Title: Final-Model-Only Data Attribution with a Unifying View of Gradient-Based Methods
Venue: NeurIPS 2025
Accepted: yes
Keywords: training data attribution

influence functions

further training
Abstract: Training data attribution (TDA) is concerned with understanding model behavior in terms of the training data. This paper draws attention to the common setting where one has access only to the final trained model, and not the training algorithm or intermediate information from training. We reframe the problem in this "final-model-only" setting as one of measuring sensitivity of the model to training instances. To operationalize this reframing, we propose *further training*, with appropriate adjustment and averaging, as a gold standard method to measure sensitivity. We then unify existing gradient-based methods for TDA by showing that they all approximate the further training gold standard in different ways. We investigate empirically the quality of these gradient-based approximations to further training, for tabular, image, and text datasets and models. We find that the approximation quality of first-order methods is sometimes high but decays with the amount of further training. In contrast, the approximations given by influence function methods are more stable but surprisingly lower in quality.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the Final-Model-Only (FiMO) setting for training data attribution (TDA), in which only a trained model’s weights are available. The authors introduce a gold-standard based on “further-training” sensitivity, which trains the final checkpoint on (a) the full dataset and (b) the dataset with one example removed, then measures the resulting change in a test loss or prediction, averaged over multiple random restarts. The author show that this gold-standard recovers first-order and second-order TDA scores. Empirically, they compare these classic TDA methods against the gold-standard on different benchmarks.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n\n- Theoretical unification:\nShows that Influence Functions, TracIn, gradient‐dot/cos, etc., serve as Taylor approximations of further training.\n\n- Novel scenario:\nThe paper claims they are the first to consider the FiMO setting. And the golden standard, which is the further training, makes sense.\n\n## Weakness\n\n- The training and testing data size seem to be too small to draw insightful and consistent conclusion.\n- Although the setting is claimed to be new, it is actually just a variation of saying \"re-training is so expensive and we can't compute gradients\". So literature like [1] implicitly already discusses similar situation. There is also work [4] utilizing \"unlearning\" as TDA, which also resemble your core idea.\n- In terms of further training, works like [2] also discuss the possibility of \"further LoRA fine-tuning as TDA\". Although they did use gradient information, the idea is similar in some sense. The ensemble idea they propose also match the expected value notation in equation (3).\n- Looking at Figure 2, I will be hesitate to claim the cosine similarity between these baseline TDA methods and their further training counterparts are actually similar...Especially the setting is more complex like (e)(f). The curves in Figure 5 are even harder to explain.\n\n\n\n[1] Ko, Myeongseob, et al. \"The mirrored influence hypothesis: Efficient data influence estimation by harnessing forward passes.\" \nProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.\n\n[2] Deng, Junwei, et al. \"Efficient ensembles improve training data attribution.\" arXiv preprint arXiv:2405.17293 (2024).\n\n[3] Park, Sung Min, et al. \"Trak: Attributing model behavior at scale.\" arXiv preprint arXiv:2303.14186 (2023).\n\n[4] Wang, Sheng-Yu, et al. \"Data attribution for text-to-image models by unlearning synthesized images.\" Advances in Neural Information Processing Systems 37 (2024): 4235-4266.\n\n[5] Choi, Woosung, et al. \"Large-Scale Training Data Attribution for Music Generative Models via Unlearning.\" arXiv preprint arXiv:2506.18312 (2025).\n\nQUESTIONS:\n- Apart from cosine similarity, could you also consider correlation coefficient or other measure to give us a more comprehensive view comparing between further training and those gradient-based baselines?\n- Just to make sure, is the very original IF already within the so-called FiMO setting?\n- For the low quality of the gradient-based approximation, it can just because the approximation is not good. Under this setting, we might also need to assume the further training objective is not deviating form the original one too far, which is usually hard to justify in real world. Will it be interesting to just \"come up with a good enough further training obj\" for better attribution?\n- How does the damping term in second-order method affect the quality of attribution?\n- Is there any experiment on generation settings?\n- Conceptually, how different it is between your further training and the \"two-stage retraining\" introduced in [1]?\n\n\n\n[1] Bae, Juhan, et al. \"If influence functions are the answer, then what is the question?.\" Advances in Neural Information Processing Systems 35 (2022): 17953-17967.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 1, "DATE": "2025-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes \"further training\" as a new evaluation measure (or golden standard) for training data attribution (TDA) methods in the \"final-model-only\" (FiMO) setting, where practitioners only have access to trained model weights rather than the full training process (e.g., intermediate checkpoints or training algorithm). The authors justify the proposed metric by showing that many existing TDA methods can be seen as approximations to \"further training\" through Taylor expansions around the final checkpoint. Across tabular, image, and text tasks, the authors demonstrate interesting trade-offs between different TDA methods: first-order methods (Grad-Dot, Grad-Cos) achieve high initial approximation quality but decay with increased further training, while second-order influence function methods (CG, LiSSA, EK-FAC) maintain more stable approximation quality over training steps but often underperform compared to first-order methods.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The paper is well-motivated and clearly written with a detailed problem formulation. All derivations in the main manuscript appear correct (I haven't read the appendix in detail, but skimmed through). \n- Experiments cover a wide range of tasks, and a detailed experimental setup is provided in the appendix.\n\nWeaknesses:\n- Although the authors clearly articulate the rationale for categorizing TDA into three settings (which I agree with), I don't agree that different settings require different gold standards. There are classes of algorithms more applicable to each setting (e.g., MAGIC [1] for TAA, TraceIn [2] for CPA, and Grad-Dot for FiMO), but the fundamental objective of data attribution stays the same: understanding which training examples led to particular model outputs. The natural ground truth for all data attribution should be retraining-based approaches. While \"further training\" can serve as a proxy metric (just like mislabeled data detection), TDA algorithms should ultimately be evaluated using retraining-based metrics. I am not convinced that \"further training\" should be treated as the gold standard in any setting. Why can't we evaluate different TDA algorithms in settings we have access to the entire training procedure, and use the SOTA method in TAA setup?\n- On a related note, it has been widely shown in the literature that influence function based approaches outperform first-order methods on several retraining-based evaluations [3, 4, 5]. If conclusions based on \"further training\" differ from retraining-based metrics, wouldn't this suggest \"further training\" might be capturing something other than what we want from data attribution?\n- Several experimental details require clarification. For instance, when leaving out a data point (line 1024), the authors subtract the loss on that point in each gradient update rather than removing it from the dataset entirely—this is quite different from further training without a data point and needs justification (or at least mention) in the main text. Additionally, second-order methods approximate further training under fixed regularization (as in the derivations authors provided), while further training is done without regularization.\n\nMinor:\n- Many important details are moved to the appendix without proper discussion in the main text. For example, the choice of cosine similarity as the evaluation metric (line 317) is not intuitive and needs explanation in the main text.\n- I'm not sure what the authors meant in line 865. Further training could change the solution even when at the model is optimal under a fixed dataset. The gradient of the empirical loss being 0 does not imply the gradients is 0 for all individual data points.\n\n[1] Ilyas, A., & Engstrom, L. (2025). MAGIC: Near-Optimal Data Attribution for Deep Learning. arXiv preprint arXiv:2504.16430.\n[2] Pruthi, Garima, et al. \"Estimating training data influence by tracing gradient descent.\" Advances in Neural Information Processing Systems 33 (2020): 19920-19930.\n[3] Park, Sung Min, et al. \"Trak: Attributing model behavior at scale.\" arXiv preprint arXiv:2303.14186 (2023).\n[4] Bae, Juhan, et al. \"Training data attribution via approximate unrolled differentiation.\" arXiv preprint arXiv:2405.12186 (2024).\n[5] Deng, Junwei, et al. \"Efficient ensembles improve training data attribution.\" arXiv preprint arXiv:2405.17293 (2024).\n\nQUESTIONS:\nPlease see the weakness section above for my questions and suggestions. The most unconvincing aspect of this paper is that the conclusions drawn from further training differ significantly from those obtained when methods are evaluated under retraining-based approaches. Given this discrepancy, I am not convinced that further training should be treated as a gold standard for data attribution.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 1, "ORIGINALITY": 2, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe work is focused on the problem of training data attribution where only final trained models are considered for analysis. To measure the sensitivity of the models, further training with appropriate adjustment and averaging are proposed. Gradient-based methods are unified for TDA to show that all these methods approximate the further training gold standard in different ways. This is done through first and second-order Taylor expansions around $\\theta_f$. The problem is set clearly to create notations and build onto the attribution/influence scores $a_i$ to be assigned to the training instance $z_i$. Three problem settings are considered: a) Training Algorithm Available (TAA) -- access to the training algorithm A, b) Checkpoints Available(CPA) -- no access to A but access to intermediate checkpoints available and c) Final Model Only (FiMO) -- only access to final model. This work focuses on FiMO. This is the main contribution -- providing a further training gold standard for FiMO for the leave-one-out (LOO) case.  Particularly, issues of non-convergence (tackled by adjusted computation of sensitivity to the presence of example $z_i$ -- Figure 1) and stochasticity (tackled by averaging over seeds) have been mentioned. The gradient-based methods are then unified as approximate further training, first-order methods (GradDot), Influence function methods and Gauss-Newton approximate hessian based methods are unified. Relationships with existing influence function methods are also discussed. Finally, experiments are conducted to produce two main insights -- a) approximation quality of first-order methods decays with the amount of further training and b) approximations given by influence function based approaches are more stable but lower in quality.\n\nSTRENGTHS AND WEAKNESSES:\n- Strengths\n  - [**Positioning**]: The paper is positioned well amongst the TDA literature and provides contextual explanations of it's proposed approaches placing them precisely in the current literature.\n  - [**Unification**]: From a reader's perspective, the manuscript does a good job of providing a unifying view of gradient based methods commonly used in the influence literature. \n  - [**Analyses**]: Extensive analysis is conducted to support the theoretical studies. This study provides the first practical FiMO benchmark.\n\n- Weakness\n  - [**Computational Time**]: The experiments took about 3000 GPU hours (Appendix E) on (relatively) small CNN and BERT models. The Appendix F mentions this and suggestions are made to reduce the number of seeds or using parameter efficient approaches like LoRA. However, the effects of LoRA have been left for future work and that would still not address the problem of computational time for widespread and meaningful adoption. \n  - [**Scope**]: The empirical studies on non-tabular datasets have low cosine similarity on all methods. The findings on tabular datasets are not reflected in the non-tabular datasets. For instance, Figure (e) CIFAR-10 shows significantly higher cosine similarity for Grad-Cos over Grad-Dot as opposed to the findings on tabular datasets. It's mentioned that the gold attribution vectors $a$ behave differently for non-tabular datasets. Lines 1140-1153 in Appendix E.1 discuss this issue but this poor approximation quality is still a weakness in non-tabular domain.\n\nQUESTIONS:\n- [**Minor Comments**]: From line 87-90, it's argued that FiMO is applicable to scenarios with TAA and CPA settings. While, this is true, the increased access in these cases may be able to provide deeper insights?  The lines 87-88 are reasonable but there could be a significant number of cases where TAA and CPA are available. The details on some limitations of FiMO analysis that can be overcome in TAA or CPA settings could perhaps be mentioned briefly.\n- [**Number of Random Seeds**]: Figures 3(b) and 7(f)  show the impact of number of random seeds averaged on the maximum cosine similarity for the SST-2 dataset -- the general suggestion is that a lower number of random seeds (10-20) can be used as the highest impact is seen there. However, in these cases, DataInf seems to be benefitting from multiple seeds. This is explained in the Appendix. However, this adds to the computations. A clarification on the following two points will be useful -- (i) why DataInf is uniquely sensitive, and (ii) whether the steadily rising curve is worth the extra compute cost.\n- [**Pseudocode/Implementation**]: If there are some institutional constraints on sharing the code, it may be good to provide some example pseudocode for reproducibility.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper focuses on training data attribution methods specifically in FiMO setting, where only the final model is available and neither the model checkpoints nor the training algorithm is accessible to the attribution method. They first define a taxonomy of TDA methods based on their access to different resources of the model. Then they define further training as the gold standard in TDA. This method works by training an already-trained model with different variations of the dataset generated by the leave-one-out technique. Authors further show that various attribution techniques, in fact, approximates the further training method. Experiments that were run on tabular, image, and text datasets show first-order gradient-based techniques approximate further training well, but decay over extended further training.\n\nSTRENGTHS AND WEAKNESSES:\n## Overall Review\nExplicit definition of FiMO setting and the proposal of further training as a gold standard are timely and sound contributions. Authors connecting multiple well-known TDA techniques is a valuable theoretical framework and highlights the significance of this work in the model interpretability domain. \n\n## Strengths\n* The explicit formalization of the FiMO setting and the proposal of \"further training\" as gold standard are novel contributions. \n* Acknowledging and addressing challenges like non-convergence and stochasticity in NN training enhances the practical relevance of the gold standard.\n* Theoretical unification of first-order methods like Grad-Dot and influence function methods like CG, LiSSA, TRAK, and DataInf is very valuable.\n* Reasonable empirical evaluations. \n* Authors do a great job in challenging many assumptions subtly made in other papers such as \"we do not assume that the empirical risk $R(D', θ)$ is convex, nor do we assume that the given parameters $θ_f$ are a stationary point of $R(D, θ)$ over the full training set D.\"\n* The paper has a solid theoretical foundation.\n\n## Weaknesses\n* While somewhat orthogonal to the idea, authors fail to properly address dataset issues such as duplicate or high-correlated data especially for $D'$ with LOO methodology. \n* While the paper explicitly mentions the cost, this method is extremely expensive nonetheless -- making it impractical for most users. This is the main reason why I am not voting Strong Accept.\n* Lastly, although it is an artifact of the FiMO setting, sensitivity *after* having trained the model might not fully capture the real impact of the training example as the model may have saturated for that input already.\n\n## Clarity\nThe paper is well-written and structured. The concepts, notations, and proofs are clear.\n\n## Originality\nFiMO framework formulation and further training with expectations over randomness are original contributions.\n\nQUESTIONS:\n* What's the dependency on the further training algorithm? What if the employed learning is really detrimental to the model?\n* What would be the right amount of further training? Can there be a generalized guidance based on empirical evidence?\n\nLIMITATIONS:\nAuthors do a great job in discussing the limitations in cost, convexity, stochasticity.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-07-03"}