"What Data Benefits My Classifier?" Enhancing Model Performance and Interpretability through Influence-Based Data Selection
Authors: Anshuman Chhabra
Peizhao Li
Prasant Mohapatra
Hongfu Liu
Venue: ICLR 2024 oral (2024)
Keywords: Data Selection
Interpretability
Fairness
Robustness
Primary area: general machine learning (i.e., none of the above)

Abstract: Classification models are ubiquitously deployed in society and necessitate high utility, fairness, and robustness performance. Current research efforts mainly focus on improving model architectures and learning algorithms on fixed datasets to achieve this goal. In contrast, in this paper, we address an orthogonal yet crucial problem: given a fixed convex learning model (or a convex surrogate for a non-convex model) and a function of interest, we assess what data benefits the model by interpreting the feature space, and then aim to improve performance as measured by this function. To this end, we propose the use of influence estimation models for interpreting the classifier's performance from the perspective of the data feature space. Additionally, we propose data selection approaches based on influence that enhance model utility, fairness, and robustness. Through extensive experiments on synthetic and real-world datasets, we validate and demonstrate the effectiveness of our approaches not only for conventional classification scenarios, but also under more challenging scenarios such as distribution shifts, fairness poisoning attacks, utility evasion attacks, online learning, and active learning.

Published as a conference paper at ICLR 2024
"WHAT DATA BENEFITS MY CLASSIFIER?" ENHANCING MODEL PERFORMANCE AND INTERPRETABILITY THROUGH INFLUENCE-BASED
DATA SELECTION
Anshuman Chhabra', Peizhao Li Prasant Mohapatra', and Hongfu Liu University of California, Davis (chhabra, succaaiisi..cccccccccomom edu
Brandeis University {peizhaoli, hotgguliul edu
GE HealthCare
ABSTRACT
Classification models are ubiquitously deployed society and necessitate high utility, faimess, and robustness performance. Current research efforts mainly focus on improving model architectures and learning algorithms on fixed datasets to achieve this goal. In contrast, in this paper, we address orthogonal yet crucial problem: given a fixed convex learning model (or a convex surrogate for a non- convex model) and function of interest, we assess what data benefits the model by interpreting the feature space, and then aim to improve performance as measured by this function. To this end, propose the use of influence estimation models for interpreting the classifier's performance from the perspective of the data feature space. Additionally, we propose data selection approaches based on influence that enhance model utility, fairness, and robustness. Through extensive experiments on synthetic and real-world datasets, we validate and demonstrate the effectiveness of approaches not only for conventional classification scenarios, but also under more challenging scenarios such as distribution shifts, fairness poisoning attacks, utility evasion attacks, online learning, and active learning.
INTRODUCTION
Machine learning models have become essential tools in various societal applications for automating processes and generating insights (Pouyanfar et al. 20188] Liu et al.) 2017). ). Along with the choice of model type/architecture, data is critical component of the learning process, and the quality and quantity of training data have significant impacts on the model performance (Blum & Langley 1997). Despite this, current research mainly focuses on proposing high-performing model architectures or learning approaches while keeping the training data fixed. However, is evident that not every sample in the training augments model performance. Furthermore, the same data sample could be beneficial or detrimental to performance depending on the type of model being used (Blum & Langley 1997.. Therefore, in this paper, we aim answer the research question "what data benefits the learning model in certain aspect?" and select suitable training data to improve model performance
Our work relates but contrasts with research on data valuation. Data valuation aims to assign monetary value or worth to a particular set or collection of data, whereas our goal in this work is to analyze what type of data can be utilized to enhance model. Data valuation can be performed in variety of ways, such using cooperative game theory (Shapley-valuu or Banzhaf index) (Ghor
bani & Zou 2019 Jia et al. 2019 Kwon & Zou 2022 Ghorbani et al.) 2020 Wang Jia 2023) and reinforcement learning Yoon et al. 2020). It is also important note that as alternative to influence functions, Shapley-value based data valuation approaches (Ghorbani & Zou| 2019: Jia et al. 2019) can also be used in our algorithms. However, Shapley-value based approaches such as TMC-Shapley (Ghorbani & Zou 2019) require the model be retrained and evaluated multiple times, where even the most efficient known con-distributional model-specific algorithms (Tia et al. 2019) require (w/n 22 model retraining steps, and n is the number of training samples. Other ap-
With respect to utility/accuracy, faimess, and adversarial robustness.

---

Published as a conference paper at ICLR 2024
proaches such as ENN-Shapley (Jia et al. 2018) that computationally efficient are model-agnostic and designed to work with utility. Hence, KNN- Shapley is neither tailored to the specific model being used nor a function of interest other than utility (such as fairness and robustness). and cannot guar- antee performance on the downstream classifier (Blum & Langley 1997). Moreover, current work on Shapley-value based frameworks generally estimate the data value utility, with either very few no work studying fairness (Arnaiz-Rodie Rodriguez et al., 2023) and robustness. Reinforcement learning- baasdd data valuation (Yoon al.) 2020) faces similar issues due its complex design and poor convergence.
Our work is also closely related to other work on data influence, such as the seminal paper on influ- ence functions by Koh and Liang (Koh & Liang 2017), follow-up work such as TracIn (Pruthi et al., 2020). representer poinr (Ych et al. 2018), and Hydra (Chen et al. (202)) However, these methods are fundamentally influence estimation approaches, and do not directly answer our research question, which is to identify and interpret the feature space for improving the model's performance. Other miscellaneous approaches, such as Datamodels (Ilyas et al. (022) only work with one specific target sample at time, posing limitation. Unlike all these methods, uniquely handle scenarios where data is unlabeled such as in active learning applications. Moreover, work considers utility, fairness, and robustness under diverse application scenarios. Note that our data selection strategy can even boost the performance of methods such as the influence based data reweighing approach of (Li & Liu 2022) for improving fairness (Section (.1] and outperform existing influence-based approaches for active learning (Liu et al. (202)) (Section (5.5). Thus, we utilize influence functions tool (allowing for any influence approach be used interchangeably)
data selection approaches can also
and extend its applicability to diverse domains and scenarios not considered previously.
Finally, our work also conceptually relates to several other data-related areas. Data efficiency ap- proaches (Paul et al. [022 [Coleman et al. 2020; Mirzasoleiman et al., 2020; Shen & Sanghavi 2019) Killamsetty et al. [021] Jain et al.) 2022) aim accelerate deep model training by pruning or select- ing a subset of data, which is beyond the scope of our work. Feature selection approaches (Cai et al., 2018 Hall 1999) aim to select important features for training, but are limited in scope as they only work for utility. Active learning (Cohn et al. 1996] Wei et al.] 2015) partially aligns with our research question, as it involves selecting unlabeled data points to be annotated and added to the training set for improving model performance. However, its applicability is limited to this specific scenario, while our work considers a broader range of applications, including this one. Antidote data methods (Raste garpanah et al. 2019 Chhabra al. 2022b Li et al., 2023) aim to add generated data to the training set for mitigating unfairness but cannot be used to interpret the usefulness of existing samples.
Contributions. We summarize our major contributions as follows:
We utilize influence functions to assess what data improves given convex classifier (or a surrogate for a non-convex model) with respect to utility, faireess, and robustness by interpreting the feature space. Our key idea is to use tree-based influence estimation models to understand and interpret which sample features contribute positively or negatively to the model's performance with respect to desired evaluation functions on validation set. Additionally, we design data selection strategy to achieve performance improvements.
We verify the correctness of our proposed approaches to improve the classification model's utility, fairness, and robustness on synthetic data and demonstrate the usefulness of our approaches on real-world diverse datasets with regard to efficacy, simplicity, and interpretability.
We move beyond the above classical classification setting and apply our approaches to diverse and practical application scenarios, including correcting for faimess distribution shift, combating fairness poisoning attacks, defending against adaptive evasion attacks, online learning with streaming batch data, and analyzing unlabeled sample effectiveness in active learning.
PRELIMINARIES AND BACKGROUND
We first introduce influence functions on convex models (logistic regression) and how to measure sam- ple influence on utility, fairness, and robustness. We then discuss extensions to non-convex models.
Influence Functions. Given a training set = ((x,, v and classifier trained using empirical risk minimization by loss function E, we have the optimal parameters of the clas- sifier Φ arg mingge n Σm= ()) Influence functions (Koh & Liang (017) mea- sure the effect of changing an infinitesimal weight of samples on a valıdation set, based on an impact function evaluating the quantity of interest, such utility, faimess, and robust-
2

---

Published as a conference paper at ICLR 2024
ness. Downweighting training sample 2j by very small fraction leads the model param- eter to f(zz; -c) = arg mingge 1 n Ei=1 {(T; yr: - el(zz, U): The actual impact of such
change can be written as (x;; -c) = [(0(z); -)) - [(0), where s(0(zz; -c) can be ob- strictly convex and twice differen- tiable, and f is also differentiable, the actual impact can be estimated without expensive model retraining by I(zzi-
tained by retraining the model without z--- Assuming
lim f(((z); -)) f(0) = Vof(o) H VV Vol(zz, U5: 8), where H - Vgl(a,, 0) is the Hessian matrix of & and is invertible since is assumed to be convex. Thus, we can measure the influence of removing sample x from the training set as I(-2z).
Mcasuring Influence on Utility. If we instantiate the impact function f to calculate the loss value on a validation set V, we can measure the training sample influence on utility as follows:
I (-o))
Σ
Vollz, 0] H V ( 0):
(1)
(A.VVV
Measuring Influence on Fairness. Similarly, we can instantiate the impact function f by group fairesss (Dwork et al. 2012), such as demographic parity (DP) or equal opportunity (EOP) to measure influence fairness. Consider binary sensitive attribute defined as g E {0, 1) and let denote the predicted class probabilities. The fairness metric DP is defined as: fDPrtair (0, V) Σv g 1] Ev [eg = O]|. Based on that, we can calculate the training sample influence on fairness as follows
D-P (-r:)) = V DP-Gair (Ó. V) "HH" VV Val(xs, O.;
(2)
Mcasuring Influence on Adversarial Robustness. We can also measure which points contribute to adversarial robustness (or vulnerability) using influence functions. To do so, we first define an adversary- any attack approaches to craft adversarial samples that can be used including black-box, white-box, among others. We consider a white-box adversary (Megyeri et al. 2019 specific to linear models, which can be easily extended to other models and settings, such as FGSM (Goodfellow ct al. 2014). PGD (Madry et al. 2017). etc. To craft an adversarial sample, we take each sample x of the validation set V and perturb it as x' = x - 7 8 o+ where E Rd are the linear model coefficients, b E IR is the intercept, and 7 decision boundary is a hyperplane, we simply move each sample orthogonal to it by adding minimal perturbation. In this manner, we can obtain adversarial validation set V which consists of x' for each sample x of V. The class labels y remain unchanged. Now, we can compute adversarial robustness influence for each training sample as follows:
controls the amount of perturbation added. Since the
Irobust x.:)
Σ (x (x''))EV'
Volla' y. 0) THH ' Vol(os,
Extension to Non-Convex Models. A current limitation of influence functions is that they require the model to satisfy strict convexity conditions. implying its Hessian is positive definite and invertible, and that it is trained to convergence (Koh & Liang. 2017). To extend influence functions to non- convex models, several possible solutions exist: (1) a linear model can be used as a surrogate on the embeddings obtained via the non-convex model (Li & Liu 2022); (2) a damping term can be added to the non-convex model such that its Hessian becomes positive definite and invertible (Han et al. 2020): :
and (3) for certain tasks specific or second-order influence functions can be derived (Basu et al. 2020b
Alaa & Van Der Schaar 2020). In this paper, we adopt the above first strategy for non-convex models.
Note that there is work that shows that influence functions for deep learning models are fragile (Basu et al., 2020a). However, follow-up work (Bac et al. 2022 Epifano et al. 2023) has contrasted with some of these findings, resulting in the applicability of influence functions in deep learning being contentious research topic. Despite this, multiple work has demonstrated their benefits in deep networks, such as on BERT (Han et al. 2020)). ResNets (Liu et al.. 2021 Yang et al., 2022). CNNs (Koh & Liang 2017 Schioppa et al. (022). We also provide preliminary results using our data selection approach on BERT to show this (Appendix H). However, our paper is primarily focused on convex models and resolving the undecided research question of deep learning influence fragility is not our goal. Thus, we resort to using surrogate convex model on the embedding space of the non-convex model. This strategy subsequently obtains positive experimental performance as well.
We provide the sample influence definitions for EOP in Appendix A
3

---

Published as a conference paper at ICLR 2024
3 PROPOSED APPROACHES
We now present Algorithm| for influence estimation via trees to interpret how data samples and feature ranges impact model performance with respect to utility, faimess, and robustness. Additionally, we propose Algorithm 2 for trimming training samples improve model performance given a budget.
3.1 ESTIMATING THE INFLUENCE OF SAMPLES
Influence functions can efficiently estimate the data impact in various aspects. To further provide their interpretations, we employ decision trees to uncover which sample features contribute positively or negatively to the model's performance with respect to desired evaluation functions. To address the issue of the tree depth on interpretability, we utilize hierarchical shrinkage (Agarwal et al., (022) to regularize the tree. We present our approach for influence estimation in Algorithm [ which takes as input regularization parameter X. training set Z, validation set V, and an influence function definition I for samples in Z on V. Specifically, we iterate over each training set tuple (z,, y4) E Z and create new regression dataset M where the regressor is [a,, 3i] (block matrix notation implies appending y; to the end of x;) and the response variable is computed via IM (-xx). Note that we append the label our dataset since influence estimation is dependent class labels.
Then, we train a regression tree h using CART (Breiman et al., 2017). To ensure that the tree is interpretable while preserving performance, we utilize hierarchical shrinkage post-training. For our tree h and for given sample qi in the dataset M, let its leaf-to-root node path in the tree denote as to C hw-1 C... to- Here the represents the leaf node and to is the root node. Then we define two mapping functions for ease of readability: o and ç. The function takes input tree node and returns the number of samples it contains. The function takes as imput the query sample q and the tree node and outputs the average predictive response for at node L. The overall regression tree prediction model for qi can then be written as: h(())= E(g;, (o) + Σ E(gt,4) - ((%:;4-1) Hierarchical shrinkage regularizes the tree h by shrinking the prediction over each tree node by the sample means of its parent nodes, (((..t))((
Algorithm 1 Influence Estimation Via Trees
Input: Training set Z, Validation set V. Influence fune-
tion Z=F. Hyperpurameter À
Output: Influence Estimator Tree å
I: initialize M 0.
2: for (ot4 Us) E 7 do
9i + [#,, 91) /aappnnding label to 2t
4: M + M
end for
6: train using CART (Breiman al. 2017) M. return by using hierarchical shrinkage (Agarwal
ct 2022 h with
h(q.)) = E(g. to) + Σド= 1+X/0(6-11
3.2 DATA TRIMMING FOR SUPERVISED MODELS
We present Algorithm 2 for trimming training datasets which takes input before Z, V, I for samples in on V. and a budget b for the number of samples to remove and outputs the trimmed dataset Z' The goal is to remove sam- ples from the dataset that have negative influ- ence. First, we initialize the sets J, K, and Z'. Then we populate J with the influence values of samples in J, and K with the indices of these samples (lines 2-3). We then sort in order of increasing positive influence, and K according
Algorithm 2
Data Trimming
Input: Training set 2, Validation set V. Influence func- tion I2,, Budget b Output: Trimmed Datasct Z'
1: inittalize < 0, K 0, 7/ + G.
2: for (z4. v.) E Z do
J
(IF((=:))) //on set K K<-KUn (
4:
5: end for
sort in ascending order.
7: sort K using J.
8: 1/ + Σ 1 1j00.EJ.
to the sorted order obtained via J. In K we only care about the first min (b, b4} indices (line 9) where is the total number of negative influence samples (line 8). Finally, we select only those samples to be part of Z' that do not have indices in this subset of K and return Z'.
9: z' + Z' (z.). Kmmin(6,W)). E Z.
10: return Z'.
4 EXPERIMENTAL RESULTS
In this section, we present results for our algorithms presented in the previous section. We first verify the correctness of our algorithms on synthetically generated toy data. We analyze how our influence
4

---

Published as a conference paper at ICLR 2024
Traininng Set ind sence Regions
Himmed Samples in training Set.
Velidation Set Performance
Pre
1.00
Accuracy
Compen
2
-6
-2
Feature
the DP 0.60
Post
Feimess
Feature
Feature
Feature
0.0
Robustness
7.30000
Feature
Feature
Feature
group
minortty group
posttive
oriiinal decision
class, majority group
class, majority group
negative influence
decision boundary
Figure I: Correctness verification on toy data for utility (accuracy), fairness, and robustness functions. (+) class samples are denoted in blue, (-) class samples are denoted orange, majority group samples are denoted by о and minority group samples are denoted by x. A, D, and G show the training set with the original logistic regression decision boundary, and we visualize the influence regions generated by our tree model from Algorithm] I Las positive (light green) or negative (light red) for each function: arilityfffirmessrobuutnssss
B, E, and denote the points to be trimmed as identified by 2 for each function type. C and F denote the validation set and how we obtain improved accuracy and fairness performance on it after trimming. I denotes the adversarial validation set and improve performance adversarial data.
Algorithm
how post trimming
estimation algorithm can be used to visualize and interpret regions of positive or negative influence, and trim the training to improve accuracy, fairness, and robustness the validation set. We then demonstrate the effectiveness of our algorithms on test sets of four real-world datasets and greatly improve their performance, especially for fairness and robustness.
Correctness Verification on Toy Data. We generate 150 train and 100 validation samples using two isotropic 2D-Gaussian distributions and use logistic regression for binary classification. We then analyze the training sample's positive/negative impact on model's accuracy, fairness and robustness in Figure AA D. and G. respectively. The green regions denote the positive influences, while the pink re- gions denote the negative influences. These regions show the feature values derived from training sam- ples that affect the linear model either positively or negatively for the function of interest. In Figure [ A, most samples contribute positively for utility, and hence lead to positive influence regions. Simi- larly, in DD most of the samples are harmful for fairness as the (+) class has a large number of majority group samples and the (-) class has a large number of minority samples. Thus, most of the re- gions identified are of negative influence on fairness. Subseguently. we use Algorithm 2 with budget b = 10 to obtain the points to be trimmed, shown in Figure B E, and H. We then remove these points from training set, resulting in significant performance improvement on the validation set for each func- tion of interest, shown in Figure CC, F, and I. Notably, the robustness is significantly improved from
5

---

Published as a conference paper at ICLR 2024
Adhit
Bank
CalehA
JigeawTvvirty
0.50
1m1
7.4
0.60
Accuracy
8.30
8.8--
0.00 D88
1553
T.39
0.19
0.20
0000000
1:23
020
0.00
lm1
0.00
5.
40
30
0.0
50
352
16.4 16-2
30.4
104
122
2300
3.50
Faimess
2:00
2:00
0:75
1.00
520
0100
280
150
510
170
125
E
6:25 0.5
H
1:11
3011
Robustness
0.00
6.00
2.50
5.0
3.02
0:00
4m 3.00
2.0
6.00
0.00
1:00
2,00
0.50
3.40
0.0
% Semples Trimmed
Influence-oased Deletion
Random Deletion
Influence Value
Figure 2: Double y-plot of our trimming method on the test sets of Adult, Bank, CelebA, and Jigsaw Toxicity. The left y-axes present algorithmic accuracy, faireess, and robustness, while the right y-axes present the influence value of the trimmed samples. Higher values indicate better accuracy and robustness, while lower values indicate better fairness. The blue lines represent the performance of our trimming method, while the red lines represent the performance with random trimming.
0.01 to 0.42 by simply removing the identified points. Additionally, Figure [ shows an adversarial set with samples perturbed Section 2 where adversarial points crowd around the original decision boundary and are difficult to classify accurately. Note that while validation of influence computations has been well-demonstrated in previous studies (Koh Liang 2017 Li
Liu 2022), we provide comparisons for actual sample influence via model retraining and estimated influence in Appendix B
Algorithmic Performance on Real-World Datasets. We demonstrate the performance of our proposed methods on four real-world datasets, consisting of two tabular datasets Adult (Kohavi et al.) 1996) and Bank (Moro et al. 2014), one visual dataset CelebA (Liu et al.) 2018). and one textual dataset Jigsaw Toxicity (Noever 2018). Details on
Faimess Influence
-0333
c.om1
Feature 385
datasets and training are present in Appendix C Influence is measured the validation set and logistic regression is the base model used. We present results on test sets of these datasets in Figure 2 along with influence value magnitudes corresponding to trimmed samples for each function type. Results with using MLP as the base model are shown in Appendix D.I exhibit similar trends. While full visualizations of the tree estimators (Algorithm T for all four datasets are presented in Appendix F as descriptive example we provide the left subtree for fairness influence on Jigsaw Toxicity in Figure
2b
1.
Class Label
Feature 160
Feature 63
Inf 0.11
Infi 0.10 (055
Inf 0.21 (esamppesse)
Infi =0 (fsompless
Figure Example influence subtree.
In Figure 2 we demonstrate the effect of increasing the budget b of our trimming approach (up to 5% of training data) and compare it to a random baseline that removes b training samples The results show that methods able to improve fairness (DP and robustness significantly, while the random baseline fails to do so. This is particularly evident for datasets where large fairness disparities exist. Additionally, we are able to achieve significant improvements in accuracy on the adversarial test set for all datasets, indicating that our trimming can improve the model's 's robustness by effectively selecting training samples. However, observe that trimming does not lead much improvement in accuracy for most datasets, except for Bank, where we obtain a 10% increase. We conjecture that
5)
We fail wholly compare with model-spceific Shapley-value data valuation methods such TMC-Shapley Ghorbani & Zou 2019) in utility due to their prohibitively long execution time on our datasets. However, we
provide some preliminar results on subsampled data and exccution time comparisons in Appendix H
"Additional experiments using EOP as the faireess metric are presented in Appendix D.2

---

Published as a conference paper at ICLR 2024
Time Shifted
Location Shifted
Time Location Shifted
0.15
0.15
0.08
[DP]
0.30
0.04
0
0.05
0.03
0.00
0.00
0.75
0.76
0.77
0.78
0.70
0.75
0.90
3.68
0.71
0.74
0.77
Accuracy
Vanilla Unteir ALL Classiter
Ia reatch
Correlstion Shift
Tormess Reweighing x Ours
Figure 4: Performance of fairness and utility of several fairness algorithms under distribution shift. A greener background denotes a better solution in terms of both accuracy and fairness.
the current logistic regression models may already achieve optimal performance these datasets, seen by the quick decrease in utility influence value, which suggests little room for improvement. This also implies that may not require much training data to achieve similar utility results.
APPLICATION SCENARIOS BEYOND CONVENTIONAL CLASSIFICATION
We extend the conventional classification setting of the previous section by conducting extensive experiments for various practical deployment and maintenance scenarios, such as correcting distribu- tion shift unfaimesss, combating (faimess) poisoning and (utility) evasion attacks, online learning with streaming batch data, and analyzing unlabeled sample effectiveness for active learning. We thus show the effectiveness of our proposed methods in improving model performance across diverse application scenarios either by trimming the training set, or by identifying new beneficial samples to add to it.
5.1 MITIGATING UNFAIRNESS UNDER DISTRIBUTION SHIFT
We demonstrate how our proposed method can serve as an effective fairness intervention and enhance the current methods under distribution shift. Fairness- speccfcc distribution shifts (Roh et al., 2023) occur when the distribution of sensitive attributes (and class labels) between the training and test sets have drifted apart, resulting in severe issues of unfairness on the test set. Although
a newly emerging direction, some pioneering attempts (Roh et al.) 2023 Maity et al., 2021 Giguere cet al. 2022) have been taken to address the change in bias between the original and test distribution. Typically, these methods have access to some samples from the test set to study the change in bias. In our experiments, these samples can constitute the validation set V given that the validation and test set correlated with each other. Here we employ multiple fair intervention approaches as baselines- such as Correlation Shift (Roh et al. 2023). FairBatch (Roh et al.] 20 Robust Fair Logloss Classifier (RLL) (Rezaei et al.) 2020), Influence-based Reweighing (Li & Liu 2022). and vanilla logistic regression. We use the ACS Income (Ding et al. 2021) dataset and construct three different distribution shift scenarios- time-based, scenarios, we use the same training data constituting California (2014) data with 18000 samples, while the test sets consist of 6000 different samples: for time-based shift, this comprises California (2018) data, for rncation-based shift, it is Michigan (2014) data, and for the lime@-locaiion-aaat shift, we use Michigan (2018) data. We set budget
timedclocttion-aae based. In all three
600 which constitutes only 3.33% the training set.
We present results fairness-accurace plots in Figure We show that our trimming based approach can greatly improve fairness under distribution shift even when utilized with the vanilla model, making it competitive with the fairness intervention basclines. Moreover, except for the vanilla model (Figure 4 A&C), our trimming approach with the faimess intervention methods improves their accuracy significantly well. This demonstrates the generalizability of our approach, as it can be used as a pre-processing step to boost the performance of other mitigation strategies.
5.2
COMBATING POISONING ATTACKS AGAINST FAIRNESS
We use our trimming approach as effective defense for mitigating poisoning attacks against fairness. Recently, several attacks (Solans et al. 2021 Mehrabi et al. 2021 Chhabra et al., 2023a) have been proposed to reduce faimess of learning models. Random Anchoring Attack (RAA) and Non-random Anchoring Attack ANRAA)(Mchrabl et al. 2021) are two representative ones. These first select a set of target points to attack, and then poison small subset of the training data by placing additional
7

---

Published as a conference paper at ICLR 2024
anchoring points near the targets with the opposite class label. The target samples uniformly ran- domly chosen in RAA, while NRAA selects "popular" target samples that result in the maximization of bias for all samples in the test set post the attack. Here follow the original implementations of RAA and NRAA and use their same datasets including German (Hsieh) 2005). Compas (Brennan al. 2009), and Drug (Fehrman al. 2017). Since all these different sizes we set the trimming
budget b v 10% of training samples and the attacker's poisoning budget is 10% of training samples.
Table 1 shows the results obtained. Our trim- ming approach is useful for combating fairness- reducing poisoning attacks, as it improves fairness (and utility for Compas) performance compared to the metric values obtained before and after the attacks. It is also significant to note that there are currently no well perl-pnrn defenses proposed for the aforementioned attack in the supervised setting (Chhabra et al. 2023a).
Table I: Performance of faimness poisoning attacks
Method
German
Compas
Drag
DP
ACC
DP
ACC
DP
ACC
Before
0.117
0.670
-0.281
0.652
0.371
0.668
RAA
-0.029
0.655
-0,060
0.630
0.225
0.657
RAA + Ours
0.000
0.650
-0.082
0.643
0.090
0.616
NRAA
0.268
0.665
0.168
0.652
0.501
0.665
NRAA + Ours
0.005
0.650
0.048
0.654
0.142
0.657
Our trimming approach thus shows promise potentially the first defense against such attacks as improves fairness significantly without sacrific- ing utility. Also note that since the defender does not know how many points the attacker poisons, the goal here is not to discover poisoned samples, but maximizing performance on the test set compared to both pre-attack and post-attack performance by trimming a small number of training samples.
5.3 DEFENDING AGAINST ADAPTIVE EVASION ADVERSARIES
In addition fairness shifts and poisoning defense, we show how the influence-based trimming approach can help defend against an adaptive adversary ( (Tramer et al. 2020; Biggio er al. 2013) that conducts evasion attacks on the given learning model. Here, adaptive refers to the adversary being able to target the given defense. In our case, the attacker can randomly select test samples conduct the attack. Notably, this is significantly different from our robustness analysis in Section 4 where we create an adversarial set using all test samples and then trim samples to optimize robustness accuracy. Here we defend by choosing to trim the training set by a fixed amount, but we have no knowledge of what samples are adversarial during inference.
We use the attack described in Section 2 to attack logistic regression. The attacker is adaptive to randomly choose between 5-25% of the test set samples to perturb. Correspondingly, we let the defender trim only 2.5% of the training set using AlgorithmßI 2] We repeat these experiments between the attacker and defender over 10 runs for the datasets used in Section 4 In Figure 5 we plot the pre-attack accuracy, the post-attack accuracy distribution, as well as the post-attack accuracy distribution after trimming the training set and retraining the model, indicate that trimming the training set after the attack can be a viable defense. With just 2.5% of the training data trimmed, we find that we can increase performance well beyond pre-attack values.
the test set. These results
5.4 ONLINE LEARNING WITH STREAMING DATA AND NOISY LABELS
So far, considered classification problems with fixed training set. In this part, we consider the online classification setting with streaming batch data. Online learning is a popular choice when learning models need to be implemented on memory constrained systems, or to combat distribution shift (Hoi et al. 2021 Montiel et al., 2021). Online learning assumes that the training data arrives in sequential batches and the learning model trains/updates on each batch sequentially. Here we reuse
Adult
Bank
CelebA
JigsawToxicity
0.85
0.85
0.74
0.72
Accurscy
0.80
0.80
0.80
0.70
0.75
0.68
0.70
0.70
0.65
Trimming Dafense
Attack
Figure 5: Defending with our trimming method against adaptive evasion attacks on four datasets.
8

---

Published as a conference paper at ICLR 2024
Adult
Hank
ColeDA
Hissew/ exicity
6.20
w Tries
Accuracy
0.60
10.55
0.00
Rondom Entrng
0.44
Margin
0:50
0.22
0.55
Infueence
(Durs)
0.50
JAAAN 64
Lrow
UF
10
Figure 6: A D: Online learning with noisy labels using logistic regression and linear Support Vector Machines with and without our influence-based trimming strategy on four datasets; E: Comparison of different active learning strategies on the Diabetic Retinopathy dataset.
the datasets in Section 4 and trim samples in each batched stream of data using Algorithm 2 Note that we estimate influence over each batch independently. To make the setting more practical, we consider that the data stream might consist of noisy class labels- where one-third of samples that arrive in batch have noisy labels flipped from the original ground truth labels. We set the trimming budget to be 10% of the batch size, and train on 10 sequential batches of data. We then measure test set accuracy with and without trimming each batch for both the online models. Figure A-D show the performance of logistic regression and linear Support Vector Machines (SVMs) (Joachims 2006) trained in an online manner with Stochastic Gradient Descent (Ketkar 2017) with and without our trimming processing. It can be seen that trimming combined with our influence estimation model can lead to much better performance for all the given datasets (except Bank) and learning models.
5.5 ACTIVE LEARNING
Finally, we employ our approaches for active learning by choosing beneficial samples for annotation. Active learning (Cohn al., 1996) constitutes a small labeled training set, and a large pool of unlabeled samples, where the goal to pick samples from the unlabeled set for annotation and then retrain the model on the combined data for boosting performance. It is generally employed in fields where annotation is very expensive undertake, such as in medicine and health.
Here, we use a linear SVM as our learning model since a number of active learning strategies work optimally for SVM models (Kremer et al., 2014). We simulate an active learning use-case, following prior work (Zhang & A [2016] Ahsan er al., 2022), by using the Diabetic Retinopathy (Decencière et al.) 2014) dataset. The dataset consists of 115T retina images of patients and can be used for predicting whether they suffer from diabetic retinopathy or not. We use the image features as extracted in (Antal & Hajdu 2014). In this setting, there are 10 rounds of querying for annotations, where each round allows for 10 samples to be annotated. As a result, by the end of the final round we will have an additional 100 labeled samples available. We consider the following baselines for active learning- random sampling, entropy sampling (Holub et al. 2008). margin sampling (Balcan jet al., 2007), uncertainty sampling (Nguyen et al.) 2022), and ISAL (Liu et al.) 2021) which is an influence-basee strategy that uses base model predictions as pseudo-labels to compute influence. For our influence-buse based sampling, since we do not have access to labels in the unlabeled set, we train our tree estimation model (Algorithm I) without labels. Then we use the estimator to predict the influence of the unlabeled samples. Out of these we select the 10 highest influence samples available in each round for labeling. Note that our anfluence-based sampling is deterministic over multiple runs since our tree estimator is deterministic when provided the same input. We present results for this experiment in Figure 6 E over 5 runs. It can be seen that our influence sampling outperforms other baselines in most rounds, and ends up with the best performance after the final round, demonstrating its effectiveness. We obtain similar results on our four real-world datasets in Appendix G
CONCLUSION
In this paper, we extended influence functions to assess what data improves a given convex classifier (or surrogate for non-convex model) with respect to utility, fairness, and robustness by interpreting the feature space. We used tree-based influence estimation models to interpret which sample features contribute positively negatively to the model's performance. We also designed a data selection strategy to achieve performance improvements. Through extensive experiments on synthetic and real-world datasets, and diverse application settings such as poisoning/evasion attacks, distribution shift, online and active learning, we showed how our simple and general approaches for data selection can significantly boost performance and provide valuable insights for practitioners.

---

Published as a conference paper at ICLR 2024
7 ETHICS STATEMENT
Our work touches upon an important problem of selecting data for a fixed model to improve its performance in terms of utility, faimess, and robustness. For applications requiring fairness and equity (Chhabra et al. 2021 2023b Zafar et al., 2017; Sapiezynski et al. 2019), our approach can constitute an important preprocessing step that helps reduce bias and diserimination in systems. Our approach can also help ensure systems are robust (Xu & Mannor, 2012, Feurer et al. 2015) and tegh-rrrfnnnnng under diverse problem settings, allowing these models to better serve their use-cases. It is also important to note that work consists only of positive contributions (such as regarding interpretability, improving fairness, defending against attacks, etc.), and the approaches cannot be used in problematic way by malicious adversary.
Throughout the paper, we show that by employing our influence-based estimation models and simple influence-basse data trimming, we can augment performance in multiple diverse problem scenarios. However, our approaches have limitations that we believe can be investigated in future work. First, better interpretability mechanisms can be designed using influence that outdo the benefits of using rule sets derived from decision trees. Second, our current data trimming approach is very simple- it is heuristic. While simplicity was the current goal of our work in this paper, better approaches for data trimming or selection can be developed. Third, our approach can be utilized on deep learning models (such as transformers (Vaswani al., 2017)) and studied in more diverse non-convex deep learning tasks and use-cases. For instance, it is important to study robustness of large language models (Chhabra al. 2024) and deep unsupervised models (Chhabra et al.) (202aa), among others not covered in this work. Future work can delve into influence selection approaches for such models.
REFERENCES
Abhineet Agarwal, Yan Shuo Tan, Omer Ronen, Chandan Singh, and Bin Yu. Hierarchical shrinkage: Improving the accuracy and interpretability of tree-based models. In International Conference on Machine Learning, 2022.
Muhammad Ahtazaz Ahsan, Adnan Qayyum, Adeel Razi, and Junaid Qadir. An active learning method for diabetic retinopathy classification with uncertainty quantification. Medical & Biological Fngineering & Computing, 2022.
Ahmed Alaa and Mihacla Van Der Schaar. Discriminative Jackknife: Quantifying uncertainty in deep learning via higher-order influence functions. In International Conference on Machine Learning, 2020.
Bálint Antal and András Hajdu. An ensemble- system for automatic screening of diabetic retinopathy. Knowledge-based Systems, 2014.
Adrian Emaiz-Rodriguee Francisco Escolano, and Nuria Oliver. FairShap: Data Re-weithting Approach for Algorithmic Faimnsss based on Shapley Values. arXiv preprint arXiv:2303.01928. 2023.
Juhan Bae, Nathan Ng, Alston Lo, Marzyeh Ghassemi, and Roger B Grosse. If influence functions the answer, then what is the question? Advances in Neural Information Processing Systems, 2022.
Maria-Florina Balcan, Andrei Broder, and Tong Zhang. Margin based active learning. In Annual Conference on Learning Theory, COLT. Springer, 2007.
Samyadeep Basu, Philip Pope, and Soheil Feizi. Influence functions in deep learning are fragile. arXiv preprint arXiv:2006. 14651, 2020a.
Samyadeep Basu, Xuchen You, and Soheil Feizi. On second-order group influence functions for black-box predictions. In International Conference on Machine Learning. 2020b.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šmdić Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In ECML PKDD, 2013.
10

---

Published as a conference paper at ICLR 2024
Avrim L Blum and Pat Langley. Selection of relevant features and examples in machine learning. Artificial Intelligence, 1997.
Leo Breiman, Jerome H Friedman, Richard A Olshen, and Charles J Stone. Classification and regression trees. Routledge. 2017.
Tim Brennan, William Dieterich, and Beate Ehret. Evaluating the predictive validity of the compas risk and needs assessment system. Criminal Justice and Behavior, 2009.
Jie Cai, Jiawei Luo. Shulin Wang, and Sheng Yang. Feature selection in machine learning: A new perspective. Neurocomputing, 2018.
Yuanyuan Chen, Boyang Li. Han Yu, Pengcheng Wu, and Chunyan Miao. Hydra: Hypergradient data relevance analysis for interpreting deep neural networks. In AAAI Conference on Artificial Intelligence, 2021.
Anshuman Chhabra, Karina Masalkovaité, and Prasant Mohapatra. An overview of fairness in clustering. IEEE Access, 2021.
Anshuman Chhabra, Ashwin Sekhari, and Prasant Mohapatra, On the Robustness of Deep Clustering Models: Adversarial Attacks and Defenses. Advances in Neural Information Processing Systems, 2022a.
Anshuman Chhabra, Adish Singla, and Prasant Mohapatra. Fair clustering using antidote data. In Algorithmic Fairness through the Lens of Causality and Robustness workshop, 2022b.
Anshuman Chhabra, Peizhao Li, Prasant Mohapatra, and Hongfu Liu. Robust Fair Clustering: A Novel Faimess Attack and Defense Framework. In International Conference Learning Representations, 2023a.
Anshuman Chhabra, Kartik Patwari, Chandana Kuntala, Deepak Kumar Sharma, Prasant Mohapatra, et al. Towards Fair Video Summarization. Transactions on Machine Learning Research, 2023b.
Anshuman Chhabra, Hadi Askari, and Prasant Mohapatra. Revisiting Zero-Shot Abstractive Summa- rization in the Era of Large Language Models from the Perspective of Position Bias. arXiv preprint arXiv:2401.01989 2024.
David A Cohn, Zoubin Ghahramani, and Michael Jordan. Active learning with statistical models. Journal of Artificial Intelligence Research, 1996.
C Coleman, C Yeh, Mussmann, B Mirzasoleiman, P Bailis, P Liang, Leskovec, and M Zaharia. Selection via proxy: Efficient data selection for deep learning. In International Conference on Learning Representations, 2020.
Etienne Decencière, Xiwei Zhang, Guy Cazuguel, Bruno Lay, Béatrice Cochener, Caroline Trone, Philippe Gain, Richard Ordonez, Pascale Massin, Ali Erginay, et al. Feedback publicly distributed image database: the Messidor database. Image Analysis & Stereology, 2014.
Frances Ding, Moritz Hardt, John Miller, and Ludwig Schmidt. Retiring Adult: New datasets for fair machine learning. In Advances in Neural Information Processing Systems, 2021.
Cynthia Dwork, Moritz Hardt, Toniann Pitassi, Omer Reingold, and Richard Zemel. Fairness through awareness. In Innovations in Theoretical Computer Science Conference, 2012.
Jacob R Epifano, Ravi P Ramachandran, Aaron J Masino, and Ghulam Rasool. Revisiting the fragility of influence functions. Neural Networks, 162:581-588, 2023.
Elaine Fehrman, Awaz K Muhammad, Evgeny M Mirkes, Vincent Egan, and Alexander N Gorban. The five factor model of personality and evaluation of drug consumption risk. In Data Science: Innovative Developments in Data Analysis and Clustering. Springer, 2017.
Matthias Feurer, Aaron Klein, Katharina Eggensperger, Jost Springenberg, Manuel Blum, and Frank Hutter. Efficient and robust automated machine learning. Advances in Neural Information Processing Systems, 2015.
11

---

Published as a conference paper at ICLR 2024
Amirata Ghorbani and James Zou. Data shapley: Equitable valuation of data for machine learning. In Interaational Conference on Machine Learning, 2019.
Amirata Ghorbani, Michael Kim, and James Zou. A distributional framework for data valuation. In International Conference on Machine Learning, 2020.
Stephen Giguere, Blossom Metevier, Bruno Castro da Silva, Yuriy Brun, Philip Thomas, and Scott Niekum. Faimess guarantees under demographic shift. In International Conference on Learning Representations, 2022.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Mark A Hall. Correlation-bused feature selection for machine learning. PhD thesis, The University of Waikato, 1999.
Xiaochuang Han, Byron C Wallace, and Yulia Tsvetkov. Explaining black box predictions and unveiling data artifacts through influence functions. In Annual Meeting of the Association for Computational Linguistics, 2020.
Steven CH Hoi, Doyen Sahoo, Jing Lu, and Peilin Zhao. Online learning: comprehensive survey. Neurocomputing. 2021.
Alex Holub, Pictro Perona, and Michael C Burl. Entropy-based active learning for object recognition. In IEEE Computer Society Conference on Computer Vision and Pattern Recognition Workshops. IEEE, 2008.
Nan-Chen Hsieh. Hybrid mining approach the design of credit scoring models. Expert Systems with Applications, 2005.
Andrew Nyas, Sung Min Park, Logan Engstrom, Guillaume Leclere, and Alcksander Madry. Data- models: Predicting predictions from training data, arXiv preprint arXiv:2202.00622, 2022.
Eeshaan Jain, Tushar Nandy, Gaurav Aggarwal, Ashish V Tendulkar, Rishabh Tyer, and Abir De. Efficient data subset selection to generalize training across models: Transductive and inductive networks. 2022.
Ruoxi Jia, David Dao, Boxin Wang, Frances Ann Hubis, Nezihe Merve Gurel, Bo Li, Ce Zhang, Costas Spanos, and Dawn Song. Efficient task specific data valuation for nearest neighbor algorithms. Proceedings of the VLDB Endowment, 2018.
Ruoxi Jia, David Dao, Boxin Wang. Frances Ann Hubis, Nick Hynes, Nezihe Merve Gürel, Bo Li, Ce Zhang, Dawn Song, and Costas J Spanos. Towards efficient data valuation based on the Shapley value. In International Conference on Artificial Intelligence and Statistics, 2019.
Thorsten Joachims. Training linear svms in linear time. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2006.
Nikhil Ketkar. Stochastic gradient descent. Deep learning with Python: A hands-on introduction, 2017.
Krishnateja Killamsetty, Xujiang Zhao, Feng Chen, and Rishabh lyer. Retrieve: Coreset selection for efficient and robust semi-supervised learning, Advances in Neural Information Processing Systems, 34:1 144110 2021.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International Conference on Machine Learning, 2017.
Ron Kohavi et al. Scaling the accuracy of uaive-bayes classifiers: A decision-tree hybrid. In KDD, 1996.
Jan Kremer, Kim Steenstrup Pedersen, and Christian Igel. Active learning with support vector machines. Wiley Interdisciplinayy Reviews: Data Mining and Knowledge Discovery, 2014.
12

---

Published as a conference paper at ICLR 2024
Yongchan Kwon and James Zou. Beta Shapley: Unified and Noise-reduced Data Valuation Framework for Machine Learning. In International Conference on Artificial Intelligence and Statistics, 2022.
Peizhao Li and Hongfu Liu. Achieving fairness no utility cost via data reweighing with influence. In International Conference on Machine Learning, 2022.
Peizhao Li, Ethan Xia, and Hongfu Liu. Learning antidote data to individual unfairesss In International Conference on Machine Learning, 2023.
Weiho Liu, Zidong Wang, Xiaohui Liu, Nianyin Zeng, Yurong Liu, and Fuad E Alsaadi. A survey of deep neural network architectures and their applications. Neurocomputting. 2017.
Zhuoming Liu, Hao Ding, Huaping Zhong, Weijia Li, Jifeng Dai, and Conghui He. Influence selection for active learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2021.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiavou Tang. Large-scale Celebfaces attributes (CelebA) dataset. Retrieved August, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: (tt:::/706600333 2017.
Subha Maity, Debarghya Mukherjee, Mikhail Yurochkin, and Yuekai Sun. Does enforcing fairness mitigate biases caused by subpopulation shift? In Advances in Neural Information Processing Systems, 2021.
István Megyeri, István Hegedūs, and Márk Jelasity. Adversarial robustness of linear models: regular- ization and dimensionality. i6doc. com, 2019.
Ninareh Mehrabi, Muhammad Naveed, Fred Morstatter, and Aram Galstyan. Exacerbating algorith- mic bias through fairness attacks. In AAAI Conference on Artificial Intelligence, 2021.
Baharan Mirzasoleiman, Jeff Bilmes, and Jure Leskovec. Coresets for data-efficient training of machine learning models. In International Conference on Machine Learning, 2020.
Jacob Montiel, Max Halford, Saulo Martiello Mastelini, Geoffrey Bolmier, Raphael Sourty, Robin Vaysse, Adil Zouitine, Heitor Murilo Gomes, Jesse Read, Talel Abdessalem, et al. River: machine learning for streaming data in python. The Journal of Machine Learning Research, 2021.
Sérgio Moro, Paulo Cortez, and Paulo Rita. A data-driven approach to predict the success of bank telemarketing. Decision Support Systems, 2014.
Vu-Linh Nguyen, Mohammad Hossein Shaker, and Eyke Hüllermeier. How to measure uncertainty in uncertainty sampling for active learning. Machine Learning, 2022.
David Noever. Machine learning suites for online toxicity detection. arXiv preprint arXiv:1810.0186) 2018.
Mansheej Paul, Surya Ganguli, and Gintare Karolina Dziugaite. Deep learning on data diet: Finding important examples early in training. In Advances in Neural Information Processing Systems, 2021.
Samira Pouyanfar, Saad Sadiq, Yilin Yan, Haiman Tian, Yudong Tao, Maria Presa Reyes, Mei- Ling Shyu, Shu-Ching Chen, and Sundaraja S Iyengar. A survey on deep learning: Algorithms, techniques, and applications. ACM Computing Surveys (CSUR), 2018.
Garima Pruthi, Frederick Liu, Satyen Kale, and Mukund Sundararajan. Estimating training data influence by tracing gradient descent. Advances in Neural Information Processing Systems, 2020.
Bashir Rastegarpanah, Krishna P Gummadi, and Mark Crovella. Fighting fire with fire: Using antidote data to improve polarization and faimess of recommender systems. In ACM International Conference Web Search and Data Mining, 2019.
13

---

Published as a conference paper at ICLR 2024
Ashkan Rezaei, Rizal Fathony, Omid Memarrast, and Brian Ziebart. Fairness for robust log loss classification. In AAAI Conference on Artificial Intellignnce 2020.
Yuji Roh, Kangwook Lee, Steven Euijong Whang, and Changho Suh. Fairbatch: Batch selection for model fairness. In International Conference on Learning Representations, 2021.
Yuji Roh, Kangwook Lee, Steven Euijong Whang, and Changho Suh. Improving fair training under correlation shifts. In International Conference on Machine Learning. 2023.
Piotr Sapiezynski, Wesley Zeng, Ronald Robertson, Alan Mislove, and Christo Wilson. Quantifying the impact of user attentionon fair group representation in ranked lists. In The World Wide Web Conference, 2019.
Andrea Schioppa, Polina Zablotskaia, David Vilar, and Artem Sokolov. Scaling up influence functions. In AAAI Conference on Artificial Intelligence, 2022.
Yanyao Shen and Sujay Sanghavi. Learning with bad training data via iterative trimmed loss minimization. In International Conference on Machine Learning. 2019.
David Solans, Battista Biggio, and Carlos Castillo. Poisoning attacks on algorithmic fairness. In ECML PKDD. Springer, 2021.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In Advances in Neural Information Processing Systems, 2020.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Information Processing Systems, 2017.
Jiachen T Wang and Ruoxi Jia. Data Banzhaf: Robust Data Valuation Framework for Machine Learning. In International Conference Artificial Intelligence and Statistics, 2023.
Wenhui Wang, Furu Wei, Li Dong, Hangbo Bao, Nan Yang, and Ming Zhou. Minilm: Deep self- attention distillation for task-agnostic compression of pre-trained transformers. In Advances in Neural Information Processing Systems, 2020.
Kai Wei, Rishabh Iyer, and Jeff Bilmes. Submodularity in data subset selection and active learning. In International Conference on Machine Learning, 2015.
Huan Xu and Shie Mannor. Robustness and Generalization. Machine Learning, 86:391-425 423, 2012.
Shuo Yang, Zeke Xie, Hanyu Peng. Min Xu, Mingming Sun, and Ping Li. Dataset pruning: Reducing training data by examining generalization influence. In The Eleventh International Conference on Learning Representations, 2022.
Chih-Kuan Yeh, Joon Kim, Ian En-Hsu Yen, and Pradeep K Ravikumar. Representer point selection for explaining deep neural networks. Advances Neural Information Processing Systems, 2018.
Jinsung Yoon, Sercan Arik, and Tomas Pfister. Data valuation using reinforcement learning. In International Conference on Machine Learning, 2020.
Muhammad Bilal Zafar, Isabel Valera, Manuel Gomez Rogriguez, and Krishna Gummadi. Fairness constraints: Mechanisms for fair classification. In Artificial Intelligence and Statistics, 2017.
Yinan Zhang and Mingqiang An. An active learning classifier for further reducing diabetic retinopathy screening system cost. Computational and Mathematical Methods in Medicine, 2016.
14

---

Published as a conference paper at ICLR 2024
APPENDIX
A INFLUENCE FUNCTION DEFINITION FOR EOP
Let there be binary sensitive attribute defined g {0, 1). The equal opportunity (EOP) fairnsss metric can then be defined as:
fEOP fair (0,V)= Ev v: -1 1] By 1,9 0
Now the influence function definition is:
Z (-x,) V fof fEO (0, (0. H 'V Vgl((,,,b6
(4)
B INFLUENCE FUNCTION VS ACTUAL EFFECT VIA LEAVE-ONE-ON RETRAINING ON ToY DATA
6.
0.4
0.8
02
APhU falmmese infunnce
0.5
0.0
0.4
-02
0.2
-04
0.0
-0.6
0.2
-00
-1.
-0.6
0.25
Prodicted
Predicted
Predictedd Inflcnnc
(a) Utility
(b) Fairness
(c) Robustness
Figure 7: Predicted vs actual influence analysis with leave-one-out training over 125 samples (out of 150 total training samples). Spearman's rank correlation coefficient (p) between the predicted and actual influence values also shown.
we present results comparing sample influence of points measured using influence functions to their actual influence obtained via leave-one-out retraining on the toy dataset. In the latter case we essentially measure the change in the function of interest (utility/fairness etc.) on the entire dataset versus when the point being considered removed and the model retrained on the remaining samples. We remove total of 125 points out of 150 samples in the training set as part of this experiment.
In Figure 7
Figure 7a shows these results for utility, Figure 7b for fairness, and Figure 7c for robustness. It can be seen that the approximated and actual influences are very close together and we further quantify this by computing the Spearman's 's rank correlation coefficient p. As the value obtained in each case 0.99, this indicates high similarity in predicted and actual influence.
C DETAILS REGARDING MODEL TRAINING, DATASET SPLITS, AND MISCELLANEOUS INFORMATION
C.I DATASET INFORMATION AND SPLITS
For CelebA we utilize extracted features provided by the dataset authors, and for Jigsaw Toxicity extract text embeddings via the MiniLM transformer model (Wang et al. 2020). We set sex (male/female) as the sensitive attribute for Adult, Bank, CelebA, and ethnicity (black/other) for Jigsaw Toxicity. Further details provided below.
15

---

Published as a conference paper at ICLR 2024
Bank. For this dataset, have total of 30,488 samples, with 18,292 training samples, 6,098 validation set samples, and 6098 test set samples. The number of features are 51. We use sex (malc/female) the sensitive attribute for fairness. The target to predict is whether not (yes/no) client will subscribe to a term deposit.
Adult. For this dataset, have total of 45,222 samples, with 30,162 training samples, 7,530 validation set samples, and 7,530 test set samples. The number features are 102. We use sex (male/female) as the sensitive attribute for fairness. The target predict is whether income is $50k (yes) or I $50k (no).
CelebA. For this dataset, we have total of 104,163 samples, with 62,497 training samples, 20,833 validation set samples, and 20,833 test set samples. The number of features are 39, We use sex (male/female) as the sensitive attribute for fairness. The target predict is whether given person smiling (yes) not (no).
Jigsaw Toxicity. For this dataset, we have total of 30,000 samples, with 18,000 training samples, 6,000 validation set samples, and 6,000 test set samples. The number of features are 385. We use ethnicity (black/other) as the sensitive attribute for fairness. The target to predict is whether a given tweet is toxic (yes) or not (no).
C.2 MITIGATING DISTRIBUTION SHIFT EXPERIMENT DETAILS
In these experiments for the main paper, we basically use logistic regression as the base learning model and utilize our trimming algorithm. This constitutes the results on the vanilla model shown in the figures for each distribution shift. Now, we utilize the same points identified for deletion using approach and measure performance before and after trimming these for all other fairness intervention baselines. Note that we use Logistic Regression as surrogate in this case which allows us to effectively compute sample influence and improve the fairness performance of these approaches. Note that since we are using logistic regression, there is very little variance observed in the results. All the other baselines are used as provided by the authors.
C.3 ONLINE LEARNING WITH NOISY LABELS EXPERIMENT DETAILS
Here for both models compute influence using the logistic regression model the surrogate. For each batch of streaming data we train a new logistic regression model from scratch and compute sample influences. Based these values conduct data batch stream-level trimming.
C.4 ACTIVE LEARNING EXPERIMENT DETAILS
Here, the dataset splits for the labeled sample set, and the large unlabeled pool sample set (as well as validation/test set) are obtained by randomly partitioning the data. We then measure the results on the fixed test set and compute the influence on the fixed validation set over all rounds. For influence-basse sampling, we use logistic regression as the surrogate for influence computation.
D ADDITIONAL EXPERIMENTS FOR ALGORITHMIC PERFORMANCE ON REAL- WORLD DATASETS
In this section, we provide additional experiments that extend the results on showcasing algorithmic performance of our proposed approaches on four real-world datasets. In particular, we first provide results in similar fashion to the main paper when the base learning model is an MLP Neural Network as opposed to logistic regression Model. Next, we provide results for utilizing EOP instead of DP for fairness trimming experiments, for both the MLP and logistic regression models. We find that in both cases the trends demonstrate that trimming highly beneficial and improves model performance significantly.
D.1 RESULTS FOR MLP NEURAL NETWORK
We present results for MLP (2 hidden layers with ReLU activations in between layers) as the learning model in Figure g It can be seen that even though the MI. model is non-linear, approach is
16

---

Published as a conference paper at ICLR 2024
able to improve utility, fairesss (DP), and robustness performance, for each of the four datasets. Furthermore, the random baseline is unable to do so, and actually leads to worsened performance in some cases.
Aduutt
Bank
Colob4
TixicwToxicity
Te-1
Ie-1
1.00 Te-1
1.00
Accuracy
0.60
0.30
9:30
0.40
8.99
020
0.50
0.0
0.20
0.10..55
0.00.90
0.00
1.0
30
1e-4
1e-2
0.0
1.50
0.35
16-3
0.18
0.20
1.50
0:40
0.30
1e.4
0.30
0.30
0.20
0.50
0.10
020
0.10
0.12
9.35
H
0.40
0.60
1661
Robustness
1.56
4.00
16-1
6.00
0.40
0.12
4.00
2.00
1555
2.00
2.00.10
K
0.10
0.00
0.00
0.00
0.00
0.0
10
2.0
20
40
5.0
0.0
1.0
20
3.0
4,0
5.0
0.0
1.0
2.0
20
4.0
5.0
0.0
10
20
300
4.0
5.0
%
Samples Trimmed
Influence-basse based Deletion
Random Deletion
Influence Value
Figure 8: Double y-plot of our trimming method on the test of Adult, Bank, CelebA, and Jigsaw Toxicity for the MLP Neural Network as the base learning model. The left y-axes present algorithmic accuracy, fairness (DP), and robustness, while the right y-axes present the influence value of the trimmed samples. Higher values indicate better accuracy and robustness, while lower values indicate better fairness. The blue lines represent the performance of our trimming method, while the red lines represent the performance with random trimming.
D.2 RESULTS FOR EOP (LOGISTIC REGRESSION AND MLP)
Now we present results for using EOP (instead of DP) the fairness function for both MLP and logistic regression as the learning models as Figure 9 It can seen that our results hold for EOP as well, and can significantly improve fairness for both models on all four datasets and for both logistic regression and the MLP network.
Adult
Bank
CelebA
JiasewTaxicily
162
0440 0.20
[E0P]
0.10
1.00 0.06
0.15
0.40..20
0.0
020
0.10
0.10
0.50
0.000.00
0.02
0.05
0.00
0.000000
0.00 0.00
0.00 0.00
0.00
0.
20
3.0
40
5.0
00
10
20
30
40
5.0
0.0
10
2.0
30
40
5.0
0.0
10
20
30
4.0
5.0
0.40
1.00
015
0.30
0.10
010
020 020
0.50..05
0.05
0.0
0.04
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.
100
2.0
30
40
5.0
0.0
10
20
30
40 5.0
0.
10
20
30
40
5.0
00
10
20
300
4.004000
5.0
% Samples Trimmed
Figure 9: Additional faimnsss experiment on our trimming method and random trimming shown as double y-plot on the test sets of Adult, Bank, CelebA, and Jigsaw Toxicity for Logistic Regression and MLP as the base learning model but with the EOP metric instead of DP. The blue lines represent the performance of our trimming method, while the red lines represent the performance with random trimming.
17

---

Published as a conference paper at ICLR 2024
E COMPARATIVE EXPERIMENTS WITH SHAPLEY-VALUE BASED DATA VALUATION
E.1 EXECUTION- COMPARISONS WITH INFLUENCE ESTIMATION
We now present results to demonstrate that compared to data valuation approaches such as TMC- Shapley (Ghorbani & Zou 2019), influence is much faster, and hence, better choice for data valuation and data selection tasks. For system details and the runtime environment, please refer to Appendix
| We utilize the implementation of DataShapley (Truncated Monte Carlo), i.c. TMC- Shapley as provided by the authors and run it with the default parameters on our four real-world datasets. We find that while influence computations are in the order of seconds (< for all datasets except Jigsaw Toxicity, for which the computation takes ~ 1.5 minutes. This is understandable as Jigsaw Toxicity has the largest number dimensions compared to the other datasets with 384 embedding features.
However, in comparison to DataShapley (TMC) these computations are many order of magnitudes faster, that takes over 11.2 hours compute for Bank, our smallest dataset. For all other datasets, we either ran into memory overflow errors after 96 hours, or the computation was not making reasonable progress (such as for Jigsaw Toxicity). It is clearly evident that DataShapley (TMC) is not viable for use on large-scale datasets.
Table Execution times on all datasets for computation for both our influence- based approach and TMC-Shapley (Ghorbani & Zou 2019). Influence computation is order of magnitudes faster.
Datasel
Inlluence (Ours)
DataShapley (TMC) (Ghorbani & Zou 2019
Bank
1.599 Seconds
11.2 Hours
Adult
4.061 Seconds
Hours
CelebA
2.301 Seconds
96 Hours
Jigsaw Toxicity
85.42 Seconds
96 Hours
E.2 PERFORMANCE COMPARISON OF INFLUENCE- UENCEE-ASED TRIMMING (OURS) VS TMC-SHAPLEY BASED TRIMMING ON SUBSAMPLED Bank
0.74
0.73
0.72
Influence Deletion (Ours)
TMC- IMC-Shopley Deletion
0.71
0.70
0.69
% Training Samples Deleted
Figure 10: Comparing TMC-Shapley and Influence Estimation on a subsampled version of the Bank dataset, which only contains 100 samples.
Despite the rumning- issues of TMC-Shapley, conduct additional experiment to compare per- formance with TMC- Shapleapley on a subsampled version of the Bank dataset consisting of 100 samples. We then iteratively trim the training set (up 12.5%) using Algorithm 2 for both influence and Shapley values on logistic regression. These results are provided as Figure TO It can be seen that influence- based trimming outperforms TMC-Shapley. While not an exhaustive comparison, we believe our approach shows promise as a data selection strategy with respect to scalability and performance.
F VISUALIZING INFLUENCE TREES FOR REAL WORLD DATASETS
We now showcase the visualizations of trees obtained using our first algorithm for influence estimation. For Adult, provide the utility estimation tree Figure 11] fairness estimation tree Figure 12
18

---

Published as a conference paper at ICLR 2024
and robustness estimation tree Figure 13 For Bank, provide the utility estimation tree as Figure 14. fairness estimation tree as Figure 15 and robustness estimation tree as Figure 16 For CelebA, we
provide the utility estimation tree Figure 17 fairmess estimation tree Figure T8 and robustness estimation tree as Figure 19 For Jigsaw Toxicity, we provide the utility estimation tree as Figure 20 fairness estimation tree Figure 21 and robustness estimation tree Figure 22
00 1o--SNAAigg Astn
EERaRNE Avmn
ETES
TO 100--
Avan
SOTT 22
Utiliyy
Zt
30
contue 22
96
Figure 11: Adult dataset utility influence estimation tree.
19

---

Published as a conference paper at ICLR 2024
Falmed
Inffuenceeee 0.08
Faimesa Inffuence=
Bw231
Feature 3
Falmels
Inffuence- BMBST
Falmes infuencee-0 00 BW2S5
Featune 3
Class Label
11:11
Falmed infuencee-.00
19
0.88 Feature 51
Class Label
65
Faimel Influence-
120
Talmed we Infuercee 0.12
Feature 3
Falmeed F To
Figure 12: Adult dataset fairness influence estimation tree.
20

---

Published as a conference paper at ICLR 2024
Mobustmiss Influence--eee 0.00
the D-24588 4588
Robusties Int infuuencee 0.01
th B-7266
E01T Festure 30
Robustiess Iifuunnce--D00
2273
Robustiess
O n-1123
1413
Robustness Influence
Robustres Infuuence-- 06
1331
Robustrisss inflaenceeDD.. 0.83
Rotustnes Influencce 0,00
13:5
Robustrii inToeoo0-
1000000--- 0.00
Figure 13: Adult dataset robustness influence estimation tree.
21

---

Published as a conference paper at ICLR 2024
Unity
Feature
2300
Uniliy Inffuence-D 2..0--0..0 nm
Unility
Class Label
Utility Influence
30
Infuencee-
-0221
Feature
Uniey Influence
2.00
n
Feature
www.icee...00 00
Figure 14: Bank dataset utility influence estimation tree.
22

---

Published as a conference paper at ICLR 2024
Falmel
0.23
Falmess Infuuecce DM3300
Feature 1
Falmad Infuenneen B9229
12:33
Falmes
Feature 3
Class Label
Faimess Influence
4311
Pa0 19
Falmad Inffue Inffuence-
Feature 9
65 Label
T Falmela Infleecce-0 25
Faimes To
Festune 3
Srtueree 0.01
ma 22
Figure 15: Bank dataset fairness influence estimation tree.
23

---

Published as a conference paper at ICLR 2024
Robustias 1EBuicce-0.5
Robustriess
Influenee-0011
Robustriss Influenceee..00
0.9
+229
Robustilss Influenceee 0.
Robustness Influence
2331
Mesuur
Rebustoass 00tvence--.33
65
Rabusties Influenceeeec. 03
Rabustids Influenceeeeo 0.06
6311
Rebusaa S w wwrrereeeeeee 00000
Figure 16: Bank dataset robustness influence estimation tree.
24

---

Published as a conference paper at ICLR 2024
TO 100-000mmmm Aaronn
ED'O CONRIN Avna
OOZ
60 1OO0RT Auuan
Airinn
02 Temmr
Zampay
ZVO Z
Utility
GESEZ 00'D wow.nng Auan
ED 10'--o www.wuangguuuuu Aupa
BPEC
GEg-bbannga Alran
02 Somtee
tiCou LT---eoinni Anran
Figure 17: CelebA dataset utility influence estimation tree.
25

---

Published as a conference paper at ICLR 2024
Falmess Infuencee
Falmelk Infuuecce-O 01 n-22009
Feature
Palmess
Falmel T wwmeennaaaeeeeeoo So
Feature
6355
2000 2
Fairness Influence
Falmess Pnffercee-..0 (4
Feature 24
Festure
Falmels Infuerce 0.01 B4SEES
Falmels Infueecee 09
Famesa weweeeeeeeccoooo 0 20
Figure 18: CelebA dataset fairness influence estimation tree.
26

---

Published as a conference paper at ICLR 2024
00
sirpes
EL
GEETE TEO SORIESSOONNN
Robustness influence
20 100mmaoo
00
02 auneey
200--oonna soursmor
Eopoooaii Soussmong
Figure 19; CelebA dataset robustness influence estimation tree.
27

---

Published as a conference paper at ICLR 2024
1000
338
Utility Influence
TO
SB8 ama
109
Tean Santun
20 Dape
SaRa 14
20
Figure 20: Jigsaw Toxicity dataset utility influence estimation tree.
28

---

Published as a conference paper at ICLR 2024
Faimess ietuunnee-
m=3940
0.11
Falmess Infueenee 0.10 Be9025
Feature 160
-003
Faimess Influence-0222 0e5
3.99
Faimess Inffuence--Oooo m=116
Feature 3488
Class Label
Faimeess Influence
Faimess Influence-O 0.54 01933
Feature 109
Class Label
-4.00
65
Falmess Inffuence-OOOO
370
(=2107
-380
Faimess wenssiooeeeee intuecee 0,14
Feature 358
Falaas wwwecco-
So-------- 0000
Figure 21: Jigsaw Toxicity dataset fairness influence estimation tree.
29

---

Published as a conference paper at ICLR 2024
Infieence--Ge 0.04
Robustrias
Feature 224
0.01
Rebustriles Influence-- 0.04 neS
Robustiias Inft 35
Feature 310
Buy
Robustness Influence
Rebustrinss
BHE245
Class Label
Rebustries Influmcee 0.01 0015
Feature 64
Robastnies
4.03
Robustiess BeE321
0.01
Figure 22: Jigsaw Toxicity dataset robustness influence estimation tree.
30

---

Published as a conference paper at ICLR 2024
G ADDITIONAL ACTIVE LEARNING EXPERIMENTS
Rendom Sampling
Entrayy Sumpling
Nargr Sumpling
Uncetarry Samsling
infuerce Sampling
2,800
0.800
2.300
0.75
Rendom Sampling
Entrayy Sempling
Margin sempling
Uncatasty Samsling
3775
Irfuerce Sompling
Roundss
(a) Adult
(b) Bank
0.800
Random Sampling
Entropy Sumpling
Hargh Sampling
Uncertaiity nt Sampllig
0.875
Infuence Sampling
2,070
0.78
Fancom Samp iy
0.885
Entrapy Sampl
Margin Sampling
3.66
uncorbantyy Samplnng
2,000
Sampling
10
Rounds
Rounds
(c) CelehA
(d) Jigsaw Toxicity
Figure 23: Additional comparisons on real-world datasets for active learning baselines with influence- based sampling.
We now provide additional results for the active learning experiments from the main paper. Here, conduct the same experiments on our four real-world datasets. Labeled and unlabeled sample sets partitioned randomly, are the validation and test sets. The results shown in Figure [3] It can be seen that influence-based sampling is superlative to the other active baselines for all datasets except Adult. For Adult, influence-based sampling still outperforms uncertainty sampling and random sampling, but is slightly less performant than entropy and margin sampling.
H PRELIMINARY RESULTS ON DATA TRIMMING (ALGORITHM 2) FOR IMPROVING UTILITY PERFORMANCE OF BERT
We conduct very preliminary experiments to show that influence functions and influence-based trimming can applicable for deep learning; this can also guide future work in this area. We use the setting of (Han et al. 2020) where BERT is fine-tuned on 10k samples for binary sentiment classification on the SST-2 dataset (Socher et al, 2013) and influences are computed for individual test samples. Then we compute training set influence for 50 test samples, take the union of all training samples that were given a negative influence, and use these to trim the training set up to 12%. We fine- tune BERT for each of these trimmed sets, and measure performance. These experiments three times and results are provided in Figure 24] It can be seen that test set accuracy improves upon trimming, which shows the effectiveness of work in initial preliminary experiment setting.
repeated
31

---

Published as a conference paper at ICLR 2024
Original
0.910
Trimmed
Accuracy Set
0.908
0.906
0.902
8
10
12
of Training Samples Trimmed
Figure 24: Comparing Influence- Trimming on BERT /Vaswani al. 2017 using the experi-
mental set-up of (Han et al. 2020) for Binary Sentiment Classification on the SST-2 Dataset (Socher al, 2013).
CODE AND REPRODUCIBILITY
We open-source our code and experiment implementations in the following repository: https //github com/ Sathhaann2/IIfaattaaaaa
All experiments were conducted on a Linux server running Ubuntu 18.04.6 LTS. The CPU used Intel(R) Xeon(R) Silver 41 14 CPU @ 2.20GHz. Any experiments using the GPU (such for MLP, etc.) were conducted using Tesla V100 with 32GB VRAM and CUDA version 11.4.
All code is written in Python, and utilizes basic libraries such as as NumPy, scikit-lear,, PyTorch, Pandas, etc. Detailed package information is provided in the code repository itself.
32


Reviews:
[{"review_id": "bT7FqF6G4N", "reviewer": "Reviewer_bDe3", "summary": "This paper presents two schemes for 1) identifying the effect of a training point on a function of a model's parameters, and 2) trimming the training set to stem the influence of training instances that have a high negative influence on the test metric of interest. The paper examines the influence of a training point on a test set fairness metric, adversarial robustness, and utility. The first algorithm fits a regression tree using the input and label to the influence function of a metric of interest. The second algorithm then trims the subset of the training set to improve the model. The paper then demonstrates this approach across a variety of metrics including mitigating the effect of unfairness due to distribution shift, adversarial robustness, and the effect of noisy labels in the streaming setting across several datasets.", "questions": "Please see the first two bullet points in the weaknesses section for a list of the questions that I have. Thanks.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Overall, this paper provides a comprehensive empirical demonstration of how to improve a performance metric of interest given training samples and model parameters. \n\n- **The breadth of properties**: This paper considers several interesting scenarios ranging from noisy labels, active learning, adversarial robustness to fairness. The comprehensive nature of these settings is quite impressive and commendable.\n- **Compares to adequate baselines**: The paper considers the key baselines that I would've expected and shows improved performance over these baselines.\n- **Compelling results**: I particularly like Figure 2. Over a range of properties and settings, we see that influence-based deletion approach remains quite effective.", "weaknesses": "I have a number of confusion about this work that I state here and in the questions section. I would be happy to revise my score in light of feedback from the authors.\n\n- **Details of the approach**: The exact procedure of the trimming portion is not quite clear to me. I think the authors miss discussing retraining. I assume that the authors are referring to a model retrained after a subset of examples are deleted? So in Fig. 2, x axis==zero is a model trained on all data points? Then you trim a percent of the training samples and then retrain a model on the new dataset? If yes, is it the original model that is used for deciding which samples to trim or is the model changing? \n\n- **What is the motivation behind the cart regression procedure?**: As it stands it seems the cart procedure takes as input $(x_i, y_i)$, and the predicts some influence score per example? More details could be useful here. Are the samples used in the training of the cart model a subset of the original training set for which the influence was estimated? Since we know that the influence score measures the effect of up(down)weighting the training sample, alone, we also know that the label should not have any effect on predictive quality of the tree. What is the point of then concatenating the label? It seems like the goal here is to estimate the effect of a feature on the performance metric of interest. I take this judging from Figure 1 where the authors plot performance metric vs features that is colored by influence. If the goal is really to determine the effect of a feature on the performance metric of interest, then how to do that is already in section 2.2 of the original Koh and Liang paper. If the goal is not to measure the effect of the feature on the influence score, then I am not sure I understand the point of this section. Another point here is that in the rest of the paper, the trimming-based approach is really what the authors use and not the cart procedure. If this is the case, I don't think we can that as a contribution of this work. I am asking all these questions as a way to better understand the motivation and goal of fitting the tree to predict the estimated influence score.\n\n- **Related Work**: There is some related work that this paper should be aware of. I list them here: Kong et. al., Resolving Training Biases via Influence-based Data Relabeling, Adebayo et. al. Quantifying and mitigating the impact of label errors on model disparity metrics, Richardson et. al. Add-Remove-or-Relabel: Practitioner-Friendly Bias Mitigation via Influential Fairness, (concurrent) Understanding Unfairness via Training Concept Influence, Sattigerri et. al. Fair infinitesimal jackknife: Mitigating the influence of biased training data points without refitting. All of these papers have a trimming and/or relabelling scheme in them. I am not claiming that this work is not novel/important. I think the insights here are quite useful actually, but it would be helpful for the authors to acknowledge these works, and contextualize their contributions in light of these papers.\n\n- **Tabular Data**: I don't see this as an important weakness; however, most of this work is demonstrated on tabular data. It will be tricky to extend the feature analysis portion, as done in Figure 1 for example, to say images or text.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zjahypgdQW", "reviewer": "Reviewer_GBD9", "summary": "This paper presents a new approach to enhancing the performance of classification models by interpreting and selecting training data through influence estimation models. The authors aim to improve model utility, fairness, and robustness by identifying data that positively impacts these aspects. Extensive experiments on various datasets demonstrate the effectiveness of their methods, which are also applicable to scenarios like distribution shifts and fairness attacks.", "questions": "- How do the tree-based influence estimation models proposed by the authors scale with very large datasets, and what are the computational costs associated with these models?\n- Could the authors provide insights into the computational complexity of their influence estimation approach, and are there any strategies they recommend for scaling it to big data applications?\n- How does the tree model handle high-dimensional data, such as images, where feature interactions are more complex?\n- Could the authors elaborate on any modifications or extensions to their approach that might be necessary to apply it effectively to image data or other high-dimensional datasets?\n- The work presented focuses on convex models or convex surrogates for non-convex models. Could the authors discuss the potential limitations of this?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. **Important Research Problem**: The authors have targeted an important research problem that focuses on selecting important training data to improve model performance. The research can improve the effectiveness of machine learning models' development that is often overlooked in favor of more complex model architectures or algorithms.\n\n2. **Thorough Experiments**: The authors have conducted thorough experiments to validate their approaches. The use of both synthetic and real-world datasets ensures that the findings are robust and not limited to specific types of data or scenarios. This comprehensive testing framework strengthens the validity of the research conclusions.\n\n3. **Many Applications**: One of the paper's strengths lies in its application to different scenarios. The authors have not only considered conventional classification tasks but have also extended their methodology to address other challenges such as distribution shifts, fairness poisoning attacks, utility evasion attacks, online learning, and active learning. This broad applicability demonstrates the potential impact of the research on various domains and highlights the versatility of the proposed methods.", "weaknesses": "1. **Scalability Concerns**: The use of tree-based influence estimation models might indeed pose scalability issues. Tree-based models can become computationally expensive as the size of the dataset increases, especially if the influence estimation requires building trees for many subsets of data or for complex feature interactions. This could limit the method's applicability to big data scenarios or require significant computational resources, which may not always be feasible.\n\n2. **Hard to Adopt Data with High-Dimensional Features**: For example, image data presents unique challenges due to its high dimensionality and the spatial relationships between pixels. Influence functions and feature space interpretations that work well for tabular data may not translate directly to image data.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9NDSAzvXzd", "reviewer": "Reviewer_MiDf", "summary": "This paper utilizes influence functions to assess what data samples improve utility (smaller loss), fairness (DP and EOP), and adversarial robustness for a given convex classifier by interpreting which sample features contribute positively or negatively to certain performance metrics, and design a data selection strategy accordingly.", "questions": "1.\tShould not the influence estimator has the same architecture of the classifier?\n2.\tFor the fairness experiments in Section 5.1, would the authors justify the choice of the fairness intervention baselines?\nFor other questions, please refer to the Weaknesses. I will consider raising the scores if the authors could adequately address my questions in the rebuttal.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.\tConsider many aspects of model performance beyond accuracy; especially the fairness.\n2.\tExperiments are thorough and the presentations of the experimental results are sound and clear.", "weaknesses": "1.\tLimitation on model class: The authors provide a discussion on why the influence function evaluations are limited to convex classifiers, possible remedies, and recently applications to deep neural networks. However, \n2.\tTheoretical analysis: the estimation of the influence function is based on the trees with hierarchical shrinkage regularization. However, there is no analysis on the credibility, time complexity of the proposed Algorithm 1 and Algorithm 2. It seems that these algorithms are not scalable to large-scale datasets. \n3.\tThe utility, fairness and adversarial robustness are important performance metrics for a classifier; however, there is a lack of a unifying story to connect all three and therefore the discussion and experiments may seem distracted\n4.\tFeature explanation is a key aspect in this paper; however, the connection of feature explanation using the influence function with existing explainable AI literature is lacking.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KeL7EPROT9", "reviewer": "Reviewer_MEKL", "summary": "The authors propose an influence-based trimming approach to uncover which samples and features contribute positively/negatively to the specified utility function. The authors perform experiments with various utility functions (fairness, accuracy, etc) on several datasets: adult, German, drugs, and celebA, among others.", "questions": "While I think the authors propose an interesting perspective, the presentation of the paper needs some improvement. \nI have raised my main concerns in the weaknesses section.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- From my understanding, the authors are trying to not only get the best data samples useful for the model but also identify the best features of the data to use. They use regression trees to help in feature selection and use the influence function for the sample selection. \nNeither influence estimators for sample valuation (for different utilities: fairness, accuracy, data poisoning, etc..) nor CART as a feature selector is a new concept, but the combination is a useful endeavor and an interesting perspective. \n\n- Authors carry out several experiments on several datasets and investigate the performance of their method on several applications, and also compare their work with TMC Shapley.", "weaknesses": "- When I read feature space, I think of d-dimensions where the variables (features) live. The authors' writing was a bit confusing to me because from the abstract to the introduction, I thought their influence estimation-based method was identifying features from the feature space with positive/negative influence on the model utility (accuracy, fairness, robustness, and so on). \nHowever, at the beginning of the background section and throughout the experiment results, the authors focus on only the contribution of the training samples to the utility function. \nI think the authors should be a bit more clear in the writing or presentation.  Although section 3 is fairly written, I would recommend that authors revisit abstract+sections 1-3.\n\n- Since the authors focus on features and samples, it would have been informative to see the difference in selected/excluded features and samples and the consequential contribution to the utility with and without the authors' method. \n\n- Although influences functions are not affected by retraining-related complexity, they have a high incremental complexity due to the computation of the Hessian matrix for each x_{i} valuation, which might worsen (beyond retraining) when n is large. \nAdditionally, using CART as a sub-module further increases model complexity.\nI would have appreciated looking at the code specific to section E.1 in the appendix (I couldn't find it in the shared code base)\n\n\n- Not entirely sure, probably it's the figure, I find the almost constant utility values with random deletion somewhat unrealistic. \nCould the authors also explain Figure 2C?\nThe scale for accuracy on some figures in 2 is not intuitive. Is it possible for authors to adopt similar scales for similar utilities across datasets?\n\n- Experimental results. \n  - Figure 2 Specific questions: I find the almost constant utility values with random deletion somewhat unrealistic.  Could the authors also explain Figure 2C?\n  - Figure 10 in the appendix.  If you're removing low-value samples, I wouldn't expect TMC-Shapley to behave like that, accuracy would increase with the removal of low-value samples.  If you're trimming high-value examples, then this graph would make sense but would mean influence-based trimming is performing poorly.\n  - Instead of TMC-Shapely and random, it would have been more informative to see how the proposed approach compares with other influence estimation-based approaches, including vanilla (without CART) influence estimation.\n  - The scale for accuracy on some figures in 2 is not intuitive. Is it possible for authors to adopt similar scales for similar utilities across datasets?\n\n\n- Minor: \n\n  - While the focus on convex loss is understandable, it might lead to sub-optimal influence value estimation due to the model parameters not being at a stationary point or the model not converging. This might then be a net negative and misleading data value estimation.\n  - It looks like the authors do one utility at a time. Due to often competing utilities,  for example, key features and samples for fairness might not necessarily be the same for accuracy, and in most cases might have a negative influence. It would be interesting to see an interplay of various utilities. \n  - Although authors use several datasets, all of them are binary settings. Value computation increases with classes, so I am curious to know if this is the reason authors only focused on binary settings or if there is another reason behind this design choice.\n  - The authors' paper was 32 pages instead of 9", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "IlPuYhuR4w", "reviewer": "Reviewer_ZqCd", "summary": "This paper diverges from the mainstream focus on enhancing model architectures and learning algorithms on fixed datasets. Instead, it tackles an essential yet overlooked issue: understanding how a fixed convex learning model (or a convex surrogate for a non-convex model) benefits from data by interpreting the feature space. Specifically, this paper proposes to use influence estimation models to interpret the classifier's performance through the lens of data features. Furthermore, it introduces data selection methods based on influence to enhance model utility, fairness, and robustness. Through extensive experiments on both synthetic and real-world datasets, the effectiveness of the proposed method is validated. Additionally, the method proves effective not only in conventional classification scenarios but also in more challenging situations, such as distribution shifts, fairness poisoning attacks, utility evasion attacks, online learning, and active learning.", "questions": "- At the beginning, this paper claims it is related to data valuation,  data influence, and data efficiency. Essentially, this paper studies the problem of \"coreset selection\", which is not a new problem in machine learning. Coreset selection surely is related to the above topics. Therefore, it seems that there is no need to introduce so much redundant content in the main paper. \n- The motivation is not clear. It has been fully studied to use the influence function to analyze the importance of data points. This paper follows this line. However, after checking this paper, I am confused about the proposed method of this paper, as the paper just combines the influence estimation and decision tree. Also, why do we need this tree?\n- This paper uses a lot of space to introduce the previous versions of influence functions (Section 2). However, it is not clear that the difference between previous work and this work mathematically.\n- Could the paper provide more high-level intuitions about the formulas of the overall regression tree prediction and hierarchical shrinkage regularizes?\n- For the method in Section 3.2, what is its time/space complexity?\n- Figure 3 and the illustrations in the appendix are not informative. Could the paper supplement more descriptions for them?\n- Could the paper discuss the difference between this paper and the work [1]?\n\n----\n[1] Shuo Yang et al. Dataset Pruning: Reducing Training Data by Examining Generalization Influence. ICLR 2023.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- The research topic is realistic and important. In the era of big data, the analysis of \"more important data points\" is significant. \n- Experimental results are great. In a series of tasks, the proposed method can achieve the best performance.", "weaknesses": "- The motivation of this paper is not clear and not strong. \n- Technical contributions of the proposed method are limited. \n- Writing is not unsatisfactory. Many times, readers are unable to understand the author’s true intentions. \n\nMore details about the weaknesses can be checked below.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (oral)