Faithful Group Shapley Value
Authors: Kiljae Lee
Ziqi Liu
Weijing Tang
Yuan Zhang
Venue: NeurIPS 2025 poster ()
Keywords: Shapley value
data valuation
group evaluation
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Data Shapley is an important tool for data valuation, which quantifies the contribution of individual data points to machine learning models. 
 In practice, group-level data valuation is desirable when data providers contribute data in batch.  However, we identify that existing group-level extensions of Data Shapley are vulnerable to \emph{shell company attacks}, where strategic group splitting can unfairly inflate valuations.  We propose Faithful Group Shapley Value (FGSV) that uniquely defends against such attacks.  Building on original mathematical insights, we develop a provably fast and accurate approximation algorithm for computing FGSV.  Empirical experiments demonstrate that our algorithm significantly outperforms state-of-the-art methods in computational efficiency and approximation accuracy, while ensuring faithful group-level valuation.

Faithful Group Shapley Value
Kiljae Lee" The Ohio State University
Ziqi Liu" Carnegie Mellon University
Weijing Tang
Carnegie Mellon University weij peijjint@@nddeee cmu, edu
lee. 10428@osu. edu
ziqiliu20andrev. cmu. edu
Yuan Zhang
The Ohio State University rzhaangf@sstat.. osu. edu
Abstract
Data Shapley is an important tool for data valuation, which quantifies the contribu- tion of individual data points to machine learning models. In practice, group-level data valuation is desirable when data providers contribute data in batch. However, we identify that existing group-level extensions of Data Shapley are vulnerable to shell company attacks, where strategic group splitting unfairly inflate valuations. We propose Faithful Group Shapley Value (FGSV) that uniquely defends against such attacks. Building original mathematical insights, develop provably fast and accurate approximation algorithm for computing FGSV. Empirical exper- iments demonstrate that algorithm significantly outperforms state-of-the-re methods in computational efficiency and approximation accuracy, while ensuring faithful group-level valuation.
Introduction
As data become increasingly crucial in modern machine learning, quantifying its value has significant implications for faithful compensation and data market design [29] [39]. The Shapley value, a foundational concept from cooperative game theory [30], stands out the unique valuation method
satisfying four desirable axioms for faithful data valuation 7 [4] Consequently. has been applied
diverse applications, including collaborative intelligence 22 25
and copyright compensation 35
and quantifying feature importance in explainable Al 226]
Many real-world scenarios demand evaluation of data
sets instead of individual data points. In applications like data marketplaces [39] or compensation alloca- tion for generative Al 35), data are contributed by owners who possess entire datasets, making group- level data valuation a natural choice. A more techni- cal motivation is that individual-leved Shapley values are often computationally challenging to approximate for big data; while group-level valuation is much faster and can provide useful insights
5,
FGSV
0.1
A
0.0
2
Number of Groups
Number of Groups
Figure 1: Left: GSV; right: FGSV (our method), Vertical span: valuation. Group A is fixed; group B engages increasing de- grees of shell company attack (left~rright). Detailed experimental set-up in Appendix B
[17]. ex- plainable AI, group-level feature importance report- edly provides more robust and interpretable valuation 32
*Lee and Liu equally contributed; they are co-first authors were listed alphabetically. CCoresppnniig author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

As group data valuation frameworks are increasingly used in real-world scenarios such as data markets and copyright compensation, their robustness against adversarial manipulation becomes important. Prior studies on attacks and defenses in data valuation have focused primarily on the individual-leve data valuation, such as the copier attack that duplicates existing data to unjustly inflate value [0]. In contrast, we identify a new vulnerability unique to group data valuation, which has been largely unexplored in literature. Existing extensions of the Shapley framework to group data valuation treat each pre-defined group as an atomic unit and then apply the standard Shapley value formulation [1]] 20 35 32), which we refer to as Group Shapley Value (GSV). However, we demonstrate- both theoretically and empirically- thatt this approach suffers from susceptibility to strategic manipulation through partitioning. Consider the valuation of a fixed data group A. As shown in Figure| II, partitioning the remaining data points into smaller subgroups reduces the GSV for A, despite no change in data content. In other words, malicious players may exploit the loophole in GSV by splitting their data among puppy subsidiaries, vulnerability we coin shell company attack.
To address this issue, we propose faithfulness axiom for group data valuation, such that the total valuation of the same set of data remains unchanged, regardless of how others are subdivided. Based on this, we introduce the Faithful Group Shapley Value (FGSV) for a group as the sum of individual Data Shapley values of its members, and prove that it uniquely satisfies the set of axioms that are desirable for faithful group data valuation. Figure T demonstrates that FGSV effectively defends against the shell company attack.
While FGSV safeguards faithfulness, its exact computation requires combinatorial computation of individual Shapley values. Although numerous approximation algorithms for individual Shapley values have been developed [ 14 34
38 24 27). simply applying them and summing up results in each group is slow for large groups and may compound approximation errors. Importantly, we proved that a small subset of terms dominate in FGSV's formula. As a result, we developed an original algorithm that directly approximates FGSV fast and accurately. Our numerical experiments demonstrate its computational efficiency and approximation accuracy against summing up individual Shapley values computed by state-of-the-art (SOTA) methods. We also applied FGSV to faithful copyright compensation on Stable Diffusion models for image generation.
26
3
2 Preliminaries: individual and group Shapley values
Individual Shapley value (SV). Let D (zI...., 2n} E 2 denote the training data, where := [D]. Let S C [n] be an index set of cardinality s == 1S), and write S := (z: : E S}. A utility function US) assigns a performance score (such as classification accuracy) to method trained based on data S. To simplify notation, we may refer to "U(S)" by index as "U(S)" and write them interchangeably. The individual Shapley value of data point is defined as
[S - |S| - 1)! (U (1)) - US)}
SV(i) =
Σ 8CIN
(1)
na!
The widespread adoption of Shapley value stems from its strong theoretical foundation that it uniquely satisfies four desired axioms, called null player, symmetry, linearity, and efficiency. We will review
these principles as part of our axiomatization for group Shapley value in Definition 2
Group Shapley value (GSV). As mentioned in Section 2 most group-level Shapley values 15 35
32 adopt the so-called group-as-indive individual (Gal) approach. Suppose the entire data set is partitioned into (K + 1) disjoint groups: 'D = So U S U... U Sg. in which, So C [r]] is the group we aim to evaluate. The group Shapley value (GSV) of So, as in 15 32
is defined as
GSV(Sa)=
Σ IC
!!!(K !T)
{U(( (Uker } U.)))))
U U' Sk Sk)}
(2)
(K + 1)!
Clearly, 2 is a "set version" of TT. Thus GSV also satisfies the four axioms for SV at the group level. However, it is questionable whether these axioms, originally formulated for individual-level valuation, are appropriate for groups.
Fairness issue with GSV. The GSV valuation of Sy as in can be impacted by how the rest of the data are grouped. serious consequence is that GSV is prone to the shell company attack: splitting a group into smaller subgroups will increase the total valuation earned by the same set of data points. We have seen an illustration Figure in Section T Now we theoretically formalize this observation.

---

Proposition 1 (Shell company attack), Let P be the underlying data distribution over the sample space Z, and write Pa for the s-fold product distribution; thus ~~ P denotes an i.i.d. sample S= == ..2=== E 2a with ~ P. Let (s) = -s.pp= [U()] denote the expected utility for data (which only depends on = ((]) Now we split a group Sy. into two non-empty subgroups Sy and St (i.e., St U Sk. S 5% 0, and 5/ St + (). If (s) satisfies prudence condition:
(+)()) = Ü + 3) - (5 + 2) + 30 (s 1) U(+)
then
BIGSV(SL)) < B[GSV(S)) (SG)V
Condition
is a familiar concept in economics, characterizing risk-aversion behaviors under It is also observed in machine learning. where the performance of learning method
uncertainty g
saturates as the same type of data repeatedly come [8] 12]
3 Our method
3.1
Faithfulness axiom and Faithful Group Shapley Value (FGSV)
Motivated by the faithfulness issue, we introduce a set of axioms that formalize desirable principles for faithful group data valuation. We first axiomatize group-level data valuation that generalizes the Shapley's 's four axioms for individual valuation.
Definition 1 (Group data valuation). For data D = {zi..... } utility U and partition II (S Sk} such that Sk, n kkz 0, S k k2 S n and Sy U...U SK [n), a group data valuation method Vu),,n(-) IT + TR is mapping that assigns real-valued score to each Sy E II.
Next, we propose set of axioms that faithful group data valuation method should satisfy.
Definition 2 (Axioms for faithful group data valuation). A group data valuation VU.D,n called faithful if it satisfies the following axioms for any dataset D, utility U, and partition II:
1. Null player: For any S II, if every subset S S satisfies US" U S') U(S") for all S" C [m] \ S", then VU,D,I =
2. Symmetry: For any St, S2 II. [S = [22), there is a bijection a :1 Sz. s.t. US""
U(S" (O(())) for all - S1 and S" S [n] \ (8' (S())) then VU,D,n(Si) = VUDD.
3. Linearity:
For any utility functions U1, U2 and scalars on 02 R. we have for all S II Va (nnUitaaUs,D,n($) 0, + (2,
Efficiency: For any partition II = (S,...., Sk), we have Σk_ VU,D = U(n)).
5. Faithfulness: For any group S E IT n Il,, we have VUDD,II (S) (U),
Notably, null player and symmetry require group valuation to faithfully reflect the contributions of its individual members. They are strictly weaker assumptions than their Gal counterparts. For example, a group assigned zero value in Gal can receive nonzero value under axioms if some of its members have marginal contributions, but not the other way around. Linearity and efficiency standard group-level extensions. Our newly introduced Axiom 5 requires that group's 's value is determined only on its own competitive merit and rules out the unfair competition means of shell company attack.
turns out that there is a unique group data valuation method that can satisfy all axioms in Definition 2 simply add up all member's 's individual Shapley values.
Theorem 1. The only group data valuation method vU.D.n that satisfies all axioms Definition (S) = Eies (V)),, where (V) is the individual Shapley value defined in (I.
In view of Theorem we propose Faithful Group Shapley Value (FGSV):
FGSV(S.) := Σ SV()).
(5)
3.2
Fast and accurate approximation algorithm for FGSV
The exact evaluation of FGSV requires combinatorial computation. develop a feasible approxima- tion method, make series of key mathematical observations leading to efficient algorithm.

---

To start, from the definition of FGSV and I we see that FGSV(S)) is complicated linear combination of (S) terms, where S ranges over all subsets of [n]. Therefore, the first step towards simplification is to discover the pattern in the coefficient in front of each (SS) term.
Key observation 1. In FGSV(So). the coefficient of (S) depends on S and So only through the tuple (81, 8, 8o), where recall that so = [Sol and [S], and define 81 : |So n..
In other words, any two terms (S) and U'S') with |S| - |S'| and S0 n - So S'| share the same coefficient in FGSV (So)- This motivates us to aggregate these terms in our analysis. Let
d L,
{S |S| 8, |S = 81 collect all S'ee with the same 81) configuration, and define
ESEA,... U(S)
Essss= U(S)
81 "
8, 50,
(6)
AAs,s
When sampling subset 5 [ [n] of size without replacement, the size of S So, which denote as the boldfaced $1 to emphasize its randomness, follows a hypergeometric distribution:
P(s, =1 (:) (==at) (0) (*). Using this fact, can re-express FGSV in terms of μ.
Lemma 1. Let 81 (n, 50, s). We can rewrite FGSV as
n-1
FGSV(S))
s0 -
U
Σ T(s), s=1
(7)
n
where
T(s) == BxI
n1
81
80 n2
81 s, so:
(8)
n
Instead of directly estimating T(s) via Monte Carlo, we discover two key observations that deepen greatly reduce computational cost.
understandings of (7) and (8). building which, Key observation The probability P(s1 = *1) decays exponentially in |81 - 880/n|.
Key observation 2 implies that T(s) is dominated by the values of 81 around its mean [[[s]] = 880 To deepen our understanding of T(s). for this moment, we informally deem μ as a smooth function of the continuous variable $1/s, with formal characterization provided later. Then, applying "Taylor expansion" of p (s1/s; s, so, so.n) n) around s1/a so/n leads to the following intuition.
Key observation 3 (Informal). T(s) ~ s (ss//)) (1- su/n)p' (/)))((()) (so/ nn; s, sp,
Key observation 3 reveals that, under suitable conditions, the term T(s) can be efficiently estimated by evaluating the derivative p' (::s, Sp, n) at a single point su/n.
Next, we formalize the above discoveries into rigorous mathematical results.
Assumption (Boundedness). For all s N and Z", (U(S) S C for a universal constant C. Assumption 2 (Second-order algorithmic stability of utility). There exist constants C. >> 0 and >> 0 such that for all E N. S E Z' and 21, 21 22, 2/2 Z,
( 213) - USSU [21, x2)) - (S U {21, +/1) + UUSU +631 - Cs -3/24u))
Assumption is a standard regularity condition commonly adopted in the data valuation literature 114 33], and Assumption AssumptionnJintroduuee introduuces mild second-order stability requirement. In Section 3.5 we will show examples that Assumption] is satisfied by some commonly used utility functions.
Theorem 2. Under Assumptions
7 and
2 for each E {l,...,, n - 1}, we have
T(s) n/(n 1) ao(1 an){ Ap(si//:: n) + (s-
(9)
where si |ssu/n]. ag == so/n, and Au( {): : Su. n) = uu( m su. su, n) p( (1: so. n).
Theorem consolidates Key observation 3 and, moreover, shows that its approximation error decays rapidly grows. For large s, we use (9) design the estimator for T(s). Yet, some extra care needed. In principle, each ua( (////// So. n) can be estimated by subsampling S from As.e.-
1 m
(81 3 8, So. n1 pm
Σ U(SS)), where p5 iid Uniform(<a...)) m j=1
(10)
s

---

S, However, estimating yu( |1 s, su. n. and uu( s, Su. n) separately can be statistically inefficient. as the noise from two independent Monte Carlo estimates could mask the signal in their difference- especially when the true gap is small for large s. Following the variance-reduction technique used in stochastic simulation [21]: we propose to estimate Ap directly using paired Monte Carlo terms:
Apm ( 5,, 50, m)
1 m
m
{U(
U - })
(II)
where the tuple ((5(),
, (00 ) is i.i.d. sampled from (S, |S| = s, 1 Sol = 81, 11
So \ S, E 1%)5 {S}
When s is small and the approximation becomes less accurate, we instead estimate T(s) via direct Monte Carlo using (8) and (TO).
We formally present our method as Algo-
rithm I Later, our Theorem H will pro- vide quantitative guidance on choosing this threshold for deciding whether small or large.
Algorithm Approximate (SSV(
Require: Dataset D, group Sg, threshold 6, subsample sizes m,, m22
1: Initialize
[D], 80
=Sol and oo so/n.
3.3 Computational complexity
2: for 8 = to n do
if' < then
Following the convention, we measure computational complexity by the number of utility function evaluations required for a given approximation accuracy.
4: Estimate (m; s, n) for each E [max{0, s+ so- fiij,,iins,,, so3] by Eq. (TO).
5:
Compute T(s) by (B. replacing μ by Am..
6:
else
Definition 3 ((e, 8) -paprroxxmmatio) For
7:
s + -s
target vector 8 E Rd an estimator 0 is called (c, 8) ppproxiimaainn, if (
8:
Estimate Ap (si, 8 8, 80, n) by Eq.
9: 7(s) + n- a00 ao) Ap ( S,, Su, n).
1| 2 c) S
10: end if
11: end for
Our theoretical analysis for approximating Ts)) relies on the stability of the utility function U. Specifically,, we employ the concept of deletion stability to quantify the maximum change in the utility function when a single data point is removed
12: return du U(2)) E
Definition 4 (Deletion Stability). A utility function U is B(s)) -deettinnn stable for a non-increasing function 3 : N + R if
((SU(z)) U(S) ( (Bs)..
for all & E N. S E 2 and z E Z.
The regime B(s) = ((1ss) for deletion stability is commonly assumed in the literature on individual and in the analysis of algorithm stability 1
Data Shapley approximation 36 37
Theorem 3. Suppose the utility function U is -edsstinltttion stable, then Algorithm 7 guarantees that for any truncation threshold and sample sizes m1, m2, with probability at least 8,
log(n/o) m1
log(n/0) log + ano(1 ox))
FGSV(Ss) - FS)V(S.) S
+ ao(1 =oo)
m2
Specifically, choosing
8 1/2
4:2
log (n/0), m2 = max ( - -n)) (oooo//(()(()()))))))))))))
m. x
yields an (aproxxaiiii of FG)V(S.) with O (n max {1, (ao ( utility evaluations.
Theorem implies that our algorithm requires only O(n Poly n)) utility evaluations to achieve an (c, 0) approximmtion for the FGSV of a group Sn whose size scales as constant fraction of n.
5

---

To compare our method's 's computational complexity with existing works, we notice numerous recent
efficient algorithms for approximating individual Shapley values [4
34
24
26
3
27
23
38
They target an (c, -pprroxxxinnnn on the full individual Shapley-value vector |0 B112. where and 0 is the approximation for 0. The SOTA method achieves this
0 := (S guarantee in O(ne -2 (og((/6)) utility evaluations. Approximating FGSV(Se) = Eies, 0 by simply summing up individual approximations can lead an additive error bounded by / --12- Thus, achieving the same (c, d)appooxximiioonnn on FGSV(Se) requires tightening the error tolerance to v55. increasing the sample complexity to Pooy ni). By directly targeting the group objective, our method avoids this quadratic blow-up and offers significant speed-up over the SOTA. continues to outperform SOTA individual based methods even when evaluating multiple groups in parallel, provided that the number of groups is o(n).
3.4 Utility function values for small input sets
In some machine learning scenarios, US) might not be well-defined for small |S]. For instance, methods such as LLM's would only produce meaningful result from sufficiently large data sets. Meanwhile, Shapley value emphasizes the contributions from small games, therefore, we cannot simply ignore the small |S] terms in the computation of FGSV Z One way is to use variants of Shapley value, such as beta-Shapley and Banzhaf, that down-weight small [S] terms, but these alternatives do not satisfy all axioms for faithful group data valuation per Theorem [ The other way is to fill in (S) for small S with random or zero values. However, these ad-hoc solutions lack principle and may risk significantly distorting the valuation.
To motivate our approach, we make two simple observations. First, when S 0, the trained method should behave as if it were trained on pure noise, corresponding to a baseline utility value. Second, big-data reliant methods might not value small 5 very differently than baseline, regardless of their content. In this context, both quality and quantity of data matter for valuation.
Our remedy very simple. We set a threshold for input size, denoted by B, such that US) is always well-defined and meaningful for |S| > B. For example, in a linear regression with p predictors, observing that (S) is undefined for SI < p. we may set B cp for some constant 2 If |S| < B, we inject B- - [S| non-informative data points, to elevate the input size to B; otherwise no change made to (S). As a concrete example for the non-informative distribution, consider a supervised learning scenario with data D {(x2, ys) v))) } Here, we can randomly shuffle ys 's and use the resulting empirical data distribution as the non-informative distribution Pnull- Clearly, we can expect that as the size of informative data (i.e., [S)) increases, less amount of non-informative data will be injected, and (S)) gradually becomes non-baseline. For further theoretical and algorithmic
details, see Appendix C
While our approach was inspired by the feature deletion technique in machine unlearning. to our best knowledge, we are the first to adapt the idea for data Shapley, in distinct fashion.
3.5
Examples of second-order stable algorithms
Among the conditions our theory needs, Assumption is arguably the least intuitive. To demonstrate that Assumption is in fact quite mild, here, we verily that it holds for two important applications.
3.5.1 Stochastic Gradient Descent (SGD)
SGD on a training set S = {2.) minimizes the empirical loss = ΣE E(w; 2,). Start- ing from an initial wo, SGD runs for T' steps, each step & E [T] updating Wt W:-1 Ore L Eier, VÉ(W;-15 24) with learning rate a,, where the mini-batch I, of size m is drawn indepen- dently and uniformly from [n].. Denote the final output by wr = w(2), . AIy). The performance of WT can be represented as some scalar function au-) (e.g., classification accuracy on test data).
Define the utility as the expected performance:
USS) := Ey,... [u(WT)].
(12)
Assumption 3. Suppose E and u satisfy the following regularity conditions. All conditions hold for some constants C, L, B.p > and all w, w' 2.
1. (Smoothness of u) [u(w)]] < C and [|Vu(w")- - Vu(we)l s C'llw' - -wll-
2. (L-Lipschitz of E) [6(w': ( E(w; 2)1 S Lllw' - w|l-

---

3. smoothesss of E) [ (=l(w - Vul(w; - Bl|wo - wwll-
4. (Smoothness of E's Hessian) ((w';))) (w:; =)]l pllw 10/-ww) w|l-
Assumption 3 imposes mild smoothness on the utility function u, while the remaining assumptions concern the loss function f. Compared with the classical analysis of SGD stability by Hardt et al.
[1] the only additional requirement is Assumption 33,, which ensures smoothness of the Hessian. This condition is mild and is satisfied by standard smooth loss functions, such as the squared loss, when the prediction function is twice continuously differentiable in terms of parameters w.
Proposition 2. Set ae x 8 -- /t, m X 8" and T x S where constants T > 0 and T2, T3 2
Suppose := 2T 72 1/2 2 0. Under Assumption 3
the utility function (2 satisfies:
(21, - (21, (2) US (21, + U(S (=2 2 S 8 (3/2++))
3.5.2 Influence Function (IF)
The influence function (IF) method [9 19 considers the following regularized empirical loss:
0s arg min (): arg min s
Σ
((0)2) + (A/2) [1012]]
(13)
ZES
Like in Section
3.5.1 suppose the utility can be written U(S) = u((s). Under mild conditions
(see Proposition B). standard IF theory 99 19 implics that
US) s - Vou(Os) H (e((0): ve((s:z1))
(14)
for any 21, z11, where Hās is the Hessian of L evaluated at Ös. This yields the following proposition.
Proposition 3. Suppose is continuously differentiable with L-Lipschitz and bounded gradient. Assume that the loss function E(0; z) is convex in O, three times continuously differentiable with all derivatives up order three uniformly bounded. Then for any 21, 21, 22, 2/2 2,
- (21,
(2) +11 -US
U(S u (2) S
(15)
Proposition
3 is not surprising in view of (14). as the main terms cancel out on the LHS of (15)
4 Experiments
We empirically compare our method (FGSV) to the approach of first computing individual Shap- ley values using SOTA methods and then summing them form a group valuation. The results demonstrate the superiority of our method in both speed and approximation accuracy and its faithful- ness under shell company attack in applications such copyright attribution in generative Al and explainable AI. We report the key findings in the main paper and relegate full details to Appendix B
4.1 Approximation accuracy and computational efficiency
In this experiment, we compare our method the following benchmarks: (1) Permutation-hasee estimator 7 that averages marginal contributions over random data permutations; (2) Group Test-
ing-based estimator [14 34 that uses randomized group inclusion tests estimate pairwise Shapley value differences; (3) Complementary Contribution estimator (38) that uses stratified sampling
of complementary coalitions: (4) One-for-All estimator (4 that uses weighted subsets and reuses utility evaluations; (5) KeAnelSHAP 26 a regression- based method with locally weighted samples; (6) Unbiased KernelSHAP 3 KerneISHAP with a bias-correction; and (7) LeverageSHAP 27
that speeds up KemeISHAP by weighted sampling based on leverage scores.
Experimental setup. We consider the Sum-of-Unanee Unanimitty (SOU) cooperative game 24 where the individual Shapley values have a closed- form expression. Specifically, the utility function is defined as
U(S) = Σラ= a2 LA,,, and the corresponding Shapley value for player E [n]] is given by SV(i) E/ [A,| LEA, Here, each subset Aj is generated by sampling random size uniformly from 1 to n and then drawing that many players without replacement. We set n² and the coefficient O; as the average of the weights of all players Ay, where each player has weight mad 4) We
7

---

Pemmontioo
Group Treding
Comppeemen
Creeltokil
Undioowe KerreShA
64
126
256
10
AUCO
10'
10
10"
10
51
S4
S1
S
Sx
10
10
10"
ARE
10"
(5)
20
400
50
25
200
Figure 2: Performance comparison in the SOU game. Top: Our method (FGSV) achieves the lowest AUCC and ARE across all problem sizes. Bottom: Our method costs the lowest runtime per iteration.
partition all players into 4 groups based on their indices: S = {i k (mood4)) for k E [4], and goal is to estimate the group value FGSV(S;) Eiss, SV(1). Given fixed budget of 20,000 utility function evaluations, we record the absolute relative error of the FGSV estimate every 200 iterations for each method. We summarize convergence behavior using the Area Under
the Convergence Curve (AUCC), defined as: AU)C(S}) 1
_.0
FGSV(S.) -FGSV (GSVV(2000))
(200-1) FGSV(Ss)
(Sa)
100
which captures both speed and stability of convergence. We also report the Absolute Relative Error
(ARE) of the final estimate: ARE(S,) (GSs((S)-FCCS) FGSV (20000) (St)
Lower AUCC and ARE
FGSV(SR)
indicate faster convergence and better accuracy, respectively. We record the average runtime per iteration for each method.
Results. Figure 2 summarizes the average performance over 30 replications for n E (64, 128, 256}. The top two rows together indicate that our method shows overall superior performance across all problem sizes n, exhibiting both the lowest average AUCC and ARE. The bottom row suggests that, while using the same utility evaluation budget, our method is among the fastest. contrast, baselines such as Group Testing, KernelSHAP, and Unbiased KernelSHAP incur substantial higher computational overhead, due to internal optimization processes. Overall, our method achieves both faster convergence and improved computational efficiency, which demonstrates the benefits of directly estimating the group value rather than aggregating individual Shapley estimates.
4.2 Application to faithful copyright attribution in generative Al
Group data valuation is important for fairly compensating copyright holders whose data used to train generative AI models. Existing approaches, such as the Shapley Royalty Share (SRS) proposed by (35, adopt the Gal approach based GSV. Given a partition of the training data into K disjoint groups Si,... SK. SRS is defined as SRS(S,; : Σ GSV(S):=gmm))
GSV
However, as discussed
Section 2, GSV prone to the shell company attack. To address this vulnerability, we propose the Faithful Shapley Royalty Share (FSRS) that replaces GSV with our FGSV to faithfully reward individuals group by their contributions, not by tactical grouping strategies:
FGSV(SE; Tgen)
FSRS(Sk; Dgea) = ΣK (SSV
Experimental setup. Following
35 we fine-tune Stable Diffusion v1.4 28 using Low-Rank
Adaptation (LoRA; (13) on four brand logos from FlickrLogo-27 [66] The utility ((:))())))) is the average log-likelihood of generating brand-specific images (gen) using the prompt logo by [brand name]" (see example images in Panel (a) of Figure 3). We compare SRS and FSRS under

---

two grouping scenarios: (1) 30 images from each brand form a single group, and (2) the Google and Sprite datasets are each split into two subgroups (20/10 images), launching shell company attack. Importantly, the total data per brand remains unchanged across two scenarios.
Prompt: "A logo by Google
loge by Google"
logo by Sprite'
"A logo by Starbucks" logo by
Gogs Go Googg
0.4
&
Promp:: "A lopo Sprite"
SijRie
sut
0.c
Google Spriea
Starbucks
Vestfoore
Google Sprie
Starbucks
Vodafone
Google Sprite
Starbucks
Vadafone
Google
Spriee
Starbucko
Vedafone
Premeo: "A logo by Starbucks
(b)
loge by Google
logo by Sprite
"A logo by Starbucks
by Vodafone
Promot: "A logo by Vodafone"
ncorliee
Google
Sprite
Starbucks
Vodafone
Google
Sprtss
Starbucks
Vodafone
Goople
Sprite
Starburks
Vodafone
Google
Sprite
Starbucks
Vadalona
(a)
(c)
Figure 3: Comparison of SRS and FSRS for copyright attribution. (a) Example images generated using brand prompts. (b) Shapley Royalty Share (SRS, (35)) based on GSV. (c) Faithful SRS (FSRS, method) based on FGSV. Blue bars: valuation under Scenario 1 (single group per brand); orange bars:
valuation under Scenario 2 (Google/Spritee data each split into size-20/10 subgroups, colored in dark and light orange).
Results. Figure 3 iillustrates the impact of the shell company attack copyright attribution under SRS and FSRS. Each subplot corresponds to a brand-specific prompt and shows the royalty shares assigned to each brand. Conceptually, the brand corresponding the prompt should receive the highest royalty share. Panel (b) shows that applying a shell company attack that favors the Google and Sprite groups indeed inflates their total SRS shares substantially. while reducing others', despite the contents contributed by each group remain unchanged. This produces misleading results- for example, Google and Sprite receive higher overall SRS than Vodafone under the "A logo by Vodaf one" prompt. In contrast, Panel (c) shows that FSRS yields consistent and stable valuations under the shell company attack. This demonstrates that FSRS mitigates the effects of strategic data partitioning and provides more faithful reflection of group contribution for copyright attribution.
4.3 Application to faithful explainable AI
Group data valuation is also crucial tool in explainable AI, providing interpretable summaries of data contributions at the group level- particularly in contexts where groups correspond to socially or scientifically significant categories. For example, 77 used GSV to quantify the contributions of data from different demographic groups to patient readmission prediction accuracy [31]. However, GSV's sensitivity the choice of grouping can cause group values to fluctuate dramatically under different data partitions, leading to inconsistent interpretations. To address this problem, we recommend practitioners use FGSV and empirically demonstrate that produces more consistent and reliable interpretations across variety of grouping configurations.
Experimental setup. We conduct our experiment on the Diabetes dataset (5), which contains 442 individuals, each described by 10 demographic and health-related features (e.g., sex, age, and BMT). The task predict the progression of diabetes one year after baseline. We construct 7 grouping schemes, partitioned by all non-empty subsets of the variables sex, age, and BMI, excluding the trivial no-partition case. For the continuous variables age and BMI, we discretize each into three quantile- based categories. Overall, we will have between 2 to 18 total groups. For each grouping scheme, we compute GSV exactly and estimate FGSV via 30 Monte Carlo replications. Our predictive model ridge regression, and we measure utility as the negative mean squared enror on a held-out test set, with the null utility set to the variance of the test responses. Thus, higher group valuations indicate greater contributions to the model's predictive accuracy. To compare category- different grouping schemes, we aggregate group values as follows: for a given variable (c.g., sex), we sum the (F)GSVs of all groups that include that category. This allows for consistent cross-scheme comparisons, where one would expect a category to receive stable valuations after aggregation across different grouping strategies if the valuation method is robust.
contributions across
Results. Figure visualizes the aggregated category-level values from GSV (top row) and FGSV (bottom row) across various grouping schemes. FGSV produces significantly more stable and

---

Sex-wise Values
Age-wiis Values
3MI--wis Vallues
Female
Young
Mididie
Mediuum
High
(Aggregatoon GSV
0.4
0.19
0.20
0.10
0.18
0.16
0.16
0.15
0.12
(Aggrocated) RSSV
0.4
0.3
0.25
0.2
0.0
0.00
0.2
Sel
Sox x
Age
Sex BMI x Age BMI
Age
Sex Age
Age BMI
x Age BANI
BMI
Sex BMI
Age BMI
Sex Age BMI
Comparison of GSV (top row) and FGSV (bottom row) in regression task for explainable AL. Each column aggregates category-level values for specific variable: sex (left), age (middle), and BMI (right). Shaded areas represent 111 standard deviation across 30 replications.
Figure 4:
consistent group rankings compared to GSV. For instance, in the age-wise plots (second column), GSV gives inconsistent rankings: each of the three age groups-"Young. "Middle." and "Old"- appears as the top-ranked group under at least one grouping scheme. This instability undermines the reliability of the interpretation. In contrast, FGSV consistently assigns the highest value to the "Young" group across all grouping schemes, demonstrating its robustness. Overall, FGSV provides more reliable explanations that are less sensitive arbitrary grouping schemes.
Conclusion and discussion
In this paper, proposed FGSV for faithful group data valuation. We showed that FGSV is the unique group valuation method that satisfies a desirable set of principles, including faithfulness, which ensures that group value remains unchanged to arbitrary re-grouping among other players, thereby defending against the shell company attack. Our algorithm also achieves lower sample complexity over SOTA methods that sum up individual Shapley value estimates, demonstrated through both theoretical analysis and numerical experiments. We further illustrated the robustness of FGSV in applications to copyright attribution and explainable AI, where it faithfully reflects and fairly rewards individual contributions from group members.
Beyond the shell company attack, there exists another unfair competition strategy, namely, the copier attack, in which a group may steal valuation from other groups by duplicating their high-value data points. An ad-hoc remedy is pre-process the dataset to detect and remove such duplicated entries before applying our FGSV method. In existing literature, [6] suggests designing the utility function using Pearl's "do operation". This defense can be incorporated into our framework, letting our method also defend against the copier attack; but such do-utility function is not always available. 100 shows that with a submodular utility function, Banzhaf (33) and leave-one-out can successfully discourage a genuine contributor from duplicating itself to gain higher total valuation; however, their method is prone to "pure infringers" who only copy from valuable data points without contributing original contents. Overall, it remains an open challenge to defend against the copier attack for general utility functions, while maintaining the defense against the shell company attack to ensure safe group data valuation.
Code
The code and instructions to reproduce the experiments are provided in the supplementary material httpt/ttb.ccmm/lllaaaaaaaaaattlp
and available at
Acknowledgements
Lee and Zhang were supported by NSF DMS-2311100 Liu and Tang were supported by NSF DMS-2..
10

---

References
[1] O. Bousquet and A. Elisseeff. Stability and generalization. Journal of Machine Learning Research, 2(Mar):499-522 2002.
[2] J. Castro, D. Gómez, and J. Tejada. Polynomial calculation of the shapley value based on sampling. Computers & operations research, 36(5):1726 2009.
[3] I. Covert and S.-I. Lee. Improving kernelshap: Practical Shapley value estimation using linear regression. In International Conference on Artificial Intelligence and Statistics, pages 3457-3465. PMLR, 2021.
[4] Deng and J. Ma. Computational copyright: Towards royalty model for ai music generation platforms. In ICLR 2024 Workshop on Navigating and Addressing Data Problems for Foundation Models, 2023.
[5] B. Efron, T. Hastie, I. Johnstone, and Tibshirani. Least angle regression. The Annals of Statistics, 32(2):407 2004.
[6] T. Falconer, J. Kazempour, and P. Pinson. Towards replication-roouus analytics markets. arXiv [econ.GN], Aug. 2025. URL http://arxiv wttg/////////a// http:///arrw..oogg/a//2230..... 06000
[7] A. Ghorbani and J. Zou. Data Shapley: Equitable valuation of data for machine learning. In Proceedings of the 36th International Conference on Machine Learning, volume 97, pages 2242-2251. PMLR, 09-15 Jun 2019.
[8] C. Gollier. The Economics of Risk and Time. The MIT Press, 2001.
[9] R. Hampel. The influence curve and its role in robust estimation. Journal of the American Statistical Association, 69(346):383-335 1974.
[10] D. Han, M. Wooldridge, A. Rogers, O. Ohrimenko, and S. Tschiatschek. Replication robust payoff allocation submodular cooperative games. IEEE Transactions on Artificial Intelligence, 4(5): (15):1114-111 11111111111.,11111 2022.
[11] M. Hardt, B. Recht, and Y. Singer.
Train faster, generalize better: Stability of stochastic gradient descent. In International conference on machine learning, pages 1225-1234. PMLR, 2016.
[12] Hestness, S. Narang, N. Ardalani, G. Diamos, Jun, H. Kianinejad, M. M. A. Patwary,
Y. Yang, and Y. Zhou. Deep learning scaling is predictable, empirically, 2017. URL https 7/arxiv. wrgg///ggg abs/1712 00409
[13] E. J. Hu, Y. Shen, Wallis, Z. Allen- Zhu, Y. Li, S. Wang, L. Wang, W. Chen, et al. Lora: Low-rank adaptation of large language models. ICLR, 1(2):3 2022.
[14] R. Jia, D. Dao, B. Wang, F. A. Hubis. N. Hynes, N. M. Gürel, B. Li, C. Zhang, D. Song, and
C. J. Spanos. Towards efficient data valuation based on the Shapley value. In Proceedings of the Twenty-Second International Conference on Artificial Intelligence and Statistics, volume 89, pages 1167-1176, 16-18 Apr 2019.
[15] M. Jullum, A. Redelmeier, and K. Aas. GroupShapley: Efficient prediction explanation with Shapley values for feature groups, 2021. /Rtptss/://aaxi
12228
[16] Y. Kalantidis, L. G. Pueyo, M. Trevisiol, R. Van Zwol, and Y. Avrithis. Scalable triangulation- based logo recognition. In Proceedings of the 1st ACM international conference on multimedia retrieval, pages 1-7, 2011.
[17] Kang, Sun, B. Wen, S. Chen, D. Song, R. Mahmood, and R. Jia. Autoscale: Auto- matic prediction of compute-optimal data composition for training LLMs. arXiv preprint arXiv:2407.20177. 2024.
[18] Kaplan, McCandlish, T. Henighan, B. Brown, B. Chess, R. Child, Gray, A. Radford,
J. Wu, and D. Amodei. Scaling laws for neural language models, 2020. URL https://arxiv
arg/abs/2000 20011003611
[19] W. Koh and P. Liang. Understanding black-box predictions via influence functions. In P Proceedings of the 34th International Conference on Machine Learning, volume 70, pages 1885-1894, 06-11 Aug 2017.
[20] Y. Kwon, S. Lee, and G. A. Pouliot. Group Shapley value and counterfactual simulations in structural model. arXiv preprint arXiv:2410.06885. 2024.

---

[21] A. M. Law and W. D. Kelton. Simulation modeling and analysis. McGraw-Hill series in indus- trial engineering and management science. McGraw-Hill, New York, 1982. ISBN 0070366969.
[22] J. Li, K. Kuang, B. Wang, F. Liu, L. Chen, F. Wu, and J. Xiao. Shapley counterfactual credits for multi-agent reinforcement learning. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages 934-942, 2021.
[23] W. Li and Y. Yu. Faster approximation of probabilisticc and distributional values via least squares. In The Twelfth International Conference on Learning Representations, 2024.
[24] w. Li and Yu, One sample fits all: Approximating all probabilistic values simultaneously and efficiently. arXiv preprini 4r 10.23808, 2024.
[25] Z. Liu, Y. Chen, H. Yu, Y. Liu, and L. Cui. Grg-Shapley: Efficient and accurate participant contribution evaluation in federated learning. ACM Transactions on Intelligent Systems and Technology (TIST), 13(4) 2022.
[26] S. Lundberg. A unified approach to interpreting model predictions. arXiv preprint 1rXiv.1705.07874, 2017.
[27] C. Musco and R. T. Witter. Provably accurate Shapley value estimation via leverage score sampling. The Thirteenth International Conference on Learning Representations, 2025.
[28] R. Rombach, A. Blattmann, D. Lorenz. P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pages 10684-10695, 2022.
[29] A. Sestino, A. Kahlawi, and A. De Mauro. Decoding the data economy: literature review of its impact on business, society and digital transformation. European Journal of Innovation Management, 28(2):298-323 2025.
[30] I. S. Shapley. A value for n-person games. Contributions to the Theory of Games, 2, 1953.
[31] B. Strack. J. P. DeShazo, C. Gennings. J. L. Olmo, S. Ventura, K. J. Cios, and J. N. Clore. Impact of hbalc measurement on hospital readmission rates: analysis of 70,000 clinical database patient records. BioMed research international, 2014(1):78167)) 2014.
[32] J. Wang. Y. Chen, and P. Giudici. Group Shapley with robust significance testing and its application to bond recovery rate prediction. arXiv preprint arXiv:2501 .03041, 2025.
[33] J. T. Wang and R. Jia. Data Banzhaf: A robust data valuation framework for machine learning. In Proceedings of The 26th International Conference on Artificial Intelligence and Statistics, volume 206, pages (388-642) PMLR, 25-27 Apr 2023.
[34] J. T. Wang and R. Jia. A note on "Towards efficient data valuation based on the shapley value". arXiv preprint arXiv:2302..0 /431, 2023.
[35] J. T. Wang, Z. Deng, H. Chiba-Okabe, B. Barak, and W. J. Su. An economic solution to copyright challenges of generative ai. arXiv preprint arXiv:2404. 13964, 2024.
[36] M. Wu, R. Jia, C. Lin, W. Huang, and X. Chang. Variance reduced Shapley value estimation for trustworthy data valuation. Computers & Operations Research, 159:106305, 2023.
[37] M. Wu, 7. Liu, X. Li, R. Jia, and X. Chang. Uncertainty quantification of data Shapley via statistical inference. arXiv preprint arXiv:2407. 19373, 2024.
[38] J. Zhang, Q- Sun, J. Liu, L. Xiong, J. Pei, and K. Ren. Efficient sampling approaches Shapley value approximation. Proceedings of the ACM on Management of Data, 1(1):1-24, 2023.
[39] J. Zhang, Y. Bi, M. Cheng, J. Liu, K. Ren, Q Sun, Y. Wu, Y. Cao, R. C. Fermandez, H. Xu, et al. A survey on data markets. arXiv preprint MxXii:2411.07200 2024.
12

---

NeurIPS Paper Checklist
1. Claims
Do the main claims made the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification: The abstract and introduction accurately reflected the contents of the paper, and the conclusions are supported by theory and numerical experiments.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contribu- tions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine include aspirational goals as motivation as long as it is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: While our method effectively defends against the shell company attack, there exists different type of attack, called the copier attack. This attack can be addressed by adding data pre-processing step before feeding data to our method. See Section 5 for details.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results to vi- olations of these assumptions (e.g.. independence assumptions, noiseless settings, model well- well-speciffictton, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope the claims made, e.g., if the approach was only tested on few datasets with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or a speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by review- ers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof? Answer: [Yes]
13

---

Justification:
We presented all the main theoretical results and the assumptions they depend on in the paper. All proofs, along with auxiliary lemmas, are in the appendix. Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should numbered and cross-referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof' can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the of the paper should be complemented by
formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experi- mental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: The paper provides sufficient details in both the main text and Appendix to reproduce the key experiments. For each setting, we provide the details, such as how the utility function is constructed, how data grouped, and how the estimation method implemented.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer this question will be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case large language model), releasing of model checkpoint, or other means that are appropriate the research performed.
While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
new model (e.g., large language model), then there should
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material? Answer: [Yes]
14

---

Justification: All datasets used in the experiments are publicly available. The code will be included as part of supplemental materials and later released as a GitHub repository, along with detailed instructions for reproducing the main results. The synthetic data used in the paper is fully documented by the main paper and supplemental materials, as well as reproducible by our submitted code.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines tattpp://nipps calipp..ccpubbicc.
for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to to reproduce the results, See the NeurlPS code and data submission guidelines (https:// ssionPolicy) for more details.
nips. wwt.:cccpullcgggccccec Baaal////gu.eee//Ceeuubmm.eeee sttes//oooSuuiisssinooii
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification:
The paper specifies all essential training and test settings needed to understand and replicate the experiments. This includes the choices of machine learning models, the values of hyper/tuning parameters, and additional implementation details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [Yes] (Whenever applicable)
Justification: In Sections 4.1 and 4.3 reported numerical results with error bars. For the motivation example in Section we did not report error bars because it a qualitative illustration. In the generative AI application in Section 4.2 reporting standard errors would require retraining Stable Diffusion models many times, which exceeds the hardware resources available to us. That being said, did repeat both experiments (in Section T and Section (42) multiple times, though not enough to formally produce error bars, and found the outcomes sufficiently stable to support our interpretations. Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, least for the experiments that support the main
claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
15

---

The method for calculating the error bars should be explained (closed form formula, call to library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are of range (e.g. negative error rates). If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
Question: For each experiment, does the paper provide sufficient information the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experi- ments?
Answer: [Yes]
Justification: The paper provides detailed information about the compute environment for each experiment, including CPU/GPU specifications. Resource-demanding experiments, such as those involving generative Al models, include descriptions of GPU hardware and fine-tuning time. For all other experiments, computational details specified ensure reproducibility and transparency.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experi- mental runs well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make into the paper).
Code of ethics
Question: Does the research conducted in the paper conform, every respect, with the NeurIPS Code of Ethics https://neur ips cctppp/llccEhhiicssuu..ellllllll htthgg/rrrre/////rr.o.//////aaaa
Answer: [Yes]
Justification: We are carefully complying with all requirements in NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consideration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We propose Faithful GSV (FGSV), which addressed the loophole in the existing method called GSV, which can be exploited by "shell company attack" lead to negative societal impact. In this regard, our paper's main contribution is to uphold fair competition in data valuation. On the other hand, data pre-processing step needs be added to our method defend against different type of attack. Guidelines:
The answer NA means that there is societal impact of the work performed.
16

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairesss considerations (e.g., deploy- ment technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications. let alone deployments. However, if there is a direct path to any negative applications, the authors should point out. For example, is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (c.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: We use open/public data sets that anyone can access. Our work does not generate machine learning models, either. We do not believe this aspect is relevant to this paper.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We only use open/public data sets and have properly acknowledged their sources by including the corresponding citations.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, snnerswithcodk cww/ dat/aatsssts has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
17

---

For existing datasets that are re- se-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: This paper does not release any new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects Question:
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, well as details about compensation (if any)?
Answer: [NA]
Justification:
This aspect not relevant or applicable to this paper.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should included in the main paper.
According the NeurIPS Code Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This aspect is not relevant applicable to this paper.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere to the NeurIPS Code of Ethies and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
18

---

Question: Does the paper describe the usage of LLMs if it is an important, original, non- standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: After carefully reading the LLM policy of NeurIPS 2025, we believe no LLM-related declaration needed for this paper.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non non- standard components.
Please refer to our LLM policy what should or should not described.
http:///aarrppp..cc/ooeeeeeeeeee MLLM) for
19


Reviews:
[{"review_id": "Ye10U7ujOd", "reviewer": "Reviewer_gZ5H", "summary": "The authors address the problem of dataset valuation based on Shapley values (called group-level Shapley), where the objective is to derive Shapley semi-values for each dataset participating into a machine learning task. This differs from classical datum valuation, where one player is a data sample from a fixed dataset. Group-level valuation is subjected to a specific adversarial attack (shell attack), where other players can split their datasets to change the value of the current player. To cope with that issue, the authors are proposing a generalisation of the Shapley value for dataset valuation by introducing an additional axiom introducing a fairness constraint to address shell attacks. They provide an algorithm computationally efficient and illustrate the benefits of the latter on several experiments.", "questions": "See above.", "limitations": "N/A", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths**\n* The Faithful Group Shapley Value proposed by the authors is, up to my knowledge, novel.\n* The proposed algorithm is original, scalable (from $O(n^2)$ to $O(n)$ computational cost up to polylogarithmic terms, where $n$ is the number of players). Note that $O(n)$ is the SOTA computational cost in terms of number of utility evaluations.\n* All claims are theoretically justified, albeit I did not check the full supplementary material.\n* Experiments are revelant and indeed show the benefits of the proposed approach.\n\n** Weaknesses**\n* Could the authors provide more insights on why they choose to focus on the shell attack compared to others? A dedicated paragraph on the most impactful and common attacks would be valuable to know at which extent this novel methodology will be relevant for the community.\n* The authors are introducing FGSV with a new faithful axiom but are considering an algorithm approximating the latter and hence potentially loosing the faithful axiom and the ability to cope with shell attacks. Could the authors comment on that point?", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable comments.\n\n> **1. Why choose to study the shell company attack?  What are other common attack methods?**\n\n**The shell company attack is our original contribution.**  We identified a significant vulnerability in popular group data valuation methods, which has not been discovered in the existing literature. \n\nThe copier attack is the most significant other type of attack that we know, which has been addressed in the data valuation literature [1].  Shell company and copier are completely different attacks: copier attack duplicates existing data; while shell company strategically manipulates data grouping.\n\nOverall, the topic of “group data valuation” has only emerged very recently [2,3].  Works on attack and defense of data valuation exclusively concentrate on individual data valuation.  **Our paper is the first, pioneering work that addressed the unexplored topic of attack and defense for group data valuation.**\n\nThanks to your comments, we will revise the presentation of our paper’s contributions and make the above points clearer in the next version.\n\n> **2. Approximately computing FGSV may break axiom compliance and lose defense against the shell company attack**\n\nIt is necessary and a common practice to compute numerical approximations to Shapley values in the literature, since the exact Shapley values are computationally prohibitive.\n\nOur Theorem 3 guarantees that the output of the algorithm approximately obeys the axioms, including the faithfulness axiom.  Numerical results such as Figures 1 and 3 clearly demonstrate our method’s robustness against the shell company attack.\n\n***\n_**References**_\n\n[1] Falconer, T., Kazempour, J. and Pinson, P., 2023. Towards replication-robust data markets. arXiv preprint arXiv:2310.06000.\n\n[2] J. T. Wang, Z. Deng, H. Chiba-Okabe, B. Barak, and W. J. Su. An economic solution to copyright challenges of generative AI. arXiv preprint arXiv:2404.13964, 2024.\n\n[3] J. Wang, Y. Chen, and P. Giudici. Group Shapley with robust significance testing and its application to bond recovery rate prediction. arXiv preprint arXiv:2501.03041, 2025."}, {"review_id": "EF3rtnxq75", "reviewer": "Reviewer_V1yM", "summary": "This article addresses the problem of dataset valuation, where the goal is to fairly assess the contributions of agents—represented by datasets—using Shapley values. Traditional state-of-the-art (SOTA) methods are vulnerable to *shell company attacks*, where an agent splits their dataset into multiple subsets to unfairly increase their total valuation.\n \nTo overcome this, the authors propose the Faithful Group Shapley Value (FGSV), which evaluates each dataset as the sum of the Shapley values of its individual data points. Intuitively, this fine-grained approach prevents agents from benefiting through artificial data splitting, as FGSV assigns value at the most granular level.\n\nFGSV is shown to be the only dataset valuation method that satisfies a set of five axioms: the four standard Shapley axioms adapted to the group setting, plus *faithfulness*—the property that ensures robustness against shell company attacks.\n\nAlthough computing FGSV exactly is computationally expensive, the authors develop a fast and accurate approximation algorithm that works under mild regularity conditions. They demonstrate scenarios where these conditions are met and validate the proposed method with extensive experiments, showing strong performance compared to various SOTA alternatives.", "questions": "1. How accurate is it to evaluate the importance of a dataset by aggregating pointwise valuations? Since the value function $u$ is not necessarily linear, the dataset-level Shapley value  $SV_{S_0}(u)$ can differ significantly from the sum $\\sum_{i\\in S_0} SV_i(u)$. Could you elaborate on the implications of this discrepancy?\n\n2. How does your method perform when Assumptions 1 and 2 do not hold? Specifically, do the three empirical scenarios presented in the paper satisfy these assumptions? If not, how robust is the method in such cases?\n\n3. Why is the area under the convergence curve an indicator of accuracy? While it reflects convergence speed, does it guarantee convergence to the correct values, particularly in light of the first concern regarding the dataset vs. pointwise valuation?", "limitations": "The article does not adequately address the limitations of the proposed method. In particular, the concerns raised in Questions 1 and 2 are critical and deserve a thorough discussion.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n- The article is clearly written and easy to follow.\n- The addressed problem is both interesting and novel, particularly the focus on robustness against shell company attacks.\n- The paper is mathematically rigorous, with well-justified theoretical assumptions.\n- The proposed method is validated through a comprehensive set of experiments.\n\nWeaknesses\n– The method evaluates the importance of a dataset as the sum of the valuations of its individual data points, which may fail to capture the overall contribution of the dataset as a unit.\n- The performance of the proposed method under violations of the regularity conditions is not thoroughly investigated.\n- The literature review is insufficient, making it difficult to fully assess the contribution relative to existing work.\n- The paper lacks a dedicated discussion of limitations, especially regarding scalability and applicability in less ideal scenarios.", "was_revised": true, "final_justification": "The article is good. However, I have decided to keep my score due to the insufficient literature review. The authors argue that shell company attacks are their main novelty, but the idea of coalitions splitting into smaller coalitions is quite standard in cooperative game theory. Moreover, the claim that the only way to prevent such attacks is to reward datasets by the sum of the Shapley values of their individual data points feels somewhat disappointingly intuitive.", "rebuttal": "Thank you for your valuable comments.\n\n> **1. W1 & Q1: FGSV is defined as the sum of individual valuations.  This may fail to capture the overall contribution of the dataset, since the valuation function $u$ is nonlinear. Elaborate on the implications of the discrepancy between the dataset-level Shapley value $\\mathrm{GSV}(S_0)$ and the sum $\\mathrm{FGSV}(S_0)=\\sum_{i\\in S_0}\\mathrm{SV}(i)$.**\n\nAllow us to clarify a potential conflation: our FGSV adds up individual Shapley values (SV), not individual utility functions $u$.  Although both SV and utility can be interpreted as “valuation function” in some sense, they are different concepts.  To illustrate, let’s consider the following metaphor:\n\n- Utility $U(S)$ is the total revenue earned by the joint work of group $S$.\n- $\\mathrm{SV}(S)$ is the total salary allocated to $S$.\n\nFor an individual $i$, define $U(i)$ and $\\mathrm{SV}(i)$ by setting $S=\\\\{i\\\\}$. Note that $U(i)$ is the solo revenue, but $\\rm{SV}(i)$ is not simply $U(i)$; it is computed competitively to capture the uniqueness and indispensability of $i$’s contribution – see Eqn. (1).\n\nWe agree that summing up $U(i)$ ignores the extra merit of joint force. However, what we propose is that group salary be the sum of its members’ individual salaries, which already encodes interaction effects across possible coalitions. This is both intuitively sensible and, in view of our Theorem 1, mathematically necessary.\n\nIn contrast, $\\mathrm{GSV}(S_0)$ treats $S_0$ as a whole and fails to account for its members' unique contributions, which makes it vulnerable to group manipulations like the shell company attack.\n\n\n> **2. W2, W4 & Q2: Discussion of limitation/less idea scenarios: what if Assumptions 1 and 2, and regularity conditions are violated?  Are they satisfied in the three data examples?**\n\nImportantly, we clarify that there are two types of assumptions. The first type is about the data-generating process, over which a user has little control (e.g., assuming data follows a normal distribution and building a method upon it). In this case, it is crucial to assess the impact of assumption violation by sensitivity analyses.\n\nWe emphasize that in this paper, we make no assumptions in the first type.\n\n**Instead, our Assumptions 1 and 2 and regularity conditions belong to the second category, that is, assumptions on things that the user has control over.**  Notice that all these assumptions eventually regard the utility function, and the practitioner (user) chooses the utility function. For example, many machine learning problems essentially predict response $y$ based on predictor $x$. Then utility depends on: 1) the prediction method $f: x\\to y$, as well as the optimization algorithm; and 2) the performance measure, such as $\\|\\hat y-y\\|$ under a proper norm. The user can choose both 1) and 2), and that fully determines the utility. \n\n**How common is it that a utility function satisfies our assumption?  Our understanding is “very often”.** In our three data examples, Assumption 1 is satisfied by our design of the performance measure. For example, we use the log-likelihood on a new image (normalized to a compact set) in the copyright attribution task, and a bounded mean squared error for disease progression in the explainable AI example (as the maximum follow-up time is bounded). Assumption 2 is satisfied under the standard algorithm and model choice, such as using a DNN with smooth activation functions and bounded parameters trained with SGD. In our experiments, we used advanced optimizers like Adam beyond standard SGD. Our stable results demonstrate that our method performs robustly well even when these conditions are not strictly met.\n\n**Our assumptions are quite standard compared to other works [2, 3, 4].** One can certainly think of a scenario that violates our assumptions, where the utility is built based on an unpatterned prediction method with rather arbitrary behaviors, then to our best knowledge, no other existing theoretical results in this area will apply, either.\n\n\n> **3. W3: Literature review seems insufficient, making it difficult to fully assess the contribution relative to existing work.**\n\nGeneric literature: we cited prior works on data valuation, including non-Shapley-type methods and other Shapley-type methods.  This part is similar to other papers on Shapley value.\n\nMost related literature: in fact, the topic “group data valuation” has emerged very recently.  We cited major advances, as bib entries [6,14,32,35] in our paper.\n\n**Our contribution’s significance:** the group-as-individual (GaI) paradigm dominates existing literature.  However, in this paper, we proposed a new attack, i.e., the shell company attack, that exposes a fundamental flaw in GaI.  We proposed a new method FGSV and proved that it uniquely defends against this new attack.  Moreover, we devised a fast algorithm to numerically approximate FGSV.\n\n> **4. W4: Method scalability?**\n\nEstimating Shapley values involves evaluating the utility function on many subsets of the data, which can be computationally expensive. However, this expense is unavoidable to any Shapley‐based estimator.  Crucially, our FGSV algorithm provably **reduces** the number of utility evaluations needed for an $(\\epsilon,\\delta)$‑approximation: compared to prior methods, it requires far fewer calls to the utility oracle while still delivering the same accuracy guarantees.\n\n> **5. Q3: Why use AUCC to measure performance (Section 4.1)?  AUCC doesn’t show methods’ accuracy at convergence.**\n\nOur adoption of AUCC follows [1], who used it to compare the convergence behaviors of several individual Shapley value estimators. AUCC summarizes how quickly and stably an estimator approaches the ground truth by integrating the error across the intermediate phase.\n\nWe agree that AUCC does not show the “final” accuracy of an estimator. To address this, we also report the **absolute relative error (ARE)** of the final estimates:\n$$\n\\mathrm{ARE}(S_k)=\\left|\\frac{\\mathrm{FGSV}(S_k)-\\widehat{\\mathrm{FGSV}}^{(20000)}(S_k)}{\\mathrm{FGSV}(S_k)}\\right|.\n$$\nThe table below presents ARE (mean and sd across 30 runs) for the first group $S_1$. Our method consistently achieves the lowest ARE. Results for other groups are similar and omitted here for brevity. \n***\n||Permutation|Group Testing|Complement|One-for-All|KernelSHAP|Unbiased KernelSHAP|LeverageSHAP|**FGSV**|\n|:---|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n|$n=64$|0.04945 (0.03597)|0.18083 (0.11655)|0.05496 (0.11161)|0.00819 (0.00674)|0.08503 (0.05977)|0.02690 (0.02030)|0.07921 (0.05467)|**0.00161 (0.00047)**|\n|$n=128$|0.07252 (0.04468)|0.24966 (0.16843)|0.19794 (0.05634)|0.01531 (0.04132)|0.15551 (0.09972)|0.01930 (0.01848)|0.08117 (0.06099)|**0.00139 (0.00056)**|\n|$n=256$|0.08818 (0.06402)|0.37767 (0.26249)|0.83911 (0.04193)|0.05433 (0.01457)|0.26393 (0.20925)|0.02536 (0.01830)|0.13617 (0.10424)|**0.00100 (0.00075)**|\n\n***\n_**References**_\n\n[1] Li, W. and Yu, Y. One sample fits all: Approximating all probabilistic values simultaneously\nand efficiently. arXiv preprint arXiv:2410.23808, 2024.\n\n[2] Jia, R., et al. 2019. “Towards Efficient Data Valuation Based on the Shapley Value.” Edited by Kamalika Chaudhuri and Masashi Sugiyama. International Conference on Artificial Intelligence and Statistics abs/1902.10275 (February): 1167–76.\n\n[3] Jia, R., et al. 2019. “Efficient Task-Specific Data Valuation for Nearest Neighbor Algorithms.” Proceedings of the VLDB Endowment International Conference on Very Large Data Bases 12 (11): 1610–23.\n\n[4] Ghorbani, A., et al. 2020. “A Distributional Framework for Data Valuation.” International Conference on Machine Learning abs/2002.12334 (February): 3535–44."}, {"review_id": "nsLhawrYQA", "reviewer": "Reviewer_A8AR", "summary": "This paper examines the usage of group level data valuation based on Shapley value. \nThe author makes this observation:  a malicious agent can game a mechanism that treats the groups as atomic entities,  using the so-called *shell company attack*, in which the malicious agent strategically splits its data between several shell companies.\n\nThe paper first result is that, to be robust to shell company attacks and satisfy the classical Shapley value axioms -- where anonymity has been adapted to the group setting--  one has no choice but to value a group of point as the sum of each point Shapley value. \n\nThis motivates the introduction of a Shapley value algorithm exploiting the group structure, in particular,  \none can group the $U(S)$ terms in the Shapley value computation based on the size of |S| and the size of the  intersection  of $S$ with the group of interest (the one we want to compute the Shapley value).\nThis observation initiates a series of tricks that ends up with a novel, efficient algorithm.\n\nNumerical experiments demonstrate competitiveness against sota as well as a scenario of shell company attack.", "questions": "A: How do you think theorem 3 presentation could be improved? \nB: Do you have arguments to weights the pros and cons between coping against copier attack and shell company attack, are there other aspects we should have in mind? \nC: How did you came up with condition 3? What does the literature tells us about it that made you believe it was the right condition to build the argument?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "# Strengths\n* The paper raises an important question by introducing the notion of shell company attack. \n* This is a paper articulating several original observations about a very active field of research. Leading to a well motivated algorithm (+++). I find this paper very innovative.\n* The reading of the paper is eased by the fact that the important ideas are well emphasized (\"key observations..., pictures..\"). \n\n\n# Weaknesses\n* I find the current version of Theorem 3 hard to parse. I believe this should be improved. \n* The paper mentions the copier attack only at the end (and they recognize the limitation of this pape with respect of this attack). In my first reading of the paper, I almost stop reading because they did not acknowledge it earlier (and this attack is what came to my mind immediately while reading). It would be good to mention the copier attack a bit ealier. \n* (Still on the copier attack) The remark at the end falls like a clifthanger, and I think it is quite easy to find counter-measure against the authors's  defensive proposal (the \"remove the copies\" argument). I think this part should be elaborated a bit more.", "was_revised": true, "final_justification": "I keep my score, I believe this is a good paper and the authors answers my question in a satisfying manners.", "rebuttal": "Thank you for your thoughtful and constructive comments.\n\n> **1. W1 & Question A: Clarification and Revision of Theorem 3**\n\nThank you for this comment. We will revise Theorem 3 for readability. Here is the revised version.\n\n**Theorem 3.** _Algorithm 1 guarantees that for any truncation threshold $\\bar s$ and sample sizes $m_1, m_2$, with probability at least $1-\\delta$,_\n\n$$\n\\left|\\widehat{\\mathrm{FGSV}}(S_0)-\\mathrm{FGSV}(S_0)\\right| \\lesssim \\bar s\\sqrt{\\frac{\\log(n/\\delta)}{m_1}}  +  \\alpha_0(1-\\alpha_0)\\sqrt{\\frac{\\log(n/\\delta)}{m_2}} \\sum_{s=\\bar s}^{n-1}\\beta(s) + \\alpha_0(1-\\alpha_0)\\bar s^{-\\upsilon}.\n$$\n_Specifically, by choosing_\n$$\n\\bar s  \\asymp  \\epsilon^{-1/\\upsilon}, \\quad m_1  \\asymp  \\epsilon^{-\\frac{4+2\\upsilon}{\\upsilon}}  \\log\\bigl(n/\\delta\\bigr), \\quad m_2  \\asymp  \\max\\Bigl\\\\{1,  \\epsilon^{-2}(\\alpha_0(1-\\alpha_0))^2(\\log(n/\\delta))^3\\Bigr\\\\},\n$$\n_one obtains an $(\\epsilon, \\delta)$‑approximation of $\\mathrm{FGSV}(S_0)$ with $O\\bigl(n\\cdot\\mathrm{polylog}(n)\\bigr)$ total utility evaluations._\n\n**Remark.** For the error bound, the first term comes from the Monte Carlo approximation error for small $s$, the second term comes from the Monte Carlo approximation error for large $s$, and the last term is the tail bound induced by the approximation in Theorem 2.\n\n> **2. W2, W3, & Question B: How can the proposed method (be extended to) handle the copier attack?**\n\nThank you.  We will revise the paper and add more discussion on the copier attack, both earlier in the paper and in the discussion section.  NeurIPS does not allow revision during rebuttal, so let us give you an overview of the expanded discussion.\n\nThe copier attack impacts both group and individual valuation methods.  The comments from you and other reviewers pointed out two remedies:\n- [1] suggests designing the utility function using Pearl’s “do operation”.  **This defense can be incorporated into our framework, and let our method also defend against the copier attack.**\n- [2] suggests using replication-robust data valuation measures, such as Banzhaf or leave-one-out, to replace Shapley.  This approach can automatically fend off one subtype of copier attack by discouraging existing contributors from self-replication, **but it does not defend against “pure infringers”** who copy valuable players without contributing any original content.\n\nOverall, it remains an **open challenge** to defend against the copier attack for **general** utility functions, while keeping the defense against the shell company attack up.  In view of our Theorem 1, a satisfactory solution will be based on our FGSV.  Therefore, this paper **pioneers an important first step** in the exploration of safe group valuation methods.\n\n> **3. Question C: Motivation of Condition (3) in Proposition 1**\n\nPrudence is a classical concept in economics: a consumer is called “prudent” if they save more when facing greater future income risk – mathematically, this is characterized as the utility’s third derivative being nonnegative [5].  In machine learning applications, several popular utility function curvatures satisfy the prudence condition, such as\n- Power‑law utilities ($\\bar U(s)\\propto s^a$ with $0<a<1$)\n- Logarithmic utilities ($\\bar U(s)\\propto \\log s$)\n\nFor instance, empirical studies report that scaling laws in deep learning [3] and large‑language‑model performance [4] follow power‑law trends in sample size \\(s\\), thereby also satisfying the prudence condition. \n\n---\n_**References**_\n\n[1] Falconer, T., Kazempour, J. and Pinson, P., 2023. Towards replication-robust data markets. arXiv preprint arXiv:2310.06000.\n\n[2] Han, D., Wooldridge, M., Rogers, A., Ohrimenko, O. and Tschiatschek, S., 2022. Replication robust payoff allocation in submodular cooperative games. IEEE Transactions on Artificial Intelligence, 4(5), pp.1114-1128\n\n[3] Hestness, Joel, Sharan Narang, Newsha Ardalani, Gregory Diamos, Heewoo Jun, Hassan Kianinejad, Md Mostofa Ali Patwary, Yang Yang, and Yanqi Zhou. 2017. “Deep Learning Scaling Is Predictable, Empirically.” arXiv [Cs.LG].\n\n[4] Kaplan, Jared, Sam McCandlish, Tom Henighan, Tom B. Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. 2020. “Scaling Laws for Neural Language Models.” arXiv [Cs.LG]. \n\n[5] Sandmo, A. 1970. “The Effect of Uncertainty on Saving Decisions.” The Review of Economic Studies 37 (3): 353."}, {"review_id": "U8t5MxA6Ou", "reviewer": "Reviewer_ct4R", "summary": "Authors propose the Faithful Group Shapley Value (FGSV) to ensure data valuation is robust to the shell company attack where different data groups (companies) strategically split their data into multiple groups to increase their value.\nThey define FGSV for a group as the sum of individual Data Shapley values of its members and prove that it uniquely satisfies the set of axioms desirable for faithful group data valuation.\nThey empirically test the proposed approach on synthetic data,  FlickrLogo-2 dataset, and diabetes dataset.", "questions": "- Section 3.2 (Algorithm 1) in the main paper and in Appendix C.\n   - None of the references in Algorithm 1 take you to the actual equation.\n   - How do you determine m1 and m2? From B.4, it's 1000>n, and in application B.2, it's 20,000, and in B.1, it's 2000. Is it the same across runs for each application?\n   - What is non-informative distribution Pnull, and how does it relate to D?\n   - In general, I think that adding a paragraph describing the algorithm(s) and or comments in the algorithm(s) would improve readability. \n\n\n- Section 3.4 (Utility function values for small input sets).\n   - Theorem 3 appears to guide whether the size of s is appropriate; however, it is still unclear to me how B is determined. It's also unclear to me the extent to which the \"non-informative data points\" affect the data valuation of a group's data. How do authors define non-informative data points? Where do they come from, and are they drawn from the same distribution?\n   - Lastly, more theoretical analysis of the implications of this padding process would improve trust in the efficacy of the faithful data valuation approach. \n\n   - The Banzhaf value is replication-robust, reliable across runs, and can handle varied sizes. Why is not used a base method instead of Shapley? \n\n\n\n- Experiments (Section 4).\n   - Both the experimental setups and the results are generally difficult to follow. For instance, in Figure 2, it is unclear which dataset was used, what the B or \\tilde{s} is, what the size of each data group(S) is, and how the dataset was sourced or generated. Many crucial details are missing, with only a few relegated to Appendix B.1. There is also a mismatch between the motivation, e.g., copyright or explainable AI, and the setup and results.\n   - The authors mention the test set for just one experiment in Section B.4 but provide no information on the data splits used in the other experiments. It remains unclear how they sourced the held-out test sets and how similar or different they are in distribution compared to the various groups used in the experiments.\n\n\n- Related works. \n   - There are several replication robust \"base\" methods. For example https://openreview.net/pdf?id=iTjSqQQ4f8, https://proceedings.mlr.press/v206/wang23e/wang23e.pdf, https://arxiv.org/pdf/2006.14583\n   - I think the related works should ideally cite papers in this line of inquiry. If possible, use these kinds of methods in the experimental comparative analysis.\n\n- Motivation and setup.\n   - There are some disconnects between the motivation and the setup. For example, drawing held-out tests and the different groups from the same distribution might not sufficiently depict the real-world setting the authors aim to address. \n   - The application of the approach to faithful explainable AI (section 4.3) might exacerbate fairness issues and further marginalize already marginalized groups. It's also unclear to me, based on the results in Section 4.3, if FGSV improves things. \n\n\n- Typos and reference issues.\n   - There are several typos. For example,  the on the reference made on line 214.  In appendix C, there is only Algorithm 1, not Algorithm 2\n   - Most of the references in the paper don't work as expected. E.g., if you click on some hyperlinked references, they take you to page one. For example, none of the references in algorithm 1 take you to the actual equation.", "limitations": "The paper lacks a (detailed) limitation section", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n- The authors try to address a key issue in data markets by using a commonly used method as a baseline. \n- Figure 1 is intuitive and clearly illustrates the problem the authors are trying to address. \n- Authors theoretically prove the existence of a fast and accurate approximation algorithm for FGSV, empirically test their approach, and avail their code in supplementary material.\n\n\n**Weaknesses**\n\n- Section 3.2 (Algorithm 1) in the main paper  and in Appendix C.\n   - None of the references in Algorithm 1 take you to the actual equation.\n   - How do you determine m1 and m2? From B.4, it's 1000>n, and in application B.2, it's 20,000, and in B.1, it's 2000. Is it the same across runs for each application?\n   - What is non-informative distribution Pnull, and how does it relate to D?\n   - In general, I think that adding a paragraph describing the algorithm(s) and or comments in the algorithm(s) would improve readability. \n\n\n- Section 3.4 (Utility function values for small input sets).\n   - Theorem 3 appears to guide whether the size of s is appropriate; however, it is still unclear to me how B is determined. It's also unclear to me the extent to which the \"non-informative data points\" affect the data valuation of a group's data. How do authors define non-informative data points? Where do they come from, and are they drawn from the same distribution?\n   - Lastly, more theoretical analysis of the implications of this padding process would improve trust in the efficacy of the faithful data valuation approach. \n\n   - The Banzhaf value is replication-robust, reliable across runs, and can handle varied sizes. Why is not used a base method instead of Shapley? \n\n\n\n- Experiments (Section 4).\n   - Both the experimental setups and the results are generally difficult to follow. For instance, in Figure 2, it is unclear which dataset was used, what the B or \\tilde{s} is, what the size of each data group(S) is, and how the dataset was sourced or generated. Many crucial details are missing, with only a few relegated to Appendix B.1. There is also a mismatch between the motivation, e.g., copyright or explainable AI, and the setup and results.\n   - The authors mention the test set for just one experiment in Section B.4 but provide no information on the data splits used in the other experiments. It remains unclear how they sourced the held-out test sets and how similar or different they are in distribution compared to the various groups used in the experiments.\n\n\n- Related works. \n   - There are several replication robust \"base\" methods. For example https://openreview.net/pdf?id=iTjSqQQ4f8, https://proceedings.mlr.press/v206/wang23e/wang23e.pdf, https://arxiv.org/pdf/2006.14583\n   - I think the related works should ideally cite papers in this line of inquiry. If possible, use these kinds of methods in the experimental comparative analysis.\n\n- Motivation and setup.\n   - There are some disconnects between the motivation and the setup. For example, drawing held-out tests and the different groups from the same distribution might not sufficiently depict the real-world setting the authors aim to address. \n   - The application of the approach to faithful explainable AI (section 4.3) might exacerbate fairness issues and further marginalize already marginalized groups. It's also unclear to me, based on the results in Section 4.3, if FGSV improves things. \n\n\n- Typos and reference issues.\n   - There are several typos. For example,  the on the reference made on line 214.  In appendix C, there is only Algorithm 1, not Algorithm 2\n   - Most of the references in the paper don't work as expected. E.g., if you click on some hyperlinked references, they take you to page one. For example, none of the references in algorithm 1 take you to the actual equation.", "was_revised": true, "final_justification": "Although the paper has weaknesses, the authors propose an interesting problem supported by sound theory and empirical results. I am raising the score with the expectation that authors will make the promised changes.", "rebuttal": "Thank you for your thoughtful and constructive comments.\n\n> **1. Typos, broken hyperlinks, and adding comments and description to algorithms**\n\nWe will correct the typos/hyperlinks, and add comment lines into algorithms to improve readability in the revised version. Algorithm 1 in the Appendix should be Algorithm 2 for an optional padding procedure when the utility function is not well-defined for small sets.\n\n> **2. Clarification on the choice of tuning parameters $m_1$ and $m_2$ in Algorithm 1**\n\nWhile Theorem 3 provides a theoretical guideline for accuracy, in practice, we selected $m_1$ and $m_2$ to balance approximation quality and computational cost.\nSpecifically, Theorem 3 implies an error bound of\n$$O\\bigg(\\frac{\\log n}{m_1}+\\frac{\\log s}{m_2}\\bigg),$$\nwhich decreases with larger $m_1$ and $m_2$. However, since both $m_1$ and $m_2$ are the numbers of Monte Carlo samples, increasing them leads to more utility calls, roughly $s_0m_1+2m_2$ calls, which directly affects total runtime. Importantly, different experiments incur utility costs differently, depending on the model complexity and sample size. Thus, in each experiment, we selected $m_1$ and $m_2$ such that the total utility calls remained within the computational budget, while accounting for the per-call cost in specific settings.\n- B.1: Involves retraining with low-dimensional input and small sample size, allowing large $m_1 = m_2 = 2000$.\n- B.4: Involves retraining with high-dimensional input and large sample size, setting $m_1 = m_2 = 1000$ to keep the runtime manageable.\n\nIn B.2, the number 20,000 refers to the total number of utility calls allowed for each method, not to fixed $m_1$ and $m_2$. Here, utility does not involve retraining, so we could afford to set $m_1$ and $m_2$ adaptively for each $n$ to match this budget constraint.\n\n> **3. The padding procedure in Section 3.4**\n\n**i) How to select $B$?**\nThe choice of $B$ depends on the specific context. $B$ denotes the smallest $s$ for which $U(S)$ is well-defined. For example, in linear regression with $p$ predictors, $U(S)$ is undefined for $|S|<p$. In this case, we typically set $B=cp$ for some constant $c\\geq 1$.\n\nAlso, let us clarify that when $U(S)$ is well-defined for small input sets, we do not engage the procedure in Section 3.4. For instance, in Section 4.2, $U(S)$ describes the performance of a foundation model fine-tuned on a small data set $S$. Since the model is already pretrained, even an empty $S$ gives meaningful $U(S)$. We did not enact Section 3.4 in this example.\n\n**ii) How to generate the non-informative distribution?**\n\nIn supervised learning, with data $D = \\\\{(x_i,y_i)\\\\}^n_{i=1}$ we can randomly shuffle the order of $y_i$'s, then the empirical distribution of the shuffled data can serve as $\\mathcal{P}_{null}$.\n\n**iii) Theoretical analysis of this padding procedure**\n\nWe will include a full theoretical analysis of the padding procedure for Algorithm 2 in the revised Appendix. Here, we briefly present the main result. First, define a padded utility function\n$$\n\\tilde U(S)=\\begin{cases}\\mathbb{E}\\bigl[U(S\\cup S_{null})\\bigr],&|S|<B,\\\\\\U(S),&|S|\\ge B, \\end{cases}\n$$\nwhere $S_{null}\\sim \\mathcal{P}_{null}^{B-|S|}$.\n\nUnder the assumption that $U$ satisfies Assumptions 1 and 2 and is $O(1/s)$‑deletion‑stable for $|S|\\ge B$, one can verify that $\\tilde U$ retains these properties for all $S$. Applying Algorithm 2 to $\\tilde U$ with the parameter choices\n\n$$\\bar s\\asymp\\epsilon^{-1/\\upsilon}\\bigl(\\alpha_0(1-\\alpha_0)\\bigr)^{1/\\upsilon}\\log^{1/(2\\upsilon)}\\bigl(n/\\delta\\bigr),\\quad m_1\\asymp\\epsilon^{-\\frac{2(2+\\upsilon)}{\\upsilon}}\\bigl(\\alpha_0(1-\\alpha_0)\\bigr)^{4/\\upsilon}\\log^{\\frac{2+\\upsilon}{\\upsilon}}\\bigl(n/\\delta\\bigr),\\quad m_2\\asymp\\epsilon^{-2}\\bigl(\\alpha_0(1-\\alpha_0)\\bigr)^2\\log^3\\bigl(n/\\delta\\bigr),$$\n\ndelivers an $(\\epsilon,\\delta)$‑approximation of $\\widetilde{\\mathrm{FGSV}}(S_0)$ using\n\n$$O\\bigl((\\alpha_0(1-\\alpha_0))^2n(\\log n)^3\\bigr)$$\n\nutility evaluations, matching the bounds in the original Theorem 3. \n\n> **4. Our motivation and problem setup are orthogonal to machine learning fairness.** You commented:\n“drawing held-out tests and the different groups from the same distribution...”\nand\n“The application of the approach to faithful explainable AI (section 4.3) might exacerbate fairness...”\n\nWhile we agree that ML fairness is important, it concerns a different aspect and is **orthogonal to the main theme of this paper.**\n\nA Shapley-type data valuation method typically has two stages: 1. Design a utility function $U(\\cdot)$; 2. Properly combine $U(\\cdot)$ to yield an individual or group valuation measure.  \n\nOur study focuses on stage 2, where ‘faithful’ refers to robustness against the shell company attack, which provably compromises GSV-based data valuation.\n\nWe understand that your comments entail adjusting the prediction to reduce disparity among different subgroups. Designing the prediction method and evaluating its outcome both belong to stage 1 and eventually reflected in $U(\\cdot)$. In contrast, we focus on the valuation faithfulness in stage 2 for any given $U(\\cdot)$, not how to design $U(\\cdot)$. **Moreover, a data valuation method based on a fair utility function from stage 1 can still be prone to the shell company attack in stage 2, if it adopts the popular GSV approach there.**\n\n> **5. Clarification on experiment setup.**\nYou commented: “Both the experimental setups and the results are difficult to follow...” and “The authors mention the test set for just one experiment…”\n\nOur experiments are designed to demonstrate specific contributions of our work: (i) identifying the shell company attack, (ii) developing a fast approximation algorithm for FGSV, and (iii) the robustness of our FGSV against shell company attack in two applications. Below, we clarify the objective and setup of each experiment:\n\n- **Sec 1 (B.1): Illustrating the shell company attack.** We used a supervised learning example to motivate it. The utility function $U(S)$ is the accuracy of a model trained on $S$ evaluated on a held-out test set. Thus, this setup involves data splitting, as described in line 714.\n\n- **Sec 4.1 (B.2): Benchmarking the approximation algorithm.** This experiment evaluates how efficiently and accurately Algorithm 1 approximates FGSV. Following [1], we used the Sum-of-Unanimity (SOU) game, where utility $U(S)$ is defined purely on index set $S$ and the exact Shapley value is analytically tractable. This is not a machine learning task and does not involve any dataset, therefore, test data, data splitting, or parameter $B$ are not applicable here. We set $\\bar{s} = 10$, and partition the $n$ players evenly into four groups of size $n/4$.\n\n- **Sec 4.2 (B.3): First application to copyright attribution.** This experiment evaluates FGSV’s robustness against the shell company attack in the context of copyright sharing for generative AI. The utility is defined as the log-likelihood of a given newly generated image after fine-tuning with subset $S$, so no held-out test set is needed in this setup. \n\n- **Sec 4.3 (B.4): Second application to explainable AI.** The experiment evaluates whether FGSV maintains faithful data valuation in explainable AI. The goal is not to design a fair performance metric $U(S)$ as in ML fairness but to demonstrate the robustness against shell company attack in stage 2 for any given $U(S)$. This is a supervised learning setup, and the utility is defined as the test MSE. The splits of train/test data are described in line 859.\n\nWe will make these distinctions more explicitly in the revised version.\n\n> **6. Related literature:**\ni). Existing works on handling copier attack [2,3,4]\nii). Why not use Banzhaf instead of Shapley as the base method?\n\nThank you for the references. Let’s discuss them.\n\n[2] proposes a specific form of utility function using Pearl’s “do” operation to differentiate between authentic contributors and copiers. Assuming access to the do-conditional probabilities, this paper essentially designed a utility function that rewards nothing to copiers. **Therefore, it can be naturally incorporated into our framework – we can simply use their utility function when we know the do-conditional probabilities and conveniently defend against the copier attack.**\n\n[4] establishes that by using a submodular utility function, Banzhaf [3] and leave-one-out can automatically defend against the following type of copier attack: a genuine contributor duplicates itself to gain higher total valuation, while Shapley does not.\n\nHowever, **this [4]'s approach is prone to \"pure infringers\" (copy attackers not associated with any genuine contributors)**, who enter the game, directly copying from valuable data points, without contributing anything in the first place.\n\nSpecifically, on why we use Shapley not Banzhaf:\n\n1. Our main target application is royalty sharing (or called “revenue allocation”). Therefore, additivity (\"efficiency axiom\") is an indispensable requirement. Banzhaf does not satisfy this requirement and cannot serve our target real-world application.\n\n2. As aforementioned, Banzhaf’s defense against the copier attack still has a significant loophole.\n\n---\n_**Reference**_\n\n[1] Li, W. and Yu, Y. One sample fits all: Approximating all probabilistic values simultaneously\nand efficiently. arXiv preprint arXiv:2410.23808, 2024.\n\n[2] Falconer, T., Kazempour, J. and Pinson, P., 2023. Towards replication-robust data markets. arXiv preprint arXiv:2310.06000.\n\n[3] Wang, J.T. and Jia, R., 2023, April. Data banzhaf: A robust data valuation framework for machine learning. In International Conference on Artificial Intelligence and Statistics (pp. 6388-6421). PMLR.\n\n[4] Han, D., Wooldridge, M., Rogers, A., Ohrimenko, O. and Tschiatschek, S., 2022. Replication robust payoff allocation in submodular cooperative games. IEEE Transactions on Artificial Intelligence, 4(5), pp.1114-1128"}, {"review_id": "k3CPaTdMRK", "reviewer": "Reviewer_R2x5", "summary": "The paper considers the problem of group data valuation and proposes axioms that a _faithful_ group data valuation method should satisfy. In particular, for faithfulness, the total valuation of the same group of data should remain unchanged, regardless of how others are partitioned. The paper suggests the sum of individual Shapley values (i.e., the Faithful Group Shapley Value (FGSV)) uniquely satisfies the required axioms.\nNext, based on the observation that a small subset of terms dominate in FGSV’s formula, the paper proposes a more efficient approximation for individual FGSV. \nLastly, the paper empirically evaluate the approximation accuracy and computation time of FGSV and other baseline methods and compare FGSV against GSV on copyright attribution in generative AI application and explainable AI applications.", "questions": "1. What is the justification for the weaker null player and symmetry axioms in Sec 3 vs their GaI counterparts? Why is this weakening needed or acceptable?\n2. In line 193-6, it is stated that SOTA individual data values require quadratic number of samples to achieve the same error tolerance. However, the quadratic number of samples (or more precisely linear multiplied by the maximum group size) can be reused across all groups $S_0, \\dots, S_k$. Algorithm 1 requires linear number of samples to achieve the error tolerance but it is only for a specific group $S_0$. With more groups (maximum $n$), the total number of samples becomes quadratic as well. Is this understanding correct? If so, is the new approximation less useful and efficient in some cases with more groups?\n3. What is the issue with small input sets (Sec 3.4)? For smaller datasets, the utility might be small but that does not mean it is meaningless. Do you mean that the variance due to the algorithm randomness is high?\n4. In Sec 4.1, it is good that the total budget of utility evaluations is fixed at 20k. However, comparing the performance and time taken based on the iteration of each method seems unfair as _different methods use different number of utility evaluations per iteration_ (e.g., permutation vs single utility). Theorem 3 suggests a comparison based on the same number of utility evaluations instead. \n    * Can you compare based on the number of utility evaluations (plot of AUCC/MSE against number of utility evaluations)? \n    * Can you report the total runtime instead? Is the runtime for a single FGSV or all $n$ FGSVs?", "limitations": "The authors only discussed another unaddressed attack strategy in the conclusion.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths\n1. It is significant and important to design group data valuation that satisfy the faithfulness axiom and is resistant to the splitting and shell company attacks. While summing the individual Shapley values seem like a natural solution, the paper also proposes a novel technique to compute the FGSV more directly and efficiently.\n\n### Weaknesses\n1. The clarity of the paper can be improved.\n    * A few claims need some clarifications (see questions below)\n    * Some notations are unexplained, e.g., $\\asymp$ in Theorem 3, $\\mathcal{P}\\^s$ on line 77, $\\mathcal{Z}\\^s$ in Assumption 1 and 2. Is  $\\mathcal{P}^s$ the uniform distribution over all subsets of size $s$?\n    * It would be helpful to provide the intuitive version and justification of the prudence condition (Eq 3) and axioms in Sec 3 so that the reader would not have to infer them. It is also helpful to provide some intuition about the proof of the proposition and the theorem in the main paper.\n2. There are some concerns about the experiment settings and whether it demonstrates FGSV better efficiency and approximation quality over other individual SV estimation methods (see questions below)\n\n### Minor Comments\n* Using $s_1$ instead of $s_1/s$ in the definition of $\\mu$ (Eq. 6) may be cleaner. $\\mu$ depends on the set $S_0$ not just the size $s_0$.\n* For the copier/replication attack, see Han, D., Wooldridge, M., Rogers, A., Ohrimenko, O., & Tschiatschek, S. (2022). Replication robust payoff allocation in submodular cooperative games. IEEE Transactions on Artificial Intelligence, 4(5), 1114-1128.", "was_revised": true, "final_justification": "The authors' response has addressed my question and concerns. I have raised the score slightly.", "rebuttal": "Thank you for your thoughtful and constructive comments. \n\n> **1. Notation clarification and improvement suggestions (minor comment 1)**\n\nWe will improve clarity in the revised paper.\n- \"$\\asymp$\" is imported from calculus to denote asymptotic equivalence: $a_n\\asymp b_n$ means both $a_n=O_p(b_n)$ and $b_n=O_p(a_n)$. Here, $a_n=O_p(b_n)$ means that the sequence $a_n/b_n$ is bounded in probability.\n- \"$\\mathcal{P}^s$\" denotes the product distribution of $s$ independent samples from the distribution $\\mathcal{P}$, i.e., $S\\sim\\mathcal{P}^s$ if $S=(z_1,\\dots,z_s)$ with $z_i\\stackrel{\\mathrm{iid}}{\\sim}\\mathcal{P}$.\n- Similarly, \"$\\mathcal{Z}^s$\" denotes the Cartesian product of $\\mathcal{Z}$ taken $s$ times, i.e., $S\\in\\mathcal{Z}^s$ if $S=(z_1,\\dots,z_s)$ with each $z_i\\in\\mathcal{Z}$. \n- Following your suggestion, we will revise the paper using $s_1$ in Eq (6).\n\n> **2. How to understand the prudence condition?**\n\nPrudence is a classical concept in economics: a consumer is called “prudent” if they save more when facing greater future income risk – mathematically, this is characterized as the utility’s third derivative being nonnegative [4].  In machine learning applications, several popular utility function curvatures satisfy the prudence condition, such as\n- Power‑law utilities ($\\bar U(s)\\propto s^a$ with $0<a<1$)\n- Logarithmic utilities ($\\bar U(s)\\propto \\log s$)\nFor instance, empirical studies report that scaling laws in deep learning [2] and large‑language‑model performance [3] follow power‑law trends in sample size \\(s\\), thereby also satisfying the prudence condition.\n\n> **3. How to interpret the axioms in Definition 2? Why use weaker null player and symmetry axioms, compared against their GaI counterparts, why is this needed or acceptable?**\n\nOur five axioms closely mirror the classical Shapley axioms, with only minimal adaptations to enforce faithfulness against shell attacks. We will add references, include a concise recap in the appendix, and provide clear explanations in the main text so readers can readily understand each axiom’s intent in the revised version.\n\nThe weaker null player and symmetry axioms are both mathematically necessary and conceptually sensible.\n\n**Mathematical necessity.**  Roughly speaking, we can think of axioms as “assumptions” or “requirements”.  Stronger axioms make it harder to find compliant valuation methods.  To fence off the shell company attack, the valuation method must satisfy our newly identified faithfulness axiom.  Then, if one still enforces the GaI version of axioms 1–4, no method can comply with all five axioms.\n\nTo illustrate, consider the following toy example:\n\n**Players** $\\\\{1,2,3\\\\}$ are fully interchangeable but **do not collaborate**: the utilities are\n$$\nU(S)= \\begin{cases} 0, & S=\\varnothing,  \\\\\\ 1, & S\\neq\\varnothing. \\end{cases}\n$$\nIn other words, adding a second or third player to a nonempty set brings **no extra utility** beyond what a single player already provides.\n\n**Grouping** $A=\\\\{1,2\\\\}$ vs. $B=\\\\{3\\\\}$.  Under GaI‑Symmetry, groups $A$ and $B$ are each treated as atomic players.  Symmetry requires that if  \n$$\nU(S\\cup A)=U(S\\cup B)\\text{ for all }S\\subseteq \\\\{1,2,3\\\\}\\setminus(A\\cup B),\n$$\nthen they must receive equal value, i.e. $\\phi(A)=\\phi(B)$. Here the only external coalition is $S=\\varnothing$, and $U(A)=U(B)=1$, so GaI‑Symmetry forces $\\phi(A)=\\phi(B)$.\n\n**This fails to comply with axiom 5.** Since each atomic player contributes the same marginal utility (1 when first added, 0 thereafter), a faithful valuation should assign $A$ twice the value of $B$, reflecting its two members. The GaI axioms obscure this intra‑group structure, leading to the mismatch.\n\n**Conceptual sensibility.**  The GaI paradigm treats each group as an indivisible “super‑player,” ignoring interactions and unique contributions from its members.  This is partially why GaI is vulnerable to the shell company attack. Therefore, to develop a more robust valuation method, null player and symmetry must be revised to reflect interactions between individuals, ensuring that grouping does not cut off these interactions as it does in GaI.\n\n\n> **4. Provide proof sketches**\n\nThank you for the suggestion. In the revised appendix, we will include a high‑level outline of the main ideas at the beginning of each major proof to help readers follow the reasoning without wading through every technical detail.\n\n> **5. Related work on copier attack [1]**\n\nThank you for suggesting this paper. We will certainly cite this work in our revised paper. This paper establishes that when using a submodular utility function, Banzhaf and leave-one-out can automatically demotivate self-duplication from genuine contributors, while Shapley does not.  It successfully addresses a key subtype of copier attack. Other subtypes of copier attack may require different solutions. For example, the challenge of \"pure infringers\", where new entrants who contribute nothing but copy valuable data from others, remains an open problem. It would be an interesting future direction to investigate how to simultaneously protect against both the broader class of copier attacks and the shell company attack that is the focus of our work.\n\n> **6. SOTA methods for individual SV produce approximations for all $\\mathrm{SV}(i)$’s, while this paper’s algorithm for FGSV only computes for one $\\mathrm{SV}(S_0)$.  What if there are multiple $S_0$’s to evaluate – is it still faster?**\n\nYes, our method remains faster than individual‑Shapley approximations as long as the number of groups $K$ grows as $o(n)$. Ignoring logarithmic factors, existing individual-SV-based methods require $O(n^2)$ utility evaluation to compute all SV$(S_k)$ terms for $k \\in \\\\{1, \\cdots, K\\\\}$. In contrast, our method requires only $O(n)$ utility evaluations to compute a single $\\mathrm{SV}(S_0)$, so applying it to $K$ groups costs $O(Kn)$, strictly better than $O(n^2)$ as long as $K=o(n)$.\n\nWhen there are O(n) groups with balanced group sizes, the scenario is usually not noticeably different than an individual data valuation problem.  In this case, we recommend using individual‑Shapley approximations.\n\n> **7. Clarify what’s the issue for small input sets (Section 3.4).**\n\nFirst, we clarify that in applications where $U(S)$ is well-defined for small input sets, we do not engage the padding procedure in Section 3.4.  For instance, in Section 4.2, $U(S)$ describes the performance of a foundation model fine-tuned on a small data set $S$.  Since the model is already pretrained, even an empty $S$ gives meaningful $U(S)$. We did not enact Section 3.4 in this example.\n\nNext, we provide some concrete examples where this padding procedure may be useful.\n- Let the utility be the residual norm of standard linear regression with $p$ predictors, then U(S) is not well-defined for $|S|<p$.\n- Another example is that modern learning methods, such as DNN, typically require big data and do not produce informative learning outcomes if trained on small data – in this scenario, the utility, as you mentioned, is unstable and untrustworthy (think of a classification method trained based on 10 observations).  \n\nIn these examples, by injecting non-informative data to complement small $S$, we stabilize $U(S)$ in a meaningful way and ensure that $U(S)$ for small $S$ is close to the baseline $U(\\emptyset)$, which itself also requires a meaningful “padding” in some examples.\n\n> **8. Clarify the computational cost comparison in experiment 1 (Section 4.1)**\nYou commented: “Can you compare based on the number of utility…” and “Can you report the total runtime instead?” \n\nThank you for asking. We would like to clarify a possible misunderstanding: in line 268, we wrote that “recorded the FGSV estimate every 200 iterations,” but the term “iterations” was intended to mean “utility calls”. Therefore, each method was executed with the same total number of utility calls, 20,000, ensuring a fair comparison across all estimators at each evaluation point. The AUCC plots are already generated with the same number of utility evaluations for a direct comparison consistent with Theorem 3.  Regarding runtime, the reported value corresponds to the total runtime required to compute the FGSV’s for all groups. We will improve clarity and avoid potential confusion in the revised version.\n\n---\n_**References**_\n\n[1] Han, D., Wooldridge, M., Rogers, A., Ohrimenko, O. and Tschiatschek, S., 2022. Replication robust payoff allocation in submodular cooperative games. IEEE Transactions on Artificial Intelligence, 4(5), pp.1114-1128\n\n[2] Hestness, Joel, Sharan Narang, Newsha Ardalani, Gregory Diamos, Heewoo Jun, Hassan Kianinejad, Md Mostofa Ali Patwary, Yang Yang, and Yanqi Zhou. 2017. “Deep Learning Scaling Is Predictable, Empirically.” arXiv [Cs.LG].\n\n[3] Kaplan, Jared, Sam McCandlish, Tom Henighan, Tom B. Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. 2020. “Scaling Laws for Neural Language Models.” arXiv [Cs.LG]. \n\n[4] Sandmo, A. 1970. “The Effect of Uncertainty on Saving Decisions.” The Review of Economic Studies 37 (3): 353."}]

Author rebuttal:

Meta-review: This paper considers the problem of dataset valuation using the Shapley value, and the objective is to be "robust" against other players that could split/merge their dataset to lower the value of a single player.

This idea is quite new and interesting, and of practical interest.

This is the reason why, even if the reviewers had some questions and concerns, they were all rather positive about this paper. So I went through it and it is, indeed, quite interesting.

For this reason, I am also in favor of accepting this paper to NeurIPS 2025 !
Decision: Accept (poster)