Diffusion Attribution Score: Evaluating Training Data Influence in Diffusion Models
Authors: Jinxu Lin
Linwei Tao
Minjing Dong
Chang Xu
Venue: ICLR 2025 Spotlight (2025)
Keywords: Diffusion Model; Data Attribution; Training Data Influence
Primary area: generative models
TL;DR: We propose Diffusion Attribution Score in diffusion model which can be used to evaluate the influence of training sample in the generation. Our proposed method reached the State Of The Art performance compared with baseline method.

Abstract: As diffusion models become increasingly popular, the misuse of copyrighted and private images has emerged as a major concern. One promising solution to mitigate this issue is identifying the contribution of specific training samples in generative models, a process known as data attribution. Existing data attribution methods for diffusion models typically quantify the contribution of a training sample by evaluating the change in diffusion loss when the sample is included or excluded from the training process.
However, we argue that the direct usage of diffusion loss cannot represent such a contribution accurately due to the calculation of diffusion loss.
Specifically, these approaches measure the divergence between predicted and ground truth distributions, which leads to an indirect comparison between the predicted distributions and cannot represent the variances between model behaviors.
To address these issues, we aim to measure the direct comparison between predicted distributions with an attribution score to analyse the training sample importance, which is achieved by Diffusion Attribution Score (\textit{DAS}).
Underpinned by rigorous theoretical analysis, we elucidate the effectiveness of DAS.
Additionally, we explore strategies to accelerate DAS calculations, facilitating its application to large-scale diffusion models.
Our extensive experiments across various datasets and diffusion models demonstrate that DAS significantly surpasses previous benchmarks in terms of the linear data-modelling score, establishing new state-of-the-art performance.

Published as a conference paper at ICLR 2025
DIFFUSION ATTRIBUTION SCORE: TRAINING DATA INFLUENCE IN DIFFUSION MODELS
EVALUATING
Jinxu Lin' Linwei Tao' Minjing Dong² Chang Xu'
'The University of Sydney, "City University of Hong Kong (jinxu. lin, linwei. tao, c. e.xueesydney, edu. au, miajjongBeityy..duk
ABSTRACT
As diffusion models become increasingly popular. the misuse of copyrighted and private images has emerged as major concern. One promising solution to miti- gate this issue is identifying the contribution of specific training samples in gener- ative models, process known as data attribution. Existing data attribution meth- ods for diffusion models typically quantify the contribution of a training sample by evaluating the change in diffusion loss when the sample is included or excluded from the training process. However, we argue that the direct usage of diffusion loss cannot represent such contribution accurately due to the calculation of diffusion loss. Specifically, these approaches measure the divergence between predicted and ground truth distributions, which leads to indirect comparison between the predicted distributions and cannot represent the variances between model behav- iors. To address these issues, we aim to measure the direct comparison between predicted distributions with an attribution score to analyse the training sample im- portance, which is achieved by Diffusion Attribution Score (DAS). Underpinned by rigorous theoretical analysis, we elucidate the effectiveness of DAS. Addition- ally, we explore strategies to accelerate DAS calculations, facilitating its appli- cation to large-scale diffusion models. Our extensive experiments across various datasets and diffusion models demonstrate that DAS significantly surpasses pre- vious benchmarks in terms of the linear data- modellig score, establishing new state-of- ttthheeartt art performance.
INTRODUCTION
Diffusion models, highlighted in key studies (Ho al., 2020; Song et al., 2021b), are advancing significantly in generative machine learning with broad applications from image generation to artis- tic creation (Saharia al., 2022; Hertz et al., 2023; Li et al., 2022; Ho et al., 2022). As these models, exemplified by projects like Stable Diffusion (Rombach et al., 2022), become increasingly capable of producing high-quality, varied outputs, the misuse of copyrighted and private images has become significant concern. A key strategy to address this issue is identifying the contribu- tions of training samples in generative models by evaluating their influence on the generation, task known as data attribution. Data attribution in machine learning is to trace model outputs back to influential training examples, which essential understand how specific data points affect model behaviors. In practical applications, data attribution spans various domains, including explaining predictions (Koh & Liang, 2017; Yeh et al., 2018; Ilyas et al., 2022), curating datasets (Khanna et al., 2019; Jia et al., 2021; Liu et al., 2021), and dissecting the mechanisms of generative models like GANs and VAES (Kong & Chaudhuri, 2021; Terashita et al., 2021), serving to enhance model transparency and explore the effect of training data model behaviors.
Data attribution methods generally fall into two categorics. The first, based on sampling (Shapley et al.. 1953; Ghorbani & Zou, 2019; Ilyas et al., 2022), involves retraining models to assess how outputs change with the a data deletion. While effective, this method requires training thousands approximations to assess the change in output function for
of models. The second approach efficiency (Koh & Liang. 2017; Feldman & Zhang, 2020; Pruthi et al., 2020) by proposing attribu- tion score function. TRAK (Park al., 2023) introduced innovative estimator, which considers
"oode available http://gittuh.com//nnsn/iiiiiii

---

Published as a conference paper at ICLR 2025
the inverse-sigmoid function model output and computes attribution scores assess its change. Building on this, Zheng et al. (2024) proposed D-TRAK, adapting TRAK to diffusion models by following TRAK's derivation and replacing the inverse-sigmoid function with the diffusion loss. Moreover, D-TRAK reported counterintuitive findings that the output function could be replaced with alternative functions without altering the score's ' form. These empirical designs outperformed theoretically motivated diffusion losses in experiments, emphasizing the need for deeper under- standing of the attribution properties on diffusion models.
In this paper, we define the objective of data attribution in diffusion models as evaluating the impact of training samples on generation by measuring shifts in the predicted distribution after remov- ing specific samples and retraining the model. From this perspective. directly applying TRAK to diffusion models by replacing the output function with the diffusion loss leads to indirect compar- isons between predicted distributions, as the diffusion loss represents the KI.-divergence between predicted and ground truth distributions (Ho et al., 2020). We also address the sounter-intuitive find- ings in D-TRAK, which manually removes the effect of data distributions in attribution but treats the diffusion model's output as a scalar, failing to capture the unique characteristics of diffusion models. Our analysis indicates that TRAK's s derivation cannot be directly extended to diffusion models, as they fundamentally differ from discriminative models. To address this, we propose the Diffusion Attribution Score (DAS), novel metric designed specifically for diffusion models quantify the impact of training samples by measuring the KI--divegeence between predicted distributions when a sample is included or excluded from the training set. DAS computes this divergence through changes in the noise predictor's 's output, which, by linearization, can be represented as variations in the model parameters. These parameter changes are then measured using Newton's 's Method. Since directly computing the full form of DAS is computationally expensive, we propose several techniques, such as compressing models and datasets, to accelerate computation. These enhancements enable the application of DAS to large-scale diffusion models, significantly improving its practicality. Our experiments across ranges of datasets and diffusion models demonstrate that DAS significantly out- performs previous benchmarks, including D-TRAK and TRAK, achieving superior results in terms of the linear data-modeling score. This consistent performance across diverse settings highlights its robustness and establishes DAS as the new state-of-the-ar method for data attribution in diffusion models. The primary contributions our work are summarized as follows:
1. We provide comprehensive analysis of the limitations of directly applying TRAK to dif- fusion models and evaluate D-TRAK's empirical design, highlighting the need for more effective attribution methods tailored to diffusion models.
2. We introduce DAS, a theoretically solid metric designed to directly quantify discrepancies in model outputs, supported by detailed derivations. We also discuss various techniques, such as compressing models or datasets, to accelerate the computation DAS, facilitating its efficient implementation.
3. DAS demonstrates state-of-the-art performance across multiple benchmarks, notably ex- celling in linear datamodeling scores.
2 RELATED WORKS
2.1 DATA ATTRIBUTION
The training data exerts a significant influence on the behavior of machine learning models. Data attribution aims to accurately assess the importance of each piece of training data in relation to the desired model outputs. However, methods of data attribution often face the challenge of balancing computational efficiency with accuracy. Sampling-basee based approaches, such as empirical influence functions (Feldman & Zhang, 2020), Shapley value estimators (Ghorbani & Zou, 2019; Jia et al., 2019), and datamodels (Ilyas et al., 2022), are able to precisely attribute influences to training data but typically necessitate the training of thousands of models to yield dependable results. On the other hand, methods like influence approximation (Koh & Liang, 2017; Schioppa al., 2022) and gradient agreement scoring (Pruthi et al., 2020) provide computational benefits but may falter in terms of reliability in non-convex settings (Basu al., 2021; Akyurek al., 2022).
2

---

Published as a conference paper at ICLR 2025
2.2 DATA ATTRIBUTION IN GENERATIVE MODELS
The discussed methods address counterfactual questions within the context of discriminative models, focusing primarily on accuracy and model predictions. Extending these methodologies to genera- tive models presents complexities due to the lack of clear labels definitive ground truth. Re- search in this area includes efforts to compute influence within Generative Adversarial Networks (GANs) (Terashita et al., 2021) and Variational Autoencoders (VAEs) (Kong Chaudhuri, 2021). In the realm of diffusion models, earlier research (Dai & Gifford, 2023) has explored influence compu- tation by employing ensembles that necessitate training multiple models on varied subsets of training data a method less suited for traditionally trained models. Wang et al. (2023) suggest an alter- native termed "eustomization," which involves adapting or tuning a pretrained text-to-image model through specially designed training procedure. MONTAGE (Brokman et al., 2025) integrates novel technique to monitor generations throughout the training via internal model representations. In this paper, we mainly focus post-hoc data attribution method, which entails applying attribu- tion methods after training. Recently, Park et al. (2023) developed TRAK, a new attribution method that is both effective and computationally feasible for large-scale models. Journey TRAK (Georgiev et al., 2023) extends TRAK to diffusion models by attributing influence across individual denoising timesteps. Moreover, D-TRAK (Zheng al., 2024) has revealed surprising results, indicating that theoretically dubious choices in the design of TRAK might enhance performance, highlighting the imperative for further exploration into data attribution within diffusion models. In DataInf (K (Kwon et al., 2024), influence function using the loss gradient and Hessian have been improved for greater accuracy and efficiency in attributing diffusion models. A concurrent work (Mlodozeniec et al., 2025) extends influence functions to diffusion models by predicting how the probability of gener- ating specific examples changes when training data is removed, leveraging a K-FAC approximation for scalable computation. These studies are pivotal in advancing our understanding and fostering the development of instance-based interpretations detailed theoretical discussion about the existing data attribution methods in diffusion model in Ap- pendix E.3. Besides, we provide an introduction about application of data attribution in Appendix
unsupervised learning contexts. We give a more
3 PRELIMINARIES
3.1 DIFFUSION MODELS
Our study concentrates on discrete-time diffusion models, specifically Denoising Diffusion Proba- bilistic Models (DDPMs) (Ho et al., 2020) and Latent Diffusion Models (LDMs) which are foun- dational to Stable Diffusion (Rombach et al., 2022). This paper grounds all theoretical derivations within the framework of unconditional generation using DDPMs. Below, we detail the notation employed in DDPMs that underpins all further theoretical discussions.
Consider a training set $ (=(1), ..., (()) where each training sample 2(0) = (xx(9
Z an input-label pair?. Given an input data distribution (ar). DDPMs aim to model a distribution pa(x) to approximate (zx). The learning process divided into forward and reverse process, con- ducted over a series of timesteps in the latent variable space, with æo denoting the initial image and [1, T]. the forward process, DDPMs sample an observation Zp from S and add noise on it across T timesteps: q(x; xx-1) == N(x;; vI 3, I,T, where Bi.... Br constitute variance schedule. As indicated DDPMs, the latent variable æ, can be
24 the latent variables timestep
express as a linear combination of æo:
xt = Vaizo + VI - ātE.
(1)
where a 1 1--BB, Bi, ā. distribution (1(2x-1/1,, by minimizing the KL-divergence from data at t:
IT' O₂ and I). In the reward process, DDPMs model
Bi
(2 1110) mo)) = (o- 20, ar) ||e cn( I)]
(2)
II text-to-image task, (ar",
represents an image-caption sample, whereas in unconditional gener-
ation, solely contains image z (z))
3

---

Published as a conference paper at ICLR 2025
where Eg is function implemented by models 0 which can be seen noise predictor. A simplified version of objective function for data point a used to train DDPMs is:
Simple (z, 8) Ee.eIllco t) <l1²).
(3)
3.2 DATA ATTRIBUTION
Given a DDPM trained on dataset S, our objective is to trace the influence of the training data on the generation of sample 2. This task referred to as data attribution, which is commonly solved by addressing a counterfactual question: removing a training sample 20) from & and retraining a model Br on the subset , the influence of (+)
can he assessed by the change in the model
output, computed f(z, 8) f(z 0y)). The function f(z, 8), which represents the model output, has a variety of choices, such as the direct output of the model or the loss function.
To avoid the high costs of model retraining, some data attribution methods compute score function T(2, S) x z + I" to reflect the importance of each training sample in on the sample x. For clarity, T(2,8) (i) denotes the attribution score assigned to the individual training sample 200) on z. TRAK (Park al., 2023) stands out representative data attribution method designed for large-scale models focused on discriminative tasks. TRAK defines the model output function as:
fTRAK (z, 0) = log]f(æ 0)/(1 - ((xx0)))
(4)
where p(x, 0) the corresponding class probability z. TRAK then introduces attribution score TTRAK(Z, 8) to approximate the change in fTAA after data intervention, which is expressed as:
TRRA ( 2. 8) = <(=) (=z))>((()))))) Re (ZRAK(Z, 0) - STRKK (TRAA(Z, (2,0x 0,s).
(5)
where (1) = [1- (x) 0)] denotes the residual for sample z(0), Here, x(z) := P VØTTRAX
and 4 ( .... (()())) represents the matrix of stacked gradients on S. P NV (00,1)dxx 1)dxk
is a random projection matrix (Johnson & Lindenstrauss, 1984) to reduce the gradient dimension.
To adapt TRAK in diffusion models, D-TRAK (Zheng et al., 2024) first followed TRAK's guidance, replacing the output function with Simple Loss: fD-TRAK (2, 0) = CSimpea (x, 0). and simplifies the residual term an identity matrix The attribution function D-TRAK defined as follows:
(2,
x(z)
( $T) -z(()(()))) [D. 0) fo (2,
(6)
where dxz) P Vo 0). Interestingly, D-TRAK observed that substituting Simple Loss with other functions can yield superior attribution performance. Examples of these include Esquare (z, 0) Eg,elllee eo (x,, []] and Exverue(22,0 = (v)
4
METHODOLOGY
4.1
RETHINKING OUTPUT FUNCTION IN DIFFUSION MODELS
For the goal of data attribution within diffusion models, we want to measure the influence of spe- cific training sample zt²) on generated sample 800 This task can be approached by addressing the counterfactual question: How would 20th change if we removed 211) from S and retrained the model on the subset ? This change can be evaluated by the distance between predicted distribution po(=* and pa. (x) in DDPM, where the subscript denotes the deletion of (().
Reviewing D-TRAK, they proposes using TD-TRAK to approximate this difference on the Simple Loss by setting output function as fT-TRAK Liimph. In details, the difference is computed as:
TOATRAK (20 S)(i) SO.TRAK (2 (200 0) - fI.TRAK (2 O2ss)
=Ee,e (x=?" - <l | Fe,, [e,, (2: 1
(7)
However, from the distribution perspective, this approach conducts an indirect comparison of KL- divergences between the predicted distributions by involving the data distribution g(
(2.0, ())(0) DKLl(po(ss [1q(=="")) -DKL(po,, (zx (1g((200)))))
DDKLlPo (2."") Ilpo, (22) /I1o(a00))) - Po,, (2:55") log ((2)""))xx
(8)
4

---

Published as a conference paper at ICLR 2025
Compared to directly computing the KL-divergences between predicted distributions pa and po.. D-TRAK involves a Cross Entropy between the predicted distribution shift pa po, and data distri- bution 9. where the crossing term is generally nonzero unless are identical distributions. This setting involves the influence of the data distribution @ in the attribution process and may introduce errors when evaluating the differences. We can consider the irrationality of this setting through a practical example: the predicted distributions might approach the data distribution q(> from different di- rections while training, yet exhibit similar distances. In this case, D-TRAK captures only minimal loss changes, failing to reflect the true distance between the predicted distributions.
To isolate the effect of the removed data on the model, we propose the Diffusion Attribution Score (DAS), conducting direct comparison between pa and pos, by assessing their KL-divergence:
(D ,))()))) x DKL (po( Ilpe, (xx
Be,ellle (xt .)) E0,, E0, (xt t)
The output function in DAS is defined as foas 0) = Eo (x t). which is able to directly reflect the differences between the noise predictors of the original and the retrained models. Eq. 9 also validates the effectiveness of employing Luguro as the output function, which is formulated as:
Tiquare (z sen ()(() Ee, (ll (=]²) Ee, (x?"", +)]]
(10)
The effectiveness of Tqqure lies in manually eliminating the influence of q; however, this approach has its limitations since the output of diffusion model is a high dimensional feature. Defining the output function Lsquie using average and I.2 norm, treats the latent as scalar, thereby neglecting dimensional information. For instance, these matrices might exhibit identical differences across var- ious dimensions, an aspect that scalar representations fail capture. This dimensional consistency is crucial for understanding the full impact of training data alterations on model outputs.
4.2 DIFFUSION ATTRIBUTION SCORE
Since we define the output change as KL-divergence, which differs from TRAK, fuAs cannot be di- rectly applied to TRAK and TDaS needs be specifically derived on diffusion models. In this section, we explore methods to approximate Eq. 9 at timestep ł without retraining the model. The derivation divided into two main parts: First, we linearize the output function, allowing the difference in the output function to be expressed in terms of difference in model parameters. The second part is that approximating this relationship using Newton's 's method. By integrating these two components, we derive the complete formulation of DAS to attribute the output of diffusion model at timestep I.
Linearizing Output Function. Computing the output of the retrained model co., (x=²", t) is compu- tationally expensive. For computational efficiency, we propose linearizing the model output function around the optimal model parameters 0* at convergence, simplifying the calculation as follows:
fDAs(Ze, 0) 2 Eg- (æt, t) + V (x,, t) - 0*)
(11)
By substituting Eq. 11 into Eq. 9, we derive:
Taas (2 {) as E. Vo (x," .) (8' (0"-6%') -(,))
(12)
The subscript indicates the attribution for the model output at timestep t. Consequently, the influ- ence of removing a sample can be quantitatively evaluated through the changes in model parameters, which can be measured by the Newton's 's method, thereby reducing the computational overhead.
Estimating the model parameter. Consider using the leave-one-out method, the variation of the model parameters can be assessed by Newton's 's Method (Pregibon, 1981). The counterfactual pa- rameters Or, can be approximated by taking single Newton step from the optimal parameters 0":
0r -000,-- + - - -VVEE (S 1) Vaca- (S -V (S Boig
(13)
where eg. (Se, = (co- (a. (1) (),... cg- (zt (n) 1)] represents the stacked output matrix for the set S at timestep t, and R, == (x)))) .)) t)- - <) is a diagonal matrix describing the residuals among S. A detailed proof of Eq. 13 is provided in Appendix A.
5

---

Published as a conference paper at ICLR 2025
Let ge (x) Vacg- (2r (a and (S) Vgeg- Vo,g-(St:1) l). The inverse term in Eq. 13 can be reformulated as:
G. ()) G. g g(((2())
(14)
Applying the Sherman-Morrison formula to Eq. 14 simplifies Eq. 13 as follows:
0 00
(15)
(((
(g))))(((((())))
where (1) is the i-th element of R₁. A detailed proof of Eq 15 in provided in Appendix B.
Diffusion Attribution Score. By substituting Eq.15 into 1q.12, we derive the formula for comput- ing the DAS at timestep t:
gr (m
TiAS ( (2 5) = EE
113).
(16)
1- (x ((G (T)
This equation estimates the impact of training samples at specific timestep t. The overall influence of training sample z(1) on the target sample za throughout the entire generation process can be computed as an expectation over timestep t. However, directly calculating these expectations is extremely costly. In the next section, discuss methods to expedite this computation.
4.3 EXTEND DAS TO LARGE-SCALE DIFFUSION MODEL
Calculating Eq. 16 for large-scale diffusion models poses several challenges. The computation of the inverse term is extremely expensive due to the high dimensionality of the parameters, Additionally, gradients must be calculated for all training samples in S, further increasing computational demands. In this subsection, we explore techniques to accelerate the calculation of Eq. 16. These methods can be broadly categorized into two approaches: The first focuses on reducing the gradient computation by minimizing the number of expectations and candidate training samples. The second aims to accelerate the computation of the inverse term by reducing the dimensionality of the gradients.
Reducing Calculation of Expectations. Computing times the equation specified in Eq. highly cesource-intensive due to the necessity of calculating inverse terms. To simplify, average gradient g(x) and average residual F over entire generation, enabling a single computation of 16 to assess overall influence. However, during averaging, these terms may exhibit varying magnitudes across different timesteps, potentially leading to the loss of significant information. To address this, we normalize the gradients and residuals over the entire generation before averaging:
the
1 Σ T
gr (x)
g (xx
(17)
T
10
Thus, to attribute the influence training sample (i) on a generated sample zon throughout the entire generation process, we redefine Eq. 16 as follows:
g (e))
[G(S) (C())C(()))))))))))))))))))))
TDMS
SS)(
g ((x(11) 112
(18)
((( ( G(S) "
Reducing Dimension of Gradients by Projection. The dimension of gi (x) matches that of the amount of diffusion model's parameter, posing a challenge in calculating the inverse term due to its substantial size. One effective method of reducing the dimension is to apply the Johnson and Lindenstrauss Projection (Johnson & Lindenstrauss, 1984). It involves multiplying the gradient vector 9r (x)) E IºP by random matrix P NN 1) E P < p). which can preserve inner product with high probability while significantly reducing the dimension the gradient. This projection method has been validated in previous studies (Malladi et al., 2023; Zheng et al., 2024), demonstrating its efficacy in maintaining the integrity of the gradients while easing computational demands. We summarize our algorithms in Algorithm with normalization and projection.
Reducing Dimension of Gradients by Model Compression addition to projection methods, other techniques can be employed to reduce the dimension of gradients in diffusion models. For

---

Published as a conference paper at ICLR 2025
instance, noted by Ma al. (2024), the up-block of the U-Net architecture in diffusion models plays a pivotal role in the generation process. Therefore, we can focus on the up-block gradients for dimension reduction purposes, optimizing computational efficiency. Furthermore, various strate- gies have been proposed to fine-tune large-scale diffusion models efficiently. One such approach LoRA (Hu et al., 2022), which involves freezing the pre-trained model weights while utilizing trainable rank decomposition matrices. This significantly reduces the number of trainable parame- ters required for fine-tuning. Consequently, when attributing the influence of training samples in fine-tuned dataset, we can compute the DAS with gradients on the trainable parameters.
Reducing the amount of timesteps. Computing Eq. 17 requires performing back propagation T times, making it highly resource-intensive Sampling fewer timesteps can also approximate the expectation and estimate gradient behavior while significantly lowering computational overhead.
Reducing Candidate Training Sample. The necessity to traverse the entire training set when computing the DAS poses significant challenge. To alleviate this, a practical approach involves conducting preliminary screening to identify the most influential training samples. Techniques such as CLIP (Radford et al., 2021) or cosine similarity can be effectively employed to locate sam- ples that are similar to the target. By using these methods, we can form preliminary candidate set and concentrate DAS computations on this subset, rather than on the entire training dataset.
EXPERIMENTS
5.1 DATASETS AND MODELS
In this section, we present a comparative analysis of our method, Diffusion Attribution Score (DAS), against existing data attribution methods across various experimental settings. Our findings demon- strate that DAS significantly outperforms other methods attribution performance, validating its ability to accurately identify influential training samples. We provide an overview of the datasets and diffusion models used in our experiments, with detailed descriptions available in Appendix E.
CIFARIO x32x32). We conduct experiments on the CIFAR-10 (Krizhevsky, 2009), containing 50,000 training samples across 10 classes. For computational efficiency on ablation studies, CIFAR- 2, a subset with 5,000 samples randomly selected from 2 classes is proposed. We use a 35.7M DDPM (Ho et al., 2020) with 50-step DDIM solver (Song et al., 2021a) on these settings.
CelebA (64x 64). From original CelebA dataset training and test sets (Liu et al., 2015), we extracted 5,000 training samples. Following preprocessing steps outlined by Song et al. (2021b), images were initially center cropped to 140x 140 and then resized to 64x64. The diffusion model used mirrors the CIFAR-10 setup but includes an expanded U-Net architecture with 118.8 million parameters.
ArtBench (256x256) ArtBench (Liao et al., 2022) a dataset of 50,000 images across 10 artistic styles. For our studies, we derived two subsets: ArtBench-2, with 5,000 samples from 2 classes and ArtBench-5,, with 12,500 samples from five styles. We fine-tuned a Stable Diffusion model on these datasets using LoRA (Hu et al., 2022) with 128 rank and 25.5M parameters. During inference, images are generated using a DDIM solver with a classifier free guidance (Ho & Salimans, 2021).
5.2 EVALUATION METHOD FOR DATA ATTRIBUTION
Various methods are available for evaluating data attribution techniques, including the leave-one-our influence method (Koh & Liang, 2017; Basu et al., 2021) and Shapley values (Lundberg & Lee, 2017). In this paper, we use the Linear Datamodeling Score (I.DS) (Iyas et al., 2022) to assess data attribution methods. Given model trained @ on dataset S, LDS evaluates the effectiveness of data attribution method r by initially sampling a sub-dataset S' C S and retraining a model 0' on S'. The attribution- output prediction for an interested sample te is then calculated as:
9r (z 10st S', := Σ T(2 ())
(19)
The underlying premise of LDS is that the predicted output 9r (2,S', S',3) should correspond closely to the actual model output f( 0¹). To validate this LDS samples M subsets of fixed size and
7

---

Published as a conference paper at ICLR 2025
Table 1: LDS (%) on CIFAR-2/CIFAR-10 with timesteps (10 100).
CIFAR2
CIFARIO
Method
Validation
Generation
Validation
Generation
10
100
10
100
10
100
10
100
Raw pixel (dot prod.)
7.77=:0.57
4.89::0.58
2.50::0:42
2.25:+0.39
Raw pixel (cosine)
7.87:10.57
5.44:0.57
2.71:0.41
2.61:0.38
CLIP similarity (dot prod.)
6.51+:1.06
3.00=0.95
2.394-0.41
1.11=-0.47
CLIP similarity (cosine)
8.54::1001
4.01 =0.85
3.39:10.38
1.69::0.49
Gradient (dot prod.)
5.14=0.60
5.07
2.80:10,55
4.03:20.51
0.79=0043
1.40::0.42
0.74::0.45
1.85:10554
Gradient (cosine)
5.08=0.59
4.89410.50
2.7840.55
3.92:10.9
0.66::0.33
1.24:10.4
0.58:10.42
1.82:0.51
TracInCP
6.26=0.84
5.4710.87
3.7611.61
3.7010.66
0.98=0.44
1.26.1.38
0,96:10.40
1.3910.54
GAS
5.78=0.82
5.15+0087
3,34:10.56
3.30=0.68
0.89=0048
1.25-+0.38
0,90:10:41
1,61
Journey TRAK
/
7.73++0.5
12.21++0.46
3,71++0.37
7.244
Relative IF
11.20=0.51 23.43=0.46
5,86+0.48
15.91+0.399
2.76=0045
13.56=0.39
2.42:40.36
10.65:0.42
Renorm. IF
10,99=0.46 21.46:0:42
5.6910.45 14.65:10.37
2.73-0046
12:58=0:4)
2.10:10.34
9.3420.43
TRAK
11.42:+0.49 23.59-0.46
5.78++0.48
15.87-40.39
2.93-0.46
13.62- 0.38
2,20++0.38
10,33-+0,42
D-TRAK
26.79:10.33 33.74=0.37
48.
25.67:10.40
14.69:1046
0.22
11.05=0::33
16.11100,66
DAS
03.90 43.08 0.37 20.8//00.88-0.22 30.68-100.7, 24.74-10.41
15.24 0.51 23.69
Table 2: LDS (%) on ArtBench-2/Arttenchhh with timesteps (10 or 100)
ArtBench2
ArtBench5
Method
Validation
Generation
Validation
Generation
100
100
100
100
Raw pixel (dot prod.)
2.441:0.56
2.60=1084
1.8410.42
2.77=0.80
Raw pixel (cosine)
2.58-+0.56
2.71 0.666
1.97-40.41
3,22:10.78
CLIP similarity (dot prod.)
7.18:+0.70
5.33:1145
5.29:t0.45
4.47:+1.09
CLIP similarity (cosine)
8.62:10.70
8.66
6.5710.44
6.63
Gradient (dot prod.)
7.68=0.43
16.00=0.51
4.07:1-007
10.23::1.08
08
4.77=0036
10.02=:0455
3,89:10888
8.17::1.02
Gradient (cosine)
7.72-0.42
16.04-0.44
4.50++0.97
10.71++1007
4.96-0035
9.85+00.44
4,14++0.86
8.18+11.01
TrucInCP
9.69-0.49
17.83-0.58
6.36:10.93
13.85::1.01
5.33-0037
10.87-0447
4.34:10.84
9.02.11.04
GAS
9.65=0.46
18.04-0062
6.74++0.82
14.27++0.97
5.52+0.38
10.71=0.48
4.48++0.83
9.13++1001
Journyy TRAK
/
5.96:t0.97
11.41+11.02
7.59:
13.31+00.68
Relative IF
12.22:10.43 27.25
7.62::0.57
19.78:10.99
9.77=0034
20.97=0.41
8.89:10559
19.56:10.2
Renorm, IF
11,90-1043 26.49-0.44
7.83-10.64
19.86-10.71
9.57=0.32
20.72 0.40
8.97-40.58
19.38:10.66
TRAK
12.26:10.42 27.2
7.78:1.55 20.02410.99
9,79--033
22
8.7910059
19.5410.1
D-TRAK
27.61+0.49 32.38-0.41
24.16+0.67
26.53+
22.8440.37
27.46-0.77
0.75
23.85+0.71
DAS
37.96:10.64 40.77: 307
32.31
35.33:404
37.67
0..77
predicted model outputs across these subsets:
LDS(T, 2 = p (E 0m) E [M]), (9r(""", ,,"::) D)
m [M])
(20)
where p denotes the Spearman correlation and O.. is the model trained on the m-th subset Sm In evaluation, we adopt the output function setup from D-TRAK (Zheng et al., 2024), setting f(" see00 O) as the Simple Loss described in Eq. 3 for fairness. Although the output functions differ between D- TRAK and DAS. fiAs can also evaluate the Simple Loss change, where we elaborate on the rationale in Appendix D. Further details about LDS benchmarks are described in Appendix E.2.
5.3 EVALUATION FOR SPEED UP TECHNIQUES
The diffusion models used in our experiments are significantly complex, with parameter counts of 35.7M. 1188M, and 25,5M respectively. These large dimensions pose considerable challenges in calculating the attribution score efficiently. To address this, we evaluate speed-up techniques dis- cussed in Section 4.3 on CIFAR-2. The results of these evaluations are reported in the Appendix E.4.
Normalization. We evaluate the normalization of gradients and residuals, proposed in Eq. 17, to stabilize gradient variability across timesteps and enhance computational accuracy. By normalizing across generation before averaging, the performance for both DAS and D-TRAK improve (Table 4).
Number of timesteps. Computing DAS requires balancing effectiveness and computational ef- ficiency, timesteps selected improve performance but increase costs. Experiment shows
8

---

Published as a conference paper at ICLR 2025
that while increasing timesteps enhances LDS results (Table 5), using 100 10 timesteps achieves comparable performance to 1000 timesteps with much lower computational demands.
Projection. We apply the projection technique reduce gradient dimensions. As Johnson & Lin- denstrauss (1984) discussed, higher projection dimensions better preserve inner products but in- crease computational costs. Figure 2 shows that LDS scores for both D-TRAK and DAS improve with increasing & before plateauing. Based on these results, we set h = 32768 as a default setting.
Compress Model Parameters. We explore techniques to reduce the gradient dimension by com- pressing. We conduct experiments by computing gradients on the up-block of U-Net, and the results in Table show that this approach achieves competitive performance compared to the full model.
Candidate Training Sample. Another technique to speed up the calculation involves reducing the number of training samples considered. We use CLIP to select the 1,000 training samples most similar to the target, compute attribution scores only for this candidate set (assigning 0 to others), and calculate the LDS, with results Table validating its effectiveness.
5.4 EVALUATING OUTPUT FUNCTION EFFECTIVENESS
We define the output function foAs co(x;" .) to assess distribution shifts after data interven- tion. We argue that using Simple Loss introduces error as it involves the effect of data distribution during attribution. To validate this, conduct toy experiment using unconditional DDPM trained on CIFAR-2 to generate 60 images. Each image is regenerated after removing 1,000 random training samples, producing 60 image pairs for which we compute L distances. Denoising starts from timestep T', and we track average differences in loss and noise predictor outputs. Pearson cor- relation between I,2 distances and loss differences is 0.257, whereas for noise predictor differences, it reaches 0.485, indicating stronger alignment with image variations. Details are in Appendix H. This result aligns with intuition: if model trained on cats and dogs generates a cat, removing all cat samples leads to a dog image under the same seed. Despite the drastic change, loss values may remain similar, as they reflect model optimization rather than generated content. Thus, loss differ- ences fail to capture image changes, whereas noise predictor outputs effectively trace variations in diffusion model outputs.
5.5 EVALUATING LDS FOR VARIOUS ATTRIBUTION METHODS
In this section, we evaluate the performance of the Diffusion Attribution Score (DAS) against exist- ing attribution baselines applicable to our experimental settings, as outlined by Zheng et al. (2024), with detailed explanations provided in Appendix E.3. Our primary focus is on comparing with post- hoc data attribution methods. To ensure fair comparisons, we limit the use of acceleration techniques for DAS to projection only, excluding others like normalization. The results on CIFAR, ArtBench and CelebA, presented in Tables 1, 2, demonstrate that DAS consistently outperforms existing meth- ods, where the result of CelebA is reported in the appendix in Appendix E.4 at Table 3.
Compared D-TRAK, DAS shows substantial improvements. On validation set utilizing 100 timesteps, DAS achieves improvements of +9.33% on CIFAR-2, +8.39% on ArtBench-2, and +5.1% on CelebA. In the generation set, the gains continue with +5.01% on CIFAR-2, +5.78% on ArtBench-2, and +9. +9.21 % on CelebA. Notably, DAS also achieves significant improvements on larger datasets like CIFARIO and ArtBench5, outperforming D-TRAK by +12.67% and +10.21% % on validation sets and +7.58% and +8.92% on generation samples.
Other methods generally underperform on larger datasets such as ArtBench5 and CIFARIO com- pared to smaller datasets like CIFAR2 and ArtBench2. Conversely, our method performs better on ArtBench5 than on ArtBench2. Remarkably, our findings suggest that while with more timesteps for calculating gradients generally leads to a better approximation of the expectation E,, DAS, employ- ing only a 10-timestep computation budget, still outperforms D-TRAK, which uses a 100-timestep budget in most cases, which underscores the effectivvness of our approach. Additionally, the mod- est improvements on CIFAR1O and CelebA may be attributed to the LDS setup for these datasets, which employs only random seed per subset for training a model, whereas other datasets uti- lize three random seeds, potentially leading to inaccuracies in LDS evaluation. Another observation is that DAS performs better on the validation set than the generation set. This could indicate

---

Published as a conference paper at ICLR 2025
Random
D- D-TRAK
DAS
Random
D-TRAK
DAS
We conduct visualization experiment explore DAS effectiveness described in Sec 5.6. Removing the influential samples identified by DAS produces the most significant differences the generated images after retraining the model. DAS the most effective methods for attribution.
Figure 1:
that the quality of generated images may have significant impact on data attribution performance. However, further investigation is needed to validate this hypothesis.
5.6 COUNTER FACTUAL VISUALIZATION EVALUATION
To more intuitively assess the faithfulness of DAS, we conduct a counter factual visualization exper- iment. We use different attribution methods, including TRAK, D-TRAK and DAS, to identify the the top-1000 positive influencers on 60 generated images on ArtBench2 and CIFAR2. We sample 100 timesteps and projection dimension of l 32768 to identify the top- 1000 influencers. These training samples identified by each method are subsequently removed and the model is retrained. Additionally, we conduct baseline setting where 1,000 training images randomly removed be- fore retraining. We re-generate the images with same random seed and compare the I,a-Distance and CLIP cosine similarity between the origin and counter-factual images. For the pixel-wise I.2- Distance, D-TRAK yields values of 8.97 and 187.61 for CIFAR-2 and ArtBench-2, respectively, compared TRAK's values of 5.90 and 168.37, while DAS results in values of 10.58 and 203.76. In terms of CLIP similarity, DAS achieves median similarities of 0.83 and 0.71 for ArtBench-2 and C respectively, which are notably lower than TRAK's 's values of 0.94 and 0.84, as well as D-TRAK's values of 0.88 and 0.77, demonstrating the effectiveness of our method. An illustration of the experiment Figure 1, where removing the influencers detected by DAS results in biggest difference compared to baseline methods. A detailed result in box-plot is reported in Appendix G.
CONCLUSION
In this paper, we introduce the Diffusion Attribution Score (DAS) to address the existing gap in data attribution methodologies for generative models. We conducted comprehensive theoretical anal- ysis to elucidate the inherent challenges in applying TRAK to diffusion models. Subsequently, we derived DAS theoretically based on the properties of diffusion models for attributing data throughout the entire generation process. We also discuss strategies to accelerate computations extend DAS to large-scale diffusion models. Our extensive experimental evaluations on datasets such as CIFAR, CelebA, and ArtBench demonstrate that DAS consistently surpasses existing baselines in terms of Linear Datamodeling Score evaluation. This paper underscores the crucial role data attribution in ensuring transparency in the of diffusion models, especially when dealing with copyrighted or sensitive content. Looking forward, our future work aims to extend DAS to other generative models and real-world applications further ascertain its effectiveness and applicability.
7
ACKNOWLEDGMENT
This work supported in part by the Start-up Grant (No. 9610680) of the City University of Hong Kong, Young Scientist Fund (No. 62406265) of NSFC, and the Australian Research Council under Projects DP240101 01844 and F7230100549.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Ekin Akyurek, Tolga Bolukbasi, Frederick Liu, Binbin Xiong, lan Tenney, Jacob Andreas, and Kelvin Guu. Towards tracing knowledge in language models back the training data. In Findings of the Association for Computational Linguistics: EMNLP 2022. Association for Computational Linguisties, 2022.
Arindam Banerjee, Srujana Merugu, Inderjit S Dhillon, Joydeep Ghosh, and John Lafferty, Cluster- ing with bregman divergences. Journal of machine learning research, 2005.
Elnaz Barshan, Marc-Etienne Brunet, and Gintare Karolina Dziugaite. Relatif: Identifying explana-
tory training samples via relative influence. International Conference on Artificial Intelligence and Statistics, 2020.
Samyadeep Basu, Phil Pope, and Soheil Feizi. Influence functions in deep learning are fragile. In International Conference on Learning Representations, 2021.
Jonathan Brokman, Omer Hofman, Roman Vainshtein, Amit Giloni, Toshiya Shimizu, Inderjeet Singh, Oren Rachmil, Alon Zolfi, Asaf Shabtai, Yuki Unno, al. Montrage: Monitoring training for attribution of generative diffusion models. In European Conference on Computer Vision, pp- 1-17. Springer, 2025.
Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), 2023.
Guillaume Charpiat, Nicolas Girard, Loris Felardos, and Yuliya Tarabalka. Input similarity from the neural network perspective. Advances in Neural Information Processing Systems, 2019.
Yuanyuan Chen, Boyang Li, Han Yu, Pengcheng Wu, and Chunyan Miao. Hydra: Hypergradi- ent data relevance analysis for interpreting deep neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, 2021.
R Dennis Cook. Detection of influential observation in linear regression. Technometrics, 1977.
Zheng Dai and David K Gifford. Training data attribution for diffusion models, 2023.
Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. Advances in Neural Information Processing Systems, 2020.
Kristian Georgiev, Joshua Vendrow, Hadi Salman, Sung Min Park, and Aleksander Madry. The jour- ney, not the destination: How data guides diffusion models. In Arxiv preprint arXiv:2312.06205, 2023.
Amirata Ghorbani and James Zou. Data shapley: Equitable valuation of data for machine learning. In International conference on machine learning, 2019.
Zayd Hammoudeh and Daniel Lowd. Identifying a training-set attack's target using renormalized influence estimation. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022.
Zayd Hammoudeh and Daniel Lowd. Training data influence analysis and estimation: survey. Machine Learning. 2024.
Trevor Hastie. Ridge regularization: An essential concept in data science. Technometrics, 2020.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-or. Prompt-to-prompt image editing with cross-attention control. The Eleventh International Con- feerence Learning Representations, 2023.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. In NewrIPS 2021 Workshop Deep Generative Models and Downstream Applications, 2021.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 2020.

---

Published as a conference paper at ICLR 2025
Jonathan Ho, William Chan, Chitwan Saharia, Jay Whang, Ruiqi Gao, Alexey Gritsenko, Diederik P Kingma, Ben Poole, Mohammad Norouzi, David J Fleet, et al. Imagen video: High definition video generation with diffusion models. arXiv preprint arXiv:2210.023303 2022.
Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Con- ference on Learning Representations, 2022.
Yuzheng Hu, Pingbang Hu, Han Zhao, and Jiaqi Ma. Most influential subset selection: Challenges, promises, and beyond. In The Tiihty-eighth Annual Conference on Neural Information Processing Systems, 2024.
Andrew Ilyas, Sung Min Park, Logan Engstrom, Guillaume Leclere, and Aleksander Madry. Data- models: Predicting predictions from training data. In ICMI,, 2022.
Ruoxi Jia, David Dao, Boxin Wang, Frances Ann Hubis, Nick Hynes, Nezihe Merve Gürel, Bo Li, Ce Zhang, Dawn Song, and Costas J Spanos. Towards efficient data valuation based the shapley value. In The 22nd International Conference on Artificial Intelligence and Statistics, 2019.
Ruoxi Jia, Fan Wu, Xuehui Sun, Jiacen Xu, David Dao, Bhavya Kailkhura, Ce Zhang, Bo Li, and Dawn Song. Scalability vs, utility: Do we have to sacrifice one for the other in data importance quantification? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021.
William Johnson and Joram Lindenstrauss. Extensions of lipschitz maps into hilbert space. Con- temporary Mathematics, 1984.
Rajiv Khanna, Been Kim, Joydeep Ghosh, and Sanmi Koyejo. Interpreting black box predictions using fisher kernels. In The 22nd International Conference on Artificial Intelligence and Statistics, 2019.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International conference on machine learning, 2017.
Xianghao Kong, Ollie Liu, Han Li, Dani Yogatama, and Greg Ver Steeg. Interpretable diffusion via information decomposition. In The Twelfth International Conference on Learning Representa- tions, 2024.
Zhifeng Kong and Kamalika Chaudhuri. Understanding instance-basee interpretability of variational auto-encoders, Advances in Neural Information Processing Systems, 2021.
Krizhevsky. Learning multiple layers of features from tiny images. Master's thesis, University of Tront, 2009.
Yongchan Kwon, Eric Wu, Kevin Wu, and James Zou. Datainf: Efficiently estimating data influence in loRA-tuned LLMs and diffusion models. In The Twelfth International Conference Learning Representations, 2024.
Xiang Li, John Thickstun, Ishaan Guirajani, Percy S Liang, and Tatsunori B Hashimoto. Diffusion- Im improves controllable text generation. Advances in Neural Information Processing Systems, 2022.
Peiyuan Liao, Xiuyu Li, Xihui Liu, and Kurt Keutzer. The artbench dataset: Benchmarking genera- tive models with artworks, 2022.
Jinkun Lin, Anqi Zhang, Mathias Lécuyer, Jinyang Li, Aurojit Panda, and Siddhartha Sen. Mea- suring the effect of training data on deep learning predictions via randomized experiments. In International Conference on Machine Learning, 2022.
Zhuoming Liu, Hao Ding, Huaping Zhong, Weijia Li. Jifeng Dai, and Conghui He. Influence selec- tion for active learning. In Proceedings of the IEEE/CVF international conference on computer vision, 2021.
12

---

Published as a conference paper at ICLR 2025
Ziwei Liu, Ping Luo, Xiaogang Wang. and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, 2015.
Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. International Confer- on Learning Representations, 2019.
Scott M Lundberg and Su-In Lee. A unified approach interpreting model predictions. Advances in neural information processing systems, 2017.
Xinyin Ma, Gongfan Fang, and Xinchao Wang. Deepcache: Accelerating diffusion models for free. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pp- 15762-15772, 2024.
Sadhika Malladi, Alexander Wettig, Dingli Yu, Danqi Chen, and Sanjeev Arora. A kernel-based view of language model fine-tuning. In International Conference on Machine Learning. 2023.
James Martens. New insights and perspectives on the natural gradient method. Journal of Machine Learning Research, 2020.
Bruno Kacper Mlodozeniec, Runa Eschenhagen, Juhan Bac, Alexander Immer, David Krueger, and Richard E. Turner. Influence functions for scalable data attribution in diffusion models. In The Thirteenth International Conference on Learning Representations, 2025.
Sung Min Park, Kristian Georgiev, Andrew llyas, Guillaume Leclerc, and Aleksander Madry. Trak: Attributing model behavior at scale. International Conference on Muchine Learning, 2023.
Daryl Pregibon. Logistic regression diagnostics. The annals of statistics, 1981.
Garima Pruthi, Frederick Liu, Satyen Kale, and Mukund Sundararajan. Estimating training data influence by tracing gradient descent. Advances in Neural Information Processing Systems, 2020.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference machine learning, 2021.
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. Model-agnostic interpretability of ma- chine learning, 2016.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattemn recognition, 2022.
Chitwan Saharia, William Chan, Huiwen Chang, Chris Lee, Jonathan Ho, Tim Salimans, David Fleet, and Mohammad Norouzi. Palette: Image-to-imas diffusion models. In ACM SIGGRAPH 2022 conference proceedings, 2022.
Andrea Schioppa, Polina Zablotskaia, David Vilar, and Artem Sokolov. Scaling up influence func- tions. In Proceedings of the AAAI Conference on Artificial Intelligence, 2022.
Harshay Shah, Sung Min Park, Andrew Ilyas, and Aleksander Madry. Modeldiff: A framework for comparing learning algorithms. International Conference on Machine Learning, 2023.
Lloyd S Shapley et al. A value for n-person games. Machine Learning, 1953.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art digital forgery? investigating data replication in diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- tional Conference on Learning Representattons, 202
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In Interna- tional Conference Learning Representations, 2021b.
13

---

Published as a conference paper at ICLR 2025
Naoyuki Terashita, Hiroki Ohashi, Yuichi Nonaka, and Takashi Kanemaru. Influence estimation for generative adversarial networks. In International Conference on Learning Representations, 2021.
Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning. Advances in neural information processing systems, 2017.
Sheng-Yo Yu Wang, Alexei Efros, Jun-Yan Zhu, and Richard Zhang. Evaluating data attribution for text-to-image models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023.
Chih- Kuan Yeh, Joon Kim, lan En-Hsu Yen, and Pradeep K Ravikumar. Representer point selection for explaining deep neural networks. Advances in neural information processing systems, 2018.
Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023.
Xiaosen Zheng, Tianyu Pang, Chao Du, Jing Jiang, and Min Lin. Intriguing properties of data attribution on diffusion models. In The Twelsth International Conference on Learning Represen- tations, 2024.
14

---

Published as a conference paper at ICLR 2025
A PROOF OF EQUATION 13
In this section, we provide a detailed proof of Eq. 13. We utilize the Newton Method (Pregibon, 1981) to update the parameters in the diffusion model, where the parameter update 0' is defined as:
0' - 0 + H (Csimple (0)) Siiple
(21)
Here, Ho, (Siiptee (0) represents the Hessian matrix, and V Csmple the gradient w.r. the Simple Loss in the diffusion model. At convergence, the model reaches the global optimum parameter estimate ,r, satisfying:
(fssippe(( Csimpee O.
(22)
Additionally, the Hessian matrix and gradient associated with the objective function at timestep / are defined as:
Ho. VAEN (B,, VOEg. (S,, VoL(0*) Voeg (Sc,t) R..
(23)
where Eg. (8,, 1) [gg (x) b), Eg. (x("), t)] denotes a stacked output matrix on timestep
t and RG == d (i) t) - E] is a diagonal matrix on S describing the residual among S. Thus, the update defined in Eq. 21 around the optimum parameter0"
0' - 0 + Ve (S,,t) Vgeg. (S,, t)) (Sr,t) R.
(24)
Upon deleting training sample (+)) from S, the counterfactual parameters oi can be estimated by applying a single step Newton's 's method from the optimal parameter 0* with the modified set S as follows:
0- - 07 + - |V geg (S " VeEr (B t) VeEe t) Rii
(25)
B PROOF OF EQUATION 15
In this section, we provide a detailed proof of Eq. 15. The -horian-Morrison formula is defined as:
(A uv ) A A uuv A-1
(26)
1 + T T 1-11 'uu
Let = (S) GS) and u (z) Applying Eq. 26 in Eq. 14, we derive:
(S TG H uu 11- H H uu H
(27)
H-1u
Additionally, we have:
()) R GS) R - (0) -u r (6)
(28)
Applying Eq. 27 and Eq. 28 to Eq. 25, we obtain:
H uu H
0-
1 T r(())
(29)
H 1
Let a = u T H u. Eq. 29 simplifies to:
8" 8, = H u (1+ + 1 r
H-1 u 1 1-6
(i)
Ti
(G)(S) (x )r
(30)
(T
(G.(S)
-
15

---

Published as a conference paper at ICLR 2025
C ALGORITHM OF DAS
In this section, we provide a algorithm about DAS in Algorithm
Algorithm Diffusion Attribution Score
1: Input:
Learning algorithm A, Training dataset & of size Training data dimension p. Max- imum timesteps for diffusion model T, Unet output in diffusion model c,(x,t), t), Projection dimension k, A standard gaussian noise (0, I), Normalization and average method N, A generated sample 2
2: Output: Matrix of attribution scores T E R
3: 0* < A(S)
Train a diffusion model on S Sample projection matrix
4: P (0,
5: R < -0xxn
6: for to do
7:
for -= 1 to T do
8:
6 N0, (0,1) 1)2
Sample gaussian noise D Compute gradient on training set and project Compute residual term
9:
(:(2((1)
P TTE (1 ri t ca. (a -c
11: end for
g(x(())
((g(((())))
Normalize projected gradient term Normalize residual term
13:
7(1) (r!"))
14: end for
15: G(S) (gx (oo( .... (..,((())).))))))))))))))) (x))
16: R (iag((()) ("))
17: for f T do
18: N0, 1)P²
Sample gaussian noise Compute gradient for generated sample and project
19: (2
Vg6a- (2t"
end for
21: g (20))
N (z
22: T (( (G1S) G(3) R
Compute attribution matrix
G()) (G(S) -
return (T)
D EXPLANATION ABOUT THE CHOICE OF MODEL OUTPUT FUNCTION IN LDS EVALUATION
In the LDS framework, we evaluate the ranking correlation between the ground-truth and the pre- dicted model outputs following data intervention. In our evaluations, the output function used in JoumeyTRAK and D-TRAK is shown to provide the same ranking as our DAS output function. Below, we provide detailed explanation of this alignment.
Defining the function fzz f) as Simple D-TRAK predicts the change in output as:
f(2 00 - f(250 0m) = E..l ||| where A and 6m represent the models trained on the full dataset S and subset Syn, respectively.
ea (z," ,))1l E.llle eo... (=t .)].
(31)
With the retraining of the model on subset S,m while fixing all randomness, the real change can be computed as:
f( f2 0m) =Ee,elllc((z?)) (0, Co... (2 (2,
+ 2. (E0(2))) 1) - c0,m (2 1)) (c- (2,"
(2("", ())].
(32)
The first expectation represents the predicted output change in DAS as well as the ground truth output, while the term (6 60., (2.th ()) is recognized as the error of the MMSE estimator.
In our evaluations, the sampling noise c is fixed and co (2 t) is given value since the model is frozen. Therefore, the second term equals zero, following the orthogonality principle. It can be stated as a more general result that,
vf [[ 24 (c Co... (2 })] 0.
(33)
16

---

Published as a conference paper at ICLR 2025
48
48
44
TRAK
26
30
28
28
20
20
16
22
12
28672
(a) Val-10
(b) Val-100
52
DAS
DAS
44
D-TRAK
44
D-TRAK
36
36
20
28
24
20
16
15
(c) Gen-10
(d) Val-100
Figure 2: The LDS(%) on CIFAR-2 under different projection dimension k. We consider 10 and 100 timesteps selected to be evenly spaced within the interval [1, 7]. which used approximate the expectation E, For each sampled timestep, we sample one standard Gaussian noise ~ N((e(o, approximate the expectation E.,
The error (E - Ea.,, (2) must be orthogonal to any estimator f. If not, we could use f to construct an estimator with lower MSE than 60,, (Fgen), contradicting our assumption that (e 60... (= is the MMSE estimator. Applications of the orthogonality principle in diffusion models have been similarly proposed (Kong al., 2024; Banerjee al., 2005). Thus, given that we have frozen model 0, fixed sampling noise e and specific generated sample 2 the change in the output function in DAS provides the same rank as the one in JourneyTRAK and D-TRAK.
E IMPLEMENTATION DETAILS
E. DATASETS AND MODELS
CIFARI032x32). The CIFAR-10 dataset, introduced by Krizhevsky (2009), consists of 50,000 training images across various classes. For the Linear Datamodeling Score evaluation, we utilize subset of 1,000 images randomly selected from CIFAR-10's demands effectively, we also create smaller subset, CIFAR-2, which includes 5,000 training images and 1,000 validation images specifically drawn from the "automobile" and "horse" categories of C1'AR-10's training and test sets, respectively.
To manage computational
In our CIFAR experiments, we employ the architecture and settings of the Denoising Diffusion Probabilistic Models (DDPMs) as outlined by Ho et al. (2020). The model is configured with ap- proximately 35.7 million parameters (d = 35.7 x 106 for Rd).. We set the maximum number of timesteps (1) 1,000 with linear variance schedule for the forward diffusion process, beginning at 31 = 10 4 and escalating to 3r = 0.02. Additional model specifications include dropout rate of 0.1 and the of the AdamW optimizer (Loshchilov & Hutter, 2019) with weight decay of 10 -6_ Data augmentation techniques such as random horizontal flips are employed to enhance model ro- bustness. The training process spans 200 epochs with batch size of 128, using cosine annealing
17

---

Published as a conference paper at ICLR 2025
1i0 Eacts
100/0 Eoids
10
Figure 3: The LDS( on CIFAR-2 varies across different checkpoints. We analyze the data using 10 and 100 timesteps, evenly spaced within the interval [1, T), to approximate the expectation E4- At each sampled timestep, we introduce one standard Gaussian noise é ~ (o I) to approximate the expectation E., We set the projection dimension k 32768.
learning rate schedule that incorporates a warm-up period covering 10% of the training duration, beginning from an initial learning rate of 10-4 During inference, new images are generated using the 50-step Denoising Diffusion Implicit Models (DDIM) solver (Song et al., 2021a).
C64 We selected 5,000 training samples and 1,000 validation samples from the orig- inal training and test sets of CelebA (Liu et al., 2015), respectively. Following the preprocessing method described by Song et al. (2021b), we first center-cropped the images to 140 x 140 pixels and then resized them to 64x 64 pixels. For the CelebA experiments, we adapted the architecture to accommodate a 64 x4 resolution while employing a similar unconditional DDPM implementation as used for CIFAR-10. However, the U-Net architecture was expanded to 1 118.8 million parameters to better capture the increased complexity of the CelebA dataset. The hyperparameter, including the variance schedule, optimizer settings, and training protocol, were kept consistent with those used for the CIFAR-IO experiments.
ArtBench(256x22 256). ArtBench (Liao et al., 2022) a dataset specifically designed for gener- ating artwork, comprising 60,000 images across 10 unique artistic styles. Each style contributes 5,000 training images and 1,000 testing images. We introduce two subsets from this dataset for focused evaluation: ArtBench-2 and ArtBench-5, ArtBench-2 features 5,000 training and 1,000 val- idation images selected from the "post-impressionism" and "ukiyo-e" styles, extracted from a total of 10,000 training and 2,000 test images. ArtBench-5 includes 12,500 training and 1,000 valida- tion images drawn from a larger pool of 25,000 training and 5,000 test images across five styles: "post-imprressonismm." "ukiyo-e," "romanticism,"" "renaissance," and "baroque."
For our experiments on ArtBench, we fine-tune a Stable Diffusion model (Rombach et al., 2022) using Low-Rank Adaptation (LoRA) (Hu al., 2022) with rank of 128, amounting to 25. 5, million parameters. We adapt a pre-trained Stable Diffusion checkpoint from a resolution of 512x510
256x256 align with the ArtBench specifications. The model is trained conditionally using textual prompts specific to each style, such as "a class painting," e.g., "a romanticism painting," We set the dropout rate at 0.1 and employ the AdamW optimizer with weight decay of 10-0 Data augmentation is performed via random horizontal flips. The training is conducted over 100 epochs with a batch size of 64, under a cosine annealing learning rate schedule that includes a 0.1 fraction warm-up period starting from initial rate of 3 10-4 During the inference phase, generate new images using the 50-step DDIM solver with a classifier- free guidance scale 7.5 (Ho & Salimans, 2021).
E.2 LDS EVALUATION SETUP
Various methods are available for evaluating data attribution techniques, including the leave-one-out influence method (Koh & Liang, 2017; Basu et al., 2021) and Shapley values (Lundberg & Lee, 2017). In this paper, we use the Linear Datamodeling Score (L.S)) (Ilyas et al., 2022) to assess data attribution methods. Given model trained 0 dataset S, LDS evaluates the effectiveness of data attribution method r by initially sampling sub-dataset S' C S and retraining model 0' on S'. The attribution-ben based output prediction for an interested sample zesi is then calculated as:
gr (',S))))))
Σ 7(2
(34)
E
The underlying premise of LDS is that the predicted output 9r (2, Liz,S'S. S',3) should correspond closely to the actual model output f( 0¹). To validate this LDS samples M subsets of fixed size and
18

---

Published as a conference paper at ICLR 2025
4.5
412
634
130
(a) VAL-10
(b) VAL-100
(c) VAL-1000
1.4
0.4
0.2
0.4
274
870
0.20
030
2.44
8.45
8.00
6.1
8.4
6.3
0.15
0.1
0.8
8:00
8:04
8:00
164
-082
19m
15*
18
(d) GEN-10
(c) GEN-ION 100
GEN- 1000
Figure 4: LDS (%) on CIFAR-2 under different A. We consider 10, 100, and 1000 timesteps selected to be evenly spaced within the interval [1, TJ. which are used to approximate the expectation E, We set k 4096.
predicted model outputs across these subsets:
LDS(T, ="=) == p (f : m E [M]], (""" m E [M]})
(35)
where p denotes the Spearman correlation and 6m is the model trained on the m-th subset Sth For the L.S evaluation, we construct 64 distinct subsets S. from the training dataset S, each constituting 50% of the total training set size. For CIFAR-2, ArtBench-2, and ArtBench-5,, three models per subset are trained using different random seeds for robustness, while for CIFAR-IO and CelebA, a single model is trained per subset. A validation set, comprising 1,000 samples each from the original test set and a generated dataset, serves as zte for LDS calculations. Specifically, we evaluate the Simple Loss Liugiee 0) defined in Eq 3 for samples of interest from both the validation and generation sets. To better approximate the expectation E,, we utilize 1,000 timesteps, evenly spaced within the range []. At each timestep, three instances of standard Gaussian noise NN I) are introduced to approximate the expectation Ez. The calculated LDS values are then averaged across the selected samples from both the validation and generation LDS performance.
determine the overall
E.3 BASELINES
In this paper, our focus primarily on post-hoc data attribution, which entails applying attribution methods after the completion of model training. These methods are particularly advantageous as they do not impose additional constraints during the model training phase, making them well-suited for practical applications (Ribeiro et al., 2016).
Following the work of Hammoudeh & Lowd (2024), we evaluate various attribution baselines that are compatible with our experimental framework. We exclude certain methods that are not fea- sible for our settings, such as the Leave-One-Out approach (Cook, 1977) and the Shapley Value method (Shapley et al., 1953; Ghorbani & Zou, 2019). These methods, although foundational, do not align well with the requirements of DDPMs due to their intensive computational demands and model-speciffe limitations. Additionally, we do not consider techniques like Representer Point (Yeh et al., 2018), which are tailored for specific tasks and models, and thus are incompatible with DDPMs. Moreover, disregard HYDRA (Chen et al., 2021), which, although related to Trac-
19

---

Published as a conference paper at ICLR 2025
(a) VAL-10
(b) VAL-I00
134
(c) GEN-10
(d) GEN-100
Figure 5: LDS (%) on ArtBench-2 under different A. We consider 10 and 100 timesteps selected to be evenly spaced within the interval [1, which are used to approximate the expectation E,, We set k = 32768.
InCP (Pruthi et al., 2020), compromises precision for incremental speed improvements as critiqued by Hammoudeh & Lowd (2024).
Two works focus diffusion model that also fall outside our framework. Dai & Gifford (2023) pro- pose a method for training data attribution on diffusion models using machine unlearning; however, their approach necessitates a specific machine unlearning training process, making it non-post-hoc and thus unsuitable for standard settings. Similarly, Wang et al. (2023) acknowledge the current challenges in conducting post-hoc training influence analysis with existing methods. They suggest an alternative termed "customization," which involves adapting or tuning a pretrained text-to-image model through specially designed training procedure.
Building upon recent advancements, Park et al. (2023) introduced an innovative estimator that lever- ages kernel matrix analogous the Fisher Information Matrix (FIM), aiming linearize the model's behavior. This approach integrates classical random projection techniques to expedite the computation of bbased influence functions (Koh Liang, 2017), which are typically compu- tationally intensive. Zheng et al. (2024) adapted TRAK to diffusion models, empirically designing the model output function. Intriguingly, they reported that the theoretically designed model output function in TRAK performs poorly in unsupervised settings within diffusion models. However, they did not provide theoretical explanation for these empirical findings, leaving a gap in understanding the underlying mechanics.
Our study concentrates on retraining-Fe free methods, which we categorize into three distinct types: manilarity-based gradient-based based (without kernel), and gradient-basee (with kernel) methods. For similarity-basee approaches, we consider Raw pixel similarity and CLIP similarity (Radford et al., 1)21). The gradient-based methods without kernel include techniques such as Gradient (Charpiat et al., 2019), TracInCP (Pruthi et al., 2020) and GAS (Hammoudeh & Lowd, 2022). In the domain of gradient- gradeent-based methods with kernel, we explore several methods including D-TRAK (Zheng et al., 2024), TRAK (Park et al., 2023), Relative Influence (Barshan et al., 2020), Renormalized Influence (Hammoudeh & Lowd, 2022), and Journey TRAK (Georgiev et al., 2023).
20

---

Published as a conference paper at ICLR 2025
(a) VAL-10
(b) VAL-100
(c) GEN-10
(d) GEN-100
Figure 6: LDS (%) on ArtBench-5 under different A. We consider 10 and 100 timesteps selected to be evenly spaced within the interval [1, which are used to approximate the expectation E,, We set k = 32768.
We next provide definition and implementation details of the baselines used in Section 5.5.
Raw pixel. This method employs a naive similarity- approach for data attribution by using the raw image data itself as the representation. Specifically, for experiments ArtBench, which utilizes latent diffusion models (Rombach al., 2022), we represent the images through the VAE encodings (Van Den Oord et al., 2017) of the raw image. The attribution score is calculated by computing either the dot product or cosine similarity between the sample of interest and each training sample, facilitating straightforward assessment of similarity based on pixel values.
CLIP Similarity. This method represents another similarity-based approach to data attribution. Each sample is encoded into an embedding using the CLIP model (Radford et al., 2021), which cap- tures semantic and contextual nuances of the visual content. The attribution score is then determined by computing cither the dot product cosine similarity between the CLIP embedding of the target sample and those of the training samples. This method leverages the rich representational power of CLIP embeddings ascertain the contribution of training samples to the generation classification of new samples.
Gradient. This method employs gradient-basse approach to estimate the influence of training samples, as described by Charpiat et al. (2019). The attribution score is calculated by taking the dot product cosine similarity between the gradients of the sample of interest and those of each training sample. This technique quantifies how much the gradient (indicative of the training sample's 's influence on the loss) of a particular training sample aligns with the gradient of the sample of interest, providing insights into which training samples most significantly affect the model's 's output.
T(2,S) = (P V Limple (x, 8))T (PT V Simple (2))))
(z) (PT V Simmpe (x, 8)) (PT) V Vo (x (1) 0))
| V Simple (x, 0)] V (z) 0)
21

---

Published as a conference paper at ICLR 2025
Table 3: L.S (%) CelebA with timesteps (10 100)
Results on CelebA
Validation
Generation
Method
10
100
100
Raw pixel (dot prod.)
5.58:10.73
-4.94:11.58
Raw pixel (cosine)
6.16::.75
1.63
CLIP similarity (dot prod.)
8.87+1.14
2.51
CLIP similarity (cosine)
10.92:10.87
3.03=1.113
Gradient (dot prod.)
3.82:10.50
4.89:10.65
3,83-1106
4.53:10.84
Gradient (cosine)
3.65:0.552
4.79100,6
3.86:10.96
4,40
TracInCP
5.14110.75
4.89110.86
5.1811005
4.50
GAS
5.44
5.19
4.69+00.77
3,98+0.97
Journey TRAK
1.53+1106
10.87=0.84
Relative IF
11.10=0.51
09,99=0.50
6.80+
14.66=0.70
Renorm. IF
11.01
18.67
6.74
13.24
TRAK
11.28.10.47
20.02-10447
7.02-10.89
14.71
D-TRAK
22.83-10.51
28.69
16.84
21.47-0.48
DAS
29.38:10.51
33.79=0.23
28.73::0499
30.68=0.31
TracInCP. We implement the TracInCP estimator, outlined by Pruthi et al. (2020), which quan- tifies the influence of training samples using the following formula:
(2, 1 50 (P. Vo.Vo VoLsimque 09) (Po V VoLsimpee ())),
where C' represents the number of model checkpoints selected evenly from the training trajectory, and 0 denotes the model parameters at each checkpoint. For our analysis, we select four specific checkpoints along the training trajectory to ensure a comprehensive evaluation of the influence over different phases of learning. For example, in the CIFAR-2 experiment, the chosen checkpoints occur at epochs 50, 100, 150, and 200, capturing snapshots of the model's development and adaptation.
GAS. The GAS method is essentially a "renormalized" version TracInCP that employs cosine similarity for estimating influence, rather than relying on raw dot products. This method was intro- duced by Hammoudeh Lowd (2022) and aims to refine the estimation of influence by normalizing the gradients. This approach allows for more nuanced comparison between gradients, considering not only their directions but also normalizing their magnitudes to focus solely on the directionality of influence.
TRAK. The retraining-free version of TRAK (Park et al., 2023) utilizes a model's s trained state to es- timate the influence of training samples without the need for retraining the model each evaluation step. This version is implemented using the following equations:
T FRAKK [xx"), (x
where ((x)) = V Simppic (I. 0),
7(z, 5= = V (a, 8))T (ΦTRAK TRAA + AT)
- Vy (x: 0),
where AI is included for numerical stability and regularization. The impact of this term further explored in Appendix F.
D-TRAK. Similar to TRAK. as elaborated Section 3, we adapt the D-TRAK (Zheng et al., 2024)
detailed in Eq 6. We implement the model output function f(z,0) as Lsquree The D-TRAK is implemented using the following equations:
P (x(xx) ..... (x) where (xxx) = PT VoLsimph (xc 0),
3(2,3)'= = Vo 0)) (PPRAK 4 + A1)
-1
P g
where AI is also included for numerical stability and regularization as TRAK. Additionally, the output function f(z,0 0) could be replaced to other functions.
22

---

Published as a conference paper at ICLR 2025
Table 4: We compare D-TRAK and methods DAS with the normalization and without normal- ization on CIFAR2. Besides, we also select 10, 100 and 1000 timesteps evenly spaced within the interval [1, I] and calculate the average LDS(%) among the timesteps.
Validation
Generation
Method
Normalization
10
100
1000
10
100
1000
No Normalization
24.78
30.81
32.37
16.20
22.62
23.94
D-TRAK
Normalization
26.11
31.50
32.51
17.09
22.92
24.10
No Normalization
33.04
42.02
43.13
20.01
29.58
30.58
DAS
Normalization
33.77
42.26
43.28
21.24
29.60
30.87
Relative Influence. Barshan et al. (2020) introduce the O-relative influence functions estimator, which normalizes the influence functions estimator from Koh & Liang (2017) by the magnitude of the Hessian-vector product (HVP). This normalization enhances the interpretability of influence scores by adjusting for the impact magnitude. We have adapted this method to our experimental framework by incorporating scalability optimizations from TRAK. The adapted equation for the Relative Influence is formulated as follows:
P Vo CSimpii (x, 0))T TRAK
TRAK AI)
-PT V o (z
(2,,8)(-
TRRAK T & TRAK
TRAK + A1) .P V Pohmimpe (ar(t), 0*)
Renormalized Influence. Hammoudeh & Lowd (2022) propose method to renormalize influence by considering the magnitude of the training sample's s gradients. This approach emphasizes the rel- ative strength of each sample's impact the model, making the influence scores more interpretable and contextually relevant. We have adapted this method to our settings by incorporating TRAK's scalability optimizations, which are articulated as:
(P VT (x, T)) TRAK T TRAK + AI)
-P
Vo Vo (z) A)
7(2,8)(0=
|| V Ciipiie (x) ,0]1
Journey TRAK. Journey TRAK (Georgiev et al., 2023) focuses on attributing influence noisy images 2, at specific timestep t throughout the generative process. In contrast, our approach aims attribute the final generated image x0 necessitating an adaptation of their method to our context. We average the attributions across the generation timesteps, detailed in the following equation:
T(2, (2 1 >
VeL (x,, 0))
TRAK + TRAK + A1)
P (x (x) ,0)
where 7" represents the number of inference steps, at 50, and æ; denotes the noisy image gener- ated along the sampling trajectory.
E.4 EXPERIMENTS RESULT
In this subsection, we present the outcomes of experiments detailed in Section 5.3. The results, which illustrate the effectiveness of various techniques designed expedite computational pro- cesses in data attribution, are summarized in several tables and figures. These include Table 4, Table Table and Table 7, as well as Figure 2. Each of these displays key findings relevant the specific speed-up technique tested, providing comprehensive view of their impacts on attribution performance.
F ABLATION STUDIES
We conduct additional ablation studies to evaluate the performance differences between D-TRAK and DAS. In this section, CIFAR-2 serves our primary setting. Further details these settings
23

---

Published as a conference paper at ICLR 2025
Table 5:
We compare our methods with TRAK and D-TRAK by LDS method CIFAR-2 among different selected timesteps. The projected dimension kt = 4096.
Validation
Generation
Method
10
100
1000
10
100
1000
TRAK
10.66
19.50
22.42
5.14
12.05
15,46
D-TRAK
24.91
30.91
32.39
16.76
22.62
23.94
DAS
33.04
42.02
43.13
20.01
29.58
30.58
Table 6: We compute DAS only with the Up-Block gradients in U-Net and evaluate by LDS method on CIFAR-2 among different selected timesteps. The projected dimension 32768.
Validation
Generation
Method
10
100
10
100
D-TRAK
24.91
30.91
16.76
22.62
DAS(Up-Block)
32.60
37.90
18.47
27.54
DAS(U-Net)
33.77
42.26
21.24
29.60
are available in Appendix E. We establish the corresponding LDS benchmarks as outlined in Appendix E.2.
Checkpoint selection Following the approach outlined by Pruthi et al. (2020), we investigated the impact of utilizing different model checkpoints for gradient computation. As depicted in Figures 3, our method achieves the highest LDS when utilizing the final checkpoint. This finding suggests that the later stages of model training provide the most accurate reflections of data influence. aligning gradients more closely with the ultimate model performance. Determining the optimal checkpoint achieving the best LDS score requires multiple attributions to be computed, which significantly increases the computational expense. Additionally, in many practical scenarios, access may be limited exclusively to the final model checkpoint. This constraint highlights the importance of de- veloping efficient methods that deliver precise attributions even when earlier checkpoints not available.
Value of À In our computation of the inverse of the Hessian matrix within the DAS framework, incorporate the regularization parameter X, as recommended by Hastie (2020), to ensure numerical stability and effective regularization. Traditionally, À is set to value close to zero; however, in our experiments, a larger İ proved necessary. This is because we use the generalized Gauss-Newton (GGN) matrix approximate the Hessian in the computation of DAS. Unlike the Hessian, the GGN is positive semi-definin (PSD), meaning it does not model negative curvature in any direction. The main issue with negative curvature is that the quadratic model predicts unbounded improvement in the objective when moving in those directions. Without certain techniques, minimizing the quadratic model results in infinitely large updates along these directions. To address this, several methods have been proposed, such as the damping technique discussed in (Martens, 2020). In our paper, adopt the linear damping technique \/ used (Zheng et al., 2024; Georgiev et al., 2023), which has proven effective on diffusion models. We show how À influence the LDS result in Figure 4, Figure 5, Figure 6, Figure 7 and Figure 8.
G COUNTER FACTUAL EXPERIMENT
Hu al. (2024) discuss some limitations LDS evaluation in data attribution. To further validate the effectiveness of DAS, we also conduct an counter-factur experiment, that 60 generate images are attributed by different attribution method, including TRAK, D-TRAK and DAS. We detect the top-1000 positive influencers identified by these methods and remove them from the training set and re-train the model. We utilize 100 timesteps and a projection dimension of = 32768 to identify the top- 1000 influencers for TRAK, D-TRAK and DAS. Additionally, conduct baseline experiment where 1000 training images are randomly removed before retraining. The experiment is conducted on ArtBench2 and CIFAR2. We generate the new images with same random seeds and compute
24

---

Published as a conference paper at ICLR 2025
(a) VAL-10
(b) VAL-100
(c) GEN-10
(d) GEN-100
Figure 7: LDS (%) on CIFAR- 10 under different A. We consider 10 and 100 timesteps selected to be evenly spaced within the interval [1, T], which are used to approximate the expectation Ez, We set k 32768.
(a) VAL-10 10
(b) VAL-100
(c) GEN-10
(d) GEN-100
Figure 8: LDS (%) on CelebA under different X. We consider 10 and 100 timesteps selected to be evenly spaced within the interval [1, TJ, which are used approximate the expectation E,, We set k = 32768.
25

---

Published as a conference paper at ICLR 2025
Table 7: We compute DAS only with the Up-Block gradients in U-Net and evaluate by LDS method
on CIFAR-2 among different selected timesteps. The projected dimension A 32768.
Validation
Generation
Method
10
100
10
100
D-TRAK
24.91
30.91
16.76
22.62
DAS(Candidate Set)
31.53
37.75
17.73
23.31
DAS(Entire Training Set)
33.77
42.26
21.24
29.60
CLIP Sim
CLIP Sim
Random
TRAK
D-TRAK
DAS
(a) ArtBench2-CLL
(b) CIFAR2-CLIP
C2 Dist
C2 Dist
Random
TRAK
D-TRAK
DAS
Random
TRAK
D-TRAK
DAS
(c) ArtBench2-IA 1,2 Dist.
(d) CIFAR2-LA Dist.
Figure 9: Box-plots of counterfactual evaluation CIFAR2 and ArtBench2. We assess the impact of removing the 1,000 highest-scoring training samples and retraining the model using Random, TRAK, D-TRAK, and DAS. The evaluation metrics include pixel-wise 1,²-Distacce and CLIP co- sine similarity between 60 generated samples and the corresponding images generated by the re- trained models, sampled from the same random seed.
the pixel-wise D'-Distance and CLIP cosine similarity between the re- re-generated images and their corresponding origin images. The result is reported in Figure with boxplot. For the pixel-wise I.*-Distace,, D-TRAK yields values 8.97 and 187.61 for CIFAR-2 and ArtBench-2, respectively, compared to TRAK's values of 5.90 and 168.37, while DAS results in values of 10.58 and 203. 76..76. DAS achieves median similarities of 0.83 and 0.71 for ArtBench-2 and CIFAR-2, respectively, which notably lower than TRAK's values of 0.94 and 0.84, well D-TRAK's values of 0.88 and 0.77, demonstrating the effectiveness our method.
H EVALUATING OUTPUT FUNCTION EFFECTIVENESS
Here, we present toy experiment to validate our theoretical claims: using the Simple Loss Value to represent changes in generated images is inadequate, as it relies on an indirect distributional comparison, discussed in Eq. 8. Instead, we propose using changes in the noise predictor output of the diffusion model. In the toy experiment, we first train unconditional DDPM on CIFAR2. The origin and each retrained model are to generate an image pair where random seed for re-trained model. total, we have 60 different generated images pairs. The L distance between the generated and original images is calculated to directly measure their differences.
26

---

Published as a conference paper at ICLR 2025
Correlation: 0,257
correlation: 0.485
Sample Loss Difference
Output Noise Difference
24403
L2 Distance
L2 Distance
(a) Origin
(b) Counter Factual
Figure 10: The result of Toy Experiment in Appendix H. Scatter plot showing the relationship between L distance and two metrics: loss difference and noise predictor output difference over entire generation. The noise predictor output difference exhibits stronger correlation with L distance, indicating its effectiveness in capturing image variation.
(a) Origin
(b) Counter Factual
(c) Origin
(d) Counter Factual
Figure 11: Figures 1 (a) and (1(b) represent pair of generated images, while 11(c) and 11(d) form another pair. Despite the loss difference between (a) and (1(b) being only 0.0007, the L distance is 15.261. Similarly, the loss difference between Ic(c) and 1 (dd) is also 0,0007, yet the L L'distance 14.485, showing that the loss value fail trace the change on generated images.
The original images are first noised timestep T, and the two models then used denoise the latent variables at T. At the entire denoising process, we compute the average loss difference and the average noise predictor output difference. For the 60 pairs of generated samples, calculate the rank correlation between these differences and the 2 distance. The results reveal that the Pear- son correlation between the L distance and the average loss difference is only 0.257, while the correlation with the average noise predictor output difference reaches 0.485. This indicates that the noise predictor output difference aligns better with the I distance than the loss value difference. Larger noise predictor output differences correspond to larger L distances, reflecting greater image variation. A scatter plot of these results is shown in Figure 10.
Figure 11 provides two specific examples. For images 11(a) and 11 as well as 11(c) and 11(d), the loss differences between the models are only 0.0007, the smallest among pairs. However, the L distance between l1))) and 11(b) is 15.261. and between 11(c) and [1(d) is 14.485, making them among the top five pairs with the largest L distances the toy dataset, which means the loss images. Meanwhile, the noise output differences for these two pairs align closely with the trend line in Figure 10(b), showing a correlation with the I distance.
difference fails to measure the difference
This result is unsurprising. Consider an extreme scenario: a model trained on a dataset containing cats and dogs generates image of cat. If all cat samples are removed, and the model is retrained,
27

---

Published as a conference paper at ICLR 2025
the new model would likely generate dog image under the same random seed. In such case, the loss values for both images might both remain v, resulting in loss difference of O. This may occurs because the simple loss reflects the model's convergence for the generation, not the image itself. Thus, the shift on loss value fail to capture the extent of image changes. By contrast, analyzing the differences in the noise predictor's outputs at each timestep allows to effectively trace the diffusion model output on the images.
I APPLICATION
Recent research has underscored the effectiveness of data attribution methods in a variety of ap- plications. These include explaining model predictions (Koh & Liang, 2017: Ilyas al., 2022), debugging model behaviors (Shah et al., 2023), assessing the contributions of training data (Ghor- bani & Zou, 2019; Jia et al., 2019), identifying poisoned or mislabeled data (Lin et al., 2022). most influential subset selection (Hu et al., 2024) and managing data curation (Khanna et al., 2019; Liu et al., 2021; Jia al., 2021). Additionally, the adoption of diffusion models in creative industries, as exemplified by Stable Diffusion and its variants, has grown significantly (Rombach et al., 2022; Zhang et al., 2023). This trend highlights the critical need for fair attribution methods that appro- priately acknowledge and compensate artists whose works are utilized in training these models. Such methods are also crucial for addressing related legal and privacy concerns (Carlini et al., 2023; Somepalli al., 2023).
J LIMITATIONS AND BROADER IMPACTS
J.1 LIMITATIONS
While our proposed Diffusion Attribution Score (DAS) showcases notable improvements in data attribution for diffusion models, several limitations warrant attention. Firstly, although DAS reduces the computational load compared to traditional methods, it still demands significant resources due to the requirement to train multiple models and compute extensive gradients. This poses challenges particularly for large-scale models and expansive datasets. Secondly, the current implementation of DAS tailored primarily to image generation tasks. Its effectiveness and applicability to other forms of generative models, such as those for generating text audio, remain untested and may not directly translate. Furthermore, DAS operates under the assumption that the influence of individual training samples is additive. This simplification may not accurately reflect the complex interactions and dependencies that can exist between samples within the training data.
J.2 BROADER IMPACTS
The advancement of robust data attribution methods like DAS carries substantial ethical and practi- cal implications. By enabling a more transparent linkage between generated outputs and their corre- sponding training data, DAS enhances the accountabilityy of generative models. Such transparency is crucial in applications involving copyrighted or sensitive materials, where clear attribution supports intellectual property rights and promotes fairness. Nonetheless, the capability to trace back to the data origins also introduces potential privacy risks. It could allow for the identification and extrac- tion of information pertaining to specific training samples, thus raising concerns about the privacy of data contributors. This highlights the necessity for careful handling of data privacy and security in the deployment of attribution techniques. The development of DAS thus contributes positively to the responsible use and governance of generative models, aligning with ethical standards and fostering greater trust in Al technologies. Moving forward, it is imperative to continue exploring these ethical dimensions, particularly the balance between transparency and privacy. Ensuring that advancements in data attribution hand in hand with stringent privacy safeguards will be essential in maintaining the integrity and trustworthiness of AI systems.
28


Reviews:
[{"review_id": "EMSTvQOYFK", "reviewer": "Reviewer_bWtE", "summary": "(1) This paper examines the choice of the model output function in D-TRAK, demonstrates the theoretical shortcomings of D-TRAK's choice, and proposes using the predicted noise of a diffusion model as the output function (i.e., the output of the noise predictor). (2) With the proposed model output function, the leave-one-out attribution is approximated with Taylor expansion and Newton's method. (3) Additional tricks such as moving the expectation w.r.t the timestep inside the norm and using CLIP score to select candidate important data are proposed. Finally, the proposed method (i.e., DAS) achieves better linear datamodeling scores than existing attribution methods.", "questions": "- How does Equation (9) validate the effectiveness of Equation (10) in comparison to the ineffectiveness of Equation (7)?\n- Why do you think $\\lambda$ has such a big impact on the performance of DAS (shown in Figure 4)? How is $\\lambda$ tuned for CelebA and ArtBench?\n- In the proof for applying Newton's Method, it is assumed that $\\theta^*$ is a global optimum. Can you explain why this assumption is reasonable for diffusion models?\n- Since Newton's Method can be applied to approximate $\\theta^*_{\\setminus i}$, why can't we used the approximated $\\theta^*_{\\setminus i}$ in Equation (9)? This way we don't need to linearize $f_{\\text{DAS}}$.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- This paper addresses the gap left by Zheng et al. (2024) and demonstrates why the simple diffusion loss is not an appropriate model output function for TRAK-based methods (Equation 8).\n- The proposed, theoretically more principled method DAS actually leads to improved linear datamodeling scores.\n- This paper proposes to reduce the number of candidate training samples for computing data attribution scores, using CLIP score as the criterion. This approach can significantly improve computational efficiency and is shown to work fine (Table 7).\n\nReferences\n- Zheng et al. (2024) - Intriguing properties of data attribution on diffusion models.", "weaknesses": "- Although the paper shows that $L_{\\text{simple}}$ is not an appropriate model output function, it is not directly shown why $L_{\\text{Square}}$, as proposed in Zheng et al. (2024), is more appropriate. Specifically, Equations (9) and (10) are not exactly equivalent. In this sense, this paper does not fully explain the intriguing findings in Zheng et al. (2024). A more direct theoretical comparison between Equations (9) and (10) would make the contribution greater.\n\n- In lines 153-155 and Equation (7), the paper states that D-TRAK uses the simple loss $L_{\\text{simple}}$ as the output function. However, the main experimental results from Zheng et al. (2024) come from D-TRAK implemented with $L_{\\text{Square}}$ as the output. This mismatch in writing needs to be resolved.\n\n- Quantitative results are missing in the experiment where the top 1,000 positive influential samples are removed. Something like the counterfactual evaluation in Zheng et al. (2024) would suffice.\n\nReferences\n- Zheng et al. (2024) - Intriguing properties of data attribution on diffusion models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ywxR8QVNxd", "reviewer": "Reviewer_AfWj", "summary": "This paper introduces a novel metric called Diffusion Attribution Score (DAS) to more accurately quantify the attribution of training samples to generated images. While the paper is tackling an important problem of accurate data attribution for diffusion models, it has areas for improvement, such as justification of their proposed and more rigorous evaluation of the method as described below.", "questions": "- Could you please clarify the theoretical benefits of DAS over D-TRAK?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The paper addresses the important problem of attributing diffusion models’ output to training samples.\n- The metrics in quantitative evaluation look good, all showing significant gaps accounting for the confidence interval or standard deviation (though further clarity on these intervals would be helpful as they are not noted).", "weaknesses": "- The equations in Section 3.1 only show that DAS is independent of data distribution, unlike D-TRAK. However, it has not been shown how significant it is. While DAS seems to be working well in the experiment results, the theory behind it appears weak.\n- The evaluation solely relies on the LDS metric, which is based on the strong assumption of additive data contributions. There have been discussions on the effectiveness of LDS for evaluating data attribution algorithms, such as https://arxiv.org/abs/2409.18153 Adding other metrics or justifying its use looks necessary.\n- In Figure 1, diffusion model outputs from the same random seeds are presented. The rationale behind the comparison seems to be that the same random seed should lead to a similar output when models are trained on datasets of similar distribution. However, this may not be true since models are retrained, and they are essentially different ones. How can you ensure that two diffusion models trained on the same dataset generate the same output for a random seed when other randomness, such as batch sampling, is not controlled?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TXAvWeYwMq", "reviewer": "Reviewer_T3TW", "summary": "The authors introduce the Diffusion Attribution Score (DAS) to address limitations found in D-TRAK, a data attribution method for diffusion models. This is a timely and surprisingly under-explored task: While data attribution task (AKA data valuation), which strives to assess training samples' impact on trained model's predictions, has a long history - only recently methods for diffusion models emerged, motivated by the timely copyrights issues that such models present. The previous method D-TRAK approximates comparisons between prediction loss of diffusion models trained with and without specific training samples. However, the authors argue that the reliance on diffusion loss leads to indirect comparisons, and hypothesize that this indirect approach does not accurately capture the influence of training samples on model outputs. To overcome this, they propose DAS, which approximates a direct comparison. As demonstrated in thorough evaluations, this approach indeed provides more precise data attribution scores, when compared to D-TRAK and other baselines.", "questions": "Please refer to weaknesses", "limitations": "", "rating": 10, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The authors picked up on the counterintuitive finding of D-TRAK that switching loss functions in their method, to a loss that is not used during training, increases attribution correctness. Though D-TRAK proposed an explanation, I personally share the author’s belief that this finding calls for further exploration (in my view D-TRAK's explanation requires further substantiation in itself). \n\n2. The authors provide a significant observation: D-TRAK’s attribution scores, as expressed in Eq. (7), do not directly compare (approximate) predictions with/ without training samples. I agree with this found limitation.\n\n3. They propose to derive attribution formulas, that fall within the TRAK methodology, but starting from a direct comparison between the predictions (Eqs. 9). This original paradigm not only solves the newfound limitation, but also sheds light on the counterintuitive finding of D-TRAK: L_square does indeed differ from L_simple by providing a direct comparison of the predictions (Eq. 10).\n\n4. Sufficient performance experiments: The authors demonstrate that DAS indeed outperforms D-TRAK (and several other baselines) across four datasets, and in several settings. Evaluations are in terms of LDS - a widely accepted choice in evaluating TRAK-based methods. Ontop of being appropriate, it is also extensive as it requires multiple training.", "weaknesses": "1. The paper lacks a \"Previous Work\" section—a significant omission, as it currently mentions only one attribution method for diffusion models (D-TRAK) in the introduction. The authors appear to have overlooked other relevant approaches, such as [1], [2], and [3], which should be acknowledged, even if not necessarily included in direct comparisons. Acknowledging these methods is especially important, given that this domain is still underexplored, and the current structure of the paper will give researchers a misleading impression that only gradient-based methods are available. Additionally, key baselines like Journey TRAK, TracInCP and others are introduced in the evaluation tables without prior context - an earlier introduction would clarify their relevance.\n\n2. The mathematical claims lack direct verification through numerical experiments or even qualitative examples, and the improved performance alone is too indirect to serve as convincing validation  **[Edit: i.e. better LDS scores against competitors on standard benchmarks is not enough to substantiate the mathematical claims]**. With that said, given that it is common practice in ML to present mathematical derivations and substantiate them only via improved performance, this is not a critical flaw in terms of acceptance. However, it would significantly improve the impact if such experiments were added - here is a possible idea (other convincing experiments can work as well): Find cases where DAS succeeds and D-TRAK fails, and show that D-TRAK is indeed limited by its indirect comparisons (Sec. 3.1), where DAS solves this. \n\n[1] Wang et. al, ICCV 2023, “Evaluating Data Attribution for Text-to-Image Models”\n\n[2] Brokman et. al, ECCV 2024, “MONTRAGE: Monitoring Training for\nAttribution of Generative Diffusion Models”\n\n[3] Kwon et. al, ICLR 2024, “DataInf: Efficiently Estimating Data Influence in LoRA-tuned LLMs and Diffusion Models”", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PH10h2PjEf", "reviewer": "Reviewer_e8RA", "summary": "The paper introduces a new data attribution method called \"Diffusion Attribution Score (DAS)\" to quantify the influence of training samples in diffusion models, specifically addressing the challenges of data attribution in generative tasks. Experimental results demonstrate that DAS achieves state-of-the-art performance in LDS across various datasets and diffusion models, with strategies explored to accelerate DAS computation for large-scale models.", "questions": "Please refer to the Weakness", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Compared to previous work, the proposed DAS method shows significant improvements in experimental results.\n2. The article provides anonymized source code, demonstrating the reproducibility of the proposed approach.\n3. The data attribution problem in diffusion models studied in this paper is meaningful.", "weaknesses": "1. The author mentions \"these approaches measure the divergence between predicted and ground truth distributions, which leads to an indirect comparison between the predicted distributions and cannot represent the variances between model behaviors.\" and provides a brief explanation in Section 3.1. However, as an important argument of the paper, the vague explanation given in lines 178–180 is insufficient to convincingly illustrate the shortcomings of previous work.\n2. Similar to W1, lines 191–194 lack adequate support, whether theoretical justification, appropriate citations, or experimental evidence.\n3. The logical connection from Sections 3.2 to 3.3 is unclear. The motivation for each sub-module, the problems they aim to solve, and why the proposed methods were chosen are not explained. Additionally, the theoretical proof follows similar derivations as [1] without clearly explaining the motivation behind each step, making it difficult to follow the authors' reasoning.\n\n\n\n[1] Park, Sung Min, et al. \"TRAK: Attributing Model Behavior at Scale.\" *International Conference on Machine Learning*. PMLR, 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Spotlight)