Source-linked AI summary
Which Influence Are We Estimating? The Role of Counterfactual Specifications in Data Attribution
Zhe Li, Wei Zhao, Peixin Zhang, Jun Sun
TL;DR
Influence estimators often disagree, and that disagreement matters for attribution tasks, especially when the target behavior must be represented by a surrogate. This paper formalizes influence as a counterfactual estimand and separates specification mismatch from approximation error. Experiments show that specification choices can change exact rankings and attribution quality, motivating specification analysis when interpreting and comparing estimators.
Problem
Influence estimators often give incompatible rankings, while behavior surrogates such as query loss may not capture the target behavior being attributed.
Source: §1 · pp. 1–2Method
Results
Controlled and practical attribution experiments show that specifications can change exact rankings and that behavior-surrogate choices affect attribution quality and downstream data decisions.
Source: §1 · p. 2Takeaways & Limitations
Specification analysis is a necessary first step for interpreting and comparing influence estimators, and behavior-aligned surrogates can reveal target-specific examples obscured by default choices.
Source: §6 · p. 9
Abstract
from arXiv · showhide
Estimating the influence of training examples on model behavior is essential for data debugging, valuation, and attribution. Existing influence estimators often produce incompatible rankings, which are commonly ascribed to approximation error. We argue that a more fundamental source of disagreement is specification mismatch: influence depends on the behavior being attributed, the intervention applied to each training example, and the counterfactual training process that maps the intervention to a model response. These choices are especially important when the target behavior requires a tractable surrogate, such as query loss, a logit, or a margin. We formalize influence as a counterfactual estimand, distinguish specification mismatch across estimands from approximation error in estimating a fixed estimand, and organize representative estimators by their implied specifications. We further derive a local decomposition that exposes how behavior signals, training signals, and counterfactual parameter responses interact. Controlled experiments show that exact estimands under different specifications can induce different rankings, whereas approximation error grows as perturbations move farther from their linearization points. Experiments on noisy label detection and LLM attribution show that specification choices significantly affect attribution quality, especially for the choice of behavior surrogate. Behavior-aligned specifications can identify target-specific training examples obscured by default loss-based or similarity-based specifications. These results establish specification analysis as a necessary first step for interpreting and comparing data influence estimators.
1 INTRODUCTION
Influence estimators can disagree because they may answer different counterfactual questions, not merely because they approximate poorly. The paper formalizes this distinction and shows that specification choices affect rankings and attribution outcomes.
1 INTRODUCTION
- Influence estimators often produce incompatible rankings on the same model and dataset, making disagreement difficult to interpret for LLMs where retraining references can be prohibitively expensive.Influence estimates matter for debugging, data selection, and safety analysis.Source: §1 · p. 1
- Changing the attributed behavior, training-example intervention, or counterfactual training process can change rankings even when the resulting quantity is computed exactly.A surrogate such as query loss can also mismatch the target behavior and yield poor attribution despite accurate estimation of its specified quantity.Source: §1 · pp. 1–2
- The framework separates specification mismatch from approximation error, organizes estimators by specification, and decomposes how behavior signals, training signals, and parameter responses interact.It extends a local decomposition of learning dynamics to counterfactual training processes.Source: §1 · p. 2
- Experiments show that exact estimands under different specifications can rank examples differently, while approximation error grows as local approximations move farther from their reference points.In noisy-label detection and LLM attribution, behavior-aligned surrogates can reveal target-specific examples obscured by default loss-based or similarity-based specifications.Source: §1 · p. 2
2 INFLUENCE AS A COUNTERFACTUAL ESTIMAND
The paper defines influence as a counterfactual change in a specified behavior under an example-specific intervention and training process. It distinguishes exact rankings across specifications from estimator disagreement under a fixed specification.
2 INFLUENCE AS A COUNTERFACTUAL ESTIMAND
- The behavior B may be the target behavior itself or a tractable surrogate, such as a loss, whose change is measured at query q.The factual model θD is obtained by training on dataset D.Source: §2 · pp. 2–3
- An influence specification combines the behavior being measured, an example-specific intervention, and a counterfactual training process that maps the intervention to a counterfactual model.Interventions can upweight an example or modify its training objective; processes can include retraining or a local update.Source: §2 · p. 3
- Influence is defined relative to the chosen specification, and changing that specification can alter the exact ranking.Positive influence means the intervention increases B; under data removal, negative influence means removal decreases B and the example supports the measured factual behavior.Source: §2 · p. 3
- With a fixed specification, disagreement between exact and estimated rankings measures approximation error, whereas exact rankings under different specifications may differ because they answer different counterfactual questions.When methods share a specification, ranking disagreement implies approximation error in at least one method but does not identify which is more accurate.Source: §2 · p. 3
3 COUNTERFACTUAL SPECIFICATIONS OF INFLUENCE ESTIMATORS
Influence estimators can be understood through the behavior, intervention, and counterfactual training process they specify. Similarity-based estimators admit an exact interpretation under a constructed specification, while learning-based estimators combine behavior and training signals through the parameter response induced by the process.
Similarity-Based Estimators
- Feature similarity is exact influence, up to a common positive scale, under a constructed specification with a frozen-feature linear readout and standardized update.The construction isolates feature geometry through a readout update determined solely by the training example’s features.Source: §3 · pp. 3–4
Learning-Based Estimators
- Learning-based estimators decompose into a query behavior signal, a Jacobian interaction, and a training signal.For scalar outputs, the Jacobian interaction is an inner product of Jacobian features, linking the decomposition to feature similarity.Source: §3 · p. 4
- For general counterfactual processes, the parameter response determines how behavior and training signals interact, and the first-order decomposition linearizes the exact path-level representation at the factual model.The response operator maps a training-gradient perturbation to the negative first-order parameter response; one-step updates use η times the identity operator.Source: §3 · pp. 4–5
- Similarity-based scores drop the behavior and training signals, while restoring them recovers much of the gap to learning-based estimators.The learning-based score depends on both the training objective and the current model prediction.Source: §3 · pp. 4–5
4 CONTROLLED EXPERIMENTS ON INFLUENCE SPECIFICATION
Controlled experiments show that exact influence rankings can differ when the behavior, intervention, or counterfactual process changes. With a specification fixed, approximation error grows as counterfactuals move farther from their linearization points, particularly for nonlinear behaviors.
Controlled Setting
- The controlled study uses FashionMNIST logistic regression with a strongly convex objective, varying one specification component at a time and measuring ranking agreement with Kendall’s τ.The authors also perform a non-convex check on CIFAR-10 with a simple CNN.Source: §4 · p. 5
Finding 1: Changing the specification changes the question
- Exact influence rankings vary across behavior, intervention, and training-process specifications, including differences between leave-one-out removal and finite upweighting and between one-step and inverse-Hessian responses.Soft margin and query loss agree exactly, while hard margin and query logit differ significantly from query loss.Source: §4 · p. 5, Figure 2 · p. 6
Finding 2: Fixing the specification isolates approximation error
- With specifications fixed, ranking agreement decreases as update size or perturbation scale grows for nonlinear behaviors and inverse-Hessian responses.Agreement remains high for query logit, which is linear in the parameter update.Source: §4 · pp. 5–6, Figure 2 · p. 6
- Ranking disagreement informs approximation quality only when specifications align; when direct counterfactual evaluation is infeasible, the behavior, intervention, and process still need to be specified.The same qualitative patterns are reported in a supplementary CIFAR-10 CNN check.Source: §4 · p. 6
5 SPECIFICATION EFFECTS IN PRACTICAL ATTRIBUTION
Practical attribution evaluates whether specification choices identify problematic training examples and improve downstream model behavior. Across noisy-label and LLM tasks, the preferred behavior surrogate depends on both the estimator and the target task.
5 SPECIFICATION EFFECTS IN PRACTICAL ATTRIBUTION
- The practical evaluations use trusted clean examples to identify harmful noisy labels and test whether LLM attribution distinguishes corrupted responses and harmful poisons from benign triggers.The noisy-label study also measures model accuracy after selected examples are removed and the model is retrained.Source: §5 · p. 6, §5.1 · pp. 6–7, §5.2 · p. 8
5.1 NOISY LABEL DETECTION
- For noisy-label detection, TracIn with target logit improves test accuracy by 3.20 percentage points after removal, versus 1.06 points with trusted loss.LiSSA with hard margin improves accuracy by 2.21 points; TracIn consistently benefits from target logit, while LiSSA generally favors trusted loss or hard margin across noise rates and architectures.Source: Figure 3 · p. 7, §5.1 · p. 8
- At noise rate ρ = 0.2, TracIn's target-logit AUPRC is 0.602 versus 0.349 with trusted loss, while LiSSA's highest AUPRC is 0.587 with hard margin.The preferred behavior surrogate varies by estimator; representation and NTK similarity perform close to random selection.Source: §5.1 · p. 7, Table 2 · p. 7
5.2 LLM ATTRIBUTION
- For response-corruption attribution, answer logit and margin reach AUPRC 0.64–0.94 for answer corruption, while explanation loss yields 0.11–0.13.Rationale corruption instead favors rationale-sensitive surrogates: GradSim reaches AUPRC 0.596 with explanation loss versus 0.242 with answer margin.Source: Figure 4 · p. 8, §5.2 · pp. 8–9
- Conditional-backdoor attribution shows a strong estimator–surrogate interaction: TracIn with answer logit reaches AUPRC 0.872 versus 0.481 with response loss.Its BT-FPR falls from 0.029 to 0.001; removing its top 10% of selected examples lowers attack success to approximately 5% with little clean-accuracy change.Source: Table 3 · p. 9, §5.2 · p. 9
- Across methods and tasks, no behavior surrogate consistently performs best, so practical attribution should evaluate task-relevant surrogates for each method.When feasible, the authors recommend validating selected examples through downstream interventions.Source: §5.2 · p. 9
6 CONCLUSION
The conclusion frames influence as a counterfactual estimand and argues that specification analysis is necessary for interpreting and comparing estimators.
6 CONCLUSION
- Influence is specified by the behavior, intervention, and counterfactual training process, and representative estimators are organized within a shared local structure.The experiments show that changing specifications can alter exact rankings, while approximation error grows with distance from the linearization point.Source: §6 · p. 9
- The authors report using generative AI for code assistance, automated tests, and language polishing, but not for research ideas, data, manuscript drafting, or images.They state that AI-assisted work was reviewed and that they take responsibility for the final content.Source: AI USE STATEMENT · p. 10
- The paper's code is available at https://github.com/plumprc/Influence_Estimation.Source: AI USE STATEMENT · p. 10
A.1 CONTROLLED EXPERIMENTS
The controlled-experiment appendix describes FashionMNIST and CIFAR-10 setups for comparing influence rankings.
A.1 CONTROLLED EXPERIMENTS
- FashionMNIST uses unit-normalized inputs and an ℓ2-regularized multinomial logistic regression model with λ = 10−4, refined until the gradient norm is below 10−12.Each run uses 20,000 training examples, 2,000 test examples, 1,000 queries, and 1,000 candidates; Kendall’s τ is averaged across three seeds.Source: §A.1 · p. 13
- CIFAR-10 provides a non-convex check using a CNN trained with SGD for 50 epochs and ℓ2 regularization with λ = 10−4.Each run uses 10,000 training examples, 600 test examples, 500 queries, and 500 candidates; Kendall’s τ is averaged within each seed.Source: §A.1 · p. 13
A.2 PRACTICAL EXPERIMENTS
The practical-experiment appendix specifies methods and training setups for noisy-label detection and ScienceQA LLM attribution.
A.2 PRACTICAL EXPERIMENTS
- Noisy-label detection compares gradient-similarity, trajectory-based TracIn, and mini-batch LiSSA estimators using trusted loss, target logit, or hard margin as behavior signals.The appendix also describes their gradient, checkpoint, and similarity computations.Source: §A.2 · p. 13
- LLM attribution fine-tunes the models with LoRA and uses one epoch for response corruption and two epochs for the conditional-backdoor task.The configuration uses AdamW, learning rate 10−4, batch size 8, and maximum sequence length 1,024.Source: §A.2 · p. 13
- The ScienceQA tasks use answer corruption, rationale corruption, and conditional poisons, alongside benign-trigger and clean examples.The backdoor setup varies context and trigger markers across balanced groups; labels for corruption and poison are used only for evaluation.Source: §A.2 · pp. 13–14
B.1 CONTROLLED EXPERIMENTS
Controlled comparisons show that exact influence rankings can change with the behavior, intervention, and counterfactual training process. Approximation error also grows as a perturbation moves farther from its linearization point.
B.1 CONTROLLED EXPERIMENTS
- The ranking comparisons use Kendall’s τ, top-5% overlap, and sign agreement, averaged per query and within each seed.The controlled experiments use FashionMNIST and report full comparisons in Tables 9 and 10 and Figures 5 and 6.Source: §B.1 · pp. 14–15
- In the conditional-backdoor showcase, four variants share a question and explanation; only the triggered activating variant uses the incorrect target answer.The variants distinguish the trigger and target conditions in the data showcase.Source: Table 8 · p. 15
- Hard margin and query logit produce different rankings: τ is 0.747 and 0.408 on FashionMNIST, and 0.944 and 0.501 on CIFAR-10, respectively; soft margin matches query loss.These behavior comparisons vary the behavior measure while holding the other specification components fixed.Source: §B.1 · p. 15
- As finite-upweighting scale increases, τ falls from 0.980 to 0.771 on FashionMNIST; CIFAR-10 values are −0.052 and 0.060.The comparison is between exact leave-one-out removal and finite upweighting.Source: §B.1 · p. 15
- Five-step unrolled responses stay close to one-step responses (τ=0.957 and 0.970), whereas inverse-Hessian re-optimization is nearly uncorrelated (τ=0.043 and 0.058).Approximation error increases as the perturbed optimum moves farther from the linearization point.Source: §B.1 · p. 15
B.2 PRACTICAL EXPERIMENTS
Practical attribution results vary with the behavior surrogate and with the signals used by an estimator. Surrogates aligned to the target behavior can improve detection and removal outcomes, while the preferred choice depends on the task and estimator.
B.2 PRACTICAL EXPERIMENTS
- Noisy-label removal utility is unstable at top-1%; at top-5% and top-10%, each estimator’s best surrogate also delivers its largest gain.TracIn with target logit improves test accuracy by 1.45 and 3.20 points; random selection and both similarity baselines reduce accuracy.Source: §B.2 · p. 15
- For response corruption, answer logit or margin reaches AUPRC 0.960 on Gemma and 0.971 on Llama3, while explanation loss reaches 0.755 and 0.731 for rationale corruption.The preferred surrogate reverses across corruption types.Source: §B.2 · pp. 15–16
- For conditional backdoor attribution, TracIn with answer logit reaches AUPRC 0.855 on Gemma and 0.464 on Llama3, versus response loss at 0.246 and 0.115.Representation similarity is competitive on Llama3, reaching AUPRC 0.626.Source: §B.2 · p. 16
- Under the triggered harmful specification, TracIn with answer logit reaches AUPRC 0.872 while explanation loss is 0.104; under the other specifications, all surrogates are at most 0.309.Most surrogate results under the other specifications stay near random selection at 0.105.Source: §B.2 · p. 16
- Removing TracIn answer-logit’s top 10% reduces attack success rate from 0.809 to 0.053, near the 0.050 oracle rate, with little clean-accuracy change.GradSim, TRAK, and LESS select few harmful-poison examples and leave attack success near its original level.Source: §B.2 · p. 16
- On noisy-label detection, adding a training signal raises AUPRC from 0.218 to 0.337 and P@10% from 0.222 to 0.429; combining behavior and training signals does not improve on training alone.The behavior signal alone raises AUPRC to at most 0.224.Source: §B.2 · p. 16
- For response corruption, only combining behavior and training signals raises AUPRC from 0.100 to 0.984 for answer corruption and from 0.102 to 0.509 for rationale corruption.Neither signal alone suffices, and the layer matters: last-layer results are 0.320 and 0.116 while middle layers remain above 0.97 and 0.35.Source: §B.2 · p. 16
C MONOTONICITY OF BEHAVIOR SURROGATES
Exact influence rankings are invariant to strictly increasing transformations of a behavior measure when the specification is fixed. More broadly, disagreement can reflect different specifications rather than estimation accuracy, making unaligned comparisons ill-posed.
C MONOTONICITY OF BEHAVIOR SURROGATES
- For fixed P and T, a strictly increasing transformation of a behavior measure preserves exact influence rankings for every query.The proof compares each candidate’s counterfactual behavior change with the factual behavior value; finite precision and first-order response approximations can still yield slightly different rankings.Source: C MONOTONICITY OF BEHAVIOR SURROGATES · p. 17
D RELATION TO PRIOR WORK
- Prior explanations emphasize approximation error, while Bae et al. (2022) show removal and infinitesimal upweighting answer different questions; this paper frames unaligned comparisons as ill-posed.The paper formalizes influence over a specification comprising behavior, intervention, and counterfactual training process.Source: D RELATION TO PRIOR WORK · p. 18