pinpoint the specific token-level features responsible for the artifact.

*Bias mitigation.* In bias mitigation, the goal is to reduce performance disparities across demographic or structural
groups in the dataset. This typically involves minimizing discrepancies in group-based metrics such as true positive
rate (TPR), false negative rate (FNR), or other fairness-specific objectives. Data attribution offers a principled way to
simulate counterfactuals: given a well-defined target function that captures fairness notions, attribution methods can
estimate which training examples most contribute to group disparities. A key distinction from artifact detection is that
bias mitigation not only seeks to *identify* biased or harmful examples but also to *modify* the training process in response
through reweighting, relabeling, or removing those examples.

Although this direction remains underexplored for generative models in particular, several recent works demonstrate
how data attribution can support fairness improvements in discriminative settings.

Two recent methods, D3M (Jain et al., 2024) and FairIF (Wang et al., 2024b), use data attribution to improve group-level
performance without requiring manual intervention. D3M applies TRAK-based attribution to identify subsets of training
data that disproportionately impact under-performing groups. The target function is group-aggregated test loss, and
group-level attribution is used to determine which examples most exacerbate fairness gaps; this information is then
used to rebalance the training data. In contrast, FairIF employs a two-stage pipeline. In the first stage, it uses influence
functions with group-specific target functions, such as TPR and TNR within each subgroup, to estimate the influence
of training examples on fairness objectives. In the second stage, the estimated influence scores are used to compute
reweighting coefficients, and the model is retrained using this reweighted dataset. This approach improves fairness in a
data-driven and systematic manner.

In the NLP domain, Brunet et al. (2019) studies social bias in static word embeddings such as Word2Vec (Mikolov et al., 2013) and GloVe (Pennington et al., 2014). Using influence functions, they attribute changes in the WEAT (Word Embedding Association Test) score (Caliskan et al., 2017)—a common metric for measuring bias in embeddings—to individual training documents. By ranking documents by their influence on WEAT, the method identifies high-impact sources of bias and enables targeted removal or curation. This represents a natural application of attribution to unsupervised or non-classification models.

A related direction concerns biases that arise not from group-based disparities but from train-test distribution mismatch.
This scenario resembles data cleaning (see Section 3.1) but involves a more active *mitigation* step. Kong et al. (2022)
explores this case by proposing a novel use of influence functions to actively *correct* training labels rather than
discard samples. Here, the target function is the standard validation loss, and attribution scores estimate the effect of
relabeling each training point. Based on this, the authors design a relabeling function that selects the optimal label under
counterfactual analysis, thereby mitigating bias while preserving valuable examples and improving model robustness.

**Discussion.** Data attribution offers a flexible and principled toolkit for detecting artifacts and mitigating bias by identifying and intervening on influential training examples. Its core strength lies in simulating counterfactual effects: attribution methods can estimate how small changes in the training data impact downstream behavior, enabling targeted interventions. Crucially, this counterfactual perspective is adaptable to a wide range of settings and objectives—from robustness to fairness—simply by choosing an appropriate target function. This makes data attribution a unifying framework for a broad class of problems involving harmful data influence.

Nonetheless, current applications of attribution-based artifact detection and bias mitigation are largely confined to
supervised, discriminative models and are typically applied in small- to medium-scale settings. Extending these
approaches to large-scale or generative models remains a significant open challenge. From a data attribution perspective,
future progress in this area may require:

* **Target function design:** Developing principled target functions that reflect nuanced forms of bias or artifact-driven
behavior, particularly for open-ended outputs. For instance, instead of standard loss, one might consider diversity,
toxicity, or factuality metrics in language generation.

* **Granular attribution:** Leveraging finer-grained attribution units (e.g., token spans, sentence pairs, visual regions) to
localize problematic features within training examples, as seen in the hybrid data-feature attribution approach by
Pezeshkpour et al. (2022).

* **Intervention strategies:** Expanding beyond removal and reweighting to include soft interventions such as relabeling,
synthetic data augmentation, or guided training-time regularization informed by attribution scores.
As foundational models grow in scale and scope, so too does the risk of learning from biased or confounded data. Data attribution stands out as a promising direction for making these systems more interpretable, robust, and fair. However, significant methodological advances are still needed to realize its full potential in generative and large-scale settings.

### 3.5.2 Memorization Detection

**Problem setting.** Large generative models are prone to memorizing parts of their training data (Morris et al., 2025a), largely due to their high capacity and over-parameterization. While some level of benign memorization is expected, such as well-known phrases or public content, uncontrolled memorization poses risks to generalization, privacy, and robustness. The goal of memorization detection is to identify whether a model has memorized specific training examples, and if so, to determine which examples contributed most to this behavior.

**Data-attribution-based memorization detection.** Data attribution offers a causal lens for understanding memorization by linking generated outputs back to influential training examples. A central challenge is defining what constitutes “memorization” in a way that is measurable and aligned with model behavior. Early work by Feldman and Zhang (2020) introduces a formal definition of label memorization in supervised classification. Specifically, the memorization of a training example $z_i = (x_i, y_i) \in D_{\text{raw}}$ under training algorithm $\mathcal{A}$ is defined as

$$ \text{mem}(\mathcal{A}, D_{\text{raw}}, z_i) := \Pr_{h \leftarrow \mathcal{A}(D_{\text{raw}})} (h(x_i) = y_i) - \Pr_{h \leftarrow \mathcal{A}(D_{\text{raw}} \setminus \{z_i\})} (h(x_i) = y_i). $$

This counterfactual definition aligns naturally with data attribution: by setting the target function to the model's prediction confidence on $z_i$, self-influence (see Section 3.1) becomes a direct estimator of memorization.

In generative settings, however, applications of attribution remain limited and often heuristic. For example, Liu and Yang (2024) applies influence functions to detect privacy leakage by treating the validation loss on a held-out test sample as the target function. Similarly, Wang et al. (2025d) employs TracIn in a comparable setup. While these approaches are practical, the use of validation loss as a proxy for memorization lacks theoretical justification, making these applications relatively shallow. A more principled connection between generative memorization and attribution remains to be established.

**Discussion.** Unlike similarity-based memorization detection methods, attribution techniques offer more precise diagnostics by not only identifying whether memorization has occurred but also revealing which training examples are causally responsible. This is particularly valuable for debugging training data, auditing privacy risks, or performing targeted unlearning.

However, a key limitation lies in the absence of a formal and community-accepted definition of harmful memorization, especially in the context of generative AI. Without such a definition, attribution-based methods risk being applied in ad hoc or heuristic ways. To advance this direction, future work should aim to formalize memorization metrics for generative models—potentially drawing from the existing literature (Morris et al., 2025b)—and integrate attribution tools into training-time pipelines for early detection and proactive mitigation.

### 3.5.3 Machine Unlearning

**Problem setting.** Machine unlearning aims to remove the influence or effects of specific training examples from a model. This capability is essential for complying with data deletion requests (e.g., under privacy regulations (Mantelero, 2013)) to protect sensitive data, or to erase unwanted knowledge that is accidentally acquired by the model during training. While retraining from scratch is the most principled form of “exact unlearning,” it is typically infeasible in practice due to high computational costs. As a result, there is growing interest in efficient approximate unlearning methods that can remove the impact of selected training points without full retraining.

A key challenge lies in the global nature of unlearning: the objective is not merely to alter predictions on a few test points, but to modify the model parameters such that the overall behavior reflects the absence of the removed data. With the growing complexity of modern model training setups, accurately estimating the counterfactual effect on model parameters under general settings (e.g., non-convexity, inherent randomness, etc.) remains a significant technical obstacle.

**Data-attribution-based machine unlearning.** Since unlearning is fundamentally about removing the influence of specific training examples, it naturally connects with data attribution methods. In convex settings, this connection has been explicitly explored: early certified unlearning algorithms for convex models effectively employ influence-function-style updates. For instance, Guo et al. (2020) derives a closed-form parameter update via one Newton step for removing
one sample $z$, given by

$$ \hat{\theta}_{-z} \approx \hat{\theta} + \frac{1}{n} H_{\hat{\theta}}^{-1} \nabla \ell(z; \hat{\theta}), $$

which mirrors the classical influence function approximation (Equation (2)) for the parameter change induced by removing a training example $z$. Similarly, Neel et al. (2021) develops descent-based methods grounded in similar first-order influence approximations. However, these approaches are limited by their reliance on convexity and smoothness, which restricts their applicability to modern deep models, where such approximations can be inaccurate or unstable.

Recent work has begun to address this gap by leveraging advances in data attribution for complex, non-convex models. In particular, Georgiev et al. (2025) proposes an unlearning method that uses counterfactual influence estimates, as computed by TRAK (Park et al., 2023), to guide targeted model updates. Instead of retraining the model from scratch, they identify and modify only the parameters most affected by the example to be unlearned, enabling more efficient and localized unlearning. While their method does not provide formal guarantees, they employ their proposed algorithm on ResNet models on image classification tasks, demonstrating that attribution-informed unlearning is empirically viable even in the absence of convexity.<fnref n="15" />

**Discussion.** Attribution-based unlearning has shown its potential in the classical classification settings, but in general, this direction remains largely unexplored, let alone in the context of large generative models. Several obstacles hinder progress: high computational costs, the challenge of isolating a training point's impact on open-ended outputs, and the lack of robust approximations for global parameter influence with guarantees. For instance, the influence function suffers from non-convex loss functions and multiple local minima of model checkpoints, hence can not accurately predict the effects of removing a data point for a single model, but only an expectation over training randomness.

A promising future direction is to focus on designing scalable surrogates for attribution that are tailored to the needs of generative models, and also leverage recent dynamic attribution methods that are more single-model-focused methods to overcome the training progress.

# 4 Evaluation

In this section, we present common approaches for evaluating data attribution methods. We categorize these evaluations into four groups: (i) counterfactual prediction of model behavior, (ii) utility/effectiveness in downstream tasks, (iii) computational costs, and (iv) other miscellaneous criteria. For each group, we introduce the relevant definitions and highlight general limitations. We also discuss specific considerations for generative models, including large language models and diffusion models. Finally, we provide suggestions and recommendations for developing improved evaluation methods for future work.

## 4.1 Counterfactual Prediction of Model Behavior

**Notations.** Consider a training dataset $D = \{z_1, z_2, \dots, z_n\}$, where each $z_i$ is a training example. For any data subset $S \subseteq D$, let $\hat{\theta}_S$ denote the (optimal) model obtained by minimizing the following empirical risk over $S$:

$$ \hat{\theta}_S = \arg\min_{\theta} \mathcal{L}(S; \theta) = \arg\min_{\theta} \frac{1}{|S|} \sum_{z_i \in S} \ell(z_i; \theta), $$

where $\ell(z_i; \theta)$ is the loss incurred by the model with parameters $\theta$ on training data $z_i$. We further define $f(z; \theta)$ as the target function, which quantitatively represents the model behavior when the corresponding model is evaluated at a certain sample $z$ in interest. Note that the input to $f$ can also be a data subset (e.g., $f(S; \theta)$). In particular, for a query/test dataset $D_{eval} = \{z_{test}^{(j)}\}$ in interest, we may write $f(D_{eval}; \theta)$. We also denote an attribution method as $\tau$. For a given attribution method $\tau$ applied on model $\theta$, a training dataset $S$ and the target function $f(D_{eval}; \theta)$ associated with a test dataset $D_{eval}$, we define the attribution score associated with training example $z_i$ as $\tau(z_i, S; f(D_{eval}; \theta))$.

**Overview.** For a given data attribution method $\tau$, the (optimal) model $\hat{\theta}_D$ trained on full training dataset $D$ and a fixed query dataset $D_{eval}$, evaluation methods in this group examine how well (i) the induced attribution scores of training samples: $\{\tau(z_i, D; f(D_{eval}; \hat{\theta}_D)), \forall z_i \in D\}$ and (ii) the counterfactual predictions of model behavior when the model is directly re-trained on counterfactual subsets $S_{z_i} : \{f(D_{eval}; \hat{\theta}_{S_{z_i}}), \forall z_i \in D\}$ align with each other.<fnref n="16" /> Typically,

<footnote n="15">¹⁵It is worth noting that in Georgiev et al. (2025), they have also provided convergence theory in the case of linear models, echoing Guo et al. (2020); Neel et al. (2021).</footnote>

<footnote n="16">¹⁶Note that the definition of counterfactual dataset $S_{z_i}$ depends on each training example $z_i$.</footnote>
these evaluation methods will (i) apply data attribution methods to compute the attribution scores for each training data point $z_i$, (ii) compute certain types of counterfactual predictions as **ground-truth** values (such as direct model output $f(D_{eval}; \hat{\theta}_S)$ or output of different target functions) and (iii) compute the *goodness score* between the attribution scores and the **ground-truth** values. For example, the *goodness score* can be defined as some correlation coefficients, measuring the correlation between two lists of attribution scores and *ground-truths*.

Below, we introduce some important definition of the **ground-truth** values, where their corresponding *goodness score* will be discussed in each subsection. For each group of evaluation methods, we also provide discussion on its general limitation and applicability to large generative models.

### 4.1.1 Leave-One-Out (LOO) Influence

Leave-One-Out (LOO) influence (Cook and Weisberg, 1982; Koh and Liang, 2017) evaluates how much a model's performance changes when a single data point is removed from the training set. Specifically, models are trained with each data point dropped one at a time, and the performance (i.e. the value of target function output) is measured to observe the effect of excluding that particular point. Formally, given a test example $z_{test}$ in interest, LOO influence defines the *ground-truth* for training sample $z_i$ as $f(z_{test}, \hat{\theta}_{D-\{z_i\}})$, where the counterfactual data subset $S \triangleq D - \{z_i\}$ is the full dataset with $z_i$ removed. For the target function, a common choice is the loss function $\ell(z_{test}; \theta)$. Thus, the corresponding LOO influence can be written as $\mathcal{I}_{LOO}(z_i) := \ell(z_{test}; \hat{\theta}_{D-\{z_i\}}) - \ell(z_{test}; \hat{\theta}_D)$. For the corresponding *goodness score*, the Pearson correlation coefficient (Pearson, 1895) is used by comparing the attribution scores with the change in model behavior observed when that data point is removed. Representative experiment setups with LLO influence are summarized in Table 14.

**Influence-function-based influence.** As an approximation of LOO influence, influence function (Koh and Liang, 2017) exhibits strong correlation with LOO ground-truths under certain conditions, such as the convergence of model and convexity of the loss function. However, for papers that propose variants of influence functions (Koh and Liang, 2017), LOO influence can not capture the most accurate information since those conditions may not be satisfied. Thus, these papers evaluate the quality of their proposed data attribution methods by treating the attribution scores derived from either exact or approximate of influence function as ground-truths. For example, FastIF (Guo et al., 2021) and DataInf (Kwon et al., 2024) compare their methods to the exact computation or LiSSA-based approximation of influence function and conduct correlation analysis (via Pearson correlation coefficient (Pearson, 1895) computation).

**Trajectory-specific LOO influence.** To overcome the limitation of typical LOO influence, which assumes permutation invariance of training data and only consider the final state of the trained model, trajectory-specific LOO influence (TSLOO influence) (Hara et al., 2019; Wang et al., 2025b) has been developed to quantify the change in loss when a specific data point is removed during an iteration within a specific training run. Specifically, a training run is defined as a sequence of mini-batches and the random initialization that is defined and fixed before model training. The advantage of TSLOO influence is that it considers the case that an identical data can have significantly different attribution scores when introduced in different training stages. Correlation analysis has been carried out with epoch-specific single data removal influences (i.e. each data point within a specific epoch or all epochs is removed) as ground-truths (Hara et al., 2019; Wang et al., 2025b).

<table><caption>Table 14: Representative experiment settings with LOO influence.</caption><thead><tr><th>Reference</th><th>Models</th><th>Datasets</th></tr></thead><tbody><tr><td colspan="3"><strong>Language Models</strong></td></tr><tr><td>Wang et al. (2025b)</td><td>Pythia-410M (Biderman et al., 2023)</td><td>Pile (Gao et al., 2020)</td></tr><tr><td>Jiao et al. (2024)</td><td>Pythia-1B (Biderman et al., 2023)</td><td>Alpaca (Taori et al., 2023), K-Means-100 (Li et al., 2024c)</td></tr><tr><td colspan="3"><strong>Diffusion Models</strong></td></tr><tr><td>Dai and Gifford (2023)</td><td>DDPM (Ho et al., 2020b)</td><td>MNIST (LeCun et al., 1998), CIFAR-10 (Krizhevsky, 2009), CelebA (Liu et al., 2015)</td></tr></tbody></table>
**Limitations.** While LOO influence provides a theoretically grounded approach to measuring the effect of individual training examples, it comes with several practical and theoretical limitations:

* **Assumption of unique solution:** LOO influence typically assumes that the solution to the underlying loss minimization problem is unique, requiring a fixed reference point to compute the effect of data removal. However, large and deep neural networks often violate this assumption, making LOO estimates ambiguous (Basu et al., 2021; Bae et al., 2022; Schioppa et al., 2023; Bae et al., 2024).

* **Indistinguishability:** In modern large-scale datasets, models trained with only one data point removed are often indistinguishable with the original model. This ambiguity persists even when averaging over multiple independent re-trained models with different random initializations (Nguyen et al., 2023).

* **Fragility:** Several studies (K and Søgaard, 2021; Epifano et al., 2023; Basu et al., 2021; Bae et al., 2022, 2024) have highlighted the fragility of LOO influence. Notably, Bae et al. (2022) identifies failure modes of influence-function-based estimates and introduces the proximal Bregman response function (PBRF) as a more reliable ground-truth.

* **Computational inefficiency:** LOO influence requires retraining the model $n$ times to compute influence scores for all training samples, where $n$ is the number of training instances. This makes it computationally infeasible for large datasets.

**Generative model settings.** Computing exact LOO influence is already impossible for large models before the era of large generative models. As an efficient alternative, influence-function-based influence approximates LOO influence by certain technical assumption. Nevertheless, it is still computationally infeasible for large generative models mainly due to the expensive computation of Hessian matrix and inverse Hessian-vector-product. For example, most papers (Koh and Liang, 2017; Ko et al., 2024; Kwon et al., 2024) evaluating their method with influence-function-based influence typically only consider small models, such as MLP/CNN or RoBERTa-large (Liu et al., 2019), whose sizes are much smaller than modern generative models.

### 4.1.2 Linear Datamodeling Score (LDS)

Proposed by Park et al. (2023), the linear datamodeling score (LDS) evaluates data attribution methods by probing their ability to estimate the counterfactual predictions of models being re-trained on random data subsets. By the additivity assumption on attribution methods <fnref n="17" />, LDS defines a method’s counterfactual prediction as the sum of the scores of the examples in the given training subset. Formally, for a given attribution method $\tau$ and a test example $z_{test}$ in interest, we can first define the *attribution-based prediction* of the target function $f(z_{test}; \theta)$ as follows:

$$g_{\tau}(z_{test}, S; D) \triangleq \sum_{i:z_i \in S} \tau(z_i, S; f(z_{test}; \hat{\theta}_S)),$$

where $D$ is the full training set and $S \subseteq D$ is a subset of $D$. Conceptually, $g_{\tau}(z_{test}, S; D)$ computes the overall attribution of the subset $S$ on the test example $z_{test}$, which should serve as a proxy of the counterfactual prediction measured on $z_{test}$ (i.e. $f(z_{test}; \hat{\theta}_S)$). The *linear datamodeling score* (LDS) then defines the *goodness score* as the Spearman rank correlation (Spearman, 1904) between counterfactual predictions when the models are re-trained on different training subsets $S$ and the scores computed by the attribution method. Formally, let $\{S_1, \dots, S_m : S_j \subseteq D\}$ be $m$ randomly sampled data subsets from the full training set $D$, each of size $\alpha \times n$ for some fixed $\alpha \in (0, 1)$. The *linear datamodeling score* (LDS) of $\tau$ for a specific example $z_{test}$ is defined as:

$$\text{LDS}(\tau, z_{test}) \triangleq \rho(\{f(z_{test}; \hat{\theta}_{S_j}) : j \in [m]\}, \{g_{\tau}(z_{test}, S_j; D) : j \in [m]\}),$$

where $\rho$ is the Spearman rank correlation (Spearman, 1904).<fnref n="18" /> Compared to LOO influence, only a constant number of training data subsets are required to compute an accurate LDS, regardless of the size of the training data set (typically only tens to hundreds of models are sufficient for the LDS to converge (Park et al., 2023)). Notable experiment settings with LDS are summarized in Table 15.

<footnote n="17">¹⁷If a data attribution method is additive, then it defines an attribution score that the overall influence of a group is the sum of the individual influence in the group.</footnote>

<footnote n="18">¹⁸It is straightforward to extend the definition of LDS to a set of test examples (i.e. $D_{eval} = \{z_{test}^{(j)}\}$) by $\text{LDS}(\tau, D_{eval}) = \frac{1}{|D_{eval}|} \sum_{z_{test} \in D_{eval}} \text{LDS}(\tau, z_{test})$</footnote>
**Limitations.** While being more computationally efficient than LOO influence, LDS still faces the following limitations.

* **Spearman rank correlation:** As discussed by Epifano et al. (2023), the Spearman rank correlation coefficient (Spearman, 1904), often used as a *goodness score* for evaluating data attribution, captures only monotonic relationships and ignores scale. Thus, it may yield high correlation even when the estimated and true influence values diverge significantly in magnitude, potentially masking estimation inaccuracies.

* **Assumption on additivity:** The assumption on the additivity of attribution scores can be violated and might hinder LDS from probing the *true* ability of attribution methods on predicting the behavior of re-trained models when they are trained with a significant amount of data points removed (Hu et al., 2024a).

**Generative model settings.** Park et al. (2023) evaluate their main method, TRAK, with LDS on mostly small-scale classification tasks (i.e. the parameter size of models is much smaller than modern generative models). The only generative setting discussed in the paper is conducted on a mt5-small model (Xue et al., 2021) (≈ 300M parameters), which is much smaller than modern generative models. Even much cheaper than LOO influence, training hundreds of model variant is still computationally extensive for *large language models* (typically with tens to hundreds of billion parameters). Thus, it is more often for papers discussing *diffusion models* to evaluate their proposed methods using LDS. For example, these data attribution methods designed for diffusion models (Georgiev et al., 2023; Zheng et al., 2023; Brokman et al., 2024; Lu et al., 2025; Bae et al., 2024; Wang et al., 2024d) all include LDS as one evaluation protocol.

<table><caption>Table 15: Representative experiment settings with LDS.</caption><thead><tr><th>Reference</th><th>Models</th><th>Datasets</th></tr></thead><tbody><tr><td colspan="3"><strong>Diffusion Models</strong></td></tr><tr><td>Georgiev et al. (2023)</td><td>DDPM (Ho et al., 2020b), LDM (Rombach et al., 2022)</td><td>CIFAR-10 (Krizhevsky, 2009),<br>MS COCO (Lin et al., 2014)</td></tr><tr><td>Zheng et al. (2023)</td><td>DDPM (Ho et al., 2020b)</td><td>CIFAR-2/10 (Krizhevsky, 2009),<br>ArtBench (Liao et al., 2022),<br>CelebA (Liu et al., 2015)</td></tr><tr><td>Lin et al. (2025)</td><td>DDPM (Ho et al., 2020b), Stable Diffusion (Rombach et al., 2022)</td><td>CIFAR-2/10 (Krizhevsky, 2009),<br>ArtBench (Liao et al., 2022)</td></tr><tr><td>Lu et al. (2025)</td><td>DDPM (Ho et al., 2020b), Stable Diffusion (Rombach et al., 2022)</td><td>CIFAR-20 (Krizhevsky, 2009),<br>ArtBench (Liao et al., 2022),<br>CelebA-HQ (Karras et al., 2018)</td></tr></tbody></table>

### 4.1.3 Steering Model Output Change

In contrast to the previous methods, another line of evaluation focuses on the general utility of attribution scores through data removal or addition experiments. Rather than comparing attribution scores to ground-truth outputs, these methods assess how model output changes when specific subsets of the training data are removed or added based on their attribution scores. The key hypothesis is that removing the most influential samples, which are those with the top-k highest (most positively attributed) scores, should degrade performance, while removing the least useful or harmful samples (those with the bottom-k scores) should improve it. This form of steering offers a practical way to validate the effectiveness of a data attribution method. For this type of evaluation method, the definition of *goodness score* varies between different scenarios, which includes but not limits to the magnitude of the prediction logit or loss change (Yeh et al., 2022; Wang et al., 2024h,h; Guo et al., 2021; Barshan et al., 2020; Koh et al., 2024; Lu et al., 2025), accuracy drop (Park et al., 2023; Fotouhi et al., 2024; Wu et al., 2023b; Lin et al., 2024c; Wang et al., 2024g), and change of FID score (Georgiev et al., 2023; Lin et al., 2024a). Representative experiment setups that inspect model output are summarized in Table 16.

**Brittleness.** Brittleness (Ilyas et al., 2022; Moitra and Rohatgi, 2023), which is originally defined as finite-sample stability by Broderick et al. (2020) and Moitra and Rohatgi (2023), is another important evaluation metric probing the prediction change of the model trained with a valuable set of data removed.<fnref n="19" /> Formally, given *D* as the full training

<footnote n="19">¹⁹We note that *brittleness* was originally defined in the context of traditional classification problems. Accordingly, we adopt the same setting for its definition.</footnote>
dataset and $z_{test}$ a test example, we define the *data support* of $z_{test}$, denoted as $\text{SUPPORT}(z_{test})$, as the smallest subset $S \subset D$ such that the *counterfactual* classifier trained on $D \setminus S$ *mis-classifies* $z_{test}$:

$$ \text{SUPPORT}(z_{\text{test}}) = \min_{S \subset D}\{|S|, \text{ where } f(z_{\text{test}}; \hat{\theta}_{D\setminus S}) \neq y_{z_{\text{test}}}\}, $$

where $f(z_{test}; \hat{\theta}_{D\setminus S})$ is the (optimal) classifier trained on $D - S$ and $y_{z_{test}}$ is the ground-truth label of $z$. Specifically, a test example $z_{test}$ is considered *brittle* if $\text{SUPPORT}(z_{test})$ is small, i.e., removing only a few training points can significantly change the model's prediction on $z_{test}$. Notably, Ilyas et al. (2022) proposes an algorithm that is suitable for any data attribution method to approximate *brittleness* utilizing its corresponding attribution scores for a guided search on optimal $S$. Several later papers (Park et al., 2023; Choe et al., 2024) evaluate their proposed data attribution method via the same algorithm design to compute *brittleness*.

**Limitations.** When measuring brittleness, previous papers (Ilyas et al., 2022; Park et al., 2023) typically first apply a specific algorithm, which utilizes the assumption of additivity of attribution scores (i.e. group influence can be approximated by the sum of individual influence) to obtain the *data support* for each test sample. This assumption is not necessarily true and thus contributes to a mismatch gap between the exact utility of data attribution method and the brittleness output by the algorithm (Hu et al., 2024a).

**Generative model settings.** While brittleness is originally used to probe classification tasks (Ilyas et al., 2022), it can be extended to generative scenarios by modifying the definition of the target function $f(z; \theta)$. For example, Park et al. (2023) and Choe et al. (2024) compute the effectiveness of their proposed methods with the generative language modeling setting, where for any text query in the training corpus, the classification target can be defined as the next token associated with the ending token of the query.

<table><caption>Table 16: Representative experiment settings with model output change.</caption><thead><tr><th>Reference</th><th>Models</th><th>Datasets</th><th>Metrics</th><th>Task</th></tr></thead><tbody><tr><td colspan="5"><strong>Language Models</strong></td></tr><tr><td>Bae et al. (2024)</td><td>GPT-2 XL (Radford et al., 2019)</td><td>Wikitext (Merity et al., 2017)</td><td>Perplexity</td><td>Brittleness</td></tr><tr><td>Wang et al. (2025a)</td><td>GPT-2 small (Radford et al., 2019)</td><td>Pile (Gao et al., 2020)</td><td>loss change</td><td>Counterfactual</td></tr><tr><td colspan="5"><strong>Diffusion Models</strong></td></tr><tr><td>Georgiev et al. (2023)</td><td>DDPM (Ho et al., 2020b),<br>LDM (Rombach et al., 2022)</td><td>CIFAR-10 (Krizhevsky, 2009),<br>MS COCO (Lin et al., 2014)</td><td>FID change<br>l<sub>2</sub>-distance change</td><td>Brittleness<br>Counterfactual</td></tr><tr><td>Zheng et al. (2023)</td><td>DDPM (Ho et al., 2020b)</td><td>CIFAR-2/10 (Krizhevsky, 2009),<br>ArtBench (Liao et al., 2022),<br>CelebA (Liu et al., 2015)</td><td>l<sub>2</sub>-distance change<br>CLIP-similarity</td><td>Counterfactual</td></tr><tr><td>Wang et al. (2024h)</td><td>LDM (Rombach et al., 2022)</td><td>MS COCO (Lin et al., 2014)</td><td>loss/l<sub>2</sub>-distance change,<br>CLIP-similarity</td><td>Counterfactual</td></tr></tbody></table>

## 4.2 Effectiveness in Downstream Tasks

**Overview.** Application-based evaluation of data attribution methods assesses their practical utility in real-world scenarios. Key application domains include *data selection* (Section 3.1), *fact tracing* (Section 3.2) and *adversarial attacks* and *defenses* (Section 3.3). We focus on these areas for their heightened relevance in the era of generative AI. For each downstream application, we further discuss the associated evaluation metrics, common limitations as well as caveats in applying them to generative modeling contexts.

### 4.2.1 Data Selection

In this evaluation setting, attribution methods are applied to edit the training dataset and their effectiveness is judged by the change in downstream model performance. The underlying assumption is that a well-calibrated attribution method assigns high scores to genuinely useful examples and low scores to detrimental ones. Accordingly, retaining top-ranked data or removing low-quality entries should yield performance improvements, while the inverse should lead to degradation. The following paragraphs examine common applications of this setting: *Selection and Filtering*, which focuses on retaining or discarding samples based on their scores, and *Mislabeled Data Detection*, which targets the identification and removal of incorrectly annotated examples. Notable experiment settings are summarized in Table 17.
**Selection and filtering.** Whether aiming to retain only the most valuable samples or remove those harmful ones, data attribution scores are ultimately judged by their impact on downstream performance. As mentioned in Section 3.1.1, a common pipeline is to utilize the score to retain, discard, or re-weight training samples, and then re-train or fine-tune the model on the edited dataset. The updated model is evaluated on a target dataset, with metrics such as accuracy and mean log-probability on a holdout set being standard choices (Engstrom et al., 2024; Xia et al., 2024; Zhou et al., 2024; Wang et al., 2024e; Zhou et al., 2024; Yu et al., 2024; Wang et al., 2024e, 2025b, 2023c; Kang et al., 2023; He et al., 2024; Chhabra et al., 2024; Zhou et al., 2024; Wang et al., 2024e).

When the goal is to filter out low-quality or toxic data (Wang et al., 2024b; Bejan et al., 2023; Schioppa et al., 2022), attribution scores guide the identification of such samples. In some cases, their influence is explicitly “unlearned” by altering the model to forget them (Wang et al., 2024h; Lin et al., 2024a; Ye et al., 2024). Here too, effectiveness is measured by improvements in downstream metrics, supplemented by task-specific measures such as F1 or exact match score in question answering tasks (Bejan et al., 2023; Xie et al., 2024b; Teso et al., 2021).

**Mislabeled/noisy data detection.** As another important application, *mislabeled/noisy data detection* aims to identify incorrect labels/noisy features in training datasets. In earlier works, *mislabeled/noisy data* is curated manually and has been a standard task to for evaluation (Koh and Liang, 2017; Khanna et al., 2019; Pruthi et al., 2020; Kim et al., 2023; Kwon et al., 2024; Zhou et al., 2024; Ko et al., 2024; Bejan et al., 2023; Schioppa et al., 2022; Just et al., 2023).

To detect *mislabeled/noisy data*, different indicators are used to rank the training samples. For example, gradient-based methods (Koh and Liang, 2017; Pruthi et al., 2020; Park et al., 2023) typically compute *self-influence* by imaging a test set with the training data point in interest within it and computing the attribution scores between them. In contrast, shapley-based methods (Ghorbani and Zou, 2019; Li and Yu, 2023; Wang and Jia, 2023a) do not require specifying the imaginary test set. They assess the contribution of each training example by considering its marginal impact directly. A high self-influence score indicates a *mislabeled* or *noisy* data point, suggesting that the remaining training data cannot adequately compensate for its absence.

To evaluate the effectiveness of data attribution methods in identifying such points, most studies compute false positive and true positive rates under varying thresholds (i.e., number of retrieved samples). Common evaluation metrics include Area Under the Curve (AUC) (Pruthi et al., 2020; Schioppa et al., 2022; Wang et al., 2025a; Just et al., 2023; Ko et al., 2024; Kwon et al., 2024), Average Precision (AP) (Schioppa et al., 2022), and F1 score (Cai, 2024). For this evaluation protocol, the experiment setting is primarily designed for traditional classification settings rather than generative ones. Therefore, we omit a detailed coverage in Table 17.

**Limitations.** Despite the practical appeal, several important limitations should be noted:

* **Dependence on high-quality validation set:** Data selection and cleaning rely on the existence of a reliable validation dataset to serve as a proxy for measuring attribution effectiveness. However, constructing such a dataset is often non-trivial or infeasible in many real-world settings.

* **Limited generality of mislabeled data detection.** Although *mislabeled data detection* is a widely studied task, spanning gradient-based (Koh and Liang, 2017; Pruthi et al., 2020; Schioppa et al., 2022), data Shapley-based (Wang et al., 2024d; Kwon and Zou, 2022; Wang and Jia, 2023a; Li and Yu, 2023; Kwon and Zou, 2023), and more recent approaches (Zhou et al., 2024; Ko et al., 2024; Just et al., 2023; Bejan et al., 2023), its relevance to evaluating data attribution methods remains questionable. These methods often rely on *self-influence* scores, ignoring the relative ranking across the dataset, which contradicts key principles of attribution evaluation.

**Generative model settings.** We summarize how the *data-selection evaluation* protocol is specifically instantiated for large language models and diffusion models.

* **Language models:** Due to the scale of modern LLMs, the gold-standard of full pre-training on a selected subset is practically impossible. As a result, most studies resort to continued pre-training of a fixed checkpoint or fine-tuning on a pruned corpus. This introduces a systematic mismatch: performance gains (or losses) observed under light fine-tuning may not extrapolate to those achievable via full-scale training, undermining the fidelity of the evaluation. Moreover, if the chosen performance oracle fails to capture the intended LLM capability, attribution-guided selection can lead to misleading conclusions about a TDA method's effectiveness.

* **Diffusion models:** In vision-generative settings, stochastic sampling and guidance-scale sensitivity introduce substantial noise into fidelity and alignment metrics. Thus, attribution scores can misrepresent an image's true utility and produce unstable evaluation signals. These issues are amplified in text-conditioned diffusion: image-caption pairs form joint representations, meaning that pruning based on single-modality influence can degrade the complementary modality's fidelity results toward high-frequency patterns.
<table><caption>Table 17: Representative experiment settings with data selection.</caption><thead><tr><th>Reference</th><th>Models</th><th>Datasets</th><th>Metrics</th><th>Task</th></tr></thead><tbody><tr><td colspan="5"><strong>Language Models</strong></td></tr><tr><td>Wang et al. (2025b)</td><td>GPT-2 small (Radford et al., 2019)<br>Pythia-410M (Biderman et al., 2023)</td><td>Wikitext (Merity et al., 2017),<br>Pile (Gao et al., 2020)</td><td>Accuracy</td><td>Pre-train</td></tr><tr><td>Yu et al. (2024)</td><td>Pythia-410M/1B (Gao et al., 2020)</td><td>C4 (Raffel et al., 2020)</td><td>Accuracy</td><td>Pre-train</td></tr><tr><td>Thakkar et al. (2023)</td><td>mT5-base/large (Xue et al., 2021)</td><td>C4 (Raffel et al., 2020)</td><td>F1, Accuracy</td><td>Pre-train</td></tr><tr><td>Jiao et al. (2025)</td><td>Pythia-1B (Biderman et al., 2023),<br>Llama-3.2-3B (Dubey et al., 2024)</td><td>Alpaca (Taori et al., 2023),<br>K-Means-100 (Li et al., 2024c)</td><td>Accuracy</td><td>Fine-tune</td></tr><tr><td>Wang et al. (2024e)</td><td>Llama-2-7B (Touvron et al., 2023b),<br>Llama-3.2-3B (Dubey et al., 2024),<br>Mistral-7B (Jiang et al., 2023),<br>GPT-2 small (Radford et al., 2019)</td><td>LESS data (Xia et al., 2024),<br>Alpaca (Taori et al., 2023),<br>OpenWebText (Gokaslan and Cohen, 2019)</td><td>Accuracy,<br>Perplexity</td><td>Fine-tune</td></tr><tr><td>Xia et al. (2024)</td><td>Llama-2-7B/13B (Touvron et al., 2023b),<br>Mistral-7B (Jiang et al., 2023)</td><td>MMLU (Hendrycks et al., 2021),<br>TyDi QA (Clark et al., 2020),<br>BIG-Bench Hard (Suzgun et al., 2023)</td><td>Accuracy</td><td>Fine-tune</td></tr><tr><td>San Joaquin et al. (2024)</td><td>Mistral-7B (Jiang et al., 2023),<br>Gemma-2B (Team et al., 2024)</td><td>MMLU (Hendrycks et al., 2021),<br>Ultrachat (Ding et al., 2023)</td><td>Accuracy,<br>Perplexity</td><td>Fine-tune</td></tr><tr><td colspan="5"><strong>Vision-Language Models</strong></td></tr><tr><td>Zhou et al. (2024)</td><td>Llava (Liu et al., 2023)</td><td>Prismatic VLMs instructions (Karamcheti et al., 2024)</td><td>Accuracy</td><td>Pre-train</td></tr><tr><td>Liu et al. (2024b)</td><td>Llava-1.5-7B/13B (Liu et al., 2024a)</td><td>LLaVA-1.5 instructions (Liu et al., 2024a),<br>SVIT-Mix (Zhao et al., 2023),<br>Mini-Gemini (Li et al., 2024b)</td><td>Accuracy</td><td>Fine-tune</td></tr><tr><td colspan="5"><strong>Diffusion Models</strong></td></tr><tr><td>Xie et al. (2024a)</td><td>DDIM (Song et al., 2021a)</td><td>MNIST (LeCun et al., 1998),<br>CIFAR-10 (Krizhevsky, 2009)</td><td>Precision</td><td>Mislabeled</td></tr></tbody></table>

### 4.2.2 Fact Tracing and Concept Probing

For these two applications, researchers primarily assess whether a data attribution method can successfully retrieve a predefined set of training examples that represent specific *facts* or *concepts*. The goal is to determine whether high- or low-scoring training samples align with known positively or negatively influential examples. These may include fact-providing instances or erroneous and harmful samples in a poisoned dataset. Representative experiment settings are summarized in Table 18.

**Fact tracing.** The goal of fact tracing (Park et al., 2023; Akyürek et al., 2022; Ko et al., 2024) is to evaluate whether a data attribution method can accurately identify the "ground-truth" training examples that served as factual sources for a given test prediction. A closely related task is *hallucination tracing*, which aims to attribute targeted hallucinations in model outputs back to perturbed or misleading training examples (Wu et al., 2024b; Lin et al., 2024b). Fact tracing is typically framed as a retrieval task. Its effectiveness is measured using standard ranking metrics such as Mean Reciprocal Rank (MRR) (Park et al., 2023; Liu and Yang, 2024; Chang et al., 2025) and Recall@k (Akyürek et al., 2022; Chang et al., 2025; Wu et al., 2024b). MRR evaluates the rank position of the first correctly identified ground-truth fact, assigning higher scores when relevant examples appear closer to the top while Recall@k measures the proportion of test instances for which the true fact appears among the top-k most attributed training examples.

**Tail-patch.** In contrast to traditional retrieval-based metrics, which often assume that the top-k retrieved samples contain the target fact, Chang et al. (2025) propose *tail-patch* as a more direct evaluation strategy that incorporates model influence. Specifically, this evaluation method takes one additional training step using a single top-ranked training example (retrieved based on attribution scores) from the final model checkpoint, and measures the change in the predicted probability of the target test sample. This directly quantifies the causal impact of each retrieved example on the model's behavior.

**Attribution by customization.** Wang et al. (2023b) introduce a novel evaluation framework called *Attribution by Customization* (AbC) for text-to-image models. AbC involves fine-tuning a pre-trained diffusion model on a single or a set of exemplar images. It extends the concept of fact tracing by treating exemplar images as ground-truth facts and evaluating whether the generated outputs can be correctly attributed back to these sources. Similar to other retrieval-based evaluations, AbC employs metrics such as Recall@k and mean average precision (mAP) to assess attribution performance. Wang et al. (2024h) and Brokman et al. (2024) also follow this setting to evaluate their attribution methods on diffusion models.
**Concept probing.** In contrast to fact tracing, which is relatively straightforward to define ground-truth labels for training samples, concept probing presents additional challenges due to the vague and context-dependent nature of what constitutes a "concept." The definition of a concept often varies depending on the task and use case. For language modeling, one notable scenario is in the context of multilingual language models where the goal is to investigate how training data in one language influences performance in another. Here, concept of a specific training data can be explicitly defined as its corresponding language (Choenni et al., 2023, 2024a). The evaluation metric is termed *Top-k Contribution*, which refers to the average percentage of training samples from each fine-tuning language that contributed to the top-k training samples for a test language. For diffusion models, Brokman et al. (2024) uses the *CustomConcepts101* dataset (Kumari et al., 2023), which is a benchmark dataset encompassing various concepts and their corresponding textual prompts. Similarly, Kwon et al. (2024); Brokman et al. (2024) build customized text-to-image datasets with ground-truth concepts to evaluate their proposed methods.

**Limitations.** For fact tracing applications, the main limitation lies in the acquisition of high-quality ground-truth fact defined in the training data. This is also reflected by the scarcity of the available dataset used to test the attribution methods dedicated to solve these two applications. For example, FTRACE-TREx (Akyürek et al., 2022) and its variant (Akyürek et al., 2022; Chang et al., 2025) are the only golden-standard datasets for the fact tracing evaluation (Ko et al., 2024; Wu et al., 2024b; Park et al., 2023).

**Generative model settings.** We describe how fact tracing and concept probing are adapted and evaluated in two major classes of generative models, namely language models and diffusion models, as follows.

* **Language models:** In this setting, language models are fine-tuned on a fact tracing dataset consisting of abstracts and their corresponding facts, using a masked language modeling (MLM) objective. Since MLM involves predicting masked tokens from a fixed vocabulary, the task naturally aligns with a v-way classification problem, where v is the vocabulary size. As discussed in TRAK (Park et al., 2023), this framing enables the application of data attribution methods originally developed for multi-class classification tasks.

* **Diffusion models:** For image generation models, fact tracing and concept probing are often referred to as *image tracing*, where the goal is to identify specific training images that contribute to the generation of a given output. These images may share common *styles*, *subjects*, or *categories*. For instance, Xie et al. (2024a) construct a synthetic dataset by mixing MNIST (LeCun et al., 1998) and CIFAR-10 (Krizhevsky et al., 2010), and train a diffusion model on this combined set. For each test sample, they compute the proportion of correctly attributed training examples among the top-k influential samples as the evaluation metric.

<table><caption>Table 18: Representative experiment settings with fact tracing and concept probing.</caption><thead><tr><th>Reference</th><th>Models</th><th>Datasets</th><th>Metrics</th><th>Task</th></tr></thead><tbody><tr><td colspan="5"><strong>Language Models</strong></td></tr><tr><td>Akyürek et al. (2022)<br>Ko et al. (2024)</td><td>mT5-base (Xue et al., 2021)</td><td>FTRACE-TREx (Akyürek et al., 2022)</td><td>MRR, Recall,<br>Precision</td><td>Fact Tracing</td></tr><tr><td>Park et al. (2023)<br>Liu and Yang (2024)</td><td>mT5-small (Xue et al., 2021)</td><td>FTRACE-TREx (Akyürek et al., 2022)</td><td>MRR</td><td>Fact Tracing</td></tr><tr><td>Lin et al. (2024b)</td><td>Llama-2-7B/70B (Touvron et al., 2023b)</td><td>Alpaca Taori et al. (2023)</td><td>Precision</td><td>Fact Tracing</td></tr><tr><td>Chang et al. (2025)</td><td>PALM-154M/1B/8B (Chowdhery et al., 2023)</td><td>T-REx (Elsahar et al., 2018),<br>C4 (Raffel et al., 2020)</td><td>Tail-Patch,<br>MRR, Recall</td><td>Fact Tracing</td></tr><tr><td>Choenni et al. (2024a)</td><td>mT5-small/base/large (Xue et al., 2021)</td><td>PBC (Christodoulopoulos and Steedman, 2015),<br>Tanzil (Tiedemann, 2012)</td><td>Top-100<br>Contribution</td><td>Concept Probing</td></tr><tr><td>Choenni et al. (2023)</td><td>XLM-R Base (Xue et al., 2021)</td><td>XNLI (Conneau et al., 2018),<br>PAWS-X (Yang et al., 2019),<br>MARC (Keung et al., 2020)</td><td>Top-100<br>Contribution</td><td>Concept Probing</td></tr><tr><td>Choenni et al. (2024b)</td><td>XLM-R Base (Xue et al., 2021)</td><td>XNLI (Conneau et al., 2018),<br>PAWS-X (Yang et al., 2019),<br>MARC (Keung et al., 2020)</td><td>Accuracy</td><td>Concept Probing</td></tr><tr><td colspan="5"><strong>Diffusion Models</strong></td></tr><tr><td>Xie et al. (2024a)</td><td>DDIM (Song et al., 2021a)</td><td>MNIST (LeCun et al., 1998),<br>CIFAR-10 (Krizhevsky, 2009)</td><td>Precision</td><td>Fact Tracing</td></tr><tr><td>Brokman et al. (2024)</td><td>Stable Diffusion (Rombach et al., 2022)</td><td>CustomConcepts101 (Kumari et al., 2023),<br>Archive (Harden, Accessed 2025)</td><td>Recall, Precision,<br>Spearman Corr.</td><td>Concept Probing,<br>AbC</td></tr><tr><td>Wang et al. (2023b)<br>Wang et al. (2024h)</td><td>DINO (Caron et al., 2021),<br>CLIP (Radford et al., 2021)</td><td>LAION (Schuhmann et al., 2022)</td><td>Recall, mAP</td><td>AbC</td></tr></tbody></table>
### 4.2.3 Adversarial Attack and Defense

Evaluation of adversarial attack/defense application involves deliberately perturbing or poisoning the training data, and measuring how effectively data attribution methods can identify these (negatively) influential samples. For instance, Lin et al. (2024b); Xie et al. (2024b) construct poisoned dataset and apply attribution methods to locate the injected harmful data samples. Detection performance is typically quantified using metrics like Area Under the Precision-Recall Curve (AUPRC) and Area Under the Receiver Operator Characteristic Curve (AUROC) (Xie et al., 2024b; Lin et al., 2024b). On the defense side, evaluation methods can also assess how attribution methods help mitigate harmful impacts by guiding model fine-tuning or data selection processes. For example, studies (Choe et al., 2024; Barshan et al., 2020) study model responses to fine-tuning on harmful data and evaluate improvements using safety-oriented metrics, such as Attack Success Rate (ASR) and output loss reduction. The notable experiment settings with adversarial attack/defense are summarized in Table 19.

<table><caption>Table 19: Representative experiment settings with adversarial attack/defense.</caption><thead><tr><th>Reference</th><th>Models</th><th>Datasets</th><th>Metrics</th><th>Task</th></tr></thead><tbody><tr><td colspan="5"><strong>Language Models</strong></td></tr><tr><td>He et al. (2024)</td><td>Llama-2-7B/13B-Chat (Touvron et al., 2023b),<br>Llama-3-8B-Chat (Dubey et al., 2024),<br>Gemma-7B-Instruct (Team et al., 2024)</td><td>Alpaca (Taori et al., 2023),<br>Dolly (Conover et al., 2023)</td><td>GPT score, GPT ASR,<br>ASR increase</td><td>Attack</td></tr><tr><td>Lin et al. (2024b)</td><td>Llama-2-7B/70B (Touvron et al., 2023a)</td><td>Poisoned Alpaca (Taori et al., 2023)</td><td>AUPRC, AUROC</td><td>Attack</td></tr><tr><td>He et al. (2024)</td><td>Llama-2-7B-Chat (Touvron et al., 2023b)</td><td>Alpaca (Taori et al., 2023),<br>Dolly (Conover et al., 2023)</td><td>ASR reduction</td><td>Defense</td></tr><tr><td>Xie et al. (2024b)</td><td>Llama-2-7B (Touvron et al., 2023a)</td><td>ToxicChat (Lin et al., 2023),<br>XSTest (Röttger et al., 2024)</td><td>AUPRC, F1,<br>Precision, Recall</td><td>Defense</td></tr></tbody></table>

### 4.3 Computational Costs

Parallel to the evaluation on the effectiveness of data attribution methods, time/memory efficiency metrics such as *runtime* (Lin et al., 2024b; Wang et al., 2024h; Koh et al., 2024; Yu et al., 2024; Wang et al., 2024e; Brokman et al., 2024; Kwon et al., 2024; Ko et al., 2024; Schioppa et al., 2022; Yang et al., 2025; Kwon and Zou, 2023; Wang et al., 2024g), *throughput* (Wang et al., 2024e, 2025b), *memory storage* (Wang et al., 2025b; Lin et al., 2024b; Xia et al., 2024) and *peak GPU memory consumption* (Koh et al., 2024; Deng et al., 2024a; Wang et al., 2025b) are all commonly appeared in the data attribution literature.

### 4.4 Other Evaluation Criteria

**Loss curve fitness.** For simulator methods (Guu et al., 2023; Chai et al., 2024), the evaluation metrics test the ability to predict the entire training loss trajectory and the final training loss. Thus, the mean squared error (MSE) aggregated throughout the loss trajectory and the correlation coefficient between the true final-step training loss and the predicted one are the main metric (Guu et al., 2023; Chai et al., 2024; Yoon et al., 2020).

### 4.5 Suggestions for Future Evaluations

To address existing limitations of evaluation paradigms for data attribution methods, the following directions can be considered when proposing new evaluation protocols in the future:

#### 4.5.1 Beyond Multi-model Training

According to the previous section, data attribution methods across various models trained on counterfactual datasets can provide a more comprehensive understanding of data influence. However, training multiple models is computationally expensive, which is involved in the computation of LOO influence and LDS.

**Recommendation.** To reduce the computational burden of multi-model training while still capturing the ability of data attribution to predict counterfactuals, future evaluation protocols should explore scalable approximations to evaluate large generative models. For example, researchers can investigate surrogate modeling to reduce model size or ensemble approximation techniques to cut down number of re-trained models needed. These approaches could help preserve the quality of attribution assessments while significantly lowering computational costs, especially when dealing with large generative language and diffusion models.
### 4.5.2 Attribution Scores as Distributions

For the first time, Nguyen et al. (2023) introduces a Bayesian formulation of training data attribution. Rather than treating a trained deep model as a fixed entity, the paper embraces the inherent randomness during model training by considering the resulting model as a sample from a posterior distribution. The paper also offers the following key insights: (i) *noise dominance*: the variance in the data attribution scores can be larger than their average influences and thus mean estimates might be misleading, (ii) *score reliability*: for each pair of training-test data, only those with substantial signal out-weighting the noise can be deemed reliable, and (iii) *inaccurate evaluation*: stand metrics like Pearson or Spearman correlation coefficients (Pearson, 1895; Spearman, 1904) may fail when the uncertainty is ignored during the data attribution score comparison.

**Recommendation.** Based on the observation aforementioned, we can conclude that analyzing the standard deviation and other statistical properties of the data attribution scores can reveal the consistency and reliability of the attributions. We encourage the development of evaluation methods that account for the inherent variability in model training and data sampling processes, together with more nuanced evaluation metrics that are independent of the internal variances.

### 4.5.3 Benchmark Suite with Standardized Settings

Establishing a comprehensive benchmark suite that includes a series of downstream applications with standardized settings, including fixed combinations of models, datasets, and evaluation metrics, would facilitate consistent and fair comparisons of data attribution methods. Recent efforts, such as the development of the *dattri* library developed by Deng et al. (2025), have aimed to provide unified APIs and benchmark frameworks to streamline the evaluation process. Moreover, the suite must cover the full spectrum of generative model classes, including relatively modern large language models and diffusion models, so that attribution methods can be evaluated under consistent, real-world settings. Such a standardized, transparent framework will accelerate methodological progress and build confidence in attribution techniques across diverse use cases.

**Recommendation.** For future TDA research, we recommend including LDS evaluation alongside downstream applications such as data selection experiments (fine-tuning on or without selected influential subsets) and explicit reporting of computational cost (GPU-hours, memory storage and peak GPU memory consumption).

## 5 The Scope of the Survey

**Scope.** This survey focuses on data attribution in modern machine learning, with a particular emphasis on generative AI. Prior to this work, there was only one survey dedicated to the topic of data attribution (Hammoudeh and Lowd, 2024)<fnref n="20" />, yet their focus was on conventional machine learning models and did not cover recent state-of-the-art development. We also note that while the concept of data attribution has historical roots in fields such as statistics and econometrics (e.g., robust statistics (Huber and Ronchetti, 2009), regression diagnostics (Belsley et al., 2005), and game-theoretic Shapley values (Shapley, 1953)), these antecedents fall outside the scope of this survey.

Our coverage of data attribution methods (Section 2) is guided by two key criteria: broad representation of major data attribution paradigms and their (potential) applicability to generative AI models. Notably, although weighted marginal contribution methods (Section 2.3) are often computationally infeasible for generative AI due to repeated retraining, we provide a comprehensive overview given their central role in the data attribution literature and the lack of systematic treatment in existing surveys (Hammoudeh and Lowd, 2024). Our discussion of applications (Section 3) centers on generative AI but also includes scenarios in conventional machine learning (e.g., adversarial attack and defense in Section 3.3) where applications in generative AI are currently limited but transferable in principle.

The systematic literature search for this version of survey paper was conducted in March 2025²¹ and focused on influential and peer-reviewed studies related to data attribution with a particular focus on generative AI. The process began with approximately 40 seed papers selected based on their topical relevance. We then employed a snowball sampling strategy to expand the literature list by including papers cited by or citing the initial seed papers. To ensure quality, we filter the papers with proxy criteria based on their publication status and citation count: papers were included only if they were published in peer-reviewed journals or conferences, or if they were well-cited, defined as having a citation count greater than or equal to the number of months since the paper's first preprint became available online.

<footnote n="20">²⁰They refer the field as “training data influence analysis”, while the term “data attribution” has become more standard recently.
²¹We have planned an updated literature search to be included in the next version of this survey paper.</footnote>
**Related topics.** We briefly discuss the distinction between data attribution and some closely related topics to better
clarify the scope of this survey paper.

1. **Data monetization.** *Data monetization*, sometimes also referred to as “data valuation” (Fleckenstein et al., 2023), focuses on deriving economic benefits from data (Najjar and Kettinger, 2013; Faroukhi et al., 2020). In contrast, data valuation or data attribution as named in this survey paper typically emphasizes the contribution of individual data points or subsets to a model’s behavior with various applications, rather than directly assigning a market price. While these concepts are related, such data attribution scores may serve as a prerequisite for monetization but do not necessarily involve commercialization, we have some discussion about this in Section 3.4.

2. **Membership inference attacks.** *Membership inference attack* (MIA) aims to determine whether a specific data sample was included in the training set of a given model (Shokri et al., 2017; Salem et al., 2019; Parisot et al., 2021; Hu et al., 2022b). Such attacks are widely used to estimate the privacy risks of machine learning systems, particularly in sensitive application domains such as medical records or personal user data (Shokri et al., 2017; Truex et al., 2019). While both MIA and data attribution examine the relationship between a model and its training data, their objectives and assumptions differ. MIA focuses on a binary classification problem—inferring whether a given sample was included in the training set. In contrast, data attribution methods aim to quantify the influence of individual training points on model predictions (Koh and Liang, 2017), typically under the assumption that the full training set is known or accessible. Despite these differences, both approaches leverage signals from models (e.g., prediction confidence, gradients, or loss) and share methodological overlaps, which are discussed in Section 3.3.4.

3. **Machine unlearning.** *Machine unlearning*, which focuses on removing the influence of specific training data from a trained model, often to comply with data removal requests such as those mandated by the “right to be forgotten” (Cao and Yang, 2015; Ginart et al., 2019; Neel et al., 2021). Unlike data attribution, which typically does not modify a machine learning model, machine unlearning aims to *reverse* the model so it behaves as if the target data sample had never been used for training. Existing approaches range from exact retraining to approximate strategies like certified removal guarantees (Golatkar et al., 2020; Bourtoule et al., 2021). Both areas benefit from a sample-level understanding of data and model interactions, and in recent years, the advances of data attribution methods and machine unlearning methods are shown to improve each other, which is discussed in Section 2.6.1.

4. **Differential privacy.** *Differential privacy* (DP) (Dwork and Roth, 2014; Abadi et al., 2016) is a mathematical framework that limits what an adversary can infer about any single training example from an algorithm's output, and has been widely adopted in deep learning (De et al., 2022; Yu et al., 2022; Hu et al., 2024b). Unlike data attribution, which seeks to quantify individual data influence, DP aims to cap it through randomization. Despite this difference in goals, both operate at the level of individual samples and thus share methodological similarities. For example, per-example gradients are central to both: in data attribution, they estimate sample influence; in DP, they are clipped to bound it. The ghost dot-product technique in Section 2.4.1 is one such crossover, adapted from the ghost clipping method (Li et al., 2022) originally developed for DP.

# 6 The Future of Data Attribution in GenAI

Looking ahead, this section presents a research agenda for data attribution in the era of Generative AI, outlining
key directions intended to guide future work. We delineate our vision for data attribution within this transformative
landscape, identifying the most impactful challenges and opportunities ahead. These points are designed to serve as
both a practical blueprint for concrete research endeavors and a northstar to orient the field towards realizing its full
potential.

1. **Scale as a central consideration in data attribution for GenAI.** The defining characteristic of state-of-the-art GenAI is its operation at scales previously unimaginable—billions of parameters trained on petabytes of data. Scale is not merely a technical hurdle for data attribution methods; it fundamentally shapes the problem itself, influencing model behavior, data interactions, and computational feasibility. Therefore, a **scale-aware mindset** must permeate all research in GenAI attribution. This imperative translates into several interconnected research thrusts, including: (1) Development of scalable attribution methods (Wang et al., 2025a; Chang et al., 2025); (2) Studying the scaling properties of data influence (Covert et al., 2024); and (3) Leveraging cross-scale insights (especially small-to-large) (Kang et al., 2024; Yang et al., 2024; Khaddaj et al., 2025).

2. **Data attribution for GenAI's diverse data & paradigms.** GenAI models are characterized by the heterogeneity of their training data—spanning diverse modalities (text, image, video), sources (massive
web scrapes, curated datasets, synthetic data), and types (raw data, human preferences). Furthermore, their
development involves complex multi-stage processes incorporating various learning paradigms (pre-training,
supervised fine-tuning, RLHF). Data attribution must evolve to handle this multifaceted landscape. This
requires developing attribution strategies capable of: (1) Handling diverse data modalities; (2) Adapting to
more sophisticated learning paradigms, such as RL and RLHF (Hu et al., 2025); (3) Understanding cumulative
impact across multi-stage training (e.g., the development of frontier LLMs is a continual effort, and often
times we want to answer the following question: "*how much value does this new data point / data source add
to the existing model?*"); and (4) Accounting for the usage of synthetic data.

3. **Data attribution as a foundational tool for interpreting and governing responsible GenAI.** Data attribution serves as a critical lens for peering into the opaque nature of large generative models, providing essential interpretability and debugging capabilities. While data attribution has a history in traditional machine learning, GenAI's unique complexity, emergent behaviors, and challenging failure modes significantly elevate its importance. It provides actionable insights into key concerns for responsible AI, including identifying data sources of bias, uncovering potential privacy leaks through memorization, tracing the origins of safety failures, and understanding intellectual property issues related to training data (e.g., copyright violations). By establishing a crucial link between model behavior and its training data, data attribution moves beyond being a purely technical tool to become an essential pillar for building and governing responsible AI systems, providing the transparency needed for ethical deployment and regulatory compliance.

4. **Shift towards proactive and dynamic attribution.** Moving data attribution from a purely *post-hoc* analysis to a more proactive and dynamic process integrated into the GenAI development lifecycle is crucial for efficiency, control, and continuous improvement. We encourage the field to explore methods that perform attribution during training to guide data sampling, weighting, or filtering in real-time. This enables early problem detection and more efficient use of massive datasets Coalson et al. (2025).

5. **Establish rigorous evaluation and standardized benchmarks for GenAI attribution.** To measure algorithmic advancement and ensure the practical utility of data attribution methods for GenAI, the field must move towards more application-oriented, challenging, and rigorous evaluation. This involves several key steps: (1) Quantifying the direct impact and effectiveness of attribution methods on crucial downstream GenAI applications, shifting focus from correlation analysis based on LOO and LDS (which can sometimes be misleading or easily “fooled”); (2) Establishing application-oriented benchmarks that capture the complexity, scale, and unique data/model characteristics of GenAI, going beyond simple tasks like mislabeled data detection; and (3) Standardizing evaluation protocols, defining clear and reproducible procedures within these benchmarks (e.g., use ensembles or multiple runs to mitigate noise in the evaluation process).

6. **Synergy between data attribution and other interpretability methods.** Combining insights from data attribution (understanding data-model relationships) with other interpretability techniques such as mechanistic interpretability (Elhage et al., 2021; Sharkey et al., 2025) (understanding model internals) offers a powerful path towards achieving truly comprehensive understanding, control, and improved development of GenAI models (Zhang et al., 2025c; Cohen-Wang et al., 2025; Hua et al., 2025).
References

Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In *Proceedings of the 2016 ACM SIGSAC conference on computer and communications security*, pages 308–318, 2016.

Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. *arXiv preprint arXiv:2303.08774*, 2023.

Naman Agarwal, Brian Bullins, and Elad Hazan. Second-order stochastic optimization for machine learning in linear time. *Journal of Machine Learning Research*, 18(116):1–40, 2017.

Ekin Akyürek, Tolga Bolukbasi, Frederick Liu, Binbin Xiong, Ian Tenney, Jacob Andreas, and Kelvin Guu. Towards tracing knowledge in language models back to the training data. In *Findings of the Association for Computational Linguistics: EMNLP 2022*, pages 2429–2446, 2022.

Alon Albalak, Yanai Elazar, Sang Michael Xie, Shayne Longpre, Nathan Lambert, Xinyi Wang, Niklas Muennighoff, Bairu Hou, Liangming Pan, Haewon Jeong, Colin Raffel, Shiyu Chang, Tatsunori Hashimoto, and William Yang Wang. A survey on data selection for language models. *Transactions on Machine Learning Research*, 2024. ISSN 2835-8856. URL https://openreview.net/forum?id=XfHWcNTSHp. Survey Certification.

Walter Edwin Arnoldi. The principle of minimized iterations in the solution of the matrix eigenvalue problem. *Quarterly of applied mathematics*, 9(1):17–29, 1951.

Sanjeev Arora, Simon Du, Wei Hu, Zhiyuan Li, and Ruosong Wang. Fine-grained analysis of optimization and generalization for overparameterized two-layer neural networks. In *International conference on machine learning*, pages 322–332. PMLR, 2019.

Imanol Arrieta-Ibarra, Leonard Goff, Diego Jiménez-Hernández, Jaron Lanier, and E Glen Weyl. Should we treat data as labor? moving beyond “free”. In *AEA Papers and Proceedings*, volume 108, pages 38–42. American Economic Association 2014 Broadway, Suite 305, Nashville, TN 37203, 2018.

Lars Backstrom and Jure Leskovec. Supervised random walks: predicting and recommending links in social networks. In *Proceedings of the fourth ACM international conference on Web search and data mining*, pages 635–644, 2011.

Juhan Bae, Nathan Ng, Alston Lo, Marzyeh Ghassemi, and Roger B Grosse. If influence functions are the answer, then what is the question? *Advances in Neural Information Processing Systems*, 35:17953–17967, 2022.

Juhan Bae, Wu Lin, Jonathan Lorraine, and Roger Baker Grosse. Training data attribution via approximate unrolling. In *The Thirty-eighth Annual Conference on Neural Information Processing Systems*, 2024. URL https://openreview.net/forum?id=3NaqGg92KZ.

John F Banzhaf III. Weighted voting doesn't work: A mathematical analysis. *Rutgers L. Rev.*, 19:317, 1964.

Elnaz Barshan, Marc-Etienne Brunet, and Gintare Karolina Dziugaite. Relatif: Identifying explanatory training samples via relative influence. In Silvia Chiappa and Roberto Calandra, editors, *Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics*, volume 108 of *Proceedings of Machine Learning Research*, pages 1899–1909. PMLR, 26–28 Aug 2020. URL https://proceedings.mlr.press/v108/barshan20a.html.

MS Bartlett. Approximate confidence intervals. *Biometrika*, 40(1/2):12–19, 1953.

Samyadeep Basu, Xuchen You, and Soheil Feizi. On second-order group influence functions for black-box predictions. In *International Conference on Machine Learning*, pages 715–724. PMLR, 2020.

Samyadeep Basu, Phil Pope, and Soheil Feizi. Influence functions in deep learning are fragile. In *International Conference on Learning Representations*, 2021. URL https://openreview.net/forum?id=xHKVVHGDOEk.

Irina Bejan, Artem Sokolov, and Katja Filippova. Make every example count: On the stability and utility of self-influence for learning from noisy NLP datasets. In *Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing*, pages 10107–10121, Singapore, December 2023. Association for Computational Linguistics.

David A Belsley, Edwin Kuh, and Roy E Welsch. *Regression diagnostics: Identifying influential data and sources of collinearity*. John Wiley & Sons, 2005.

Alberto Bernacchia, Mate Lengyel, and Guillaume Hennequin. Exact natural gradient in deep linear networks and its application to the nonlinear case. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, *Advances in Neural Information Processing Systems*, volume 31. Curran Associates, Inc., 2018. URL https://proceedings.neurips.cc/paper_files/paper/2018/file/7f018eb7b301a66658931cb8a93fd6e8-Paper.pdf.
Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Rottger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions. In *The Twelfth International Conference on Learning Representations*, 2024.

Stella Biderman, Hailey Schoelkopf, Quentin Anthony, Herbie Bradley, Kyle O'Brien, Eric Hallahan, Mohammad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, Aviya Skowron, Lintang Sutawika, and Oskar van der Wal. Pythia: A suite for analyzing large language models across training and scaling. In *International Conference on Machine Learning*, pages 2397–2430. PMLR, 2023.

Bernd Bohnet, Vinh Q. Tran, Pat Verga, Roee Aharoni, Daniel Andor, Livio Baldini Soares, Jacob Eisenstein, Kuzman Ganchev, Jonathan Herzig, Kai Hui, Tom Kwiatkowski, Ji Ma, Jianmo Ni, Tal Schuster, William W. Cohen, Michael Collins, Dipanjan Das, Donald Metzler, Slav Petrov, and Kellie Webster. Attributed question answering: Evaluation and modeling for attributed large language models. *arXiv preprint arXiv:2212.08037*, 2022.

Lucas Bourtoule, Varun Chandrasekaran, Christopher A Choquette-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In *2021 IEEE symposium on security and privacy (SP)*, pages 141–159. IEEE, 2021.

Tamara Broderick, Ryan Giordano, and Rachael Meager. An automatic finite-sample robustness metric: when can dropping a little data make a big difference? *arXiv preprint arXiv:2011.14999*, 2020.

Carla E Brodley and Mark A Friedl. Identifying mislabeled training data. *Journal of artificial intelligence research*, 11: 131–167, 1999.

Jonathan Brokman, Omer Hofman, Roman Vainshtein, Amit Giloni, Toshiya Shimizu, Inderjeet Singh, Oren Rachmil, Alon Zolfi, Asaf Shabtai, Yuki Unno, and Hisashi Kojima. Montrage: Monitoring training for attribution of generative diffusion models. In *European Conference on Computer Vision*, pages 1–17. Springer, 2024.

Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, T. J. Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeff Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Ma teusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners. *Advances in neural information processing systems*, 33:1877–1901, 2020.

Marc-Etienne Brunet, Colleen Alkalay-Houlihan, Ashton Anderson, and Richard Zemel. Understanding the origins of bias in word embeddings. In *International conference on machine learning*, pages 803–811. PMLR, 2019.

Huaiguang Cai. Chg shapley: Efficient data valuation and selection towards trustworthy machine learning, 2024. URL https://arxiv.org/abs/2406.11730.

Aylin Caliskan, Joanna J Bryson, and Arvind Narayanan. Semantics derived automatically from language corpora contain human-like biases. *Science*, 356(6334):183–186, 2017.

Bochuan Cao, Yuanpu Cao, Lu Lin, and Jinghui Chen. Defending against alignment-breaking attacks via robustly aligned llm. In *62nd Annual Meeting of the Association for Computational Linguistics, ACL 2024*, pages 10542–10560. Association for Computational Linguistics (ACL), 2024a.

Yihan Cao, Yanbin Kang, Chi Wang, and Lichao Sun. Instruction mining: Instruction data selection for tuning large language models. In *First Conference on Language Modeling*, 2024b. URL https://openreview.net/forum?id=wF6k0aWjAu.

Yinzhi Cao and Junfeng Yang. Towards making systems forget with machine unlearning. In *2015 IEEE symposium on security and privacy*, pages 463–480. IEEE, 2015.

Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B. Brown, Dawn Xiaodong Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. Extracting training data from large language models. In *30th USENIX Security Symposium (USENIX Security 21)*, pages 2633–2650, 2021.

Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In *Proceedings of the IEEE/CVF international conference on computer vision*, pages 9650–9660, 2021.

Javier Castro, Daniel Gómez, and Juan Tejada. Polynomial calculation of the shapley value based on sampling. *Computers & operations research*, 36(5):1726–1730, 2009.

Yekun Chai, Qingyi Liu, Shuohuan Wang, Yu Sun, Qiwei Peng, and Hua Wu. On training data influence of gpt models. In *Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing*, pages 3126–3150, Miami, Florida, USA, November 2024. Association for Computational Linguistics. doi:10.18653/v1/2024.emnlp-main.183. URL https://aclanthology.org/2024.emnlp-main.183/.
Tyler A. Chang, Dheeraj Rajagopal, Tolga Bolukbasi, Lucas Dixon, and Ian Tenney. Scalable influence and fact tracing for large language model pretraining. In *The Thirteenth International Conference on Learning Representations*, 2025. URL https://openreview.net/forum?id=gLa96F1Wwn.

Guillaume Charpiat, Nicolas Girard, Loris Felardos, and Yuliya Tarabalka. Input similarity from the neural network perspective. *Advances in Neural Information Processing Systems*, 32, 2019.

Yuanyuan Chen, Boyang Li, Han Yu, Pengcheng Wu, and Chunyan Miao. Hydra: Hypergradient data relevance analysis for interpreting deep neural networks. In *Proceedings of the AAAI Conference on Artificial Intelligence*, volume 35, pages 7081–7089, 2021.

Anshuman Chhabra, Bo Li, Jian Chen, Prasant Mohapatra, and Hongfu Liu. Outlier gradient analysis: Efficiently improving deep learning model performance via hessian-free influence functions. *ArXiv*, abs/2405.03869, 2024.

Sang Keun Choe, Hwijeen Ahn, Juhan Bae, Kewen Zhao, Minsoo Kang, Youngseog Chung, Adithya Pratapa, Willie Neiswanger, Emma Strubell, Teruko Mitamura, Jeff G. Schneider, Eduard H. Hovy, Roger B. Grosse, and Eric P. Xing. What is your data worth to gpt? llm-scale data valuation with influence functions. *arXiv preprint arXiv:2405.13954*, 2024.

Rochelle Choenni, Dan Garrette, and Ekaterina Shutova. How do languages influence each other? studying cross-lingual data sharing during lm fine-tuning. In *Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing*, pages 13244–13257, 2023.

Rochelle Choenni, Anne Lauscher, and Ekaterina Shutova. The echoes of multilinguality: Tracing cultural value shifts during language model fine-tuning. In *Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)*, pages 15042–15058, 2024a.

Rochelle Choenni, Ekaterina Shutova, and Dan Garrette. Examining modularity in multilingual lms via language-specialized subnetworks. In *Findings of the Association for Computational Linguistics: NAACL 2024*, pages 287–301, 2024b.

Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways. *Journal of Machine Learning Research*, 24(240):1–113, 2023.

Christos Christodouloupoulos and Mark Steedman. A massively parallel corpus: the bible in 100 languages. *Language resources and evaluation*, 49(2):375–395, 2015.

Yung-Sung Chuang, Benjamin Cohen-Wang, Zejiang Shen, Zhaofeng Wu, Hu Xu, Xi Victoria Lin, James R. Glass, Shang-Wen Li, and Wen tau Yih. Selfcite: Self-supervised alignment for context attribution in large language models. In *Forty-second International Conference on Machine Learning*, 2025.

Jonathan H Clark, Eunsol Choi, Michael Collins, Dan Garrette, Tom Kwiatkowski, Vitaly Nikolaev, and Jennimaria Palomaki. Tydi qa: A benchmark for information-seeking question answering in typologically diverse languages. *Transactions of the Association for Computational Linguistics*, 8:454–470, 2020.

Zachary Coalson, Juhan Bae, Nicholas Carlini, and Sanghyun Hong. If-guide: Influence function-guided detoxification of llms. *arXiv preprint arXiv:2506.01790*, 2025.

Gilad Cohen and Raja Giryes. Membership inference attack using self influence functions. In *Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision*, pages 4892–4901, 2024.

Benjamin Cohen-Wang, Harshay Shah, Kristian Georgiev, and Aleksander Madry. Contextcite: Attributing model generation to context. *Advances in Neural Information Processing Systems*, 37:95764–95807, 2024.

Benjamin Cohen-Wang, Yung-Sung Chuang, and Aleksander Madry. Learning to attribute with attention. *arXiv preprint arXiv:2504.13752*, 2025.

Alexis Conneau, Ruty Rinott, Guillaume Lample, Adina Williams, Samuel Bowman, Holger Schwenk, and Veselin Stoyanov. Xnli: Evaluating cross-lingual sentence representations. In *Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing*, pages 2475–2485, 2018.

Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. Free dolly: Introducing the world's first truly open instruction-tuned llm. URL https://www.databricks.com/blog/2023/04/12/dolly-first-open-commercially-viable-instruction-tuned-llm.

R. Dennis Cook and Sanford Weisberg. *Residuals and Influence in Regression*. Monographs on Statistics and Applied Probability. Chapman and Hall, New York, 1982.

Ian Covert and Su-In Lee. Improving kernelship: Practical shapley value estimation using linear regression. In *International Conference on Artificial Intelligence and Statistics*, pages 3457–3465. PMLR, 2021.
Ian Connick Covert, Wenlong Ji, Tatsunori Hashimoto, and James Zou. Scaling laws for the value of individual data points in machine learning. In *Forty-first International Conference on Machine Learning*, 2024. URL https://openreview.net/forum?id=scSB9RynSd.

Damai Dai, Li Dong, Yaru Hao, Zhifang Sui, Baobao Chang, and Furu Wei. Knowledge neurons in pretrained transformers. *arXiv preprint arXiv:2104.08696*, 2021.

Zheng Dai and David K Gifford. Training data attribution for diffusion models. *arXiv preprint arXiv:2306.02174*, 2023.

Soham De, Leonard Berrada, Jamie Hayes, Samuel L Smith, and Borja Balle. Unlocking high-accuracy differentially private image classification through scale. *arXiv preprint arXiv:2204.13650*, 2022.

Michiel Debruyne, Mia Hubert, and Johan AK Suykens. Model selection in kernel based regression using the influence function. *Journal of machine learning research*, 9:2377-2400, 2008.

Junwei Deng, Ting-Wei Li, Shichang Zhang, and Jiaqi Ma. Efficient ensembles improve training data attribution. *arXiv preprint arXiv:2405.17293*, 2024a.

Junwei Deng, Shiyuan Zhang, and Jiaqi Ma. Computational copyright: Towards a royalty model for music generative ai, 2024b. URL https://arxiv.org/abs/2312.06646.

Junwei Deng, Ting-Wei Li, Shiyuan Zhang, Shixuan Liu, Yijun Pan, Hao Huang, Xinhe Wang, Pingbang Hu, Xingjian Zhang, and Jiaqi Ma. dattr: A library for efficient data attribution. *Advances in Neural Information Processing Systems*, 37:136763-136781, 2025.

Xiaotie Deng and Christos H Papadimitriou. On the complexity of cooperative solution concepts. *Mathematics of operations research*, 19(2):257-266, 1994.

Shizhe Diao, Yu Yang, Yonggan Fu, Xin Dong, Dan Su, Markus Kliegl, Zijia Chen, Peter Belcak, Yoshi Suhara, Hongxu Yin, Mostofa Patwary, Yingyan, Lin, Jan Kautz, and Pavlo Molchanov. Climb: Clustering-based iterative data mixture bootstrapping for language model pre-training, 2025. URL https://arxiv.org/abs/2504.13161.

Thomas G Dietterich. Ensemble methods in machine learning. In *International workshop on multiple classifier systems*, pages 1-15. Springer, 2000.

Meng Ding, Kaiyi Ji, Di Wang, and Jinhui Xu. Understanding forgetting in continual learning with linear regression. In *Forty-first International Conference on Machine Learning*, 2024.

Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. Enhancing chat language models by scaling high-quality instructional conversations. In *Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing*, pages 3029-3051, 2023.

Ding-Zhu Du and Frank Kwang-ming Hwang. *Combinatorial group testing and its applications*, volume 12. World Scientific, 1999.

Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. *arXiv preprint arXiv:2407.21783*, 2024.

Pradeep Dubey and Robert J Weber. Probabilistic values for games. Technical report, Cowles Foundation for Research in Economics, 1977.

Pradeep Dubey, Abraham Neyman, and Robert James Weber. Value theory without efficiency. *Mathematics of Operations Research*, 6(1):122-128, 1981.

Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. *Foundations and trends® in theoretical computer science*, 9(3-4):211-407, 2014.

Carl Eckart and Gale Young. The approximation of one matrix by another of lower rank. *Psychometrika*, 1(3):211-218, Sep 1936. ISSN 1860-0980. doi:10.1007/BF02288367. URL https://doi.org/10.1007/BF02288367.

Naoki Egami and Kosuke Imai. Causal interaction in factorial experiments: Application to conjoint analysis. *Journal of the American Statistical Association*, 2019.

Nelson Elhage, Neel Nanda, Catherine Olsson, Tom Henighan, Nicholas Joseph, Ben Mann, Amanda Askell, Yuntao Bai, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Deep Ganguli, Zac Hatfield-Dodds, Danny Hernandez, Andy Jones, Jackson Kernion, Liane Lovitt, Kamal Ndousse, Dario Amodei, Tom Brown, Jack Clark, Jared Kaplan, Sam McCandlish, and Chris Olah. A mathematical framework for transformer circuits. *Transformer Circuits Thread*, 2021. https://transformer-circuits.pub/2021/framework/index.html.

Hady Elsahar, Pavlos Vougiouklis, Arslen Remaci, Christophe Gravier, Jonathon Hare, Frederique Laforest, and Elena Simperl. T-rex: A large scale alignment of natural language with knowledge base triples. In *Proceedings of the Eleventh International Conference on Language Resources and Evaluation (LREC 2018)*, 2018.
Logan Engstrom, Axel Feldmann, and Aleksander Madry. Dsdm: Model-aware dataset selection with datamodels. In *International Conference on Machine Learning*, pages 12491–12526. PMLR, 2024.

Jacob R Epifano, Ravi P Ramachandran, Aaron J Masino, and Ghulam Rasool. Revisiting the fragility of influence functions. *Neural Networks*, 162:581–588, 2023.

Itay Evron, Edward Moroshko, Rachel Ward, Nathan Srebro, and Daniel Soudry. How catastrophic can catastrophic forgetting be in linear regression? In *Conference on Learning Theory*, pages 4028–4079. PMLR, 2022.

Minghong Fang, Neil Zhenqiang Gong, and Jia Liu. Influence function based data poisoning attacks to top-n recommender systems. In *Proceedings of The Web Conference 2020*, pages 3019–3025, 2020.

Abou Zakaria Faroukhi, Imane El Alaoui, Youssef Gahi, and Aouatif Amine. Big data monetization throughout big data value chain: a comprehensive review. *Journal of Big Data*, 7(1):3, 2020.

Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. In *NeurIPS*, 2020. URL https://proceedings.neurips.cc/paper/2020/hash/1e14bfe2714193e7af5abc64ecbd6b46-Abstract.html.

Ronald A Fisher. On the mathematical foundations of theoretical statistics. *Philosophical transactions of the Royal Society of London. Series A, containing papers of a mathematical or physical character*, 222(594-604):309-368, 1922.

Mike Fleckenstein, Ali Obaidi, and Nektaria Tryfona. A review of data valuation approaches and building and scoring a data valuation model. *Harvard Data Science Review*, 5(1), 2023.

Milad Fotouhi, Mohammad Taha Bahadori, Oluwaseyi Feyisetan, Payman Arabshahi, and David Heckerman. Fast training dataset attribution via in-context learning. *arXiv preprint arXiv:2408.11852*, 2024.

Fabian Fumagalli, Maximilian Muschalik, Patrick Kolpaczki, Eyke Hüllermeier, and Barbara Hammer. Shap-iq: Unified approximation of any-order shapley interactions. *Advances in Neural Information Processing Systems*, 36, 2024.

Ruyi Gan, Ziwei Wu, Renliang Sun, Junyu Lu, Xiaojun Wu, Dixiang Zhang, Kunhao Pan, Junqing He, Yuanhe Tian, Ping Yang, Qi Yang, Hao Wang, Jiaxing Zhang, and Yan Song. Ziya2: Data-centric learning is all llms need, 2024. URL https://arxiv.org/abs/2311.03301.

Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, Shawn Presser, and Connor Leahy. The pile: An 800gb dataset of diverse text for language modeling. *arXiv preprint arXiv:2101.00027*, 2020.

Thomas George, César Laurent, Xavier Bouthillier, Nicolas Ballas, and Pascal Vincent. Fast approximate natural gradient descent in a kronecker factored eigenbasis. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, *Advances in Neural Information Processing Systems*, volume 31. Curran Associates, Inc., 2018. URL https://proceedings.neurips.cc/paper_files/paper/2018/file/48000647b315f6f00f913caa757a70b3-Paper.pdf.

Kristian Georgiev, Joshua Vendrow, Hadi Salman, Sung Min Park, and Aleksander Madry. The journey, not the destination: How data guides diffusion models. *arXiv preprint arXiv:2312.06205*, 2023.

Kristian Georgiev, Roy Rinberg, Sung Min Park, Shivam Garg, Andrew Ilyas, Aleksander Madry, and Seth Neel. Machine unlearning via simulated oracle matching. In *The Thirteenth International Conference on Learning Representations*, 2025. URL https://openreview.net/forum?id=3vXpZpOn29.

Amirata Ghorbani and James Zou. Data shapley: Equitable valuation of data for machine learning. In *International conference on machine learning*, pages 2242–2251. PMLR, 2019.

Amirata Ghorbani, Michael Kim, and James Zou. A distributional framework for data valuation. In *International Conference on Machine Learning*, pages 3535–3544. PMLR, 2020.

Antonio Ginart, Melody Guan, Gregory Valiant, and James Y Zou. Making ai forget you: Data deletion in machine learning. *Advances in neural information processing systems*, 32, 2019.

Ryan Giordano, Michael I Jordan, and Tamara Broderick. A higher-order swiss army infinitesimal jackknife. *arXiv preprint arXiv:1907.12116*, 2019a.

Ryan Giordano, William Stephenson, Runjing Liu, Michael Jordan, and Tamara Broderick. A swiss army infinitesimal jackknife. In *The 22nd International Conference on Artificial Intelligence and Statistics*, pages 1139–1147. PMLR, 2019b.

Aaron Gokaslan and Vanya Cohen. Openwebtext corpus. http://Skylion007.github.io/OpenWebTextCorpus, 2019.
Aditya Golatkar, Alessandro Achille, and Stefano Soatto. Eternal sunshine of the spotless net: Selective forgetting in deep networks. In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pages 9304–9312, 2020.

Youdi Gong, Guangzhen Liu, Yunzhi Xue, Rui Li, and Lingzhong Meng. A survey on dataset quality in machine learning. *Information and Software Technology*, 162:107268, 2023.

Ian Goodfellow. Deep learning, volume 196. MIT press, 2016.

Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. *Advances in neural information processing systems*, 34:4218–4233, 2021.

Arthur Gretton, Karsten M. Borgwardt, Malte J. Rasch, Bernhard Schölkopf, and Alexander Smola. A kernel two-sample test. *Journal of Machine Learning Research*, 13(25):723–773, 2012. URL http://jmlr.org/papers/v13/gretton12a.html.

Roger Grosse, Juhan Bae, Cem Anil, Nelson Elhage, Alex Tamkin, Amirhossein Tajdini, Benoit Steiner, Dustin Li, Esin Durmus, Ethan Perez, Evan Hubinger, Kamilė Lukošiūtė, Karina Nguyen, Nicholas Joseph, Sam McCandlish, Jared Kaplan, and Samuel R. Bowman. Studying large language model generalization with influence functions, 2023. URL https://arxiv.org/abs/2308.03296.

Chuan Guo, Tom Goldstein, Awni Hannun, and Laurens Van Der Maaten. Certified data removal from machine learning models. In *Proceedings of the 37th International Conference on Machine Learning*, pages 3832–3842, 2020.

Han Guo, Nazneen Rajani, Peter Hase, Mohit Bansal, and Caiming Xiong. FastIF: Scalable influence functions for efficient model interpretation and debugging. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih, editors, *Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing*, pages 10333–10350, Online and Punta Cana, Dominican Republic, November 2021. Association for Computational Linguistics. doi:10.18653/v1/2021.emnlp-main.808. URL https://aclanthology.org/2021.emnlp-main.808/.

Kelvin Guu, Albert Webson, Ellie Pavlick, Lucas Dixon, Ian Tenney, and Tolga Bolukbasi. Simfluence: Modeling the influence of individual training examples by simulating training runs. *arXiv preprint arXiv:2303.08114*, 2023.

Zayd Hammoudeh and Daniel Lowd. Identifying a training-set attack’s target using renormalized influence estimation. In *Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security*, pages 1367–1381, 2022.

Zayd Hammoudeh and Daniel Lowd. Training data influence analysis and estimation: A survey. *Machine Learning*, 113(5):2351–2403, 2024.

Frank R Hampel. The influence curve and its role in robust estimation. *Journal of the american statistical association*, 69(346):383–393, 1974.

Frank R Hampel, Elvezio M Ronchetti, Peter J Rousseeuw, and Werner A Stahel. *Robust Statistics: The Approach Based on Influence Functions*. John Wiley & Sons, 2011.

Xiaochuang Han and Yulia Tsvetkov. Fortifying toxic speech detectors against veiled toxicity. In Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu, editors, *Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)*, pages 7732–7739, Online, November 2020. Association for Computational Linguistics. doi:10.18653/v1/2020.emnlp-main.622. URL https://aclanthology.org/2020.emnlp-main.622/.

Xiaochuang Han and Yulia Tsvetkov. Influence tuning: Demoting spurious correlations via instance attribution and instance-driven updates. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih, editors, *Findings of the Association for Computational Linguistics: EMNLP 2021*, pages 4398–4409, Punta Cana, Dominican Republic, November 2021. Association for Computational Linguistics. doi:10.18653/v1/2021.findings-emnlp.374. URL https://aclanthology.org/2021.findings-emnlp.374/.

Xiaochuang Han, Byron C. Wallace, and Yulia Tsvetkov. Explaining black box predictions and unveiling data artifacts through influence functions. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel Tetreault, editors, *Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics*, pages 5553–5563, Online, July 2020. Association for Computational Linguistics. doi:10.18653/v1/2020.acl-main.492. URL https://aclanthology.org/2020.acl-main.492/.

Xiaochuang Han, Daniel Simig, Todor Mihaylov, Yulia Tsvetkov, Asli Celikyilmaz, and Tianlu Wang. Understanding in-context learning via supportive pretraining data. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors, *Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume*
1: *Long Papers)*, pages 12660–12673, Toronto, Canada, July 2023. Association for Computational Linguistics.
doi:10.18653/v1/2023.acl-long.708. URL https://aclanthology.org/2023.acl-long.708/.

Satoshi Hara, Atsushi Nitanda, and Takanori Maehara. Data cleansing for models trained with sgd. *Advances in Neural Information Processing Systems*, 32, 2019.

Mark Harden. The artarchive. https://www.artarchive.com/, Accessed 2025.

John C Harsanyi. A simplified bargaining model for the n-person cooperative game. *Papers in game theory*, pages 44–70, 1982.

Luxi He, Mengzhou Xia, and Peter Henderson. What is in your safe data? identifying benign data that breaks safety. In *First Conference on Language Modeling*, 2024. URL https://openreview.net/forum?id=Hi8jKh4HE9.

Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. In *International Conference on Learning Representations*, 2021. URL https://openreview.net/forum?id=d7KBjmI3GmQ.

J. Herzberger and Lj. Petković. Efficient iterative algorithms for bounding the inverse of a matrix. *Computing*, 44 (3):237–244, September 1990. ISSN 1436-5057. doi:10.1007/BF02262219. URL https://doi.org/10.1007/BF02262219.

Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. *Advances in neural information processing systems*, 33:6840–6851, 2020a.

Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. *Advances in neural information processing systems*, 33:6840–6851, 2020b.

Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In *International Conference on Learning Representations*, 2022a. URL https://openreview.net/forum?id=nZeVKeeFYf9.

Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. Membership inference attacks on machine learning: A survey. *ACM Computing Surveys (CSUR)*, 54(11s):1–37, 2022b.

Yuzheng Hu, Pingbang Hu, Han Zhao, and Jiaqi Ma. Most influential subset selection: Challenges, promises, and beyond. In *The Thirty-eighth Annual Conference on Neural Information Processing Systems*, 2024a. URL https://openreview.net/forum?id=qWi33pPecC.

Yuzheng Hu, Fan Wu, Qinbin Li, Yunhui Long, Gonzalo Munilla Garrido, Chang Ge, Bolin Ding, David Forsyth, Bo Li, and Dawn Song. Sok: Privacy-preserving data synthesis. In *2024 IEEE Symposium on Security and Privacy (SP)*, pages 4696–4713. IEEE, 2024b.

Yuzheng Hu, Fan Wu, Haotian Ye, David Forsyth, James Zou, Nan Jiang, Jiaqi W Ma, and Han Zhao. A snapshot of influence: A local data attribution framework for online reinforcement learning. *arXiv preprint arXiv:2505.19281*, 2025.

Kai Hua, Steven Wu, Ge Zhang, and Ke Shen. Attentioninfluence: Adopting attention head influence for weak-to-strong pretraining data selection. *arXiv preprint arXiv:2505.07293*, 2025.

Chengzhi Huang and Hui Li. Single-user injection for invisible shilling attack against recommender systems. In *Proceedings of the 32nd ACM international conference on information and knowledge management*, pages 864–873, 2023.

Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, and Ting Liu. A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. *ACM Trans. Inf. Syst.*, 43(2), January 2025. ISSN 1046-8188. doi:10.1145/3703155. URL https://doi.org/10.1145/3703155.

Zirui Huang, Yunlong Mao, and Sheng Zhong. Uba-inf: unlearning activated backdoor attack with influence-driven camouflage. In *33rd USENIX Security Symposium (USENIX Security 24)*, pages 4211–4228, 2024.

Peter J Huber and Elvezio M Ronchetti. *Robust Statistics*. Wiley Series in Probability and Statistics. Wiley-Blackwell, Hoboken, NJ, 2 edition, January 2009. ISBN 9780470129906,9780470434697. doi:10.1002/9780470434697.

Andrew Ilyas, Sung Min Park, Logan Engstrom, Guillaume Leclerc, and Aleksander Madry. Datamodels: Understanding predictions with data and data with predictions. In *International Conference on Machine Learning*, pages 9525–9587. PMLR, 2022.

Guido W Imbens and Donald B Rubin. *Causal inference in statistics, social, and biomedical sciences*. Cambridge university press, 2015.
Arthur Jacot, Franck Gabriel, and Clément Hongler. Neural tangent kernel: Convergence and generalization in neural networks. *Advances in neural information processing systems*, 31, 2018.

Matthew Jagielski, Giorgio Severi, Niklas Pousette Harger, and Alina Oprea. Subpopulation data poisoning attacks. In *Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security*, pages 3104–3122, 2021.

Himanshu Jahagirdar, Jiachen T Wang, and Ruoxi Jia. Data valuation in the absence of a reliable validation set. *Transactions on Machine Learning Research*, 2024.

Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models, 2023. URL https://arxiv.org/abs/2309.00614.

Saachi Jain, Kimia Hamidieh, Kristian Georgiev, Andrew Ilyas, Marzyeh Ghassemi, and Aleksander Madry. Improving subgroup robustness via data selection. *Advances in Neural Information Processing Systems*, 37:94490–94511, 2024.

Neil Jethani, Mukund Sudarshan, Ian Connick Covert, Su-In Lee, and Rajesh Ranganath. FastSHAP: Real-time shapley value estimation. In *International Conference on Learning Representations*, 2022. URL https://openreview.net/forum?id=Zq2G_VTV53T.

Ruoxi Jia, David Dao, Boxin Wang, Frances Ann Hubis, Nezihe Merve Gurel, Bo Li4 Ce Zhang, and Costas Spanos1 Dawn Song. Efficient task-specific data valuation for nearest neighbor algorithms. *Proceedings of the VLDB Endowment*, 12(11), 2019a.

Ruoxi Jia, David Dao, Boxin Wang, Frances Ann Hubis, Nick Hynes, Nezihe Merve Gürel, Bo Li, Ce Zhang, Dawn Song, and Costas J Spanos. Towards efficient data valuation based on the shapley value. In *The 22nd International Conference on Artificial Intelligence and Statistics*, pages 1167–1176. PMLR, 2019b.

Ruoxi Jia, Fan Wu, Xuehui Sun, Jiacen Xu, David Dao, Bhavya Kailkhura, Ce Zhang, Bo Li, and Dawn Song. Scalability vs. utility: Do we have to sacrifice one for the other in data importance quantification? In *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pages 8239–8247, 2021.

Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b, 2023. URL https://arxiv.org/abs/2310.06825.

Cathy Jiao, Gary Gao, and Chenyan Xiong. In-context probing approximates influence function for data valuation, 2024. URL https://arxiv.org/abs/2407.12259.

Cathy Jiao, Weizhen Gao, Aditi Raghunathan, and Chenyan Xiong. On the feasibility of in-context probing for data attribution. In Luis Chiruzzo, Alan Ritter, and Lu Wang, editors, *Findings of the Association for Computational Linguistics: NAACL 2025*, pages 5140–5155, Albuquerque, New Mexico, April 2025. Association for Computational Linguistics. ISBN 979-8-89176-195-7. doi:10.18653/v1/2025.findings-naacl.286. URL https://aclanthology.org/2025.findings-naacl.286/.

Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In *Proceedings of the AAAI conference on artificial intelligence*, volume 34, pages 8018–8025, 2020.

Yiming Ju, Yuanzhe Zhang, Zhao Yang, Zhongtao Jiang, Kang Liu, and Jun Zhao. Logic traps in evaluating attribution scores. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio, editors, *Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)*, pages 5911–5922, Dublin, Ireland, May 2022. Association for Computational Linguistics. doi:10.18653/v1/2022.acl-long.407. URL https://aclanthology.org/2022.acl-long.407.

Hoang Anh Just, Feiyang Kang, Tianhao Wang, Yi Zeng, Myeongseob Ko, Ming Jin, and Ruoxi Jia. LAVA: Data valuation without pre-specified learning algorithms. In *The Eleventh International Conference on Learning Representations*, 2023. URL https://openreview.net/forum?id=JJuP86nB14q.

Karthikeyan K and Anders Søgaard. Revisiting methods for finding influential examples. *arXiv preprint arXiv:2111.04683*, 2021.

Feiyang Kang, Hoang Anh Just, Anit Kumar Sahu, and Ruoxi Jia. Performance scaling via optimal transport: Enabling data selection from partially revealed sources. *Advances in Neural Information Processing Systems*, 36:61341–61363, 2023.

Feiyang Kang, Yifan Sun, Bingbing Wen, Si Chen, Dawn Song, Rafid Mahmood, and Ruoxi Jia. Autoscale: Automatic prediction of compute-optimal data composition for training llms. *arXiv preprint arXiv:2407.20177*, 2024.
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models. arXiv preprint arXiv:2001.08361, 2020.

Siddharth Karamcheti, Suraj Nair, Ashwin Balakrishna, Percy Liang, Thomas Kollar, and Dorsa Sadigh. Prismatic vlms: Investigating the design space of visually-conditioned language models. In *Forty-first International Conference on Machine Learning*, 2024.

Bojan Karlaš, David Dao, Matteo Interlandi, Sebastian Schelter, Wentao Wu, and Ce Zhang. Data debugging with shapley importance over machine learning pipelines. In *The Twelfth International Conference on Learning Representations*, 2024. URL https://openreview.net/forum?id=qXGXjWxabq.

Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of GANs for improved quality, stability, and variation. In *International Conference on Learning Representations*, 2018. URL https://openreview.net/forum?id=Hk99zCeAb.

Phillip Keung, Yichao Lu, György Szarvas, and Noah A Smith. The multilingual amazon reviews corpus. In *Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)*, pages 4563–4568, 2020.

Alaa Khaddaj, Logan Engstrom, and Aleksander Madry. Small-to-large generalization: Training data influences models consistently across scale. In *The Thirteenth International Conference on Learning Representations*, 2025. URL https://openreview.net/forum?id=79ZkWgY2FI.

Rajiv Khanna, Been Kim, Joydeep Ghosh, and Sanmi Koyejo. Interpreting black box predictions using fisher kernels. In *The 22nd International Conference on Artificial Intelligence and Statistics*, pages 3382–3390. PMLR, 2019.

SungYub Kim, Kyungsu Kim, and Eunho Yang. Gex: A flexible method for approximating influence via geometric ensemble. *Advances in Neural Information Processing Systems*, 36:5888–5911, 2023.

Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.

Myeongseob Ko, Feiyang Kang, Weiyan Shi, Ming Jin, Zhou Yu, and Ruoxi Jia. The mirrored influence hypothesis: Efficient data influence estimation by harnessing forward passes. In *2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)*, pages 26276–26285, 2024. doi:10.1109/CVPR52733.2024.02483.

Jungyeon Koh, Hyeonsu Lyu, Jonggyu Jang, and Hyun Jong Yang. Faithful and fast influence function via advanced sampling. In *ICML 2024 Workshop on Mechanistic Interpretability*, 2024. URL https://openreview.net/forum?id=TTVPbaxXjR.

Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In *International conference on machine learning*, pages 1885–1894. PMLR, 2017.

Pang Wei W Koh, Kai-Siang Ang, Hubert Teo, and Percy S Liang. On the accuracy of influence functions for measuring group effects. *Advances in neural information processing systems*, 32, 2019.

Patrick Kolpaczki, Viktor Bengs, Maximilian Muschalik, and Eyke Hüllermeier. Approximating the shapley value without marginal contributions. In *Proceedings of the AAAI Conference on Artificial Intelligence*, volume 38, pages 13246–13255, 2024.

Shuming Kong, Yanyan Shen, and Linpeng Huang. Resolving training biases via influence-based data relabeling. In *International Conference on Learning Representations*, 2022. URL https://openreview.net/forum?id=EskfH0bwNVn.

Steven George Krantz and Harold R Parks. *The implicit function theorem: history, theory, and applications*. Springer Science & Business Media, 2002.

Alex Krizhevsky. *Learning Multiple Layers of Features from Tiny Images*. PhD thesis, University of Toronto, Toronto, ON, Canada, 2009. URL https://www.cs.toronto.edu/~kriz/learning-features-2009-TR.pdf.

Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar-10 (canadian institute for advanced research), 2010. URL http://www.cs.toronto.edu/kriz/cifar.html.

Nupur Kumari, Bingliang Zhang, Richard Zhang, Eli Shechtman, and Jun-Yan Zhu. Multi-concept customization of text-to-image diffusion. In *Proceedings of the IEEE/CVF conference on computer vision and pattern recognition*, pages 1931–1941, 2023.

Yongchan Kwon and James Zou. Beta shapley: a unified and noise-reduced data valuation framework for machine learning. In *Gustau Camps-Valls, Francisco J. R. Ruiz, and Isabel Valera, editors, Proceedings of The 25th International Conference on Artificial Intelligence and Statistics*, volume 151 of *Proceedings of Machine Learning Research*, pages 8780–8802. PMLR, 28–30 Mar 2022. URL https://proceedings.mlr.press/v151/kwon22a.html.
Yongchan Kwon and James Zou. Data-oob: Out-of-bag estimate as a simple and efficient data value. In *International Conference on Machine Learning*, pages 18135–18152. PMLR, 2023.

Yongchan Kwon, Manuel A Rivas, and James Zou. Efficient computation and analysis of distributional shapley values. In *International Conference on Artificial Intelligence and Statistics*, pages 793–801. PMLR, 2021.

Yongchan Kwon, Eric Wu, Kevin Wu, and James Zou. Datainf: Efficiently estimating data influence in loRA-tuned LLMs and diffusion models. In *The Twelfth International Conference on Learning Representations*, 2024. URL https://openreview.net/forum?id=9m02ib92Wz.

Tsz Kin Lam, Eva Hasler, and Felix Hieber. Analyzing the use of influence functions for instance-specific data filtering in neural machine translation. In *Proceedings of the Seventh Conference on Machine Translation (WMT)*, pages 295–309, Abu Dhabi, United Arab Emirates (Hybrid), December 2022. Association for Computational Linguistics.

Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. *Proceedings of the IEEE*, 86(11):2278–2324, 1998.

Jinhyuk Lee, Zhuyun Dai, Xiaoqi Ren, Blair Chen, Daniel Cer, Jeremy R. Cole, Kai Hui, Michael Boratko, Rajvi Kapadia, Wen Ding, Yi Luan, Sai Meher Karthik Duddu, Gustavo Hernandez Abrego, Weiqiang Shi, Nithi Gupta, Aditya Kusupati, Prateek Jain, Siddhartha Reddy Jonnalagadda, Ming-Wei Chang, and Iftekhar Naim. Gecko: Versatile text embeddings distilled from large language models, 2024. URL https://arxiv.org/abs/2403.20327.

Dan Ley, Suraj Srinivas, Shichang Zhang, Gili Rusak, and Himabindu Lakkaraju. Generalized group data attribution, 2024. URL https://arxiv.org/abs/2410.09940.

Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. Data poisoning attacks on factorization-based collaborative filtering. In D. Lee, M. Sugiyama, U. Luxburg, I. Guyon, and R. Garnett, editors, *Advances in Neural Information Processing Systems*, volume 29. Curran Associates, Inc., 2016. URL https://proceedings.neurips.cc/paper_files/paper/2016/file/83fa5a432ae55c253d0e60dbfa716723-Paper.pdf.

Kangming Li, Daniel Persaud, Kamal Choudhary, Brian DeCost, Michael Greenwood, and Jason Hattrick-Simpers. Exploiting redundancy in large materials datasets for efficient machine learning with less data. *Nature Communications*, 14(1):7283, 2023.

Tianjian Li, Haoran Xu, Philipp Koehn, Daniel Khashabi, and Kenton Murray. Error norm truncation: Robust training in the presence of data noise for text generation models. In *The Twelfth International Conference on Learning Representations*, 2024a. URL https://openreview.net/forum?id=zMvMwNvs4R.

Weida Li and Yaoliang Yu. Robust data valuation with weighted banzhaf values. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, *Advances in Neural Information Processing Systems*, volume 36, pages 60349–60383. Curran Associates, Inc., 2023. URL https://proceedings.neurips.cc/paper_files/paper/2023/file/bdb0596d13cfccf2db6f0cc5280d2a3f-Paper-Conference.pdf.

Weida Li and Yaoliang Yu. Faster approximation of probabilistic and distributional values via least squares. In *The Twelfth International Conference on Learning Representations*, 2024a. URL https://openreview.net/forum?id=lvSMIsztka.

Weida Li and Yaoliang Yu. One sample fits all: Approximating all probabilistic values simultaneously and efficiently. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors, *Advances in Neural Information Processing Systems*, volume 37, pages 58309–58340. Curran Associates, Inc., 2024b. URL https://proceedings.neurips.cc/paper_files/paper/2024/file/6b295b08549c0441914e391651423477-Paper-Conference.pdf.

Xuechen Li, Florian Tramer, Percy Liang, and Tatsunori Hashimoto. Large language models can be strong differentially private learners. In *International Conference on Learning Representations*, 2022. URL https://openreview.net/forum?id=bVuP3ltATMz.

Yanwei Li, Yuechen Zhang, Chengyao Wang, Zhisheng Zhong, Yixin Chen, Ruihang Chu, Shaoteng Liu, and Jiaya Jia. Mini-gemini: Mining the potential of multi-modality vision language models. *arXiv preprint arXiv:2403.18814*, 2024b.

Yunshui Li, Binyuan Hui, Xiaobo Xia, Jiaxi Yang, Min Yang, Lei Zhang, Shuzheng Si, Ling-Hao Chen, Junhao Liu, Tongliang Liu, Fei Huang, and Yongbin Li. One-shot learning as instruction data prospector for large language models. In *Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)*, pages 4586–4601, 2024c.

Fan Liang, Wei Yu, Dou An, Qingyu Yang, Xinwen Fu, and Wei Zhao. A survey on big data market: Pricing, trading and protection. *IEEE Access*, 6:15132–15154, 2018. doi:10.1109/ACCESS.2018.2806881.
Peiyuan Liao, Xiuyu Li, Xihui Liu, and Kurt Keutzer. The artbench dataset: Benchmarking generative models with artworks. arXiv preprint arXiv:2206.11404, 2022.

Chris Lin, Mingyu Lu, and Su-In Lee. Efficient global data attribution for diffusion models. In Workshop on Navigating and Addressing Data Problems for Foundation Models at ICLR, 2024a.

Huawei Lin, Jikai Long, Zhaozhuo Xu, and Weijie Zhao. Token-wise influential training data retrieval for large language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors, Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 841–860, Bangkok, Thailand, August 2024b. Association for Computational Linguistics. doi:10.18653/v1/2024.acl-long.48. URL https://aclanthology.org/2024.acl-long.48/.

Jinkun Lin, Anqi Zhang, Mathias Lécuyer, Jinyang Li, Aurojit Panda, and Siddhartha Sen. Measuring the effect of training data on deep learning predictions via randomized experiments. In International Conference on Machine Learning, pages 13468–13504. PMLR, 2022.

Jinxu Lin, Linwei Tao, Minjing Dong, and Chang Xu. Diffusion attribution score: Evaluating training data influence in diffusion model. In The Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=kuutidLf6R.

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, pages 740–755. Springer, 2014.

Xiaoqiang Lin, Xinyi Xu, Zhaoxuan Wu, See-Kiong Ng, and Bryan Kian Hsiang Low. Distributionally robust data valuation. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp, editors, Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 30362–30391. PMLR, 21–27 Jul 2024c. URL https://proceedings.mlr.press/v235/lin24t.html.

Zi Lin, Zihan Wang, Yongqi Tong, Yangkun Wang, Yuxin Guo, Yujia Wang, and Jingbo Shang. Toxicchat: Unveiling hidden challenges of toxicity detection in real-world user-ai conversation. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 4694–4702, 2023.

Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems, volume 36, pages 34892–34916. Curran Associates, Inc., 2023. URL https://proceedings.neurips.cc/paper_files/paper/2023/file/6dcf277ea32ce3288914faf369fe6de0-Paper-Conference.pdf.

Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. Improved baselines with visual instruction tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 26296–26306, 2024a.

Jinxin Liu and Zao Yang. Tracing privacy leakage of language models to training data via adjusted influence functions. arXiv preprint arXiv:2408.10468, 2024.

Qian Liu, Xiaosen Zheng, Niklas Muennighoff, Guangtao Zeng, Longxu Dou, Tianyu Pang, Jing Jiang, and Min Lin. Regmix: Data mixture as regression for language model pre-training. In The Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=5BjQOUXq7i.

Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692, 2019.

Zelei Liu, Yuanyuan Chen, Han Yu, Yang Liu, and Lizhen Cui. Gtg-shapley: Efficient and accurate participant contribution evaluation in federated learning. ACM Transactions on intelligent Systems and Technology (TIST), 13 (4):1–21, 2022.

Zikang Liu, Kun Zhou, Wayne Xin Zhao, Dawei Gao, Yaliang Li, and Ji-Rong Wen. Less is more: High-value data selection for visual instruction tuning, 2024b. URL https://arxiv.org/abs/2403.09559.

Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.

Elita Lobo, Harvineet Singh, Marek Petrik, Cynthia Rudin, and Himabindu Lakkaraju. Data poisoning attacks on off-policy policy evaluation methods. In James Cussens and Kun Zhang, editors, Proceedings of the Thirty-Eighth Conference on Uncertainty in Artificial Intelligence, volume 180 of Proceedings of Machine Learning Research, pages 1264–1274. PMLR, 01–05 Aug 2022. URL https://proceedings.mlr.press/v180/lobo22a.html.

Shayne Longpre, Gregory Yauney, Emily Reif, Katherine Lee, Adam Roberts, Barret Zoph, Denny Zhou, Jason Wei, Kevin Robinson, David Mimno, and Daphne Ippolito. A pretrainer's guide to training data: Measuring the effects