Intriguing Properties of Data Attribution on Diffusion Models
Authors: Xiaosen Zheng
Tianyu Pang
Chao Du
Jing Jiang
Min Lin
Venue: ICLR 2024 poster (2024)
Keywords: Data Attribution
Diffusion Models
Primary area: visualization or interpretation of learned representations
TL;DR: We report counter-intuitive observations that theoretically unjustified design choices for attributing diffusion models empirically outperform previous baselines by a large margin.

Abstract: Data attribution seeks to trace model outputs back to training data. With the recent development of diffusion models, data attribution has become a desired module to properly assign valuations for high-quality or copyrighted training samples, ensuring that data contributors are fairly compensated or credited. Several theoretically motivated methods have been proposed to implement data attribution, in an effort to improve the trade-off between computational scalability and effectiveness. In this work, we conduct extensive experiments and ablation studies on attributing diffusion models, specifically focusing on DDPMs trained on CIFAR-10 and CelebA, as well as a Stable Diffusion model LoRA-finetuned on ArtBench. Intriguingly, we report counter-intuitive observations that theoretically unjustified design choices for attribution empirically outperform previous baselines by a large margin, in terms of both linear datamodeling score and counterfactual evaluation. Our work presents a significantly more efficient approach for attributing diffusion models, while the unexpected findings suggest that at least in non-convex settings, constructions guided by theoretical assumptions may lead to inferior attribution performance. The code is available at https://github.com/sail-sg/D-TRAK.

Published as a conference paper at ICLR 2024
INTRIGUING PROPERTIES OF DATA ATTRIBUTION ON DIFFUSION MODELS
Xiaosen Zheng"!, Tianyu Pang Chao Du Jing Jiang Min Lin
'Singapore Management University
Sea Al Lab, Singapore
(zhengxs, tianyupang, duchao, 1inmin/ @sea. com; jingjiang@ edu. sg
ABSTRACT
Data attribution seeks to trace model outputs back to training data. With the recent development of diffusion models, data attribution has become desired module to properly assign valuations for high-quality or copyrighted training samples, ensur- ing that data contributors are fairly compensated credited. Several theoretically motivated methods have been proposed to implement data attribution, in an effort improve the trade-off between computational scalability and effectiveness. In this work, we conduct extensive experiments and ablation studies on attributing diffusion models, specifically focusing on DDPMs trained on CIFAR- and CelebA, as well as Stable Diffusion model Intriguingly, we report counter-intuitive observations that theoretically unjustified design choices for attribution empirically outperform previous baselines by a large margin, in terms of both linear datamodeling score and counterfactual evaluation. Our work presents significantly more efficient approach for attributing diffusion models, while the unexpected findings suggest that at least in non-convex settings, constructions guided by theoretical assumptions may lead inferior attribution performance. The code is available at https://githu..com// -asi//ailgg//D-TRRKKK
on ArtBench.
INTRODUCTION
Training data plays a pivotal role in determining the behavior of machine learning models. To this end, the goal data attribution is to precisely indicate the importance of each training data in relation to the model outputs of interest. Data attribution has been extensively utilized to interpret model predictions (Koh & Liang, 2017; Yeh et al., 2018; Ilyas et al., 2022), detect poisoning attacks or noisy labels (Hammoudeh & Lowd, 2022a; Lin et al., 2022), curate data (Khanna al., 2019; Jia et al., 2021; Liu et al., 20,1), debug model behavior (Kong et al., 2022), and understand conventional generative models such GANs and VAEs (Kong& & Chaudhuri, 2021; Terashita et al., 2021).
On the other hand, diffusion models have made promising progress on generative tasks (Ho et al., 2020; Song al., 2021b). and they have gained popularity alongside open-soureed large diffusion models such as Stable Diffusion (Rombach et al., 2022). Numerous applications employ customized variants of Stable Diffusion that personalized via LoRA (Hu et al., 2022) ControlNet (Zhang et al., 2023). However, the emerging success and potent ability of diffusion models raise legal and ethical concerns, particularly in domains such as artistic creation where data contributors (c.g., artists) seek fair compensation or credit. In this regard, data attribution acts as an essential module to properly assign valuations for high-quality or copyrighted training samples.
Along the research routine of implementing different methods for data attribution, there is recurring trade-off between computational scalability and effectiveness (Koh & Liang, 2017; Ghorbani & Zou, 2019; Feldman & Zhang, 2020; Pruthi et al., 2020; llyas et al., 2022; Schioppa et al., 2022), especially non-convex settings. Recently, Park al. (2023) develop an attribution method called TRAK that is both effective and computationally tractable for large-scale models. Georgiev et al. (2023) makes additional use of TRAK on diffusion models to attribute newly generated images to training data.
In this work, we conduct comprehensive experiments and ablation studies attributing diffusion models. In addition to taking TRAK as a strong baseline, we evaluate several prevalent attribution
Work done during internship Sea AT Lab. *Corresoondigg authors.

---

Published as a conference paper at ICLR 2024
approaches. Intriguingly, report counter- intuuttvi observations that after integrating theoretically unjustiffed design choices into TRAK (the resulting method is named diffusion- diffusion-TRAK, D-TRAK), our D-TRAK method consistently outperforms previous baselines including TRAK, in terms of both linear datamodeling score (Park et al., 2023) and counterfactual evaluation (Hooker et al., 2019; Ilyas al., 2022). Furthermore, D-TRAK has number of empirical advantages such as insensitivity to checkpoint selection and fewer timestep requirements, as described in Section 4.
Although D-TRAK is empirically appealing for attributing diffusion models, is challenging to provide a satisfactory theoretical explanation for questions such as "why D-TRAK performs better than TRAK?" or "are there better design choices than D-TRAK?". Therefore, the unanticipated results reported in this paper suggest that, at least in non-convex settings, theoretically motivated (under simplified assumptions) constructions are not necessarily superior design choices for practical attribution problems, and that the mechanism of data attribution requires a deeper understanding.
2
PRELIMINARIES
This section provides a concise overview of diffusion models, the definition of data attribution, the evaluation metries associated with it, and advanced methods for attribution.
2.1
DIFFUSION MODELS
Our research primarily focuses on discrete-time diffusion models, specifically denoising diffusion probabilistic models (DDPMs) (Ho et al., 2020) and latent diffusion models (LDMs) that serve as the foundation of Stable Diffusion (Rombach et al., 2022). Below we briefly recap the notations of DDPMs, where consider random variable on F1.T E1.-.. DT with T E N+. The data distribution is q(x) and the Markov transition probability from .;-1 to æ; is ( 1x.-1) - N(xx/ 3, B,II,, where 2n and B1, ........ ... ,,r correspond to a variance schedule. A notable property of DDPMs is that they can sample æ; at an arbitrary timestep & directly from æ, since there is q(2,/2x) = ( (1-ā))I), where 02 - 1 3, and ā e I Og Sohl-Dickstein et al. (2015) show that when 3r are small, the reverse diffusion process can also be modeled by Gaussian conditionals.
X and define a forward diffusion process
Specifically, for the DDPMs framework, the reverse transition probability from æ; to xt-1 written as (o [x;) (mt-1//alf f), If where 0 E Rd is the model parameters and Ø; are time dependent constants that can be predefined or analytically computed (Bao et al., 2022). Instead of directly modeling the data prediction μag DDPMs choose to model the noise prediction eg based on the parameterization [ t)
Vas ctz - Eo (Z d)). The training objective of é (2i, t) can be derived from optimizing the variational bound of negative log likeeeilloood formulated follows:
(aLBO( 0) = Er,t 20000111 oz) ||e Ea E
a. + v1 dr,e, 011
where e ~ NCc[o, I) and t ~ 2((1, denotes the discrete uniform distribution between and T. Jn=1 be a training dataset that x." ~ q(x). then the empirical training objective on D can be written as (D: 0) = ExneD SELBo(x" A). To benefit sample quality, DDPMs apply a simplified training objective that corresponds to weighted variational bound and is formulated as
Let D A {xm)
Simple (ax; 0) Ee,, ||c (c-Eolvan Volv + Vi- 1)
where the empirical objective on DD is similarly written as Simple (D: = N ExneD fsimple 0).
2.2 DATA ATTRIBUTION AND EVALUATION METRICS
Data attribution refers to the goal of tracing model outputs back to training data. We follow Park et al. (2023) and recap the formal definition of data attribution below:
Definition 1 (Data attribution). Consider an ordered training set of samples a {x and model output function Fxx;0) ). A data attribution method T(x, D) is function T X x X + R that, for any sample x X and a training set D. assigns a score to each training input xx D indicating its importance to the model output F(x; 6* (D)), where 6* (DD = arg min, C(D: 0).
We apply bold symbols of F and L to highlight the model output function and training objective in the defini- tion of data attribution, respectively, to distinguish them from the functions used in specific attribution methods.
2

---

Published as a conference paper at ICLR 2024
There have been various metrics to evaluate data attribution methods, including leave-one-out influences (Koh & Liang, 2017; Koh et al., 2019; Basu et al., 2021), Shapley values (Ghorbani & Zou, 2019), and performance
auxiliary tasks (Jia et al., 2021; Hammoudeh & Lowd, 2022a). However, these metrics may pose computational challenges in large-scale scenarios or be influenced by the specific characteristics of the auxiliary task. In light of this, Park al. (2023) propose the linear datamodeling score (LDS), which considers the sum of attributions as an additive proxy for FF, new metric for evaluating data attribution methods. In accordance with Definition we define the attribution priibuttoo--bsedd output prediction of the model output F(x;; 0 (D')) as
(x. D':D) A Σ ET(x,
where D' is a subset of D D' D. Then the LDS metric can be constructed as follows:
Definition 2 (Linear datamodeling score). Considering a training set D, a model output function F)x; and a corresponding data attribution method т. Let (D" } be M randomly sampled subsets of the training dataset 'D that D C D, each of size a N for some a E (0, 1). The linear datumodeling score (LDS) of data altribution T for a specific sample x E X is given by
LDS(T, x)) & ({F((x; (0 (D"))) : m E [M]. for (xx :D; m E [M])),
(4)
where p denotes Spearman rank correlation (Spearman, 1987).
To counter the randomness of the training mechanism (the process of approximating 0* (D"")), for every subset D we train three models with different random seeds and average the model output function. We also consider the counterfactual evaluation to study the utility of different attribution methods, following common practice (Hooker et al., 2019; Feldman & Zhang, 2020; Ilyas et al., 2022; Park et al., 2023; Brophy et al., 2023; Georgiev et al., 2023). We compare the pixel-wise l2-distance and CLIP cosine similarity of generated images, using the models trained before/after the exclusion of the highest-ranking positive influencers identified by different attribution methods.
2.3 ATTRIBUTION METHODS
The primary interface employed by attribution methods is the score Tax D), which is calculated for each training input to indicate its importance to the output of interest. From robust statisties (Cook & Weisberg, 1982; Hampel et al., 2011), influence functions are classical concept that approximates how much an infinitesimally up-weighting of training sample x. E DD affects the model output func- tion F (a:; (²), measured on an sample of interest æ. In the convex setting, Koh & Liang (2017) show that the attributing score of influence function can be computed as TF D), = V 0²)
H.. VoL(""" 0*) for n E [N], where Ho- V (D; 0*) ) is the Hessian matrix at the optimal parameters 0" Previous work has shown that computing the inverse of the Hessian matrix exhibits nu- merical instability, particularly when dealing with deep models (Basu et al., 2021; Pruthi et al., 2020). In more recent approaches, the Hessian matrix is substituted with the Fisher information matrix (Ting & Brochu, 2018; Barshan et al., 2020; Teso et al., 2021; Grosse et al., 2023). In contrast, retraining- based methodologies demonstrate greater efficacy in accurately assigning predictions to training data, albeit necessitating the training of numerous models, ranging from thousands to tens of thousands, achieve desired effectiveness (Ghorbani & Zou, 2019; Feldman & Zhang, 2020; Ilyas et al., 2022).
Tracing with the candomly-projected after kernel (TRAK). In a more recent study, Park et al. (2023) develop approach known as TRAK, which aims to enhance the efficiency and scalability of attributing discriminative classifiers. In the TRAK algorithm, a total of S subsets denoted as {D {D=}s 1 are initially sampled from the training dataset D, where each subset has fixed size of B N for 3 E (0. 1].2 On each subset D=, a model is trained to obtain the parameters 0 E Rd and a random projection matrix P. sampled from (0, 1)dxk (typically there is < d). Then TRAK constructs the projected gradient matrices DRAA and the weighting terms ΦiRAK
PRAA = [[0'(z)) (] where (²(x) P.
dC
(5)
2 diag (x*))) Q'(x<'()) where Q' (x(x)=
(x; 0*).
OF
"The values of and $ in TRAK different from M and a that applied for computing L.D in Definition 2.
3

---

Published as a conference paper at ICLR 2024
Table 1: LDS (%) on CIFAR-2 with different constructions of (x)).. All the values of LDS are calculated with F C = Simple. and the model is a DDPM with I' 1000. We select 10, 100, and 1000 timesteps evenly spaced within the interval [1, I] to approximate the expectation E,. For each sampled timestep, we sample one standard Gaussian noise e ~ (c(0. to approximate the expec- tation Eg, The projection dimension of each Ps should be reasonable design choice for attributing DDPMs, it is counter-intuitive to observe that using ø² constructed by Lsquiee Layg. 2- and L-mor consistently achieve higher values of LDS.
4096. While (0))) = P. V Simple (z) 0g)
Validation
Generation
Method
Construction of (x:)
10
100
1000
10
100
1000
TRAK
P. V Ssimpto (x. 8%))
10.66
19.50
22.42
5.14
12.05
15.46
PT V o BLO
x 02)
8.46
9.07
13.19
3.49
3.83
5.80
P
V Square
(z, ())
24.78
30.81
32.37
16.20
22.62
23.94
D-TRAK (Ours)
P V Avg ar, 0%)
24.91
29.15
30.39
16.76
20.82
21.48
P V L mmomm (x, 0%)
23.44
30.36
32.29
15.10
21.99
23.78
P V L2 morm
xx, )
24.72
30.91
32.35
15.75
22.44
23.82
P. V ooo-nom (x,
5.22
11.54
22.25
3.99
8.11
15.94
Finally, the attribution score TTRAK D) of TRAK is computed by
S
8
TTRAK (TRAK(2: D)
8" (x) @DiRAK PiRAK)
PiRAK TRAK
ΦiRAK
(6)
5
In the discriminative classification cases, Park et al. (2023) design the model output function to be F F(:;; 0) = log(exp([(x:; 0)) according to the mechanism of logistic regression.
3 DATA ATTRIBUTION ON DIFFUSION MODELS
In the context of generative models, such as diffusion models, it is crucial to accurately attribute the generated images the corresponding training images. This attribution serves the purpose of appropriately assigning credits or valuations, as well as safeguarding copyright (Ghorbani Zou, 2019; Dai Gifford, 2023; Wang et al., 2023; Georgiev al., 2023). Although the study of data attribution has primarily focused on discriminative classification problems, the Definition of data attribution and evaluation metric LDS in Definition 2 can also be applied to generative cases.
3.1 DIFFUSION- TRAK
In our initial trials, we attempt to adopt TRAK for attributing images generated by DDPMs, drawing in- spiration from the implementation described by Georgiev et al. (2023).* To be specific, given a DDPM trained by minimizing L(D;)) 0) = Simple (D: 0). there is l (D) = arg min, Ssiplee (D; (D; 0) and we set the model output function be F (a:; f)) L (r:; 0) = Simple ax, )). this particular configuration, when we compute the attribution score of TRAK Eq. (6), the weighting terms 2 = 8C become identity matrices, and the function of is constructed as (xx))) = P.
aF
P.VVo V (zr 0*)
Counter-intuitive observations. Intuitively, it seems reasonable to consider TRAK with d² (x)
P. V Ciimmee (x, 02) as a suitable approach for attributing DDPMs. This is particularly applicable in the context of initial trials, where both L and F are LSimple. Nevertheless, we fortuitously observe that replacing é. (x) with alternative functions can result in higher values of LDS. Specifically, we study a generalization of the TRAK formula, which we refer as diffusion iiffusion-TRAK (D-TRAK):
8 2 (x())" ( (DO-TRAK 2 D-TRAK
TD-TRAK (2, (x, D) =
&e D-TRAK
(7)
where & -[oo(x) ::... <
(2x } are the projected gradient matrices. In contrast the
TRAK formula in Eq. (6). D-TRAK allows de to be constructed from alternative functions, rather than
relying on F as (z)))) P. VoF(x B?). The weighting terms are eliminated (i.e., Q = I)
Georgiev (2023) focus attributing noisy images æe, while attribute the finally generated image a..
4

---

Published as a conference paper at ICLR 2024
36
36
32
32-
24
28
26
24
20
20
20
LDS
0.4 055 0.6
60 611 06 0.7 038 00 022 0.3
0.9 1.
1
(a) # of timesteps
(b) # of timesteps 100
(c) # timesteps is 1000
Figure 1: LDS (%) on CIFAR-2, where 6² is constructed by the interpolation described in Section 3.2 for 17 E [0, 1J. The experimental setup employed is identical to that outlined in Table 1. The three subplots are associated with 10, 100, and 1000 timesteps selected to be evenly spaced within the interval [1. Ti, respectively, which are used to approximate the expectation E, over t ~ ([[1,T]).
under the assumption that L and IF are the same. In addition to Lsimple and LELBO. we define Lsquare: Livg: and Cp norm to the alternative functions constructing 6² D-TRAK, formulated as
Squure (x, Er,e (2 sr, 11]] Lavg (x. (x,0) Er.. (Ea(a;, 1))]; Cp-nomm (x. 0) -Er.e [ 01pp]
where T2 = / + -- E and Avg(.) X' -> R is the average pooling operation. We instantiate
p 1, 2, 00 for Cy-norm. Our preliminary results are concluded in Table where we train DDPM with 7' = 1000 on CIFAR-2 (a subset consisting of two classes from CIFAR-10), We compute the values LDS on the validation set (original test images) and generation set (newly generated images) w.r.t. the training samples. Regarding the trade-off between computational demand and efficiency, we consider different numbers of timesteps (e.g.. 10, 100, and 1000) sampled from U([1, T)) to approximate the expectation of E,, where these timesteps are selected to be evenly spaced within the interval [1, 7] (by the a arange operation). As can be seen from Table 1, D-TRAK constructed from Lsqure. Cavgs 22-nom. and L-nnom consistently outperform TRAK by large margin.
3.2 INTERPOLATION BETWEEN LSIMPLE AND LSQUARE
The counter-intuitive results in Table I pose challenge in terms of theoretical explanation. It is noteworthy that several alternative functions, namely Lsquare. Lavg. L2-norm. and Li-norm, consistently outperform the seemingly reasonable choice of Liimple- To take a closer look on how these phenomena occur, we take Lsqure as an object of study, and expand the gradients of Simple and Lsquure as
VoLsimple Er,e 2 (Co
- (co-
Voco) and VoLsquare Et,e [2 Cg Voco].
(8)
where omit the dependence and V Squaree share the same term of Veeg, and the difference is that they product V with 2 (Ea -c) and cj. respectively. We deduce that the information of Voco is better retained in the norm-based losses. Hence, we perform interpolation on these two loss functions and subsequently utilize the resulting function to construct d in D-TRAK:
and for the simplicity of notations. We can find that VoLsimple
d'( P. Ve [mquuee + +1 (Csimple- - Square) ) (xx 03) 1E,, 2 (NE-- (1- E)
V
where 7) [0, the interpolation hyperparameter. When v = 0.5, there is d) PPP V Simple corresponding to TRAK (the constant factor does not affect L.S);; when = 1, there is 6² d'(x))
P. V corresponding to D-TRAK (Lsquare) shown in Table 1. Full results of the LDS values w.r.t. various interpolation values 17 presented in Figure 1. It can be seen that TRAK (i.c., 17 0.5) has the poorest performance compared to other interpolations. Moreover, as the value of 1 diverges further from 0.5, approaching either 1, the corresponding LDS values increase.
In Appendix B, we conduct additional ablation studies on the effects different implementation details. Our findings indicate that at least for the DDPM trained on CIFAR-2, D-TRAK (Lsquare) consistently achieves superior performance compared to TRAK. This empirical evidence motivates us replicate these unexpected findings across various diffusion models and datasets.
4 EXPERIMENTS
In this section, we perform comparative analyses between D-TRAK (Esquare) and existing data attri- bution methods across various settings. The primary metrics employed for evaluating attribution are LDS and counterfactual generations. Additionally, we visualize the attributions for manual inspection. We show that our D- D-TRAK achieves significantly greater efficacy and computational efficiency.
5

---

Published as a conference paper at ICLR 2024
Table 2: LDS (%) of retraining-fre methods on CIFAR-2/CIFAR- with various # of timesteps (10 or 100). indicates applying TRAK's scalability optimizations described in Appendix A.3.
Results on CIEAR-2
Validation
Generation
Method
10
100
10
100
Raw pixel (dot prod.)
7.77 + 0.57
4.89 + 0,58
Raw pixel (cosine)
7.87 + 0.57
5.44 = 0.57
CLIP similarity (dot prod.)
6.51 + 1.06
3.00 + 0.95
CLIP similarity (cosine)
8.54 1:
4.01 + 0.85
Gradient (dot prod.) (Charpiat al., 2019)
5.14 + 0.60
5.07 0.55
2,80 = 0.55
4.03 0.51
Gradient (cosine) (Charpiat et al., 2019)
5.08 + 0.59
4.89 + 0.50
2.78 + 0.54
3.92 + 0.49
TracInCP (Pruthi et al., 2020)
6.26 + 0.84
5,47
+ 0.87
3.76 0.61
3.70 + 0.66
GAS (Hammoudeh & Lowd, 2022a)
5.78 + 0.82
5.15 + 0.87
3.30 0.68
Journey TRAK (Georgiev et al., 2023)
/
7.73 0.65
12.21 + 0.46
Relative IF (Barshan al., 2020)
11.20 0.51
23.43 = 0.46
5.86 = 0.48
0.39
Renorm. IFt (Hammoudeh & Lowd, 2022a)
10.89 + 0.46
21.46
= 0.42
5.69
14.65 + 0.37
TRAK (Park et al., 2023)
11.42 - 0.49
23.59
0.46
5.78 = 0.48
15.87 0.39
D-TRAK (Ours)
26.79 + 0.33
33.74
0.37
18.82
0.43
25.67 0.40
Results on CIFAR-10
Validation
Generation
Method
10
100
10
100
Raw pixel (dot prod.)
2.50 + 0.42
2.25 + 0.39
Raw pixel (cosine)
2.71 + 0.41
2.61 + 0.38
CLIP similarity (dot prod.)
2.39 + 0.41
1.11+00.47
CLIP similarity (cosine)
3.39 +
+ 0.49
Gradient (dot prod.) (Charpiat et al., 2019)
0.79 + 0.43
0.74 - 0.42
1.40 + 0.45
1 0.54
Gradient (cosine) (Charpiat et al., 2019)
0.66 + 0.43
0.58 0.41
0.41
+ 0.42
1.82 + 0.51
TracInCP (Pruthi et al., 2020)
0.98 + 0.44
0.96 = 0.38
1.39 0.54
GAS (Hammoudch & Lowd, 2022a)
0.89 + 0.48
0.90 = 0.38
1.25 1.25
1.61 + 0.54
Journey TRAK (Georgiev et al., 2023)
/ 13.56
3.71 = 0.37
7.26 0.43
Relative IF (Barshan al., 2020)
2.76 1 0.45
0.39
2.42 1 0.36
10.65 1 0.42
Renorm. IFt (Hammoudeh & Lowd, 2022a)
2.73 1 0.46
12.58
+ 0.40
2.10 + 0.34
9.34 0.43
TRAK (Park et al., 2023)
2.93 0.46
13.62
- 0.38
2.20 0.38
10.33 1 0.42
D-TRAK (Ours)
14.69 0.46
20.56
0.42
11.05
0.43
16.11 0.36
4.1 DATASETS
Our experiments are conducted on three datasets including CIFAR (32x32), CelebA (64x64) and ArtBench (256x256) More details of datasets be found in Appendix A.1.
In addition to the 1,000 held-out validation samples, we created a set of 1,000 generated images for each of the aforementioned datasets. Notably, calculating LDS necessitates retraining large number of models, which constitutes the majority of the computational cost. In contrast, several attribution methods, such as TRAK and D-TRAK, are computationally efficient and scalable larger datasets.
4.2 BASIC SETUPS OF DIFFUSION MODELS
On CIFAR, we adhere to the original implementation of the unconditional DDPMs (Ho et al., 2020), where the model architecture has 35. 7M parameters (i.e., 35.7 x 10t for Id.). The maximum timestep is T 1000, and we choose the linear variance schedule for the forward diffusion process as (1 10-4 to 3T 0.02. We set the dropout rate to 0.1, employ the Adam W (Loshchilov Hutter, 2019) optimizer with weight decay of 10-6 and augment the data with random horizontal flips. A DDPM is trained for 200 epochs with 128 batch size, using a cosine annealing learning rate schedule with 0.1 fraction warmup and initial learning rate of 10 10-4. During inference, new images are generated utilizing the 50-step DDIM solver (Song et al., 2021a).
On CelebA, CIFAR after being adapted to 64 64 resolution by slightly modifying the U-Net architecture, which has 118.8M parameters. Other hyper-parameters identical those employed CIFAR.
unconditional DDPM implementation that is similar to the used for

---

Published as a conference paper at ICLR 2024
Table 3: LDS (%) of retraining- methods on ArBBench-2/ArtBenchh with various # of timesteps (10 or 100). indicates applying TRAK's scalability optimizations described in Appendix A.3.
Results on ArtBench-2
Validation
Generation
Method
10
100
10
100
Raw pixel (dot prod.)
2,44 + 0.56
2.60 + 0.84
Raw pixel (cosine)
2.58 + 0.56
2.71 + 0.86
CLIP similarity (dot prod.)
7.18 + 0.70
5.33 + 1.45
CLIP similarity (cosine)
8.62 1: 0.70
+ 1.31
Gradient (dot prod.) (Charpiat al., 2019)
7.68 + 0.43
16.00
0.51
4.07 = 1.07
10.23 1.08
Gradient (cosine) (Charpiat et al., 2019)
7.72 + 0.42
16.04 = 0.49
4.50 + 0.97
10.71 1.07
TracInCP (Pruthi et al., 2020)
9.69
+ 0.49
17.83 = 0.58
6.36 0,93
13.85 + 1.01
GAS (Hammoudeh & Lowd, 2022a)
9.65 + 0.46
18.04 + 0.62
6.74
14.27 + 0.97
Journey TRAK (Georgiev et al., 2023)
/ 0.34
11.41 + 1.02
Relative IF (Barshan al., 2020)
12.22 0.43
27.25
7.62
19.78
Renorm. IFt (Hammoudeh & Lowd, 2022a)
11.90 + 0.43
26.49
= 0.34
7
19.86 + 0.71
TRAK (Park et al., 2023)
12.26 + 0.42
27.28
= 0.34
7.78 0.59
20.02 0.69
D-TRAK (Ours)
27.61 + 0.49
32.38
0.41
24.16 + 0.67
26.53 0.64
Results on ArtBench-5
Validation
Generation
Method
10
100
10
100
Raw pixel (dot prod.)
1.84 + 0.42
2.77 + 0,80
Raw pixel (cosine)
1.97 + 0.41
3.22 + 0.78
CLIP similarity (dot prod.)
5.29 + 0.45
4.47 + 1.09
CLIP similarity (cosine)
6.57 +
6.63 + 1.14
Gradient (dot prod.) (Charpiat et al., 2019)
4.77
10.02 0.45
+
+ 1.02
Gradient (cosine) (Charpiat et al., 2019)
4.96
9.85 0.44
4.14 0.86
8.18 + 1.01
TracInCP (Pruthi et al., 2020)
5.33 0.37
10.87 = 0.47
4.34 0.84
9.02 + 1.04
GAS (Hammoudch & Lowd, 2022a)
5.52 + 0.38
10.71 = 0.48
4
9.13 1.01
Journey TRAK (Georgiev et al., 2023)
/ 20.97
7.59
13,31 + 0.68
Relative IF (Barshan al., 2020)
9.77 1 0.34
0.41
8.89 1 0.59
19.56 0.62
Renorm. IFt (Hammoudeh & Lowd, 2022a)
9.57 1 0.32
20.72
+ 0.40
8.97 0.58
19.38 1 0.66
TRAK (Park et al., 2023)
9.79 0.33
21.03 1 0.42
8.79 199-0.55
19.54 11541100 0.61
D-TRAK (Ours)
22.84 0.37
27.46 0.37
21.56
0.71
23.85 0.74
On ArtBench, fine-tune the Stable Diffusion model (Rombach al., 2022) using LoRA (Hu et al., 2022) with the rank set to 128, which consists of 25.5M parameters. To the resolution ratio of ArtBench, we use a Stable Diffusion checkpoint that has been adapted from 512x512 to 256 resolution. We train the model in class-conditional manner where the textual prompt is simply set as "a (class) painting" such as romanticism painting". We also set the dropout rate 0.1, employ the AdamW W optimizer with weight decay of 10 and augment the data with random horizontal flips. We train the model for 100 epochs under batch size of 64, using a cosine annealing learning rate schedule with 0. fraction warmup and an initial learning rate of 3 x 10-1 1 At the inference phase, we sample new images using the 50-step DDIM solver and guidance scale 7.5 (Ho & Salimans, 2022). More implementation details on training and generation of diffusion models are in Appendix A.I.
4.3 EVALUATING LDS FOR ATTRIBUTION METHODS
We set up the LDS benchmarks described Appendix A.2. In the following experiments, we report the mean and standard deviation of the LDS scores based on bootstrapping (Johnson, 2001) corresponding to the random re-sampling from the subsets. Regarding the design choices of attri- bution methods, as shown in Figure 2, for D-TRAK, the best LDS scores are obtained at the final checkpoint. However, for TRAK, using the final checkpoint is not the best choice. Finding which checkpoint yields the best LDS score requires computing the attributions for many times, which means much more computational cost. practice, we might also only get access to the final model. On ArtBench-2, though TRAK obtains comparable LDS scores at the best checkpoint using 1000 timesteps, we believe that even ignoring the cost of searching the best checkpoint, computing the gradients for 1000 times per sample is unrealistic. In summary, when computing gradients,
7

---

Published as a conference paper at ICLR 2024
TRAK
24
12
24
LDS (%)
LDS (99)
LDS (%)
0.0.3
Epech
Epoch
Epoch
(a) of timesteps is 10
(b) # of timesteps is 100
(c) # of timesteps is 1000
25 X
LDS (96)
LDS (%6
LDS (96)
0.
100
23
100
100
Epoch
Epoch
Epoch
(d) of timesteps is 10
(c) # of timesteps is 100
(f) timesteps is 1000
Figure The LDS(%) on the generation set of (Top) CIFAR-2 and (Bottom) Artbench-2 using check- points of different epochs. We select 10, 100, and 1000 timesteps evenly spaced within the interval [) to approximate E, For each selected timestep, we sample one standard Gaussian noise to ap- proximate K,, We set l 32768. For the full results, please check Figures 6, 7 and in Appendix B.
500
250
CLIP Sim
CLIP Sim
8 Distt
0.8
-5' 155
0.7
100
0.6
Kandom TRAK D-TRAK
Randon
TRAK D-TRAK
Random
TRAK D-TRAK
Random
TRAK IXTRAK
(a) CIFAR-2
(b) ArtBench-2
(c) CIFAR-2
(d) ArtBench-2
Figure 3: Boxplots of counterfactual evaluation on CIFAR-2 and ArtBench-2. We quantify the
impact of removing the 1,000 highest-scoring training samples and re-training according to Random, TRAK, and D-TRAK. We measure the pixel-wise f2-distance and CLIP cosine similarity between 60 synthesized samples and corresponding images generated by the re-trained models when sampling from the same random seed. For the results on CelebA, please check Figure 11 in Appendix C.3.
the final model checkpoint default following Koh & Liang (2017); Park al. (2023); Grosse et al. (2023). We consider using 10 and 100 timesteps selected to be evenly spaced within the interval [1, []. For example, the selected timesteps are {1, 101, 201, ..., 901) when the number of timesteps is 10. For each timestep, we sample one standard Gaussian noise. The projection dimension is k 32768.
Following (Hammoudeh & Lowd, 2022b), we consider the attribution baselines that can be applied to our settings, We filter out methods that are intractable on our settings like Leave-One-Out (Cook Weiiserg, 1982) and Shapely Value (Ghorbani & Zou, 2019). We opt those methods that inapplicable to DDPMs, which are generally designed for specific tasks and models like Representer Point (Yeh al., 2018). The baselines could be grouped into retraining free and retraining- based methods. We further group the straining-free methods into similarity- based, gradient-baat kernel) and gradient-based (with kernel) methods. For TRAK and D-TRAK, setting means S 1 and 8 1.0, where we compute the gradients reusing the model we want to interpret. More implementation details baselines can be found in Appendix A.3.
(without retraining
As shown in Tables 2, 3, 6, the similarity-based baselines including Raw pixel and CLIP similarity, (without kernel) methods such as Gradient, TracInCP and GAS, yield poor LDS scores. However, gradient-based (with kernel) methods like TRAK and D-TRAK perform consistently better than other methods. Methods normalizing the attributions based on the magnitude of gradients including Relative Influence and Renormalized Influence have similar performance
and those gradient-
8

---

Published as a conference paper at ICLR 2024
Random
TRAK
D-TRAK
Random
TRAK
D-TRAK
Figure 4: Counterfactual visualization (Top) C and (Bottom) ArtBench-2.. We compare the samples to those generated by retrained models using the same seed. See Appendix D.1 1 for more cases.
compared to TRAK. The Journey TRAK yields low LDS scores as expected because it is designed for attributing noisy images 2 along the sampling trajectory originally, while we attribute the finally generated image æ. On the validation set, with 10/100 timesteps. D-TRAK achieves improvements of +15.37%/+10.15% +11.55%/+8.... +8.6%% and + +15.35%/+55 1% on CIFAR-2, CelebA and ArtBench-2, re- spectively. On the generation set, with 10/100 timesteps, D-TRAK exhibits gains of + +13.04%/+9.88 in the L.S scores for the above three datasets. Regarding CIFAR-10 and ArtBench-5, overall the LDS scores are lower, which is expected because attributing to a larger training set might be more difficult. Nonetheless, D-TRAK still performs significantly better than TRAK. It is also interesting to see that across all the settings, D-TRAK with 10 timesteps computation budget outperforms TRAK with 100 timesteps computation budget. In Tables 7 and 8, we compare D-TRAK with the retraining- based methods including TRAK (ensemble). Empirical In- fluence and Datamodel, on CIFAR-2, CelebA and ArtBench-2 D-TRAK performs consistently better. More implementation details and empirical results of LDS evaluation can be found in Appendix C.2.
-9.82% and + +16.38%/+6.51
4.4 COUNTERFACTUAL EVALUATION
To evaluate the faithfulness of D-TRAK more intuitively, on CIFAR-2, CelebA, and ArtBench-2, we measure the pixel-wise disti. and CLIP cosine similarity between images generated by the models trained before/after the exclusion of the top-1000 positive influencers identified by different attribution methods. For both D-TRAK and TRAK, we consider 100 timesteps, sample one standard Gaussian noise, and set k = 32768. We consider control baseline called Random, which randomly removes 1000 training samples before retraining. As shown in Figure and 11, when examining the median pixel-wise & distance resulting from removing mettrrtaannnng D-TRAK yields 8.97, 15.07. and 187.61 for CIFAR-2, CelebA, and ArtBench-2, respectively, in contrast to TRAK's values of 5.90, 11.02 and 168.37. D-TRAK obtains median similarities of 0.881, 0.896 and 0.769 for the above three datasets respectively, which are notably lower than TRAK's values of 0.943, 0.942 and 0.840, highlighting the effectiveness of our method. We manually compare the original generated samples to those generated from the same random seed with the re-trained models. 5 As shown in Figure 4, our results suggest our method can better identify images that have a larger impact on the target image.
DISCUSSION
In this work, we empirically demonstrate that when the model output function of interest F is the same as the training objective C. the gradients of VeL may not good design choice for attributing C itself. Although this deduction seems counter-intuitive, we find potentially related phenomena observed in previous research. For examples, Park et al. (2023) have reported that using VoL in TRAK leads to worse performance than using V, (eeee(((((xs)) 0)) 1) on classification problems, even if the LDS score is computed by setting = L. However, the TRAK paper has not extensively investigated this observation, and the utilization of the design involving Vo 1) based on theoretical justifications. Furthermore, existing literature on adversarial attacks has also identified the presence of gradient obfuscation when utilizing gradients derived from V.C (Athalye et al., 2018). Conversely, employing gradients from alternative functions has been shown enhance the efficiency of adversarial attacks (Carlini & Wagner, 2017; Croce & Hein, 2020). The aforementioned phenomena have not been adequately explained in a formal manner. We advocate that further investigation be conducted to gain a deeper understanding of these counter-intuitive observations and to enhance the development of data attribution methods.
0))
*On ArtBench-2, we measure the lg-dist. of VQ- VQ-VAE encoding for generated images (Rombach et al., 2022). 'e also visualize top attributions for sampled target samples in Appendix D.2.

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGMENTS
This research is supported by the Ministry of Education, Singapore, under its Academic Research Fund Tier 2 (Proposal ID: T2EP20222-0047). Any opinions, findings and conclusions or recommendations expressed in this material are those of the authors and do not reflect the views of the Ministry of Education, Singapore.
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning (ICML), 2018.
Fan Bao, Chongxuan Li, Jun Zhu, and Bo Zhang, Analytic- an analytic estimate of the optimal reverse variance in diffusion probabilistic models. International Conference on Learning Representations (ICLR), 2022.
Elnaz Barshan, Marc- Etienne Brunet, and Gintare Karolina Dziugaite. Relatif: Identifying explanatory training samples via relative influence. In International Conference on Artificial Intelligence and Statistics (AISTATS), 2020.
Samyadeep Basu, Philip Pope, and Soheil Feizi. Influence functions in deep learning are fragile. In International Conference Learning Representations (ICLR), 2021.
Lucas Bourtoule, Varun Chandrasekaran, Christopher Choquette- Choo. Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot. Machine unlearning. In 2021 IEEE Symposium on Security and Privacy (SP), 2021.
Jonathan Brophy, Zayd Hammoudeh, and Daniel Lowd. Adapting and evaluating influence-estimation methods for gradient-boosted decision trees. Journal of Machine Learning Research (JMLR), 2023.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy (S&P), 2017.
Guillaume Charpiat, Nicolas Girard, Loris Felardos, and Yuliya Tarabalka. Input similarity from the neural network perspective. Advances Neural Information Processing Systems (NeurIPS), 2019.
Yuanyuan Chen, Boyang Li, Han Yu, Pengeheng Wu, and Chunyan Miao. Hydra: Hypergradient data relevance analysis for interpreting deep neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, 2021.
Dennis Cook and Sanford Weisberg. Residuals and influence in regression. New York: Chapman and Hall, 1982.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free free attacks. In International Conference on Machine Learning (ICML), 2020.
Zheng Dai and David K Gifford. Training data attribution for diffusion models. arXiv preprint arXiv:2306.02 074, 2023.
Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
Kristian Georgiev, Joshua Vendrow, Hadi Salman, Sung Min Park, and Aleksander Madry. The journey, not the destination: How data guides diffusion models. In Workshop on Challenges in Deployable Generative Al International Conference on Machine Learning (ICML), 2023.
Amirata Ghorbani and James Zou. Data shapley: Equitable valuation of data for machine learning. In International Conference on Machine Learning (ICMI), 2019.
10

---

Published as a conference paper at ICLR 2024
Roger Grosse, Juhan Bae, Cem Anil, Nelson Elhage, Alex Tamkin, Amirhossein Tajdini, Benoit Steiner, Dustin Li, Esin Durmus, Ethan Perez, et al. Studying large language model generalization with influence functions. arXiv preprint arXiv:2308. 03296, 2023.
Xiangming Gu, Chao Du, Tianyu Pang, Chongxuan Li, Min Lin, and Ye Wang. On memorization in diffusion models. arXiv preprint 2rXiv:23 2023.
Zayd Hammoudeh and Daniel Lowd. Identifying a training-set attack's 's target using renormalized influence estimation. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022a.
Zayd Hammoudeh and Daniel Lowd. Training data influence analysis and estimation: A survey. arXiv preprint arXiv:2212. 04612, 2022b.
Frank R Hampel. Elvezio M Ronchetti, Peter Rousseeuw, and Werner A Stahel. Robust statisties: the approach based on inffuence functions. John Wiley & Sons, 2011.
Trevor Hastie. Ridge regularization: An essential concept in data science. Technometrics, 2020.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598. 2022.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
Sara Hooker, Dumitru Erhan, Pieter-Jan Kindermans, and Been Kim. A benchmark for interpretabil- ity methods deep neural networks. In Advances Neural Information Processing Systems (NeurIPS), 2019.
Edward Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang. Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation large language models. In International Conference Learning Representations (ICLR), 2022.
Andrew Ilyas, Sung Min Park, Logan Engstrom, Guillaume Leclere, and Aleksander Madry. Data- models: Predicting predictions from training data. In International Conference on Machine Learning (ICML), 2022.
Ruoxi Jia, Fan Wu, Xuehui Sun, Jiacen Xu, David Dao, Bhavya Kailkhura, Ce Zhang, Bo Li, and Dawn Song. Scalability vs. utility: Do we have to sacrifice one for the other in data importance quantification? IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2021.
Roger W Johnson. An introduction to the bootstrap. Teaching statistics. 2001.
William B. Johnson and Joram Lindenstrauss. Extensions of lipschitz mappings into hilbert space. Contemporary mathematics, 1984.
Rajiv Khanna, Been Kim, Joydeep Ghosh, and Sanmi Koyejo. Interpreting black box predictions using fisher kernels. In International Conference on Artificial Intelligence and Statistics (AISTATS), 2019.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International Conference on Machine Learning (ICML.) 2017.
Pang Wei Koh, Kai-Siang Ang, Hubert Teo, and Percy Liang. On the accuracy of influence functions for measuring group effects. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
Shuming Kong, Yanyan Shen, and Linpeng Huang. Resolving training biases via influence-based data relabeling, In International Conference on Learning Representations (ICLR), 2022.
Zhifeng Kong and Kamalika Chaudhuri. Understanding mnstance-based interpretability of variational auto-encoders. In Advances in Neural Information Processing Systems (NeurIPS), 2021.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, 2009.
11

---

Published as a conference paper at ICLR 2024
Peiyuan Liao, Xiuyu Li, Xihui Liu, and Kurt Keutzer. The artbench dataset: Benchmarking generative models with artworks. arXiv preprint wxXv:2206.114044 2022.
Jinkun Lin, Anqi Zhang, Mathias Lécuyer, Jinyang Li, Aurojit Panda, and Siddhartha Sen. Mcasuring the effect of training data on deep learning predictions via randomized experiments. In International Conference on Machine Learning (ICML), 2022.
Zhuoming Liu, Hao Ding, Huaping Zhong, Weijia Li, Jifeng Dai, and Conghui He. Influence selection for active learning. In International Conference Computer Vision (ICCV), 2021.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In International Conference on Computer Vision (ICCV), 2015.
Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. In International Confer- on Learning Representations (ICLR), 2019.
James Martens. New insights and perspectives on the natural gradient method. The Journal of Machine Learning Research (JMLR), 2020.
Sung Min Park, Kristian Georgiev, Andrew Ilyas, Guillaume Leclerc, and Aleksander Madry. Trak: Attributing model behavior at scale. In International Conference Machine Learning (ICML), 2023.
Garima Pruthi, Frederick Liu, Satyen Kale, and Mukund Sundararajan. Estimating training data influence by tracing gradient descent. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning (ICML), 2021.
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. Model-agnostic interpretability of machine learning. arXiv preprint 1606.05388888 2016.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In IEEE Conference Computer Vision and Pattern Recognition (CVPR), 2022.
Andrea Schioppa, Polina Zablotskaia, David Vilar, and Artem Sokolov. Scaling up influence functions. In AAAI Conference on Artificial Intelligence (AAAI), 2022.
Lloyd S Shapley et al. A value for n-person games. Contributions the Theory of Games II., 1953.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International Conference on Machine Learning (ICML), 2015.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- tional Conference on Learning Representations (ICLR), 20.
Yang Song, Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-basee based generative modeling through stochastic differential equations. In International Conference on Learning Representations (ICLR), 2021b.
Charles Spearman. The proof and measurement of association between two things. The American journal of psychology, 1987.
Naoyuki Terashita, Hiroki Ohashi, Yuichi Nonaka, and Takashi Kanemaru. Influence estimation for generative adversarial networks. In International Conference on Learning Representations (ICLR), 2021.
Stefano Teso, Andrea Bontempelli, Fausto Giunchiglia, and Andrea Passerini. Interactive label cleaning with example-base explanations. In Advances Neural Information Processing Systems (NeurIPS), 2021.
12

---

Published as a conference paper at ICLR 2024
Daniel Ting and Eric Brochu. Optimal subsampling with influence functions. In Advances in Neural Information Processing Systems (NeurIPS), 2018.
Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning. In Advances in Neural Information Processing Systems (NeurIPS), 2017.
Sheng- Yu Wang, Alexei A Efros, Yan Zhu, and Richard Zhang. Evaluating data attribution for text-to-image models. In International Conference on Computer Vision (ICCV), 2023.
Chih-Kuan Ych, Joon Kim, Ian En-Hsu Yen, and Pradcep K Ravikumar. Representer point selection for explaining deep neural networks. In Advances in Neural Information Processing Systems (NeurlPS), 2018.
Lymin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control text-to-image diffusion models. In International Conference on Computer Vision (ICCV), 2023.
Xiaosen Zheng and Jing Jiang. An empirical study of memorization in nlp. In Association for Computational Linguistics (ACL), 2022.
13

---

Published as a conference paper at ICLR 2024
A IMPLEMENTATION DETAILS
In this paper, train various diffusion models for different datasets using the Diffusers library. We compute the per-sample gradient following a tutorial of the PyTorch library (version 2.0.1). We use the rak library* to project gradients with random projection matrix, which is implemented using a faster custom CUDA kernel. For all of our experiments, we use 64 CPU cores and NVIDIA A100 GPUs each with 40GB of memory.
A.1 DATASETS AND MODELS
CIFAR (32x32). The CIFAR-I0 dataset (Krizhevsky et al., 2009) contains 50,000 training samples. 10 We randomly sample 1,000 validation samples from CIFAR-IO's test set for LDS evaluation. To reduce computation, we also construct CIFAR-2 dataset as a subset of CIFAR-10, which consists of 5,000 training samples randomly sampled from CIFAR-10 10's 's training samples corresponding to the "automobile" and "horse" classes, and 1,000 validation samples randomly sampled from CIFAR-10's test set corresponding to the same two classes
On CIFAR, adhere to the original implementation of unconditional DDPMs (Ho al., 2020), where the model architecture has 35.7M parameters (i.e., = 35.7 x 10 for 0 E Rd) The maximum timestep is T 1000, and we choose the linear variance schedule for the forward diffusion process as 31 = 10 to ST 0.02. We set the dropout rate to 0.1, employ the Adam (Loshchilov & Hutter, 2019) optimizer with weight decay of 10 and augment the data with random horizontal flips. A DDPM is trained for 200 epochs with 128 batch size, using a cosine annealing learning rate schedule with a 0.1 fraction warmup and an initial learning rate of 10 During inference, new images are generated utilizing the 50-step DDIM solver (Song et al., 2021a).
CelebA (64x 64). We sample a subset of 5,000 training samples and 1,000 validation samples from the original training set and test set of CelebA (Liu et al., 2015)." 12 respectively, and first center crop the images to 140 140 according to Song et al. (2021b) and then resize them to 64 x4.
On CelebA, we use an unconditional DDPM implementation that is similar to the one used for CIFAR after being adapted to 64x66 x4 resolution by slightly modifying the U-Net architecture, which has 1 118.MM parameters. Other syper-parameters are identical to those employed CIFAR.
ArtBench (256 256). ArtBench (Liao et al., 2022) is a dataset for artwork generation." 14 It includes 60,000 artwork images for 10 distinct artistic styles, with 5,000 training images and 1,000 testing images per style. We construct ArtBench-2 as a subset of ArtBench, consisting of 5,000 training/1,000 validation samples sampled from 10,000 training/2,000 test samples of the pposttiippressooiism" and "ukiyo-e" classes. We also test our method on ArtBench-5 as a subset of ArtBench, consisting of 12,500 training/1,000 validation samples sampled from 25,000 training/5,000 test samples of the "post-imppressionssn"" "ukiyo-e", "romanticism", "renaissance" and "baroque" classes.
On ArtBench, we fine-tune the Stable Diffusion model (Rombach et al., 2022) using LoRA (Hu et al., 2022) with the rank set to 128, which consists of 25.5M parameters. 15 To fit the resolution ratio of ArtBench, we use a Stable Diffusion checkpoint that has been adapted from 512x512 to 256x256 resolution." 16 We train the model in class conditoon manner where the textual prompt is simply set as "a (class) painting" such as "a romanticism painting". We also set the dropout rate to 0.1, employ
html
phtpes//huniingeeeo.o//ttttttttt
to http://s///nnggggga.a.oco//////a
14

---

Published as a conference paper at ICLR 2024
the AdamW optimizer with weight decay of 10 6, and augment the data with random horizontal flips. We train the model for 100 epochs under a batch size of 64, using a cosine annealing learning rate schedule with 0.1 fraction warmup and an initial learning rate of 3 x 10 4. At the inference phase, sample new images using the 50-step DDIM solver and a guidance scale of 7.5 (Ho & Salimans, 2022).
A.2 LDS EVALUATION SETUP
To conduct the LDS evaluation, we sample M = 64 different random subsets of the training set D. and train three models with different random seeds on each one of these subsets. Each subset sampled to 50% of the size of the training set, that is, we set a = 0.5. We then compute the linear datamodeling score for each sample of interest as the Spearman rank correlation between the model output and the attribution- based output prediction of the model output as described in Eq. (3). Especially, when computing Lsimple (x: f) as described in Eq. (2) for any sample of interest from either the validation set or generation set, we consider all the 1000 timesteps selected to be evenly spaced within the interval [1, 7] to approximate the expectation E., For each timestep, we sample three standard Gaussian noises (E (0 I) to approximate the expectation Ee. Finally, we average the LDS across samples of interest from the validation set and generation set respectively.
A.3 BASELINES
In this paper, we majorly focus on conducting data attribution in a post-hoc manner, which refers to the application of attribution methods after model training. Post-hoe attribution methods do not add extra restrictions to how we train models and are thus preferred in practice (Ribeiro et al., 2016).
Following (Hammoudeh & Lowd, 2022b), consider the attribution baselines that can be applied to our settings. We filter out intractable methods on our settings like Leave-One-Out (Cook & Weisberg, 1982) and Shapely Value (Shapley et al., 1953; Ghorbani & Zou, 2019). We exclude those methods that are inapplicable to DDPMs, which are generally designed for specific tasks and models like Representer Point (Yeh et al., 2018). We also omit HYDRA (Chen et al., 2021). which is closely related to TracInCP Pruthi et al. (2020) and can be viewed as trading (incremental) speed for lower precision compared to TracInCP as described by Hammoudeh & Lowd (2022b).
We also noticed two concurrent works that do not apply to our settings. Dai & Gifford (2023) propose to conduct training data attribution on diffusion models based on machine unlearning (Bourtoule et al., 2021). However, their method is restricted to the diffusion models that are trained by specially designed machine unlearning training process thus is not post-hoc and could not be applied to the common settings. Wang et al. (2023) claim that analyzing training influences in post-hoc manner using existing influence estimation methods is currently intractable and instead propose a method that also requires training/tuning the pretrained text-to-image model in specifically designed process, which is called "customization" in their paper.
Regarding methods that use the Hessian matrix the kernel including Influence Functions (Koh & Liang, 2017), Relative Influence (Barshan et al., 2020) and Renormalized Influence (Hammoudeh & Lowd, 2022a), previous work has shown that computing the inverse of the Hessian matrix exhibits numerical instability in practical scenarios, often resulting in either divergence or high computational costs, particularly when dealing with deep models (Basu al., 2021; Pruthi et al., 2020). In more recent approaches, the Hessian matrix is substituted with the Fisher information matrix (FIM) (Ting Brochu, 2018; Barshan et al., 2020; Teso et al., 2021; Grosse al., 2023). Martens (2020) discuss the relationship between Hessian and FIM more thoroughly.
Recently, Park et al. (2023) developed an estimator that leverages a kernel matrix that is similar to the FIM based on linearizing the model and further employs the classical random projection to speed up the hessian- influence functions (Koh & Liang, 2017), as the estimators are intractable otherwise. We summarize these two modifications TRAK's scalability optimizations and also apply them to Relative Influence and Renormalized Influence.
We divided the baselines into two categories: retraining free and retraining-based methods. The retraining-fre free methods are further classified into three types: similarity- based, gradient-based (with- out kemne) and gradient- based (with kernel) methods. Raw pixel and CLIP similarity (Radford et al., 2021) are two similarity- -asedd methods. Gradient (Charpiat et al., 2019), TracInCP (Pruthi et al., 2020), and GAS (Hammoudeh & Lowd, 2022a) are gradient-based based (without kemnel) meth-
15

---

Published as a conference paper at ICLR 2024
ods. TRAK (Park al., 2023), Relative Influence Barshan al. (2020) and Renormalized Influ- ence(Hammoudeh & Lowd, 2022a), and Journey TRAK (Georgiev et al., 2023) are gradient- based (with kernel) methods. TRAK (ensemble), Empirical Influence (Feldman & Zhang, 2020), and Datamodel (Ilaas et al., 2022) are retraining-based methods.
We next provide definition and implementation details of the baselines used in Section 4.
Raw pixel. This is a naive similarity- -based attribution method that simply uses the raw image as the representation and then computes the dot product cosine similarity between the sample of interest and each training sample as the attribution score. Especially, for ArtBench, which uses latent diffusion models (Rombach al., 2022), we represent the image using the VAE encodings (Van Den Oord et al., 2017) of the raw image.
CLIP Similarity. This is another simillarity-bsce attribution method. We encode each sample into an embedding using CLIP (Radford et al., 2021) and then compute the dot product or cosine similarity between the target sample and each training sample as the attribution score.
Gradient. This is gradient- muddentt-baedd based influence estimator from Charpiat et al. (2019), which computes the dot product or cosine similarity using the gradient representations of the sample of interest and each training sample, as the attribution score as follows
Tac D)n =PT T V Simple l (x: 0²) .P V Fimsimple (x=;; 0");
P V Vo L Simple e (ar; 0*) P V Simple (a:" 0*)
T(x D), ||P V Simple [x; 0* Il] V Simple (x:;: [*]
Cr. We use the TracInCP estimator from Pruthi et (2020), implemented as
1 _C T(x, D), - P.
P VoLsimpte B PT. T V Csimple (x"; (*).
where C' is the number of model checkpoints selected from the training trajectory evenly and 0 is the corresponding checkpoint. We use four checkpoints from the training trajectory. For example, for CIFAR-2, we take the checkpoints at epochs (50, 100, 150, 2003.
GAS. This is a "renormalized" version of the TracInCP based on using the cosine similarity instead of raw dot products (Hammoudeh & Lowd, 2022a).
TRAK. As discussed in Section 3, we adapt the TRAK (Park et al., 2023) to the diffusion setting as described in Eq. (6), the retraining-free TRAK is implemented as
S TRAA [o(x :d)xN)) where (bx) P
Sismpeee 0*);
T(x, D)n, = P V Simple (x; TT)T. (RAA T
TIRAAK
XT)
P
V Cimplee (x. : O*),
where the AI serves for numerical stability and regularization effect. We explore the effect of this term in Appendix B. The ensemble version of TRAK is implemented as
iRAAK [00 [>'((');;.. ).... ""."""""( where o² (x:) P. V Ceimtee (5;;0);;
Tax D)n = =3
S D V (im ( DiRAK + 21)
-1
PP. V Sisspee 0?).
Relative Influence. Barshan et al. (2020) propose the 0-relative influence functions estimator, which normalizes Koh & Liang (2017) influence functions' estimator by HVP magnitude. We adapt this method to our setting after applying TRAK's scalability optimizations, which is formulated as
P V Simple (x: TT (DTRAK T TTTRAK + A1) .P V V Simple (x 6*)
T(x, D)n
(PTAAK "TRAK + 21)
T PeLSimple (== 0+)
Renormalized Influence. Hammoudeh & Lowd (2022a) also propose to renormalize the influence by the magnitude of the training sample's gradients. We adapt this method to setting after applying
16

---

Published as a conference paper at ICLR 2024
TRAK's scalability optimizations, which is formulated as
P Vo Simple (x; BTT ( (TAA TRAK
+ X1 -1
.PV Simple (x";
Vo
T(0, D)n
P V Simple (x 0*)1
Journey TRAK. Georgiev et al. (2023) focus attributing noisy images while we attribute the finally generated image æ. We adapt their method to our setting by averaging the attributions over the generation timesteps as follows
1 Tax D)n = TO Dو CTPTVVLLie Sooii
(TTRAA TRAAK + 21 . Simple (a: 0*),
where 7" is inference steps set as 50 and æ, is the noisy generated image along the sampling trajectory.
Empirical Influence. We use the downsampling -aseed approximation to leave-one-ous influences as used by Feldman & Zhang (2020), using up S = 512 models trained on different random 50% subsets of the full training set, which is difference in means estimator given by:
r(x D)., ED Siimple (a: 8%) ED z Siimple ( (x: 82).
Especially, when computing Lsimple (a;; ( 0) described in Eq. (2) for any sample of interest from either the validation set or generation set, we consider the 1000 timesteps selected to evenly spaced within the interval [1, to approximate the expectation E, For each timestep, sample one standard Gaussian noise e A 0, I) to approximate the expectation E.,
Datamdoel. We use the regression- estimator from Ilyas et al. (2022), using up to S = 512 mdoels trained on different random 50% subsets of the full training set.
A.4 TIME MEASUREMENTS
We evaluate the computational cost of attribution methods using two factors: the total number of timesteps used and the total number of trained models used. These factors are hardware and implementation-agnennn
We note the number of timesteps used as K. Unlike classification models, we need to compute the gradients of multiple timesteps per sample for diffusion models. For retraining-free methods, the time it takes to compute attribution scores will dominated by the time of computing the gradients for different timesteps.
TRAIN_ The time to train one model (from scratch or fine-tuning).
GRAD_TIME: TIME: entire dataset including train, validation, and generation sets.
The time to compute gradients of one model for each sample at each timestep in the
The time to project gradients of one model for each sample in the entire dataset including training, validation, and generation sets. Note that for each sample, we first average the gradient vectors multiple timesteps and then conduct the random projection.
PROJ_TIME:
We approximate the total compute time for each method as follows.
TracInCP and GAS: Cx (Kx GRAD_TIME PROJ_TIME)
TRAK and D-TRAK: GRAD_TIME PROJ_TIMM
TRAK and D-TRAK (ensemble): S' (TRAIN_TTME KX GRAD_TIME.
Empirical Influence and Datamodel: Sx TRAIN TRAIN_TIME
17

---

Published as a conference paper at ICLR 2024
Table 4: LDS (%) on CIFAR2 corresponding different model output function of interest FF and dif- ferent 6 in D-TRAK. When computing o² we use 100 timesteps selected to be evenly spaced within the interval [1, T which are used approximate the expectation E, For each sampled timestep, we sample one standard Gaussian noise e ~ (ee) I) to approximate the expectation Eg. The projection dimension 4096. Here we omit the (ar, 02) when writing the expressions of JF and ø²
Validation
Generation
Simple
LELBO
Lsquar Li norm Lo noo-norm
Simple
LELBO Ssquie Le.morm Loa-norm
Simple
19.50
20.54
0.16
0.10
-0.06
12.05
11.88
0.25
0.24
0.51
P
V CELBO
9.07
15.65
0.13
0.11
-0.13
3.83
8.35
0.06
-0.05
-0.04
P4
Square
30.81
27.06
0.57
0.55
0.57
22.62
18.24
0.15
0.14
0.30
P
V VoLi .norm
30.36
27.40
0.55
0.59
0.28
21.99
18.46
0.54
0.50
0.58
P
V VeCoc-nom
11.54
13.53
-0.23
-0.21
-0.49
8.11
10.08
-0.45
-0.49
-0.36
32
32
28
28-
D-TRAK
LDS (%)
24
20
200
K192
16384
24575
32768
K19
16354
24576
52768
K192
16554
24576
52568
K192
16:54
24576
52568
(a) # of timesteps is 10
(b) of timesteps is 100
(c) # of timesteps is 10
(d) of timesteps is 100 Gen
Val
Val
Gen
Figure 5: The LDS(%) on CIFAR-2 under different k. The number of timesteps is in the parentheses. consider and 100 timesteps selected to be evenly spaced within the interval [], which are used to approximate the expectation EE, For each sampled timestep, sample one standard Gaussian noise (e((0, I) to approximate the expectation E..
B ABLATION STUDIES
To double-check if the counter-intuitive observations in Table 1 and Figure are caused by certain implementation details, we perform more ablation studies to compare the performance between TRAK and D-TRAK (CSquare. In this section, we choose the CIFAR-2 as our major setting, we also consider CelebA and ArtBench-2 in some experiments. The details these settings can be found in Appendix A. We set up the corresponding LDS benchmarks described in Appendix A.2.
We focus on the retraining-fi free setting, which means gradients reusing the model we want to interpret. When computing gradients for attribution methods, we consider various number of timesteps where the timesteps are selected to be evenly spaced within the interval [1, T| by the arange operation, which term uniform. More concretely, the selected timesteps are {1, 101, 201, ... 901} when the number of timesteps is 10. For each timestep, we sample one standard Gaussian noise.
and B 1.0, where we compute the
F Selection. Recap the LDS metric in Definition 2, we need to specify the model output function before conducting the LDS evaluation. This introduces a design choice for discussion. Given DDPM trained by minimizing (D; -) Lsimple (D; there is 0* (D) = arg ming Simple 0) and setting the model output function to be F(x: 0) = C(x; 0) Simple (æ, f) should be natural choice. Nevertheless, we further conduct comprehensive study by constructing different LDS benchmarks that use different model output functions such as LELBO, LSqurrea Li-norm and Loc-norm and then evaluate different constructions of 6* as what we did in Table 1. As shown in Table 4, we first observe that setting the model output function as one of Lsquared- L1-norm- and Loc-norm- will make the attribution task fail indicated by near-zero LDS scores. One potential explanation is that these functions are not well approximated by the linear functions of training samples as suggested by Park al. (2023). Using either Simple LELBO yields reasonable LDS scores, rank different constructions of 6² in a similar order and have similar LDS scores for P. V Simple- However, setting the model output function to be Simple (x. 0) yields higher LDS scores for P, VoLSqueee 33.81 $1 % and 22.62%
18

---

Published as a conference paper at ICLR 2024
Table 5: LDS(%) on CIFAR-2 under #100 computation budget. The numbers in the parentheses indicate the number of timesteps and the number of noises set to compute the gradients, respectively.
Validation
Generation
Method
Strategy
(10, 10)
(20, 5) (50, 2)
(100, 1)
(10, 10) (20, 5) (50, 2) (100, 1)
cumulative
13.45
14.12
15.71
17.68
4.58
5.30
6.52
8.97
TRAK
uniform
16.57
19.45
22.93
24.00
9.13
12.14
15.49
16.13
cumulative
29.35
31.14
33.40
34.90
19.86
21.26
23.44
25.16
D-TRAK
uniform
30.71
32.91
34.06
34.24
22.07
24.39
25.76
26.02
36
TRAK D-TRAK
36
24
LDS
20
16
100 Epoch
150
200
100 Epoch
150
200
50
100
150
200
Epoch
(a) timesteps is 10)
(b) Val (# of timesteps 100)
(c) timesteps is 1000)
32
32
32
28
28
24
24
24
20
20
LD'S (%6
20
LDS
16
LDS
16
100
130
200
100
150
200
100
150
200
Epoch
Epoch
Epoch
(d) Gen (# of timesteps is 10)
(c) Gen (# of timesteps is 100)
(f) Gen (# of timesteps is 1000)
Figure 6: The LDS(%) on CIFAR-2 under different checkpoints. We consider 10, 100, and 1000 timesteps selected to be evenly spaced within the interval [1, 77. which are used to approximate the expectation E,, For each sampled timestep, we sample one standard Gaussian noise 6 ~ (e to approximate the expectation E., We set 32768.
on validation and generation respectively, thus we set F(w; CSimple 0) the default choice in the following experiments.
Value of k. When compute the attribution scores, dimensionality of the gradients. Intuitively, as the resulting dimension & increases, the associated projection better preserves inner products, but is also more expensive compute Johnson & Linden- strauss (1984). We thus investigate how the projection dimension & selection affects the attribution performance. Figure 5 shows that the dimension increased, and the LDS scores of both TRAK and our method initially increase and gradually saturate, as expected. In the following experiments, we set 32768 as the default choice.
random projection to reduce the
Number of noises. When computing the gradients, for every timestep, we can sample multiple noises and then average the resulting gradients for better performance at the cost of computation. However, shown in Table increasing the number of noises is less effective than increasing the number of timesteps. So we set using one noise per timestep when computing the gradients as default.
Timestep selection. As mentioned previously, we set the time selection strategy as uniform. We also explore another potential strategy cumulative. For example, when the number of timesteps is set 10, will select {1, 2. .10) for cumulative. As shown in Table 5, for D-TRAK, the sampling strategy has little influence, while for TRAK, the wniform significantly better. Thus we set the sampling strategy uniform default in the following experiments for fair comparison.
19

---

Published as a conference paper at ICLR 2024
36
36
36
32
32
D-TRAK
24
24
LDS (%)
LDS
100
130
200
100
150
100
Epoch
Epoch
Epoch
(a) Val (ff of timesteps is 10)
(b) Val (if of timesteps is 100)
(c) Val (# of timesteps is 1000)
LDS (%)
LDS (%)
LDS
100
130
200
100
150
200
100
200
Epoch
Epoch
Epoch
(d) Gen (# of timesteps 10)
(e) Gen timesteps is 100)
(f) Gen of timesteps 1000)
Figure 7: The LDS(%) on CelebA under different checkpoints. We consider 10, 100, and 1000 timesteps selected to evenly spaced within the interval [1, T]. which are used approximate the expectation E, For each sampled timestep, sample one standard Gaussian noise ~ 1) to approximate the expectation E,, set = 32768.
40
IRAK
40
36
D-TRAK
LDS (%)
24
30
25
50
15
100
50
100
50
75
100
Epoch
Epoch
Liocc
(a) Val (#f of timesteps is 10)
(b) Val (#f of timesteps is 100)
(c) Val (# of timesteps is 1000)
24
LDS
16
LDS
Epoch
Epoch
Lipoch
(d) Gen (# of timesteps is 10)
(c) Gen (# of timesteps is 100) (f) Gen (# of timesteps 1000)
Figure 8: The LDS(%) on ArtBench-2 under different checkpoints. We consider 10, 100, and 1000 timesteps selected to be evenly spaced within the interval [1, 7). which used approximate the expectation E,. For each sampled timestep, we sample one standard Gaussian noise e ~ I) approximate the expectation E.. We set 32768.
20

---

Published as a conference paper at ICLR 2024
IRAK D-TRAK
32
24
LDS (%)
LDS
LDS
50-2
520
502
504
525
5e-2
5e0
562
504
5c5
50-2
Sel
562
5.4
365
(a) Val (#f of timesteps is 10)
(b) Val (if of timesteps is 100)
(c) Val (# of timesteps is 1000)
24
24
24
20
LDS
LDS
56-2
500
562
Sol
320
5e-2
Se0
362
5o4
3.5
50.2
5e0
302
5.4
36b
(d) Gen (# of timesteps 10)
(c) Gen timesteps is 100)
(f) Gen of timesteps 1000)
Figure 9: LDS (%) on CIFAR-2 under different A. We consider 10, 100, and 1000 timesteps selected to be evenly spaced within the interval [1, TJ. which are used to approximate the expectation E, For each sampled timestep,
sample standard Gaussian noise (eee to approximate the expectation E., We set 32768. The shaded area in the LDS represents the standard deviation corresponding to different checkpoints.
TRAK
D-TRAK
LDDS 150
(5C)
LDS (56)
1,05
(a) # timesteps is Val (k: -096)
(b) timesteps 100
(c) timesteps is
(d) of timesteps Gen (k 4096)
Val (k -096)
Gen (k = 4096)
1,D8
LIDS
LIDS
364
304
304
504
(e) # timesteps is (0) of timesteps Val (k 32768)
(g) # timesteps is Gen (k 32768)
(h) # timesteps is Gen (/: 32768)
Val (k = 32768)
Figure 10: LDS (%) on CIFAR-10 under different X. We consider 10 and 100 timesteps selected to be evenly spaced within the interval [1,2], which are used to approximate the expectation EE, For each sampled timestep. sample standard Gaussian noise ~ (<e to approximate the expectation E., The subplots are associated with random projection dimensions 4096 and 32768.
21

---

Published as a conference paper at ICLR 2024
Table 6: LDS (%) retraining- free methods on CelebA with various # of timesteps (10 or 100),
indicates applying TRAK's scalability optimizations as described in Appendix A.3.
Validation
Generation
Method
100
10
Raw pixel (dot prod.)
5.58 + 0.73
-4.94 1,58
Raw pixel (cosine)
6.16 + 0.75
-4.38 1.63
CLIP similarity (dot prod.)
8.87 + 1.14
2.51 + 1.13
CLIP similarity (cosine)
10.92 0.87
3.03 + 1.13
Gradient (dot prod.) (Charpiat et al., 2019)
3.82 0.50
4.89 = 0.65
3.83
1.06
4.53 0.84
Gradient (cosine) (Charpiat el al., 2019)
3.65 1 0.52
4.79 1 0.68
3,86 1 0.96
4,40 1: 0.86
TracInCP (Pruthi et al., 2020)
5.14 0.75
4.89 1 0.86
1.05
4.50 0.93
GAS (Hammoudeh & Lowd, 2022a)
5.44 + 0.68
5.19 = 0.64
4.69 1699
3.98 + 0.97
Journey TRAK (Georgiev et al., 2023)
/
6.53 1.06
10.87 - 0.84
Relative IFT (Barshan et al., 2020)
11,10 + 0.51
19.89 + 0.50
6.80 0.77
14.66 + 0.70
Renorm. IFt (Hammoudeh Lowd, 2022a)
11.01 + 0.50
18.67
= 0.51
6.74 0.82
13.24 = 0.71
TRAK (Park et al., 2023)
11.28 + 0.47 20.02
= 0.49
7.02 + 0.89
14.71 = 0.70
D-TRAK (Ours)
22.83 +: 28.69 = 0.44 16.84
0.54
21.47 = 0.48
Checkpoint selection. Motivated by Pruthi al. (2020), we study the effect of using different checkpoints of a model to compute the gradients. As shown in Figures 6, 7 and 8, for D-TRAK, the best LDS scores are obtained at the final checkpoint. However, for TRAK, using the final checkpoint is not the best choice. Finding which checkpoint yields the best LDS score requires computing the attributions many times, which means much more computational cost. Additionally, in practice, we might only get access to the final model.
Number of timesteps. When computing the attribution scores, considering the gradients from more timesteps might increase the performance. That is, there is a trade-off between efficacy and computational efficiency. We consider the extreme case that we compute gradients for all the 1000 timesteps, which is computationally expensive. As shown in Figures 6, 7 and 8, the more timestep we consider, the better LDS we can get. However, for our method, setting number of timesteps as 100 even 10 could get performance similar to 1000, while being much faster.
Value A. our initial experiments, we noticed that adding \/ to the kernel before inverting the kernel matrix, is necessary for obtaining better LDS scores. This term may serve for numerical stability and regularization effect as suggested by Hastie (2020). Traditionally the À small and close to zero, however, in case, found that need to set relatively larger X, which might be because the kernel is not divided by the number of training samples N following Park et al. (2023). We search the À from (le-2, 2e-2, 5e-2, le-1, 2e-1, 1e le6, 2e6, 5e6). As shown in Figures and 10, setting a proper X, which adjusts the regularization level, has significant influence on the attribution performance. In our experiments, the peak LDS scores for both TRAK and D-TRAK for fair comparison. In practice, we can search the proper À value by manually examining the attribution visualizations or evaluating the LDS scores on smaller scale LDS benchmark.
search À on the LDDS benchmarks directly and report
C ADDITIONAL EXPERIMENT RESULTS
In this section, we provide additional experiment results of LDS evaluation (on both vetraining-free methods and retraining- based methods) and counterfactual evaluation.
C.I LDS EVALUATION (RETRAINING-FRES METHODS)
As shown in Table 6, on the validation set, with 10/100 timesteps. D-TRAK achieves improvements of +11.55%/+8 8.67% CelebA. On the generation set, with 10/100 timesteps, D-TRAK exhibits gains of 19.82%/46.777 76% the LDS scores. These results highlight the efficacy of D-TRAK and underscore its capacity for enhancing LDS scores.
22

---

Published as a conference paper at ICLR 2024
Table LDS (%) of retraining- baased methods on CIFAR-2 and ArtBench-2 with various S. For TRAK and D-TRAK, we select 10 and 100 timesteps evenly spaced within the interval [1. 7] to approximate E. For each selected timestep, we sample one standard Gaussian noise approximate Eg We set k 32768.
Results on CIFAR-2
Validation
Generation
Method
S
10
100
100
1
12.85 + 0.41
25.52
+ 0.43
6.91
0.44
17.50 + 0.43
TRAK
2
13.19
+ 0.43
27.29
+ 0.43
7.00 + 0.41
19.23 + 0,42
(ensemble)
4
13.27
0.43
27.98
1 0.43
7.08 1 0.41
20.12 1 0,41
(Park et al., 2023)
8
13.36
1.44
0.42
28.59
0.43
7.13
20.67 1 0.41
1
25.71
1: 0.37
32.26
1 0.28
18.90 1: 0.47
24.92 1 0,42
D-TRAK (Ours)
2
27.12
+ 0.38
34.09 1 0.32
20.05 + 0.49
26.61
+ 0.43
(ensemble)
4
27.77
0.36
34.88 + 0.31
20.59 + 27.30
+ 0.45
8
28.07
+ 0.32
35.42
+ 0.33
20.82
0.44
27.75
+ 0.43
64
6.00 0.50
4.12 - 0.46
Empirical IF
128
8.83 + 0.43
6.10 - 0.43
(Feldman & Zhang, 2020)
256
12.17 + 0.47
9.47 = 0.55
512
16.69 + 0.51
12.97 = 0.47
64
5.99 + 0.50
4.08 = 0.45
Datamodel (lyas et al., 2022)
128
8.86 0.44
6.08 + 0.45
256
12.25
9.55 0.54
512
16.94 1 0,50
12.81 + 0.41
Results ArtBench-2
Validation
Generation
Method
S
10
100
100
1
12.84 + 0.46
28.20 + 0.33
9.31 1 0.51
21.32 1 0.77
TRAK
14.86
0.45
31.24
11.19 1 0.51
24.12 1 0.70
(ensemble) (Park al., 2023)
4
16.09 1 0.49
32.89
1 0.34
12.16 1 0.56
25.63
1 0.65
8
16.63 + 0.49
33.91
+ 0.36
12.88 = 0.62
26.50 = 0.65
1
27.39 + 0.40
31.99
+ 0.35
23.51 + 0.58
25.68 1 0.70
D-TRAK (Ours)
2
28.78 + 0.42
10.36 33.08
24.18 + 0.63
26.42 + 0.72
(ensemble)
4
29.70
= 0.44
33.84
24.87 = 0.67
26.94 = 0.75
8
30.21
0.44
34.24 0.39
25.09
27.20 = 0.76
64
4.91 0.50
5.29 0.75
Empirical
128
7.62 0.49
8.67
(Feldman & Zhang, 2020)
256
11.27 1 0.44
11.51 = 0.68
512
16.10 1 0.43
16.45 = 0.67
64
4.99 0.51
5.30 1: 0.76
Datamodel (llyas et al., 2022)
128
7.83 1: 0.46
8.70 -: 0.88
256
11.32 1 0.44
11.48 1 0.62
512
16.19 + 0.47
16.35 = 0.69
C.2 LDS EVALUATION (RETRAINING-BASED METHODSS
As shown in Tables and 8, compare D-TRAK with those retraining-based methods as references on CIFAR-2, CelebA, and ArtBench-2. Under this setting, we need retrain multiple models on different random subsets of the full training set and compute gradients multiple times, where each subset has fixed size of N. We set = 0.5. At the cost of computation, using the gradients computed by independently trained models improves the LDS scores for both TRAK and D-TRAK. Considering 8 models, D-TRAK still performs better than TRAK on various settings.
We also compare D-TRAK with both Empirical Influence and Datamodel. These two methods computationally expensive so we train at most 512 models due to our computation limits. Overall, these methods perform similarly settings. With larger S, which translates into retraining
23

---

Published as a conference paper at ICLR 2024
Table 8: LDS (%) of retraining- baased methods on CelebA with various S. For TRAK and D-TRAK, we select 10 and 100 timesteps evenly spaced within the interval [1, 7 to approximate E, For each selected timestep, we sample one standard Gaussian noise to approximate E.. We k 32768.
Validation
Generation
Method
S
10
100
100
1
13.07 + 0.44 22.14
0,45
9.37 + 0.75
16,51 = 0.51
TRAK
2
13.50
0.43
23.73
0.44
9.26
0.73
17.38 0.58
(ensemble)
4
13.52
1 0.44 24.62 1 0.42
9.38
1 0.69
18.01 1 0.57
(Park al., 2023)
8
13.64 0.42 24.93
0.40
9.36
0.68
18.37 + 0.58
23.04 0.56 27.90
0.52 17.15 + 0.59 20.87 + 0.48
D-TRAK (Ours)
2
23.80 = 0.56 28.72 0.53 17.60 + 0.59 21.79 = 0.52
(ensemble)
4 24.08 + 0.55 29.57 0.49 17.74 + 0.59 22.38 = 0.48
8 24.19 + 0.53 29.64 0.50 17.87 + 0.57 22.58 0.49
64
6.44 0.54
4.58 0.42
Empirical IF
128
8.23 +: 0.54
5.85 1 0.44
(Feldman & Zhang, 2020)
256
11.07 1.
8.82 + 0.36
512
15.55 1 0.42
12.62 1 0.38
64
6.41 +: 0.55
4.51 + 0.42
Datamodel (Ilyas al., 2022)
128
8.16 0.55
5,94 + 0.44
256
11.14 + 0.44
8.92 0.38
512
15.56 + 0.43
12.43 0.36
35
1.0
30
25.
CLIP Sim
0.9
t Dist
10
5
0.7 Random TRAK D-TRAK
Random
TRAK D-TRAK
(a) CelebA
(b) CelebA
Figure 11: Boxplots of counterfactual evaluation CelebA. We quantify the impact of removing the
1,000 highest-scoring training samples and re-training according to Random, TRAK, and D-TRAK. We measure the pixel-wise fi-distance and CLIP cosine similarity between 60 synthesized samples and corresponding images generated by the re-trained models, sampled from the same random seed.
more models and thus more computation needed, the LDS scores grow gradually. However, using 512 models, the LDS scores obtained by these two methods are still substantially lower than D-TRAK, even TRAK.
C.3 COUNTERFACTUAL EVALUATION
In the context of CelebA, the counterfactual evaluation of D-TRAK against TRAK, presented in Figure 11, demonstrates that D-TRAK can better identify influential images that have a larger impact the generated images. When examining the median pixel-wise distance resulting from D-TRAK yields 15.07, in contrast to TRAK's values of 1.02. A reverse trend is observed when evaluating the median CLIP cosine similarity, where D-TRAK obtains lower similarities of 0.896, which are notably lower than TRAK's 's 0.942.
24

---

Published as a conference paper at ICLR 2024
Random
TRAK
D-TRAK
Random
TRAK
D-TRAK
Figure 12: Counterfactual visualization of (Left) automobile and (Right) horse on CIFAR-2. We compare the original generated samples those generated from the same random seed with the retrained models.
Random
TRAK
D-TRAK
Random
TRAK
D-TRAK
Counterfactual visualization (Left) female and (Right) male on CelebA. We compare the original generated samples those generated from the same random seed with the retrained models.
Figure 13:
D VISUALIZATION
We provide visualization results, including counterfactual visualization, proponents and oppo- nents visualization, as well as self-influence (memorization) visualization.
D. COUNTERFACTUAL VISUALIZATION
In the context of CIFAR-2, CelebA, and ArtBench-2 datasets, we compare the original generated samples to those generated from the same random seed with the models trained after the exclusion of the top 1,000 positive influencers identified by different attribution methods including Random, TRAK, and D-TRAK. For both D-TRAK and TRAK, consider 100 timesteps selected to be evenly spaced within the interval T", sample one standard Gaussian noise, and set k = 32768 when computing the gradients. In terms of the LDS(%) performance the generation sets of CIFAR-2, CelebA, and ArtBench-2, D-TRAK and TRAK obtain 25.67% versus 15.87%, 21.47% versus 14.71%, and 26.53% versus 20.02% respectively, reported previously.
As shown in Figure 12, our results suggest that our method D-TRAK can better identify influential images that have significant impact the target image. Take the first row of the left column in
25

---

Published as a conference paper at ICLR 2024
Figure 12 example, the model retrained after removing training samples based on Random and TRAK still generates a automobile image, while the one corresponding to D-TRAK generates image looks similar to mixture of automobile and horse. It is also interesting CIFAR-2 and CelebA, randomly removing 1,000 training samples results in little change in the generated images based manual perception.
that for
D.2 PROPONENTS AND OPPONENTS VISUALIZATION
Following Pruthi et al. (2020), we term training samples that have positive influence score as proponents and samples that have negative value of influence score as opponents. For samples of interest, we visualize the training samples corresponding the most positive and negative attribution scores. The visualizations on CIFAR-2, CIFAR-IO, CelebA, ArtBench-2 and ArtBench-5 are shown in Figures 15, 16, 17, 18 and 19, respectively. We manually check the proponents and opponents. We observe that D-TRAK consistently finds proponents visually more similar to the target samples.
D.3 SELF-INFLUENCE (MEMORIZATION) VISUALIZATION
Motivated by Feldman & Zhang (2020); Zheng & Jiang (2022); Gu et (2023), we also visualize the training samples that have the highest self-influence scores on CIFAR-2 and ArtBench-2 as shown in Figure 20. The self-influent the self-influence scores, we consider 100 timesteps selected to be evenly spaced within the interval [1, and set = 32768. The identified highly self-influenced samples usually look atypical unique, while low self-influence ones have similar samples in the training set. Especially, CIFAR-2, highly self-influenced samples are visually high-contrast.
of x" is computed as TD-TRAK (x", D),, When computing
26

---

Published as a conference paper at ICLR 2024
Random
TRAK
D-TRAK
Random
TRAK
D-TRAK
Figure 14: Counterfactual visualization (Left) post-imporessaion paintings and (Right) ukiyo-e paintings on ArtBench-2. We compare the original generated samples to those generated from the same random seed with the retrained models.
27

---

Published as a conference paper at ICLR 2024
Proponent
Opponent
TRAK 10
0.04
0.036
0.035
0.034
0.034
-0.019
-0.02
-0.027
TRAK 100
0.064
0.039
0.038
0.031
0.03
-0.02
-0.022
-0.025
D-TRAK 10
0.048
0.045
0.041
0.041
0.037
-0.015
-0.017
-0.023
D-TRAK 100
0.062
0.049
0.049
0.048
0.045
-0.019
-0.02
-0.023
(a) Validation
Proponent
Opponent
TRAK
0.017
0.015
0.015
0,015
0.015
-0.011
-0.011
-0,012
TRAK 100
0.028
0.026
0.022
0.021
0.021
-0.016
-0.016
-0.02
D-TRAK 10
0.104
0.091
0.08
0.074
0.065
-0.024
-0.026
-0.029
D-TRAK 100
0.11
0.071
0.069
0.06
0.058
-0.02
-0.021
-0.022
(b) Generation
Figure 15: Proponents and opponents visualization on CIFAR-2 using TRAK and D-TRAK with various of timesteps (10 or 100). For each sample of interest, 5 most positive influential training samples and most negative influential training samples are given together with the influence scores (below each sample).
28

---

Published as a conference paper at ICLR 2024
Proponent
Opponent
TRAK 10
0.004
0.004
0.004
0.004
0.003
-0.003
-0.003
-0.003
TRAK 100
O. 0.009
0.008
0.008
0.007
0.006
-0.004
-0,004
-0,005
D-TRAK 10
0.017
0.016
0.013
0.013
0.012
-0.004
-0.004
-0,005
D-TRAK 100
0.017
0.016
0.013
0.011
0.01
-0.003
-0.003
-0.004
(a) Validation
Proponent
Opponent
TRAK
0.002
0.002
0.002
0,002
0.002
-0.002
-0.002
-0.002
TRAK 100
0.008
0.008
0.008
0.007
0.007
-0.005
-0.006
-0,006
D-TRAK 10
0.007
0.007
0.006
0,006
0.006
-0. -0.002
-0.002
-0.003
D-TRAK 100
0.007
0.007
0.007
0.007
0.007
-0.002
-0.002
-0.002
(b) Generation
Figure 16: Proponents and opponents visualization on CIFAR-I0 using TRAK and D-TRAK with various of timesteps (10 or 100). For each sample of interest, 5 most positive influential training samples and most negative influential training samples are given together with the influence scores (below each sample).
29

---

Published as a conference paper at ICLR 2024
Proponent
Opponent
TRAK 10
0.013
0.011
0.01
0.01
0.009
-0.006
-0.007
-0.007
TRAK 100
0.031
0.024
0.024
0.021
0.02
-0.014
-0.016
-0,018
D-TRAK 10
0.035
0.028
0.028
0.027
0.026
-0.01
-0.01
-0.01
D-TRAK 100
0.046
0.034
0.034
0.028
0.027
-0.012
-0.012
-0.012
(a) Validation
Proponent
Opponent
TRAK 10
0.018
0.016
0.016
0.016
0.015
-0.011
-0.011
-0.012
TRAK 100
0.031
0.031
0.03
0.029
0.027
-0.022
-0,026
-0,026
D-TRAK 10
0.036
0.029
0.028
0.028
0.027
-0.013
-0.014
-0.015
D-TRAK 100
0.037
0.035
0.034
0.033
0.033
-0.012
-0.013
-0.016
(b) Generation
Figure 17: Proponents and opponents visualization on CelebA using TRAK and D-TRAK with various of timesteps (10 or 100). For each sample of interest, 5 most positive influential training samples and most negative influential training samples are given together with the influence scores (below each sample).
30

---

Published as a conference paper at ICLR 2024
Proponent
Opponent
TRAK 10
0.013
0.012
0.012
0.012
0.011
-0.01
-0.011
-0.011
TRAK 100
0.021
0.02
0.019
0.019
0.019
-0.017
-0.017
-0.018
D-TRAK 10
0.086
0.042
0.035
0.033
0.031
-0.01
-0.011
-00113
D-TRAK 100
0.12
0.049
0.04
0.04
0.038
-00012
-0.012
-0.013
(a) Validation
Proponent
Opponent
TRAK 10
0.039
0.032
0.029
0.025
0.024
-0.018
-0.019
-0.019
TRAK 100
0.063
0.062
0.056
0.053
0.043
-0.05
-0.053
-0.06
21
D-TRAK 10
0.019
0.018
0.018
0.017
0.016
-0.005
-0.006
-0,006
D-TRAK 100
0.034
0.029
0.027
0.026
0.025
-0.008
-0.009
-0.01
(b) Generation
Figure 18: Proponents and opponents visualization ArtBench-2 using TRAK and D-TRAK with various timesteps (10 or 100). For each sample of interest, 5 most positive influential training samples and most negative influential training samples are given together with the influence scores (below each sample).
31

---

Published as a conference paper at ICLR 2024
Proponent
Opponent
TRAK 10
0.016
0.015
0.014
0.013
0.013
-0.011
-0.011
-0.012
TRAK 100
0.015
0.014
0.014
0.013
0.012
-0.009
-0.009
-0.01
D-TRAK 10
0.022
0.018
0.016
0.015
0.015
-0.005
-0.006
-0,006
D-TRAK 100
0.031
0.024
0.023
0.023
0.021
-0.007
-0.007
-0.007
(a) Validation
Proponent
Opponent
TRAK 10
0.04
0.036
0.036
0.034
0.027
-0.037
-0.044
-0.051
TRAK 100
0.092
0.089
0.067
0.067
0.065
-0.09
-0.094
-0.114
D-TRAK 10
0.096
0.075
0.049
0.044
0.041
-0.011
-0.011
-0,019
D-TRAK 100
0.105
0.074
0.055
0.049
0.047
-0.013
-0.014
-0.017
(b) Generation
Figure 19: Proponents and opponents visualization ArtBench-5 using TRAK and D-TRAK with various timesteps (10 or 100). For each sample of interest, 5 most positive influential training samples and most negative influential training samples are given together with the influence scores (below each sample).
32

---

Published as a conference paper at ICLR 2024
Mem
Not Mem
Auto mobile
0.843
0.822
0.821
0.797
0.795
0.157
0.15
0.146
Horse
0.843
0.798
0.713
0.677
0.673
0.19
0.175
0.17
CIFAR-2
Mem
Not Mem
Post
Impress.
0.754
0.551
0.54
0.52
0.51
0.066
0.066
0.065
Ukiyo-e
0.597
0.568
0.541
0.458
0.447
0.06
0.058
0.057
(b) ArtBench-2
Figure 20: Self-influence visualization on CIFAR-2 and ArtBench-2. For each class, the top given together with the
self-influenced training samples and the bottom self-influence self-influence scores (below each sample). Samples with high self-influence scores look more unique, while those with low self ceff-infuence scores have similar samples in the training set.
33

---

Published as a conference paper at ICLR 2024
E COUNTERFACTUAL EVALUATION AT A PARTICULAR STEP
Journey TRAK Georgiev et al. (2023) is designed to conduct data attribution at a particular sampling timestep and thus produce different attribution scores for each timestep. However, our method D-TRAK is designed to conduct data attribution for the final generated images and thus produce only one attribution for the entire diffusion trajectory. To conduct a counterfactual evaluation between these two methods, we adapt D-TRAK to Journey TRAK's 's setting by sharing the same attribution scores for all timesteps. We also apply this adaptation to the Random and TRAK baselines and include them in this evaluation.
We consider timestep 400 and 300. Then we compute attribution scores on 60 generated samples using different attribution methods. For Random, TRAK, and D-TRAK, we still use the retraining-free free settings described in Section 4.4 and share the same attribution scores for both timestep 400 and 300. For Journey TRAK, we compute the attribution scores specific to each timestep. Especially, for Journey TRAK, we set the number of resampling rounds of the random noise at each timestep as 10 when computing the gradients with respect to Journey TRAK's 's model output function. We also consider an ensemble variant of Journey TRAK to strengthen its performance via ensembling the attribution scores computed from 8 models. Given the attribution scores for each sample, we then retrain the model after removing the corresponding top-1000 influencers.
For simplicity, we abbreviate Journey TRAK as J-TRAK and the ensemble variant as J-TRAK (8). As shown in Figures 21 and 23, when examining the median pixel-wise fisd distance resulting from eemoving-and-retrainnng D-TRAK yields 7. 7.39/8.71 71 and 194.18/195.77 for CIFAR-2 and ArtBench-2 at timestep 400/300 respectively, in contrast to J-TRAK (8)'s values of 6.63/7.01 and 774.76/17,,000 75.06. D-TRAK obtains median similarities of 0.927/0.899 and 0.773/0.740 for the above two datasets at timestep 400/300 respectively, which are notably lower than J-TRAK (8)'s values of 0.961/0.939 and 0.816/0.805, highlighting the effectiveness of our method.
We manually compare the original generated samples to those generated from the same random seed with the re-trained models. As shown Figures 22 and 24, our results first show that J-TRAK (8) can successfully induce larger effect on diffusion models" generation results via removing high-scoring training images specific to a sampling timestep, compared to baselines like Random and TRAK. Second, although D-TRAK is not designed for attributing particular sampling timestep, results suggest our method can better identify images that have a larger impact on the target image at a specific timestep via removing high-scoring training images based on attribution scores derived from the entire sampling trajectory. Finally, it is also worth noting that for different timesteps, J-TRAK (8) identifies different influential training examples to remove and thus leads to different generation results. Take the 4h row in both Figures 22 and 24 as an example, for the timestep 400, J-TRAK (8) leads the diffusion model to generate a man with the white beard. However, for the timestep 300, it is a man with brown bread and an extra hat. In contrast, D-TRAK removes the same set of influential training examples for different timesteps and thus produces consistent generation: still-life painting for both timestep 400 and 300. The above phenomenon again highlights the differences between Journey TRAK and D-TRAK.
Journey TRAK may perform better via ensembling more models like 50 models at the cost of computations as suggested in Georgiev et al. (2023). Nonetheless, in this paper, we are more interested in the retraining-free setting.
34

---

Published as a conference paper at ICLR 2024
Random
Random
TRAK
TRAK
D-TRAK
D-TRAK
J-TRAK
J-TRAK
J-TRAK (8)
J-TRAK (8)
12
0.8
100
200
0.6
82 Dist (1=400)
CLIP Sim (L=400)
& Dist (1=400)
CLIP Sim (I=400)
(a) CIFAR-2
(b) ArtBench-2
Figure 21: Boxplots of counterfactual evaluation at timestep 400 on CIFAR-2 and ArtBench-2. We quantify the impact of removing the 1,000 fighest-scoring training samples and re- re-training according Random, TRAK, D-TRAK, J-TRAK and J-TRAK (8). J-TRAK is short for Journey TRAK. We measure the pixel-wise f2-distance and CLIP cosine similarity between 60 synthesized samples and corresponding images generated by the re- re-trained models when sampling from the same random seed.
t=400
Random
TRAK
D-TRAK
J-TRAK
J-TRAK
t=400
Random
TRAK
D-TRAK
J-TRAK
J-TRAK
Figure 22: Counterfactual visualization at timestep 400 on CIFAR-2 and ArtBench-2. We compare the original generated samples to those generated from the same random seed with the retrained models. The images are blurry as expected since they are noisy generated images at a particular timestep.
35

---

Published as a conference paper at ICLR 2024
Randomn
Random
TRAK
TRAK
D-TRAK
D-TRAK
J-TRAK
J-TRAK
J-TRAK (8)
J-TRAK (8)
12
0.8
0.9
1.0
100
200
300
0.5 0.6
0.7
0.8
099 1.0
82 Dist (1=300)
CLIP Sim (I=300)
& Dist (I=300)
CLIP Sim (I=300)
(a) CIFAR-2
(b) ArtBench-2
Figure 23: Boxplots of counterfactual evaluation at timestep 300 CIFAR-2 and ArtBench-2. We quantify the impact of removing the 1,000 highest-scoring training samples and re-training according Random, TRAK, D-TRAK, J-TRAK and J-TRAK (8). J-TRAK is short for Journey TRAK. We measure the pixel-wise la-dittacce and CLIP cosine similarity between 60 synthesized samples and corresponding images generated by the re-trained models when sampling from the same random seed.
1-300
Random
TRAK
D-TRAK
J-TRAK
J-TRAK (8)
t-300
Random
TRAK
D-TRAK
J-TRAK
J-TRAK (8)
Figure 24: Counterfactual visualization at timestep 300 on CIFAR-2 and ArtBench-2. We compare the original generated samples to those generated from the same random seed with the retrained models. The images blurry expected since they are noisy generated images at particular timestep.
36


Reviews:
[{"review_id": "vFhRwsFRPk", "reviewer": "Reviewer_yBWG", "summary": "This paper proposes variants of TRAK for diffusion models by calculating the gradients with respect to various different loss functions and discover that alternative loss functions perform better than the original TRAK in terms of LDS, a data attribution metric.", "questions": "See weaknesses.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 2, "strengths": "The paper is simple and easy to follow. The extensive experiments on different settings provide solid evidence of D-TRAK performing better than TRAK in terms of LDS. Readers can be easily convinced that there is an issue with either TRAK as a data attribution method or LDS as a data attribution metric.", "weaknesses": "Despite the solid experiment results, the desiderata of a data attribution paper is different from an adversarial attack paper. For adversarial attacks, the success of an attack is a sufficient contribution. This could not be said for data attribution. Successfully finding techniques to optimize for a data attribution metric is only meaningful **if the technique reveals insight**, because in practice attackers have no control over the data attribution method. Therefore, unlike writing adversarial attack papers, more insight to explain why changing the loss function would lead to better LDS score should be provided. Is the non-convexity at fault? Is LDS not an appropriate metric? Is there something special about diffusion models that TRAK fails to capture? How does different norm losses lead to better or worse LDS score?\n\nThe observation of this paper is extremely interesting. Providing some insights about the success of D-TRAK over TRAK would make it publication-worthy.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "3mOjwozVt2", "reviewer": "Reviewer_nsDq", "summary": "This paper tackles the problem of attributing images generated by diffusion models back to the training data of these models. They make simple modifications to existing methods [1, 2] and report significantly better results on a standard evaluation metric (LDS) for this task. The authors do not provide a justification for the discrepancy in empirical results between their method and [1], and call for further exploration of the design choices within data attribution methods for diffusion models.\n\n\n[1] Sung Min Park, Kristian Georgiev, Andrew Ilyas, Guillaume Leclerc, and Aleksander Madry. Trak:\nAttributing model behavior at scale. In International Conference on Machine Learning (ICML),\n2023.\n\n[2] Kristian Georgiev, Joshua Vendrow, Hadi Salman, Sung Min Park, and Aleksander Madry. The\njourney, not the destination: How data guides diffusion models. In Workshop on Challenges in\nDeployable Generative AI at International Conference on Machine Learning (ICML), 2023.\n\n---\n\nScore raised from 5 to 6 after authors' response.", "questions": "- Why is the rank correlation close to $0$ when $\\mathcal{L}\\_{square}$ is used for both $\\phi^s$ and $\\mathcal{F}$ (Table 4)?\nThe authors have observed that $\\mathcal{L}\\_{square}$ is useful as a model output function when predicting $\\mathcal{L}\\_{simple}$ or $\\mathcal{L}\\_{ELBO}$. It is particularly odd then that it does not do a good job at predicting *itself*. Is there any particular reason why that might be the case?\n\n- Why set $\\mathcal{Q}\\equiv \\frac{\\partial\\mathcal{L}}{\\partial\\mathcal{F}}$ to be the identity matrix even when $\\mathcal{F}\\neq \\mathcal{L}$?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- The authors thoroughly test their proposed method on a number of datasets \n- The authors present strong empirical results across a variety of settings", "weaknesses": "- Out of the listed baselines, to the best of my knowledge only Journey TRAK [1] has been explicitly used for diffusion models in previous work. As the authors note, Journey TRAK is not meant to be used to attribute the *final* image $x$ (i.e., the entire sampling trajectory). Rather, it is meant to attribute noisy images $x_t$ (i.e., specific denoising steps along the sampling trajectory). Thus, the direct comparison with Journey TRAK in the evaluation section is not on equal grounds.\n\n- For the counterfactual experiments, I would have liked to see a comparison against Journey TRAK [1] used at a particular step of the the sampling trajectory. In particular, [1, Figure 2] shows a much larger effect of removing high-scoring images according to Journey TRAK, in comparison with CLIP cosine similarity. \n\n- Given that the proposed method is only a minor modification of existing methods [1, 2], I would have appreciated a more thorough attempt at explaining/justifying the changes proposed by the authors.\n\n[1] Kristian Georgiev, Joshua Vendrow, Hadi Salman, Sung Min Park, and Aleksander Madry. The\njourney, not the destination: How data guides diffusion models. In Workshop on Challenges in\nDeployable Generative AI at International Conference on Machine Learning (ICML), 2023.\n\n[2] Sung Min Park, Kristian Georgiev, Andrew Ilyas, Guillaume Leclerc, and Aleksander Madry. Trak:\nAttributing model behavior at scale. In International Conference on Machine Learning (ICML),\n2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jZuKDb43Xb", "reviewer": "Reviewer_3yAm", "summary": "This work considers the topic of data attribution with diffusion models, which means quantifying the importance of training examples to model generations. Previous work on this topic has explored a range of techniques, including with gradient-based calculations and retraining-based calculations, and this work builds off of TRAK (a gradient-based method that can leverage retraining runs, but can also avoid doing so). \n\nThe proposed method, D-TRAK, deviates from TRAK in ways that the authors describe as theoretically unjustified. Namely, they use a non-standard measure of parameter sensitivity for each generation, and they omit a term that should only be ignored when the loss and model output $\\mathcal{F}$ are identical. Surprisingly, they find that this heuristic version of TRAK works better than the original version, achieving better performance in the LDS metric that's designed around TRAK's original formulation.\n\nThis raises natural questions about why, which the authors don't answer. However, they observe consistently better performance than competing methods across several datasets, a couple evaluation approaches, and that performance improves when several retraining runs are used.", "questions": "Several questions are mentioned in the weaknesses section above.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "Data attribution is an interesting problem that's increasingly important with widely used generative models trained on web-scraped datasets. It's computationally and theoretically challenging, so developing new methods for this task is a valuable contribution. This work builds off of one the better-performing methods in the literature, TRAK, and observes performance for D-TRAK that makes it, to my knowledge, the most effective method available. And it preserves the advantages of TRAK, particularly the relative efficiency compared to methods that require many model retraining runs (e.g., the original datamodels approach from which TRAK is derived).\n\nThe evaluation is thorough, although it's restricted mostly to small datasets. This is perhaps understandable given the cost of running certain retraining based methods, but it would be helpful for the authors to clarify why they can't use ArtBench itself, for example. It seems like the cost of running TRAK/D-TRAK should be manageable, given that retraining is optional in these methods?\n\nThe experiments are also thorough in terms of the baselines considered. I appreciated the appendix section that concisely describes each method.", "weaknesses": "The main weakness is that in terms of data attribution methodology, the contribution here is shallow. The paper essentially finds that a couple heuristics improve performance, and offers no explanation for why. The paper acknowledges this with statements like \"the mechanism of data attribution requires a deeper understanding,\" which are true, but this is not ideal for a publication. A paper proposing a new and improved method should offer some understanding of why it works, and the paper barely attempts to do so. The analysis in Section 3.2 about interpolating between TRAK and D-TRAK provides no insight on why D-TRAK works, it only shows that interpolated versions are strictly worse (which is not an especially interesting point, I don't see why we would have expected this to work).\n\nThe point above is my main concern, and I wonder whether this paper could be more valuable given time to revise it and offer an appropriate explanation for why D-TRAK works.\n\nSeveral other thoughts:\n\n- There is an emphasis in the introduction on the role of non-convexity in this setting, and its potential impact on TRAK not working as expected. After reading the paper, I'm not sure it ultimately addresses this point, or offers any explanation for how D-TRAK circumvents the issue. Can the authors expand on that subject in the paper?\n\n- In Section 2.2, I'm not sure it's correct that Shapley values are proposed to *evaluate* data attributions, they're suggested to define data attributions (or more specifically, data valuation scores). In any case, this would be due to Ghorbani & Zou, not Lundberg & Lee.\n\n- In Section 2.2, the lead-up to Definition 2 is hard to follow. It might be helpful to explicitly state that the LDS score considers the sum of attributions as an additive proxy for $\\mathcal{F}$, as it's explained in the original datamodels work.\n\n- In Section 2.3, the authors write that retraining-based methods offer better efficacy than gradient-based methods. Is there existing work that makes this point, or or is this an allusion to results showing that D-TRAK/TRAK improve when using retraining runs? I'm not clear on whether this point is generally true or only true for TRAK, so it could be helpful to clarify.\n\n- Many of the results reflect that the LDS score depends strongly on the number of time steps used when approximating the expectation $\\mathbb{E}_t$. It therefore seems like the results entangle two separate concerns: the intrinsic correctness of the attribution method, and the efficiency of estimation. Both matter, but interpreting the results is more difficult because we don't know if either method has converged to its theoretical value due to imprecision in the expectation. I wonder if this subject deserves more discussion in the paper. For example, is there a good reason why D-TRAK should be easier to estimate?\n\n- Can the authors explain the consistent drops in LDS scores when shifting from validation examples to generations? \n\n- Related to my main concern described above, do the authors have any other ideas for why their alternative $\\mathcal{L}$ formulations make sense? The point in eq. 8 doesn't tell us much. One intuition I have is that it's fundamentally difficult to predict the exact noise value, because there are many \"denoising paths\" to recover the original image when large noise is added. $\\mathcal{L}_{simple}$ therefore seems like a questionable choice to determine whether the model works well for a given image. I'm not sure the new proposals are more sensible, but perhaps they get at, in a limited sense, whether the predicted noise values are at least Gaussian? Further discussion around why they work seems important for the paper.\n\n- On a broader note, can the authors justify their choice to focus on the LDS metric defined via $\\mathcal{L}_{simple}$? It seems convenient and natural in a way, because it's how the model is trained, but I don't see an argument that this faithfully represents the model's tendency to generate particular images. I see that this design choice is motivated by prior work, but it seems like a strange implementation decision because it's disconnected from what we really care about, which is whether the model will produce certain generations.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)