2D-OOB: Attributing Data Contribution Through Joint Valuation Framework

Authors: yifan  sun
jingyan  shen
yongchan  kwon
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-12 22:40:25

Abstract: Data valuation has emerged as a powerful framework for quantifying each datum's contribution to the training of a machine learning model. However, it is crucial to recognize that the quality of cells within a single data point can vary greatly in practice. For example, even in the case of an abnormal data point, not all cells are necessarily noisy. The single scalar score assigned by existing data valuation methods blurs the distinction between noisy and clean cells of a data point, making it challenging to interpret the data values. In this paper, we propose 2D-OOB, an out-of-bag estimation framework for jointly determining helpful (or detrimental) samples as well as the particular cells that drive them. Our comprehensive experiments demonstrate that 2D-OOB achieves state-of-the-art performance across multiple use cases while being exponentially faster. Specifically, 2D-OOB shows promising results in detecting and rectifying fine-grained outliers at the cell level, and localizing backdoor triggers in data poisoning attacks.

Main paper: 
 introduction: 
 From customer behavior prediction and medical image analysis to autonomous driving and policy making, machine learning (ML) systems process ever increasing amounts of data. In such data-rich regimes, a fraction of the samples is often noisy, incorrect annotations are likely to occur, and uniform data quality standards become difficult to enforce. To address these challenges, data valuation emerges as a research field receiving increasing attention, focusing on properly assessing the contribution of each datum to ML training [12, 24] . These methods have proven useful in identifying low-quality samples that can be detrimental to model performance, as well as selecting subsets of data that are representative of enhanced model performance [50, 28, 47] . Furthermore, they are widely applicable in data marketplace for fair revenue allocation and incentive design [53, 46, 41] .Nevertheless, existing data valuation methods assign a scalar score to each datum, thereby failing to account for the varied roles of individual cells. This leaves the valuation rationale unclear and can be unsatisfactory and sub-optimal in various practical scenarios. Firstly, whenever a score is assigned to a data point by a particular data valuation method, it is crucial to understand the underlying justifications to ensure transparency and reliability, especially in high-stakes decision making [40] . Secondly, it is important to recognize the fact that even if a data point is of low quality, it is rarely the case that all the cells within this data point are noisy [38, 27, 44] . The absence of detailed insights Both panels illustrate the same hypothetical dataset, while darker colors indicate higher quality or importance. As illustrated in panel (a), data valuation can only identify that the third and fifth data points are of low quality, but it lacks further feature-level attribution. This limitation may result in discarding the entire data point, even when only certain cells are problematic. In contrast, joint valuation provides a finer level of attribution than data valuation and aims to reveal how individual features contribute to data values. As shown in panel (b), the joint valuation framework can identify outlier cells (highlighted by blue boxes), such as -1 in "Income" and 100 in "Education", providing detailed interpretations of data values.into how individual cells contribute to ML training inevitably leads to discarding the entire data point. This can result in substantial data waste, particularly when only a few cells are noisy and data acquisition is expensive. Finally, in data markets, different cells within a data point may originate from different data sellers [3, 10] . Consequently, a singular valuation for the entire point fails to offer equitable compensation to all contributing parties.Our contributions In this paper, we propose 2D-OOB, a powerful and efficient joint valuation framework that can attribute a data point's value to its features. 2D-OOB quantifies the importance of each cell in a dataset, as illustrated in Figure 1 , providing interpretable insights into which cells are associated with influential data points. Our method is computationally efficient as well as theoretically supported by its connections with Data-OOB [24] . Moreover, our extensive empirical experiments demonstrate the practical effectiveness of 2D-OOB in various use cases. 2D-OOB accurately identifies cell outliers and pinpoints which cells to fix to improve model performance. Additionally, 2D-OOB enables inspection of data poisoning attacks by precisely localizing the backdoor trigger, an artifact inserted into a training sample to induce malicious model behavior [13, 5] . On average, 2D-OOB is 200 times faster than state-of-the-art methods across all datasets examined.Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?Answer: [Yes] Justification: The paper's contributions have been clearly stated in the abstract and section 1.Guidelines:• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 
preliminaries: 
 Notations Throughout this paper, we focus on supervised learning settings. For d ∈ N, we denote an input space and an output space by X ⊆ R d and Y ⊆ R, respectively. We denote a training dataset with n data points by D = {(x i , y i )} n i=1 where (x i , y i ) is the i-th pair of the input covariates x i ∈ X and its output label y i ∈ Y. For an event A, an indicator function 1(A) is 1 if A is true, otherwise 0. For j ∈ N, we set [j] := {1, . . . , j}. For a set S, we denote its power set by 2 S and its cardinality by |S|.DataShapley The primary goal of data valuation is to quantify the contribution of individual data points to a model's performance. Leveraging the Shapley value in cooperative game theory [39] , DataShapley [12] measures the average change in a utility function U : 2 D → R over all possible subsets of the dataset that either include or exclude the data point. For i ∈ [n], DataShapley of i-th datum is defined as follows.EQUATIONwhere D k and computes the average difference in utility U (S ∪ {(x i , y i )}) -U (S). It characterizes the impact of a data point, but its computation requires evaluating U for all possible subsets of D, rendering precise calculations infeasible. Many efficient computation algorithms have been proposed [15, 26, 52] , and in these studies, Shapley-based methods have demonstrated better effectiveness in detecting low-quality samples than standard attribution approaches, such as leave-one-out and influence function methods [20, 9] .Data-OOB As an alternative efficient data valuation method, Kwon and Zou [24] propose Data-OOB, which leverages a bagging model and measures the similarity between the nominal label and weak learners' predictions. To be more specific, consider a bagging model consisting of B weak learners, where for b ∈ [B], the b-th weak learner ĥb is given as a minimizer of the weighted empirical risk,ĥb := argmin h n i=1 w bi ℓ(y i , h(x i )),where ℓ : Y × Y → R is a loss function and w bi ∈ N is the number of times the i-th datum (x i , y i ) is selected by the b-th bootstrap dataset. Let w b be a weight vector w b := (w b1 , . . . , w bn ) for all b ∈ [B]. For i ∈ [n] and {(w b , ĥb )} B b=1 , Data-OOB of the i-th datum is defined as follows.EQUATIONwhere T (y i , ĥb (x i )) is a score function evaluated at (x i , y i ). We assume that the higher T , the better the prediction. In classification settings, a common choice for T is 1(y i = ĥb (x i )), and in this case, Data-OOB ϕ OOB i measures the average similarity between a nominal label y i and weak learners' predictions ĥb (x i ) when a datum (x i , y i ) is not sampled in a bootstrap dataset. It intuitively captures the quality of a data point. For instance, when (x i , y i ) is a mislabeled sample or an outlier, the label y i is likely to differ from ĥb (x i ), resulting in ϕ OOB i being close to zero.It is noteworthy that Data-OOB in (2) can be computed by training a single bagging model, making it computationally efficient. Kwon and Zou [24] show that Data-OOB can easily scale to millions of data points, but for DataShapley this is often very impractical. In addition, Data-OOB is typically comparable to or even more effective than DataShapley in detecting mislabeled data points and selecting helpful data points [24, 16] .Question: Does the paper discuss the limitations of the work performed by the authors?Answer: [Yes]Justification: The paper has included discussion about limitations in section 6.Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
attributing data contribution through joint valuation framework: 
 Data valuation quantifies the utility of data points, however, it fails to identify which features contribute to these data values and to what extent. For instance, in anomaly detection tasks, data valuation methods can be deployed to detect anomalous data points but cannot explain why they are considered abnormal, which is generally not desirable in practice. To address this challenge, we introduce a joint valuation framework that assigns a cell score to each feature of a data point. Here, a cell score is designed to quantify how each feature affects the value of an individual data point, thereby attributing the data value to specific features.To the best of the author's knowledge, Liu et al. [30] were the first to consider the concept of joint valuation in the literature, proposing 2D-Shapley as a means to quantitatively interpret DataShapley.To formalize this, we denote a 2D utility function by u : [n] × [d] → R, which takes as input a subset of data points S ⊆ [n] and a subset of features F ⊆ [d], measuring the utility of a fragment of the given dataset consisting of cells {(i, j)} i∈S,j∈F , where a tuple (i, j) denotes a cell at the i-th datum and the j-th column. Then, 2D-Shapley is defined asEQUATIONwhereD (i,j) k,l := {(S, F )|S ⊆ [n]\{i}, F ⊆ [d]\{j}, |S| = k -1, |F | = l -1} and M i,j u (S, F ) = u(S ∪ {i}, F ∪ {j}) + u(S, F ) -u(S ∪ {i}, F ) -u(S, F ∪ {j}).The function M i,j u allows us to quantify how much removing a specific cell at (i, j) from a given set (S ∪ {i}, F ∪ {j}) affects the overall utility, and 2D-Shapley ψ 2D-Shap ij evaluates the average M i,j u across all possible data fragments (S, F ) ∈ D (i,j) k,l . Similar to DataShapley, the permutation of all rows and columns required for exact 2D-Shapley calculations presents significant computational challenges. To address this, Liu et al. [30] develop 2D-KNN, which utilizes k-nearest-neighbors models as surrogates to approximate 2D-Shapley values. However, the approximation methods can compromise the accuracy of valuations [24, 16] . Additionally, 2D-KNN still faces challenges scaling to large-scale datasets and high-dimensional settings.To address these limitations, we propose 2D-OOB, an efficient and model-agnostic joint valuation framework that leverages out-of-bag estimation to attribute data contribution. We also illustrate how 2D-OOB is connected to Data-OOB, thereby facilitating sample-wise feature-level interpretation for data valuation, as discussed in Section 3.2.Our idea builds upon the subset bagging model [14] , which is well recognized as an earlier version of Breiman's random forest model [4] . A key distinction from a standard bagging model is that a weak learner in a subset bagging model is trained on a randomly selected subset of features. For b ∈ [B], we denote the b-th random feature subset by S b ⊆ [d]. Then, the b-th weak learner of a subset bagging model is given as follows.fb := argmin f n i=1 w bi ℓ(y i , f (x i,S b )),where x i,S b is a subvector of x i that only takes elements in a subset S b . This difference enables us to assess the impact of which features are more influential: if S b includes a helpful (or detrimental) feature, we can expect the out-of-bag prediction f (x i,S b ) to be good (or poor). We formalize this intuition and propose 2D-OOB.For i ∈ [n], j ∈ [d] and {(w b , S b , fb )} Bb=1 , the 2D-OOB for the j-th cell of the i-th data point is defined as follows,EQUATIONwhere T : Y × Y → R is a utility function that scores the performance of the weak learner fb (x i,S b ) on the i-th datum (x i , y i ). Specifically, for binary or multi-class classification problems, we can adopt T (y i , fb (x i,S b )) = 1(y i = fb (x i,S b )). In this case, 2D-OOB measures the average accuracy score of out-of-bag predictions (specifically, when the i-th data point is out-of-bag) if the j-th feature is used in training fb . For regression problems, we can use the negative squared error loss function, defined asT (y i , fb (x i,S b )) = -(y i -fb (x i,S b )) 2 .In practice, X could also be incorporated into T to suit the specific use case.While Data-OOB in (2) aims to assess the impact of the i-th datum, 2D-OOB in (4) further provides interpretable insights by evaluating the data point with various combinations of features, revealing which cells are influential to model performance. By leveraging the subset bagging scheme, 2D-OOB only requires a single training of the bagging model, making it computationally efficient.We now present interpretable expressions of how 2D-OOB connects to Data-OOB in the following proposition. To begin with, we denote a set of subsets of ψ 2D-OOB ij = E FS [ϕ OOB i (S) | j ∈ S],where FS is an empirical distribution with respect to S induced by the sampling process.A proof is given in Appendix C. Proposition 3.1 shows that 2D-OOB ψ 2D-OOB ij can be expressed as a conditional empirical expectation of Data-OOB provided that the j-th feature is used in Data-OOB computation. It provides intuitive interpretations: for a fixed i and j ̸ = k, ψ 2D-OOB ij > ψ 2D-OOB ik implies that the cell x ij is more helpful to achieve a higher OOB score than the cell x ik , where the OOB score serves as an indicator of model performance. By distinguishing the contributions of individual cells, 2D-OOB effectively realizes joint valuation, providing a finer granularity of analysis that links feature-level importance to individual data quality.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?Answer • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 
experiments: 
 In this section, we empirically show the effectiveness of 2D-OOB across multiple use cases of the joint valuation: cell-level outlier detection, cell fixation, and backdoor trigger detection. To the best of our knowledge, the latter two use cases are introduced here for the first time within the joint valuation framework. As a summary, 2D-OOB can precisely identify anomalous cells that should be prioritized for examination and subsequent fixation to improve model performance. In the context of backdoor trigger detection, 2D-OOB demonstrates its efficacy by accurately identifying different types of triggers within poisoned data, showcasing its proficiency in detecting non-random, targeted anomalies. Our method also exhibits high computational efficiency through run-time comparison. Throughout all of our experiments, 2D-OOB uses a subset bagging model with B = 1000 decision trees. We randomly select a fixed ratio of features to build each decision tree. Unless otherwise specified, we utilize half of the features for each weak learner and setT (y i , f (x i,S b )) = 1(y i = f (x i,S b )).The run time is measured on a single Intel Xeon Gold 6226 2.9 GHz CPU processor. We provide a detailed ablation study of key hyperparameters in Section 4.4.Experimental setting In practical situations, even when dealing with abnormal data points, it is not always the case that all cells are noisy [38, 30, 21] . To simulate more realistic settings, we introduce noise to certain cells in the following two-step process: First, we randomly select 20% rows for each dataset. We then select 20% columns uniformly at random, allowing each selected row to have a different set of perturbed cells. We inject noises sampled from the low-probability region into these cells, following Du et al. [8] and Liu et al. [30] . Details on the outlier injection process can be found in Appendix A.3.We use 12 publicly accessible binary classification datasets from OpenML, encompassing a range of both low and high-dimensional datasets, which have been widely used in the literature [12, 23, 24] . Details on these datasets are presented in Appendix A.1. For each dataset, 1000 and 3000 data points are randomly sampled for training and test datasets, respectively. For the baseline method, we consider 2D-KNN, a fast and performant variant of 2D-Shapley [30] . We incorporate a distance regularization term in the utility function T for enhanced performance.We calculate the valuations for each cell using our joint valuation framework. Ideally, the outlier cells should receive a low valuation. We then arrange the cell valuations in ascending order and inspect those cells with the lowest values first.The detection rate curve of inserted outlier is shown in Figure 2 . For all datasets, 2D-OOB successfully identifies over 90% of the outlier cells by inspecting only 30% of the bottom cells. In comparison, 2D-KNN requires examining nearly 90% of the cells to achieve the same detection level.We also evaluate the area under the curve (AUC) as a quantitative metric and measure the run-time. As Table 1 shows, 2D-OOB achieves an average AUC of 0.83 across 12 datasets, compared to 0.67 for 2D-KNN, while being significantly faster. For high-dimensional datasets such as the musk dataset, which comprises 166 features, 2D-KNN would take more than an hour to process, while 2D-OOB can finish in seconds. Furthermore, we present additional results on multi-class classification datasets in Appendix B.1, demonstrating the consistently superior performance and efficiency of 2D-OOB. Experimental setting A naive strategy to handle cell-level outliers is to eliminate data points that contain outliers. This method, however, risks substantial data loss, particularly when outliers are scattered and data points are costly to collect. We instead consider a cell fixation experiment, where we assume that the ground-truth annotations of outlier cells can be restored with external expert knowledge. At each step, we "fix" a certain number of cells by substituting them with their ground-truth annotations, prioritizing cells that have the lowest valuations. Then we fit a logistic model 3 and evaluate the model's performance with a test set of 3000 samples. It is important to note that correcting normal cells has no effect, whereas fixing outlier cells is expected to enhance the model's performance. We adopt the same datasets and implementations as in Section 4.1. We replace cells with their ground-truth annotations, starting with those cells assigned the lowest valuations. The results for 6 datasets are presented, and additional results for other datasets are available in Appendix B.2. We conduct 30 independent trials and report the average results. A higher curve indicates better performance. 2D-OOB demonstrates a superior capability in accurately identifying and rectifying cell-level outliers. Results Figure 3 illustrates the anticipated trend in the performance of 2D-OOB, validating our method's capability to accurately identify and prioritize the most impactful outliers for correction. As cells with the lowest valuations are progressively fixed, 2D-OOB demonstrates a consistent improvement in model accuracy. In contrast, when applying the same procedure with 2D-KNN, such notable performance enhancements are not observed.Additionally, we investigate a scenario where ground-truth annotations remain unavailable. We adopt the setup from Liu et al. [30] , where we replace the outlier cells with the average of other cells in the same feature column. 2D-OOB uniformly demonstrates significant superiority over its counterparts. Results are provided in Appendix B.2.A common strategy of data poisoning attacks involves inserting a predefined trigger (e.g., a specific pixel pattern in an image) into a subset of the training data [13, 5, 29] . These malicious manipulations can be challenging to detect as they only infect specific, targeted samples. Even when poisoned data are present, it could be difficult to discern the root cause of the attacks, since manually reviewing the images is expensive and time-consuming. In this experiment, we introduce a novel task enabled by the joint valuation framework: localizing backdoor triggers in data poisoning attacks. Distinct from the random outliers investigated previously, this type of cell contamination is targeted and deliberate. In the first two pairs, the class 'bird" is relabeled as "cat", while in the latter two pairs, the class "deer" is relabeled as "cat". The heatmaps clearly show that higher cell valuations are predominantly concentrated in the regions containing triggers, while areas featuring actual objects receive lower valuations. This pattern suggests that 2D-OOB effectively captures the triggers as the impactful features responsible for the misclassification of the poisoned samples.We consider two popular backdoor attack algorithms: BadNets [13] and Trojan Attack [29] We conduct ablation studies on the cell-level outlier detection task, as outlined in Section 4.1, to examine the impact of key hyperparameters on 2D-OOB estimations, including the selection and number of weak learners, as well as the feature subset ratio.Selection of weak learners Although our study primarily employs decision trees as weak learners, it is important to note that 2D-OOB is model-agnostic, enabling the use of any class of machine learning models as weak learners. Specifically, we examine decision trees, logistic regression, a single-layer MLP with 64 units, and a two-layer MLP with 64 and 32 units, respectively, as weak learners to compare their performance. valuation results, with more complex models generally yielding better performance. Nonetheless, all variations of 2D-OOB outperform 2D-KNN, highlighting the clear advantages of the 2D-OOB approach.Increasing the number of weak learners allows for a greater number of data-feature subset pairs to be explored, potentially leading to more accurate estimates. However, as shown in Table 3a , when we increase the number of base learners from 500 to 3000, the detection AUC for each dataset remains relatively unchanged, suggesting convergence of the estimation beyond a certain threshold. Typically, 1000 base learners are sufficient to achieve an equitable joint valuation.Feature subset ratio K/d The feature subset ratio K/d refers to the fraction of the total number of features d that are randomly selected to build each weak learner, where K is the number of selected features. In previous experiments, we used a fixed ratio of 0.50 (unless otherwise specified). To further investigate the impact of this ratio, we now test two additional values: 0.25 and 0.75. The results in Table 3b suggest that in general, the joint valuation capacity of our method is robust to the choice of feature subset ratio.Apart from the experiments discussed above, we showcase that marginalization of 2D-OOB can either match or surpass state-of-the-art data valuation methods on standard benchmarks in Appendix D. 
related work: 
 Data contribution estimation In addition to the marginal contribution-based methods discussed in Section 2, many other approaches are emerging in the area of data valuation. Just et al. [18] develop a non-conventional class-wise Wasserstein distance between the training and validation sets and use the gradient information to evaluate each data point. Wu et al. [49] extend data valuation to deep neural networks, introducing a training-free data valuation framework based on neural tangent kernel theory. Yoon et al. [50] leverage reinforcement learning techniques to automatically learn data valuation scores by training a regression model. However, all these data valuation methods do not assign importance scores to cells, whereas our method provides additional insights into how individual cells contribute to the data valuations.Feature attribution Feature attribution is a pivotal research domain in explainable machine learning that primarily aims to provide insights into how individual features influence model predictions.Various effective methods have been proposed, including SHAP-based explanation [31, 32, 25, 7, 6] , counterfactual explanation [45, 17, 37, 33, 34] , and backpropagation-based explanation [1, 2, 43, 42, 51] . Among these methods, the SHAP-based explanation stands out as the most widely adopted approach, utilizing cooperative game theory principles to compute the Shapley value [39] . While feature attribution offers a potential method to attribute data valuation scores across individual cells, our empirical experiments in Appendix B.1 reveal that this two-stage scheme falls short in efficacy compared to our proposed joint valuation paradigm, which integrates data valuation and feature attribution in a simultaneous process. 
conclusion: 
 We propose 2D-OOB, an efficient joint valuation framework that assigns a score to each cell in a dataset, thereby facilitating finer attribution of data contributions and enabling a deeper understanding of the dataset. Through comprehensive experiments, we show that 2D-OOB is computationally efficient and competitive over state-of-the-art methods in multiple joint valuation use cases.Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?Answer: [Yes]Justification: Experiment settings have been clearly stated in section 4 and Appendix A.Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [Yes]Justification: The paper reports error bars for all experiment results.Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors).• It should be clear whether the error bar is the standard deviation or the standard error of the mean. • It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. • For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates). • If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 
experiments compute resources: 
 Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?Answer: [Yes]Justification: The paper provides information on compute resources in section 4.Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA] Justification: The paper poses no such risks.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: Please refer to Appendix A for dataset citations.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. 
 
 Appendix: We emphasize that the primary objective of the joint valuation framework is to evaluate the quality of cells within the dataset, rather than to optimize model performance. The model used serves as a proxy for this evaluation, and it is important to note that a high-performing machine learning method does not necessarily ensure a justified valuation framework.Limitation and future work While our study primarily explores random forest models applied to tabular datasets and simple image datasets, the potential application of neural network models within the 2D-OOB framework for more complex vision and language tasks presents a promising avenue for future investigation. For instance, in text datasets, tokens or words can be treated as cells. 2D-OOB can be easily integrated into any bagging training scheme that uses language models.Overall, we believe that our work will inspire further exploration in the field of joint valuation, with the broader goal of improving the transparency and interpretability of machine learning, as well as developing an equitable incentive mechanism for data sharing.pretrained ResNet-18 model on the CIFAR-10 dataset and employ the implementation in Pang et al. [36] . For each attack, we evaluate its effectiveness by training a decision tree model on the poisoned dataset. The accuracy on a clean test set remains nearly unchanged compared to a model trained on an uncontaminated training set, while the attack success rate on a held-out poisoned test set is guaranteed to exceed 75%. We conducted cell-level outlier detection experiments (as described in Section 4.1) on three multi-class classification datasets from the UCI Machine Learning repository [19] . As shown in the Table 5 , 2D-OOB displays superior detection performance and efficiency. Additional baseline: two-stage attribution Once we obtain the data valuation scores, an alternative solution approach to determining cell-level attributions involves leveraging feature attribution methods such as SHAP [31] . We explore an additional baseline method building upon this idea: initially, Data-OOB (or any other data valuation method) is computed for the i-th data point, denoted as dv i . Subsequently, TreeSHAP [32] is fitted, using dv i as the target and the concatenation of x i and y i (denoted as x i ⊕ y i ) as the predictor. The derived local feature attributions are then interpreted as joint valuation results. We refer to this method as "two-stage attribution".Table 6 indicates that 2D-OOB substantially outperforms its two-stage counterpart. We hypothesize that the superiority of our method stems from integrating data valuation and feature attribution into a cohesive framework. Conversely, the two-stage method treats data valuation and feature attribution as separate processes, potentially resulting in sub-optimal outcomes. Furthermore, due to the computational complexity of TreeSHAP, the two-stage approach is notably slower compared to our method. A noisy setting with more outlier cells We consider a more challenging scenario with increased outlier levels, where both the row outlier ratio and column outlier ratio increase from 20% (as in Section 4.1) to 50%. Consequently, this leads to 25% (50% × 50%) of the cells being replaced with outlier values. We follow the same outlier generation procedure outlined in Appendix A.3. The findings, presented in Table 7 , demonstrate that our method maintains a significantly superior performance over 2D-KNN, even under such a noisy setting.Figure 6 presents the results for the cell fixation experiment on 6 additional datasets. 2D-OOB excels in precisely detecting and correcting relevant cell outliers.The scenario without ground-truth knowledge Following Liu et al. [30] , we examine a situation where external information on the ground-truth annotations of outlier cells is not accessible. In this scenario, we address these outliers by substituting them with the average of other cells in the same feature column. This procedure starts by addressing cells with the lowest valuations, based on the hypothesis that correcting these cells is likely to maintain or potentially improve the model's performance. As depicted in Figure 7 , 2D-OOB conforms to this expected trend, demonstrating the We replace cell values with ground-truth values from the cells with the lowest valuation to the highest valuation. The results from 6 additional datasets are displayed. We conduct 30 independent trials and report the average results. A higher curve indicates better performance. 2D-OOB sets itself apart by its remarkable precision in detecting and rectifying relevant cell outliers. We replace cell values with column mean imputations from cells with the lowest value to the highest value. We report the average results of 30 independent trials from 12 datasets. A higher curve indicates better performance. effectiveness of our method in joint valuation. Conversely, 2D-KNN fails to show similar performance improvements.We provide additional qualitative examples of the backdoor trigger detection experiment in Figure 8 . The first two images are from the class "airplane" but have been relabeled as "automobile", while the latter two images are from the class "frog" and have been relabeled as "horse".Proof. For simplicity, we denote ϕ OOB ϕ i (S l ) = B b=1 1(w bi = 0)1(γ bl = 1)T (y i , fb (x i,S l )) B b=1 1(w bi = 0)1(γ bl = 1).With slight abuse of notation, the formulation of 2D-OOB in (4) can be expressed as follows.ψ ij = L l=1 B b=1 1(w bi = 0)1(γ bl = 1)1(j ∈ S l )T (y i , fb (x i,S l )) L l=1 B b=1 1(w bi = 0)1(γ bl = 1)1(j ∈ S l ) = L l=1 1(j ∈ S l ) B b=1 1(w bi = 0)1(γ bl = 1)T (y i , fb (x i,S l )) L l=1 B b=1 1(w bi = 0)1(γ bl = 1)1(j ∈ S l ) = L l=1 1(j ∈ S l ) B b=1 1(w bi = 0)1(γ bl = 1) L l=1 B b=1 1(w bi = 0)1(γ bl = 1)1(j ∈ S l ) B b=1 1(w bi = 0)1(γ bl = 1)T (y i , fb (x i,S l )) B b=1 1(w bi = 0)1(γ bl = 1) = L l=1 α i,j,l ϕ i (S l ),whereα i,j,l ∝ 1(j ∈ S l ) B b=1 1(w bi = 0)1(γ bl = 1), ∀i ∈ [n], j ∈ [d], l ∈ [L] and L l=1 α i,j,l = 1. Define P i (S l |j ∈ S l , {w bi } B b=1 ) = α i,j,l, which specifies an empirical distribution of the feature subset S, conditioned on j ∈ S and the bootstrap sampling process. Here, 1(j ∈ S l ) indicates that the distribution is conditioned on the inclusion of the j-th feature within the feature subset S l . w bi indicates whether the i-th sample is out-of-bag in the b-th bootstrap, and γ bl indicates whether the l-th feature subset is selected in the b-th weak learner. Thus, the point mass is determined by the sampling process, leading to:ψ ij = E FS [ϕ i (S) | j ∈ S].In this section, we show that 2D-OOB-data, the marginalization of 2D-OOB, offers an effective approach to data valuation. This serves as the basis of our enhanced performance in joint valuation.Marginalization 2D-OOB aims to attribute data contribution through cells. Consequently, by summing up 2D-OOB over all columns, we can derive data contribution values. For i ∈ [n], we define the 2D-OOB-data ψ data i as follows.EQUATIONBased on discussions in Section 3.2, the marginalizations also connect with Data-OOB: Proposition D.1. For all i ∈ [n], the marginalizations ψ data i can be expressed as follows.ψ data i = E FS [ϕ OOB i (S)],where the notations follow the same definitions as Proposition 3.1.Proof. Based on the definition of 2D-OOB-Data, for i ∈ [n],ψ data i := 1 d d j=1 ψ 2D-OOB ij = 1 d d j=1 L l=1 α i,j,l ϕ OOB i ) = L l=1 ( 1 d d j=1 α i,j,l )ϕ OOB i (S l ),where α i,j,l is defined in Appendix C. We haveL l=1 ( 1 d d j=1 α i,j,l ) = 1 d d j=1 L l=1 α i,j,l = 1. Denote P i (S l |{w bi } B b=1 ) = 1 d d j=1 α i,j,l, which induces the empirical expectation of Data-OOB with respect to S l . Proposition D.1 indicates 2D-OOB-data ψ data i can be expressed as the average Data-OOB value for the i-th data point. As a result, 2D-OOB-data is expected to inherit the advanced ability of Data-OOB in terms of data valuation, as will be empirically examined next.Experimental setting Following the standard protocol in Kwon and Zou [23, 24] and Jiang et al. [16] , we randomly select 10% of the data points and flip its label to the other class. For joint valuation methods, we calculate the valuation of each cell and perform the marginalization over features to obtain the data valuation scores. Mislabeled data detection and data removal experiments are examined based on this setting. For the baseline methods, we further incorporate several stateof-the-art data valuation methods including [12] , KNNShapley [15] , DataBanzhaf [48] , LAVA [18] , and Data-OOB [24] . Implementation details are listed below. To guarantee a fair comparison, we also employ the decision tree as the base model in DataShapley and DataBanzhaf. We adopt the same 12 datasets as outlined in Section 4.1.Data-OOB Data-OOB involves fitting a random forest model without feature subset sampling, consisting of 1000 decision trees.DataShapley We use a Monte Carlo-based algorithm. The Gelman-Rubin statistics is computed to determine the termination criteria of the algorithm. Following Jiang et al. [16] , We adopt the threshold to be 1.05.We set the number of nearest neighbors to be 10% of the sample size following Jia et al. [15] .LAVA We calculate the class-wise Wasserstein distance following Just et al. [18] . The "OTDD" framework is adopted to complete the optimal transport calculation.DataBanzhaf We adopt the implementation from Jiang et al. [16] . We set "the number of models to train" as 1000.We calculate the precision-recall curve by comparing the actual annotations, which denote whether data points are mislabeled, against the data valuation scores computed by different methods. Mislabeled data typically have a detrimental impact on model performance. Therefore, data points that receive a lower valuation score are considered to have a higher chance of being mislabeled. We then determine AUCPR (the AUC of the precision-recall curve) as a quantitative metric to assess the detection efficacy.As shown in Table 8 , 2D-OOB-data consistently outperforms 2D-KNN-data across all datasets, suggesting its superior ability to detect mislabeled data points. It is worth noting that 2D-OOB-data's results are on par with Data-OOB, while significantly exceeding the performance of other data valuation methods. These results are in line with our theoretical analysis regarding the resemblance between Data-OOB and 2D-OOB-data. However, it is important to highlight that applying Data-OOB to the joint tasks is not feasible as mentioned earlier, underscoring the necessity for the development of 2D-OOB.Removing low-quality data points has the potential to enhance model performance. Based on this idea, we employ the point removal experiment, a widely used benchmark in data valuation [24, 12, 23] . According to the calculated data valuation scores, we progressively remove data points from the dataset in ascending order. Specifically, we begin by removing the data points with the lowest data valuations. Each time we remove a datum, we fit a logistic model and use the held-out test set consisting of 3000 instances to evaluate the model performance. The expected behavior is that the model performance will improve initially as the detrimental data points are gradually eliminated from the training process. Removing an excessive number of data points may result in a drastically altered dataset. Consequently, we opt to remove the bottom 20% data points. Table 8 : Point-level mislabeled data detection results. AUCPR of different data valuation and (marginalized) joint valuation methods. The average and standard error of the AUCPR based on 30 independent experiments are denoted by "average ± standard error". Bold numbers denote the best method, for data valuation and joint valuation respectively. The AUCPR value for the Random method consistently remains at 0.5 across all datasets. 2D-OOB-data exhibits performance comparable to Data-OOB, while significantly surpassing 2D-KNN-data (the marginalization of 2D-KNN) and all other data valuation methods. Test accuracy curves throughout the data removal process are shown for 12 datasets (Figure 9 ). A higher curve signifies better performance in terms of data valuation. Overall, 2D-OOB-data demonstrates similar performance to Data-OOB, while significantly outperforming all other data valuation methods and the random baseline. When a few data points with poor quality are removed, the test performance of 2D-OOB-data exhibits an evident increase. However, such a positive trend does not apply to other popular data valuation methods including DataShapley and LAVA. These findings highlight the potential of 2D-OOB-data in selecting a subset of critical data points that can maintain model performance when the dataset is pruned. The results from 6 binary classification datasets are displayed. For each dataset, we conduct 30 independent trials and report the average results. A higher curve indicates better performance. 2D-OOB-data demonstrates superior ability in finding a set of helpful data points.NeurIPS Paper ChecklistJustification: There is no societal impact of the work performed.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.• The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).Logistic regression is chosen because it is a simple yet powerful machine learning model commonly used to test data separability, which is a standard practice in this field[16,30]. 


Decision: The rebuttal provided by the authors have addressed most of the reviewers' questions, by clarifying parts of the submission and providing additional experiments. However, some of the reviewers also point out that the novelty of the submission and its applicability may be limited.

Reviews: review: paper_summary: paper_summary: This paper studies data valuation in a fine-grained fashion: determine helpful samples as well as the particular cells that drive them. The proposed method is tested with 12 datasets and has application in backdoor detection.
strength_weakness: strength_weakness: - The proposed method seems to be a combination of existing algorithms 2D-KNN and Data-OOB. The novelty and contribution may be relatively marginal.
questions: questions: Could you please discuss what are the *unique* challenges of 2D-OOB that do not arise for 2D-KNN and Data-OOB?
limitations: limitations: Yes.
paper_summary: paper_summary: This paper proposes a joint valuation framework for not only obtaining data value but also attributing a data points value to its individual features (cells). The framework is build on top of data-OOB. The authors compared the proposed 2D-OOB with 2D-KDD on several tasks, including cell-level outlier detection and backdoor trigger detection in data poisoning attacks.
strength_weakness: strength_weakness: (-) Despite the strengths mentioned above, the entire framework is built on top of the OOB framework. This brings a main limitation, as the OOB framework requires the training algorithm to be a bagging method with weak learners. In many applications, bagging may not be the best-performing method, and data valuation under this method may not be of interest.

(-) Typically, the number of randomly selected features for each weak learner is an important hyperparameter to fine-tune. What is the impact when the number of random features is small? While an ablation study was provided in Appendix, certain variation was still observed. Should we correspondingly update the bagging size? Some practical guidance would be helpful.
questions: questions: 1. What does fitting a logistic model in line 187 on page 6 mean? Why change from bagging decision trees to a logistic model in this specific cell fixation experiment?

2. It would be helpful to further explain the difference between Trojan and BadNets trigger methods, as it seems that 2D-OOB is much more effective than 2D-KNN under the Trojan square. This would help us understand in which scenario 2D-OOB works better.

3. Regarding the ablation study: I am also curious about the original prediction performance for each task, not just the outlier detection performance.

4. What is the implication of the connection to data-OOB in Proposition 3.1? Are there any insights we can gain after establishing the connection with data-OOB?
limitations: limitations: None
paper_summary: paper_summary: The paper proposes 2D-OOB, an out-of-bag estimation framework for jointly detecting both samples as well as their cells that are outliers. In other words, 2D-OOB allows attribution of the value of a data sample to its individual features.  Evaluation shows that the framework is also able to localize backdoor triggers in data poisoning attacks. 
In comparison to the 2D-Shapley model, which also performs joint valuation of a sample and its features, the 2D-OOB is a more efficient and model-agnostic formulation and builds on the subset bagging model, where each weak learner is trained on a randomly selected subset of features. In the experiments, decision trees as used as the weak learners and trained using randomly selected features. The framework measures (using Eqn. (4)), the average accuracy of the bag of predictors for a selected sample and its features.
strength_weakness: strength_weakness: * The paper is low on novelty. Given, OOB-Data formulation and the 2D-Shapley for joint valuation, the 2D-OOB formulation seems like a natural extension -- interesting, but not high on novelty.

* In Fig. 4, panel B, for BadNets poisoning attack, the detection performance of 2D-OOB and 2D-KNN (proxy for 2D-Shapley) are very similar. It is difficult to assess how 2D-OOB will perform for more stronger poisoning attacks. A more detailed study on this aspect as well as analysis showing that 2D-OOB is more likely to identify such triggers, even when attack takes such a detection mechanism into account, will be a good indicator of the strength of this framework.

* Table 1, shows the average run time is much improved from 2D-KNN, however, most of the datasets used (Appendix A, Table 3) have small input dimensions (only three have >= 100 but have small sample size) and hence it is difficult to assess how the technique would scale.
questions: questions: * One of the arguments mentioned in the description of Fig. 2 is that 2D-OOB detects a majority of outlier cells by examining a small fraction of the total cells. It would be great if the authors could further explain this statement and which part of the formulation in (4) motivates this argument.

* In Fig. 3 (showing 2D-OOBs ability to identify and prioritize the outliers to fix), the test accuracy for the Jannis dataset is relatively low compared to the others and the performance is also similar to 2D-KNN. Any insights as to why this is happening?

* In Section 4.4, were the experiments also performed by varying B using a 2-layer MLP? What is the overhead of training an out-of-bag estimator versus a single model (maybe an autoencoder) and using that for outlier detection. 

* Are there any other stronger baselines against which comparison can be made?
limitations: limitations: Yes.
paper_summary: paper_summary: This paper studies data attribution. Unlike the previous works that only quantifies the contribution of each datum, this work also considers the attribution of the cells within every datum. The proposed the joint valuation framework, 2D-OOB, can accurately identify cell outliers, as well as the poisoning attacks. The experiments verify the authors claims and show the efficiency of the proposed method.
strength_weakness: strength_weakness: 1. In section 4.3, the experiments did not mention that the classification label is altered or not after poisoning (e.g, from correct to incorrect).
2. The paper does not state clearly about the differences of the application on image, comparing with the other model attribution methods? They both assign a value to each feature/pixel/cell in the input data. Why would the proposed method be better in this scenario?
3. How about the scalability of the proposed method? The experiments are either conducted on tabular data or small images. The large images or high-dimensional data are not mentioned.
4. What is the distance regularization term mentioned in L168 in the utility function $T$?
5. The size of CIFAR-10 is 32x32, but the cell valuation displayed in Figure 5 is 16x16. Why is that?
questions: questions: See weaknesses
limitations: limitations: N/A

Comments: title: Thank you
Thank you
Thank you!
Thanks for the response
comment: We greatly appreciate your constructive review and are glad our new results addressed your concerns. We will incorporate all these new results and discussions in the revision. Thank you for re-evaluating our paper.
We appreciate your thoughtful review again and are pleased you found the paper solid!
Thank you for the detailed response. I am satisfied with the scalability experiments as well as the results on the attacks. I am increasing my score to 5.
Dear AC and Reviewer ECZV,

We are grateful for your feedback and suggestions. We will make sure to include necessary clarifications, discussion on our method and image feature attribution, as well as scalability results in the revision.
Dear authors,

Are you planning to revise the paper accordingly?
Thanks for the authors' response, which has addressed most of my concerns. The authors should include the key points of the discussion into their revised version.
I appreciate the authors' response. Overall I think this is a solid paper, although its impact may be limited by its applicability to bagging methods only.
Dear reviewers,

All the reviews and rebuttals are now available. Please go over all such information and ask any clarifying questions to the authors.