Outlier Gradient Analysis: Efficiently Identifying Detrimental Training Samples for Deep Learning Models
Authors: Anshuman Chhabra
Bo Li
Jian Chen
Prasant Mohapatra
Hongfu Liu
Venue: ICML 2025 oral (2025)
Keywords: Data-centric learning
Detrimental sample detection
Primary area: deep_learning->everything_else

Abstract: A core data-centric learning challenge is the identification of training samples that are detrimental to model performance. Influence functions serve as a prominent tool for this task and offer a robust framework for assessing training data influence on model predictions. Despite their widespread use, their high computational cost associated with calculating the inverse of the Hessian matrix pose constraints, particularly when analyzing large-sized deep models. In this paper, we establish a bridge between identifying detrimental training samples via influence functions and outlier gradient detection. This transformation not only presents a straightforward and Hessian-free formulation but also provides insights into the role of the gradient in sample impact. Through systematic empirical evaluations, we first validate the hypothesis of our proposed outlier gradient analysis approach on synthetic datasets. We then demonstrate its effectiveness in detecting mislabeled samples in vision models and selecting data samples for improving performance of natural language processing transformer models. We also extend its use to influential sample identification for fine-tuning Large Language Models.

Outlier Gradient Analysis:
Efficiently Identifying Detrimental Training Samples for Deep Learning Models
Anshuman Chhabra
Bo Li
Jian Chen Prasant Mohapatra' Hongfu Liu
Abstract
or other processing for improving utility (Zha et al., 2023), Data-centric learning holds significant potential in many areas such as model interpretation, subset training set selec- tion, data generation, noisy label detection, active learning, and others (Chhabra et al., 2024; Kwon et al., 2024).
A core data-centric learning challenge is the iden- tification of training samples that are detrimental to model performance. Influence functions serve as a prominent tool for this task and offer robust framework for assessing training data influence model predictions. Despite their widespread use, their high computational cost associated with calculating the inverse of the Hessian matrix pose constraints, particularly when analyzing large- sized deep models. In this paper, we establish a bridge between identifying detrimental train- ing samples via influence functions and outlier gradient detection. This transformation not only presents straightforward and Hessian-free for- mulation but also provides insights into the role of the gradient in sample impact. Through sys- tematic empirical evaluations, we first validate the hypothesis of our proposed outlier gradient analysis approach on synthetic datasets. We then demonstrate its effectiveness in detecting misla- beled samples in vision models and selecting data samples for improving performance of natural lan- guage processing transformer models. We also extend its use to influential sample identification for fine-tuning Large Language Models.
The essence of data-centric learning lies in estimating data influence, also known data valuation in the context of learning task (Hammoudeh & Lowd, 2022). Intuitively, the impact of an individual data sample can be measured by assessing the change in learning utility when training with and without that specific sample. This leave-one-out influence (Cook & Weisberg, 1982) provides a rough gauge of the relative data influence of the specific sample on the otherwise full fixed training set. Shapley value (Ghorbani & Zou, 2019; Jia et al., 2019), originating from cooperative game theory, quantifies the increase in value when group of samples collaborates to achieve the learning goal. Unlike leave-one-out influence, Shapley value represents the weighted average utility change resulting from adding the sample different training subsets. Despite the absence of assumptions on the learning model, the aforementioned eetraining-based retraining- based methods incur significant computational costs, especially for large-scale data analysis and deep models (Schioppa et al., 2022).
A popular choice for data valuation applications, such as identifying training samples detrimental to model perfor- mance, are influence functions (Koh & Liang, 2017). Es- sentially, influence functions assess data influence without requiring model retraining. They measure the effect of changing an infinitesimal weight of training samples based on a utility-evaluating function. While influence functions can be accurate or acceptable proxies for convex and cer- tain shallow models, their applicability to deep models constrained by the strong convexity assumption and the computational cost linked to calculating the inverse of the Hessian matrix (Basu al., 2020a).
1. Introduction
Data-centric learning focuses on enhancing algorithmic performance from the perspective of the training data (Oala et al., 2023). contrast to model-centric learning, which designs novel algorithms or optimization techniques for per- formance improvement with fixed training data, data-centric learning operates with fixed learning algorithm while modifying the training data through trimming, augmenting,
Our Contributions, In this paper, we delve into the classi- cal data-centric problem: identifyin//rimming detrimental samples. We tackle the computational challenge of the inverse of the Hessian matrix in influence functions the context of detrimental sample identification and removal. Our major contributions are as follows:
Uniieessity of South Florida, Tampa, FL, USA "Tsinghua University Brandeis University, Waltham, MA, USA. Correspon- dence to: Hongfu Liu <hongfuliu@ @ brandcis.edu>.
Proceedings of the 4nnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Outlier Gradient Analysis
We build bridge between identifying detrimental train- ing samples via influence functions and outlier detec- tion on the gradient space of samples, and propose our outlier gradient analysis approach. The transformation features a straightforward and Hessian-free formula- tion, and reduces the computational cost associated with the Hessian matrix and its inverse.
Zhang, 2020; Chhabra et al., 2024; Richardson et al., 2023), they tend to be too computationally expensive for large models, and cannot run in reasonable time. More recently, efficient influence estimation methods such as DataInf (Kwon et al., 2024), Amoldi iteration (Schioppa et al., 2022), and Kronecker-factored approximation curvature (Grosse et al., 2023) have been proposed which can be em- ployed for large models. Some approaches simply consider the gradients directly 2020; Charpiat et al., 2019). followed by some ensemble strategies (Bae et al., 2024; Kim et al., 2024). Recent work has also investigated the role of the Hessian and convexity in influence estimation (Schioppa et al., 2024). In contrast, our work aims to circumvent these issues for detrimental sample identification by operating on the gradient space in a skillful manner. Hence, our work paves the way for an efficient and accurate detrimental sample identification framework and adds to the "influence function toolset" for deep models and large datasets, Finally, recent work has also found that self-inffuence (influence computed on training samples) can be beneficial in detecting detrimental samples (Bejan et al., 2023; Thakkar et al., 2023). For related works on miscel- laneous data-centric learning, please refer Appendix A.
Empirically, we utilize both linear and non-linear syn- thetic datasets to illustrate the ineffectiveness of the cur- rent Hessian approximation and to validate our hypoth- esis regarding outlier gradient analysis, showcasing our method's high accuracy in identifying mislabeled detrimental samples.
measure of influence (Pruthi et al.,
Subsequently, we demonstrate the effectiveness of out- lier gradient analysis in trimming mislabeled samples from vision datasets across various noise regimes. Ad- ditionally, we explore textual applications on data se- lection for fine-tuning deep transformer models and identifying influential data for text generation tasks using fine-tuned Large Language Models.
2. Related Work
3. Proposed Approach
Retraining- Based Influence Estimation. Influence esti- mation approaches can be generally categorized as either retraining- based or gradient-basee -baseddt-baeddddeee (Hammoudeh & Lowd, methods consist of the classical
We first introduce influence functions conceptually and outline how they are applied to the task of detrimental samples identification. We then detail our transformation by converting the original formulation into a gradient space outlier analysis problem. Subsequently, we provide insights for extending influence functions to non-convex learning models and propose our outlier gradient analysis approach.
2022). Retraining-basse leave-one-out influence approach (Cook& & Weisberg, 1982), which consists of removing one training sample at a time, and retraining the model to measure sample influence via performance change. Other representative methods include Shapley value approaches (Ghorbani & Zou, 2019; Jia et al., 2019; Kwon & Zou, 2022), which are model agnostic, but also computationally untenable for large datasets and deep models due to exponential time complexity. Computation- ally efficient approaches such as KNN-Shap (Jia et al., 2018) can only employ KNN classifiers and hence are not directly applicable to the deep models. Gradient-Basse Influence Estimation. For models trained using gradient descent, gradient-based influence approaches can be used to approximately estimate influence without requiring retraining. The seminal work in this category is that of (Koh & Liang, 2017), which utilizes a Taylor-series approximation and LiSSA optimization (Agarwal et al., 2017) to compute sample influences. However, the limiting underlying assumption in the formulation is that the model and loss function convex, which is not true for deep models. Follow-up works such as representer point (Yeh et al., 2018) and Hydra (Chen et al., 2021) inherit these convexity assumptions and suffer from similar issues of applicability. While influence functions have been used for numerous applications in data-centric learning (Feldman &
3.1. Preliminaries on Influence Functions
Let T==2=]= be a training set, where z; = 31) in- cludes the input space feature and output space la- bel y/.. A classifier trained using empirical risk min- imization on the empirical loss E can be written as: -=arg milgaee 4 >. E(z;; 0). Influence functions (Cook & Weisberg, 1982; Hampel. 1974: Martin & Yohai, 1986) measure the effect of changing an infinitesimal weight of training samples, based on function that evaluates model utility. Downweighting a training sample zj by a very small fraction e leads model parameter: 0(zy; arg mingge n (Ei ((2;; 8) c))(((;; 0)). By evaluating the limit as approaches 1, the seminal work of Koh & Liang (2017) provides an estimation for the influence score associated with the removal of zj from the training set in terms of training/validatinn loss as follows:
I(z;)) = Σ Vol(2; H H Vol(z;;0) (1)
2ET/V
2

---

Outlier Gradient Analysis
where T/V denotes the training/validation set, Vgg(zz; 0) is the gradient of the loss with respect to network parameters, and H. - T2 V (( (z;; 0) denotes the Hessian matrix.
in the gradient space. Upon scrutinizing the influence esti- mation of 2j in Eq. (1), it becomes evident that the influence score is the result of three terms, with the first two remaining the same across all training samples and not solely depen- dent on 2j- While all three terms contribute to the concrete value of the influence score, it is the final term V Vz((zz; 0) that assumes decisive role in determining whether zj is beneficial or detrimental sample. This is because the third term has 2j as the only training sample as an input. With the following observation below regarding detrimental samples, we can build the connection between identifying detrimental samples via influence estimation and outlier analysis:
One key application of influence functions lies in identify- ing detrimental samples. This is because an intuitive way of assessing whether a sample is detrimental is by training the model both with and without the specific training sam- loss. In
ple and computing metrics like training/validaan other words, if the performance improves when excluding particular sample, it is deemed detrimental to the learning task. By computing the influence score without needing to retrain the model, one can estimate the impact of sample to assess it is beneficial or detrimental, as follows:
Observation 3.1. For a converged model trained using empirical risk minimization, the majority of training sam- ples positively contribute to the model's utiliiyy and a much smaller subset than beneficial samples (with respect to the overall size of the training set) exhibits detrimental effects.
f(2)) = {1 (Beneficial Sample)
0 (Detrimental Sample) I(zy) << 0.
I(z,) 2 O.
[(z)) can be regarded as the discrete version of I(z;)- Specifically, a value of 0 for I(zz) means that removing the sample 2j enhances the model's 's utility, and that 2, is a detrimental sample.
Clearly, Observation 3.1 holds true as the empirical loss is an average of error between predictive and true values over all training samples. Hence, detrimental samples can be regarded as minority outlier set compared to the beneficial sample majority. Based on Observation 3.1 and the deci- sive role of Vz((z;;0) in influence estimation, we have the following hypothesis:
Remark. While influence functions offer swift estimation for identifying detrimental training samples without the need for costly model retraining, their practical applications to large models are constrained by two prominent drawbacks. The first limitation lies in the necessity of strictly convex loss function to guarantee the existence of the inverse of the Hessian matrix. The second challenge pertains to the considerable computational expense associated with calculating the inverse of the Hessian. For the first challenge, several possible solutions have been proposed: (1) a convex surrogate model can be used instead of the non-convex model (Chhabra et al., 2024); (2) a damping term can be added to the Hessian to ensure it is positive definite and invertible (Han et al., 2020); and (3) alternative formulations (Basu et al., 2020b; Alaa & Van Der Schaar, 2020) can be used (e.g. the Gauss Newton Hessian (Grosse et al., 2023) instead of the standard Hessian). Note that some studies bypass the convexity assumption and directly apply influence functions to deep models, yielding effective results. (Grosse et al., 2023). For the second challenge, various matrix inverse techniques are employed expedite the computation process, including LiSSA optimization (Koh & Liang, 2017) and swapping the order of the matrix inversion (K (Kwon& et al., 2024), among several others. Considerable efforts have been dedicated to addressing the aforementioned challenges with promising results- however, in this paper we target the second challenge for identifying/removing detrimental samples.
Hypothesis 3.2. There exist outlier analysis algorithms ca- pable of detecting detrimental samples in the gradient space. This algorithm would enable us to evaluate whether a train- ing sample positively or negatively impacts model utility through influence estimation, effectively equating this evalu- ation with the application of the outlier analysis algorithm in the gradient space.
Hypothesis 3.2 establishes a conceptual transformation be- tween the identification of detrimental training samples via influence estimation and the detection of outliers in the gra- dient space. The outlying nature of detrimental samples has also been observed in past work (Kim et al., 2024), This transformation not only features a straightforward and Hessian-free free formulation, reducing the computational cost associated with the Hessian matrix and its inverse, but also yields insights into the role of the gradient in sample impact beyond model optimization.
3.3. Our Approach: Outlier Gradient Analysis
As demonstrated in Hypothesis 3.2, outlier analysis can effectively be used to evaluate the discrete influence of training samples. Notably, we can circumvent the need for computing and inverting the Hessian for non-convex deep models by measuring discrete influence via Eq. (2). The primary contribution and discovery of our work lies in the realization that simple and efficient outlier analysis techniques can be applied to the gradient space for a discrete estimation of which samples are beneficial or
3.2. Bridging Influence Estimation and Outlier Analysis
We transform the problem of identifying detrimental sam- ples via influence estimation to an outlier analysis problem
3

---

Outlier Gradient Analysis
Table I. Outlier detection and classification performance of noisy label correction and influence based approaches including our proposed outlier gradient trimming on the two half moons dataset (top performer in bold).
Algorithm 1: Outlier Gradient Analysis and Trimming
1: Input:
Training set T, loss function l, model parameter 0, outlier analysis algorithm A, trimming budget k
2: Output: Set L containing beneficial/derrimental sample
Outlier Detection Accuracy (%)
Classificution Post-Trimming (%)
Method
labels, Trimmed training set T
3: initialize G + 0 < 0.
Multilayer Perceptron
90.0
4: g GU (Vgl(z, ye: }) ((z, E T.
Normalized Margin
82.0
89.0
5: I A(G, k).
Self-Confidence Confidence Entropy
82.0
89.0
82.0
89.0
6: T 4 T J [ Lg is not outlier.
Exact Hessian
90.0
90.0
7: return L,T"
Gradient Tracing
82.0
91.0
LISSA
82.0
91.0
Datalif
82.0
91.0
detrimental to the model's utility.
Self-LiSSA
82.0
90.0
Self-Datalnf
90.0
87.0
As Hypothesis 3.2 cannot prescribe specific outlier detection algorithm, one of our choices for outlier analysis is the Isolation Forest (iForest) algorithm (Liu et al., 2008), owing to several factors. Firstly, iForest boasts a linear time complexity with a low constant, requiring minimal memory, rendering it well-suited for handling the nigh-dimensional gradient space inherent in deep models. Secondly, iForest constructs an ensemble of iTrees, where each iTree builds partial models and employs sub-sampling, demonstrating the ability to identify suitable subspace for the detection of detrimental samples. Thirdly, iForest is known for its simplicity and effectiveness in identifying outliers that are non-linearlyy separated from inliers. Along with iForest, we also consider two simple outlier analysis approaches based on L1-norm and L2-norm thresholding, that work well in practice (Knorr et al., 2000).
Outlier Gradient (iForest)
96.0
96.0
Outlier Gradient (L.1)
98.0
87.0
Outlier Gradient (L.2)
98.0
87.0
respectively. Notably, the training set includes 10 manually generated noisy samples with misspecified labels. Subfigure C displays the influence score of each training sample, computed using Eq. (1), and subfigure D provides a visu- alization of the gradient space. Similarly, subfigures E and F represent the training and test sets of the two half moons dataset, with the training set consisting of 250 samples and the test set of 100 samples, equally distributed between two classes. The training set in this case also contains 20 noisy samples. Subfigures G and H showcase the influence score and gradient space of the non-convex case.
In the linear case, as illustrated in subfigure C, the influence score proves to be a reliable indicator for distinguishing detrimental samples from beneficial ones. Notably, detri- mental samples exhibit large negative scores, while other samples display positive or nearly zero values. Additionally, subfigure D affirms that these detrimental samples are distinctly separated in the gradient space, confirming the validity of the equivalent transformation outlined in Hypothesis 3.2. However, the limitations of influence scores become evident in the context of non-convex models, as observed in subfigure G, where the influence scores of detrimental samples are mixed with those of normal ones. Nevertheless, in the gradient space illustrated in subfigure H. the detrimental samples are effectively isolated from inliers. Notably, our method does not rely on the Hessian for computing influence and operates directly on the gradient space using outlier analysis.
Upon obtaining outlyingness labels through the application of an outlier detection algorithm to the gradient space, de- noted as the set I., we can assess the influence of training samples on model performance. Subsequently, we then trim k (the designated deletion budget) detrimental training sam- ples. Retraining the model on this pruned sample set leads to potential performance improvements. The approach is outlined in Algorithm 1.
4. Hypothesis Verification on Synthetic Data
We seek to validate the hypothesis of our proposed idea and showcase the effectiveness of our outlier gradient analysis method on two synthetic 2D toy datasets and two models for binary classification in Figure 1. In this figure, subfigures A-D present a linear dataset employing a Logistic Regression model, while subfigures E-H exhibit a non-linear dataset utilizing a non-convex Multilayer Perceptron (MLP) model as the base model. Specifically, subfigures A and B depict the training and test sets of linearly separable dataset comprising 150 and 100 samples,
We also conduct quantitative evaluation assess the advantages of our approach compared to three recently proposed noisy label correction methods and six influence function-basee approaches, as detailed in Table 1. Specif- ically, we measure ground-truth outlier predictive accuracy and the performance gain achieved by removing detrimental samples. For noisy label correction approaches we consider:
'Comprehensive details regarding datasets and model training for experiments are provided in Appendix B.
4

---

Outlier Gradient Analysis
Inflvence Score
0.0
Gradient (Featture
2.0
Feoture 2
1.
Feature
-0.5-
1.0
88
0.-
2
50
75
100
125
150
-2.0
-15
-1.0
-0.5
00
05
Feature
Feature
Sample Index
Gradient (Feature 1)
0.01
Gradient (Feature 21
1.0
1.-
Influence Score
8.
Feature 2
Feeture
0.00
0.0
-0.5
-0.5-
-0.01
8
H
120
150
200
250
0.5
1.0
1.5
2.0
Feature
Feature
Sample
Gradient (Feature 1)
Class
Class 1
Predicted Non outlier
Predicted Outlier
Regular Sample
X
Naisy Sample
Figure 1. Illustrating our outlier gradient analysis approach on two synthetic datasets and convex/non-conve models. A-D showcase our outlier gradient analysis approach on a 2D linearly separable synthetic dataset. This dataset includes a small subset of detrimental samples with incorrect labels used to train a Logistic Regression binary classification model. Meanwhile, E-H depict outlier gradient analysis on non-linear synthetic dataset with mislabeled samples employed in training a Multilayer Perceptron (MLP) neural network. In subfigures A and E, the training are represented with class labels 0 (red) and (blue) in the convex and non-convex cases, respectively. Detrimental samples with incorrect class labels are marked with x, while regular samples are marked with o. B and F denote the test sets used to evaluate model performance. C and G display the influence scores calculated by Eq. (1). Note that G demonstrates that influence scores are not reliable indicators for detecting detrimental samples in the non-convex case. After applying outlier analysis on the gradient space of the non-convex MLP model, most detrimental samples are detected. and H showcase the gradient space obtained for each sample from the Logistic Regression and MLP models, respectively. It is evident that the outlier samples correspond to detrimental samples with mislabeled classes, which are linearly or non-linearly separated from inliers. Note that the benefits of outlier gradient trimming can be clearly
predicted outlier samples via iforest and retraining the MLP enhances classification performance from 90%- + 96% on the test set (refer to Table I).
Normalized Margin (Northcutt et al., 2021), Ceff-Confidence En-
5. Noisy Label Correction for Vision Datasets
(Müller & Markert, 2019), and Confidence-Weigee tropy (Kuan & Mueller, 2022). The influence function approaches include computing the Hessian exactly (Cook & Weisberg, 1982), using the Hessian-frue gradient tracing approach by (Pruthi et al., 2020), LiSSA-based optimization (Koh & Liang, 2017), the recently proposed influence esti- mation approach Datalnf (Kwon et al., 2024), self- reff-influence using LiSSA as in Bejan et al. (2023), and self-influence us- ing Datalnf. We compute influences only using the training samples and performance is measured on the test set.
We now demonstrate the effectiveness of our approach in addressing noisy label correction using the CIFAR-ION and CIFAR-IOON real-world noisy label datasets (Wei al., 2022). These datasets stem from the original CIFAR- 10 and CIFAR-100 datasets (Krizhevsky et al., 2009), but introduce label inaccuracies due to crowdsourced labeling. CIFAR- 1ON has 3 different noise settings: Aggregate, Random, and Worst- these correspond to using majority voting across annotators, first annotator label, and worst annotator label, respectively. CIFAR- only has noise setting.
Our outlier gradient analysis approaches demonstrate high accuracy in identifying mislabeled outliers (96-98%), out- performing all three noisy label correction baselines (only 82% accuracy) and among influence baselines, all exhibit similar performance except for exact Hessian computation, which attains 90% accuracy. Next, we evaluate model performance gain by removing detected outlier samples and retraining the MLP on the trimmed dataset. Here the benefits of our iForest outlier gradient analysis can be observed, as it increases performance from 90% 96% while the overtly simple L1/L.2-norm outlier analysis approaches effective. The other baselines attain performance between 89-91%. This emphasizes the effectiveness of our iForest approach, while exhibiting low time complexity (refer to Appendix C.3 for details on computational complexity).
Table 2 shows the accuracy performance of outlier gradient analysis (L 1L..-.2noomm iForest) compared to label correction approaches and influence-based haselines covered the pre- vious section. Exact Hessian computation is excluded due to its computational intractability for large datasets. Our out- lier gradient analysis methods consistently outperform other baselines across diverse noise settings and datasets. Notably, even in challenging scenarios like the Worst noise setting in CIFAR- 1ON (40.21% % noise rate), our approaches are the top performers- L1-norm based outlier analysis achieves high- est accuracy gain, improving from 82.27% (vanilla ResNet- 34) to 84.20%. Similar superior performance is observed in the Random noise setting (17.23% noise rate), where L2- norm outlier analysis achieves final accuracy of 90.25% compared to original cross-entropy accuracy of 89. 17% and
5

---

Outlier Gradient Analysis
showing similar trends. Finally, approaches for noisy learn- ing can be categorized into methods that either change the loss function model architecture or methods that iden- tify noisy samples and remove/relabel them for improving performance (Algan & Ulusoy, 2021). Since our approach belongs to the latter category, we only compare against other approaches from this category. For completeness, we also present results comparing our approach with some others in the former category in Appendix C.7. We would like to emphasize that this is not an exhaustive list of baselines and noisy learning by adjusting the loss/model is not the focus of our work (but detecting detrimental samples is). Moreover, our algorithm could also be combined with approaches from both categories for additional gains. Finally, we also con- ducted experiments using two new influence function meth- ods: TRAK (Park al., 2023) and GEX (Kim et al., 2024). While we were able to obtain results for CIFAR-ION (please refer to Appendix C.8 for results), both methods got out-of- memory errors on CIFAR- R for the same experimental set-up as other influence methods. Given their shortcomings, we did not consider them for the other experiments.
Table 2. Accuracy (5 runs) on CIFAR- RON and CIFAR-10ON for R4 model trained via cross entropy and performance post trimming using noisy label correction approaches and influence- based methods, including our outlier gradient analysis (top-2 per- formers in bold).
CIFAR-ION
CIFAR-IOON
Method
Aggregate
Random
Worst
Noisy000
Cruss Entropy
90.87
89.17
82.27
57.36
Normalized Margin
91.33
90.06
83.57
60,94
Self Confidence
91.38
90.09
83,65
60.51
Confidence Entropy
91.11
90.05
83.63
60.62
Gradient Tracing
91,47
89.98
83,38
60.73
LISSA
91.49
90.05
83,38
60.48
Datalaf
91.46
90.05
83,40
60.70
Self-LiSSA
92.07
89.58
59.48
Self-DataInf
91.41
89.81
83.15
60.56
Outlier Gradient (L1)
91.86
90.66
84,20
60,32
Outlier Gradient (1.2)
92.21
90.25
82,99
61.40
Outlier Gradient (iForest)
91.36
90.20
83.72
60.99
CAT DOG
CAT FROG
CAT TRUCK
DOG AIRPLANE
SHIP
6. Data Selection for Fine-tuning NLP Models
We conduct experiments on data selection for fine-tuning on NLP models, following the experimental setup by Kwon et al. (2024) for DataInf, where the RoBERTa transformer model (Liu et al., 2019) is fine-tuned on four binary GLUE datasets ( (Wang et al., 2018): QNLJ, SS72, QQP, and MRPC. To assess if influence-based methods can enhance NLP model performance via Low Rank Adaptation (LoRA) (Hu et al., 2022) fine-tuning, Kwon et al. (2024) introduce noisy versions of all four datasets by flipping the binary label for 20% randomly chosen training data samples. The goal of the data selection task is to select the best representative subset of the training data so that performance is maximized on an unseen test set. Specifically, 70% of the most beneficial samples are selected according to each influence computation approach, and the model is fine-tuned for 10 epochs and rank of LoRA matrix is set to 4. Then, as the model trains over each epoch, performance is measured on the unseen test set. Clearly, for fairness, the sample influence is computed only using the training set, and the test set remains unknown until inference.
LEOPARD
CASTLE CLOCK
HOUSE TREE
MOTORBIKE TULIP
CAR FOX
KANGAROO
Figure 2. Detrimental samples detected using our outlier gradient analysis. Top row: CIFAR-ION bottom row: CIFAR-JOON. Top label (red): noisy label; bottom label (green): correct class.
in CIFAR-1OON, where it attains the highest performance of 61. 11.40% surpassing the cross-entropy performance of 57.36%. In the CIFAR-ION Aggregate noise setting (noise rate 9.03%), outlier gradient analysis is again the top per- former. Due to space constraints, we omit standard devia- tions from Table 2, but these are provided in Appendix C.I.
Additionally, visual examples of mislabeled samples detected by our outlier gradient analysis approach (iForest) are provided in Figure 2. All displayed images contain mislabeled samples, and their removal from the training set contributes to improved model performance on the test set. In Table 2, we set the trimming budget for outlier gradient analysis (k) at 5% of the training data size. An empirical analysis for the choice of k is undertaken in Appendix C.2, where we vary the outlier budget (from 2.5% to 12.5%) and measure test set accuracy across the CIFAR-ION dataset.
The results over three runs are presented in Figure 3 for all four GLUE datasets. We only show trends for iForest based outlier gradient analysis to aid visualization since per- formance is similar for the L1/L2--norm methods. It can be seen that our outlier gradient trimming approach markedly outperforms all other baselines- more specifically, outlier gradient analysis achieves the best test set results on QNLI, SST2, QQP, and on MRPC, Self- (Bejan et al., 2023) and outlier gradient analysis are on par with each other. Despite this competitive performance, our outlier gradient
Additional Analyses. We conduct ablations on the iForest parameters in Appendix C.4. Further, we provide running time experiments on CIFAR- 10N and CIFAR- CIFAR-IOON in Ap- pendix C.3 along with the other baselines. We also provide results with ResNet-18 18 as the base model in Appendix C.5 and on ImageNet (Deng et al., 2009) in Appendix C.6,
6

---

Outlier Gradient Analysis
ONL
S572
QQP
MRRC
0.9-
0.8
0.5-
0.6
Accuracy
0.8-
Accuracy
Accuracy
Accuracy
0.6
0.7
0.5
0.8-
0.8
2.4
0.5
2
10
10
6
10
6
10
Epoch
Epoch
Epoch
Epoch
Tracing
USSA
Datainf
Self-USSA
Self-Datainff
Outlier Gradient Trimming
Figure 3. Performance of the data selection task using outlier gradient trimming and other influence baselines for fine-tuning RoBERTa.
Sentence Transformations
Math Without Reasoning
Math With Reasoning
Beneficial
Beneficial
Beneficial
Class
Class
Detrimental
5-
Detrimental
Detrimental
7-
10 20 30 40 50 60 70 80 90
0 10 20 30
40
50
60 70 80 90
0 10 20 30 40 50 60 70 80 90
Test Sample Index
Sample
Test Sample Index
Prompt:
Prompt:
Perform specticc transformation on sentences: Double Every Consonent. For example: Feathers floot dieams,
Solve the following math prozlem. John invests $63 at en ennual interest rete How
Solve the following math problem. If Jake seves $28 eech week, how much will he after
Reeson Total savings 28"52. Answer: 1456.
FFoatthhrrss Miloot onn ddrreammss.
43 years. Answer:..
1820.
Influential Training Sample:
Most Influential Training Sample: Solve the following math problem. If Jake saves $44 each waek, how much will he seve sowings 39, Answer: 1718.
Perform specific transfomation
Most Influential Training Semple: Solve the fallowing math prozlam, John invests $27 at ennual interest 96%, How much interest will he efter 34 years? - Answen 88t
sentences: Double Every Consonant. For example: Whispering winds call night wwhttsspoeriinggg wwirnddss ccoll!'
Reasor:
niighttt
Figure 4. Results for outlier gradient analysis on LLM influential data identification benchmarks.
analysis is orders of magnitude faster than Self-LiSS. as shown in experiments of Appendix C.3. This highlights the effectiveness of our proposed outlier gradient analysis approach in selecting relevant data for fine-tuning NLP models while being more computationally efficient.
tence Transformations, Math Without Reasoning, and Math With Reasoning, conduct the influential data identifica- tion experiment on the Llama-2-13B-ae et al., 2023). For each of the influence identification bench- mark datasets, there are 900 training samples for LoRA fine-tuning, and 10 categories or classes of task types with 90 samples belonging to each class. For each dataset there are 100 test set prompts with 10 test set prompts per class category.
LLM (Touvron
7. Extending to Influential Data Identification for LLMs
We now consider an alternate task- demonstrating the effec- tiveness of our proposed outlier gradient analysis in iden- tifying influential data samples for Large Language Mod- els (LLMs), using the proposed benchmarks from DataInf (Kwon al., 2024). The LLM influential data identifica- tion task at its core is similarity measurement task, it seeks to ascertain which fine-tuning prompts are most similar to a given test sample (Askari et al., 2025). More specifically, the goal is to assess what training set prompts (used for LoRA fine-tuning) are most influential for given unseen test prompt. The robustness and effectiveness of influence estimation are gauged based on whether the iden- tified training set prompts belong the same class category as the given test prompt. We utilize the three benchmark datasets introduced in Datalnf (Kwon& et al., 2024): Sen-
In (Kwon al., 2024), to predict the most influential train- ing samples given test set prompt, the authors assign pscudo label to every data point in the training set (1 if is in the same class/task category as the test data prompt, or oth- erwise). This set serves as ground-truth for measuring per- formance of identifying influential data samples. Next, they calculate the Area Under the Curve (AUC) by comparing the absolute values of the influence function (for each training set prompt corresponding to a given test prompt) with these pseudo labels. Clearly, a high AUC signifies that training data samples from the same category have a significant influ- ence on the given test prompt. The average AUC across all test data points is then recorded, and is denoted as the Class Detection (AUC) metric. Additionally, another metric is used- for every test data prompt, the authors determine if the

---

Outlier Gradient Analysis
Table 3. AUC/Recall for outlier gradient analysis and baselines for influential class detection for three tasks on Llama2- 13B LLM.
training samples. We also conduct experiments to validate this empirically. In Table 6 (Appendix C.3), we benchmark the running time for all the methods considered for the vari- ous noise settings of CIFAR-ION and CIFAR-IOON. It can be observed that outlier gradient analysis features in the top- performing methods in terms of computational efficiency, while simultaneously also featuring as a top-performing method for accurately detecting detrimental samples (as seen in Table 2). We observe similar trends for the Ima- geNet dataset in Table 10 (Appendix C.6). Note that this is also evident in terms of worst-case computational com- plexity, as outlier gradient analysis possesses linear (in both number of samples and parameters) time complexity (see Table in Appendix C.3 for more details).
Class Detection
Class Desoction
Task
Method
(AUC)
(Recal))
Gradient Tracing
0.999 0.001
0.982 = 0.032
Sentence
Transformations
DataInf
1.000 = 0.000
0.996 = 0.012
Outlier Gradient
0.000
1,000 a 0.000
Math Problems
Grudient Tracing
0.724 0.192
0.241 = 0.385
Datalaf
0.999 = 0.005
0.993 = 0.046
Without Reasoning
Outlier Gradient
1.000 = 0.000
1.000 = 0.000
Gradicut Tracing
0.722 0.192
0.226 0.376
Math Problems
With Reasoning
DataTnf
0.999 0.004
0.990 = 0.049
Outlier Grudient
1.000 = 0.000
1.000 = 0.000
proportion of training data prompts belonging the same class/category are within the top 90 (# of training prompts in each category) influential samples. The average % across all test data points is calculated and this metric is denoted as Class Detection (Recall), where higher recall is better.
Adapting outlier gradient analysis to validation/test set distribution. In some scenarios we might wish to utilize validation set distribution to accurately adjust influence estimation. This is especially true for distribution shift sce- narios, where the training and validation distributions are different. In the original influence formulation, the first term provides this information. For outlier gradient analysis, we only use training set gradients. To rectify this, we can instead employ semi-supervised outlier analysis algorithm A with validation samples provided inliers. We utilize the semi-supervised OneClassSVM (Li et al., 2003) outlier analysis algorithm and the distribution shift experimental framework from Chhabra et al. (2024) to assess performance. These results indicate that outlier gradient analysis is the top- nop-performer across baselines, as can be seen in Table 13 (Appendix C.9). While a full extensive analysis of valida- tion set adaptation is beyond the scope of this paper, these preliminary experiments showcase the benefits of outlier gradient analysis beyond just the training distribution.
As part of this task, we need to measure similarity between train and test set samples. Note that for our experiments on identifying detrimental samples outlier gradient analysis only operated on the training set (i.e., it uses the training set gradients). However, to extend outlier analysis to this task while maintaining consistency with the previous ex- periments and methods, we will train 10 individual iForest estimators for each class prompt category, as the ultimate objective is to use outlier gradient analysis for prompt class detection. Each class's 's iForest estimator is trained solely on the gradient space of training prompts from that cate- gory. Subsequently, for each test set prompt, we utilize each iForest estimator to generate an outlier score based on the gradient space of that test sample, enabling us to conduct the influential data identification experiment. Note that the other baseline influence methods already have access to the given test set sample and can use that information directly for analyzing which training sample is most influential.
Our outlier gradient analysis performs exceptionally well on this task, achieving perfect scores for both AUC and Recall in Table 3. It outperforms DataInf and Gradient Tracing, with LiSSA omitted as it fails to converge due to instability on LLMs (Kwon et al., 2024). Self-influence baselines also cannot be used since similarity matrix with the full set of test prompts needs to be constructed (information leakage). Figure 4 further illustrates the individual influence predictions, with darker colors indicating lower outlier score magnitudes. The heatmaps correspond to three benchmark datasets, with test samples ordered sequentially based on their categories. The accurate influence estimation is evident from the highest influence values along the diagonal. The most influential sample identified by our approach closely resembles the given test prompts.
9. Conclusion
We focused on the key data-centric learning task of iden- tifying detrimental training samples. Influence functions are a leading approach often used for this problem, but pos- sess certain deficiencies when applied to deep models, such as the computational demands for inverting the Hessian matrix. We propose a novel solution for detrimental sam- ple detection that does not rely on the Hessian matrix, and hence eliminates this major limitation. Our approach, outlier gradient analysis, is based on a conceptual transformation between the influence function formulation and outlier anal- ysis in the gradient space. This transformation results in a computationally efficient method that possesses high de- tection accuracy. Through comprehensive experiments on synthetic datasets and various application domains (code details in Appendix D), including noisy label correction for vision models, data selection for NLP models, and even in- fluential data identification in LLMs, we demonstrated that
8. Diseussion
Computational complexity and running time. Through- out, we have emphasized that outlier gradient analysis is effi- cient while being highly accurate at identifying detrimental
8

---

Outlier Gradient Analysis
our method outperformed many existing influence-based approaches and baselines in deep learning scenarios.
References
Agarwal, N., Bullins, B., and Hazan, E. Second-order stochastic optimization for machine learning in linear time. The Journal of Machine Learning Research, 2017.
Impact Statement
Our work and proposed techniques aim to address the data- centric task of identifying detrimental samples. We im- prove upon the influence function analysis framework that is used to undertake this problem, but possesses deficiencies when applied to deep learning models. Enabling influence estimation for deep models allows practitioners to assess whether training samples are beneficial or detrimental to performance, and can make models more interpretable and performant. As we show through extensive experiments on multiple problem settings, our proposed outlier gradi- ent analysis approach outperforms existing baselines and can augment model performance by identffyin/trimming detrimental samples in computationally efficient manner. As result, our work paves the way for significant positive societal impact, especially with the increased adoption of larger and deeper neural networks such as LLMs. However, as with any work, there are limitations to our approaches that can be overcome in future work. For instance, it might be possible to derive specific outlier analysis algorithms that are computationally more efficient than iForest norm thresholding, and significantly more performant. Another limitation that can be overcome is the further study and benchmarks for influence based analysis in LLMs- going beyond the datasets and approaches we used in this work. Further, while outlier gradient analysis is useful in cases where training data can be noisy, it might not be useful if the data is very high quality and there are no outlying gradi- ent samples. However, it is unlikely that this will be the case in the real-world unless some steps have been taken prior to training to ensure high data quality. Finally, outlier analysis algorithms have a fundamental limitation of how to spec- ify the budget for outlier detection, which is non-trivial hyperparameter optimization problem. While this is com- mon problem with little consensus across the entire field of outlier analysis, our methods inherit this limitation as well (although we note that outlier gradient analysis performs well for different budget thresholds, as shown in additional experiments in the Appendix C.2).
Alaa, A. and Van Der Schaar, M. Discriminative jackknife: Quantifying uncertainty in deep learning via higher-order influence functions. In International Conference on Ma- chine Learning. 2020.
Algan, G. and Ulusoy, I. Image classification with deep learning in the presence of noisy labels: A survey. Knowledge- Baased Systems, 215:106771, 2021.
Askari, H., Gupta, S., Tong, T., Wang, F., Chhabra, A., and Chen, M. Unraveling Indirect In In-Context Learning Using Influence Functions. arXiv preprint arXiv:2501.0447. 2025.
Bae, J., Lin, W., Lorraine, J., and Grosse, R. Training data attribution via approximate unrolled differentation. arXiv preprint arXiv:2405.12188 2024.
Basu, S., Pope, P., and Feizi, S. Influence Functions in Deep Learning Are Fragile. In International Conference on Learning Representations, 2020a.
Basu, S., You, X., and Feizi, S. On second-order group influ- ence functions for black-box predictions. In International Conference on Machine Learning, 2020b.
Bejan, I,, Sokolov, A., and Filippova, K. Make every exam- ple count: On the stability and utility of self-influence for learning from noisy nlp datasets. Conference on Em- pirical Methods in Natural Language Processing, 2023.
Cai, J., Luo, J., Wang, S., and Yang, S. Feature selection in machine learning: A new perspective. Neurocomputingg 2018.
Charpiat, G., Girard, N., Felardos, L., and Tarabalka, Y. Input similarity from the neural network perspective. Ad- vances in Neural Information Processing Systems, 2019.
Chen, Y., Li, B., Yu, H., Wu, P., and Miao, C. Hydra: Hypergradient data relevance analysis for interpreting deep neural networks. In AAAI Conference on Artificial Intelligence, 2021.
Acknowledgments
The authors would like to thank Han Yue for aiding with experiment design and implementation, and the anonymous reviewers for their feedback in helping strengthen the work. Bo Li was supported by the National Natural Science Foun- dation of China (No. 72171131, 72133002). Anshuman Chhabra was supported by the USF CSE department faculty startup fund for the duration of this project.
Chhabra, A., Singla, A., and Mohapatra, P. Fair clustering using antidote data. In Algorithmic Fairness through the Lens of Causality and Robustness Workshop, 2022.
Chhabra, A., Li, P., Mohapatra, P., and Liu, H. Robust fair clustering: A novel fairness attack and defense frame- work. In International Conference on Learning Repre- sentations, 2023.

---

Outlier Gradient Analysis
Chhabra, A., Li, P., Mohapatra, P., and Liu, H. What Data Benefits My Classifier? Enhancing Model Performance and Interpretability through Influence-Based Data Selec- tion. In International Conference on Learning Represen- tations, 2024.
He, K., Zhang, X., Ren, S., and Sun, Deep residual learning for image recognition. In IEEE/CVF Conference Computer Vision and Pattern Recognition, 2016.
Hu, E. J., yelong shen, Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. LoRA: Low-Rank Adaptation of Large Language Models. In International Conference on Learning Representations, 2022.
Cohn, D. A.. Ghahramani, Z., and Jordan, M. Active learning with statistical models. Journal of Artificial Intelligence Research, 1996.
Ilyas, A., Park, S. M., Engstrom, L.., Leclerc, G., and Madry, A. Datamodels: Predicting predictions from training data. arXiv preprint (tt:::2222.00222 2022.
Cook, R. D. and Weisberg, S. Residuals and influence in regression. New York: Chapman and Hall, 1982.
Dai, Z. and Gifford, D. K. Training data attribution for dif- fusion models. arXiv preprint arXiv:2306.02174 2023.
Jain, E., Nandy, T., Aggarwal, G., Tendulkar, A. V., Iyer, R. K.. and De, A. Efficient Data Subset Selection to Generalize Training Across Models: Transductive and Inductive Networks. Advances in Neural Information Processing Systems, 2023.
Deng, J., Dong, W., Socher, R., Li, L.-J,, Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In IEEE Conference on Computer Vision and Pattern Recognition, 2009.
Jia, R., Dao, D., Wang, B., Hubis, F. A., Gurel, N. M., Li, B., Zhang, C., Spanos, C., and Song, D. Efficient task specific data valuation for nearest neighbor algorithms. Proceedings of the VLDB Endowment, 2018.
Ding, F., Hardt, M., Miller, J., and Schmidt, L. Retiring adult: New datasets for fair machine learning. In Ad- vances in Neural Information P Processing Systems, 2021.
Jia, R., Dao, D., Wang. B., Hubis, F. A., Hynes, N., Gürel, N. M., Li, B., Zhang, C., Song, D., and Spanos, C. J. To- wards efficient data valuation based on the shapley value. In International Conference on Artificial Intelligence and Statistics, 2019.
Dolan, B. and Brockett, C. Automatically constructing a cor- pus of sentential paraphrases. In International Workshop Paraphrasing, 2005.
Feldman, V. and Zhang, C. What neural networks mem- orize and why: Discovering the long tail via influence estimation. Advances Neural Information Processing Systems, 2020.
Killamsetty, K., Zhao, X., Chen, F., and Iyer, R. Retrieve: Coreset selection for efficient and robust semi-supervised learning. Advances in Neural Information Processing Systems, 2021.
Ghorbani, A. and Zou, J. Data shapley: Equitable valuation of data for machine learning. In International Conference on Machine Learning, 2019.
Kim, S., Kim, K., and Yang. E. Gex: A flexible method for approximating influence via geometric ensemble. Ad- vances in Neural Information Processing Systems, 36. 2024.
Grosse, R., Bae, J., Anil, C., Elhage, N., Tamkin, A., Tajdini, A., Steiner, B., Li, D., Durmus, F., Perez, E., et al. Study- ing large language model generalization with influence functions. arXiv preprini arXiv:2308.03220 2023.
Knorr, E. M., Ng, R. T., and Tucakov, V. Distance-based outliers: algorithms and applications. The VLDB Journal, 2000.
Hall, M. A. Correlation- foreelation-based feature selection for machine learning. PhD thesis, The University of Waikato, 1999.
Koh, P. W. and Liang, P. Understanding black-box predic- tions via influence functions. In International Conference on Machine Learning, 2017.
Hammoudeh. Z. and Lowd, D. Training data influence analysis and estimation: A survey. arXiv preprint arXiv:2212.04612, 2022.
Kong, S., Shen, Y., and Huang, L. Resolving training bi- ases via influence-basee data relabeling. In International Conference on Learning Representations, 2021.
Hampel, F. R. The influence curve and its role in robust es- timation. Journal of the American Statistical Association, 1974.
Krizhevsky, A., Hinton, G., al. Learning multiple layers of features from tiny images. University of Toronto, 2009.
Han, X., Wallace, B. C., and Tsvetkov. Y. Explaining black box predictions and unveiling data artifacts through influ- ence functions. In Annual Meeting of the Association for Computational Linguistics, 2020.
Kuan, J. and Mueller, Model-agnostic label quality scor- ing to detect world label errors. In ICML DataPerf Workshop, 2022.
10

---

Outlier Gradient Analysis
Kwon, Y. and Zou, J. Beta Shapley: a unified and noise- reduced data valuation framework for machine learning. In International Conference Artificial Intelligence and Statistics, 2022.
Oala, L., Maskey, M., Bat-Leah, L.,, Parrish, A., Gürel, N. M., Kuo, T.-S., Liu, Y., Dror, R., Brajovic, D., Yao, X., et al. Dmir: Data-centric machine learning research-past, present and future. arXiv preprint arXiv:2311.1300 2023.
Kwon, Y., Wu, E., Wu, K., and Zou, J. Datalnf: Efficiently Estimating Data Influence in LoRA-tuned LLMs and Dif- fusion Models. In International Conference on Learning Representations, 2024.
Park, S. M., Georgiev, K., Ilyas, A., Leclerc, G., and Madry, A. Trak: Attributing model behavior at scale. arXiv preprint arXiv:2303. 14186, 2023.
Paul, M., Ganguli, S., and Dziugaite, G. K. Deep learning data diet: Finding important examples early in train- ing. Advances in Neural Information Processing Systems, 2021.
Li, K.-L., Huang, H.-k., Tian, S.-F., and Xu, W. Improving one-class sym for anomaly detection. In International Conference on Machine Learning and Cybernetics, 2003.
Li, P., Hastie, T. J.. and Church, K. W. Very sparse random projections. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2006.
Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P., Weiss, R., Dubourg, V., Vanderplas, J., Passos, A., Cour- napeau, D., Brucher, M., Perrot, M., and Duchesnay, E. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825-2830, 2011.
Li, P., Xia, E., and Liu, H. Learning antidote data to individ- ual unfairness. In International Conference on Machine Learning, 2023.
Pruthi, G., Liu, F., Kale, S., and Sundararajan, M. Estimat- ing training data influence by tracing gradient descent. Ad- vances in Neural Information Processing Systems, 2020.
Liu, F. T., Ting, K. M., and Zhou, Z.-H. Isolation forest. In IEEE International Conference on Data Mining, 2008
Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., and Stoyanov, V.
Richardson, B., Sattigeri, P., Wei, D., Ramamurthy, K. N., Varshney, K., Dhurandhar, A., and Gilbert, J. E. Add- remove-or-relabel: Practitioner-friendlly bias mitigation via influential fairness. In ACM Conference on Fairness, Accountability, and Transparency, 2023.
Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv: /90. 1692, 2019.
Liu, Z., Ding, H., Zhong, H., Li, W., Dai, J., and He, C. Influence selection for active learning. In IEEE/CVF International Conference on Computer Vision, 2021.
Schioppa, A., Zablotskaia, P., Vilar, D., and Sokolov, A.
Scaling up influence functions. In AAAI Conference Artificial Intelligence, 2022.
Lyu, H., Jang, J., Ryu, S., and Yang, J. Deeper under- standing of black-box predictions via generalized influ- ence functions. arXiv preprint arXiv:23 2023.
Schioppa, A., Filippova, K., Titov, L., and Zablotskaia, P. Theoretical and practical perspectives on what influence functions do. Advances in Neural Information Processing Systems, 2024.
Martin, R. D. and Yohai, J. Influence functionals for time series. The Annals of Statistics, 1986.
Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, D., Ng. A. Y., and Potts, Recursive deep models for semantic compositionality
Mehrabi, N., Naveed, M., Morstatter, F., and Galstyan, A. Exacerbating algorithmic bias through fairness attacks. In AAAI Conference on Artificial Intelligence, 2021.
a sentiment treebank. In Conference Empirical Methods in Natural Language Processing, 2013.
Müller, N. M. and Markert, K. Identifying mislabeled in- stances in classification datasets. In International Joint Conference on Neural Networks, 2019.
Solans, D., Biggio, B., and Castillo, Poisoning attacks algorithmic fairness. In Machine Learning and Knowt- edge Discovery in Databases: European Conference, 2021.
Nguyen, V.-L., Shaker, M. H., and Hüllermeier, E. How to measure uncertainty in uncertainty sampling for active learning. Machine Learning, 2022.
Tan, H., Wu, S., Du, F., Chen, Y., Wang, Z., Wang, F., and Qi, X. Data pruning via
Ad- vances in Neural Information Processing Systems, 2024.
Northcutt, C., Jiang, L.,, and Chuang, I. Confident learn- ing: Estimating uncertainty in dataset labels. Journal of Artificial Intelligence Research, 2021.
Thakkar, M., Bolukbasi, T., Ganapathy, S., Vashishth, S.,
Chandar, S., and Talukdar, Self-influence guided data

---

Outlier Gradient Analysis
reweighting for language model pre-training. In Confer- Empirical Methods in Natural Language Pro- cessing, 2023.
Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.-A., Lacroix, T., Rozière, B., Goyal, N., Hambro, E., Azhar, F., et al. Llama: Open and efficient foundation lan- guage models. arXiv preprint arXiv:2302.13977, 2023.
Wang, A., Singh, A., Michael, J., Hill, F., Levy, O., and Bowman, S. GLUE: Multi-Task Benchmark and Anal- ysis Platform for Natural Language Understanding. arXiv preprint arXiv:1804.07461. 2018.
Wei, J., Zhu, Z., Cheng, H., Liu, T., Niu, G., and Liu, Y. Learning with noisy labels revisited: A study using real- world human annotations. International Conference Learning Representations, 2022.
Wei, K., Iyer, R., and Bilmes, J. Submodularity in data subset selection and active learning. In International Conference on Machine Learning, 2015.
Yang, S., Xie, 7., Peng, H., Xu, M., Sun, M., and Li, Dataset pruning: Reducing training data by examining generalization influence. International Conference on Learning Representations, 2022.
Yeh, C.-K., Kim, J., Yen, I. E.-H., and Ravikumar, P. K. Representer point selection for explaining deep neural networks. Advances in Neural Information Processing Systems, 2018.
Zha, D., Bhat, Z. P., Lai, K.-H., Yang, F., Jiang, Z., Zhong, S., and Hu, X. Data-centric artificial intelligence: A survey. arXiv preprint arXiv:2303. 10158, 2023.
12

---

Outlier Gradient Analysis
Appendix
A. Additional Related Work on Miscellaneous Data-Centric Learning
Many works in the data-centric learning domain study other relevant research questions beyond detrimental sample identifi- cation and influence estimation. For instance, datamodels (Ilyas et al., 2022) also estimate training sample contributions, but only for one test sample a time. Data efficiency approaches (Jain et al., 2023; Paul et al., 2021; Killamsetty al., 2021) aim to accelerate deep learning training time via subset selection. Data pruning approaches based novel approximations for leave-one-ond one-out influence estimation (Tan et al.. 2024) and the model's generalization gap (Yang et al., 2022) have also been proposed. Model pruning via generalized influence functiins has also been studied in (Lyu et al., 2023). Note that after identifying detrimental training samples, one can adopt multiple strategies for recourse. While we focus on removal in this paper, other alternatives could also be used, such as relabeling (Richardson et al., 2023; Kong et al., 2021). Antidote data augmentation (Chhabra et al., 2022; Li al., 2023) methods aim to generate synthetic data samples to improve model performance, whereas feature selection approaches (Hall, 1999; Cai al., 2018) seek to optimize the feature space to only those important for model performance. Active learning (Cohn et al., 1996) methods aim to iteratively identify optimal samples to annotate given large unlabeled training data pool (Liu et al., 2021; Nguyen et al., 2022; Wei et al., 2015). Finally, works on poisoning attacks seek to analyze model robustness by perturbing training set samples (Solans et al., 2021; Mehrabi et al., 2021; Chhabra et al., 2023) under natural input constraints. The study of training sample influence has also been extended to recent generative models, such as diffusion models (Dai & Gifford, 2023), through the use of ensembles.
B. Detailed Information on Datasets and Model Training
We describe dataset details as well as model training and other information used in the main paper.
B.1. Datasets
We first cover our generated synthetic datasets, then the vision datasets- CIFAR- JON and CIFAR-IOON, then provide more details on the four GLUE binary classification NLP datasets, and finally discuss details regarding the benchmark datasets for influential data identification in LLMs- Sentence Transformations, Math Without Reasoning, and Math With Reasoning.
B.I.1. SYNTHETIC DATASETS
We conduct experiments for our proposed outlier gradient analysis and other baselines on two synthetic datasets. The first dataset is linearly separable for logistic regression classification and consists of 150 training samples and 100 test samples. These are created using the seikit-leam (Pedregosa al., 2011) library's 's make -blobs function. For each of the two binary classes, we manually flip the labels of 10 samples (5 for each class) add noise to the dataset. The second dataset is the non-linear half moons dataset so that we can train an MLP network with two hidden layers with ReLU activations. The training set has 250 samples and the test set has 100 samples, and the dataset is generated using the scikit-learn library's s make.moons function. Here too, we manually flip the labels of 20 samples (10 from each class) to add noise to the data.
1.1.2. CIFAR-ION AND CIFAR-10ON
Both the CIFAR- JON and CIFAR-10ON datasets (Wei et al., 2022) consist of the same input images that make up the CIFAR-IO (10 classes) and CIFAR-100 (100 classes) datasets (Krizhevsky et al., 2009), respectively. Each input is a 32x32 RGB image with dimension (3,32,32). However, for CIFAR-ION and CIFAR- the labels are noisy, as they contain real-world human annotation errors collected using 3 annotators on Amazon Mechanical Turk. As these datasets are based on annottttd noise. they model noisy real-world datasets more realistically, compared to synthetic data alternatives. The training set for both datasets contains 50,000 image-label pairs, and the test set contains 10,000 image-label pairs that are free from noise. For CIFAR-ION we utilize three noise settings for experiments in the paper- (1) Worst, which is the dataset version with the highest noise rate (40.21 21%) as the worst possible annotation label for the image is chosen, (2) Aggregate, which is the least noisy dataset (9.03%) as labels are chosen via majority voting amongst the annotations, and (3) Random which has intermediate noise (17.23%) and consists of picking one of the annotators' labels. We use the first
annotator for the random labels. For CIFAR- 1OON there is only a single noisy setting (Noisy100) due to the large number of labeling classes, and the overall noise rate is 40.20%
13

---

Outlier Gradient Analysis
B. 1.3. GLUE DATASETS
The GLUE the General Language Understanding Evaluation (Wang al., 2018) benchmark datasets consist of number of benchmarks for training, evaluating, and analyzing natural language models. As in the Datalnf paper (Kwon et al., 2024), we utilize the four binary classification subset datasets: QNLI, SST2, QQP, and MRPC for experiments. Here, these datasets cover wide variety of natural language task domains. For instance, QNLI (Wang et al., 2018) covers natural language inference, SS72 (Socher et al., 2013) covers sentiment analysis, QQP covers question answering, and MRPC (Dolan & Brockett, 2005) covers paraphrase detection. We use the same datasets as in Kwon et al. (2024), where the training and test splits are obtained from the Huggingface datasets' library. For QQP and SS72 in Kwon et al. (2024) 4500 training samples and 500 test samples were randomly sampled from the full sets, so we utilize these in our experiments for fair comparison.
B.1.4. Sentence Transformations
For this benchmark dataset proposed in (Kwon et al., 2024), the LLM is required to perform a specific transformation on an input sentence. There are 10 different sentence transformations. To help the model learn different transformations, "chatbot" name identifiers are used and each is uniquely associated with each transformation. These are the categories of sentence transformations (taking an example input sentence as "Welcome to the real world."):
Reverse Order of Words: world. real the to Welcome
Capitalize Every Other Letter: WElCoMe To ThE rEaL wOrLd.
Insert Number 1 Between Every Word: Welcome Ito 1the real Iworld.
Replace Vowels with *; W t* th r**] world.
Double Every Consonant: Wwellccomme tto tthhe rreall wworrlldd
Capitalize Every Word: Welcome To The Real World.
Remove All Vowels: Wiem wrld.
Add ly To End of Each Word: Welcomely toly thely really world.ly
Remove All Consonants: eoe o ea
Repeat Each Word Twice: Welcome Welcome to to the the real real world. world.
B. Math With/Without Reasoning
Both these datasets consist of the same math problems that the LLM is tasked to solve, with the only difference being whether or not an intermediate reasoning step is used in prompting the model. More specifically the LLM is asked to provide a direct answer to an arithmetic math word problem. There are 10 types of word problems and random positive integers are used construct unique prompts. These are follows:
Pizza: Jane ate A slices of pizza and her brother ate B slices from pizza that originally had C slices. How many slices of the pizza are left? Reason: Combined slices eaten = A + B. Left C (A + B).
Chaperones: For every A students going on a field trip, there are B adults needed as chaperones. If I students are attending, how many adults are needed? Reason: Adults needed = (B C) // A.
Purchase: In an aquarium, there are sharks and B dolphins. If they bought more sharks, how many sharks would be there in total? Reason: Total sharks = A + C.
Game: John scored A points in the first game, B points in the second, C in the third, and D in the fourth game. What
his total points? Reason: Total points A B + C+D D.
Reading: Elise reads for A hours each day. How many hours does she read in total in B days? Reason: Total hours
read = A B.
Discount: A shirt costs A. There's a B-dollar off sale. How much does the shirt cost after the discount? Reason: Cost after discount = A B.
Area: rectangular garden has length of meters and a width of B meters. What its area? Reason: Area = A
Savings: If James saves A each week, how much will he save after B weeks? Reason: Total savings A * B.
Cupcakes: A bakery sells cupcakes in boxes of A. If they have B cupcakes, how many boxes can they fill? Reason:
Boxes filled = B // A.
Interest: Jake invests A at an annual interest rate of B%. How much interest will he earn after C years? Reason:
cww.ra..om//Fia. "httpe://huggiiggfaac co/ /oc//o////oooooooooooooooooooooo co/docs//atasstt datasets
14

---

Outlier Gradient Analysis
Interest (A & B C) 100.
B.2. Models and Methods
We now describe the models and the methods used in our experiments throughout the main paper. First, we describe the ResNet-34 (He al., 2016) architecture used the base model for the noisy vision datasets, then the RoBERTa (Liu et al., 2019) NLP transformer model, and then the Llama-2 LLM.* We also describe implementation details and parameter values for the label correction baselines in Sections 4 and 5 and the influence-based baselines used throughout the paper. Finally, we also describe some key implementation details regarding our outlier gradient analysis approach.
B.2.1. RESNET-34
The ResNet-34 model was proposed in (He et al., 2016) and is a 34-layer convolutional neural network pretrained on the ImageNet-1 K dataset resolution 224 x 224. The pretrained model block fine-tuned on the CIFAR- COTAR-IO//CIFAR 100N training set experiments with default parameters- minibatch size (128), optimizer (SGD), initial learning rate (0.1), I), momentum (0.9), weight decay (0.0005), and number of epochs (100), for all experiments. Moreover, directly used the implementation provided by Wei et al. (2022) and made modifications to their code.
B.2.2. ROBERTA
As in (Kwon et al., 2024), we utilize LoRA fine-tuning to fine-tune the RoBERTa-large model, a 355M parameter transformer language model that improves upon the original BERT model in key ways such as implementation and hyperparameter selection. LoRA is applied every value matrix of the attention layers of the RoBERTa model. The pre-trained model from Huggingface used. A learning rate of 0.0003 and batch size of 32 is used. The model fine-tuned over 10 epochs using LoRA and dropout is set be 0.05 while the rank of the LoRA matrix is set 4, as recommended in Kwon et al. (2024). The loss function used is negative log-likelihood as the datasets are all for binary classification. The LoRA training is enabled using the Huggingface PEFT library. 6 For the influence experiments we have utilized the code provided in (Kwon et al., 2024) and adapted for our experiments. Moreover, we only compute influences using the training set gradients, and keep the test set hidden from the learning model for fair evaluation.
B.2.3. 1-MA2-13B-CHA.. LLM
We fine-tune the Llama2 13B parameter instruction tuned LLM using LoRA fine-tuning (applied to every query and value matrix of the attention layer) in Kwon al. (2024). The LoRA parameters rank of LoRA matrix is set to 8, = 32 in 8-bit quantization, and the batch size is set to 32 across 25 fine-tuning epochs. A negative log-likelihood of the generated response is used as the loss function for fine-tuning as before. Here too, we adapt the code provided by Kwon et al. (2024) for our use cases.
follows: learning rate is set to be 0.0003,
B.2.4. LABEL CORRECTION BASELINES
For label correction baselines Sections 4 and 5- Normalized Margin (Northeutt et al., 2021), Self-Confidence (Müller Markert, 2019), and Confidence- Sonfidence-Weighted Entropy (Kuan & Mueller, 2022), we utilize the implementation provided in the Cleanlab library. We use default parameters for all three baselines. Note that the basclines model agnostic and only require predicted labels and associated probabilities for predictions, which we can easily obtain from classifiers.
B.2.5. INFLUENCE- BASED BASELINES
We utilize three influence- baselines in experiments: LiSSA (Koh & Liang, 2017), Gradient Tracing (Pruthi et al., 2020), DataInf (Kwon et al., 2024). For each of these baselines, we utilize the implementation provided Kwon et al. (2024) and adapt to our application scenarios. For each baseline influence estimation is undertaken only on the training set (except for additional results adapting the test set, provided in Appendix C.9 below). We only use the last checkpoint in Gradient Tracing (Pruthi et al., 2020) for fair comparisons.
com http://hhhhbb.comm/om/////aaaaaa
15

---

Outlier Gradient Analysis
B.2.6. OUTLIER GRADIENT ANALYSIS
We now discuss implementation details regarding oudier gradient analysis. Owing to the simplicity of our approach, the implementation is straightforward and follows directly from the algorithm. In most cases, we directly utilize the gradients obtained from the last layer of the model being considered. However, in some cases, the gradient space of samples can be high dimensional. For instance, for CIFAR-IOON, the gradient space is of dimension 50000 x 51200 which unnecessarily increases memory and time complexity of outlier detection. As a result, we reduce the gradient space dimensionality by employing a sparse random projection step (Li et al., 2006) where the reduced dimension is ascertained using the scikit-learn library. We also utilize sparse random projection in this manner for the Llama-2 1aiuu---13B-ool 13B-chat LLM model experiments to reduce the dimensionality of the gradient space obtained.
C. Additional Results and Experiments
We now provide details on additional experiments. We first provide results for the noisy label datasets and vision models shown in the main paper, but with standard deviation included. Then we conduct ablation experiments on the outlier detection threshold for the outlier gradient analysis algorithm. We also provide experiments on running time of our proposed approach (as well as details on computational complexity), ablation experiments on varying iForest parameters, results on ImageNet, experiments with ResNet-18 as the base model instead of ResNet-34, among others.
Table Accuracy # Standard Deviation results ohtained for 5 runs the CIFAR-ION and CIPAR-I0ON datasets for ResNet-34 model trained via cross entropy as well performance post trimming using noisy label correction approaches and influence- aafleence-based methods. including our proposed outlier gradient analysis methods.
CIFAR-
CIFAR-1OON
Method
Aggregate
Random
Worst
Noisy100
Cross Entropy
90.87 + 0.23
89.17 = 0.31
82.27 0.37
57.36 0.43
Normalized Margin (Northoutt et al., 2021)
91.33 + 0.11
90.06 = 0.14
83.57 0.32
60.94 0.59
Self-Confident (Müller & Markert, 2019)
91.38 + 0.19
90.09 = 0.17
83.65 # 0.21
60.51 * 0.51
Confidence Fintropy (Kuan & Mueller, 2022)
91.11 + 0.34
90.05 + 0.26
83.63 0.41
60.62 0.26
Gradient Tracing (Pruthi et al., 2020)
91.47 0.21
89.98 0.20
83.38 0.58
60.73 0.38
LiSSA (Koh & Liang, 2017)
91.49 a: 0.34
90.05 = 0.31
83.38 0.58
60.48 0.29
Datalnf (Kwon et al., 2024)
0.17
90.05 = 0.38
83.50
60.70 = 0.31
Self-LiSSA (Bejan et al.. 2023)
92.07 = 0.15
0.15
83.01
59.48 0.43
Self-Dutainf
91.41 0.17
8
0.21
60.56 0.28
Outlier Gradient Analysis (L1)
91.86 + 0.14
90.66 0.33
84.20
60.32 0.42
Outlier Gradient Analysis (L.2
92.21 + 0.14
90.25 + 0.22
82.99 0.54
61.40 0.22
Outlier Gradient Analysis (IForest)
91.36 + 0.09
90.20 0.07
83,72 0.18
60.99 0.27
C.1. Full Results with Standard Deviation for Vision Model Experiments
In the main paper results of Section we provide accuracy values without the standard deviation listed, due to space constraints. Here, we augment those results by also providing the standard deviation obtained over the 5 runs. These results are denoted in Table 4. It can be seen that the standard deviations are in general low, and overall, outlier gradient trimming has low variance.
C.2. Additional Results for Different Trimming Budget k
We now conduct experiments varying i from 2.5% to 12.5% for all three noise settings and baselines in the CIFAR-ION dataset. These results are shown in Table 5. As can be observed, our outlier analysis approaches features in the top-2 irrespective of the value of k. Moreover, the highest values across each noise regime are obtained by outlier gradient analysis (L.2 norm at 12.5% for Aggregate and Random; and L2 norm at 2.5% for Worst). Finally, we find that setting h as 5% and 12.5% are good overall choices leading to consistently desirable performance. Hence, we select 5% as the outlier budget in experiments.
C.3. Experiments on Running Time and Computational Complexity
We now present running time experiments for outlier gradient analysis on both the CIFAR-ION and CIFAR-JOON datasets compared to the other baselines compared in the paper in Table 6. can be seen that outlier gradient analysis is
16

---

Outlier Gradient Analysis
Table Varying the trimming budget and measuring test set performance across noisy datasets (top-2
performers at each in bold).
CIFARION (Aggregate)
2.5%
5%
7.5%
10%
12.5%
Gradient Tracing
92.11
91.47
92.17
91.99
91.98
LiSSA
92.08
91.49
91.83
92.27
91.74
DataInf
92.34
91.46
91.81
91.80
92.07
Self-LiSSA
91.71
92.07
91.32
91.72
91.33
Self-DataInf
91.22
91.41
91.37
91.29
91.15
Outlier Gradient (LI)
91.39
91.86
92.05
92.36
92.21
Outlier Gradient (L2)
92.10
92.21
92.70
92.63
92.78
Outlier Gradient (iForest)
91.77
91.36
91.57
91.92
92.08
CIEARION (Random)
2.5%
5%
7.5%
10%
12.5%
Gradient Tracing
90.71
89.98
90.41
90.75
90.96
LiSSA
90.21
90.05
91.09
90.88
90.00
DataInf
90.77
90.05
90.30
90.26
90.80
Self-LiSSA
89.76
89.58
89.50
88.94
89.49
Self-Datalnf
89.91
89.81
90.32
89.91
90.00
Outlier Gradient (L.)
90.51
90.66
90.24
90.45
91.17
Outlier Gradient (L2)
90.72
90.25
90.63
90.50
91.21
Outlier Gradient (iForest)
90.03
90.20
90.06
90.38
90.62
CIFARION (Worst)
2,5%
5%
7,5%
10%
12.5%
Gradient Tracing
83,56
83,38
83,61
84.12
84.49
LISSA
84.51
83.38
84.25
83.63
83,89
Datalnf
84.31
83.40
83.45
84.01
84.12
Self-LiSSA
82.65
83.01
82.75
82.71
82,66
Self- Dftf-Da
83.70
83.15
83.53
82.96
83.84
Outlier Gradient (LI)
84.26
84.20
84.12
84.32
84.25
Outlier Gradient (L2)
84.48
82.99
84.09
84.35
84.43
Outlier Gradient (iForest)
83.74
83.72
84.22
84.44
83.25
computationally efficient and fraction of the original running time of the model. Moreover, it is order of magnitudes faster than the other baselines. Thus, our outlier gradient analysis approach is computationally efficient as an option for trimming detrimental samples and improving model performance. Most notably, only Gradient Tracing is faster than outlier gradient analysis, but as we demonstrated in the main paper results, it seldom as accurate in detecting detrimental samples as outlier analysis. Thus, outlier gradient analysis is ideal for balancing performance with computational efficiency, We also provide analytical time complexity comparisons in Table 7. Although, it is important note that practice, outlier gradient analysis is much faster than the worst case time complexity, can be seen in Table 6.
Table 6. Running time for outlier gradient analysis approaches and other baselines (top-2 bold).
Method
Time Taken (seconds)
CIFAR-JOM JON (Aggregate)
CIFAR- JON (Random)
CIFAR- JON (Worst)
CIFAR-IOON (Noisy100)
Grudient Tracing
0.30
0.30
0.39
5.45
DataInf
3.89
3.99
4.01
15.22
LiSSA
23.75
23.25
23.26
115.19
Self-DataInf
5,29
5,51
5.5
12.1
Self-LiSSA
30.44
31.64
31.07
94.93
Outlier Gradient Analysis (L.)
0.54
0.54
0.74
10.3
Outlier Gradient Analysis (L2)
0.55
0,55
0.8
8.99
Outlier Gradient Analysis (iForest)
2.09
2.15
2.19
8.46
C.4. Experiments with Varying Tree Estimators
We conduct further ablations for our iForest outlier gradient analysis approach. The main parameter (other than the trimming budget k which we investigate in Appendix C.2) iForest based outlier gradient analysis is the number of tree estimators being used. As a result, we vary the number of these estimators, and measure performance. We observe that test set
17

---

Outlier Gradient Analysis
Table Computational complexity of outlier gradient analysis methods and other baseline approaches (n #training samples,
#validation/test samples, is #model parameters, is #inputs for LLM and is foutputs for LLM).
Method
Type Hessian-based
Time Complexity
Exact (Eq 1)
O(ne))
LiSSA (Koh & Liang, 2017)
Hessian-based
(nup)
DataInf (Kwon et al., 2024)
Hessian-basee
(nup)
EK-FAC (Grosse et al., 2023)
Hessian-basee
O(m"o pPo)
Self-LiSSA (Bejan et al., 2023)
Self-influence
(np))
Self- DataInf (Bejan et al., 2023)
Self-influence
(np))
Gradient Tracing (Pruthi al., 2020),
Hessian-free
(mmp)
Ours (Outlier Gradient Analysis)
Hessian-free
(npp)
performance CIFAR-ION ION (Worst noise setting) for outlier gradient analysis remains stable across the board when the number of estimators are varied, can be seen in Table 8.
Table 8, Results on varying the number of tree estimators used in iForest outlier gradient analysis.
# Tree Estimators
25
50
75
100
125
150
175
200
Accuracy on Test Set (%) 83.70
84.38
83.71
83.72
83.66
83.97
83.84
83.42
C.5. Experiments on ResNet-18 Architecture
We also provide results for ResNet-18 18 (He et al., 2016) being used as the base model IN Table 9 instead of the ResNet-34 model. The overall performance of the ResNet-18 model is lower than ResNet-34 for all datasets and noise settings, since the ResNet-18 18 model has fewer residual connections than the ResNet-34 model. Moreover, it can be observed that outlier gradient analysis leads to improved performance post trimming, compared to the cross entropy baseline. Outlier gradient trimming is advantageous as data selection strategy irrespective of the base model.
Table 9. Accuracy & Standard Deviation results for 5 runs on the CIFAR- ION and CIFAR-IOON datasets for ResNet- 18 model trained via cross entropy as well performance post trimming using noisy label correction approaches and our propused outlier gradient analysis.
CIFAR-10 JON
CIFAR-IOON
Method
Aggregate
Random
Worst
Noisy100
Cross Entropy Outlier Gradient Trimming (Ours)
90.78 + 0.
89.01 # 0.31
81.85 = 0.45
57.22 + 0.
91.17 # 0.14
89,91 # 0.21
83,08 0.26
60.58 0.28
C.6. Experiments on ImageNet
Although noisy label experiments have not been conducted on ImageNet (Deng et al., 2009), we decided to undertake a simple experiment on a subset of ImageNet. We created a subset of ImageNet containing 50000 images (50 images from each of the 1000 classes) as the training set, and flipped 40% of the corresponding image labels to create noisy labels (20 images from each class). The validation set the same ImageNet with 50000 images. We obtain results for performance on this set for baseline ResNet-18 (He al., 2016) model, DataInf, Gradient Tracing, iForest based outlier gradient analysis, as well as simple Ll-norm and L2-norm thresholding based outlier gradient analysis. The models are trained for 10 epochs. In this limited experimental setting, we obtain the following results in Table 10 and find that outlier gradient analysis methods achieve competitive performance to other methods while being highly computationally efficient.
C.7. Experiments on Other Noisy Learning Baselines
As we discussed previously, approaches for noisy learning can be categorized into (1) methods that either change the loss function or model architecture or (2) those that identify noisy samples and remove/relabel them for improving model performance (Algan & Ulusoy, 2021). Since our approach belongs to the latter category, we only compared against other approaches from this category in the main paper. For completeness we now present results comparing our approach with
18

---

Outlier Gradient Analysis
Table 10. Results ImageNet (top-3 performers based performance and time taken in bold).
Method
Accuracy (%)
Time Taken (8)
Cross Entropy
49.2
Gradient Tracing
51.0
23.51
DutaInf
182.3
Outlier Gradient Analysis (iForest)
50.3
103.5
Outlier Gradient Analysis (LI)
51.5
44.81
Outlier Gradient Analysis (L2)
51.2
44.68
Table 11. Comparing with the alternate category of noisy learning baselines.
Method
CIFAR-ION (Aggregate)
CIFAR-ION (Random)
CIFAR-ION (Worst)
Backward-T T (Patrini et al, 2017)
87.14 0.34
77.61 1.05
Forward-T (Patrini al, 2017)
14.4400.22
86.88 0.50
79.79 01.46
T-Revision (Xia et al, 2019)
0.
88.33 0.32
80.48 1.20
VolMinNet (Li et al. 2021)
89.7
88.30 2 0.12
80.53 = 0.20
GCB (Zhang and Sabuncu, 2018)
87.85
87.61 0.28
80.66 0.35
Peer Loss (Liu and Guo, 2020)
9..7
89.06 0.11
82.00 0.60
F-Div (Wei and Liu, 2020)
0.34
89.70 0.40
82.53 0.52
Positive-LS (Lukasik
2020)
91.57
89.80
82.76 0.53
Negative-LS (Wei et al, 2021)
90.61 9.49
90.29 0.32
82.99 0.36
Co-teaching+ (Yu et al, 2019)
89.70 0.27
83.26 : 0.17
JoCoR (Wei et al, 2020)
91.44
90.30 0.20
83.37 # 0.30
ELR (Liu et al, 2020)
92.38 0.64
91.46 0.38
83,58 1.13
CORES-2 (Cheng al, 2020)
0.I1
89.66 0.32
83.60 0.53
Outlier Gradient Analysis (L.I)
91.86
90.66
84.20 0.19
Outlier Gradient Analysis (L2)
92.21 = 0.14
90.25 0.22
82.99
Outlier Gradient Analysis (iForest)
91.36 = 0.09
90.20 & 0.07
83.72 # 0.18
some others in the former category for the ResNet-34 architecture and CIFAR- -ON dataset. As can be seen Table 11, outlier gradient analysis features in the top-2 performers compared the other noisy learning baselines. We would like to emphasize that this is not an exhaustive list of baselines and noisy learning by adjusting the loss/model is not the primary focus of our work (but detecting detrimental samples is). Note that our algorithm could also be combined with approaches from this other category for additional gains.
C.8. Comparison with GEX (Kim et al., 2024) and TRAK (Park et al., 2023)
We also compare the performance of our outlier gradient analysis methods with GEX (Kim al., 2024) and TRAK (Park et al., 2023). two new influence function methods. As mentioned in the main paper, we were able to obtain results for CIFAR-ION but obtained out-of-memory (OOM) emrors for CIFAR-I00R RO00. This computational memory overhead highlights the shortcomings of these approaches. Furthermore, the results on CIFAR-ION for all three noise settings are shown in Table 12. As can be seen, our outlier gradient analysis approaches outperform these new influence function baselines for the detrimental data identification task.
C.9. Experiments on Adapting Outlier Gradient Analysis to Validation/Test Set
We also conduct experiments for the distribution shift benchmark from the influence function work by (Chhabra et al., 2024). These experiments will showcase the applicability outlier gradient analysis adapting to a validation/test set distribution (instead of solely relying on the training set distribution). In (Chhabra al., 2024), three distribution shift scenarios are considered on the Folktables ACS-Income (Ding et al., 2021) dataset: time-shifted, focation-shiftes and sine+location-shiffe Essentially, in each of these settings, either the train/test distribution time-shifted (e.g. 2014/2018) 18), location-shifted (e.g. CA/MI), or both (e.g. 2014 & CA / 2018 8 & MI). We undertake the same experiments but using the OneClassSVM semi-supervised outlier analysis approach (Li et al., 2003) instead of iForest, L1/L2 norm, and provide the test set as inliers to correct the distribution the training set influence estimation. Then, we utilize outlier gradient analysis for each setting, with results shown in Table 13. Our approach highly adaptable to differing test/validation set distributions (concept drift) and can significantly outperform other baselines in this setting as well.
19

---

Outlier Gradient Analysis
Table 12. Performance comparison of outlier gradient analysis methods with GEX (Kim al., 2024) and TRAK (Park al., 2023)
influence function baselines.
Method
CIFAR- JON (Aggregate)
CIFAR-ION (Random)
CIFAR-JON (Worst)
GEX (Kim et al., 2024)
90.67
89.13
80.30
TRAK (Park al., 2023)
91.73
90.07
83.52
Outlier Gradient (L1)
84.20
Outlier Gradient (1.2)
92.21
90.25
82.99
Outlier Gradient (iForest)
91.36
90.20
83.72
Table 13. Using OneClassSVM as the outlier analysis approach in the distribution shift experiments of (Chhabra et al., 2024) on the
Folktables ACS-Income dataset.
Method
Time
Loc
Time Loc
Gradient Tracing
0.7523
0.7628
0.7483
Datalnf
0.7390
0.7830
0.7547
LiSSA
0.7490
0.7657
0.7498
Self-DataInf
0.7783
0.7797
0,7812
Self-LiSSA
0.7782
0.7798
0.7782
Outlier Gradient Analysis (LI)
0.7683
0.7797
0,7742
Outlier Gradient Analysis (L.2)
0.7687
0.7760
0.7690
Outlier Gradient Analysis (iForest)
0.7708
0.7892
0.7750
Outlier Gradient Analysis (OneClassSVM)
0.7765
0,8063
0.7840
D. Code and Reproducibility
We provide our code, instructions, and implementation in an open-source repository: https://githut: com/ anshuman23 out wwwuutierrreeeee wiee-rrrdd i ent- aar-aaalye assllnsslsss.. The experiments were conducted on two separate Linux (Ubuntu 20.04.6 LTS) servers- the experiments of Sections and 7 were conducted on NVIDIA GeForce RTX A6000 GPUs with 50GB VRAM running CUDA version 12.0 and all other experiments were conducted on an NVIDIA Tesla V100 with 32GB VRAM and CUDA version 11.4.
20


Reviews:
[{"review_id": "SWJ0tLMvkl", "reviewer": "Reviewer_91NL", "summary": "The paper introduces a simple yet powerful alternative to traditional influence functions by leveraging outlier detection in gradient space. This method—Outlier Gradient Analysis—provides a scalable, efficient, and accurate way to identify harmful training samples, with broad utility across diverse deep learning domains.  Extensive experiments demonstrate the method’s good performance in both accuracy and computational efficiency.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer 91NL, \n\nThank you for your insightful review and feedback. We answer the questions raised, below:\n\n- **Q1: Could you elaborate on the computational specifics of Outlier Gradient (L1) and Outlier Gradient (L2)?**\n\n    Thank you for your question. Our outlier gradient approach (Algorithm 1) takes in as input a trimming budget $k$ and an outlier analysis algorithm $\\mathcal{A}$. Here, $\\mathcal{A}$ can be any outlier analysis algorithm, including L1 and L2 norm thresholding. For these two algorithms, we compute the gradient of the training samples, and then simply select the top-$k$% (i.e. based on budget) norm values as outliers. For L1 (or L2) norm thresholding, the L1 (or L2) norm values need to be computed, but this is a computationally efficient simple tensor operation.\n\n___\n\n- **Q2: Why is there an additional summation symbol in Equation 1?**\n\n    The additional summation symbol is simply aggregating the loss for each of the validation/training set samples (i.e. samples from either $V$ or $T$) on which training sample $z_j$'s influence is being measured. As the loss is additive, the derivative of the loss is also additive, and hence, can be summed over to compute the overall loss contributions made by the individual training sample ($z_j$) we are computing influence for. This summation over the loss is used in past work on influence function for model performance measurement, such as [1,2], among others.\n\n___\n\n- **Q3: Avoiding the computation of the Hessian matrix can accelerate calculations, but it is strange that only calculating the third term of Equation 1 improves accuracy**\n\n    Thank you for the great question. One intuitive reason for this (that also past work has found) is that the Hessian is not mandatory for influence analysis in all cases. While (Koh and Liang, 2017) pioneered influence functions based on the Hessian, other work has considered influence functions without relying on the Hessian such as TracIn [3], TracIn-Last [4], VAE-TracIn [5], BoostIn [6], Hydra [7], etc. Note that TracIn here is the Gradient Tracing baseline we compare with in the paper as well. TracIn and its variant approaches are simply calculating a vector inner product on the gradient space without computing the Hessian. Our outlier gradient analysis approach undertakes the Hessian-free in a novel manner by discovering detrimental training samples using the outlyingness of the gradient terms.\n___\n\n- **The key hypothesis should be validated on real datasets**:\n\n    For real-world datasets (with a large number of classes) and large models, visualizing the gradient space (which will be very high-dimensional) requires undertaking aggressive approximations and is not possible in 2D/3D without losing useful information that describes outlyingness. Thus, we visualized the gradient space for simpler models and synthetic datasets as these are controllable and allow us to demonstrate our hypothesis, while real-world datasets could be affected by unknown factors. However, we would like to emphasize that the success of our methods on downstream real-world datasets (all the experiments in our paper) showcases the benefits and efficacy of outlier gradient analysis (thereby validating it) on real-world datasets and large models as well.\n\n___\n\n- **The article lacks a discussion on the limitations of the methodology**:\n\n    Thank you for the suggestion. We can definitely aim to add more discussion on the limitations of our approach in the main paper. While outlier gradient analysis is useful in cases where training data can be noisy, it might not be as useful if the data is already very high quality and there are no outlying gradient samples. However, this might not be the case in the real-world unless some steps have already been taken to ensure high data quality. Furthermore, outlier analysis algorithms have a fundamental limitation of how to specify the budget for outlier detection, which is a non-trivial hyperparameter optimization problem. While this is a common problem with little consensus across the entire field of outlier analysis, our methods inherit this limitation as well (although our methods work well for different budget thresholds, as shown in additional experiments in Appendix C.2).\n\n___\n\nThank you once again for your help in strengthening our paper, we appreciate it.\n___\n\n**References**:\n1. Understanding black-box predictions via influence functions. ICML 2017.\n2. DataInf: Efficiently Estimating Data Influence in LoRA-tuned LLMs and Diffusion Models. ICLR 2024.\n3. Estimating training data influence by tracing gradient descent. NeurIPS 2020.\n4. First is better than last for language data influence. NeurIPS 2022.\n5. Understanding instance-based interpretability of variational auto-encoders. NeurIPS 2021.\n6. Adapting and evaluating influence-estimation methods for gradient-boosted decision trees. JMLR 2023.\n7. Hydra: Hypergradient data relevance analysis for interpreting deep neural networks. AAAI 2021.", "claims_and_evidence": "**Claim 1: The majority of training samples positively contribute to the model’s utility,and a much smaller subset than beneficial samples**  \nAlthough this conclusion is evident, it would be more rigorous if there are quantitative results to support this claim.  \n**Claim 2: Gradient-space outliers correspond to detrimental training samples.**  \nThe authors validate this key hypothesis on both **synthetic datasets** (linear and non-linear) and show that detrimental samples are clearly separable in gradient space. Due to the absence of theoretical equivalence proof, this key hypothesis should be validated on **real datasets**.  \n**Claim 3: Outlier Gradient Analysis is a computationally efficient and outperforms other baselines.**  \nExperiments are provided across domains including CIFAR-10N/100N and LLM benchmarks.", "methods_and_evaluation_criteria": "The method addresses a significant gap in existing approaches. Influence functions, while effective, are computationally expensive due to the need for Hessian matrix inversion, especially in deep models. By shifting to gradient-space outlier detection, the authors propose an approach that avoids this bottleneck, making it both more scalable and efficient. This transformation from influence functions to outlier analysis is logically justified, and the use of simple and efficient outlier detection algorithms. However, this transformation requires more comprehensive validation on real datasets, or the authors should provide theoretical proof.", "theoretical_claims": "This paper does not furnish the theoretical claims.", "experimental_designs_or_analyses": "The experimental designs and analyses in the paper are generally sound and provide strong evidence for the effectiveness of the proposed Outlier Gradient Analysis method. The authors carefully design experiments across multiple domains (synthetic, vision, NLP, LLMs) and use appropriate evaluation metrics.", "relation_to_broader_scientific_literature": "None", "essential_references_not_discussed": "None", "other_strengths_and_weaknesses": "**Strengths**  \nThe method is simple and efficient.  \nThe idea of avoiding computing the Hessian matrix is innovative.  \n**Weaknesses**  \nThe technical details have not been adequately elaborated.   \nThe article lacks a discussion on the limitations of the methodology.", "other_comments_or_suggestions": "I have no other comments and suggestions.", "questions_for_authors": "**Q1: Could you elaborate on the computational specifics of Outlier Gradient (L1) and Outlier Gradient (L2)?**  \n**Q2: Why is there an additional summation symbol in Equation 1?**  \n**Q3: Avoiding the computation of the Hessian matrix can accelerate calculations, but it is strange that only calculating the third term of Equation 1 improves accuracy.**", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "OIBHDQulMq", "reviewer": "Reviewer_p9JH", "summary": "This paper addresses the challenge of identifying training samples that negatively impact deep learning model performance.  The authors draw a connection between identifying detrimental training samples using influence functions and outlier detection in the gradient space.  This connection leads to a Hessian-free formulation, reducing the computational cost associated with calculating the inverse of the Hessian matrix.    \nThe authors propose an \"outlier gradient analysis\" approach.  They validate this approach on synthetic datasets and demonstrate its effectiveness in noisy label correction for vision models.  They also show its applicability to data selection for fine-tuning NLP models and influential data identification for Large Language Models (LLMs).", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer p9JH, \n\nThank you for your insightful review, comments, and suggestions. We answer the questions raised, below:\n\n- **Essential References Not Discussed**:\n\n     Thank you for providing these references on gradient-based outlier/anomaly detection, we appreciate it. As the reviewer correctly points out, these are closely related to our work in a technical sense (but explore different research questions), and we will be sure to include and discuss these in the revision.\n\n___\n\n- **Lack of Discussion on Failure Cases**:\n\n    We can definitely aim to add more discussion on the limitations of our approach in the main paper. While outlier gradient analysis is useful in cases where training data can be noisy, it might not be as useful if the data is already very high quality and there are no outlying gradient samples. However, this might not be the case in the real-world unless some steps have already been taken to ensure high data quality. Furthermore, outlier analysis algorithms have a fundamental limitation of how to specify the budget for outlier detection, which is a non-trivial hyperparameter optimization problem. While this is a common problem with little consensus across the entire field of outlier analysis, our methods inherit this limitation as well (although our methods work well for different budget thresholds, as shown in additional experiments in the Appendix C.2). \n\n___\n\n- **Further Analysis of Outlier Detection Algorithms**: \n    \n    Thank you for this suggestion. In our paper, we have utilized 4 outlier analysis algorithms: iForest, L1 norm thresholding, L2 norm thresholding, and OneClassSVM (Appendix C.9) for outlier gradient analysis. For all 4 of these algorithms, the general trend of outlier gradient analysis improving model performance against competitive baselines in the noisy learning regime can be observed. Also, note that our primary aim in choosing these algorithms was their high computational efficiency and minimal number of hyperparameters. More complex approaches generally tend to be slower (e.g. those based on deep learning) and thus, wouldn't be as useful for outlier analysis of the gradient space. However, we are happy to include any other useful outlier detection methods that the reviewer would like us to.\n___\n\n- **How sensitive is your method to the choice of hyperparameters, such as the number of trees in iForest or the threshold for L1/L2 norm methods? Please provide more guidance on how to choose appropriate hyperparameter values for different datasets and model architectures. A discussion on the robustness of the method to hyperparameter settings would be valuable.**\n\n    Thank you for the great question. We had provided details and additional experiments on hyperparameters in **Appendix C**, which we also discuss below. More specifically, our outlier analysis algorithm has two hyperparameters: (1) the trimming budget $k$ which is the number of samples to remove, and (2) the hyperparameters of the outlier detection algorithm being used (e.g. iForest). \n\n    1. For the first hyperparameter of the trimming budget $k$, we conduct additional experiments while varying the value of $k$ from 2.5% to 12.5% for all 4 noise settings of CIFAR-10N. These results are provided in **Table 5** of **Appendix C.2**.  As can be seen, the highest values across each noise regime are obtained by outlier gradient analysis (L2 norm thresholding at 12.5% for Aggregate and Random; and L2 norm thresholding at 2.5% for Worst), indicating its broad suitability. These results also show that the budget of 5% is a good choice for the trimming budget, leading to desirable performance in most cases.\n\n    2. The second hyperparameter choice is only a facet of the iForest outlier analysis algorithm and constitutes the number of trees (as the reviewer correctly pointed out). Note that this is because for the L1 and L2 norm thresholding approaches, we do not have a norm threshold that needs to be chosen manually, since setting the budget automatically decides the threshold. For the iForest algorithm, we have provided results for varying the number of tree estimators on CIFAR-10N in **Table 8** of **Appendix C.4**. As can be observed, the performance of outlier gradient analysis remains stable across the board when the number of trees/estimators are varied, indicating low sensitivity of this hyperparameter to final results obtained.\n\n___\n\nWe would like to thank the reviewer again for all the time and effort spent on the review, and helping improve our work.", "claims_and_evidence": "Claim 1: The paper builds a bridge between identifying detrimental training samples via influence functions and outlier detection on the gradient space of samples. \n\n\nEvidence: The paper dedicates Section 3.2 to \"Bridging Influence Estimation and Outlier Analysis,\" detailing the conceptual transformation from influence function-based detrimental sample identification to outlier detection in the gradient space.  Hypothesis 3.2 explicitly states the existence of outlier analysis algorithms for detecting detrimental samples in the gradient space.  The proposed outlier gradient analysis approach is then detailed in Section 3.3.    \n\n\nAssessment: The claim is well-supported. The paper provides a clear explanation and justification for this connection.\n\nClaim 2: The \"transformation features a straightforward and Hessian-free formulation, and reduces the computational cost associated with the Hessian matrix and its inverse.\"    \n\n\nEvidence: The paper emphasizes that outlier gradient analysis \"not only features a straightforward and Hessian-free formulation\"  but also \"reduces the computational cost associated with the Hessian matrix and its inverse.\"  The method operates directly on the gradient space, avoiding the computation and inversion of the Hessian.  Algorithm 1 outlines the approach, which does not involve Hessian calculations.  Experiments in Section 8 discuss computational complexity and running time, showing that outlier gradient analysis is computationally efficient.  Table 7 provides a comparison of computational complexities, highlighting that outlier gradient analysis has a lower complexity than Hessian-based methods.    \n\n\nAssessment: The claim is convincingly supported by the presented methodology and experimental results.\n\nIn summary, the claims made in the submission are generally well-supported by the evidence provided.", "methods_and_evaluation_criteria": "The authors propose \"outlier gradient analysis,\" which connects the identification of detrimental samples using influence functions to outlier detection in the gradient space. This method is designed to address the computational challenges of traditional influence functions, which require Hessian matrix inversion. The choice of outlier detection algorithms like Isolation Forest is justified based on efficiency and effectiveness.   \n\nEvaluation Criteria: The paper uses a combination of synthetic datasets and real-world noisy label datasets (CIFAR-10N, CIFAR-100N). For the synthetic data, they measure ground-truth outlier predictive accuracy and performance gain. For real-world datasets, they evaluate the accuracy of noisy label correction. They also extend their evaluation to data selection for fine-tuning NLP models (GLUE datasets) and influential data identification for Large Language Models, using appropriate metrics (AUC and Recall).   \n\nRationale: These evaluation choices are relevant because they cover a range of scenarios, from controlled synthetic environments to more complex real-world applications in computer vision and natural language processing. The use of noisy label datasets is particularly relevant to evaluating the method's ability to identify detrimental samples.", "theoretical_claims": "The primary theoretical claim revolves around \"Hypothesis 3.2\" and its connection to the proposed \"outlier gradient analysis.\"\n\nHypothesis 3.2: \"There exist outlier analysis algorithms capable of detecting detrimental samples in the gradient space.\"    \n\nThe authors build a conceptual bridge between influence functions and outlier detection in gradient space.  They argue that detrimental samples, which negatively impact model utility, can be considered outliers in the gradient space.  This is supported by Observation 3.1, which states that in a converged model, most training samples contribute positively, while detrimental samples are a minority.    \n\nThe paper doesn't provide formal proofs in the mathematical sense for Hypothesis 3.2. Instead, it offers a logical argument and empirical evidence to support it. The argument relies on the observation that detrimental samples are analogous to outliers and the justification that gradients play a decisive role in determining a sample's influence.    \n\nWhile the paper doesn't offer formal proofs, the logical reasoning and empirical results provide strong evidence for the validity of the central theoretical claim.", "experimental_designs_or_analyses": "The experimental designs and analyses are sound and appropriate for evaluating the proposed method across different tasks and datasets.", "relation_to_broader_scientific_literature": "The key contributions of this paper are related to the broader scientific literature in the following ways:\n\n* **Influence Functions:** The paper builds upon the existing body of work on influence functions, a technique used for estimating the impact of training data on model predictions. It addresses the computational limitations of influence functions, specifically the high cost of inverting the Hessian matrix, which becomes a bottleneck for large-scale deep learning models.\n   \n* **Data-Centric Learning:** The research aligns with the growing field of data-centric learning, which focuses on improving model performance by manipulating the training data rather than the model architecture. The problem of identifying and removing detrimental samples is a core challenge in this area.\n   \n* **Outlier Detection:** The paper connects the problem of detrimental sample identification to the field of outlier detection. By framing detrimental samples as outliers in the gradient space, the authors leverage existing outlier detection algorithms to solve the problem of identifying harmful data points.", "essential_references_not_discussed": "Gradient-based anomaly detection: There is a body of work that directly uses gradients for anomaly detection, where anomalies are identified based on their gradient patterns. This line of work is closely related to the paper's idea of using gradients to identify outliers, and discussing it would provide a broader context.\n\nReferences:\n\n- Huang, Rui, Andrew Geng, and Yixuan Li. \"On the importance of gradients for detecting distributional shifts in the wild.\" Advances in Neural Information Processing Systems 34 (2021): 677-689.\n- Kwon, Gukyeong, et al. \"Backpropagated gradient representations for anomaly detection.\" Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXI 16. Springer International Publishing, 2020.\n- Chen, Jinggang, et al. \"Gaia: Delving into gradient-based attribution abnormality for out-of-distribution detection.\" Advances in Neural Information Processing Systems 36 (2023): 79946-79958.\n- ElAraby, Mostafa, et al. \"GROOD: GRadient-aware Out-Of-Distribution detection in interpolated manifolds.\" arXiv preprint arXiv:2312.14427 (2023).", "other_strengths_and_weaknesses": "Strengths:\n\n- Originality: The paper presents an original approach by connecting influence functions with outlier detection in the gradient space. This is a novel way to address the computational challenges of influence functions and offers a new perspective on identifying detrimental training samples. The idea of using outlier analysis for this purpose is creative and potentially impactful.\n\n- Significance: The problem of identifying detrimental training samples is a significant challenge in data-centric learning. The proposed method has the potential to improve the efficiency and scalability of influence estimation, making it more applicable to large-scale deep learning models. This could have a substantial impact on various applications, including noisy label correction, data selection, and model interpretation.\n\n- Clarity: The paper is generally well-written and the proposed method is explained clearly. The authors provide sufficient background information and motivation for their approach. \n\n- Thorough Evaluation: The authors evaluate their method on synthetic datasets, noisy label correction for vision, data selection for NLP, and influential data identification for LLMs. This comprehensive evaluation demonstrates the broad applicability and effectiveness of the proposed approach.\n\nWeaknesses:\n\n- Limited Exploration of Outlier Detection Methods: While the paper justifies the use of Isolation Forest, it does not thoroughly explore or compare a wider range of outlier detection algorithms. There might be other more suitable algorithms that could further improve the performance or efficiency of the proposed method. \n\nLack of Discussion on Failure Cases: The paper could include a more detailed discussion of potential limitations and failure cases of the proposed method. Understanding when and why the method might not perform optimally is crucial for a comprehensive analysis.", "other_comments_or_suggestions": "Further Analysis of Outlier Detection Algorithms: The paper justifies the use of Isolation Forest (iForest) but could benefit from a more detailed analysis and comparison of other outlier detection algorithms. This would provide a more comprehensive understanding of the impact of different outlier detection techniques on the proposed method.", "questions_for_authors": "How sensitive is your method to the choice of hyperparameters, such as the number of trees in iForest or the threshold for L1/L2 norm methods? Please provide more guidance on how to choose appropriate hyperparameter values for different datasets and model architectures. A discussion on the robustness of the method to hyperparameter settings would be valuable.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "x4dTRWpVEc", "reviewer": "Reviewer_r7gY", "summary": "This paper proposed Outlier Gradient Analysis, establishing a theoretical bridge between influence functions (a common tool for this task) and outlier detection in the gradient space. The key insight is that detrimental samples can be effectively identified as outliers in the gradient space without computing the Hessian matrix—a major computational bottleneck in traditional influence function approaches. The method employs Isolation Forest, L1-norm, and L2-norm thresholding for outlier detection and demonstrates strong performance across CV and NLP.\n\n# **update after rebuttal**\nI would like to thank the authors for their sincere efforts to address my concerns. I have increase my score.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer r7gY,\n\nThank you for your thoughtful review and feedback, we appreciate it. We have answered questions raised, below:\n\n- **The paper would be in stronger position if it included comparisons with: sample selection methods for learning with noisy labels and data pruning for training efficiency**\n    \n    Thank you for the great suggestion. Along with comparisons with other influence function baselines and simpler noisy label correction methods, we had compared with a number of sample selection methods designed for noisy learning in **Appendix C.7 (Table 11)**. Approaches for noisy learning can be categorized into (1) methods that either change the loss function or model architecture or (2) those that identify noisy samples and remove/relabel them for improving model performance (Algan & Ulusoy, 2021). While the main paper has results for the latter category, we compare with the former category on CIFAR-10N (all 3 noise settings) in Table 11 of Appendix C.7. As can be observed, outlier gradient analysis is the top performer across these methods as well. While we had thought of also comparing with training data efficiency methods, we could not undertake a fair comparison as several methods opt for reducing the size of the training set as much as possible while ensuring that performance on the reduced set remains as close to the original set. However, the goal in our work is to specify a small trimming budget and increase performance as much as possible, leading to the research questions between these approaches being fundamentally different.\n\n___\n\n- **For the LLM influential data identification task, can iForest estimators scale to different tasks with many classes?**\n\n    Currently, each of the 3 influential data identification tasks (Math With Reasoning, Math Without Reasoning, and Sentence Transformations) we considered from past work (Kwon et al, 2024) each have 10 classes/categories of subtasks (e.g. Sentence Transformation can have 10 different types of natural language transformations and Math problems can have 10 different categories of word problems). More details regarding these benchmarks are provided in Appendix B.1.4 and B.1.5. While the reviewer makes a great suggestion of scaling to even more classes, one of the challenges associated with influential data identification in LLMs is the lack of more complex and varied benchmarks. This is currently an evolving field, and designing benchmarks is challenging because ground-truth influence labels need to accurately reflect the model's inductive bias for a test sample (i.e. the model should find the training samples most influential for a particular test example). Past work does this by making the train-test problem categories very similar. We are now working on designing better LLM influence identification benchmarks for future work, and hope to test our outlier gradient analysis methods on these benchmarks as well.\n\n___\n\n- **Have you explored using other outlier detection algorithms beyond iForest and L1/L2 norms?**\n\n    In the paper, we have utilized 4 outlier analysis algorithms: iForest (main paper), L1 norm (main paper), L2 norm (main paper), and OneClassSVM (Appendix C.9) for outlier gradient analysis. For all 4 of these algorithms, the general trend of outlier gradient analysis improving model performance against competitive baselines in the noisy learning regime can be observed. Our primary aim in choosing these algorithms was their high computational efficiency and minimal number of hyperparameters. \n\n___\n\n- **The approach currently requires computing gradients for all training samples. Why not consider approximation or sampling technique?**\n\n    The reason we did not opt for approximating or sampling gradients is the ease with which they are available for model deep learning models trained via backpropagation. Basically, we can obtain gradients in one-pass as the model is training post each backpropagation step. Owing to the ease of gradient access, we did not optimize this further via approximation. Moreover, approximation/sampling would lead to some reduction in performance as opposed to using the original first-order gradients. As an aside, the Hessian is not available during training since it contains second order information.\n\n___\n\n- **Moving table of runtime evaluation to the main text and minor typos**:\n\n    Thank you for pointing these out. We will incorporate these suggestions into the revision as requested.\n\n___\n\nThank you once again for all your time and effort in reviewing our work, and helping strengthen our contributions.", "claims_and_evidence": "The paper's claims are generally well-supported by empirical evidence. \n\n1. Gradient outliers correlate strongly with detrimental samples, validated through synthetic datasets where ground truth is known (showing 96-98% detection accuracy).\n\n2. The approach outperforms baseline methods on vision tasks.\n\n3. Computational efficiency claims are substantiated with runtime measurements showing orders of magnitude speedup over traditional influence methods.\n\nHowever, evidence could be strengthened:\n- LLM influence task shows perfect scores (1.0 AUC/Recall), which may read about task difficulty or potential ceiling effects.", "methods_and_evaluation_criteria": "1. The use of varied datasets spanning different domains (vision, NLP, LLMs) demonstrates generalizability.\n\n2. In CV tasks, the evaluation protocol of detecting and removing detrimental samples followed by retraining is a sensible approximation of real-world application scenarios.\n\n3. As a concern, I suggest that the authors expand their comparison beyond just Influence function baselines. In the area of learning with noisy labels, there are many mature sample selection methods with objectives similar to the proposed approach. For example, using the small-loss criterion from early-stopped models [1] to select clean samples, or leveraging whether models can consistently learn a sample as a criterion to identify mislabeled examples [2]. I recommend incorporating these methods into your comparison to evaluate both selection accuracy and computational efficiency. \n\n[1] Co-teaching: Robust Training of Deep Neural Networks with Extremely Noisy Labels, NeurIPS 2018.\n\n[2] Late Stopping: Avoiding Confidently Learning from Mislabeled Examples, ICCV 2023.", "theoretical_claims": "The paper primarily presents an intuitive conceptual transformation rather than formal theoretical proofs. The core theoretical claim is Hypothesis 3.2, which establishes a connection between detrimental sample identification and outlier detection in gradient space. This hypothesis is supported by empirical evidence rather than formal proof, which is reasonable given the nature of the problem.\n\nThe justification in Section 3.2 about why the gradient term should be decisive in determining whether a sample is detrimental is logical. The validity of Observation 3.1 (that detrimental samples are a minority in converged models) is crucial to the approach and appears empirically sound, though not rigorously proven.", "experimental_designs_or_analyses": "1. The synthetic experiments in Section 4 provide clear validation of the core hypothesis with controlled conditions.\n\n2. The CIFAR-10N/100N experiments appropriately assess performance across varying noise regimes.\n\n3. The ablation studies on trimming budget k and iForest parameters are valuable.\n\n4. The computational complexity analysis is good enough.\n\nThat is enough, other minor issues are not concern me.", "relation_to_broader_scientific_literature": "This work relates to several research directions in the machine learning literature:\n\n1. It extends influence function research by providing a more computationally efficient method for the specific task of detrimental sample identification.\n\n2. It connects to the noisy label learning literature by offering an effective approach for identifying mislabeled samples.\n\n3. It contributes to data-centric AI  by focusing on improving model performance through data quality rather than model architecture.\n\n4. It relates to outlier detection literature (which I am not familiar).\n\nThe authors appropriately position their work within these research areas and have a decent realted work.", "essential_references_not_discussed": "There is relevant research on sample importance/informative evaluation and data valuation that deserves discussion in relation to the authors' proposed method (influence functions). These fall into two main categories:\n\n1. Data Valuation Methods:\nThese approaches provide alternative frameworks for quantifying sample importance:\n\n[1] LAVA: Data Valuation without Pre-Specified Learning Algorithms, arXiv 2023.\n\n[2] Data-OOB: Out-of-bag Estimate as a Simple and Efficient Data Value, ICML 2023.\n\n[3] Data Banzhaf: A Robust Data Valuation Framework for Machine Learning, AISTAT 2023.\n\n[4] Training data influence analysis and estimation: A survey, Machine Learning, 2024.\n\n2. Data Pruning Methods:\nThese methods are relevant, while some of them directly address problems similar to identifying detrimental samples:\n\n[5] Robust and Fully-Dynamic Coreset for Continuous-and-Bounded Learning (With Outliers) Problems, NeurIPS 2021.\n\n[6] Robust Data Pruning under Label Noise via Maximizing Re-labeling Accuracy, NeurIPS 2023.\n\n[7] Feature Distribution Matching by Optimal Transport for Effective and Robust Coreset Selection, AAAI, 2024.\n\n[8] Instance-dependent Early Stopping, ICLR 2025.", "other_strengths_and_weaknesses": "**Strengths:**\n1. The paper is a good read, and located everything on their way.\n2. Tthe authors smartly narrowed down the problem. Instead of trying to calculate exactly how much each sample influences the model (like traditional methods do), they simply focus on identifying which samples are harmful. This simplification turns a complex calculation into a straightforward binary problem.\n3. The proposed methd tested on CV/NLP/LLM, and it works.\n\n**Weaknesses:**\n\nInfluence functions provide a richer quantification (in float) of each sample's importance, potentially enabling a wider range of applications beyond sample selection. In this sense, it might seem reasonable that these methods aren't directly comparable to simpler sample selection techniques. \n\nHowever, While the authors cleverly narrowed down the problem to avoid the computational complexity of influence functions, this simplification create the need for broader comparisons. \n\nThe paper would be in stronger position if it included comparisons with: sample selection methods for learning with noisy labels and data pruning for training efficiency. These methods may have similar objectives (identifying samples to remove for different reason) but use different approaches.", "other_comments_or_suggestions": "1. Moving table of runtime evaluation to the main text, which is a key contribution of the work.\n2. Minor typos and formatting issues:\n   - Line 116: \"as a the discrete version\" → \"as the discrete version\"", "questions_for_authors": "1. For the LLM influential data identification task, can iForest estimators scale to different tasks with many classes?\n\n2. Have you explored using other outlier detection algorithms beyond iForest and L1/L2 norms? \n\n3. The approach currently requires computing gradients for all training samples. Why not considered approximation or sampling technique?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "O3QdMvJrxk", "reviewer": "Reviewer_MZJ6", "summary": "This paper introduces a novel approach called \"Outlier Gradient Analysis\" for identifying detrimental training samples in deep learning models. The authors establish a conceptual bridge between influence functions (a traditional method for assessing training data impact) and outlier detection in the gradient space. The key innovation is transforming the computationally expensive task of calculating influence functions, which requires inverting the Hessian matrix, into a more efficient outlier detection problem in the gradient space.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer MZJ6, \n\nThank you for your efforts in reviewing our work, we are grateful for your insights. We provide answers to the questions raised, below:\n\n- **Although this work conducted experiments on LLMs, I find it strange that they only used LLMs for classification tasks. It would make more sense to experiment with LLMs' generation tasks. This is my biggest concern, and if the authors can address this concern, I would be happy to raise the score.**\n\n    Thank you. We would like to point out that the current LLM benchmarks are not classification tasks, but generation tasks. Each of the 3 influential data identification tasks (Math With Reasoning, Math Without Reasoning, and Sentence Transformations) we considered from past work (Kwon et al, 2024) have 10 classes/categories of subtasks (e.g. Sentence Transformation can have 10 different types of natural language transformations and Math problems can have 10 different categories of word problems) but are still generation tasks. More details regarding these benchmarks are provided in Appendix B.1.4 and B.1.5. In general, we agree with the reviewer that one of the challenges associated with influential data identification in LLMs is the lack of more complex and varied benchmarks. This is currently an evolving field, and designing benchmarks is challenging because ground-truth influence labels need to accurately reflect the model's inductive bias for a test sample (i.e. the model should find the training samples most influential for a particular test example). Past work does this by making the train-test problem sub-categories very similar. We are now working on designing better LLM influence identification benchmarks for future work, and hope to test our outlier gradient analysis methods on these benchmarks as well.\n\n___\n\n- **Sensitivity to outlier detection algorithm. The performance of the method depends on the choice of outlier detection algorithm and its hyperparameters. While the paper explores different options (iForest, L1/L2-norm), a more systematic analysis of this dependency would be valuable.**\n\n     Thank you for the great question. \n\n     Regarding outlier analysis algorithms, in the paper, we have utilized 4 outlier analysis algorithms: iForest (main paper), L1 norm (main paper), L2 norm (main paper), and OneClassSVM (Appendix C.9) for outlier gradient analysis. For all 4 of these algorithms, the general trend of outlier gradient analysis improving model performance against competitive baselines in the noisy learning regime can be observed. Our primary aim in choosing these algorithms was their high computational efficiency and minimal number of hyperparameters.\n\n     Regarding hyperparameter sensitivity, we had provided details and additional experiments on hyperparameters in **Appendix C**, which we also discuss below. More specifically, our outlier analysis algorithm has two hyperparameters: (1) the trimming budget $k$ which is the number of samples to remove, and (2) the hyperparameters of the outlier detection algorithm being used (e.g. iForest). \n\n    1. For the first hyperparameter of the trimming budget $k$, we conduct additional experiments while varying the value of $k$ from 2.5% to 12.5% for all 4 noise settings of CIFAR-10N. These results are provided in **Table 5** of **Appendix C.2**.  As can be seen, the highest values across each noise regime are obtained by outlier gradient analysis (L2 norm thresholding at 12.5% for Aggregate and Random; and L2 norm thresholding at 2.5% for Worst), indicating its broad suitability. These results also show that the budget of 5% is a good choice for the trimming budget, leading to desirable performance in most cases.\n\n    2. The second hyperparameter choice is only a facet of the iForest outlier analysis algorithm and constitutes the number of trees being used in the algorithm. Note that this is because for the L1 and L2 norm thresholding approaches, we do not have a norm threshold that needs to be chosen manually, since setting the budget automatically decides the threshold. For the iForest algorithm, we have provided results for varying the number of tree estimators on CIFAR-10N in **Table 8** of **Appendix C.4**. As can be observed, the performance of outlier gradient analysis remains stable across the board when the number of trees/estimators are varied, indicating low sensitivity of this hyperparameter to final results obtained.\n\n___\n\nThank you once again for helping improve our paper, we appreciate it.", "claims_and_evidence": "The paper makes several key claims, which are generally well-supported by evidence:\n\n1. **Detrimental samples can be identified as outliers in the gradient space**: The authors provide strong theoretical justification through Observation 3.1 and Hypothesis 3.2, establishing that detrimental samples are typically a minority in the training set and can be detected as outliers in the gradient space. \n\n2. **Outlier Gradient Analysis is more computationally efficient than traditional influence functions**: The authors provide empirical evidence through running time comparisons (referenced in Section 8 and detailed in Appendix C.3), showing that their method is significantly faster than influence function approaches that require Hessian computation or approximation.\n\n3. **Outlier Gradient Analysis performs competitively or better than existing methods**: This claim is well-supported through extensive experiments across multiple domains:\n   - On synthetic datasets, the method achieves 96-98% accuracy in identifying mislabeled samples, outperforming all baselines (Table 1).\n   - On CIFAR-10N and CIFAR-100N, the method consistently ranks among the top performers across different noise settings (Table 2).\n   - On NLP fine-tuning tasks, the method outperforms all baselines on 3 out of 4 GLUE datasets and matches the best baseline on the fourth (Figure 3).\n   - On LLM influential data identification, the method achieves perfect scores for both AUC and Recall metrics (Table 3).", "methods_and_evaluation_criteria": "The methodology is sound and well-justified. The authors clearly explain the theoretical foundation of their approach, establishing the connection between influence functions and outlier detection in the gradient space. The transformation is elegantly formulated and the implementation details are thoroughly described.\n\nThe experimental setup is comprehensive, covering a diverse range of applications and model architectures. The authors also conduct ablation studies on key hyperparameters and provide running time analyses to demonstrate computational efficiency.", "theoretical_claims": "The paper makes several theoretical claims, primarily in Section 3, which establishes the connection between influence functions and outlier detection in the gradient space.", "experimental_designs_or_analyses": "The experimental designs are thorough and well-executed. The authors evaluate their approach across a diverse range of applications, model architectures, and datasets, demonstrating its versatility and effectiveness.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "1. Although this work conducted experiments on LLMs, I find it strange that they only used LLMs for classification tasks. It would make more sense to experiment with LLMs' generation tasks. This is my biggest concern, and if the authors can address this concern, I would be happy to raise the score.\n\n\n2. Sensitivity to outlier detection algorithm. The performance of the method depends on the choice of outlier detection algorithm and its hyperparameters. While the paper explores different options (iForest, L1/L2-norm), a more systematic analysis of this dependency would be valuable.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "N/a", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes an efficient method to identify detrimental training samples by detecting outliers in gradient space, thereby offering a Hessian-free alternative to traditional influence functions.
This submission received strong support from multiple reviewers:
- Reviewer p9JH praised the originality and computational efficiency of the proposed method. 
- Reviewer r7gY highlighted the clarity of problem scoping and its broad applicability across CV, NLP, and LLM tasks.
-  Reviewer MZJ6 noted the elegance of the transformation and robustness of empirical results.
- Reviewer 91NL appreciated the simple yet powerful design and efficiency of the method.

Before the rebuttal, Reviewers raised concerns about the lack of validation of the key hypothesis on real datasets, limited comparison with methods from noisy label learning and data pruning, and unclear applicability to generation tasks in LLMs. These concerns were thoroughly addressed by the authors through additional experiments (e.g., iForest validation on SST2 and QNLI), clarifications on benchmarks used in LLMs, and further discussions in the rebuttal and appendix. Reviewers acknowledged and appreciated the authors’ responses.
Therefore AC recommends acceptance of the paper.
Decision: Accept (oral)