Whose Data Did This? Valuation and Attribution

What is one example worth?

Ask a sharp question: if you removed this single training point, how much would performance change? The principled answer is its Shapley value — the same cooperative-game concept behind SHAP feature attributions, but applied to data points instead of features. A point's value is its average marginal contribution to model performance over all possible subsets it could join. This uniquely satisfies fairness axioms: symmetry, null-player, and additivity.

\phi_i = \sum_{S \subseteq D \setminus \{i\}} \frac{|S|!\,(n-|S|-1)!}{n!}\,\bigl[v(S \cup \{i\}) - v(S)\bigr]

The data Shapley value: an example's worth is its average marginal contribution to performance over all coalitions of the other points.

The catch is cost: the exact value sums over exponentially many subsets, each requiring a retrain. Practical data Shapley uses Monte Carlo permutation sampling, truncation (stop once marginal gains vanish), or closed forms for simple models like k-NN. Negative Shapley values are the prize — they flag points that hurt the model, typically mislabeled or out-of-distribution, giving you a removal list grounded in performance rather than heuristics.

Influence functions: valuation without retraining

Influence functions estimate the effect of up-weighting or removing a training point without retraining, using a first-order Taylor expansion of the optimum. The classic formula multiplies the gradient of the test loss by the inverse Hessian of the training loss, then by the gradient at the training point. Intuitively: how a tiny nudge to this example propagates, through the curvature of the loss, to a specific prediction.

# influence of training point z on test point z_test
g_test  = grad(loss(model, z_test), params)
g_train = grad(loss(model, z), params)
infl = - g_test @ Hinv @ g_train     # Hinv via LiSSA / EK-FAC, never formed

Influence is a Hessian-weighted inner product of gradients; the inverse Hessian is approximated implicitly (LiSSA, EK-FAC), never materialized.

\mathcal{I}(z, z_{\text{test}}) = -\,\nabla_\theta L(z_{\text{test}}, \hat\theta)^{\top}\, H_{\hat\theta}^{-1}\, \nabla_\theta L(z, \hat\theta)

The influence of training point z on a test loss: an inverse-Hessian-weighted inner product of the two gradients — no retraining required.

Scaling attribution to foundation models

Training-data attribution (TDA) is the umbrella goal: trace any model behavior back to the examples most responsible for it. For billion-parameter models, exact Shapley and full influence are hopeless, so modern TDA uses cheaper estimators — gradient-dot-product methods like TracIn that sum agreement of training and query gradients across checkpoints, or random-projection sketches (TRAK) that compress per-example gradients into a tractable kernel. These scale and are 'good enough' to surface the handful of documents behind a memorized fact or a surprising capability.

\tau(z, z_{\text{test}}) \approx \phi(z_{\text{test}})^{\top}\phi(z), \qquad \phi(z) = P^{\top}\,\nabla_\theta L(z, \hat\theta)

Scalable attribution (TRAK-style): project each example's gradient with a random matrix P, then score by a cheap low-dimensional inner product.

Attribution closes loops from earlier guides. If a fact is wrong, TDA finds the poisoned or duplicated source; if a class is brittle, it shows whether the support is one cluster or many; and dedup makes all of this meaningful, because attributing to one of a thousand identical copies tells you nothing.

Detecting contamination

The most damaging attribution failure is silent: a benchmark leaked into pretraining, so your reported score measures recall, not reasoning. Data contamination detection hunts for this with n-gram overlap against known test sets, membership-inference signals (the model is suspiciously confident or low-perplexity on verbatim test items), and canary strings deliberately planted to be searched for later.