SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\left(\mathcal {C} \cup \{i \} = \mathcal {C} ^ {\prime} \cup \{i ^ {\prime} \}\right) \wedge i ^ {\prime} \in \mathcal {C} \wedge i \in \mathcal {C} ^ {\prime},
$$
so  $\mathcal{C}' \setminus \{i\} = \mathcal{C} \setminus \{i'\}$ . Consequently, let  $\underline{\mathcal{C}} \coloneqq \mathcal{C}' \setminus \{i\}$ . Then,
$$
\left| \nu (\mathcal {C} ^ {\prime}) - \nu (\mathcal {C}) \right| = \left| \nu (\underline {{\mathcal {C}}} \cup \{i \}) - \nu (\underline {{\mathcal {C}}} \cup \{i ^ {\prime} \}) \right|.
$$
To complete the final step, first consider the simpler case of  $Z = 1$  and the coefficient  $\omega_{\mathcal{C}}$  is defined in a way such that  $\phi_i$  satisfies efficiency [69] (i.e.,  $\sum_{\mathcal{C} \subseteq [N] \setminus \{i\}} \omega_{\mathcal{C}} = 1$ ), the condition  $\forall \mathcal{C} \subseteq [N] \setminus \{i, i'\} \left| \nu(\mathcal{C} \cup \{i\}) - \nu(\mathcal{C} \cup \{i'\}) \right| \leq Ld(i, i')$  can be used to bound the overall sum of the RHS as
$$
\left| \phi_ {i} - \phi_ {i ^ {\prime}} \right| \leq L d \left(i, i ^ {\prime}\right).
$$
More generally for  $Z \neq 1$ , it can be directly multiplied to the RHS as follows
$$
\left| \phi_ {i} - \phi_ {i ^ {\prime}} \right| \leq Z L d \left(i, i ^ {\prime}\right)
$$
since every term is multiplied by the same constant in the above two summations.
Proposition 5 (Diminishing Model Shapley Value due to Substitutes). According to the definitions as in (P4),  $\phi_i(\phi_i')$  denotes the model Shapley value of  $\mathbf{M}_i$  w.r.t.  $[N] ([N'] := [N] \cup \{i_c\})$  and  $\mathbf{M}_{i_c} = \mathbf{M}_i$  is a perfect substitute/identical duplicate/copy. Then,
$$
(\forall \mathcal {C} \subseteq [ N ] \setminus \{i \} \nu (\mathcal {C} \cup \{i \}) - \nu (\mathcal {C}) \geq \nu (\mathcal {C} \cup \{i, i _ {\mathrm {c}} \}) - \nu (\mathcal {C} \cup \{i \})) \Rightarrow \phi_ {i} ^ {\prime} \leq \phi_ {i}.
$$
Proof of Proposition 5. The inequality  $\phi_i \geq \phi_i'$  is shown by examining the pairwise difference over their respective summands in the summation of model Shapley.
For  $\phi_i, \phi_i \coloneqq \sum_{\mathcal{C} \subseteq [N] \setminus \{i\}} s_{\mathcal{C}}$  where the summand  $s_{\mathcal{C}} \coloneqq \omega_{\mathcal{C}} \mathbf{MC}_i(\mathcal{C})$ .  $\omega_{\mathcal{C}}$  is as in (2) and  $\mathbf{MC}_i(\mathcal{C}) \coloneqq \nu(\mathcal{C} \cup \{i\}) - \nu(\mathcal{C})$  is the marginal contribution of  $i$  w.r.t.  $\mathcal{C}$ .
For  $\phi_i^\prime$ $\phi_i^\prime \coloneqq \sum_{\substack{\mathcal{C}\subseteq [N]\setminus \{i\} \\ \mathcal{C}' = \mathcal{C}\cup \{i_c\}}}s_{\mathcal{C}}'$  where the summand
$$
s _ {\mathcal {C}} ^ {\prime} := \frac {| \mathcal {C} | ! (N + 1 - | \mathcal {C} | - 1) !}{(N + 1) !} \mathrm {M C} _ {i} (\mathcal {C}) + \frac {| \mathcal {C} ^ {\prime} | ! (N + 1 - | \mathcal {C} ^ {\prime} | - 1) !}{(N + 1) !} \mathrm {M C} _ {i} (\mathcal {C} ^ {\prime}).
$$
$\phi_i^\prime$  is obtained by observing that adding  $i_{\mathrm{c}}$  to  $[N]$  means additionally enumerating all the  $\mathcal{C} \subseteq [N] \setminus \{i\}$  but added with  $i_{\mathrm{c}}$ , as shown above.
As  $|\mathcal{C}^{\prime}| = |\mathcal{C}| + 1$
$$
\begin{array}{l} s _ {\mathcal {C}} ^ {\prime} = \frac {\omega_ {\mathcal {C}}}{N + 1} [ (N - | \mathcal {C} |) \mathrm {M C} _ {i} (\mathcal {C}) + (| \mathcal {C} | + 1) \mathrm {M C} _ {i} (\mathcal {C} ^ {\prime}) ] \\ \leq \frac {\omega_ {\mathcal {C}}}{N + 1} \left[ (N - | \mathcal {C} |) \mathrm {M C} _ {i} (\mathcal {C}) + (| \mathcal {C} | + 1) \mathrm {M C} _ {i} (\mathcal {C}) \right] \\ = \frac {\omega_ {\mathcal {C}}}{N + 1} [ (N + 1) \operatorname {M C} _ {i} (\mathcal {C}) ] \\ = s _ {\mathcal {C}} \\ \end{array}
$$
where the inequality is due to the conditionally redundant property of  $\nu$ .<sup>12</sup> Since  $\phi_i$  and  $\phi_i'$  enumerate the same summation and individual summands have  $s_C' \leq s_C$ , it follows that  $\phi_i' \leq \phi_i$ .
Remedy for duplication from a dishonest seller. While the marginal utility of each duplicate model decreases, the combined utility of all the duplicated models may be higher than if there is only one such model. Hence, a dishonest seller might exploit this by duplicating a model to receive a higher combined utility. As a hypothetical example to illustrate this: two models  $\mathbf{M}_i$ ,  $\mathbf{M}_j$  from vendors  $i$ ,  $j$  respectively, each have values 0.5, then if the model seller  $i$  decides to fraudulently duplicate model  $\mathbf{M}_i$  to another  $\mathbf{M}_{i_c}$ . Although the value for  $\mathbf{M}_i$  depreciates, such duplication can lead to a higher value for vendor  $i$ , namely the value of  $\mathbf{M}_i$  and  $\mathbf{M}_{i_c}$  combined might be higher than if only  $\mathbf{M}_i$  is present.
We note that our proposed approach can be adapted to address this issue relatively easily, by substituting our proposed in Eq. (3) into the variant of the Shapley value [24, Theorem 4.5], which importantly continues to satisfy the properties (P1), (P2) and (P3) [24]. However, we highlight that (the robustness to) such duplication is beyond the scope of this work.
<sup>12</sup>Our definition of conditional redundancy is a weaker version of [24, Assumption 2] which stipulates the benefit of a copy  $\mathbf{M}_{i_c}$  (conditioned on model  $\mathbf{M}_i$  already being added) is exactly 0.
B Additional Literature Review
B.1 Relation to Data Valuation and its Design Approach
Data valuation, originating from the motivating application scenario of AI marketplaces [1, 13, 24], studies how to determine the intrinsic worth of data, often in the context of ML. Intuitively, as these marketplaces treat data as commodities for trading, a pricing mechanism (i.e., a valuation function) is necessary. There have been some works exploring data valuation [10, 20, 39, 80], by leveraging ML principles and assumptions. For instance, data are more valuable if training on the data produces an ML model with higher performance (i.e., more accurate). In addition to the application scenario of AI marketplaces, the value of data can also be/has been used in interpretable ML [20], data sharing [16] and collaborative ML [76, 79]. However, as motivated in Sec. 1, there are various practical scenarios where data valuation is difficult. Hence, we explore an alternative by shifting our focus onto the ML models in these scenarios to consider model valuation.
In terms of the design approach, although the existing data valuation works have different technical perspectives and thus different solutions, they often adopt a common first-principle approach, i.e., data which can produce more accurate models are more valuable. This approach provides an interpretation for the valuation function or the values assigned to the data. While it may seem counter-intuitive to market economics where the price/value can naturally arise from the demand and supply, this approach is sensible because the lack of effective demand (i.e., the willingness and ability of buyers to purchase goods/data/ML model at different prices). To elaborate, effective demand requires the buyers to have some intrinsic valuation function for the data/ML model which helps determine the quantity the buyers are willing to purchase at some fixed price. In contrast to the more conventional goods, the market for data/ML model is relatively niche in the sense that even the buyers themselves do not already have a good intrinsic valuation function for the data/ML model. As a result, the buyers are unable to specify the effective demand, which makes it difficult for the price/valuation to arise naturally from the demand and supply in a market. To this end, the (proposed) valuation methods (i.e., existing data valuation methods and the model valuation method in this paper) aim to fill in this gap by explicitly designing such a valuation function where the value is determined through the utility of the data/ML model in the context of ML (e.g., predictive performance). In this vein, the existing data valuation methods and our proposed model valuation method share a common perspective of designing the valuation function reflect the utility of the data/ML model in terms of some performance in the ML context. An added benefit of this design approach is the interpretability of the value. To see this, suppose in the marketplace (e.g., AWS marketplace), an auditor questions the basis for certain pricing of some ML model, our proposed valuation function can provide some insight to that question and can potentially be used by regulators to oversee the ML model marketplaces.
In terms of the practical setting, data valuation can be viewed as (mostly) white-box (i.e., the actual data are used as the input to the designed valuation function and thus completely observed). Intuitively, in order to determine the value of some data, the valuation function must "see" the data. In this regard, this setting for data valuation leads to a relatively straightforward formal representation of the data, which is the data. In contrast, model valuation can encounter additional practical difficulties which make the formal representation of ML much less straightforward. Similar to in data valuation, we might want to use the model itself as its formal representation (e.g., the parameters of the parametric models). However, the so-called black-box access which is particularly appealing in model valuation (Sec. 1), excludes the choice of using the model itself (e.g., the parameters). Then, it becomes unclear what the formal representation of a model to use under this black-box access setting. In other words, for model valuation, precisely what is the input to the valuation function?
To briefly summarize the comparison between data and model valuation: In light of the practical obstacles of applying data valuation, we explore the alternative of model valuation. We adopt a similar design approach to those adopted by existing data valuation works to explicitly design a model valuation function that reflects the utility of the ML model/data in terms of a performance in the ML context. To address the additional challenges due to the black-box access setting (which is not encountered in data valuation), we propose a novel formal representation of an ML model (for classification).
<sup>13</sup>Although there is some preliminary work on using some noisy version of data for valuation [77], so it is not completely white-box, in general there is some form of access to the data or its statistic for valuation.
B.2 Model Evaluation Criteria and Model Valuation
Model evaluation criteria. The value of an ML model depends on its utility/performance in the ML context. But the performance is a multi-faceted concept because there are different evaluation criteria, motivated by and suitable in different scenarios. For instance, one of the most commonly used evaluation criteria is the predictive accuracy (i.e., the proportion of correct predictions of the model). Another useful criterion is the predictive certainty (i.e., the certainty with which the model makes the predictions), as illustrated in Sec. 1. Furthermore, there are other sophisticated and practically important evaluation criteria such as fairness in prediction [56], robustness to adversaries [43] and robustness to distributional shifts in data [67]. In this regard, one approach is to design a model valuation bespoke to each of these criteria separately. However, it is more scalable and appealing to leverage a common theoretical connection among these criteria to design a more general model valuation that can be specified to different criteria as needed.
Model valuation. The work of [66] investigates the binary classification setting and is not suitable for empirical comparison as we consider problems with multiple classes. The works of [10, 11, 13, 51] approach the design of a model marketplace from an economics perspective by addressing issues like arbitrage (e.g., via horizontal/vertical pricing). In contrast, we formalize the value of a model via what it has learned w.r.t. a task. In addition, the black-box access setting is appealing in a model marketplace as it accommodates different model types. Some existing methods [8, 30, 33] focus on how to learn a fused model from several trained models with black-box access instead of how to value these models.
C.1 Additional Experiment Settings
Licenses of used datasets and computational resources. MNIST [45]: Creative Commons Attribution-Share Alike 3.0. CIFAR-10 [41]: The MIT License (MIT). MedNIST [58]: Apache License 2.0. DrugRe [23]: Apache License 2.0 KDD99 [28]: Apache License 2.0.
We perform our experiments on a server with Intel(R) Xeon(R) Gold 6226R CPU @2.90GHz and four NVIDIA GeForce RTX 3080's. As in our experiments, we use the pre-trained weights for the models (where available) instead of training from scratch. This is because our method is w.r.t. trained models, instead of focusing on the training procedure. As a result, the usage of GPUs is moderate (mainly for performing inference on the trained models, typically within 1 - 2 hours depending on the complexity of the models).
Multiple independent training for robustness of results. We train a particular setting multiple (i.e., 3) independent times and compare the results from different settings to ensure the robustness of results. For instance, Fig. 7 examines the effect of training data ratio on MSVs. For each particular training data ratio, we perform 3 independent training using the same model type and set of hyperparameters so that the plotted results are robust to randomness in the training (via stochastic gradient descent).
C.2 Additional Discussion and Experiment Details for Learning MSV
Learning approach. Conventionally, the model Shapley value (MSV) of each model  $\mathbf{M}_i$  is calculated (for sufficiently small  $N$ ) or approximated (for larger  $N$ , e.g., larger than 30). The computational complexity of exact calculation scales exponentially in the number of models (i.e.,  $\mathcal{O}(2^N)$ ), and that of approximation scales polynomial in  $N$  [53], depending on the approximation requirement (i.e., a better approximation with smaller error would incur a higher computational cost). Furthermore, each of these computational complexities has to be multiplied by the number  $N$  of models, since the calculation or approximation is performed for each model individually. Our learning approach aims to reduce the number of models for which calculation or approximation is performed, following the steps (i) perform calculation or approximation (e.g., Monte Carlo) for a subset (of size  $Z$ ) of all  $N$  models individually; (ii) use the obtained  $Z$  model-MSV (or model-approximate MSV) pairs to fit a regression learner (e.g., Gaussian process regression); (iii) use the regression learner to predict the MSV for the remaining  $(N - Z)$  models.
We highlight that this approach does not aim to reduce the computational complexity of the MSV of a model. Instead, this approach aims to reduce the total computational complexity of obtaining the
MSVs of  $N$  models, by a factor of  $N / Z$  (e.g., if  $Z = 30$  for  $N = 150$  models such as in Table 2, the total computational complexity is reduced to  $1 / 5\mathrm{th}$ ). Importantly, our learning approach is parallel to the prior and existing efforts that aim to reduce the computational complexity of the MSV of a model. It means that if a more efficient approximation (than the oft-used Monte Carlo) to the MSV of a model is proposed (in the future), it can be directly integrated with our learning approach in step (i) described above, namely replacing Monte Carlo.
Why Gaussian process regression. There are several reasons that we adopt the Gaussian process regression (GPR) as the specific choice for the learning approach: (i) GPR is a kernel-based method, which can exploit a suitably defined distance function between inputs. The Hellinger distance between two Dirichlet abstractions, or the  $\ell_1$  distance between the observed sufficient statistics  $\bar{h}_i$  of two models are both such suitable distance functions between the inputs (i.e., models). Hence, we adopt GPR to exploit the squared exponential kernel  $\exp(-d(i,i')/(2\sigma^2))$  on the similarity measure between models (where the lengthscale  $\sigma$  is learned). Specifically, for  $\{\alpha_i,\hat{\phi}_i\}$ ,  $d(i,i') \coloneqq d_{\mathrm{H}}(\mathbb{Q}_i,\mathbb{Q}_{i'})$ , while for  $\{\bar{h}_i,\hat{\phi}_i\}$ ,  $d(i,i') \coloneqq |\bar{h}_{i'} - \bar{h}_i|_1$ . (ii) While the exact MSVs satisfy (P1)-(P4), the predicted MSVs are not guaranteed to satisfy these properties. Fortunately, if the predicted MSVs have a bounded error to the exact MSVs, then these properties can be approximately satisfied [82]. In particular, GPR has such an error guarantee [47]. The result [47, Theorem 3.1] requires the function to be learnt to be Lipschitz continuous (which we derive in Theorem 1), and also the kernel to be Lipschitz continuous, so we adopt the squared exponential kernel, which is Lipschitz continuous [47]. Moreover, note that the result [47, Theorem 3.1] is w.r.t. a continuous input space (i.e., a subset of  $\mathbb{R}^d$  for some  $d$ ), but the error guarantee depends on the Lipschitz continuity only through the metric between two inputs (i.e.,  $\ell_2$  norm of the input vectors). This is to say, their result can be adapted to our setting (where the input space is not continuous, but discrete): In our formulation for  $\Phi$ , the metric between two inputs is the Hellinger distance (i.e.,  $d_{\mathrm{H}}(\mathbb{Q}_i,\mathbb{Q}_{i'})$ ). It is thus an appealing future direction provide a formal guarantee based on these two theoretical results.
C.3 Additional Results for MSV vs. Predictive Accuracy/Certainty
Varying size of training data. We use the same model type and vary the size of training data. For MNIST, we use a CNN, CIFAR-10, we use ResNet-18, for MedNIST we use a specific architecture called MedNet, $^{14}$  and for DrugRe we use a CNN for text. Fig. 7 shows more training data generally lead to (better trained models, and thus) higher MSVs. Although in some cases the MSVs are negative, it can be mitigated (if necessary) by exploiting the linearity property of MSV to linear translate all MSVs by a positive amount. For instance, if only ranking of the models is needed, then negative values are acceptable as long as the ordering is correct.
Figure 7: From left to right: MNIST, CIFAR-10, MedNIST and DrugRe. For CIFAR-10 and MedNIST,  $\mathcal{D}$  is the original test set without partitioning and for MNIST and DrugRe we partition the original test set according to classes.
Varying model type. We vary the model types and train them independently on the same data. We train each model independently for 3 copies for robustness of results. For KDD99, the model types are CNN, MLP and LR. For CIFAR-10, the model types are ResNet-18, SqueezeNet and DenseNet-121. For MedNIST, the model types are ResNet-18, MedNet, and a tiny CNN. For DrugRe, the model types are CNN for text and BiLSTM. Note that these are the model types used in the empirical verification of the generalized symmetry result in Sec. 4.1.
Fig. 8 shows the following. For KDD99, MLP performs the worst (very negative MSVs) while LR performs the best. For CIFAR-10, DenseNet-121 outperforms the rest while SqueezeNet performs
$^{14}$ https://github.com/apolanco3225/Medical-MNIST-Classification/blob/master/MedNIST.ipynb
the worst. For MedNIST, the bespoke MedNet performs the best while the tiny CNN performs the worst. For DrugRe, BiLSTM outperforms CNN for text.
Figure 8: From left to right: KDD99, CIFAR-10, MedNIST and DrugRe. For KDD99, MedNIST and DrugRe  $\mathcal{D}$  is the original test set without partitioning and for CIFAR-10 we specifically use the misclassified input data from the original test set and perform partitioning according to classes.
Varying predictive certainty. We use the same model type (trained on the same data) and only vary the predictive certainty. The model type is LR for KDD, DenseNet for CIFAR-10, MedNet for MedNIST and CNN (for text) for DrugRe.
Fig. 9 shows increasing predictive certainty (while maintaining the predictive accuracy) improves MSVs.
Figure 9: From left to right: KDD99, CIFAR-10, MedNIST and DrugRe. For all 4 datasets  $\mathcal{D}$  is the original test set without partitioning.
C.4 Additional Results for Identifying Valuable Models for a Larger Learner
We perform additional experiments on CovType [5], MNIST and CIFAR-100. For CovType, the models used are decision trees of depths at most 3 and the larger learner is a random forest. For MNIST (CIFAR-100) the models used are LeNet-5 [46] (Resnet-18) and the larger learner is a voting classifier. The total number of models is 50 for CovType and CIFAR-10, and 25 for CIFAR-100.
Fig. 10 shows for all three datasets, MSVs effectively identify the valuable subset of models since following the highest-first sequence increases the test accuracy more quickly. In particular, we identify overfitting for CovType and MNIST since the max attained accuracy occurs before all the models are included.
Figure 10: From left to right: CovType, MNIST, and CIFAR-100. Test accuracy vs. number of included models.
C.5 Empirical Advantage of the Chernoff Distance over the Hellinger Distance
Additional performance metrics of learning MSV. While using  $d_{\mathrm{H}}$  produces high regression performance of learning MSV (i.e., low test errors), we find that the performance may be somewhat limiting when we apply other performance metrics such as coefficient of determinant ( $R^2$ ) and
explained variance (exVar). In particular, we find that  $d_{\mathrm{C}}$  outperforms  $d_{\mathrm{H}}$  on these two metrics, shown in Table 4.
Table 4: Average (standard errors) of test performance (over 10 random trials) on  $80\%$  of data after training on  $20\%$  of data for MNIST (top two rows) and CIFAR-10 (bottom two rows). Left (right) two columns correspond to using  $d_{\mathrm{H}}$  ( $d_{\mathrm{C}}$ ). For both metrics, higher is better (optimal is 1).
R²	ExVar	R²	ExVar
αi	0.29(6.72e-3)	0.201(2.90e-2)	0.93(2e-3)	0.92(3e-3)
h̄i	-4.04(0.462)	-3.66e1(1.33)	0.85(7e-3)	0.44(3e-2)
αi	0.73(2.00e-2)	0.67(3.76e-2)	0.93(2e-2)	0.91(3e-2)
h̄i	-8.69(1.21)	-2.20e1(2.47)	0.80(1e-2)	0.76(2e-2)
Notice in Table 4, the right two columns  $(d_{\mathrm{C}})$  outperform the left two columns  $(d_{\mathrm{H}})$ . We hypothesize that this can to the logarithmic dependence in  $d_{\mathrm{C}}$  resulting a more "linear" relationship between  $\mathbb{Q}_i$  and  $\phi_i$ . For Dirichlet distributions (i.e., Dirichlet abstractions) over a  $C$ -dimensional space  $(C > 1)$ , the product of the pdf (appears in both  $d_{\mathrm{C}}$  and  $d_{\mathrm{H}}$ ) over the space may not be well-behaved, and the integral of this product makes it more intractable (possibly due to the curse of dimensionality). The logarithmic operation in  $d_{\mathrm{C}}$  can help mitigate this, resulting in the better regression performance using GPR, in terms of exVar and  $R^2$ .
C.6 Additional Benefit of A Lower Level of Dirichlet Abstraction