Title: 2D-OOB: Attributing Data Contribution Through Joint Valuation Framework
Venue: NeurIPS 2024
Accepted: yes
Keywords: Data valuation

Cell-level attribution

Outlier detection
Abstract: Data valuation has emerged as a powerful framework for quantifying each datum's contribution to the training of a machine learning model. However, it is crucial to recognize that the quality of cells within a single data point can vary greatly in practice. For example, even in the case of an abnormal data point, not all cells are necessarily noisy. The single scalar score assigned by existing data valuation methods blurs the distinction between noisy and clean cells of a data point, making it challenging to interpret the data values. In this paper, we propose 2D-OOB, an out-of-bag estimation framework for jointly determining helpful (or detrimental) samples as well as the particular cells that drive them. Our comprehensive experiments demonstrate that 2D-OOB achieves state-of-the-art performance across multiple use cases while being exponentially faster. Specifically, 2D-OOB shows promising results in detecting and rectifying fine-grained outliers at the cell level, and localizing backdoor triggers in data poisoning attacks.

2D-OOB: Attributing Data Contribution Through Joint Valuation Framework

Abstract

Data valuation has emerged as a powerful framework for quantifying each datum's contribution to the training of a machine learning model. However, it is crucial to recognize that the quality of cells within a single data point can vary greatly in practice. For example, even in the case of an abnormal data point, not all cells are necessarily noisy. The single scalar score assigned by existing data valuation methods blurs the distinction between noisy and clean cells of a data point, making it challenging to interpret the data values. In this paper, we propose 2D-OOB , an out-of-bag estimation framework for jointly determining helpful (or detrimental) samples as well as the particular cells that drive them. Our comprehensive experiments demonstrate that 2D-OOB achieves state-of-the-art performance across multiple use cases while being exponentially faster. Specifically, 2D-OOB shows promising results in detecting and rectifying fine-grained outliers at the cell level, and localizing backdoor triggers in data poisoning attacks.

1 Introduction

From customer behavior prediction and medical image analysis to autonomous driving and policy making, machine learning (ML) systems process ever increasing amounts of data. In such data-rich regimes, a fraction of the samples is often noisy, incorrect annotations are likely to occur, and uniform data quality standards become difficult to enforce. To address these challenges, data valuation emerges as a research field receiving increasing attention, focusing on properly assessing the contribution of each datum to ML training [13, 26]. These methods have proven useful in identifying low-quality samples that can be detrimental to model performance, as well as selecting subsets of data that are representative of enhanced model performance [52, 30, 49]. Furthermore, they are widely applicable in data marketplace for fair revenue allocation and incentive design [55, 48, 43, 5].

Nevertheless, existing data valuation methods assign a scalar score to each datum, thereby failing to account for the varied roles of individual cells. This leaves the valuation rationale unclear and can be unsatisfactory and sub-optimal in various practical scenarios. Firstly, whenever a score is assigned to a data point by a particular data valuation method, it is crucial to understand the underlying justifications to ensure transparency and reliability, especially in high-stakes decision making [42]. Secondly, it is important to recognize the fact that even if a data point is of low quality, it is rarely the case that all the cells within this data point are noisy [40, 29, 46]. The absence of detailed insights

Jingyan Shen ∗

(a) Data valuation

Age

Income

Experience

Education

25

50000

3

4

34

62000

10

6

45

-1

20

8

29

35000

5

5

40

80000

15

100

low valuation scores

(b) Joint valuation

into how individual cells contribute to ML training inevitably leads to discarding the entire data point. This can result in substantial data waste, particularly when only a few cells are noisy and data acquisition is expensive. Finally, in data markets, different cells within a data point may originate from different data sellers [3, 11]. Consequently, a singular valuation for the entire point fails to offer equitable compensation to all contributing parties.

Our contributions In this paper, we propose 2D-OOB , a powerful and efficient joint valuation framework that can attribute a data point's value to its features. 2D-OOB quantifies the importance of each cell in a dataset, as illustrated in Figure 1, providing interpretable insights into which cells are associated with influential data points. Our method is computationally efficient as well as theoretically supported by its connections with Data-OOB [26]. Moreover, our extensive empirical experiments demonstrate the practical effectiveness of 2D-OOB in various use cases. 2D-OOB accurately identifies cell outliers and pinpoints which cells to fix to improve model performance. Additionally, 2D-OOB enables inspection of data poisoning attacks by precisely localizing the backdoor trigger, an artifact inserted into a training sample to induce malicious model behavior [14, 6]. On average, 2D-OOB is 200 times faster than state-of-the-art methods across all datasets examined.

2 Preliminaries

Notations Throughout this paper, we focus on supervised learning settings. For d ∈ N , we denote an input space and an output space by X ⊆ R d and Y ⊆ R , respectively. We denote a training dataset with n data points by D = { ( x i , y i ) } n i =1 where ( x i , y i ) is the i -th pair of the input covariates x i ∈ X and its output label y i ∈ Y . For an event A , an indicator function 1 ( A ) is 1 if A is true, otherwise 0 . For j ∈ N , we set [ j ] := { 1 , . . . , j } . For a set S , we denote its power set by 2 S and its cardinality by | S | .

DataShapley The primary goal of data valuation is to quantify the contribution of individual data points to a model's performance. Leveraging the Shapley value in cooperative game theory [41], DataShapley [13] measures the average change in a utility function U : 2 D → R over all possible subsets of the dataset that either include or exclude the data point. For i ∈ [ n ] , DataShapley of i -th datum is defined as follows.

where D ( i ) k := { S ⊆ D| ( x i , y i ) / ∈ S, | S | = k -1 } . DataShapley ϕ Shap i in (1) considers every set S ∈ D ( i ) k and computes the average difference in utility U ( S ∪ { ( x i , y i ) } ) -U ( S ) . It characterizes the impact of a data point, but its computation requires evaluating U for all possible subsets of D , rendering precise calculations infeasible. Many efficient computation algorithms have been proposed [16, 28, 54], and in these studies, Shapley-based methods have demonstrated better effectiveness in detecting low-quality samples than standard attribution approaches, such as leave-one-out and influence function methods [22, 10].

Data-OOB As an alternative efficient data valuation method, Kwon and Zou [26] propose Data-OOB , which leverages a bagging model and measures the similarity between the nominal label and weak learners' predictions. To be more specific, consider a bagging model consisting of B weak learners, where for b ∈ [ B ] , the b -th weak learner ˆ h b is given as a minimizer of the weighted empirical risk,

where ℓ : Y × Y → R is a loss function and w bi ∈ N is the number of times the i -th datum ( x i , y i ) is selected by the b -th bootstrap dataset. Let w b be a weight vector w b := ( w b 1 , . . . , w bn ) for all b ∈ [ B ] . For i ∈ [ n ] and { ( w b , ˆ h b ) } B b =1 , Data-OOB of the i -th datum is defined as follows.

where T ( y i , ˆ h b ( x i )) is a score function evaluated at ( x i , y i ) . We assume that the higher T , the better the prediction. In classification settings, a common choice for T is 1 ( y i = ˆ h b ( x i )) , and in this case, Data-OOB ϕ OOB i measures the average similarity between a nominal label y i and weak learners' predictions ˆ h b ( x i ) when a datum ( x i , y i ) is not sampled in a bootstrap dataset. It intuitively captures the quality of a data point. For instance, when ( x i , y i ) is a mislabeled sample or an outlier, the label y i is likely to differ from ˆ h b ( x i ) , resulting in ϕ OOB i being close to zero.

It is noteworthy that Data-OOB in (2) can be computed by training a single bagging model, making it computationally efficient. Kwon and Zou [26] show that Data-OOB can easily scale to millions of data points, but for DataShapley this is often very impractical. In addition, Data-OOB is typically comparable to or even more effective than DataShapley in detecting mislabeled data points and selecting helpful data points [26, 17].

3 Attributing Data Contribution through Joint Valuation Framework

Data valuation quantifies the utility of data points, however, it fails to identify which features contribute to these data values and to what extent. For instance, in anomaly detection tasks, data valuation methods can be deployed to detect anomalous data points but cannot explain why they are considered abnormal, which is generally not desirable in practice. To address this challenge, we introduce a joint valuation framework that assigns a cell score to each feature of a data point. Here, a cell score is designed to quantify how each feature affects the value of an individual data point, thereby attributing the data value to specific features.

To the best of the author's knowledge, Liu et al. [32] were the first to consider the concept of joint valuation in the literature, proposing 2D-Shapley as a means to quantitatively interpret DataShapley . To formalize this, we denote a 2D utility function by u : [ n ] × [ d ] → R , which takes as input a subset of data points S ⊆ [ n ] and a subset of features F ⊆ [ d ] , measuring the utility of a fragment of the given dataset consisting of cells { ( i, j ) } i ∈ S,j ∈ F , where a tuple ( i, j ) denotes a cell at the i -th datum and the j -th column. Then, 2D-Shapley is defined as

where D ( i,j ) k,l := { ( S, F ) | S ⊆ [ n ] \{ i } , F ⊆ [ d ] \{ j } , | S | = k -1 , | F | = l -1 } and M i,j u ( S, F ) = u ( S ∪ { i } , F ∪ { j } ) + u ( S, F ) -u ( S ∪ { i } , F ) -u ( S, F ∪ { j } ) .

The function M i,j u allows us to quantify how much removing a specific cell at ( i, j ) from a given set ( S ∪{ i } , F ∪{ j } ) affects the overall utility, and 2D-Shapley ψ 2D -Shap ij evaluates the average M i,j u across all possible data fragments ( S, F ) ∈ D ( i,j ) k,l .

Similar to DataShapley , the permutation of all rows and columns required for exact 2D-Shapley calculations presents significant computational challenges. To address this, Liu et al. [32] develop 2D-KNN , which utilizes k -nearest-neighbors models as surrogates to approximate 2D-Shapley values. However, the approximation methods can compromise the accuracy of valuations [26, 17]. Additionally, 2D-KNN still faces challenges scaling to large-scale datasets and high-dimensional settings.

To address these limitations, we propose 2D-OOB , an efficient and model-agnostic joint valuation framework that leverages out-of-bag estimation to attribute data contribution. We also illustrate how 2D-OOB is connected to Data-OOB , thereby facilitating sample-wise feature-level interpretation for data valuation, as discussed in Section 3.2.

3.1 2D-OOB: an efficient joint valuation framework

Our idea builds upon the subset bagging model [15], which is well recognized as an earlier version of Breiman's random forest model [4]. A key distinction from a standard bagging model is that a weak learner in a subset bagging model is trained on a randomly selected subset of features. For b ∈ [ B ] , we denote the b -th random feature subset by S b ⊆ [ d ] . Then, the b -th weak learner of a subset bagging model is given as follows.

where x i,S b is a subvector of x i that only takes elements in a subset S b . This difference enables us to assess the impact of which features are more influential: if S b includes a helpful (or detrimental) feature, we can expect the out-of-bag prediction ˆ f ( x i,S b ) to be good (or poor). We formalize this intuition and propose 2D-OOB . For i ∈ [ n ] , j ∈ [ d ] and { ( w b , S b , ˆ f b ) } B b =1 , the 2D-OOB for the j -th cell of the i -th data point is defined as follows,

where T : Y × Y → R is a utility function that scores the performance of the weak learner ˆ f b ( x i,S b ) on the i -th datum ( x i , y i ) . Specifically, for binary or multi-class classification problems, we can adopt T ( y i , ˆ f b ( x i,S b )) = 1 ( y i = ˆ f b ( x i,S b )) . In this case, 2D-OOB measures the average accuracy score of out-of-bag predictions (specifically, when the i -th data point is out-of-bag) if the j -th feature is used in training ˆ f b . For regression problems, we can use the negative squared error loss function, defined as T ( y i , ˆ f b ( x i,S b )) = -( y i -ˆ f b ( x i,S b )) 2 . In practice, X could also be incorporated into T to suit the specific use case.

While Data-OOB in (2) aims to assess the impact of the i -th datum, 2D-OOB in (4) further provides interpretable insights by evaluating the data point with various combinations of features, revealing which cells are influential to model performance. By leveraging the subset bagging scheme, 2D-OOB only requires a single training of the bagging model, making it computationally efficient.

3.2 Connection to Data-OOB

We now present interpretable expressions of how 2D-OOB connects to Data-OOB in the following proposition. To begin with, we denote a set of subsets of [ d ] by S := { S ⊆ [ d ] } . With { ( w b , ˆ f b ) } B b =1 , we define the i -th Data-OOB when a particular subset S is used as follows and denote it by ϕ OOB i ( S ) .

Proposition 3.1. For all i ∈ [ n ] and j ∈ [ d ] , ψ 2D -OOB ij can be expressed as follows.

where ˆ F S is an empirical distribution with respect to S induced by the sampling process.

̸

A proof is given in Appendix C. Proposition 3.1 shows that 2D-OOB ψ 2D -OOB ij can be expressed as a conditional empirical expectation of Data-OOB provided that the j -th feature is used in Data-OOB computation. It provides intuitive interpretations: for a fixed i and j = k , ψ 2D -OOB ij > ψ 2D -OOB ik implies that the cell x ij is more helpful to achieve a higher OOB score than the cell x ik , where the OOB score serves as an indicator of model performance. By distinguishing the contributions of individual cells, 2D-OOB effectively realizes joint valuation, providing a finer granularity of analysis that links feature-level importance to individual data quality.

4 Experiments

In this section, we empirically show the effectiveness of 2D-OOB across multiple use cases of the joint valuation: cell-level outlier detection , cell fixation , and backdoor trigger detection . To the best of our knowledge, the latter two use cases are introduced here for the first time within the joint valuation framework. As a summary, 2D-OOB can precisely identify anomalous cells that should be prioritized for examination and subsequent fixation to improve model performance. In the context of backdoor trigger detection, 2D-OOB demonstrates its efficacy by accurately identifying different types of triggers within poisoned data, showcasing its proficiency in detecting non-random, targeted anomalies. Our method also exhibits high computational efficiency through run-time comparison.

Throughout all of our experiments, 2D-OOB uses a subset bagging model with B = 1000 decision trees. We randomly select a fixed ratio of features to build each decision tree. Unless otherwise specified, we utilize half of the features for each weak learner and set T ( y i , ˆ f ( x i,S b )) = 1 ( y i = ˆ f ( x i,S b )) . The run time is measured on a single Intel Xeon Gold 6226 2.9 GHz CPU processor. We provide a detailed ablation study of key hyperparameters in Section 4.4.

4.1 Cell-level outlier detection

Experimental setting In practical situations, even when dealing with abnormal data points, it is not always the case that all cells are noisy [40, 32, 23]. To simulate more realistic settings, we introduce noise to certain cells in the following two-step process: First, we randomly select 20% rows for each dataset. We then select 20% columns uniformly at random, allowing each selected row to have a different set of perturbed cells. We inject noises sampled from the low-probability region into these cells, following Du et al. [9] and Liu et al. [32]. Details on the outlier injection process can be found in Appendix A.3.

We use 12 publicly accessible binary classification datasets from OpenML, encompassing a range of both low and high-dimensional datasets, which have been widely used in the literature [13, 25, 26]. Details on these datasets are presented in Appendix A.1. For each dataset, 1000 and 3000 data points are randomly sampled for training and test datasets, respectively. For the baseline method, we consider 2D-KNN , a fast and performant variant of 2D-Shapley [32]. We incorporate a distance regularization term in the utility function T for enhanced performance.

Results We calculate the valuations for each cell using our joint valuation framework. Ideally, the outlier cells should receive a low valuation. We then arrange the cell valuations in ascending order and inspect those cells with the lowest values first.

The detection rate curve of inserted outlier is shown in Figure 2. For all datasets, 2D-OOB successfully identifies over 90% of the outlier cells by inspecting only 30% of the bottom cells. In comparison, 2D-KNN requires examining nearly 90% of the cells to achieve the same detection level.

We also evaluate the area under the curve (AUC) as a quantitative metric and measure the run-time. As Table 1 shows, 2D-OOB achieves an average AUC of 0 . 83 across 12 datasets, compared to 0 . 67 for 2D-KNN , while being significantly faster. For high-dimensional datasets such as the musk dataset, which comprises 166 features, 2D-KNN would take more than an hour to process, while 2D-OOB can finish in seconds. Furthermore, we present additional results on multi-class classification datasets in Appendix B.1, demonstrating the consistently superior performance and efficiency of 2D-OOB .

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: nomao

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: musk

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: MiniBooNE

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: gas_drift

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: fried

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: jannis

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: pol

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: lawschool

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: vehicle_sensIT

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: electricity

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: 2dplanes

2D-OOB

2D-KNN

Random

0

50

100

Inspection Percentage

0.00

0.25

0.50

0.75

1.00

Detection Rate

Dataset: creditcard

2D-OOB

2D-KNN

Random

4.2 Cell fixation experiment

Experimental setting A naive strategy to handle cell-level outliers is to eliminate data points that contain outliers. This method, however, risks substantial data loss, particularly when outliers are scattered and data points are costly to collect. We instead consider a cell fixation experiment, where we assume that the ground-truth annotations of outlier cells can be restored with external expert knowledge. At each step, we 'fix" a certain number of cells by substituting them with their ground-truth annotations, prioritizing cells that have the lowest valuations. Then we fit a logistic model 3 and evaluate the model's performance with a test set of 3000 samples. It is important to note that correcting normal cells has no effect, whereas fixing outlier cells is expected to enhance the model's performance. We adopt the same datasets and implementations as in Section 4.1.

0

10

20

Fixation percentage

0.918

0.920

0.922

Test accuracy

Dataset: nomao

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.918

0.920

0.922

0.924

0.926

0.928

0.930

Test accuracy

Dataset: musk

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.8075

0.8100

0.8125

0.8150

0.8175

0.8200

0.8225

Test accuracy

Dataset: MiniBooNE

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.9945

0.9950

0.9955

0.9960

0.9965

0.9970

Test accuracy

Dataset: gas_drift

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.824

0.826

0.828

0.830

0.832

Test accuracy

Dataset: fried

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.710

0.711

0.712

0.713

0.714

Test accuracy

Dataset: jannis

2D-OOB

2D-KNN

Random

0

100

0.0

0.5

1.0

Detection Rate

ship vs. truck

0

100

0.0

0.5

1.0

0

100

0.0

0.5

1.0

airplane vs. automobile

0

100

0.0

0.5

1.0

frog vs. horse

0

100

0.0

0.5

1.0

bird vs. cat

0

100

Inspection Percentage

0.0

0.5

1.0

Detection Rate

0

100

Inspection Percentage

0.0

0.5

1.0

0

100

Inspection Percentage

0.0

0.5

1.0

0

100

Inspection Percentage

0.0

0.5

1.0

0

100

Inspection Percentage

0.0

0.5

1.0

2D-OOB

2D-KNN

Random

A.

B.

Results Figure 3 illustrates the anticipated trend in the performance of 2D-OOB , validating our method's capability to accurately identify and prioritize the most impactful outliers for correction. As cells with the lowest valuations are progressively fixed, 2D-OOB demonstrates a consistent improvement in model accuracy. In contrast, when applying the same procedure with 2D-KNN , such notable performance enhancements are not observed.

Additionally, we investigate a scenario where ground-truth annotations remain unavailable. We adopt the setup from Liu et al. [32], where we replace the outlier cells with the average of other cells in the same feature column. 2D-OOB uniformly demonstrates significant superiority over its counterparts. Results are provided in Appendix B.2.

4.3 Backdoor trigger detection

A common strategy of data poisoning attacks involves inserting a predefined trigger (e.g., a specific pixel pattern in an image) into a subset of the training data [14, 6, 31]. These malicious manipulations can be challenging to detect as they only infect specific, targeted samples. Even when poisoned data are present, it could be difficult to discern the root cause of the attacks, since manually reviewing the images is expensive and time-consuming. In this experiment, we introduce a novel task enabled by the joint valuation framework: localizing backdoor triggers in data poisoning attacks. Distinct from the random outliers investigated previously, this type of cell contamination is targeted and deliberate.

Poisoned Image

Cell Valuations

0.00

0.25

0.50

0.75

1.00

Poisoned Image

Cell Valuations

0.00

0.25

0.50

0.75

1.00

Poisoned Image

Cell Valuations

0.00

0.25

0.50

0.75

1.00

Poisoned Image

Cell Valuations

0.00

0.25

0.50

0.75

1.00

We consider two popular backdoor attack algorithms: BadNets [14] and Trojan Attack [31]. During training, the poisoned samples, relabeled as the adversarial target class, are mixed up with clean data. As a result, the model learns to incorrectly associate the trigger with the target class. At test time, inputs containing the trigger are misclassified to the target class. In this context, our goal is to effectively pinpoint the triggers by recognizing them as influential features through our joint valuation framework.

Experimental setting We select 5 pairs of classes from CIFAR-10 [24]. For each pair, one class is designated as the target attack class, while the other serves as the source class. The training dataset comprises 1000 images. For each attack, we contaminate 15% of the training samples from the source class and relabel them to the target class. Two types of attack triggers are implemented: the Trojan square and the BadNets square [14, 38, 31]. These triggers are placed in the lower right corner of the original images to minimize occlusion. Further details about these attacks are available in Appendix A.4. In our experiment, the ratio of poisoned cells is approximately 1% , and each weak learner in the subset bagging model is built by sampling 25 %of the features.

Results We adopt the same detection scheme and baseline methods as in Section 4.1. Ideally, the poisoned cells should receive high valuation scores given that such data points have been relabeled. We present the detection rate curves for five datasets in Figure 4. 2D-OOB significantly outperforms 2D-KNN in detecting both types of triggers. Overall, 2D-OOB achieves an average detection AUC of 0 . 95 across all datasets and attack types, compared to 0 . 83 for 2D-KNN . It is worth noting that conventional data valuation methods are fundamentally unable to localize backdoor triggers; at most, they can only identify poisoned data points.

Qualitative examples Figure 5 displays the heatmaps for poisoned samples based on cell valuations of 2D-OOB . Areas with higher cell valuations (marked in dark red) precisely indicate the trigger locations within these samples, demonstrating the effectiveness of our joint valuation framework. Additional examples can be found in Appendix B.3.

4.4 Ablation study

We conduct ablation studies on the cell-level outlier detection task, as outlined in Section 4.1, to examine the impact of key hyperparameters on 2D-OOB estimations, including the selection and number of weak learners, as well as the feature subset ratio.

Selection of weak learners Although our study primarily employs decision trees as weak learners, it is important to note that 2D-OOB is model-agnostic , enabling the use of any class of machine learning models as weak learners. Specifically, we examine decision trees, logistic regression, a single-layer MLP with 64 units, and a two-layer MLP with 64 and 32 units, respectively, as weak learners to compare their performance.

Table 2 presents a comparison of detection AUC across 12 datasets with different choices of weak learners, indicating that 2D-OOB is not model-free. The selection of weak learners slightly affects the

valuation results, with more complex models generally yielding better performance. Nonetheless, all variations of 2D-OOB outperform 2D-KNN , highlighting the clear advantages of the 2D-OOB approach.

Number of weak learners Increasing the number of weak learners allows for a greater number of data-feature subset pairs to be explored, potentially leading to more accurate estimates. However, as shown in Table 3a, when we increase the number of base learners from 500 to 3000 , the detection AUC for each dataset remains relatively unchanged, suggesting convergence of the estimation beyond a certain threshold. Typically, 1000 base learners are sufficient to achieve an equitable joint valuation.

Feature subset ratio K/d The feature subset ratio K/d refers to the fraction of the total number of features d that are randomly selected to build each weak learner, where K is the number of selected features. In previous experiments, we used a fixed ratio of 0 . 50 (unless otherwise specified). To further investigate the impact of this ratio, we now test two additional values: 0 . 25 and 0 . 75 . The results in Table 3b suggest that in general, the joint valuation capacity of our method is robust to the choice of feature subset ratio.

Apart from the experiments discussed above, we showcase that marginalization of 2D-OOB can either match or surpass state-of-the-art data valuation methods on standard benchmarks in Appendix D.

5 Related work

Data contribution estimation In addition to the marginal contribution-based methods discussed in Section 2, many other approaches are emerging in the area of data valuation. Just et al. [19] develop a non-conventional class-wise Wasserstein distance between the training and validation sets and use the gradient information to evaluate each data point, an approach that has also been applied to data selection [20]. Wu et al. [51] extend data valuation to deep neural networks, introducing a training-free data valuation framework based on neural tangent kernel theory. Yoon et al. [52] leverage reinforcement learning techniques to automatically learn data valuation scores by training a regression model. However, all these data valuation methods do not assign importance scores to cells, whereas our method provides additional insights into how individual cells contribute to the data valuations.

Feature attribution Feature attribution is a pivotal research domain in explainable machine learning that primarily aims to provide insights into how individual features influence model predictions. Various effective methods have been proposed, including SHAP-based explanation [33, 34, 27, 8, 7], counterfactual explanation [47, 18, 39, 35, 36], and backpropagation-based explanation [1, 2, 45, 44, 53]. Among these methods, the SHAP-based explanation stands out as the most widely adopted approach, utilizing cooperative game theory principles to compute the Shapley value [41]. While feature attribution offers a potential method to attribute data valuation scores across individual cells, our empirical experiments in Appendix B.1 reveal that this two-stage scheme falls short in efficacy compared to our proposed joint valuation paradigm, which integrates data valuation and feature attribution in a simultaneous process.

6 Conclusion

We propose 2D-OOB , an efficient joint valuation framework that assigns a score to each cell in a dataset, thereby facilitating finer attribution of data contributions and enabling a deeper understanding of the dataset. Through comprehensive experiments, we show that 2D-OOB is computationally efficient and competitive over state-of-the-art methods in multiple joint valuation use cases.

Discussion We emphasize that the primary objective of the joint valuation framework is to evaluate the quality of cells within the dataset, rather than to optimize model performance. The model used serves as a proxy for this evaluation, and it is important to note that a high-performing machine learning method does not necessarily ensure a justified valuation framework.

Limitation and future work While our study primarily explores random forest models applied to tabular datasets and simple image datasets, the potential application of neural network models within the 2D-OOB framework for more complex vision and language tasks presents a promising avenue for future investigation. For instance, in text datasets, tokens or words can be treated as cells. 2D-OOB can be easily integrated into any bagging training scheme that uses language models.

Overall, we believe that our work will inspire further exploration in the field of joint valuation, with the broader goal of improving the transparency and interpretability of machine learning, as well as developing an equitable incentive mechanism for data sharing.

References

Marco Ancona, Enea Ceolini, Cengiz Öztireli, and Markus Gross. Towards better understanding of gradient-based attribution methods for deep neural networks. arXiv preprint arXiv:1711.06104 , 2017.

Sebastian Bach, Alexander Binder, Grégoire Montavon, Frederick Klauschen, Klaus-Robert Müller, and Wojciech Samek. On pixel-wise explanations for non-linear classifier decisions by layer-wise relevance propagation. PloS one , 10(7):e0130140, 2015.

Jens Bleiholder and Felix Naumann. Data fusion. ACM computing surveys (CSUR) , 41(1):1-41, 2009.

Leo Breiman. Random forests. Machine learning , 45:5-32, 2001.

Lingjiao Chen, Bilge Acun, Newsha Ardalani, Yifan Sun, Feiyang Kang, Hanrui Lyu, Yongchan Kwon, Ruoxi Jia, Carole-Jean Wu, Matei Zaharia, et al. Data acquisition: A new frontier in data-centric ai. arXiv preprint arXiv:2311.13712 , 2023.

Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 , 2017.

Ian Covert and Su-In Lee. Improving kernelshap: Practical shapley value estimation using linear regression. In International Conference on Artificial Intelligence and Statistics , pages 3457-3465. PMLR, 2021.

Ian Covert, Scott M Lundberg, and Su-In Lee. Understanding global feature contributions with additive importance measures. Advances in Neural Information Processing Systems , 33:17212-17223, 2020.

Xuefeng Du, Zhaoning Wang, Mu Cai, and Yixuan Li. Vos: Learning what you don't know by virtual outlier synthesis. arXiv preprint arXiv:2202.01197 , 2022.

Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. Advances in Neural Information Processing Systems , 33:2881-2891, 2020.

Raul Castro Fernandez, Pranav Subramaniam, and Michael J Franklin. Data market platforms: Trading data assets to solve data problems. arXiv preprint arXiv:2002.01047 , 2020.

Matthias Feurer, Jan N Van Rijn, Arlind Kadra, Pieter Gijsbers, Neeratyoy Mallik, Sahithya Ravi, Andreas Müller, Joaquin Vanschoren, and Frank Hutter. Openml-python: an extensible python api for openml. The Journal of Machine Learning Research , 22(1):4573-4577, 2021.

Amirata Ghorbani and James Zou. Data shapley: Equitable valuation of data for machine learning. In International Conference on Machine Learning , pages 2242-2251. PMLR, 2019.

Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 , 2017.

Tin Kam Ho. Random decision forests. In Proceedings of 3rd international conference on document analysis and recognition , volume 1, pages 278-282. IEEE, 1995.

Ruoxi Jia, David Dao, Boxin Wang, Frances Ann Hubis, Nezihe Merve Gurel, Bo Li, Ce Zhang, Costas J Spanos, and Dawn Song. Efficient task-specific data valuation for nearest neighbor algorithms. arXiv preprint arXiv:1908.08619 , 2019.

Kevin Fu Jiang, Weixin Liang, James Zou, and Yongchan Kwon. Opendataval: a unified benchmark for data valuation. arXiv preprint arXiv:2306.10577 , 2023.

Shalmali Joshi, Oluwasanmi Koyejo, Warut Vijitbenjaronk, Been Kim, and Joydeep Ghosh. Towards realistic individual recourse and actionable explanations in black-box decision making systems. arXiv preprint arXiv:1907.09615 , 2019.

Hoang Anh Just, Feiyang Kang, Jiachen T Wang, Yi Zeng, Myeongseob Ko, Ming Jin, and Ruoxi Jia. Lava: Data valuation without pre-specified learning algorithms. arXiv preprint arXiv:2305.00054 , 2023.

Feiyang Kang, Hoang Anh Just, Yifan Sun, Himanshu Jahagirdar, Yuanzhi Zhang, Rongxing Du, Anit Kumar Sahu, and Ruoxi Jia. Get more for less: Principled data selection for warming up fine-tuning in llms. arXiv preprint arXiv:2405.02774 , 2024.

Markelle Kelly, Rachel Longjohn, and Kolby Nottingham. https://archive.ics.uci.edu , 2017. The UCI Machine Learning Repository.

Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International conference on machine learning , pages 1885-1894. PMLR, 2017.

Hans-Peter Kriegel, Peer Kröger, Erich Schubert, and Arthur Zimek. Outlier detection in axis-parallel subspaces of high dimensional data. In Advances in Knowledge Discovery and Data Mining: 13th PacificAsia Conference, PAKDD 2009 Bangkok, Thailand, April 27-30, 2009 Proceedings 13 , pages 831-838. Springer, 2009.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Yongchan Kwon and James Zou. Beta shapley: a unified and noise-reduced data valuation framework for machine learning. arXiv preprint arXiv:2110.14049 , 2021.

Yongchan Kwon and James Zou. Data-OOB: Out-of-bag estimate as a simple and efficient data value. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors, Proceedings of the 40th International Conference on Machine Learning , volume 202 of Proceedings of Machine Learning Research , pages 18135-18152. PMLR, 23-29 Jul 2023. URL https://proceedings.mlr.press/v202/kwon23e.html .

Yongchan Kwon and James Y Zou. Weightedshap: analyzing and improving shapley based feature attributions. Advances in Neural Information Processing Systems , 35:34363-34376, 2022.

Yongchan Kwon, Manuel A. Rivas, and James Zou. Efficient computation and analysis of distributional shapley values. In Arindam Banerjee and Kenji Fukumizu, editors, Proceedings of The 24th International Conference on Artificial Intelligence and Statistics , volume 130 of Proceedings of Machine Learning Research , pages 793-801. PMLR, 13-15 Apr 2021. URL https://proceedings.mlr.press/v130/ kwon21a.html .

Andy Leung, Hongyang Zhang, and Ruben Zamar. Robust regression estimation and inference in the presence of cellwise and casewise contamination. Computational Statistics & Data Analysis , 99:1-11, 2016.

Weixin Liang, Girmaw Abebe Tadesse, Daniel Ho, L Fei-Fei, Matei Zaharia, Ce Zhang, and James Zou. Advances, challenges and opportunities in creating data for trustworthy ai. Nature Machine Intelligence , 4 (8):669-677, 2022.

Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and X. Zhang. Trojaning attack on neural networks. In Network and Distributed System Security Symposium , 2018. URL https://api.semanticscholar.org/CorpusID:31806516 .

Zhihong Liu, Hoang Anh Just, Xiangyu Chang, Xi Chen, and Ruoxi Jia. 2d-shapley: A framework for fragmented data valuation. arXiv preprint arXiv:2306.10473 , 2023.

Scott M Lundberg and Su-In Lee. A unified approach to interpreting model predictions. Advances in neural information processing systems , 30, 2017.

Scott M Lundberg, Gabriel G Erion, and Su-In Lee. Consistent individualized feature attribution for tree ensembles. arXiv preprint arXiv:1802.03888 , 2018.

Divyat Mahajan, Chenhao Tan, and Amit Sharma. Preserving causal constraints in counterfactual explanations for machine learning classifiers. arXiv preprint arXiv:1912.03277 , 2019.

Ramaravind K Mothilal, Amit Sharma, and Chenhao Tan. Explaining machine learning classifiers through diverse counterfactual explanations. In Proceedings of the 2020 conference on fairness, accountability, and transparency , pages 607-617, 2020.

Maria-Irina Nicolae, Mathieu Sinn, Minh Ngoc Tran, Beat Buesser, Ambrish Rawat, Martin Wistuba, Valentina Zantedeschi, Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, Ian Molloy, and Ben Edwards. Adversarial robustness toolbox v1.2.0. CoRR , 1807.01069, 2018. URL https://arxiv.org/pdf/1807. 01069 .

Ren Pang, Zheng Zhang, Xiangshan Gao, Zhaohan Xi, Shouling Ji, Peng Cheng, and Ting Wang. Trojanzoo: Towards unified, holistic, and practical evaluation of neural backdoors. In Proceedings of IEEE European Symposium on Security and Privacy (Euro S&P) , 2022.

Rafael Poyiadzi, Kacper Sokol, Raul Santos-Rodriguez, Tijl De Bie, and Peter Flach. Face: feasible and actionable counterfactual explanations. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society , pages 344-350, 2020.

Peter J Rousseeuw and Wannes Van Den Bossche. Detecting deviating data cells. Technometrics , 60(2): 135-145, 2018.

Lloyd S Shapley et al. A value for n-person games. 1953.

Rachael Hwee Ling Sim, Xinyi Xu, and Bryan Kian Hsiang Low. Data valuation in machine learning:'ingredients', strategies, and open challenges. In Proc. IJCAI , 2022.

Rachael Hwee Ling Sim, Yehong Zhang, Trong Nghia Hoang, Xinyi Xu, Bryan Kian Hsiang Low, and Patrick Jaillet. Incentives in private collaborative machine learning. In Thirty-seventh Conference on Neural Information Processing Systems , 2023.

Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprint arXiv:1312.6034 , 2013.

Jost Tobias Springenberg, Alexey Dosovitskiy, Thomas Brox, and Martin Riedmiller. Striving for simplicity: The all convolutional net. arXiv preprint arXiv:1412.6806 , 2014.

Peng Su, Garth Tarr, and Samuel Muller. Robust variable selection under cellwise contamination. Journal of Statistical Computation and Simulation , pages 1-17, 2023.

Sandra Wachter, Brent Mittelstadt, and Chris Russell. Counterfactual explanations without opening the black box: Automated decisions and the gdpr. Harv. JL & Tech. , 31:841, 2017.

Jiachen T Wang, Prateek Mittal, and Ruoxi Jia. Efficient data shapley for weighted nearest neighbor algorithms. arXiv preprint arXiv:2401.11103 , 2024.

Jiachen T Wang, Tianji Yang, James Zou, Yongchan Kwon, and Ruoxi Jia. Rethinking data shapley for data selection tasks: Misleads and merits. arXiv preprint arXiv:2405.03875 , 2024.

Tianhao Wang and Ruoxi Jia. Data banzhaf: A data valuation framework with maximal robustness to learning stochasticity. arXiv preprint arXiv:2205.15466 , 2022.

Zhaoxuan Wu, Yao Shu, and Bryan Kian Hsiang Low. Davinz: Data valuation using deep neural networks at initialization. In International Conference on Machine Learning , pages 24150-24176. PMLR, 2022.

Jinsung Yoon, Sercan Arik, and Tomas Pfister. Data valuation using reinforcement learning. In International Conference on Machine Learning , pages 10842-10851. PMLR, 2020.

Matthew D Zeiler and Rob Fergus. Visualizing and understanding convolutional networks. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part I 13 , pages 818-833. Springer, 2014.

Jiayao Zhang, Qiheng Sun, Jinfei Liu, Li Xiong, Jian Pei, and Kui Ren. Efficient sampling approaches to shapley value approximation. Proc. ACM Manag. Data , 1(1), may 2023. doi: 10.1145/3588728. URL https://doi.org/10.1145/3588728 .

Boxin Zhao, Boxiang Lyu, Raul Castro Fernandez, and Mladen Kolar. Addressing budget allocation and revenue allocation in data market environments using an adaptive sampling algorithm. arXiv preprint arXiv:2306.02543 , 2023.

Supplementary Materials

In the supplementary materials, we provide implementation details, additional experimental results, rigorous formalized proofs and data valuation experiment results. Code repository can be found at https://github.com/yifansun99/2D-OOB-Joint-Valuation .

A Implementation details

A.1 Datasets

Tabular datasets We use 12 binary classification datasets obtained from OpenML [12]. A summary of all the datasets is provided in Table 4. These datasets are used in Section 4.1, 4.2, 4.4, and Appendix D.

For each dataset, we first employ a standard normalization procedure, where each feature is normalized to have zero mean and unit standard deviation. After preprocessing, we randomly partition a subset of the data into two non-overlapping sets: a training dataset and a test dataset, which consists of 1000 and 3000 samples respectively. The training dataset is used to obtain the joint (or marginal) valuation for each cell (or data point). The test dataset is exclusively used for the cell fixation (or point removal) experiment when evaluating the test accuracy. Note that for methods that need a validation dataset such as KNNShapley and DataShapley , we additionally sample a separate validation dataset (disjoint from training dataset and test dataset) to evaluate the utility function. The size of the validation dataset is set to 10% of the training sample size.

Image datasets We create datasets by pairing CIFAR-10 classes, each pair consisting of a target attack class and a source class. The training and test dataset comprises 1000 and 2000 samples, respectively. The size of the validation dataset is set to 10% of the training sample size. To manage the computational challenges posed by the baseline method, we employ the super-pixel technique to transform the ( 32 , 32 , 3 ) image into a 256 -dimensional vector. Specifically, we first average the pixel values across the three channels for each pixel. Then, we partition these transformed images into equal-sized 2 × 2 grids. Average pooling is applied within each grid to reduce pixel values to a single cell value, which is then arranged into a flattened input vector. A cell is annotated as poisoned if at least 25% of its corresponding grid area contains the trigger.

A.2 Implementation details for different methods

2D-OOB 2D-OOB involves fitting a subset random forest model with B = 1000 decision trees based on the package 'scikit-learn'. When constructing each decision tree, we fix the feature subset size ratio as 0 . 5 (unless otherwise specified). For Section 4.3 and Appendix D, we simply adopt T ( y i , ˆ f ( x i,S b )) = 1 ( y i = ˆ f ( x i,S b )) . For Section 4.1 and 4.2, we further calculate the normalized negative L 2 distance between covariates and the class-specific mean in the bootstrap dataset, denoted as d norm ( x i , y i ) . Then we use T ( y i , ˆ f ( x i,S b )) = 1 ( y i = ˆ f ( x i,S b )) + d norm ( x i , y i ) .

2D-KNN 2D-KNN employs KNN as a surrogate model to approximate 2D-Shapley . We set the number of nearest neighbors as 10 and the number of permutations as 1000 . The hyperparameters are selected based on convergence behavior, and the run time is measured until the values converge.

A.3 Implementation details for cell-level outlier generation

Following Du et al. [9] and Liu et al. [32], we replace a given cell with an outlier value. Here, the outlier value is randomly generated from the two-sided 'tails' of the Gaussian distribution fitted to the column's mean and standard deviation, where the probability of the two-sided tail area is set to be 1 %. In total, 4% ( 20% × 20% ) of the cells are replaced with the corresponding outlier values.

A.4 Implementation details for backdoor trigger generation

Following the prior work [14, 31], we generate the BadNets square and the Trojan square trigger. For BadNets, we adopt the implementation in Nicolae et al. [37]. For Trojan Attack, we use a

pretrained ResNet-18 model on the CIFAR-10 dataset and employ the implementation in Pang et al. [38]. For each attack, we evaluate its effectiveness by training a decision tree model on the poisoned dataset. The accuracy on a clean test set remains nearly unchanged compared to a model trained on an uncontaminated training set, while the attack success rate on a held-out poisoned test set is guaranteed to exceed 75% .

B Additional experimental results

B.1 Additional results for cell-level outlier detection

Additional results on multi-class classification datasets We conducted cell-level outlier detection experiments (as described in Section 4.1) on three multi-class classification datasets from the UCI Machine Learning repository [21]. As shown in the Table 5, 2D-OOB displays superior detection performance and efficiency.

Additional baseline: two-stage attribution Once we obtain the data valuation scores, an alternative solution approach to determining cell-level attributions involves leveraging feature attribution methods such as SHAP [33]. We explore an additional baseline method building upon this idea: initially, Data-OOB (or any other data valuation method) is computed for the i -th data point, denoted as dv i . Subsequently, TreeSHAP [34] is fitted, using dv i as the target and the concatenation of x i and y i (denoted as x i ⊕ y i ) as the predictor. The derived local feature attributions are then interpreted as joint valuation results. We refer to this method as 'two-stage attribution'.

Table 6 indicates that 2D-OOB substantially outperforms its two-stage counterpart. We hypothesize that the superiority of our method stems from integrating data valuation and feature attribution into a cohesive framework. Conversely, the two-stage method treats data valuation and feature attribution as separate processes, potentially resulting in sub-optimal outcomes. Furthermore, due to the computational complexity of TreeSHAP , the two-stage approach is notably slower compared to our method.

A noisy setting with more outlier cells We consider a more challenging scenario with increased outlier levels, where both the row outlier ratio and column outlier ratio increase from 20% (as in Section 4.1) to 50% . Consequently, this leads to 25% ( 50% × 50% ) of the cells being replaced with outlier values. We follow the same outlier generation procedure outlined in Appendix A.3. The findings, presented in Table 7, demonstrate that our method maintains a significantly superior performance over 2D-KNN , even under such a noisy setting.

B.2 Additional results for cell fixation experiment

Figure 6 presents the results for the cell fixation experiment on 6 additional datasets. 2D-OOB excels in precisely detecting and correcting relevant cell outliers.

The scenario without ground-truth knowledge Following Liu et al. [32], we examine a situation where external information on the ground-truth annotations of outlier cells is not accessible. In this scenario, we address these outliers by substituting them with the average of other cells in the same feature column. This procedure starts by addressing cells with the lowest valuations, based on the hypothesis that correcting these cells is likely to maintain or potentially improve the model's performance. As depicted in Figure 7, 2D-OOB conforms to this expected trend, demonstrating the

0

10

20

Fixation percentage

0.882

0.884

0.886

0.888

0.890

0.892

Test accuracy

Dataset: pol

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.97

0.98

0.99

1.00

Test accuracy

Dataset: lawschool

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.824

0.826

0.828

0.830

0.832

Test accuracy

Dataset: vehicle_sensIT

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.7175

0.7200

0.7225

0.7250

0.7275

0.7300

0.7325

Test accuracy

Dataset: electricity

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.827

0.828

0.829

0.830

0.831

0.832

Test accuracy

Dataset: 2dplanes

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.794

0.796

0.798

0.800

0.802

Test accuracy

Dataset: creditcard

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.88

0.89

0.90

0.91

Test accuracy

Dataset: nomao

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.88

0.90

0.92

Test accuracy

Dataset: musk

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.79

0.80

0.81

0.82

Test accuracy

Dataset: MiniBooNE

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.97

0.98

0.99

Test accuracy

Dataset: gas_drift

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.81

0.82

0.83

Test accuracy

Dataset: fried

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.69

0.70

0.71

0.72

Test accuracy

Dataset: jannis

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.80

0.85

Test accuracy

Dataset: pol

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.97

0.98

0.99

1.00

Test accuracy

Dataset: lawschool

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.78

0.80

0.82

Test accuracy

Dataset: vehicle_sensIT

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.70

0.71

0.72

Test accuracy

Dataset: electricity

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.805

0.810

0.815

0.820

0.825

Test accuracy

Dataset: 2dplanes

2D-OOB

2D-KNN

Random

0

10

20

Fixation percentage

0.76

0.78

0.80

Test accuracy

Dataset: creditcard

2D-OOB

2D-KNN

Random

effectiveness of our method in joint valuation. Conversely, 2D-KNN fails to show similar performance improvements.

B.3 Additional results for backdoor trigger experiment

We provide additional qualitative examples of the backdoor trigger detection experiment in Figure 8.

Poisoned Image

Cell Valuations

0.00

0.25

0.50

0.75

1.00

Poisoned Image

Cell Valuations

0.00

0.25

0.50

0.75

1.00

Poisoned Image

Cell Valuations

0.00

0.25

0.50

0.75

1.00

Poisoned Image

Cell Valuations

0.00

0.25

0.50

0.75

1.00

C Proof of Proposition 3.1

Proof. For simplicity, we denote ϕ OOB i ( S ) as ϕ i ( S ) and ψ 2D -OOB ij as ψ ij in the proof. Let S := { S ⊆ [ d ] } represent the set of all feature subsets, where S is a feature subset. We denote the cardinality of S as L := |S| = 2 d . Let γ b be a weight vector γ b := ( γ b 1 , . . . , γ bL ) for all b ∈ [ B ] , where γ bl ∈ { 0 , 1 } and γ bl = 1 indicates the l -th subset is used in the b -th weak learner. With { w b , γ b , ˆ f b } B b =1 , we can denote the i -th Data-OOB on the l -th feature subset S l as

With slight abuse of notation, the formulation of 2D-OOB in (4) can be expressed as follows.

where α i,j,l ∝ 1 ( j ∈ S l ) ∑ B b =1 1 ( w bi = 0) 1 ( γ bl = 1) , ∀ i ∈ [ n ] , j ∈ [ d ] , l ∈ [ L ] and ∑ L l =1 α i,j,l = 1 . Define P i ( S l | j ∈ S l , { w bi } B b =1 ) = α i,j,l , which specifies an empirical distribution of the feature subset S , conditioned on j ∈ S and the bootstrap sampling process. Here, 1 ( j ∈ S l ) indicates that the distribution is conditioned on the inclusion of the j -th feature within the feature subset S l . w bi indicates whether the i -th sample is out-of-bag in the b -th bootstrap, and γ bl indicates whether the l -th feature subset is selected in the b -th weak learner. Thus, the point mass is determined by the sampling process, leading to:

D Data valuation experiment

In this section, we show that 2D-OOB-data , the marginalization of 2D-OOB , offers an effective approach to data valuation. This serves as the basis of our enhanced performance in joint valuation.

Marginalization 2D-OOB aims to attribute data contribution through cells. Consequently, by summing up 2D-OOB over all columns, we can derive data contribution values. For i ∈ [ n ] , we define the 2D-OOB-data ψ data i as follows.

Based on discussions in Section 3.2, the marginalizations also connect with Data-OOB :

Proposition D.1. For all i ∈ [ n ] , the marginalizations ψ data i can be expressed as follows.

where the notations follow the same definitions as Proposition 3.1.

Proof. Based on the definition of 2D-OOB-Data , for i ∈ [ n ] ,

where α i,j,l is defined in Appendix C. We have ∑ L l =1 ( 1 d ∑ d j =1 α i,j,l ) = 1 d ∑ d j =1 ∑ L l =1 α i,j,l = 1 . Denote P i ( S l |{ w bi } B b =1 ) = 1 d ∑ d j =1 α i,j,l , which induces the empirical expectation of Data-OOB with respect to S l .

Proposition D.1 indicates 2D-OOB-data ψ data i can be expressed as the average Data-OOB value for the i -th data point. As a result, 2D-OOB-data is expected to inherit the advanced ability of Data-OOB in terms of data valuation, as will be empirically examined next.

Experimental setting Following the standard protocol in Kwon and Zou [25, 26] and Jiang et al. [17], we randomly select 10 % of the data points and flip its label to the other class. For joint valuation methods, we calculate the valuation of each cell and perform the marginalization over features to obtain the data valuation scores. Mislabeled data detection and data removal experiments are examined based on this setting. For the baseline methods, we further incorporate several stateof-the-art data valuation methods including DataShapley [13], KNNShapley [16], DataBanzhaf [50], LAVA [19], and Data-OOB [26]. Implementation details are listed below. To guarantee a fair comparison, we also employ the decision tree as the base model in DataShapley and DataBanzhaf . We adopt the same 12 datasets as outlined in Section 4.1.

Data-OOB Data-OOB involves fitting a random forest model without feature subset sampling, consisting of 1000 decision trees.

DataShapley We use a Monte Carlo-based algorithm. The Gelman-Rubin statistics is computed to determine the termination criteria of the algorithm. Following Jiang et al. [17], We adopt the threshold to be 1 . 05 .

KNNShapley We set the number of nearest neighbors to be 10% of the sample size following Jia et al. [16].

LAVA We calculate the class-wise Wasserstein distance following Just et al. [19]. The 'OTDD' framework is adopted to complete the optimal transport calculation.

DataBanzhaf We adopt the implementation from Jiang et al. [17]. We set 'the number of models to train' as 1000 .

D.1 Mislabeled data detection

We calculate the precision-recall curve by comparing the actual annotations, which denote whether data points are mislabeled, against the data valuation scores computed by different methods. Mislabeled data typically have a detrimental impact on model performance. Therefore, data points that receive a lower valuation score are considered to have a higher chance of being mislabeled. We then determine AUCPR (the AUC of the precision-recall curve) as a quantitative metric to assess the detection efficacy.

As shown in Table 8, 2D-OOB-data consistently outperforms 2D-KNN-data across all datasets, suggesting its superior ability to detect mislabeled data points. It is worth noting that 2D-OOB-data 's results are on par with Data-OOB , while significantly exceeding the performance of other data valuation methods. These results are in line with our theoretical analysis regarding the resemblance between Data-OOB and 2D-OOB-data . However, it is important to highlight that applying Data-OOB to the joint tasks is not feasible as mentioned earlier, underscoring the necessity for the development of 2D-OOB .

D.2 Point removal experiment

Removing low-quality data points has the potential to enhance model performance. Based on this idea, we employ the point removal experiment, a widely used benchmark in data valuation [26, 13, 25]. According to the calculated data valuation scores, we progressively remove data points from the dataset in ascending order. Specifically, we begin by removing the data points with the lowest data valuations. Each time we remove a datum, we fit a logistic model and use the held-out test set consisting of 3000 instances to evaluate the model performance. The expected behavior is that the model performance will improve initially as the detrimental data points are gradually eliminated from the training process. Removing an excessive number of data points may result in a drastically altered dataset. Consequently, we opt to remove the bottom 20% data points.

Dataset

Data Valuation

Joint Valuation (Marginalized)

KNNShapley

LAVA

DataBanzhaf

DataShapley

Data-OOB

2D-KNN-data

2D-OOB-data

(ours)

lawschool

0.66

±

0.013

0.13

±

0.003

0.46

±

0.008

0.88

±

0.007

1.00

±

0.000

0.46

±

0.011

0.99

±

0.002

electricity

0.22

±

0.008

0.11

±

0.002

0.18

±

0.005

0.26

±

0.007

0.44

±

0.007

0.20

±

0.006

0.39

±

0.007

fried

0.40

±

0.014

0.11

±

0.002

0.22

±

0.007

0.35

±

0.009

0.76

±

0.007

0.34

±

0.010

0.73

±

0.008

2dplanes

0.46

±

0.016

0.12

±

0.002

0.32

±

0.007

0.54

±

0.009

0.78

±

0.008

0.44

±

0.011

0.68

±

0.010

creditcard

0.37

±

0.007

0.11

±

0.003

0.16

±

0.004

0.28

±

0.006

0.40

±

0.007

0.20

±

0.005

0.40

±

0.007

pol

0.19

±

0.017

0.11

±

0.002

0.37

±

0.010

0.58

±

0.012

0.93

±

0.004

0.29

±

0.018

0.87

±

0.005

MiniBooNE

0.41

±

0.013

0.13

±

0.006

0.23

±

0.007

0.41

±

0.010

0.78

±

0.007

0.36

±

0.008

0.78

±

0.007

0.20

±

0.007

0.11

±

0.002

0.14

±

0.003

0.17

±

0.005

0.38

±

0.010

0.19

±

0.006

0.37

±

0.010

nomao

0.61

±

0.012

0.14

±

0.003

0.33

±

0.010

0.58

±

0.009

0.87

±

0.006

0.33

±

0.011

0.88

±

0.005

vehicle_sensIT

0.22

±

0.009

0.11

±

0.002

0.21

±

0.007

0.33

±

0.011

0.56

±

0.010

0.14

±

0.005

0.56

±

0.010

gas_drift

0.87

±

0.013

0.16

±

0.006

0.42

±

0.009

0.75

±

0.008

0.98

±

0.002

0.88

±

0.006

0.98

±

0.002

musk

0.33

±

0.010

0.11

±

0.003

0.31

±

0.007

0.47

±

0.012

0.85

±

0.005

0.21

±

0.008

0.85

±

0.005

Average

0.41

0.12

0.28

0.47

0.73

0.34

0.71

Test accuracy curves throughout the data removal process are shown for 12 datasets (Figure 9). A higher curve signifies better performance in terms of data valuation. Overall, 2D-OOB-data demonstrates similar performance to Data-OOB , while significantly outperforming all other data valuation methods and the random baseline. When a few data points with poor quality are removed, the test performance of 2D-OOB-data exhibits an evident increase. However, such a positive trend does not apply to other popular data valuation methods including DataShapley and LAVA . These findings highlight the potential of 2D-OOB-data in selecting a subset of critical data points that can maintain model performance when the dataset is pruned.

0

5

10

15

20

Removal percentage

0.86

0.87

0.88

0.89

0.90

0.91

0.92

Test accuracy

Dataset: nomao

0

5

10

15

20

Removal percentage

0.85

0.86

0.87

0.88

0.89

0.90

0.91

0.92

Test accuracy

Dataset: musk

0

5

10

15

20

Removal percentage

0.795

0.800

0.805

0.810

0.815

0.820

0.825

0.830

Test accuracy

Dataset: MiniBooNE

0

5

10

15

20

Removal percentage

0.95

0.96

0.97

0.98

0.99

Test accuracy

Dataset: gas_drift

0

5

10

15

20

Removal percentage

0.800

0.805

0.810

0.815

0.820

0.825

0.830

Test accuracy

Dataset: fried

0

5

10

15

20

Removal percentage

0.690

0.695

0.700

0.705

0.710

0.715

Test accuracy

Dataset: jannis

0

5

10

15

20

Removal percentage

0.80

0.82

0.84

0.86

0.88

0.90

Test accuracy

Dataset: pol

0

5

10

15

20

Removal percentage

0.88

0.90

0.92

0.94

0.96

0.98

1.00

Test accuracy

Dataset: lawschool

0

5

10

15

20

Removal percentage

0.77

0.78

0.79

0.80

0.81

0.82

0.83

0.84

Test accuracy

Dataset: vehicle_sensIT

0

5

10

15

20

Removal percentage

0.705

0.710

0.715

0.720

0.725

0.730

0.735

Test accuracy

Dataset: electricity

0

5

10

15

20

Removal percentage

0.822

0.824

0.826

0.828

0.830

0.832

0.834

Test accuracy

Dataset: 2dplanes

0

5

10

15

20

Removal percentage

0.7900

0.7925

0.7950

0.7975

0.8000

0.8025

0.8050

0.8075

0.8100

Test accuracy

Dataset: creditcard

LAVA

DataShapley

KNNShapley

DataBanzhaf

Data-OOB

2D-OOB-data

2D-KNN-data

Random

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The paper's contributions have been clearly stated in the abstract and section 1.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The paper has included discussion about limitations in section 6.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: The paper discusses theoretical interpretation in section 3.2 and the proof has been included in Appendix C.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: All implementation details have been included in section 4 and Appendix A.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: The paper uses open-source datasets, detailed in Appendix A.1, and the code repository is included in the supplementary materials.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: Experiment settings have been clearly stated in section 4 and Appendix A. Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: The paper reports error bars for all experiment results.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: The paper provides information on compute resources in section 4.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: The research conducted in the paper fully adheres to the NeurIPS Code of Ethics as outlined in the provided guidelines.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [NA]

Justification: There is no societal impact of the work performed.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: Please refer to Appendix A for dataset citations.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing or research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing or research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
comments: SUMMARY:
This paper studies data attribution. Unlike the previous works that only quantifies the contribution of each datum, this work also considers the attribution of the cells within every datum. The proposed the joint valuation framework, 2D-OOB, can accurately identify cell outliers, as well as the poisoning attacks. The experiments verify the authors claims and show the efficiency of the proposed method.

STRENGTHS:
1. The paper is well-written and easy to follow.
2. The proposed method has been theoretically generalized and connected to the existing works.
3. The experiments are comprehensive and show the efficiency of the proposed method.

WEAKNESSES:
1. In section 4.3, the experiments did not mention that the classification label is altered or not after poisoning (e.g, from correct to incorrect).
2. The paper does not state clearly about the differences of the application on image, comparing with the other model attribution methods? They both assign a value to each feature/pixel/cell in the input data. Why would the proposed method be better in this scenario?
3. How about the scalability of the proposed method? The experiments are either conducted on tabular data or small images. The large images or high-dimensional data are not mentioned.
4. What is the distance regularization term mentioned in L168 in the utility function $T$?
5. The size of CIFAR-10 is 32x32, but the cell valuation displayed in Figure 5 is 16x16. Why is that?

QUESTIONS:
See weaknesses

LIMITATIONS:
N/A
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-12

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes 2D-OOB, an out-of-bag estimation framework for jointly detecting both samples as well as their cells that are outliers. In other words, 2D-OOB allows attribution of the value of a data sample to its individual features.  Evaluation shows that the framework is also able to localize backdoor triggers in data poisoning attacks. \nIn comparison to the 2D-Shapley model, which also performs joint valuation of a sample and its features, the 2D-OOB is a more efficient and model-agnostic formulation and builds on the subset bagging model, where each weak learner is trained on a randomly selected subset of features. In the experiments, decision trees as used as the weak learners and trained using randomly selected features. The framework measures (using Eqn. (4)), the average accuracy of the bag of predictors for a selected sample and its features.\n\nSTRENGTHS:\n* The paper is well written.\n* Given the background in moving fro DataShapley to the Data-OOB formulation, the transition from 2D-Shapley to 2D-OOB was intuitive and easy to follow. \n* The proposed method can identify data poisoning attack triggers (square patches placed in the original images to elicit misclassification) which could be very useful.\n\nWEAKNESSES:\n* The paper is low on novelty. Given, OOB-Data formulation and the 2D-Shapley for joint valuation, the 2D-OOB formulation seems like a natural extension -- interesting, but not high on novelty.\n\n* In Fig. 4, panel B, for BadNets poisoning attack, the detection performance of 2D-OOB and 2D-KNN (proxy for 2D-Shapley) are very similar. It is difficult to assess how 2D-OOB will perform for more stronger poisoning attacks. A more detailed study on this aspect as well as analysis showing that 2D-OOB is more likely to identify such triggers, even when attack takes such a detection mechanism into account, will be a good indicator of the strength of this framework.\n\n* Table 1, shows the average run time is much improved from 2D-KNN, however, most of the datasets used (Appendix A, Table 3) have small input dimensions (only three have >= 100 but have small sample size) and hence it is difficult to assess how the technique would scale.\n\nQUESTIONS:\n* One of the arguments mentioned in the description of Fig. 2 is that 2D-OOB detects a majority of outlier cells by examining a small fraction of the total cells. It would be great if the authors could further explain this statement and which part of the formulation in (4) motivates this argument.\n\n* In Fig. 3 (showing 2D-OOBs ability to identify and prioritize the outliers to fix), the test accuracy for the Jannis dataset is relatively low compared to the others and the performance is also similar to 2D-KNN. Any insights as to why this is happening?\n\n* In Section 4.4, were the experiments also performed by varying B using a 2-layer MLP? What is the overhead of training an out-of-bag estimator versus a single model (maybe an autoencoder) and using that for outlier detection. \n\n* Are there any other stronger baselines against which comparison can be made?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-14"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a joint valuation framework for not only obtaining data value but also attributing a data points value to its individual features (cells). The framework is build on top of data-OOB. The authors compared the proposed 2D-OOB with 2D-KDD on several tasks, including cell-level outlier detection and backdoor trigger detection in data poisoning attacks.\n\nSTRENGTHS:\n(+) This paper targets an important problem that is useful for improving the interpretability of data valuation. The joint valuation provides more fine-grained information. Identifying outliers at the cell level is informative for determining which cell to fix in the next step when improving data quality, especially useful when data acquisition is expensive.\n\n(+) The proposed method naturally integrates the idea of random forest - random feature selection in the construction of weak learners - with data-OOB, offering a new solution for joint evaluation. This approach addresses a relatively underexplored problem, with few existing works in the area. The proposed 2D-OOB method demonstrates greater computational efficiency compared to 2D-KDD.\n\n(+) The improvement in backdoor trigger detection is promising, as cell contamination in this context is targeted and deliberate, unlike artificial random outliers. \n\n(+) The authors provide an ablation study to assess the impact of the selection and number of weak learners, as well as the feature subset ratio, which helps in understanding the stability of the proposed method.\n\nWEAKNESSES:\n(-) Despite the strengths mentioned above, the entire framework is built on top of the OOB framework. This brings a main limitation, as the OOB framework requires the training algorithm to be a bagging method with weak learners. In many applications, bagging may not be the best-performing method, and data valuation under this method may not be of interest.\n\n(-) Typically, the number of randomly selected features for each weak learner is an important hyperparameter to fine-tune. What is the impact when the number of random features is small? While an ablation study was provided in Appendix, certain variation was still observed. Should we correspondingly update the bagging size? Some practical guidance would be helpful.\n\nQUESTIONS:\n1. What does fitting a logistic model in line 187 on page 6 mean? Why change from bagging decision trees to a logistic model in this specific cell fixation experiment?\n\n2. It would be helpful to further explain the difference between Trojan and BadNets trigger methods, as it seems that 2D-OOB is much more effective than 2D-KNN under the Trojan square. This would help us understand in which scenario 2D-OOB works better.\n\n3. Regarding the ablation study: I am also curious about the original prediction performance for each task, not just the outlier detection performance.\n\n4. What is the implication of the connection to data-OOB in Proposition 3.1? Are there any insights we can gain after establishing the connection with data-OOB?\n\nLIMITATIONS:\nNone", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-15"}

comments: SUMMARY:
This paper studies data valuation in a fine-grained fashion: determine helpful samples as well as the particular cells that drive them. The proposed method is tested with 12 datasets and has application in backdoor detection.

STRENGTHS:
- It makes sense to use cells rather than single data samples as the smallest unit for data valuation. 
- The proposed framework is clearly stated. 
- The backdoor trigger detection is an interesting and useful application of the proposed framework. 
- The proposed method is significantly more efficient than 2D-KNN.

WEAKNESSES:
- The proposed method seems to be a combination of existing algorithms 2D-KNN and Data-OOB. The novelty and contribution may be relatively marginal.

QUESTIONS:
Could you please discuss what are the *unique* challenges of 2D-OOB that do not arise for 2D-KNN and Data-OOB?

LIMITATIONS:
Yes.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-15