Final-Model-Only Data Attribution with a Unifying View of Gradient-Based Methods
Authors: Dennis Wei
Inkit Padhi
Soumya Ghosh
Amit Dhurandhar
Karthikeyan Natesan Ramamurthy
Maria Chang
Venue: NeurIPS 2025 poster ()
Keywords: training data attribution
influence functions
further training
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: We draw attention to the final-model-only setting for training data attribution, propose a further training gold standard for it, and show how various gradient-based methods approximate further training.

Abstract: Training data attribution (TDA) is concerned with understanding model behavior in terms of the training data. This paper draws attention to the common setting where one has access only to the final trained model, and not the training algorithm or intermediate information from training. We reframe the problem in this "final-model-only" setting as one of measuring sensitivity of the model to training instances. To operationalize this reframing, we propose *further training*, with appropriate adjustment and averaging, as a gold standard method to measure sensitivity. We then unify existing gradient-based methods for TDA by showing that they all approximate the further training gold standard in different ways. We investigate empirically the quality of these gradient-based approximations to further training, for tabular, image, and text datasets and models. We find that the approximation quality of first-order methods is sometimes high but decays with the amount of further training. In contrast, the approximations given by influence function methods are more stable but surprisingly lower in quality.

Final-Model-Only Data Attribution with a Unifying View of Gradient-Base Methods
Dennis Wei
Inkit Padhi IBM Research
Soumya Ghosh Merck Research Labs
IBM Research dwei @us. ibm. com
Amit Dhurandhar IBM Research
Karthikeyan Natesan Ramamurthy
Maria Chang IBM Research
IBM Research
Abstract
Training data attribution (TDA) is concerned with understanding model behavior in terms of the training data. This paper draws attention to the common setting where has access only the final trained model, and not the training al- gorithm or intermediate information from training. We reframe the problem this "final-model-only"" setting as of measuring sensitivity of the model training instances. To operationalize this reframing, we propose propose.urtther further training, with appropriate adjustment and averaging, as gold standard method to measure sensitivity. We then unify existing gradient-based methods for TDA by showing that they all approximate the further training gold standard in different ways. We investigate empirically the quality of these gradient-basse approximations to fur- ther training. for tabular, image, and datasets and models. We find that the approximation quality of first-order methods is sometimes high but decays with the amount of further training. contrast, the approximations given by influence function methods are more stable but surprisingly lower in quality.
Introduction
Training data attribution (TDA, or sometimes simply "data attribution") refers to the attribution or explanation of ML model behavior terms of its training data. Existing methods for TDA fall into several categories: re-training-baser approaches 2
5 6 7 gradient-based approaches
applied throughout training 8 10 I and gradient approaches applied only the end (12 13
14 15] 67,
18 19 20).
We refer to the survey by 21 for a deeper look at these categories.
reflective approach. First, we draw attention to the fact that there exist multiple problem settings for TDA, alongside the multiple categories of methods. These problem settings differ in the level of access assumed. In particular, focus on what we call the "final-model model-only"" (FiMO) setting which we have access only to the final trained model, and not the algorithm used to train the model or intermediate information from training (for example checkpoints). The FiMO setting is motivated by the common scenario in which TDA performed by different party than the one who developed the model. Models published platforms such as HuggingFace have now made this scenario ubiquitous.
In this paper, rather than proposing another TDA method, take
We find that since the TDA literature has not clearly differentiated these problem settings, it is also not clear on what should be the goal for TDA in the FiMO setting, and accordingly, what could be an ideal "gold standard" method. Having such goal and gold standard (as opposed to proxy tasks such as mislabelled example detection) facilitates the development and evaluation of more practical methods. We thus reframe the problem in the FiMO setting as of quantifying sensitiviry of the
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Table 1: Comparison with other retrospective works on TDA plus
[2]
(FT Further training)
Category
Attribute
Ours
12
24
25
26
28
Setting
FIMO (explicit)
FT refinements
Training randomness
Non-convergence
/
Derivations
Non-comvexityyAaaaioaariy
Generalized influence functions
Scope
# TDA methods evaluated
8
2
3
2
2
model to training instances. We call the reframed problem "FiMODA" (DA for data attribution). We then propose further training, starting from the given final model, as gold standard measure of sensitivity. Notably, our proposal adjusts for the effect of further training non-converged models and accounts for the randomness of neural network training algorithms. These refinements have consequences as we show in our experiments.
Like re- re-training") further training model multiple times can be computationally prohibitive. We thus consider approximations based on first- and second-order Taylor expansions of the further training objective. In doing so, we unify several existing gradient-based methods for TDA. These methods include gradient similarity [22 (a smal-checkpoint-only case of TracIn (}) and methods based
on influence functions [12
18
19 23 20]. Given that these gradient- based methods approximate
further training as we show, we submit that they are more suited to the FiMO setting, rather than as approximations to re-training where their effectiveness has been questioned 24 25]. Our derivation of gradient-basee methods also does not make assumptions convexity or stationarity that are result.
common in the TDA literature, and obtain generalized influence function expressions
We investigate empirically the quality of the approximations to further training provided by different gradient-based methods. Our experiments span the modalities of tabular, image, and text data. Overall, we find that first-order gradient-based methods can give good initial approximations to further training, but the quality of approximation decays with the amount of further training. In contrast, the approximation quality of influence function methods is more persistent, but somewhat surprisingly, never as high as first-order methods at their peak. We provide code to help reproduce our experiments at httpt:://s/tt //tt::///gttbb com/ IBM/ / imoda
Our contributions are summarized as follows and in Table 1) We highlight the FiMO setting for TDA (Section 2). 2) We reframe the TDA problem in the FiMO setting as one of quantifying sensitivity. We articulate and refine further training gold standard for this reframed problem (called FiMODA, Section 3). 3) We show how several gradient-based TDA methods approximate further training, theoretically (Section 4 and numerically (Section 6
2 Problem Settings for Training Data Attribution
all problem settings that we consider for TDA, we are given access to the training dataset D = {z, ) for the model, consisting of n pairs Y: E V. A model f(;; 0) is a function f X - F, parameterized by 0 E R", that maps to an output space F (e.g., predicted logits for classification model). The quality of each model output f 0) with respect to target is measured by a loss function (ff D));; we adopt the more compact notation L(z,;0 0) A {( (a; 0), y:). We use A to denote the training algorithm used to train fæ:; f) on dataset D. We view A as a function that takes D and initial model parameters (()) (which may come from a pre-trained model) as input and outputs final model parameters of = A(D, (())..
Preliminaries
(zx, y1) of inputs æ; E X' and targets
Given test instance = (ær, y) and evaluation function g(z, 0) that depends in general on both [(:;; 0) and y, the task of TDA to assign scores a; quantifying the importance of each training instance z; to the output g(2, 0). We refer to a, interchangeably
attribution influence score. Commonly, the evaluation function the loss on z, g(2, , 0) L(z; 0), or the output of the model alone, g(2, 0) f(=; 0). One may also consider evaluation functions that sum over test instances
Three problem settings
We distinguish three problem settings for TDA, based on the level of access to the above-defined quantities:
'Trrougoout the paper, reserve the term "re- "re-training" to mean re-training from scratch.

---

1. Training Algorithm Available (TAA): In this first case, we have access to the training algorithm A. TDA can therefore be done by re-training the model on (i.e., applying A to) different subsets of 'D and evaluating the resulting effects. This scenario typically occurs when the parties training the model and performing data attribution are the same.
2. Checkpoints Available (CPA): We do not have access to A but do have intermediate information from the training process, for example intermediate model parameters g(t) (i.e., "checkpoints") or gradients [af(z; (()), as well as algorithm details such as learning rates. Here, TDA can be done by "tracing" the effect of training instances throughout the process. This scenario is also more typical when model training and data attribution are performed by the same party.
3. Final Model Only (FiMO): We have access only to the final model fa(::; o() and not the training algorithm A or intermediate information. The algorithm A may actually be unavailable, or may be available but too computationally expensive or otherwise undesirable to re-run. This scenario typically occurs when model training and data attribution are performed by different parties.
The three settings also differ in the object being attributed. In the TAA setting, it is the algorithm A and its sensitivity to different training instances 2,. In the CPA setting, it is the training trajectory. The FIMO setting is the most focused on the final model f (x;;0) 0 that will actually be used.
In the remainder of the paper, we focus on the FIMO setting as it requires the least amount of access and is thus the most widely applicable. It applies for example to open-weight, models that are freely downleadable from platforms such HuggingFace. By extension, the FiMO setting applies in cases where methods for the TAA and CPA settings (i.e., re-training and tracing methods) cannot be used P We will use the term "FiMODA" to refer to TDA in the FIMO setting and distinguish it from the standard TDA problem.
3 A Further Training Gold Standard for Final-Model-Only Data Attribution
We first consider the question of how FiMODA should ideally be done, i.e., what should be the goal and what could serve as a "gold standard" method, where the gold standard also respects the FIMO constraint. While gold standard method may be very expensive to carry out in many cases, is nevertheless useful in evaluating and developing approximate FiMODA methods that are more practical, However, since the TDA literature has not explicitly delineated the FiMO setting to our knowledge, it is also not clear what the goal and gold standard should be.
Returning for moment to the TAA setting, the natural question to ask there is one of contribution: how much does a training instance z; con- tribute to the model through the train- ing process? Accordingly, variants of re-training, designed to estimate these contributions, are accepted as gold standards. The simplest of these is leave-one-our (LOO) re-training where each instance 2, is left out of the training set in turn to assess its contribution. For FiMODA however, it is not clear how one can "go back in time" to determine contributions to the final model. Instead, we change the question to one of sensitivity: how sensitive is the given model to train- ing instance 2;? To measure these sen- sitivities, we propose further training as a gold standard, in a manner analo- gous to how re-training used in the T'A setting.
output function g(z,
of + AD
9 (z. or + =OCD_.)
07 (0(
0
(z, or + &O(D))
Figure 1: Given only final model with parameters 05, the proposed further training gold standard measures the model's sensitivity training sample by further training on the full training set D as well as leaving out sample i (D -i) resulting in changed parameters 0 + A and 0f + AD(D_.) )). The difference in outputs g(z, of + AO(D_.) - g(z, or A (D)) indicates the sensitivity to i. For stochastic training, this process is repeated to obtain the expected sensitivity.
Naturally, if the increased access of the TAA and CPA settings is available, then methods that take advantage of this can do more than is possible in the FIMO setting.
3

---

Further training can be described generically as follows. We start from the given parameters 0 and train on dataset D' using an algorithm A', i... 0f + A0 = A' AD' 0 ), where D' and A' are generally different from D and A. In this work, we restrict attention to LOO further training. corresponding to LOO datasets D' = D_i A D {z; as well as D = -D. This restriction aligns with the gradient- based methods discussed in Section 4 more general perturbed datasets D' are of course possible. As for A', our desire is for it to be representative of neural network (NN) training. We thus assume that A' seeks to minimize the empirical risk R(D'; 0) _ ΣzYED' 0)z;0):
A@(D))
min ;(D'; 0 + =0)),
where E arg min means "an approximate minimizer" (note that ① may not have unique minimizer),
the notation 0/ + A0 is meant to indicate that the optimization initialized at 0f (20 = 0), and A0(D") is the change in parameters resulting from applying A' to (D', O²).
We now discuss refinements to further training to address two issues inherent to typical NN training
Non-convergence:
The "final" parameters 0f are often not a stationary point of the empirical risk.
Hence, shown in Figure I further training on the original training set D' = D generally yields non-zero change (D) and a corresponding change in the evaluation function g(z, o + A))))) We refer to this as the effect due to further training alone. Similarly, A0(D=;) and g(2, 01 AD(D_:)) are the effects of further training without instance z₁. The difference in outputs,
g(z. 0f + A0(D-.)) g(2, 0f + AO(D)),
(2)
can therefore be interpreted as the sensitivity to the presence of z;, where we have adjusted for the effect of further training alone.
The training algorithm A' also depends on random elements, notably the order of instances in each training epoch. Denoting these random elements as &, the change in parameters becomes a function of ç, 0f + A0(D',
Stochasticity of training:
A'(D', ,),5), as does the evaluation function g(z, 0f + AO ())). We view & as nuisance parameter, an artifact of the stochastic nature of modern training algorithms. Thus, we would ideally like to take an expectation over g. Applying this to the difference in (2) yields
0. = E [g(2 of + AO)D-.,)) - g(2, os + AO(D,
as the adjusted and expected sensitivity to leaving out instance 2,. Equation is our proposed gold standard attribution score based on further training.
As mentioned above, further training is a natural analogue of re- re-training from scratch, and as shown in the next section, it is approximated by several gradient- based TDA methods. To further support the validity of further training, Appendix [E.2 shows that the sensitivities quantified by further training can also detect mislabelled examples and provide insights into model behavior.
4 Gradient-Based Methods as Approximate Further Training
The further training gold standard described in the previous section is computationally expensive. In the case of LOO further training, the number of further trainings scales with the training set size at least the number of training instances for which we wish to estimate attribution scores. If we wish to approximate the expectation in 3 by averaging over multiple realizations of &, that further scales the cost. It is natural therefore to consider approximate further training. In this section, we assume that the amount of further training is limited, so that the resulting changes in model parameters, A0, are small. We show that several gradient-based methods for TDA can be re-derived from this perspective. We argue therefore that they better viewed approximations further training and better suited to FiMODA than to other TDA variants.
It is important to note that unlike the standard influence function literature, do not assume that the empirical risk R(D', 0) is convex, nor do we assume that the given parameters 0f are a stationary point of R(D, 0) over the full training set D. As result of the latter, we obtain generalized influence function expressions (Proposition [ and Corollary 2}. While we then specialize to the standard expressions used in existing works, the generalized expressions could be useful in future work.
For convex training objectives, these issues are not much of a concern (please see Appendix A

---

4.1 Approximate further training
The assumption of small A leads us consider first- and second-order Taylor expansions of (T)
AO(D') = arg min R(D'; 0z) + (VoR(D';0') so 20+ ~0" 2 V''''' 00
2 (4)
where VoR(D'; 01) and 22 R(D"; 0*) denote the gradient and Hessian of the empirical risk with 01, and the first-order expansion omits the Hessian term. In both
respect to 0 evaluated cases, an &g regularizer (A/2) A0 222 has been added in (4), corresponding to the "damping" term in influence function estimation. As discussed in Appendix [B.1] the regularizer can be motivated two ways: 1) enforcing the smallness of Á and the accuracy of the Taylor expansion; 2) ensuring that solutions to 4 do not diverge. To achieve 2), we make the following assumption.
Assumption If the Hessian Vg RDD'; 0f) is present in (4. then -Amin (V)R(D';
where Amin denotes the minimum eigenvalue.
We may similarly expand the evaluation function g(z, 0 + A0) to first order in A0. Doing so reduces the difference in (2) to the inner product
à (Vog(z,0()) (A -o(D)).
(5)
4.2 First-order methods
In the case of first-order Taylor expansion, the absence of the Hessian term in 4 makes its solution straightforward. For D' D, we have AO -oR"V, 0f), and similarly AO(D_.)
-- (VoR(D, (oL(z, Qf)) Hence (5) becomes
à; x (Veg(z, 01)) Vol(z,, "V 03).
proportional to the inner product between training loss and test evaluation gradients. This corresponds the "Grad-Dot" method [22], and special case of TracIn [ that only the final checkpoint.
A variation is to use cosine similarity ("Grad-Cos") instead of the unnormalized inner product.
4.3 Influence function methods
To show that the approximate further training formulation in 4 recovers influence function-based TDA methods, we first present two ingredients: influence functions for and the Gauss-Newton approximation to the Hessian that is commonly made.
4.3.1 Influence functions for
Influence functions approximate the effect of down- down- weighting the training loss of instance by small amount c, i.e., of changing the empirical risk from the full-dataset risk R(D; 0) to R(D;0) () 0).
We D_ to denote this down-weighted dataset. We apply the implicit function theorem the stationary point condition for (4) to derive the following (proof in Appendix B.2). Proposition 1. Given Assumption I the parameter change due to down-weighting training instance 2; by an amount c approximated by influence functions as
(o(D_..) Σe(D) = c (H( + AI) (VoL(z;0() 0/) + v (7)
where H H00) (D))) is the Hessian of the full-dataset empirical risk evaluated at 0f,
If of is a stationary point of the full-dataset risk R(D; 0), then AO(D) AO(D) 0 and reduces the familiar inverse Hessian-gradient product (with damping):
Ao(D_1.) = (H(0') + XI) VoL(z, 0*).
(8)
If of is not stationary however, then (O(D) * 0 as discussed in Section Previous works 112 neglect the last (D) term in 7 arguing that if 0f near-stationary, then (D is small and the product e (D) is second-order. It is also convenient to neglect this term to avoid computing (O(D). We will neglect it well in the main paper to be consistent with previous TDA methods. In Appendices B.2 and B.3 however, we provide an expression for A@(D) and also show how to account for the (D(D) term in without requiring the Hessian (z):00)
5

---

4.3.2 Gauss-Newton approximate Hessian
It is often the case that the loss function L(2;; 0) is a composition {({(2; 0)) of scalar-valued model output function f(z;; 0) with a convex univariate loss function {(f) Here we allow f(z; 0) to also depend on the target yı- For example, if f(æ;;; 0) is a regression model, f(z 0) f( 0) yi can be the prediction error, For multi-class classification, [19] define f(z;; 0) to be the logit of the predicted probability of the target class y/, which allows multi-class classification to be handled in the same way (see [19] Sec. 3.3] for details).
Given the composition (z,; 0) {() 0)), the gradient and Hessian of Lzz;; 0) are given by
VoL(2;;0) (0 0), VzL(2;00) (f (f(z; (0 +2(f(z;)))
(9)
(10)
The Gauss- Newton approximation to the Hessian drops the second term in (IO), which requires the Hessian f 0) that is more difficult compute.
To obtain more compact expressions, let us define the gradient vectors gi Vol(z; 0'), 1...., n and matrix G = [g] and n x n diagonal matrix V with (f(1 (((f..,,,(((,,,,,, ) these definitions. (9). and the Gauss-Newton simplification of (TO), and disregarding the constant
gnl vector r r= 1
((F(zz;0())
) as its diagonal entries. Using
term, the quadratic optimization in (4) can be rewritten for D' = D as
min r" G20 1000+20000 (G A
(11)
The same derivation of influence functions in the proof of Proposition applies to the approximation. Effectively, ( and (10) (with the Gauss-Newton simplification) are used to substitute for the gradient and Hessian in 7
Corollary Under the Gauss-Newton approximation, the influence function in Proposition becomes
(o(D) (G"VG+NI) g..
As with Proposition] [ this is generalization of the standard influence function non-stationary 0 and non-zero (D)) It reduces to the standard form used in previous works when AO = 0:
A (Gr VG + XT) g..
(12)
4.3.3 Relationships with existing influence function methods
We now discuss how existing influence function methods correspond to the simplified versions (8) and We refer to the cited works for more details on the methods.
(12) of Proposition Tand Corollary] 2
Conjugate gradient (CG) and LiSSA Both (8) and (2) require computing an inverse Hessian- gradient product. with either the damped true Hessian H()))= + AI or the Gauss-Newton Hessian GTVG + XI. For models with a large number of parameters p. the O computational cost of directly solving the system of equations is prohibitive. 112 proposed to apply CG 29 and LiSSA
[30. two methods that approximate the solution iteratively. The former does so by applying the CG algorithm to an equivalent quadratic minimization problem, while the latter uses truncated
Neumann series. Both can be applied to either or (12).
The following methods are based and therefore specific to the Gauss-Newton approximation.
TRAK TRAK 19 can be seen as a hybrid TDA method that combines a gradient-based ap- proximation with re-training (training ensemble of models). For FiMODA where re- re-training is not possible, we focus on the gradient-based part of TRAK by setting its parameter M (number of trained models) to 1. This variant, which refer framework of Section 4.3.2 First, TRAK applies a random projection matrix P ~ No( 1)x* to reduce the dimensionality of the gradients: Φ; = PT g: and +- G.P. With &; and & in place of g; and G, TRAKM=1 corresponds to special case of (12) with À = 0 (no regularization) and V (non-identity V found empirically to have little effect), i.c., A0TRAK(D_.) = " bb.
TRAK M1 falls under the Gauss-Newton

---

23 start with the Gauss-Newton approximation in their work, corresponding to (22 Next, they adopt the K-FAC and EK-FAC approximations from B2), which first approximate the Gauss-Newton Hessian as biock-diagonal, where each block corresponds to a layer in NN. This allows influence functions to be computed separately for each layer. Then for certain layers, an uncorrelatedness assumption is made that permits Kronecker factorization of the corresponding block of the Hessian, making inversion much more efficient.
EK-FAC
Datalnf' 20 start with a variant of the Gauss-Newton approximation in which {(f) f is the identity function and g, = VzL(z;; 0f) ) is gradient of the loss. They then make the same block- diagonal/layer-wise approximation
23 Setting this simplification aside, Datalnf corresponds to (12) with r; = 1 (identity E) and V = (1/n)T (identity e, average over 'D instead of sum). The result is (D(D-.) ((L/n)GT AT) g:- The key idea of Datalnf is then interchange the order of averaging and matrix inversion (please see (20).
5 Related Work
This work builds upon existing works that also take a retrospective look at TDA methods, and
influence functions especially 24 26 27 28 25]. We discuss individual papers more in Appendix C Here, we note key differences between our work and these prior works (summarized in Table Th:
1. More gradient-based methods: Our unified view (Section 4 and numerical comparisons (Sec- tion 6 encompass gradient- -based methods beyond influence functions, including more recent ones such as TRAK and DataInf as well as first-order methods. We thereby obtain insights into similarities and differences among gradient-based methods, in addition to how well they approximate further training. In contrast, [24] 26 27 28 mainly focus on influence functions,
while [25] evaluate fewer methods than we do.
2. Further training: The further training gold standard in Section 3 formalizes and refines similar procedures used in previous works (in Appendix D.2 in (27. in Section 5.2 of (28)). The proposal of averaging over realizations of stochastic further training appears be new, and results in Figures 3 and show that brings further training closer to what gradient-
methods estimate. (27] propose an alternative gold standard called the proximal Bregman response function (PBRF).
The PBRF however involves a non-standard Bregman distance objective, tailored specifically to be closer to influence functions, whereas our further training is more generic.
3.
FIMO setting: We explicitly define the FiMO setting, which these previous works have not.
6 Numerical Comparison of Bandient-Based Methods to Further Training
In Section 4. we showed that many gradient-based TDA methods are approximations to further training for FIMODA. We now report experiments that assess the quality of these approximations. Code to help reproduce these experiments is provided h//ttps://githbb com/ IBM/ fimoda.
6.1 Experimental setup
We refer to Appendix D for more details on data, training, computation, the evaluation metric, etc.
Datasets Our experiments span the modalities of tabular, image, and text data. However, since aimed to implement the further training gold standard described in Section which is computationally expensive, our experiments
most comprehensive in the tabular case. We used four tabular datasets: two for regression, Concrete Strength and Energy Efficiency from the UCI repository (33 following
22], and two larger ones for classification, FICO Challenge (34) and Folktables (35] For image data,
we chose the CIFAR- 10 image classification dataset (36), while for text, we used the SST-2 sentiment classification dataset (37), which part of the GLUE benchmark (38].
"Final" Models For all tabular datasets, we used a 2-hidden-layer llyer multi-layer perceptron (MLP) with 128 units in each hidden layer. The MLPs were trained using stochastic gradient descent (SGD) to yield the final model fxx 01). For CIFAR-10, we used a ResNet-9 architecture (39] and trained using SGD. For SST-2, we fine-tuned pre-trained BERT model 44) using Adam [41).
Selection of test and training instances
Our aim was to estimate influence scores of subset L C. D of training instances the losses of subset of test instances. Thus, the evaluation
7

---

function was the loss, g(2,0) O(z;0). For the Concrete and Energy datasets, we considered all test instances. while for the other datasets, we selected m 100 test instances at random. The training subset L. was also selected randomly with / = | = 100 for the tabular datasets and = 50 for CIFAR-10 10 and SST-2. The training subset size was limited by our aim to conduct further training. since the number of further trainings is proportional to 1. Nevertheless, I = 50 or 100 is greater than the number of training instances used in similar retrospective work on influence functions ((27) used 20 instances according to their Appendix C.2, [88] used 32 in their Section 5.2).
Implementation of further training For the results in this section, the further training algorithm A' is the same as A, i.e., A for BERT and SGD otherwise. Appendix [E.1 has results on the tabular datasets using Adam as A' instead. We evaluated the approximation quality of prudient-basee methods as a function of the amount of further training (epochs or steps). To approximate the expectation over & in (3), we took averages over r = 100 random seeds (denoted as realizations g(*) in (13) below), which control the order of instances in each training epoch. To achieve the effect of leaving out a training instance 2;, we followed (28) in subtracting a second loss term (zz;; 0)/n from the usual loss for every batch (please see Appendix D.3 for explanation of the 1/n scaling). While (28] did not provide justification for this practice, we believe that it also mitigates the randomness of stochastic mini-batch training. since the mini-batch that 2; appears in/is left out of random.
We considered two methods for adjusting for the effect of further training alone. The first is as specified in 2 i.e., subtracting the output due further training on the full dataset DD We found however that for some datasets, this adjustment left a non-negligible bias that varies from epoch to epoch, resulting in noisy cosine similarities. Please see Appendices DD3 and [or further discussion of and results from this first method. The second method (used in this section) subtracts the mean of the effects due each LOO dataset D_i. Incorporating also the averaging over random seeds, the "gold" attribution score from further training is thus
g( 9(2, or + ()))
E =0(D= FEC
a; r
(13)
Approximate FIMODA methods
We experimented with the first-order methods Grad-Dot 22
sinal-checkpoint-on) TracIn (1) and Grad-Cos, and influence function methods CG and LiSSA
30 12]. TRAK M= 19]. FK-FAC 233. and DataInf (2) For LiSSA, we considered both the
Gauss-Newton version ( (1)). referred simply "LiSSA") as well the true Hessian version X
LiSSA-H). For CG, only the Gauss-Newton version was used. CG could not be run on CIFAR-10 10 and
SST-2 because it took too long, whereas LiSSA-H ran out of GPU memory on SST-2. For both CG and LiSSA, we used a damping value of À = 0.01, which we found to yield a better approximation to further training than the À= = 0.001 value used by 2 (see Appendix D.4 for other parameter settings). We adapted TRAK for regression (see Appendix D.4.
Evaluation metric For each test instance evaluated, we have vector a E R' of gold attribution scores from further training (13), and corresponding vectors from gradient- based methods. We use the cosine similarity between and â as the evaluation metric. The choice of cosine similarity is motivated by the following reasons elaborated on in Appendix [D.] 1) It measures similarity in signed magnitudes between and which is in line with the derivations in Section 4 2) is not sensitive however to an overall scale difference between and à; 3) it is a more demanding measure than Pearson correlation. Appendix E. presents qualitatively similar results using Spearman rank correlation, a common metric in the TDA literature.
6.2 Results
Similarity vs. amount of further training Figure 2 shows the cosine similarity between the attribution scores of gradient-based TDA methods and further training, as a function of the amount of further training. The curves represent the mean cosine similarity over the m test instances, while the shaded area corresponds to #1 standard error. We make the following observations:
The two first-order methods, Grad-Dot and Grad-Cos, have cosine similarity curves that decay with the amount of further training. Grad-Dot generally superior to Grad-Cos, and the initial cosine similarity of the former is among the highest of any approximate method. This aligns with Section 4.2 showing that Grad-Dot the direct result of first-order approximation of further training, whereas the normalization of Grad-Cos is not supported by the theory. The rate
First-order methods:
8

---

cogine similanty further training
codine similarity to Purther training
0.8
Gradi Det
LISSA
simllsity training
1.0
0.8
Grad-Cos
LISSAH
0.6
Datainf
EXPACC
0.0
0.6
CG
TRAK
0.4
0.6
0.4
0.4
0.2
0.0
500
further training epochs
further training apochs
further training epachs
(a) Concrete Strength
(b) Energy Efficiency
(c) FICO
1.0
Cosine Similarity to furtheer training
0.6
0.5
0.4
Gradd-sst
LISA
0.8
0.4
further
0.3
Grad-Cos
Datainf
TRAC
Grad Det
LISSA
Grad-Cos
simianiyy
0.4
Dataiin
TRAK
0.1
0.0
0.2
0.1
0.0
5
10
15
20
25
200
400
600
800
200
400
600
800
1000
further training epochs
further training steps
further training stops
(d) Folktables
(e) CIFAR-10
(1) SST-2
Figure 2: Cosine similarity between attribution scores of gradient-based TDA methods and further training, function of the number of epochs steps of further training. The legend in panel (b)
applics to (a)-(d). In panel (a), Grad-Cos occludes Grad-Dot; panel (c), LiSSA occludes CG.
decay after the initial peak varies with the dataset. One reason may be how far from stationary are the final model parameters 0f, If they are farther, then the parameter changes A and AO(D_;) are larger, the first-order approximation poorer, and the cosine similarity is thus lower. DataInf: We find it interesting that DataInf behaves like first-order method, despite its attempt to incorporate second-order information. is especially similar to Grad-Dot (cosine similarity between the two is typically above 0.95) and generally slightly higher in similarity to further training. We further interpret this similarity between DataInf and Grad-Dot in Appendix E. CG, LiSSA, LiSSA-H: Unlike the first-order methods, these influence function methods have cosine similarity curves that do not decay and may even increase with further training. However, they do attain cosine similarities as high as the first-order methods (at least within the amount of further training that we conducted). A possible interpretation is that influence function methods provide better longer-range approximations to further training by using second-order information. However, the approximation may not be especially good at any point. Among the three methods, CG and LiSSA are similar each other in the first row of Figure 2 but LiSSA seems to degrade in the second row as the model size increases. LiSSA-H on the other hand is consistently worse. EK-FAC, TRAK M=1: These influence function methods make additional approximations. Com- pared to LiSSA, EK-FAC has similar higher cosine similarity in Figures 21 but is worse in 2c TRAK did not give good approximations to further training (please see Appendix E. C-FAR-10, SST-2: The cosine similarities are significantly lower for these non-tabular datasets. The immediate reason for this is that the gold attribution vectors a behave differently than they do for tabular data, discussed in Appendix E.1
Similarity vs. amount of averaging In Figure 3 we plot the maximum cosine similarity over epochs/steps (i.e., the maximum of each curve in Figure 2 as a function of the number of random seeds averaged in (13) obtain gold attribution values. The exact averaging procedure is given in Appendix E.I along with a full version of Figure 3 with all datasets (Figure (7]. We find in all cases that the cosine similarities increase with the number seeds, implying that the averaging training runs brings it closer to what gradient-baan based methods estimate. This supports our proposal of averaging and its theoretical counterpart, the expectation (3). The increases are more noticeable for the first-order methods and DataInf, and for certain datasets like SST-2.
further

---

7 Discussion and Future Work
Summary We have high- lighted the onal-model-only set- ting for TDA, recasting the prob- lem (which we call FiMODA) as one of measuring the model's 's sen- sitivity to training instances rather than their contribution. We ac- cordingly proposed further train- gold
1.0
cosine Simlenity further traiing
traniin
0.40
0.8
Grad Dot
0.30
Grad-Dat
0.6
Detaint
Grad-Cos
LISSA
0.20
LISAA
Dataint
0.4
LISSA-H
0.15
EK-TMC
TRAK
0.10
TRAK
ing, with refinements, standard method for FiMODA. We showed how several exist- ing gradient-based TDA meth- ods approximate further train- ing, theoretically and numerically. These relationships suggest that gradient- baseed methods are better suited FiMODA than other TDA settings.
0.2
0.05
10a
10-
10'
10a
10'
10"
number of random seeds averaged
number of randam seads averaged
(a) Folktables
(b) SST-2
Figure 3: Maximum cosine similarity between attribution scores of gradient- based TDA methods and further training, func-
tion of the number random seeds averaged.
Limitations The further training gold standard as described in this work is computationally expensive (as acknowledged at the beginning of Section Performing further training also limited the scale of the experiments in Section 6 in terms of the models considered, number of training instances left out, etc. The computational expense might be mitigated two ways: First, Figures and suggest that while averaging does bring further training closer to gradient-based methods, most of the gain is achieved with 10 or 20 seeds compared to 100. So reducing the number of random seeds is computational trade-off that could be made. Second, while have implemented further training as full fine-tuning, it is possible to use LoRA fine-tuning or other parameter-efficien methods (especially for LLMs) as another computational trade-off. The LoRA Ensemble method of [42] shows concretely how both ideas, ensembling and LoRA A fine-tuning, can be brought together in the context of TDA. We mention other limitations in Appendix F
Discussion of experimental results Perhaps the most salient aspect of our experimental results (Figures 2 3 in Section 6.2] and variations in Appendix (E.I) is the difference between the first-order- like methods (Grad-Dot, Grad-Cos, Datalnf) and crfuuecceffnnciin the former achieve significantly higher cosine similarities than the latter when the amount of further training is low. This contrasts with previous work in TDA in the TAA or CPA settings, where influence- Lunction-based methods are generally seen stronger I9 I. Our results for TRAK may be especially surprising in this regard, for which we point to two factors: First, in the FiMO setting, have only M checkpoint and can only evaluate the TRAK variant, whereas [19 shows that using an ensemble of M > checkpoints greatly improves performance. Second, we compute similarity with further training attribution values, whereas [19 evaluate using their linear datamodelling score (LDS) metric, which is based on re- re-training and for the TAA setting.
methods. In particular,
Overall however, think that our experimental results leave something to be desired for researchers in TDA. It could be argued that the gradient-basse based methods are "actually similar" to further training only for the first-order-liks methods, under limited further training, and perhaps not at all in Figures 2e] 21
(It is perhaps worth recalling that all these gradient-basse methods are existing and we are not advocating for any particular method.) Our results therefore motivate development of higher-quality approximate FiMODA methods, especially for non-tabular models. One possible starting point is the generalized influence function expressions in Proposition T and Corollary 2 which suggest
potential role for the parameter change A@(D) from further training on the full dataset. Moreover, Figure 2 suggests the question of whether the strengths of first- and second-order methods could be combined, i.e., higher initial similarity with less decay. We note that the damping parameter could be used to interpolate between first- and second-order methods.
Additional future work Appendix F elaborates on following points: 1) What is the right amount of further training to determine sensitivity to training instances? 2) Section 3 restricted attention to LOO further training to align with gradient-based methods; group influence 14 16
is worthy of further study. 3) Further training could also be applied to wnseen data.
10

---

Acknowledgements
We thank Swagatam Haldar for early discussions on the TDA literature. We also thank the anonymous NeurIPS reviewers for their constructive comments and discussions, in particular for clarifying that we are indeed reframing the problem for the FiMO setting and for suggesting an expanded discussion section.
References
[1] Amirata Ghorbani and James Zou. Data Shapley: Equitable valuation of data for machine learning. In Proceedings of the 36th International Conference Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages
PMLR, 09-15 Jun 2019.
[2] Amirata Ghorbani, Michael Kim, and James Zou. A distributional framework for data valuation. In Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pages 3535-3544 PMLR, 13-18 Jul 2020.
[3] Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. In Advances in Neural Information Processing Systems, volume 33, pages 2881-289) Curran Associates, Inc., 2020.
[4] Yongchan Kwon and James Zou. Beta Shapley: A unified and noise-reduced data valuation framework for machine learning. In Proceedings of The 25th International Conference on Artificial Intelligence and Statistics, volume 151 Proceedings of Machine Learning Research, pages $780-8802. PMLR, 28-30 Mar 2022.
[5] Andrew Ilyas, Sung Min Park, Logan Engstrom, Guillaume Leclerc, and Aleksander Madry, Datamodels: Understanding predictions with data and data with predictions. In Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pages 5525-9587, PMLR, 17-23 Jul 2022.
[6] Jinkun Lin, Anqi Zhang, Mathias Lécuyer, Jinyang Li, Aurojit Panda, and Siddhartha Sen. Measuring the effect of training data deep learning predictions via randomized experiments. In Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pages 13468 135844. PMLR, 17-23 Jul 2022.
[7] Jiachen T. Wang and Ruoxi Jia. Data Banzhaf: A robust data valuation framework for machine learning. Proceedings of The 26th International Conference on Artificial Intelligence and Statistics, volume 206 of Proceedings of Machine Learning Research, pages 6388 6421. PMLR, 25-27 Apr 2023.
[8] Satoshi Hara, Atsushi Nitanda, and Takanori Machara. Data cleansing for models trained with SGD. In Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019.
[9] Garima Pruthi, Frederick Liu, Satyen Kale, and Mukund Sundararajan. Estimating training data influence by tracing gradient descent. Advances in Neural Information Processing Systems, 33:19920-19930, 2020.
[10] Yuanyuan Chen, Boyang Li, Han Yu, Pengeheng Wu, and Chunyan Miao. HyDRA: Hypergra- dient data relevance analysis for interpreting deep neural networks. Proceedings the AAAI Conference on Artificial Intelligence, 15(8))7081-7089 May 2021.
[11] Juhan Bae, Wu Lin, Jonathan Lorraine, and Roger Baker Grosse. Training data attribution via approximate unrolling. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
[12] Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions.
In International Conference on Machine Learning, pages 1885-1894, PMLR, 2017.
[13] Chih-Kuan Yeh, Joon Kim, Ian En-Hsu Yen, and Pradeep K Ravikumar. Representer point selection for explaining deep neural networks. Advances in Neural Information Processing Systems, volume 31. Curran Associates, Inc., 2018.

---

[14] Pang Wei W Koh, Kai-Siang Ang, Hubert Teo, and Percy S Liang. On the accuracy of influence functions for measuring group effects. In Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019.
[15] Elnaz Barshan, Mare-Etienne Brunet, and Gintare Karolina Dziugaite. RelatIF: Identifying explanatory training samples via relative influence. In Proceedings of the Twenty Third Inter- national Conference on Artificial Intelligence and Statistics, volume 108 of Proceedings of Machine Learning Research, pages 1899-1909. PMLR, 26-28 Aug 2020.
[16] Samyadeep Basu, Xuchen You, and Soheil Feizi. On second-order group influence functions for black-box predictions. In Proceedings of the 37th International Conference on Machine Learning, volume 1 119 of Proceedings of Machine Learning Research, pages 715-724. PMLR, 13-18 Jul 2020.
[17] Han Guo, Nazneen Rajani, Peter Hase, Mohit Bansal, and Caiming Xiong. FastIF: Scalable influence functions for efficient model interpretation and debugging. In Proceedings of the 2021 Conference Empirical Methods in Natural Language Processing, pages 10333-10350, Online and Punta Cana, Dominican Republic, November 2021. Association for Computational Linguistics.
[18] Andrea Schioppa, Polina Zablotskaia, David Vilar, and Artem Sokolov. Scaling up influence functions. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 1179-81864 2022.
[19] Sung Min Park, Kristian Georgiev, Andrew Ilyas, Guillaume Leclerc, and Aleksander Madry. TRAK: Attributing model behavior at scale. In Proceedings of the 40th International Conference on Machine Learning. volume 202 of Proceedings of Machine Learning Research, pages 27074- 27113, 23 29 Jul 2023.
[20] Yongchan Kwon, Eric Wu, Kevin Wu, and James Zou. DataInf: Efficiently estimating data influence in LoRA-tuned LLMs and diffusion models. The Twelfth International Conference on Learning Representations, 2024.
[21] Zayd Hammoudeh and Daniel Lowd. Training data influence analysis and estimation: A survey. Machine Learning, 1 113(5)2335122005 May 2024.
[22] Guillaume Charpiat, Nicolas Girard, Loris Felardos, and Yuliya Tarabalka. Input similarity from the neural network perspective. In Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019.
[23] Roger Grosse, Juhan Bae, Cem Anil, Nelson Elhage, Alex Tamkin, Amirhossein Tajdini, Benoit Steiner, Dustin Li, Esin Durmus, Ethan Perez, et al. Studying large language model generalization with influence functions. arXiv preprint arXiv:2308. 03296, 2023.
[24] S Basu, P Pope, and S Feizi. Influence functions in deep learning fragile. In International Conference on Learning Representations (ICLR), 2021.
[25] Elisa Nguyen, Minjoon Seo, and Seong Joon Oh. A Bayesian approach to analysing training data attribution in deep learning. Advances in Neural Information Processing Systems, 2023.
[26] Rui Zhang and Shihua Zhang. Rethinking influence functions of neural networks in the over-parameterized regime. Proceedings of the AAAI Conference on Artificial Intelligence, 36(8):9082-9090, Jun. 2022.
[27] Juhan Bae, Nathan Ng, Alston Lo. Marzyeh Ghassemi, and Roger B Grosse. If inffuence functions are the answer, then what is the question? Advances in Neural Information Processing Systems, 15:11953--7961 2022.
[28] Andrea Schioppa, Katja Filippova, Ivan Titov, and Polina Zablotskaia. Theoretical and practical perspectives on what influence functions do. Advances Neural Information Processing Systems, 36, 2023.
12

---

[29] James Martens. Deep learning via Hessian-free free optimization. In Proceedings of the 27th International Conference on International Conference on Machine Learning, ICML' 10, page 735-742, Madison, WI, USA, 2010. Omnipress.
[30] Naman Agarwal, Brian Bullins, and Elad Hazan. Second-order stochastic optimization for machine learning linear time. Journal of Machine Learning Research, 18(116):1 1-00, 2017.
[31] James Martens and Roger Grosse. Optimizing neural networks with Kronecker-factored approximate curvature. In Proceedings of the 32nd International Conference on Machine Learning. volume 37 of Proceedings of Machine Learning Research, pages -408-2417, Lille, France, 07-09 Jul 2015. PMLR.
[32] Thomas George, César Laurent, Xavier Bouthillier, Nicolas Ballas, and Pascal Vincent, Fast approximate natural gradient descent in a Kronecker factored eigenbasis. In Advances in Neural Information Processing Systems, volume 31. Curran Associates, Inc., 2018.
[33] Markelle Kelly, Rachel RachooLnggoohn, and Kolby Nottingham. The UCI machine learning repository. https://archivg: ics. uci. edu
[34] FICO. Explainable machine learning challenge, 2018. https://communi fico. wico.com//....................cl s/ explainable Malainnabe-mmchheee -earnine challengeerabsett 3158a=2
[35] Frances Ding, Moritz Hardt, John Miller, and Ludwig Schmidt. Retiring adult: New datasets for fair machine learning. Advances in Neural Information Processing Systems, 34, 2021.
[36] Alex Krizhevsky. Learning multiple layers of features from tiny images, 2009.
[37] Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pages 1631-1644 Seattle, Washington, USA, October 2013. Association for Computational Linguistics.
[38] Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R. Bowman. Glue: A multi-task benchmark and analysis platform for natural language understanding. In Proceedings of the 24th International Conference on Learning Representations, 2019.
[39] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Intl. Conference on Computer Vision and Pattern Recognition (CVPR), 2015.
[40] Jacob Devlin, Ming-Wos Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional transformers for language understanding. In Jill Burstein, Christy Doran, and Thamar Solorio, editors, Proceedings of the 2019 Conference of the North American Chupter of the Association for Computational Linguisties: Human Language Technologies, Volume I (Long and Short Papers), pages 4171-4186, Minneapolis, Minnesota, June 2019. Association for Computational Linguistics.
[41] Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. In International Conference Learning Representations, 2019.
[42] Junwei Deng, Ting-Wes Wei Li, Shichang Zhang, and Jiaqi Ma. Efficient ensembles improve training data attribution, 2024. arXiv preprint arXiv:240s.178
[43] Yuzheng Hu, Pingbang Hu, Han Zhao, and Jiaqi Ma. Most influential subset selection: Chal- lenges, promises, and beyond. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
[44] Ohad Shamir and Tong Zhang. Stochastic gradient descent for non-smooth optimization: Convergence results and optimal averaging schemes. In Proceedings of the 30th International Conference on Machine Learning, volume 28 of Proceedings of Machine Learning Research, pages 71-79, Atlanta, Georgia, USA, 17-19 Jun 2013. PMLR.
[45] Andrew R. Conn, Nicholas I. M. Gould, and Philippe Toint, Trust-region methods. Society for Industrial and Applied Mathematics, USA, 2000.
13

---

[46] Myeongseob Ko, Feiyang Kang, Weiyan Shi, Ming Jin, Zhou Yu, and Ruoxi Jia. The mirrored influence hypothesis: Efficient data influence estimation by harnessing forward passes. In Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition (CVPR), pages 26286-26295, June 2024.
[47] Sheng- Yu Wang, Aaron Hertzmann, Alexei A Efros, Jun- Yan Zhu, and Richard Zhang. Data attribution for text-to-image models by unlearning synthesized images. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
[48] F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825-2830 2011.
[49] Dennis Wei. prcision-makinne under selective labels: Optimal finite-domain policies and beyond. In Proceedings of the 38th International Conference on Machine Learning. volume 139 of Proceedings of Machine Learning Research, pages 11055-1 1046. PMLR, 18-24 2021.
[50] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Köpf, Edward Yang. Zach Vito Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. PyTorch: imperative style, high-ppeformance deep learning library. Curran Associates Inc., Red Hook, NY, USA, 2019.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims correspond to sections in the body of the paper that develop and support the claims.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Limitations are discussed in passing in the main text, in Section 7 and in Appendix FF
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model cell-speciiiiatinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
15

---

Answer: [Yes]
Justification: Proposition 1 and Corollary 2 depend on Assumption | and are proven in Appendix [B.2
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
The experimental setup described in detail in Section 6.1 and Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., .., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path reproducing verifying the results. 5. Open access to data and code
16

---

The authors should provide scripts to reproduce all experimental results for the new reproducible, they Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: provide code to help reproduce the experiments at httpp:///githi com Hum/IBM/Ffimdda
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.co cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ https/cccppbllcgggudeeeeeeeeeeee Coaee//dddeSebmmmcia ssi onPolicy) for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
proposed method and baselines. only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
The experimental setup described in detail in Section 6.] and Appendix D
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: Figures and 3 in the main paper and similar figures in the appendix show shaded regions corresponding +1 standard error and these are described in the text.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
17

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
show in tables or
error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please see Appendix D.6
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: The research does not pose special risks and adheres to the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Please see Appendix
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
18

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility MI).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: Citations and URLs are provided in Section 6.1 and Appendix D for the datasets and code repositories that were used. Licenses could not be found for the original version some of these assets.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
19

---

If assets are released, the license, copyright information, and terms of use in the thcode has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssit
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
20

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: LLMs were not used as part of the core research methods.
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: /ttt::://neurps... http://eriips.cccommeeeeeeee//// cc//oonferences/2225/ILI. for what should or should be described.
21

---

A Further Training with Convex Objectives
For more classical models such linear regression, logistic regression, and support vector machines, the empirical risk R(D'; 0 in the further training objective (T) is a convex function of the parameters 0. If we further assume that R(D'; 0) is strictly convex in 0 (which is usually the case), then the exact minimizer is unique,
0" (D') arg R(D':0)
and barring numerical issues (for example with convex optimization solvers), we can tractably compute it. Moreover, it does not matter whether the optimization is initialized at initial parameter values ((0) or trained parameters 0². Thus, further training and re-training become equivalent, provided that they optimizing the same empirical risk.
Given the relative case of obtaining the exact minimizer 0 (D) on the full training set, is reasonable to assume that any final, trained parameters have converged to it, i.e., 0f 0 (D)) In this case, there is no non-convergence problem as in Section 3 and further training would yield no change, ie.. (D = 0 in [ As for stochastic training algorithms, they can of course also be applied to convex objectives, often with convergence guarantees (see e.g. [4] one example among many). This greatly reduces the problem of stochasticity.
B Approximate Further Training
B.1 Regularizatiio/damming term
The following reasons provide optimization- based justification for the l2 regularizer (A/2) A added in (4). This corresponds to the "damping" term AI added to the Hessian in estimating influence functions, where it is usually motivated simply means to ensure invertibilityyposiiive definiteness.
1. Enforee assumption/trust region:
Penalizing the f2 norm of AO enforces the assumption that A is small. It can also be viewed as enforcing a trust region [5] region around f where the second-order expansion gives a better approximation.
2. Ensure optimization is well-posed: The loss function L(z; 0) for neural networks is typically non-convex, which implies that the empirical risk Hessian V2R(D', 05) may not be positive semidefinite. In the absence of the regularizer, if R2 negative eigenvalue, then the objective value in (4) would tend to oo in the direction of the corresponding cigenvector. If we add regularization with À larger in magnitude than the most negative eigenvalue of R)D; then such divergence is prevented and an optimal solution to (4) exists. This consideration leads to Assumption
has a
B.2 Proofs
Proof of Proposition We substitute the down-weighted risk R(D; 0) - eL(z;; 0) for R(D;0)
everywhere in (4. Then the stationary point (i.c., zero aro--gradeent) condition for becomes
F(c, VoR(D: eVe,(z; 0*) + (H() Lz) 0*) + Al) = (14)
For 0, i.., down-weigh (14) is satisfied by the full-dataset parameter change
- -
VeR(D;
(15)
For small e, we apply the implicit function theorem to obtain an expression for A0(D_,,)). The relevant Jacobians of function F defined in (4) are
Jr = H()))
(2L(Z 01) + AI,
J - VoL(2;00) (Z
from which we obtain
AO(D_..) AO(D) - - (J (J._0ol=0.N0=0000)) JF. JFrl_=0,00=0000 + +
(c(((0 + + -1 (VoL(z;:0)) +
22

---

Proof of Corollary 2 The result follows from by substituting the Hessians
(0t)) VG and VgL(Z,;1)) v.g.g VoL(z, 01) ri from and simpli- fying.
B.3 Simplification of Proposition iin the near-stationary case
If the final parameters of are star-stationary, then the parameter change (0(D) in 7 is small. We may thus use a reverse Taylor expansion approximate
VoL(z;;
(z);0)000000 R VoL 21; 22:00 of + +0(D))
which avoids computing the Hessian V2L(z;; 0¹). Equation becomes
A A0(D) = H (())) AT) VoL 2 0f Se(D))
(16)
8 is replaced with its counterpart after further training on D. Moreover, (T5) provides an expression for (D) as a Newton step from 0f.
i... the gradient (Z 0f) in the standard influence function
C More on Related Work
In this appendix, we discuss some more closely related works individually.
Bae et al. (2022) 27 examine the discrepancy between influence functions and leave-one-out re- training and decompose the discrepancy into five contributions. They show that influence functions are a much better approximation to a quantity they call the proximal Bregman response function (PBRF), which they propose as an alternative gold standard LOO re-training. The key differences between our work and 27 are as follows: 1) We propose further training based standard training objectives (e.g., cross-entropy or mean squared error, no proximity regularization) as a different, more general gold standard. In contrast, the PBRF involves non-standard Bregman distance objective, chosen specifically to be closer to influence functions. In their Appendix D.2, [27] also discuss further training with and without leaving out one sample, which they refer as Etwo-stage LOO re- re-training." However, they do not consider taking an expectation over random trainings as we do. 2) Our unified view encompasses TDA methods beyond influence functions, including more recent methods such as TRAK [9] and DataInf (20 as well as first-order methods. We evaluate the extent to which all these methods approximate further training. [27] evaluated two TDA methods, LiSSA with and without the Gauss-Newton Hessian approximation.
Schioppa et al. (2023) 28 discuss problematic assumptions made by influence functions and TracIn [ and how these can be addressed. They then show that the predictive power of influence functions and TracIn is fundamentally limited by divergence in parameters (further) training proceeds. The latter contribution is the main point of connection with our work, where we also observe the fading of predictive power over training time, especially for first-order methods. The differences in our work are: 1) We make explicit the further training gold standard that they compare to in their experiment [28 Sec. 5.2] and further propose its expected version with respect to stochasticity in the training algorithm. 2) We conduct a larger-scale experiment than theirs in certain dimensions, notably the TDA methods evaluated, well as averaging the aforementioned stochasticity and using more test points and left-out training points. (28) evaluated two methods, TracIn and a Conjugate Residual method of computing influence functions.
Basu et al. (2021) 24] show that influence functions become worse approximators of training example's importance
test prediction with increasing model depth, width and if the models are trained with no weight decay. All experiments in the paper are conducted with further training (from the already trained model, not from scratch) determining the ground truth influence. This was done for efficiency reasons however, not because of an explicit restriction to the FIMO setting. Moreover, (44 do not average over further training realizations correct for con-conee models do. Their study is focused on influence functions (computed using two methods, exact and LiSSA), whereas consider other gradient-based methods as well.
Nguyen et al. (2023) (25 argue that Bayesian approach is the correct way of evaluating influences of training examples on test predictions as there is lot of variance in most TDA estimates when
23

---

we account for random initialization of the model as well as variation in batching when training. In such situations the recommendation is to consider the distribution of attribution values for a training example, or at least consider the distribution's 's variance, rather than simply (individual run) point estimates. Different from our work, the experiments in the paper are conducted by re-training models from scratch, and only three gradient-based TDA methods are studied, namely influence functions (IF), Grad-Dot (GD) and Grad-Cos (GC).
The seminal paper by Koh et al. (2017)
12 on influence functions in ML sketched a derivation similar ours in Section 4 and Appendix B but in less detail (in their Section 4.2 and Appendix B, less than half a page in total). In particular, our more careful derivation of the influence function in Proposition keeps the ( term that 222 neglect. Appendix [B.1 also diseusses the damping term AI at greater length. [12] evaluated two influence function methods, CG and LiSSA (without the Gauss-Newtor approximation..
Zhang& Zhang (2022) (26) analyze the effectiveness of influence functions, but only for a 2-layer ReLU network. Moreover, the theoretical analysis is done w.r.t. the neural tangent kernel (NTK) approximation of the ReLU network. They have three key findings: i) Influence functions perform better the width of the network increases. ii) Influence functions perform poorly with weak regularization, where the regularization tries to keep the model weights as close as possible to the initial weights. Our cosine similarity results in Figure 2 and elsewhere may be a reflection of this, iii) Influence functions perform better for examples that lie in the high density region of the training distribution. While the work of (26] was mostly theoretical, they did numerically evaluate influence functions computed in two ways, using inverse Hessian-vector products and a simpler method that takes advantage of their NTK approximation.
In addition, we mention Arnoldi influence functions 18 as a method falling under Section 4.3
18
proposed to use Arnoldi iteration (a.k.a. Lanczos iteration for symmetric matrices) to approximately compute the largest- magnntude eigenvalues and corresponding cigenvectors of H(O)). The method then projects gradient vectors into the subspace of top eigenvectors of HO0) By virtue of the
orthonormal basis of eigenvectors for this subspace, the matrix inversion in 8 reduces to scalar division by eigenvalues.
During the review process, a reviewer brought up works that perform TDA by training on test points [46), or in a similar vein, by synthesizing an image and then unlearning it 47 The main idea of these works is to reverse the roles of training and test data. Due to symmetry, this can still estimate influence in the usual train direction while often reducing computational cost. These works are quite different from ours however, as the training is on test points, not further training on training points. Moreover, they do not address the FiMODA problem or gold standard for it.
D Experimental Setup Details
D.1 Data
Choice of tabular datasets We followed [27] in using two regression datasets from the UCI repository
3 (CC BY 4.0 license), Concrete Compressive Strength and Energy Efficiency. We then departed from 27 in choosing two classification datasets, FICO Challenge (34] (license unknown) and Folktables [35 (MIT license), because they are at least one order of magnitude larger than the tabular datasets in 27 in terms of the number of instances and/or features.
For Concrete, Energy, and FICO, we split the dataset 90%-10% into training and test sets (using the scikit-learn [48] package's train train_test___ test_splitt () with random_ random_stated state=0) and standardized the features to have zero mean and unit variance. Handling of special feature values in FICO was done as in [49]. For Folktables, we used the person-level data from year 2018 for the US state of Massachusetts. The classification task was predicting whether person's 's income above or below USD 50,000 (task ACSIncome). The dataset was split 75%-25% into training and test (again using train_test_sttt _est_splitt () with random_ random_state=0) categorical features were dummy--coedd and numerical features were standardized. For CIFAR- 10 (original license unclear), we used the given split into training and test sets. We employed common data augmentation techniques such as random cropping and horizontal flipping, followed by standardization using the empirical mean and standard deviation of the training set. We used a random subset of 1000 samples as validation set. For SST-2 (original license unclear), we used the given split into training, validation, and test sets. We drew
Data pre-processing
24

---

the m = 100 "test" instances for evaluation from the validation set because the actual test set lacks labels for computing losses. Text was tokenized using the tokenizer of the BERT model (see next subsection) with a maximum sequence length of 128 (more than sufficient for all SST-2 examples).
D.2 Training of Final Models
Tabular datasets For all tabular datasets, we used a 2-hidden-layer multi-layer perceptron (MLP) with 128 units in each hidden layer. For the regression problems, the MLP has one output and the loss function is mean squared error (MSE), while for (binary) classification, the MLP has two outputs (logits) and the loss function is cross-entropy. The MLPs were trained using SGD for T = 1000 epochs and a batch size of 128 (following (27l) to yield the final model [(x 0z), except for the larger Folktables dataset where T = 100. Learning rates were as follows: 0.3 for Concrete and Energy, 0.001 for FICO, and 0.01 for Folktables.
CIFAR-10 We used a ResNet-9 architecture [39 and trained it using SGD to minimize cross- entropy loss on the CIFAR-10 training set for T = 50 epochs. We trained with batch size of 512, learning rate of 0.4, and weight decay of 0.001.
SST-2 We used a pre-trained bert- uncased mode 40 (Apache 2.0 license) and attached a linear classification layer that maps the BERT model's final representation of the CLS token to logits. We fine-tume fine-tund this model on the SST-2 training set using Adam W [1 to minimize cross-entropp loss, with a batch size of 64, learning rate of 10-5, zero weight decay, and gradient norm clipping at a threshold of 1. Accuracy on the SST-2 validation set was used to choose the number of epochs from a range of 1 to 30. This resulted in final model with validation accuracy of 92.9% after epoch 19.
D.3 Implementation of further training
Optimizer and parameters For the case in which the further training algorithm A' is the same as the initial training algorithm A, the learning rate for A' was chosen to be one order of magnitude smaller than that for A. i.c., 0.03 for Concrete and Energy, 10 for FICO and Folktables, 0.04 for CIFAR-10, 10, 10-6 for SST-2. The reason is that the given parameters 0f are closer to convergence than the initial parameters (0)), The maximum number of epochs T" for A' was also chosen to be fraction of T: T = 500 for Concrete and Energy following (27] T" 200 for FICO, T" = 25 for Folktables, T 10 for CIFAR-10, 10, and T' = 1 for SST-2. Other parameters such batch size were the same as for A. For the experiment on tabular data in which A' was Adam, smaller learning rates were used since Adam is more powerful optimizer: 10 for Concrete and Energy, 10 6 for FICO and Folktables.
Random seeds Regarding the random seeds (denoted as ((+) in 13 17 that determine the order of instances in each epoch, this control was achieved in PyTorch [50] as follows: First, the seed of a random number Generator object set to using generator.... mwnual_lsee Then, a RandomSampler object was instantiated with this Generator (RandomSampler (generator=-eenerator, ...)), and a DataLoader was instanti- .)..).
0,
(r 100)
ated with the RandomSampler (DataLoader @atammpeessamplen
Leaving out instances To achieve the effect of leaving out one training instance 2, we followed (8 in subtracting a second loss term L(z,; 0)/n from the usual loss for every batch. The scaling by 1/n (recall that is the number of training instances) approximately cancels out the weight of instance z; the usual loss. Denoting by B and n. [n/ B] the batch size and number of batches per epoch, the weight of in the usual loss is B (one appearance per epoch), whereas the total weight from the subtracted loss term is n R 1/B.
Adjustment for the effect of further training alone As discussed in Section 6.1 we investigated two methods for adjusting for the effect of further training alone, where the results in Figure 2 jse the mean subtraction adjustment in (13). For the other adjustment method in which the output due to full-dataset training subtracted, the attribution score is given by
0/
1 Σ
0(2, ef AO(DD., (())) - g(2, or + AO(D)
(17)
Results corresponding to
17 are shown in Figures 5 and
http:://tugghgggaccc.oo/gogg// wertggeebbbr/brrteeeeeeeee vase-uncased
25

---

D.4 Approximate TDA methods
All methods take the final model f(;; 0T) as input, either by first computing its training loss gradients VoL(zz; 01) and test loss gradients, or as a model object that used compute derivatives.
Grad-Dot, Grad-Cos malized) inner products.
Given the loss gradients, these are straightforward to implement as (nor-
CG, LiSSA, LiSSA-H We used the implementations of these methods in the torch- influce repository (Apache 2.0 license) provided by [27]. For both CG and LiSSA, we used damping value of 0.01, which we found yield higher cosine similarity values than the other À 0.001 value used by 27 We observed that cosine similarities increase as À increases, so it is possible that further tuning of À may yield better results. For LiSSA's additional parameters, we set the depth (number of iterations) to 5000, the number of repeats (repeat) to I, and the scale parameter to the smallest value in {10, 20, 50, 100, 200, 500} for which LiSSA did not diverge.
Datalnf' For the tabular datasets, we used the repository (license unknown) provided by 20 with default parameter values, specifically lambda_ caarbbdd_oost__o_eeeeee wwwsttonnssssscce const__paaam-1 10 which determines the damping value. However for CIFAR-10 10 and SST-2, the authors' code was not computationally efficient enough. Instead, we implemented Datalnf's ' key equation 20 eq. (5) ourselves. the average over all training instances i = l...., n with an average over a random subsample of size 1000. We also first computed the gradient inner products Lt,s, Licks Li, in their eq. (5) before computing eq. (5) itself.
doing so, we approximated
EK-FAC We used the repository parameter settings.
! (Apache 2.0 license) corresponding to 23 with default
TRAK We used the repository (MIT license) provided by [9 with default parameter settings. For the regression datasets Concrete and Energy, since the TRAK repository does not provide an implementation for regression,
ourselves following their documentation @ For their "model output function," we use the model's prediction, f(x; 0) in our notation. The squared error loss is L(2; 0) ) (2;; 0) y)² so the output-to-loss gradient that TRAK also requires is
tried to create
aL(z; 0) 0f f(x: 0)
D.5 Evaluation metric
The derivations in Section 4 indicate that gradient- gradient-based methods should approximate the signed magnitudes of further training gold attribution scores. Thus, we chose an evaluation metric that is sensitive signed magnitudes, not just rankings (evaluated for example by Spearman rank correlation, a common metric the TDA literature). Having said this, the vectors a of gold attribution scores and à of approximate attribution scores may have different scales. In this work, do not concern ourselves with the differing scales, so we take both to be normalized to unit &g norm. this case, the squared Euclidean distance 0 o//2 and cosine similarity 0" u are equivalent up to an affine transformation, and we use the latter as the evaluation metric. Note that cosine similarity is more demanding measure than Pearson correlation (used for example in 28 (7)), since the latter corresponds to approximating each gold score a; by aā; + 3 where 3 is non-zero bias, whereas the former constrains I to be zero. In addition, also show results with Spearman correlation in Figure which are qualitatively similar to the cosine similarity results.
D.6 Computing resources
Experiments were run on an internal computing cluster providing nodes with 32 GB of CPU memory,
V100 GPUs with 32 GB of GPU memory, and occasionally A A100 GPUs with 40 or 80 GB of GPU memory. V100s were sufficient for all training however. One CPU and one GPU were used at a time.
26

---

Oodine simiarrt further training
Oodine Sinclorty turther traling
0.8
Grad-Cos
LSSAH
0.6
Datainf
0.4
TRAK
0.4
0.2
0.1
0.0
0.0
100
200
400
500
100
200
400
500
further training epochs
further training epochs
(a) Concrete Strength
(b) Energy Efficiency
coshee similarty to further traiiin
1.0
ocsine simiartty to further trairraiiinng
0.6
0.6
0.4
0.2
further training opachs
further training
(c) FICO
(d) Folktables
Figure 4: Cosine similarity between attribution scores of gradient-based TDA methods and further training function of the amount of further training, using different further training algorithm (Adam) than the initial training algorithm (SGD).
The most computationally expensive part of the experiments was to perform further training on the BERT model for SST-2. Each further training run (T" = 1 epoch) took 12 minutes, which includes time to evaluate intermediate checkpoints on the test set after every ~ 10 optimization 100 random seeds, the total time for further training BERT was ~ 1000 GPU-hours. The total time for further training ResNet for CIFAR-10 was significant fraction of this, perhaps ~ 400 GPU-hours. Conducting the mislabelled example detection experiment on SST-2 also required ~ 400 GPU-hours for further training BERT with 40 random seeds. Aside from further training. among the gradient- based methods, LiSSA was the most computationally expensive. Running LiSSA and LiSSA-H for CIFAR-10 and SST-2 took ~ 500 GPU-hours in total. Thus altogether, reasonable estimate for total experiment compute ~ 3000 GPU-hours.
steps. With 50 LOO instances and
E
Additional Experimental Results and Discussion
E.1
Comparison of gradient-based methods to further training
Similarity between Grad-Dot and DataInf below (with sign change to be consistent with Section
We reproduce DataInf's key equation 20 eq. (5)
L T1isk X Lr,i
Datalní 0%
Σ
Tu
(18)
1=1
where k indexes the training instance being attributed to, the layers of the NN, and all training instances. Lt,s and Li,s are inner products between layer-specific loss gradients, as defined in [20]. The first term in (8) is like Grad-Dot (6) but with layer-dependent weighting 1/Ax. The remaining
average over can seen as a correction term. Our results in Figures 2 suggest that this correction term is small.
Different further training algorithm Figure shows the cosine similarity between attribution scores of mauiient-based methods and further training for the tabular datasets, using Adam as the further training algorithm A' instead of SGD as Figure The patterns are broadly similar to those in Figure However, for Folktables in Figure 4d the curves for the first-order methods and DataInf do not peak the beginning but rather after a few epochs. Figures 4a and [nd the curves for the influence function methods CG and LiSSA are also seen to peak and then decay.
27

---

cosine smilrtty to training
cadine siillrrtyy to furthar training
further training
1.0
Grad-Cos Datainf
LISSA
0.6
EKHAC
0.8
0.6
0.4
0.4
0.4
8.2
02
0.2
400
200
300
500
further
further
further epachs
(a) Concrete Strength
(b) Energy Efficiency
(c) FICO
cosine simierity to traiinn
cosine Sinilaity to further training
0.8
0.8
Grad-Dofl
USSA
MM
Datainf
TRAK
0.3
Grad Det
LISSA TRAK
0.4
0.4
0.
Dataini USSA
0.2
0.0
0.2
25
200
400
600
800
600
8.00
1000
further training epachs
turther training steps
further
(d) Folktables
(c) CIFAR-10
(f) SST-2
Figure 5: Cosine similarity between attribution scores of gradient-based TDA methods and further training using the same further training algorithms as in Figure 2 but with adjustment done according to
Different adjustment the effect further training alone In Figure 5 the further training optimizer is the same in Figure 2 (A' A), but the adjustment for the effect of further training alone is done using (7). i.c., by subtracting the output from full-dataset training. The plots for Concrete, Energy, FICO. and CIFAR-10 are similar to their counterparts in Figure 2 However for Folktables and SST-2 in Figure [d] 5 the curves are very noisy. The reason is that the adjustment in (17) still leaves non-negligible constant bias, i.e., the attribution scores a, shifted up down by a constant that varies from epoch to epoch. This varying bias is reflected in the cosine similarities shown in Figure 5d 5f
Different evaluation metric Figure we show a counterpart to Figure 2 where cosine similarity between attribution vectors a and à is replaced by Spearman correlation (and then averaged over test instances as before). The plots are qualitatively similar to those in Figure 2 terms of the grouping of the gradient-based methods. For example in Figure 6c Datalnf, Grad-Dor and Grad-Cos remain at the top, while CG and LiSSA are next and again coincide with each other. In Figure 6d] CG rises and crosses over the top three (DataInf, Grad-Cos, Grad-Dot), similar to In Figure 6f DataInf and Grad- -ot are again highest and EK-FAC again third place.
particularly in
Figure 2d
Different numbers of random seeds averaged In Figures 7 and 9 we plot the maximum cosine similarity over epochs/steps as function of the number random seeds averaged. The detailed procedure is as follows. Given a number of seeds to be averaged, we divide the 100 seeds that we have total into 100/r groups of seeds. For each group of r seeds, we obtain a gold attribution vector using either (13) or (17) depending on the adjustment method, and compute its cosine similarity with a gradient- based attribution vector à. We then compute means and standard errors of the cosine similarities over the m test instances as well as the 100/r groups. This yields mean cosine similarities as a function of further training epochs or steps, like in Figures 2 Finally, we take the maximum over epochs or steps to give the y-axis value in Figures 7 corresponding to the number seeds r on the r-axis. This procedure is repeated for different values of
In all cases in Figures 9 the cosine similarity increases with the number of seeds, implying that averaging of further training runs brings closer to what gradient-basse methods estimate. The increases are more notable for the first-order methods and DataInf. This may appear so because the first-order-like methods can achieve higher maximum cosine similarities than second-order methods, provided there is sufficient averaging. The increases are especially notable in Figure
28

---

0.0
Speamen com with further trinina
0.8
Gradi Det
LISSA
1.0
Grad-Cos
LISSAH
0.0
wit further
TRAK
Speamen conr with
0.4
0.4
0.2
0.2
0.2
0.0
0.0
training
training epechs
training
(a) Conerete Strength
Energy Efficiency
(c) FICO
1.-
Speammnn cor: With (urther training
0.8
0.25
0.20
Datalnnf
Grad Cas
EKFAC
TRAK
with further
0.3
0.4
Datainf
Grad-Cos
RI-FAC
Speaman gort. with
0.15
0.4
0.10
0.1
0.05
0.0
0.0
training opochs
training stops
further traininng steps
(d) Folktables
(e) CIFAR-I0
(l) SST-2
Figure 6: Spearman rank correlation between attribution scores of gradient-based TDA methods and further training, as a function of the number of epochs or steps of further training.
when adjustment is done using full-dataset further training (17). As seen in Figure this adjustment method is noisier and appears to benefit more from averaging.
29

---

cozine similanty further training
similants Further training
0.8
1.0
cosina similarity further
0.8
0.6
0.4
0.3
0.4
0.2
0.1
0.2
0.0
10a
number of random seeds averaged
number random seeds avereged
number of random seeds averaged
(a) Concrete Strength
(b) Energy Efficiency
(c) FICO
cosine limiistttts to trainnng
further training
0.40
0.5
Grad-Det
0.35
0.8
Grad-Det
Grad-Cos
Dataint
Grad-Dot
0.6
DG
Datainf
US SA-H
0.20
0.25
Grad-Cos
Datainf
USSA
LISAAH
0.2
TRAK
TRAK
0.1
0.10
TRAK
0.05
0.0
0.00
10
10'
10a
10'
10"
10a
of seeds averaged
random averaged
number random seeds averaged
(d) Folktables
(e) CIFAR-I0
(I) SST-2
Figure 7: Maximum cosine similarity between attribution scores of rradient-based TDA methods and further training, as a function of the number of random seeds averaged. Here the further training algorithm A' is the same the initial training algorithm.
cosine Similartt to Butther training
0.8
Cosire Simitrrly to forther training
0.5
0.7
0.6
0.5
0.3
0.4
0.3
0.2
0.1
0.1
0.0
10
number of random seeds averaged
number of randorn seeds averaged
(a) Concrete Strength
(b) Energy Efficiency
cosine Similarity to (urther trairing
1.0
cosine Similarity to traising
0.9
0.8
0.8
0.7
Grad
Grad Cas
0.7
0.6
Datainf
0.6
0.5
OG
0.4
US USSAH
0.4
0.3
TRAK
0.3
0.2
0.2
0.1
10a
10:
10"
10:
number seeds averaged
number seeds averaged
(c) FICO
(d) Folktables
Figure 8: Maximum cosine similarity between attribution scores of gradient-based based TDA methods and further training, as a function of the number of random seeds averaged. Here the further training algorithm (Adam) different from the initial training algorithm (SGD).
30

---

0.8
0.8
1.0
0.7
further
0.8
0.5
0.5
0.4
0.6
0.2
0.1
0.0
10a
101
10'
10a
10
10a
10'
number of random seeds averaged
number of random seeds averaged
number of random seeds averaged
(a) Concrete Strength
(b) Energy Efficiency
(c) FICO
amilrrt to turthertraaningg
Grad-Dot
2 0..8
Grad-Dot
Grad-Cos
coline similarit to furthertraina
0.5
Gred-Cos
0.7
Datainf
Grad-Cos
Data Inf
0.6
CG
Datalnf
0.6
LISSA
LISSA
USSA
0.5
FKFFAC
LISSA-H
USSAH
TRAK
0.4
EK#AC
EK-FAC
smilarey
0.3
TRAK
0.2
TRAK
0.3
0.2
0.0
0.0
0.0
10a
10a
10a
10a
10'
10a
10a
10'
10'
number of random seeds averaged
number random seeds averaged
number of random seeds averaged
(d) Folktables
(c) CIFAR-10
(f) SST-2
Figure 9: Maximum cosine similarity between attribution scores of gradient- based TDA methods and further training using full-dataset adjustment (17) function of the number of random seeds averaged.
31

---

0.4
sonted score
Sorted sitribution zcae
Grad-Cos
Further training
0.2
Further training 10 spocts
0.0
0.0
-0.1
-0.2
Grad-Dat
-0.2
Grad Cos
-0.3
Further epach
20
40
60
80
100
0
20
40
60
80
100
rank
rank
(a) FICO
(b) Folktables
Grad-Dot
Grad-Dot
0.6
Grad-Cas
Further training steps
attribattonn scare
0.50
Further
Grad-Cos
attribution
0.4
Rurther training 11 steps
Further training 11 steps
0.00
-0.25
-0.4
-0.75
(c) CIFAR-10
(d) SST-2
Figure 10: Attribution scores, sorted and averaged over test instances, from further training as well as Grad-Dot and Grad-Cos.
TRAK There are two possible reasons for the poor approximation quality of TRAK seen in Figure 2 and elsewhere. First, the FiMO setting, we have only M checkpoint and can only evaluate the TRAKM=1 variant as mentioned in Section 4.3.3 i.e., without ensembling. 19 show that using an ensemble of M >> checkpoints greatly improves performance. Second, we compute similarity with further training attribution values, whereas [19] evaluate using their linear datamodelling score (LDS) metric, which is based on re- re-training and for the TAA setting.
CIFAR-10 and SST-2 The cosine similarities for CIFAR-10 and SST-2 in Figures 2e and elsewhere are significantly lower than those for the tabular datasets. As first step understanding
why, we plot in Figure T0 gold attribution scores from further training (3). where for each test instance, we have sorted the scores a; increasing order, and then averaged over the test instances. We also sort and average the attribution scores from Grad-Dot and Grad-Cos in the same manner. For FICO and Folktables in Figures Toa 10b the further training attribution scores more "typical" in that they are approximately symmetric (positive versus negative) and have tails of larger positive and negative values. For CIFAR-10 10 however (Figure 10c]. the curves are more "hockey-stickk"-tee -shaped with heavier positive tail and not much of negative tail; this pattern becomes more pronounced after 11 steps of further training than after 1 step. In this case, the Grad-Cor Frad-Cos curve offers better match than the Grad-Dot one. For SST-2, the gold attribution score curves are angular: almost all of the scores are close to zero, with only one or two significant non-zero values at either end. In both Figures [0c] 10d Grad-Dot and Grad-Cos struggle more to approximate these less typical attribution score curves. Further investigation into the poorer approximation quality is ongoing.
Comparison to re-training Figure I1 shows cosine similarities between attribution scores of gradient-based TDA methods and LOO re-training (from scratch) for the tabular regression datasets. In stark contrast to further training in Figure the gradient-basse attribution scores are nearly uncorrelated with LOO re-training.
E.2
Validation of further training
E.2.1
Mislabelled example detection
Further training is a natural choice for gold standard because it is the analogue to re-training in the FiMO setting and approximated by existing gradient- based methods. further support the validity of this choice, we conducted an experiment to determine how well further training aligns with
32

---

0.10
cosine simiarity to re-trammin
cosime simllakyt restaining
Dead--Dot
L85SA
Grat-Cos
LBS save
0.05
Datatri
EKFFC
0.050
0.025
0.000
Crad-DDot
LISA
-0.05
Grad-Cos Datainf
USSAH
FK-
0.050
0.10
CG
0.075
200
460
500
800
1000
200
400
600
800
1000
reatninng opochs
re training epochs
(a) Concrete Strength
(b) Energy Efficiency
Figure 11: Cosine similarity between attribution scores of radient-bbsedd TDA methods and LOO re-training (from scratch), as a function of the number of epochs of re-training.
a downstream application of TDA, namely mislabelled data detection. In the context of FiMO and further training. we pose this as a question of whether the sensitivity of final model, as measured by further training influence values, is correlated with mislabelled examples. The setup for this experiment is similar that in Section [6. and prior works (20, 12.. For the binary classification datasets, we flip the labels of randomly selected 20% of the training subset L on which we perform LOO further training. We then evaluate the correlation of further training influence values with the indicator of flipped instances, training, the AUC values are as follows (mean and standard error over 40 trials): FICO: 0.758 + 0.008; Folktables: 0.627 + 0.012; SST-2: 0.995 + 0.003. The last value is high because the further training influence values flipped and non- non-flipped points are almost perfectly separable. We conclude that further training is indeed aligned with mislabelled data detection.
measured by AUC-ROC following 220 After one epoch of further
E.2.2 Qualitative examples
The authors of the gradient-based TDA methods considered in this work have shown that examining the most influential training instances (most positive and negative) for a given test instance can give insights into what the model has Iearned. We refer the reader to Figure 3 of [20] and Figure 3 in the arXiv version of [99] for such examples. [23] use such influential examples to make observations about LLM phenomena, such as increasing abstraction with model scale (see their Section 5.3). In the same way that illustrative examples can be provided for approximate TDA methods, we can do the same for the further training gold standard. However, given the computational cost of further training and the experimental setup in Section [6.]] we are limited to identifying most influential examples within the evaluated subset L of training instances. With this limitation in mind, we discuss our findings for two of the datasets.
Folktables In Table 2 we show the training instances with the most positive and most negative influence values for the first two test instances evaluated from the Folktables dataset. Since the most positive influence value implies that the loss on the test instance increases when the training instance left out, we call this the most "helpful" training instance, and similarly call the training instance with the most negative influence value the most "harmful". Similar to previous work (for example Figure in the arXiv version of (19), the most influential training instances are semantically similar to the test instance, and the most helpful instances tend to have the same label while the most harmful have the opposite label. For example, the first test instance a 61 -yearooolld white man who likely has blue-collar profession ("Sailors, Marine Oilers, Ship Engineers"") and earns more than 50,000 USD a year (high income). The most helpful and harmful training instances are also white men with blue-collar jobs (construction laborer and structural metal fabricator/fiterr) The most helpful instance also earns more than 50,000 and is younger at 38 years old, while the most harmful instance carns less than 50,000 and is older at 84,
SST-2 We also examined the most influential training instances within L for the m test instances that we evaluated from SST-2, both individually as well as an average over the test instances. Interestingly, we find that in almost all cases, the same two training instances are most influential. These are the texts "outnumber the hits by three-to-one" (negative sentiment) and "a fresh infusion" (positive sentiment). We thus infer that these two instances were the most important within L for the BERT model to learn in order to classify sentiment well in general. We also note that "outnumber the
33

---

Table 2: Most influential training instances for the first two evaluated test instances from the Folktables
dataset.
Feature
Test instance
Most helpful training instance
Most harmiul training instance
Label (income)
High 61 42
High 38 15
Low 84 29
Age
Work hours
Calegury of wurker
Employee of private prolit
Emplayee of private for profit
Employee private for profit No schooling completed
Schooling
Ascociate's 's degree
Master's 's degree Never married
Marital status
Married
Married
Occupation
Sailors, Marine Oilers, Ship Engineers
Construction Laborers
Structural Metal Fabricators & Fitters Mavsachuvetls
Place birth
Massachusetls
New Jersey
Sex
Male
Male
Male
Race
White alome
While alome
White alome
Label (income)
High
High
Low
Age
Work bours
50
60
45
Catogory of worker
Employee of private for-profit GED alkernative credential Married
Employee of private for-prolit
Employee private for-profit
Schooling
Bachelor's degree
Some college, < I year
Marital status
Never married
Married
Occupation
Office Clerks, General Massachusetts
Ist-Line Supervisors Of Food Workers Connecticut
Lic. Practical & Vocational Nurses Massachusetts
Place of birth
Sex
Female
Male White alone
Race
White alone
White alone
hits by three-to-one" is more difficult example to classify as negative, since it requires understanding "hits" (normally positive) and "outnumber" and combining the two.
F Additional Limitations and Future Work
Below we summarize some additional limitations of this work that were mentioned in passing in the main text:
FIMO setting: As mentioned in Section 3, limitation of the FiMO setting is that it does not seem to permit estimation of the contribution of a training instance to the final model by "going back in time." It may only be possible measure sensitivity a training instance (i.c.. localized notion of contribution). In addition, reviewer noted that sensitivity may be difficult to measure if the model has saturated on training instance.
Approximation by gradient- methods: The fundamental assumption for gradient- based methods to approximate further training is that the amount of further training is limited, as stated the beginning of Section 4 This limitation evidenced by the decay of the cosine similarity curves in Figure 2 and elsewhere, especially of the first-order methods.
We elaborate the additional points for future work listed in Section 7
1) An open question is how much further training the right amount to determine the final model's sensitivity to training instances. If too little, the sensitivity may not be measurable, whereas if too much, then the measurement may no longer be local, i.c., specific to the given model fa; 0f). The extent which further training well-approximated by Taylor expansions (as evaluated for example in Figure 2 may provide partial answer.
2) We restricted attention in this work to LOO further training, as mentioned in Section 3 Future research TDA in general could focus more units larger than single instance (referred to as "group influence" that the attribution score for group is the sum LOO attribution scores.
[14] 16 43)),, beyond making the additivity assumption
3) While we have presented further training as applied to the original training set D and assumed that DD is available, there is no obstacle to considering further training on new, unseen instances. This would broaden the problem to predicting the effect of further training new data and connect to problems such as data selection.
34

---

G Broader Impacts
This paper highlights the final-model-only setting for TDA, which a setting that allows wider set of practitioners (for example HuggingFace model users) to perform TDA because it does not assume access to the training algorithm or intermediate information from training. At the same time, this wider access to TDA might lead to increased misinterpretation or misplaced trust in attribution scores, especially among less expert users. Modern neural networks and neural network training procedures are highly complex, and any insights obtained into them should be tempered with some scientific skepticism. Beyond these considerations, there may other potential societal consequences of our work, in line with machine learning research in general. Hence do not feel that they must be specifically highlighted here.
35


Reviews:
[{"review_id": "nCUtiA4KQO", "reviewer": "Reviewer_2NEN", "summary": "This paper focuses on training data attribution methods specifically in FiMO setting, where only the final model is available and neither the model checkpoints nor the training algorithm is accessible to the attribution method. They first define a taxonomy of TDA methods based on their access to different resources of the model. Then they define further training as the gold standard in TDA. This method works by training an already-trained model with different variations of the dataset generated by the leave-one-out technique. Authors further show that various attribution techniques, in fact, approximates the further training method. Experiments that were run on tabular, image, and text datasets show first-order gradient-based techniques approximate further training well, but decay over extended further training.", "questions": "* What's the dependency on the further training algorithm? What if the employed learning is really detrimental to the model?\n* What would be the right amount of further training? Can there be a generalized guidance based on empirical evidence?", "limitations": "Authors do a great job in discussing the limitations in cost, convexity, stochasticity.", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 4, "originality": 3, "strengths_and_weaknesses": "## Overall Review\nExplicit definition of FiMO setting and the proposal of further training as a gold standard are timely and sound contributions. Authors connecting multiple well-known TDA techniques is a valuable theoretical framework and highlights the significance of this work in the model interpretability domain. \n\n## Strengths\n* The explicit formalization of the FiMO setting and the proposal of \"further training\" as gold standard are novel contributions. \n* Acknowledging and addressing challenges like non-convergence and stochasticity in NN training enhances the practical relevance of the gold standard.\n* Theoretical unification of first-order methods like Grad-Dot and influence function methods like CG, LiSSA, TRAK, and DataInf is very valuable.\n* Reasonable empirical evaluations. \n* Authors do a great job in challenging many assumptions subtly made in other papers such as \"we do not assume that the empirical risk $R(D', θ)$ is convex, nor do we assume that the given parameters $θ_f$ are a stationary point of $R(D, θ)$ over the full training set D.\"\n* The paper has a solid theoretical foundation.\n\n## Weaknesses\n* While somewhat orthogonal to the idea, authors fail to properly address dataset issues such as duplicate or high-correlated data especially for $D'$ with LOO methodology. \n* While the paper explicitly mentions the cost, this method is extremely expensive nonetheless -- making it impractical for most users. This is the main reason why I am not voting Strong Accept.\n* Lastly, although it is an artifact of the FiMO setting, sensitivity *after* having trained the model might not fully capture the real impact of the training example as the model may have saturated for that input already.\n\n## Clarity\nThe paper is well-written and structured. The concepts, notations, and proofs are clear.\n\n## Originality\nFiMO framework formulation and further training with expectations over randomness are original contributions.", "was_revised": true, "final_justification": "I really liked this paper for the gold standard framework they proposed, their discussion on non-convergence and stochasticity in NN training, and the unifying view of other methods. The authors have responded to my questions and addressed the points about time complexity of these methods and input saturation. They haven't provided an answer on the practical case of correlated and duplicate datasets, though. Some of the points raised by other reviewers about the positioning of the paper also made me reconsider my positivity towards the paper.", "rebuttal": "Thank you very much for your positive review (bordering on Strong Accept) and recognition of our contributions! Below we respond to your concerns and questions.\n\n> While the paper explicitly mentions the cost, this method is extremely expensive nonetheless -- making it impractical for most users.\n\nTo be clear, we are proposing further training as a gold standard and as such, we did not intend it to be computationally efficient, nor are we proposing it as a practical TDA method. The suggestions given in Appendix F (and work cited by Reviewer hy33) could ease implementation of further training in future work.\n\n> although it is an artifact of the FiMO setting, sensitivity after having trained the model might not fully capture the real impact of the training example as the model may have saturated for that input already.\n\nWe agree that saturation is possible. Nevertheless, we did find in Appendix E.2 that further training influence scores can be useful for detecting mislabelled examples and giving insight into what the model has learned.\n\n> What's the dependency on the further training algorithm? What if the employed learning is really detrimental to the model?\n\nWe addressed this question partially in Appendix E.1, Figure 4, where we used Adam as the optimizer instead of SGD, with qualitatively similar results.\n\n> What would be the right amount of further training? Can there be a generalized guidance based on empirical evidence?\n\nIndeed, we pose this as an open question in line 380 and elaborate on it in Appendix F, but as such is difficult to provide a concrete answer."}, {"review_id": "uLWjCpmtaY", "reviewer": "Reviewer_3d7B", "summary": "The work is focused on the problem of training data attribution where only final trained models are considered for analysis. To measure the sensitivity of the models, further training with appropriate adjustment and averaging are proposed. Gradient-based methods are unified for TDA to show that all these methods approximate the further training gold standard in different ways. This is done through first and second-order Taylor expansions around $\\theta_f$. The problem is set clearly to create notations and build onto the attribution/influence scores $a_i$ to be assigned to the training instance $z_i$. Three problem settings are considered: a) Training Algorithm Available (TAA) -- access to the training algorithm A, b) Checkpoints Available(CPA) -- no access to A but access to intermediate checkpoints available and c) Final Model Only (FiMO) -- only access to final model. This work focuses on FiMO. This is the main contribution -- providing a further training gold standard for FiMO for the leave-one-out (LOO) case.  Particularly, issues of non-convergence (tackled by adjusted computation of sensitivity to the presence of example $z_i$ -- Figure 1) and stochasticity (tackled by averaging over seeds) have been mentioned. The gradient-based methods are then unified as approximate further training, first-order methods (GradDot), Influence function methods and Gauss-Newton approximate hessian based methods are unified. Relationships with existing influence function methods are also discussed. Finally, experiments are conducted to produce two main insights -- a) approximation quality of first-order methods decays with the amount of further training and b) approximations given by influence function based approaches are more stable but lower in quality.", "questions": "- [**Minor Comments**]: From line 87-90, it's argued that FiMO is applicable to scenarios with TAA and CPA settings. While, this is true, the increased access in these cases may be able to provide deeper insights?  The lines 87-88 are reasonable but there could be a significant number of cases where TAA and CPA are available. The details on some limitations of FiMO analysis that can be overcome in TAA or CPA settings could perhaps be mentioned briefly.\n- [**Number of Random Seeds**]: Figures 3(b) and 7(f)  show the impact of number of random seeds averaged on the maximum cosine similarity for the SST-2 dataset -- the general suggestion is that a lower number of random seeds (10-20) can be used as the highest impact is seen there. However, in these cases, DataInf seems to be benefitting from multiple seeds. This is explained in the Appendix. However, this adds to the computations. A clarification on the following two points will be useful -- (i) why DataInf is uniquely sensitive, and (ii) whether the steadily rising curve is worth the extra compute cost.\n- [**Pseudocode/Implementation**]: If there are some institutional constraints on sharing the code, it may be good to provide some example pseudocode for reproducibility.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "- Strengths\n  - [**Positioning**]: The paper is positioned well amongst the TDA literature and provides contextual explanations of it's proposed approaches placing them precisely in the current literature.\n  - [**Unification**]: From a reader's perspective, the manuscript does a good job of providing a unifying view of gradient based methods commonly used in the influence literature. \n  - [**Analyses**]: Extensive analysis is conducted to support the theoretical studies. This study provides the first practical FiMO benchmark.\n\n- Weakness\n  - [**Computational Time**]: The experiments took about 3000 GPU hours (Appendix E) on (relatively) small CNN and BERT models. The Appendix F mentions this and suggestions are made to reduce the number of seeds or using parameter efficient approaches like LoRA. However, the effects of LoRA have been left for future work and that would still not address the problem of computational time for widespread and meaningful adoption. \n  - [**Scope**]: The empirical studies on non-tabular datasets have low cosine similarity on all methods. The findings on tabular datasets are not reflected in the non-tabular datasets. For instance, Figure (e) CIFAR-10 shows significantly higher cosine similarity for Grad-Cos over Grad-Dot as opposed to the findings on tabular datasets. It's mentioned that the gold attribution vectors $a$ behave differently for non-tabular datasets. Lines 1140-1153 in Appendix E.1 discuss this issue but this poor approximation quality is still a weakness in non-tabular domain.", "was_revised": true, "final_justification": "Upon considering the comprehensiveness of the work and detailed discussions with the reviewers, I have a positive outlook of the paper.", "rebuttal": "Thank you very much for your review and for recognizing the value of our positioning/organizing the TDA literature and unifying gradient-based methods within it. Below we first discuss why the **low cosine similarities are not a weakness of our paper**. We then respond to your concern about computation and your other questions.\n\n> **[Scope]**: The empirical studies on non-tabular datasets have low cosine similarity on all methods. … Lines 1140-1153 in Appendix E.1 discuss this issue but this poor approximation quality is still a weakness in non-tabular domain.\n\nWe agree that the low cosine similarities on non-tabular datasets are a less desirable finding for researchers in this area. From the perspective of approximating further training, we think they reflect weakness of the current methods and motivate the development of higher-quality methods (see point 1 in lines 377-378 and its elaboration in Appendix F). However, we do not see this as a weakness of our paper because we are not advocating for a particular TDA method and are merely reporting how well current methods approximate further training.\n\n> **[Computational Time]**: The experiments took about 3000 GPU hours (Appendix E) on (relatively) small CNN and BERT models. The Appendix F mentions this and suggestions are made to reduce the number of seeds or using parameter efficient approaches like LoRA. However, the effects of LoRA have been left for future work and that would still not address the problem of computational time for widespread and meaningful adoption.\n\nAs discussed in Appendix D.6, most of the computational time was needed because we aimed to implement and compare to the further training gold standard. Our focus in this work was to establish this gold standard and as such, we did not intend it to be computationally efficient, nor are we proposing it as a practical TDA method. The suggestions given in Appendix F (and work cited by Reviewer hy33) could ease implementation of further training in future work.\n\n> **[Minor Comments]**: From line 87-90, it's argued that FiMO is applicable to scenarios with TAA and CPA settings. While, this is true, the increased access in these cases may be able to provide deeper insights?\n\nYes of course, if increased access is available, then we encourage practitioners to take advantage of it if they can. We can clarify that while FiMO is applicable to these settings with greater access, it may not be the most recommended.\n\n> **[Number of Random Seeds]**: Figures 3(b) and 7(f) show the impact of number of random seeds averaged on the maximum cosine similarity for the SST-2 dataset -- the general suggestion is that a lower number of random seeds (10-20) can be used as the highest impact is seen there. However, in these cases, DataInf seems to be benefitting from multiple seeds. This is explained in the Appendix. However, this adds to the computations. A clarification on the following two points will be useful -- (i) why DataInf is uniquely sensitive, and (ii) whether the steadily rising curve is worth the extra compute cost.\n\n1. DataInf is not uniquely sensitive. The Grad-Dot curve almost coincides with it. We remark in lines 1130-1131 that the first-order-like methods (including DataInf) are generally more sensitive to the number of seeds. It might appear this way because these methods can achieve higher maximum cosine similarities than second-order methods, but it requires more averaging of further training runs to make this apparent.\n1. Whether the extra computational cost is worthwhile is user-dependent and not something we can answer in general. It does appear that most of the gain is achieved at ~20 seeds (this might be more apparent if we plotted on a linear scale).\n\n> **[Pseudocode/Implementation]**: If there are some institutional constraints on sharing the code, it may be good to provide some example pseudocode for reproducibility.\n\nWe will revisit the question of sharing code with our institution and we are hopeful that we will be able to do so for the purpose of reproducibility. In particular, we hope to be able to share our specific code for further training and the indices of the left-out training instances in $\\mathcal{L}$."}, {"review_id": "D8US922Xy0", "reviewer": "Reviewer_NTqP", "summary": "This paper proposes \"further training\" as a new evaluation measure (or golden standard) for training data attribution (TDA) methods in the \"final-model-only\" (FiMO) setting, where practitioners only have access to trained model weights rather than the full training process (e.g., intermediate checkpoints or training algorithm). The authors justify the proposed metric by showing that many existing TDA methods can be seen as approximations to \"further training\" through Taylor expansions around the final checkpoint. Across tabular, image, and text tasks, the authors demonstrate interesting trade-offs between different TDA methods: first-order methods (Grad-Dot, Grad-Cos) achieve high initial approximation quality but decay with increased further training, while second-order influence function methods (CG, LiSSA, EK-FAC) maintain more stable approximation quality over training steps but often underperform compared to first-order methods.", "questions": "Please see the weakness section above for my questions and suggestions. The most unconvincing aspect of this paper is that the conclusions drawn from further training differ significantly from those obtained when methods are evaluated under retraining-based approaches. Given this discrepancy, I am not convinced that further training should be treated as a gold standard for data attribution.", "limitations": "Yes", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 1, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- The paper is well-motivated and clearly written with a detailed problem formulation. All derivations in the main manuscript appear correct (I haven't read the appendix in detail, but skimmed through). \n- Experiments cover a wide range of tasks, and a detailed experimental setup is provided in the appendix.\n\nWeaknesses:\n- Although the authors clearly articulate the rationale for categorizing TDA into three settings (which I agree with), I don't agree that different settings require different gold standards. There are classes of algorithms more applicable to each setting (e.g., MAGIC [1] for TAA, TraceIn [2] for CPA, and Grad-Dot for FiMO), but the fundamental objective of data attribution stays the same: understanding which training examples led to particular model outputs. The natural ground truth for all data attribution should be retraining-based approaches. While \"further training\" can serve as a proxy metric (just like mislabeled data detection), TDA algorithms should ultimately be evaluated using retraining-based metrics. I am not convinced that \"further training\" should be treated as the gold standard in any setting. Why can't we evaluate different TDA algorithms in settings we have access to the entire training procedure, and use the SOTA method in TAA setup?\n- On a related note, it has been widely shown in the literature that influence function based approaches outperform first-order methods on several retraining-based evaluations [3, 4, 5]. If conclusions based on \"further training\" differ from retraining-based metrics, wouldn't this suggest \"further training\" might be capturing something other than what we want from data attribution?\n- Several experimental details require clarification. For instance, when leaving out a data point (line 1024), the authors subtract the loss on that point in each gradient update rather than removing it from the dataset entirely—this is quite different from further training without a data point and needs justification (or at least mention) in the main text. Additionally, second-order methods approximate further training under fixed regularization (as in the derivations authors provided), while further training is done without regularization.\n\nMinor:\n- Many important details are moved to the appendix without proper discussion in the main text. For example, the choice of cosine similarity as the evaluation metric (line 317) is not intuitive and needs explanation in the main text.\n- I'm not sure what the authors meant in line 865. Further training could change the solution even when at the model is optimal under a fixed dataset. The gradient of the empirical loss being 0 does not imply the gradients is 0 for all individual data points.\n\n[1] Ilyas, A., & Engstrom, L. (2025). MAGIC: Near-Optimal Data Attribution for Deep Learning. arXiv preprint arXiv:2504.16430.\n[2] Pruthi, Garima, et al. \"Estimating training data influence by tracing gradient descent.\" Advances in Neural Information Processing Systems 33 (2020): 19920-19930.\n[3] Park, Sung Min, et al. \"Trak: Attributing model behavior at scale.\" arXiv preprint arXiv:2303.14186 (2023).\n[4] Bae, Juhan, et al. \"Training data attribution via approximate unrolled differentiation.\" arXiv preprint arXiv:2405.12186 (2024).\n[5] Deng, Junwei, et al. \"Efficient ensembles improve training data attribution.\" arXiv preprint arXiv:2405.17293 (2024).", "was_revised": true, "final_justification": "As I mentioned in the rebuttal, I find the framing of calling this tool the golden standard for TDA (even at FiMO setting) problematic. I think the manuscript requires a significant modification to address this concern.", "rebuttal": "Thank you very much for your review. We respect your strong position on what TDA can encompass, what the objective can be, and therefore what the gold standard should be. We will say however that if one takes the unavailability of the training procedure as an unchangeable fact in the FiMO setting (as is usually the case with a model downloaded from Hugging Face), then we think that one should at least consider an alternative objective that also respects this constraint (i.e., quantifying sensitivity rather than contribution), and accordingly an alternative gold standard.\n\nWe do want to ask you the following: **Could your concern be allayed if we used different terms to distinguish our setting from the standard TDA problem?** For example, we could always qualify TDA as FiMO-TDA from the end of Section 2 onward, and we could refer to further training as a “silver standard” rather than a gold standard.\n\nFor your other comments, we think that they can be largely addressed by moving content from the appendix to the main paper (as allowed for camera-ready papers), as detailed below.\n\n> when leaving out a data point (line 1024), the authors subtract the loss on that point in each gradient update rather than removing it from the dataset entirely—this is quite different from further training without a data point and needs justification (or at least mention) in the main text.\n\nWe are happy to move the referenced paragraph in Appendix D.3 to the main text. As mentioned there, one justification is that [28] used a similar procedure (but they did not actually justify it). Another reason is that it seems to also mitigate the randomness of stochastic mini-batch training, where the mini-batch that a data point appears in/is left out of is random. (This could have been the reason for [28] as well.)\n\n> second-order methods approximate further training under fixed regularization (as in the derivations authors provided), while further training is done without regularization.\n\nAs mentioned in line 125, we wanted further training to be like typical neural network training, so we did not apply regularization. For the second-order methods and specifically CG and LiSSA, which use a regularization/damping parameter $\\lambda$, we explored varying $\\lambda$ to improve the quality of approximation to further training. As mentioned in Appendix D.4, lines 1042 and onward, we found that a larger value of $\\lambda = 0.01$ was better than $\\lambda = 0.001$ used in prior work. We can mention this in the main text as well.\n\n> the choice of cosine similarity as the evaluation metric (line 317) is not intuitive and needs explanation in the main text.\n\nWe are happy to move Appendix D.5 to the main text to elaborate on cosine similarity.\n\n> I'm not sure what the authors meant in line 865. Further training could change the solution even when at the model is optimal under a fixed dataset. The gradient of the empirical loss being 0 does not imply the gradients is 0 for all individual data points.\n\nIn the convex case of Appendix A, the gradient of the empirical loss being 0 is a sufficient condition for optimality, and thus $\\Delta\\theta = 0$ is an optimal solution to (1) when $\\theta^f = \\theta^*$ is optimal. You are right that the gradient is likely non-zero at each individual data point, and this might be an issue with stochastic optimization algorithms, but this is more an artifact of that class of algorithms. Here we are making more of a theoretical statement."}, {"review_id": "GEfAxsIqjb", "reviewer": "Reviewer_hy33", "summary": "This paper addresses the Final-Model-Only (FiMO) setting for training data attribution (TDA), in which only a trained model’s weights are available. The authors introduce a gold-standard based on “further-training” sensitivity, which trains the final checkpoint on (a) the full dataset and (b) the dataset with one example removed, then measures the resulting change in a test loss or prediction, averaged over multiple random restarts. The author show that this gold-standard recovers first-order and second-order TDA scores. Empirically, they compare these classic TDA methods against the gold-standard on different benchmarks.", "questions": "- Apart from cosine similarity, could you also consider correlation coefficient or other measure to give us a more comprehensive view comparing between further training and those gradient-based baselines?\n- Just to make sure, is the very original IF already within the so-called FiMO setting?\n- For the low quality of the gradient-based approximation, it can just because the approximation is not good. Under this setting, we might also need to assume the further training objective is not deviating form the original one too far, which is usually hard to justify in real world. Will it be interesting to just \"come up with a good enough further training obj\" for better attribution?\n- How does the damping term in second-order method affect the quality of attribution?\n- Is there any experiment on generation settings?\n- Conceptually, how different it is between your further training and the \"two-stage retraining\" introduced in [1]?\n\n\n\n[1] Bae, Juhan, et al. \"If influence functions are the answer, then what is the question?.\" Advances in Neural Information Processing Systems 35 (2022): 17953-17967.", "limitations": "yes", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 1, "strengths_and_weaknesses": "## Strengths\n\n- Theoretical unification:\nShows that Influence Functions, TracIn, gradient‐dot/cos, etc., serve as Taylor approximations of further training.\n\n- Novel scenario:\nThe paper claims they are the first to consider the FiMO setting. And the golden standard, which is the further training, makes sense.\n\n## Weakness\n\n- The training and testing data size seem to be too small to draw insightful and consistent conclusion.\n- Although the setting is claimed to be new, it is actually just a variation of saying \"re-training is so expensive and we can't compute gradients\". So literature like [1] implicitly already discusses similar situation. There is also work [4] utilizing \"unlearning\" as TDA, which also resemble your core idea.\n- In terms of further training, works like [2] also discuss the possibility of \"further LoRA fine-tuning as TDA\". Although they did use gradient information, the idea is similar in some sense. The ensemble idea they propose also match the expected value notation in equation (3).\n- Looking at Figure 2, I will be hesitate to claim the cosine similarity between these baseline TDA methods and their further training counterparts are actually similar...Especially the setting is more complex like (e)(f). The curves in Figure 5 are even harder to explain.\n\n\n\n[1] Ko, Myeongseob, et al. \"The mirrored influence hypothesis: Efficient data influence estimation by harnessing forward passes.\" \nProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.\n\n[2] Deng, Junwei, et al. \"Efficient ensembles improve training data attribution.\" arXiv preprint arXiv:2405.17293 (2024).\n\n[3] Park, Sung Min, et al. \"Trak: Attributing model behavior at scale.\" arXiv preprint arXiv:2303.14186 (2023).\n\n[4] Wang, Sheng-Yu, et al. \"Data attribution for text-to-image models by unlearning synthesized images.\" Advances in Neural Information Processing Systems 37 (2024): 4235-4266.\n\n[5] Choi, Woosung, et al. \"Large-Scale Training Data Attribution for Music Generative Models via Unlearning.\" arXiv preprint arXiv:2506.18312 (2025).", "was_revised": true, "final_justification": "During rebuttal, the authors resolve most of my concerns. However, I feel the empirical results, the relation between gradient-based methods and further training could not justify to be as the \"golden-standard\" for the setting. (echoing reviewer NTqP) This makes me hesitate to lean toward acceptance.", "rebuttal": "Thank you very much for your review. It appears from your originality score of 1 that originality is your main concern. As we discuss below, we think that the **works you cited** to support this assessment **are actually complementary to our contributions** rather than similar to them. We would be happy to discuss these works further with you. We also think that the last weakness you identified **(lower cosine similarities) is not a weakness of our paper**, and we respond to your concern about data size.\n\n### Setting\n> Although the setting is claimed to be new, it is actually just a variation of saying \"re-training is so expensive and we can't compute gradients\".\n\nTo clarify possible misunderstanding: We do assume it is possible to compute gradients of training instances, as otherwise (gradient-based) further training and the gradient-based approximations to it would not be possible. And the motivation for considering the FiMO setting is not just that re-training is expensive. We are considering the scenario where the original training process is *inaccessible* altogether (e.g., a model downloaded from Hugging Face). Given this constraint, our main contributions are as summarized in lines 51-54 of the introduction: We formulate an alternative gold standard that also operates under this constraint and show the relationships of existing gradient-based methods to this gold standard.\n\n### Works that you cited\n\n> So literature like [1] implicitly already discusses similar situation. There is also work [4] utilizing \"unlearning\" as TDA, which also resemble your core idea.\n\nThe main idea of both [1] and [4] is to reverse the roles of training and test data and use the effect on a *training* point of training on a *test* point [1], or unlearning a synthesized image [4], to approximate influence in the opposite direction (the usual one). While a valuable idea, we see it as complementary to our contributions summarized above. Specifically, this idea could be applied to yield reversed versions of the gradient-based methods that we study, but it does not address the question of an alternative gold standard for the FiMO setting or its relationships with gradient-based methods.\n\n> In terms of further training, works like [2] also discuss the possibility of \"further LoRA fine-tuning as TDA\". ... The ensemble idea they propose also match the expected value notation in equation (3).\n\nWe also think that [2] is complementary to our main contributions. We mentioned in Appendix F, lines 1219-1221 that LoRA fine-tuning could be used to make the further training gold standard more efficient, and this could be done using the specific method of [2], which we are happy to cite for this purpose. However, [2] does not address the question of a gold standard for the FiMO setting or its relationships with gradient-based methods. In addition, while the idea of ensembling has been proposed to improve practical TDA methods (for example TRAK by Park et al. (2023), which predates [2]), our work is the first to also propose it for a gold standard itself, to make it more reliable.\n\n### Lower cosine similarities\n\n> Looking at Figure 2, I will be hesitate to claim the cosine similarity between these baseline TDA methods and their further training counterparts are actually similar...Especially the setting is more complex like (e)(f). The curves in Figure 5 are even harder to explain.\n\n- We agree with you (see point 1 in lines 377-378 and its elaboration in Appendix F). We would only say that the first-order-like methods (Grad-Dot, Grad-Cos, DataInf) are “actually similar” to further training when the amount of further training is low and the cosine similarity is high enough, and perhaps not at all in Figure 2(e)(f). Figure 5 looks less pleasing because it is an ablation showing that an alternative adjustment method (see lines 303-306 and Appendix D.3) works less well. \n- In any case, we do not see these lower cosine similarities as a weakness of our paper because we are not advocating for a particular TDA method and are merely reporting how well current methods approximate further training. From this perspective, we might say that they reflect weakness of the current methods and open up possibilities for future research.\n\n### Data size\n\n> The training and testing data size seem to be too small to draw insightful and consistent conclusion.\n\n- First, we used the full training set for further training. \n- Second, we evaluated influence scores only for a subset of training instances ($|\\mathcal{L}| =$ 50 or 100) because the purpose of the experiment was to compare to the further training gold standard. The latter constrains $|\\mathcal{L}|$ because the number of further trainings is proportional to $|\\mathcal{L}|$. Moreover, 50 or 100 training instances compares favorably to previous retrospective work on influence functions (Bae et al. (2022) used 20 training instances (see their Appendix C.2), Schioppa et al. (2023) used 32 in their Section 5.2). \n- Third, regarding test instances, we evaluated 100 to assess variation across test instances; this number also compares favorably to Schioppa et al. (2023) who used 16. Figure 2 and similar figures show that the error bars resulting from 100 test instances are reasonable and our conclusions are reliable.\n\n### Your questions\n\n> Apart from cosine similarity, could you also consider correlation coefficient or other measure to give us a more comprehensive view comparing between further training and those gradient-based baselines?\n\nIndeed, we use Spearman correlation as an alternative measure in Appendix E.1, Figure 6, with qualitatively similar results.\n\n> Just to make sure, is the very original IF already within the so-called FiMO setting?\n\nYes, and one of the points we are making is that influence functions are more suited to the FiMO setting than to the full retraining setting.\n\n> For the low quality of the gradient-based approximation, it can just because the approximation is not good. Under this setting, we might also need to assume the further training objective is not deviating form the original one too far, which is usually hard to justify in real world. Will it be interesting to just \"come up with a good enough further training obj\" for better attribution?\n\nThe problem is not that the further training objective deviates from the original training objective, since we have shown that the gradient-based methods approximate further training, and we compare them only to further training, not original training. We think it may be interesting to further investigate how the further training *algorithm* affects the quality of this approximation. We touch on this in Appendix E.1, Figure 4, where we used Adam as the optimizer instead of SGD.\n\n> How does the damping term in second-order method affect the quality of attribution?\n\nFor the second-order methods CG and LiSSA, which use a damping parameter $\\lambda$, please see Appendix D.4, line 1042 and onward for discussion of our choice of $\\lambda$. We observed that cosine similarities increase with $\\lambda$.\n\n> Conceptually, how different it is between your further training and the \"two-stage retraining\" introduced in [1]?\n\nWe mention in Appendix C, lines 913-915 that the main difference is our proposal of averaging to mitigate the randomness of training."}]

Author rebuttal:

Meta-review: The manuscript has been reviewed by four reviewers.

The authors provided a rebuttal. Eventually, 2 reviewers gave acceptance and 2 gave borderlines, indicating that no reviewers are willing to (even weakly) reject the manuscript.

Despite the minor flaws, the reviewers found the manuscript novel, providing a unifying view of gradient-based methods, and presenting extensive analysis to support the theoretical studies.

There is no ground to overturn the consensus. The AC recommends acceptance of the manuscript.

Please, still, account for the comments in the final version.
Decision: Accept (poster)