SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Peter Nickl  
peter.nickl@riken.jp
Lu Xu\*† lu.xu.sw@riken.jp
Dharmesh Tailor*‡ d.v.tailor@uva.nl
Thomas Möllenhoff†  
thomas.moellenhoff@riken.jp
Mohammad Emtiyaz Khan†§ emtiyaz.khan@riken.jp
Understanding model's sensitivity to its training data is crucial but can also be challenging and costly, especially during training. To simplify such issues, we present the Memory-Perturbation Equation (MPE) which relates model's sensitivity to perturbation in its training data. Derived using Bayesian principles, the MPE unifies existing sensitivity measures, generalizes them to a wide-variety of models and algorithms, and unravels useful properties regarding sensitivities. Our empirical results show that sensitivity estimates obtained during training can be used to faithfully predict generalization on unseen test data. The proposed equation is expected to be useful for future research on robust and adaptive learning.
Understanding model's sensitivity to training data is important to handle issues related to quality, privacy, and security. For example, we can use it to understand (i) the effect of errors and biases in the data; (ii) model's dependence on private information to avoid data leakage; (iii) model's weakness to malicious manipulations. Despite their importance, sensitivity properties of machine learning (ML) models are not well understood in general. Sensitivity is often studied through empirical investigations, but conclusions drawn this way do not always generalize across models or algorithms. Such studies are also costly, sometimes requiring thousands of GPUs [38], which can quickly become infeasible if we need to repeat them every time the model is updated.
A cheaper solution is to use local perturbation methods [21], for instance, influence measures that study sensitivity of trained model to data removal (Fig. 1(a)) [8, 7]. Such methods too fall short of providing a clear understanding of sensitivity properties for generic cases. For instance, influence measures are useful to study trained models but are not suited to analyze training trajectories [14, 54]. Another challenge is in handling non-differentiable loss functions or discrete parameter spaces where a natural choice of perturbation mechanisms may not always be clear [32]. The measures also do not directly reveal the causes of sensitivities for generic ML models and algorithms.
In this paper, we simplify these issues by proposing a new method to unify, generalize, and understand perturbation methods for sensitivity analysis. We present the Memory-Perturbation Equation (MPE) as a unifying equation to understand sensitivity properties of generic ML algorithms. The equation builds upon the Bayesian learning rule (BLR) [28] which unifies many popular algorithms
*Equal contribution. Part of this work was carried out when Dharmesh Tailor was at RIKEN AIP.
$\dagger$  RIKEN Center for AI Project, Tokyo, Japan.
$^{\ddagger}$ University of Amsterdam, Amsterdam, Netherlands.
(a) Estimating the effect of an example removal
(b) Predicting test NLL during training, CIFAR10
Figure 1: Our main goal is to estimate the sensitivity of the training trajectory when examples are perturbed or simply removed; see Panel (a). We present the MPE to estimate the sensitivity without any retraining and use them to faithfully predict the test performance from training data alone; see Panel (b). The test negative log-likelihood (gray line) for ResNet-20 on CIFAR10 shows similar trends to the leave-one-out (LOO) score computed on the training data (black line).
from various fields as specific instances of a natural-gradient descent to solve a Bayesian learning problem. The MPE uses natural-gradients to understand sensitivity of all such algorithms. We use the MPE to show several new results regarding sensitivity of generic ML algorithms:
1. We show that sensitivity to a group of examples can be estimated by simply adding their natural-gradients; see Eq. 6. Larger natural-gradients imply higher sensitivity and just a few such examples can often account for most of the sensitivity. Such examples can be used to characterize the model's memory and memory-perturbation refers to the fact that the model can forget its essential knowledge when those examples are perturbed heavily.
2. We derive Influence Function [8, 31] as a special case of the MPE when natural-gradients with respect to Gaussian posterior are used. More importantly, we derive new measures that, unlike influence functions, can be applied during training for all algorithms covered under the BLR (such as those used in deep learning and optimization). See Table 1.
3. Measures derived using Gaussian posteriors share a common property: sensitivity to an example depends on the product of its prediction error and variance (Eq. 12). That is, most sensitive data lies where the model makes the most mistakes and is also least confident. In many cases, such estimates are extremely cheap to compute.
4. We show that sensitivity of the training data can be used to accurately predict model generalization, even during training (Fig. 1(b)). This agrees with similar studies which also show effectiveness of sensitivity in predicting generalization [22, 12, 19, 4].
2 Understanding a Model's Sensitivity to Its Training Data
Understanding a model's sensitivity to its training data is important but is often done by a costly process of retraining the model multiple times. For example, consider a model with a parameter vector  $\pmb{\theta} \in \mathbb{R}^{P}$  trained on data  $\mathcal{D} = \{\mathcal{D}_1, \mathcal{D}_2, \dots, \mathcal{D}_N\}$  by using an algorithm  $\mathcal{A}_t$  that generates a sequence  $\{\pmb{\theta}_t\}$  for iteration  $t$  that converges to a minimizer  $\pmb{\theta}_{*}$ . Formally, we write
$$
\boldsymbol {\theta} _ {t} \leftarrow \mathcal {A} _ {t} \left(\boldsymbol {\theta} _ {t - 1}, \mathcal {L} (\boldsymbol {\theta})\right) \quad \text {w h e r e} \mathcal {L} (\boldsymbol {\theta}) = \sum_ {i = 1} ^ {N} \ell_ {i} (\boldsymbol {\theta}) + \mathcal {R} (\boldsymbol {\theta}), \tag {1}
$$
and we use the loss  $\ell_i(\pmb{\theta})$  for  $\mathcal{D}_i$  and a regularizer  $\mathcal{R}(\pmb{\theta})$ . Because  $\pmb{\theta}_t$  are all functions of  $\mathcal{D}$  or its subsets, we can analyze their sensitivity by simply 'perturbing' the data. For example, we can remove a subset  $\mathcal{M} \subset \mathcal{D}$  to get a perturbed dataset, denoted by  $\mathcal{D}^{\backslash \mathcal{M}}$ , and retrain the model to get new iterates  $\pmb{\theta}_t^{\backslash \mathcal{M}}$ , converging to a minimizer  $\pmb{\theta}_{*}^{\backslash \mathcal{M}}$ . If the deviation  $\pmb{\theta}_t^{\backslash \mathcal{M}} - \pmb{\theta}_t$  is large for most  $t$ , we may deem the model to be highly sensitive to the examples in  $\mathcal{M}$ . This is a simple method for sensitive analysis but requires a costly brute-force retraining [38] which is often infeasible for long training trajectories, big models, and large datasets. More importantly, conclusions drawn from retraining are often empirical and may not hold across models or algorithms.
A cheaper alternative is to use local perturbation methods [21], for instance, influence measures that estimate the sensitivity without retraining (illustrated in Fig. 1(a) by the dashed red arrow). The simplest result of this kind is for linear regression which dates back to the 70s [7]. The method makes use of the stationarity condition to derive deviations in  $\pmb{\theta}_{*}$  due to small perturbations to data. For linear regression, the deviations can be obtained in closed-form. Consider input-output pairs  $(\mathbf{x}_i,y_i)$  and the loss  $\ell_{i}(\pmb {\theta}) = \frac{1}{2} (y_{i} - f_{i}(\pmb {\theta}))^{2}$  for  $f_{i}(\pmb {\theta}) = \mathbf{x}_{i}^{\top}\pmb{\theta}$  and a regularizer  $\mathcal{R}(\pmb {\theta}) = \delta \| \pmb {\theta}\| ^2 /2$  We can obtain closed-form expressions of the deviation due to the removal of the  $i$  th example as shown below (a proof is included in App. A),
$$
\boldsymbol {\theta} _ {*} ^ {\backslash i} - \boldsymbol {\theta} _ {*} = \left(\mathbf {H} _ {*} ^ {\backslash i}\right) ^ {- 1} \mathbf {x} _ {i} e _ {i}, \quad f _ {i} \left(\boldsymbol {\theta} _ {*} ^ {\backslash i}\right) - f _ {i} \left(\boldsymbol {\theta} _ {*}\right) = v _ {i} ^ {\backslash i} e _ {i}, \tag {2}
$$
where we denote  $\mathbf{H}_*^{\setminus i} = \mathbf{H}_* - \mathbf{x}_i\mathbf{x}_i^\top$  defined using the Hessian  $\mathbf{H}_* = \nabla^2\mathcal{L}(\pmb{\theta}_*)$ . We also denote the prediction error of  $\pmb{\theta}_*$  by  $e_i = \mathbf{x}_i^\top \pmb{\theta}_* - y_i$ , and prediction variance of  $\pmb{\theta}_*^{\setminus i}$  by  $v_i^i = \mathbf{x}_i^\top (\mathbf{H}_*^{\setminus i})^{-1}\mathbf{x}_i$ .
The expression shows that the influence is bi-linearly related to both prediction error and variance, that is, when examples with high error and variance are removed, the model is expected to change a lot. These ideas are generalized using infinitesimal perturbation [21]. For example, influence functions [8, 32, 31] use a perturbation model  $\pmb{\theta}_{*}^{\epsilon_{i}} = \arg \min_{\pmb{\theta}}\mathcal{L}(\pmb {\theta}) - \epsilon_{i}\ell_{i}(\pmb {\theta})$  with a scalar perturbation  $\epsilon_{i}\in \mathbb{R}$ . By using a quadratic approximation, we get the following influence function,
$$
\left. \frac {\partial \boldsymbol {\theta} _ {*} ^ {\epsilon_ {i}}}{\partial \epsilon_ {i}} \right| _ {\epsilon_ {i} = 0} = \mathbf {H} _ {*} ^ {- 1} \nabla \ell_ {i} \left(\boldsymbol {\theta} _ {*}\right). \tag {3}
$$
This works for a generic differentiable loss function and is closely related to Eq. 2. We can choose other perturbation models, but they often exhibit bi-linear relationships; see App. A for details.
Despite their generality, there remain many open challenges with the local perturbation methods:
1. Influence functions are valid only at a stationary point  $\theta_{*}$  where the gradient is assumed to be 0, and extending them to iterates  $\theta_{t}$  generated by generic algorithmic-steps  $\mathcal{A}_t$  is nontrivial [14]. This is even more important for deep learning where we may never reach such a stationary point, for example, due to stochastic training or early stopping [33, 53].
2. Applying influence functions to a non-differentiable loss or discrete parameter spaces is difficult. This is because the choice of perturbation model is not always obvious [32].
3. Finally, despite their generality, these measures do not directly reveal the causes of high influence. Does the bi-linear relationship in Eq. 2 hold more generally? If yes, under what conditions? Answers to such questions are currently unknown.
Studies to fix these issues are rare in ML, rather it is more common to simply use heuristics measures. Many such measures have been proposed in the recent years, for example, those using derivatives with respect to inputs [23, 2, 38], variations of Cook's distance [17], prediction error and/or gradients [3, 51, 42, 40], backtracking training trajectories [16], or simply by retraining [13]. These works, although useful, do not directly address the issues. Many of these measures are derived without any direct connections to perturbation methods. They also appear to be unaware of bi-linear relationships such as those in Eq. 2. Our goal here is to address the issues by unifying and generalizing perturbation methods of sensitivity analysis.
3 The Memory-Perturbation Equation (MPE)
We propose the memory-perturbation equation (MPE) to unify, generalize, and understand sensitivity methods in machine learning. We derive the equation by using a property of conjugate Bayesian models which enables us to derive a closed-form expression for the sensitivity. In a Bayesian setting, data examples can be removed by simply dividing their likelihoods from the posterior [52]. For example, consider a model with prior  $p_0 = p(\pmb{\theta})$  and likelihood  $\tilde{p}_j = p(\mathcal{D}_j|\pmb{\theta})$ , giving rise to a posterior  $q_* = p(\pmb{\theta}|\mathcal{D}) \propto p_0\tilde{p}_1\tilde{p}_2 \ldots \tilde{p}_N$ . To remove  $\tilde{p}_j$ , say for all  $j \in \mathcal{M} \subset \mathcal{D}$ , we simply divide  $q_*$  by those  $\tilde{p}_j$ . This is further simplified if we assume conjugate exponential-family form for  $p_0$  and  $\tilde{p}_j$ . Then, the division between two distributions is equivalent to a subtraction between their natural parameters. This property yields a closed-form expression for the exact deviation, as stated below.
Theorem 1 Assuming a conjugate exponential-family model, the posterior  $q_*^{\backslash \mathcal{M}}$  (with natural parameter  $\lambda_*^{\backslash \mathcal{M}}$ ) can be written in terms of  $q_*$  (with natural parameter  $\lambda_*$ ), as shown below:
$$
q _ {*} ^ {\backslash \mathcal {M}} \propto \frac {q _ {*}}{\prod_ {j \in \mathcal {M}} \tilde {p} _ {j}} \quad \Longrightarrow e ^ {\langle \boldsymbol {\lambda} _ {*} ^ {\backslash \mathcal {M}}, \mathbf {T} (\boldsymbol {\theta}) \rangle} \propto \frac {e ^ {\langle \boldsymbol {\lambda} _ {*} , \mathbf {T} (\boldsymbol {\theta}) \rangle}}{\prod_ {j \in \mathcal {M}} e ^ {\langle \widetilde {\boldsymbol {\lambda}} _ {j} , \mathbf {T} (\boldsymbol {\theta}) \rangle}} \quad \Longrightarrow \boldsymbol {\lambda} _ {*} ^ {\backslash \mathcal {M}} = \boldsymbol {\lambda} _ {*} - \sum_ {j \in \mathcal {M}} \widetilde {\boldsymbol {\lambda}} _ {j}. (4)
$$
where all exponential families are defined by using inner-product  $\langle \pmb{\lambda}, \mathbf{T}(\pmb{\theta}) \rangle$  with natural parameters  $\pmb{\lambda}$  and sufficient statistics  $\mathbf{T}(\pmb{\theta})$ . The natural parameter of  $\tilde{p}_j$  is denoted by  $\tilde{\lambda}_j$ .
The deviation  $\lambda_{*}^{\backslash \mathcal{M}} - \lambda_{*}$  is obtained by simply adding  $\widetilde{\lambda}_j$  for all  $j\in \mathcal{M}$ . Further explanations and examples are given in App. B, along with some elementary facts about exponential families. We use this result to derive an equation that enables us to estimate the sensitivity of generic algorithms.
Our derivation builds on the Bayesian learning rule (BLR) [28] which unifies many algorithms by expressing their iterations as inference in conjugate Bayesian models [26]. This is done by reformulating Eq. 1 in a Bayesian setting to find an exponential-family approximation  $q_{*} \approx p(\pmb{\theta}|\mathcal{D}) \propto e^{-\mathcal{L}(\pmb{\theta})}$ . At every iteration  $t$ , the BLR updates the natural parameter  $\lambda_t$  of an exponential-family  $q_{t}$  which can equivalently be expressed as the posterior of a conjugate model (shown on the right),
$$
\boldsymbol {\lambda} _ {t} \leftarrow (1 - \rho) \boldsymbol {\lambda} _ {t - 1} - \rho \sum_ {j = 0} ^ {N} \tilde {\mathbf {g}} _ {j} \left(\boldsymbol {\lambda} _ {t - 1}\right) \quad \Longleftrightarrow \quad q _ {t} \propto \underbrace {\left(q _ {t - 1}\right) ^ {1 - \rho} \left(p _ {0}\right) ^ {\rho}} _ {\text {P r i o r}} \prod_ {j = 1} ^ {N} e \underbrace {\langle - \rho \tilde {\mathbf {g}} _ {j} \left(\boldsymbol {\lambda} _ {t - 1}\right) , \mathbf {T} (\boldsymbol {\theta}) \rangle} _ {\text {L i k e l i h o o d}} \tag {5}
$$
where  $\tilde{\mathbf{g}}_j(\boldsymbol {\lambda}) = \mathbf{F}(\boldsymbol {\lambda})^{-1}\nabla_{\boldsymbol{\lambda}}\mathbb{E}_q[\ell_j(\boldsymbol {\theta})]$  is the natural gradient with respect to  $\pmb{\lambda}$  defined using the Fisher Information Matrix  $\mathbf{F}(\pmb {\lambda}_t)$  of  $q_{t}$ , and  $\rho >0$  is the learning rate. For simplicity, we denote  $\ell_0(\pmb {\theta}) = \mathcal{R}(\pmb {\theta}) = -\log p_0$ , and assume  $p_0$  to be conjugate. The conjugate model on the right uses a prior and likelihood both of which, by construction, belong to the same exponential-family as  $q_{t}$ . By choosing an appropriate form for  $q_{t}$  and making necessary approximations to  $\tilde{\mathbf{g}}_j$ , the BLR can recover many popular algorithms as special cases. For instance, using a Gaussian  $q_{t}$ , we can recover stochastic gradient descent (SGD), Newton's method, RMSprop, Adam, etc. For such cases, the conjugate model at the right is often a linear model [25]. These details, along with a summary of the BLR, are included in App. C. Our main idea is to study the sensitivity of all the algorithms covered under the BLR by using the conjugate model in Eq. 5.
Let  $q_{t}^{\backslash \mathcal{M}}$  be the posterior obtained with the BLR but without the data in  $\mathcal{M}$ . We can estimate its natural parameter  $\lambda_t^{\backslash \mathcal{M}}$  in a similar fashion as Eq. 4, that is, by dividing  $q_{t}$  by the likelihood approximation at the current  $\lambda_{t}$ . This gives us the following estimate of the deviation obtained by simply adding the natural-gradients for all examples in  $\mathcal{M}$ ,
$$
\hat {\boldsymbol {\lambda}} _ {t} ^ {\backslash \mathcal {M}} - \boldsymbol {\lambda} _ {t} = \rho \sum_ {j \in \mathcal {M}} \tilde {\mathbf {g}} _ {j} (\boldsymbol {\lambda} _ {t}) \tag {6}
$$
where  $\hat{\lambda}_t^{\backslash \mathcal{M}}$  is an estimate of the true  $\lambda_t^{\backslash \mathcal{M}}$ . We call this the memory-perturbation equation (MPE) due to a unique property of the equation: the deviation is estimated by a simple addition and characterized solely by the examples in  $\mathcal{M}$ . Due to the additive nature of the estimate, examples with larger natural-gradients contribute more to it and so we expect most of the sensitivity to be explained by just a few examples with largest natural gradients. This is similar to the representer theorem where just a few support vectors are sufficient to characterize the decision boundary [29, 47, 10]. Here, such examples can be seen as characterizing the model's memory because perturbing them can make the model forget its essential knowledge. The phrase memory-perturbation signifies this.
The equation can be easily adopted to handle an arbitrary perturbation. For instance, consider perturbation  $\mathcal{L}(\pmb{\theta}) - \sum_{j\in \mathcal{M}}\epsilon_j\ell_j(\pmb{\theta})$ . To estimate its effect, we divide  $q_{t}$  by the likelihood approximations raised to  $\epsilon_{i}$ , giving us the following variant,
$$
\hat {\boldsymbol {\lambda}} _ {t} ^ {\boldsymbol {\epsilon} _ {\mathcal {M}}} - \boldsymbol {\lambda} _ {t} = \rho \sum_ {j \in \mathcal {M}} \epsilon_ {j} \tilde {\mathbf {g}} _ {j} (\boldsymbol {\lambda} _ {t}), \quad \Longrightarrow \quad \left. \frac {\partial \hat {\boldsymbol {\lambda}} _ {t} ^ {\boldsymbol {\epsilon} _ {\mathcal {M}}}}{\partial \epsilon_ {j}} \right| _ {\epsilon_ {j} = 0} = \rho \tilde {\mathbf {g}} _ {j} (\boldsymbol {\lambda} _ {t}), \quad \forall j \in \mathcal {M}, \tag {7}
$$
where we denote all  $\epsilon_{j}$  in  $\mathcal{M}$  by  $\epsilon_{\mathcal{M}}$ . Setting  $\epsilon_{j} = 1$  in the left reduces to Eq. 6 which corresponds to removal. The example demonstrates how to adopt the MPE to handle arbitrary perturbations.
3.1 Unifying the existing sensitivity measures as special cases of the MPE
The MPE is a unifying equation from which many existing sensitivity measures can be derived as special cases. We will show three such results. The first result shows that, for conjugate models, the MPE recovers the exact deviations given in Thm. 1. Such models include textbook examples [6], such as, mixture models, linear state-space models, and PCA. Below is a formal statement.
Theorem 2 For conjugate exponential-family models, Eq. 4 is obtained as a special case of the MPE in Eq. 6 evaluated at  $\lambda_{*}$  of the exact posterior  $q_{*}$  when we set  $\ell_j(\pmb{\theta}) = -\log \tilde{p}_j$  and  $\rho = 1$ .
The result holds because, for conjugate models, one-step of the BLR is equivalent to Bayes' rule and therefore  $\widetilde{\mathbf{g}}_j(\boldsymbol{\lambda}_*) = -\widetilde{\boldsymbol{\lambda}}_j$  (see [24, Sec. 5.1]). A proof is given in App. D along with an illustrative example on the Beta-Bernoulli model. We note that a recent work in [49] also takes inspiration from Bayesian models, but their sensitivity measures lack the property discussed above. See also [15] for a different approach to sensitivity analysis of variational Bayes with a focus on the posterior mean. The result above also justifies setting  $\rho$  to 1, a choice we will often resort to.
Our second result is to show that the MPE recovers the influence function by Cook [7].
Theorem 3 For linear regression, Eq. 2 is obtained as a special case of the MPE in Eq. 6 evaluated at  $\lambda_{*}$  of the exact posterior  $q_{*} = \mathcal{N}(\pmb{\theta}|\pmb{\theta}_{*},\mathbf{H}_{*}^{-1})$
The proof in App. E relies on two facts: first, the natural parameter is  $\pmb{\lambda}_{*} = (\mathbf{H}_{*}\pmb{\theta}_{*}, - \frac{1}{2}\mathbf{H}_{*})$ , and second, the natural gradients for a Gaussian  $q$  with mean  $\mathbf{m}$  can be written as follows,
$$
\tilde {\mathbf {g}} _ {i} (\boldsymbol {\lambda}) = \left(\hat {\mathbf {g}} _ {i} - \hat {\mathbf {H}} _ {i} \mathbf {m}, \frac {1}{2} \hat {\mathbf {H}} _ {i}\right), \tag {8}
$$
where  $\hat{\mathbf{g}}_i = \mathbb{E}_q[\nabla \ell_i(\pmb {\theta})]$  and  $\hat{\mathbf{H}}_i = \mathbb{E}_q[\nabla^2\ell_i(\pmb {\theta})]$ . This is due to [28, Eqs. 10-11], but a proof is given in Eq. 27 of App. C. The theorem then directly follows by plugging  $\tilde{\mathbf{g}}_i(\boldsymbol {\lambda}_*)$  in Eq. 6. This derivation is much shorter than the classical techniques which often require inversion lemmas (see App. A.1). The estimated deviations are exact, which is not a surprise because linear regression is a conjugate Gaussian model. However, it is interesting (and satisfying) that the deviation in  $\pmb{\theta}_{*}$  naturally emerges from the deviation in  $\lambda_{*}$ .
Our final result is to recover influence functions for deep learning, specifically Eq. 3. To do so, we use a Gaussian posterior approximation  $q_{*} = \mathcal{N}(\boldsymbol{\theta}|\boldsymbol{\theta}_{*},\mathbf{H}_{*}^{-1})$  obtained by using the so-called Laplace's method [34, 50, 37]. The Laplace posterior can be seen as a special case of the BLR solution when the natural gradient is approximated with the delta method [28, Table 1]. Remarkably, using the same approximation in the MPE, we recover Eq. 3.
Theorem 4 The influence function in Eq. 3 is obtained as a special case of the MPE in Eq. 7 evaluated at  $\pmb{\lambda}_{*}$  of the posterior  $q_{*} = \mathcal{N}(\pmb {\theta}|\pmb{\theta}_{*},\mathbf{H}_{*}^{-1})$  when we approximate  $\tilde{\mathbf{g}}_i(\pmb {\lambda})$  of Eq. 8 with the delta method by substituting  $\mathbb{E}_{q_*}[\nabla \ell_i(\pmb {\theta})]\approx \nabla \ell_i(\pmb {\theta}_*)$  and  $\mathbb{E}_{q_*}[\nabla^2\ell_i(\pmb {\theta})]\approx \nabla^2\ell_i(\pmb {\theta}_*)$
A proof is in App. F. We note that Eq. 3 can be justified as a Newton-step over the perturbed data but in the opposite direction [32, 31]. In a similar fashion, Eqs. 6 and 7 can be seen as natural-gradient steps in the opposite direction. Using the natural-gradient descent, as we have shown, can recover a variety of existing perturbation methods as special cases.
3.2 Generalizing the perturbation method to estimate sensitivity during training
Influence measures discussed so far assume that the model is already trained and that the loss is differentiable. We will now present generalizations to obtain new measures that can be applied during training and do not require differentiability of the loss. We will focus on Gaussian  $q$  but the derivation can be extended to other posterior forms. The main idea is to specialize Eqs. 6 and 7 to the algorithms covered under the BLR, giving rise to new measures that estimate sensitivity by simply taking a step over the perturbed data but in the opposite direction.
We first discuss sensitivity of an iteration  $t$  of the BLR yielding a Gaussian  $q_{t} = \mathcal{N}(\pmb {\theta}|\mathbf{m}_{t},\mathbf{S}_{t}^{-1})$ . The natural parameter is the pair  $\lambda_{t} = (\mathbf{S}_{t}\mathbf{m}_{t}, - \frac{1}{2}\mathbf{S}_{t})$ . Using Eq. 8 in Eq. 6, we get