{"id":"068fa28a-cd67-4c90-899f-a4e99295b3bb","arxiv_id":"2505.23223","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"DAUNCE computes training-data attribution as the covariance of per-example losses across an ensemble of perturbed fine-tuned models, reporting state-of-the-art LDS scores and the first attribution runs on proprietary LLMs.","lead":"A new method called DAUNCE estimates which training examples most shaped a model's prediction by training many lightly perturbed copies of the model and measuring how losses vary across the copies. It reports higher attribution accuracy than TRAK, LoGra, and EKFAC on image and language tasks, and it can work when only an API is visible, including on OpenAI's GPT models.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's proof collapses the empirical gradient covariance into the Hessian (Appendix A.2), an identity that is false for general losses; the stated equivalence between DAUNCE and influence functions is therefore unsupported.","rationale":"The reader's weakest_assumption identifies exactly the step I consider load-bearing: the proof of Theorem 1 replaces the empirical gradient outer product with the Hessian. My independent re-derivation of Appendix A.2 confirms that the expectation of the covariance estimator is H^{-1} G H^{-1}/n, and the equality to H^{-1}/n requires the unstated and generally false identity G = H. This is not a stylistic or consensus-based objection; it is an internal gap between the stated theorem and its proof. The paper's own DAUNCE-E extension in Appendix A.3 is consistent because there the second-order matrix is defined as G by construction, which highlights that the Hessian variant relies on a different, unverified premise. I also note two lesser issues that do not change the verdict: the perturbation variance is 1/3 rather than 1, which rescales all scores uniformly and does not affect ranking, and the theorem omits the subsampling step that is part of Algorithm 1, so the theory does not exactly match the experiments. The empirical claims could still hold — covariance-based whitened gradient scores may rank influential examples well even when the theorem's equality fails — but the paper's central theoretical justification is unsupported as written. The reader already issued a CONDITIONAL verdict based on this concern, and my analysis reinforces rather than overturns it, so no verdict change is needed. A concrete check on the CIFAR-10 setup would settle whether the G/H mismatch is numerically significant in the actual evaluation regime; if it turns out to be small, the concern would dissolve, and if it is large, the paper would need a corrected theorem or a revised claim.","tokens_in":16373,"tokens_out":5331,"duration_ms":59281,"concrete_test":"For the CIFAR-10 ResNet-9 setup of Section 4.1, compute the empirical gradient covariance G = (1/n) Σ_i ∇L_i(θ0)∇L_i(θ0)^T and the Hessian H(θ0) at the same checkpoint, then report the relative spectral and Frobenius errors ||G − H|| / ||H||. Also compute the two attribution scores ∇L_i^T H^{-1} ∇L_j and ∇L_i^T H^{-1} G H^{-1} ∇L_j (or their correlation-normalized versions) for a sample of 100 training/query pairs and measure their Spearman rank correlation. If the relative error is large or the rank correlation is low, the H = G replacement in Appendix A.2 is the reason DAUNCE does not equal influence, and the paper must either state the assumption or replace H by G throughout the theory.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing step is in Appendix A.2: when taking E[Delta_theta_k Delta_theta_k^T], the proof replaces (1/n) Σ_i ∇L_i(θ0)∇L_i(θ0)^T with H(θ0). Without that identity, the derivation yields EI(x_i,x_j) ≈ (1/n) ∇L_i(θ0)^T H(θ0)^{-1} G(θ0) H(θ0)^{-1} ∇L_j(θ0), where G(θ0) = (1/n) Σ_i ∇L_i(θ0)∇L_i(θ0)^T, not the claimed (1/n) ∇L_i(θ0)^T H(θ0)^{-1} ∇L_j(θ0). For general losses and finite samples G ≠ H, and the paper neither states nor verifies this equivalence; it is false for typical deep-network losses. The same replacement is reused in the correlation extension in Appendix A.3. This matters because Theorem 1 is the only formal link between the loss-covariance estimator and influence functions; if the link is instead a whitened gradient covariance, the central theoretical claim is unsupported, though the method may still rank examples usefully. A secondary internal slip: σ_k = 2ξ_k − 1 with ξ_k ~ Uniform(0,1) has variance 1/3, not 1, so the stated 'unbiased' constant is off by a factor of 3 (rankings are unaffected). In addition, the proof explicitly omits the subsampling step used in Algorithm 1, so the theorem does not cover the actual procedure.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces DAUNCE, a training-data attribution method that fine-tunes K models on randomly subsampled, randomly perturbed objectives and uses the covariance (or correlation) of per-example losses across those K models as the attribution score. The authors claim a formal connection between this loss covariance and the influence function (Theorem 1, Section 3.2), report higher Linear Datamodeling Scores than TRAK, LoGra, and EKFAC on CIFAR-10/ResNet-9, present LLM-scale subset-removal results on MATH and IFEval against LoGra, and demonstrate black-box attribution on OpenAI GPT models through backdoor training-data retrieval. The empirical protocol is clearly described, and the black-box proprietary-LLM experiments are a novel contribution, but the theoretical framing has a load-bearing gap in the proof of Theorem 1.","tokens_in":16704,"tokens_out":5068,"duration_ms":53976,"significance":"If the covariance-influence equivalence were established, DAUNCE would offer a scalable, Hessian-free, and even black-box-compatible attribution method, which would be a meaningful advance for LLM interpretability and data debugging. The reported LDS improvements over existing baselines and the first demonstration of attribution on proprietary LLMs are valuable empirical contributions. However, the central theorem currently rests on an unstated and generally false identity between the empirical gradient outer product and the Hessian; with a corrected statement the method may still be practically useful, but the paper's theoretical motivation needs substantial revision. The manuscript does not provide code or machine-checked proofs, so reproducibility currently depends on the experimental appendices.","major_comments":[{"comment":"The proof of Theorem 1 collapses (1/n) Σ_i ∇L_i(θ0)∇L_i(θ0)^T into H(θ0). This identity is not stated and is false for general losses and finite samples. Without it, the derivation yields E[Δθ_k Δθ_k^T] = H(θ0)^{-1} G(θ0) H(θ0)^{-1}/n with G(θ0) = (1/n) Σ_i ∇L_i(θ0)∇L_i(θ0)^T, not (1/n) H(θ0)^{-1}. Consequently Theorem 1, as stated, does not establish the claimed equivalence between the loss covariance and the influence function. Please either state and empirically verify the condition under which G(θ0) ≈ H(θ0) (e.g., an exponential-family or MLE setting), or reframe Theorem 1 as estimating a whitened gradient covariance and adjust Sections 3.2, 3.3, and A.3 accordingly.","section":"Appendix A.2 / Theorem 1"},{"comment":"The text explicitly says 'we omit the Subsample step in the theoretical analysis for notational simplicity.' This means Theorem 1 does not cover the actual procedure in Algorithm 1, which trains each perturbed model on a random subset D_k. With subsampling, the expected outer product of Δθ_k acquires a different normalization and the theorem's constant factor (1/n) no longer matches the algorithm's behavior. Please either extend the proof to the subsampled procedure or state clearly that Theorem 1 applies only to an idealized unsampled version and discuss the gap.","section":"Section 3.2 / Algorithm 1"},{"comment":"The proof states that σ_k := 2ξ_k − 1 has zero mean and variance 1. Since ξ_k ~ Uniform(0,1), Var(σ_k) = 1/3, not 1. This changes the constant factor in the displayed expectation and in the 'approximately unbiased' claim of Theorem 1 by a factor of 3. Rankings are unaffected by a uniform scaling, but the mathematical statement should be corrected.","section":"Appendix A.2"},{"comment":"The IFEval removal intervals [5,000, 7,500, 10,000, 12,500, 15,000, 17,500] were chosen after observing that differences between DAUNCE and LoGra only become significant after removing at least 5,000 examples. This post hoc selection of the evaluation range weakens the claim that DAUNCE 'achieves overall stronger performance' on IFEval. Please report results over a prespecified or complete range of removal sizes, or clearly label the reported range as exploratory and discuss the selection bias.","section":"Section 4.2 / Appendix C"},{"comment":"The LLM subset-removal curves in Figure 2 are shown without error bars or per-seed variability, despite the text in Appendix C stating that results are averaged across 3 random seeds, and TRAK is not compared at LLM scale because no implementation was available. The claim of consistent LLM-scale improvement over existing methods is therefore supported only against LoGra and without uncertainty quantification. Please add error bars or per-seed points and state the TRAK limitation explicitly in the main text.","section":"Section 4.2 / Figure 2"}],"minor_comments":[{"comment":"In Theorem 1, the notation L_i(θ0)^T H(θ0)^{-1} L_i(θ0) uses L_i to denote a gradient, but L_i is defined as a scalar loss; please write ∇L_i(θ0)^T H(θ0)^{-1} ∇L_i(θ0) consistently in the theorem statement and proof.","section":"Section 3.2"},{"comment":"The notation p(x|θ) = softmax(g(θ, x)) is unusual because softmax is over class logits, not over the input x; please clarify that p denotes the model's predictive probability for the label associated with x, and define the chain-rule step more precisely.","section":"Section 3.1 / Equation (5)"},{"comment":"The LDS bar charts in Figure 1 do not include error bars or confidence intervals; since LDS is reported as an average over 10,000 validation examples, please provide a measure of variability across validation examples or random seeds.","section":"Figure 1 / Section 4.1"},{"comment":"The statement that the exponential model 'precisely characterizes' the scaling behavior in Figure 6 is too strong without reporting a goodness-of-fit measure or comparing against alternative curves; please temper the claim or add fit diagnostics.","section":"Section 6"}],"recommendation":"major_revision","confidential_remarks":"The central empirical contribution is interesting and the black-box proprietary-LLM demonstration is novel, but the theoretical claim in Theorem 1 is not supported as written. I believe the issue is fixable by either adding and verifying the necessary Hessian-gradient condition or by explicitly repositioning the paper as an empirical method with a heuristic connection to influence functions. If the authors choose the latter, the contribution would still be meaningful, but the framing and the abstract should be adjusted accordingly. I would also encourage the authors to release code and checkpoints, as the current manuscript does not provide them."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: DAUNCE is worth a look. The core idea—attribute by covariance of per-example losses across an ensemble of perturbed models—is genuinely new to me, and the empirical results are stronger than the theory that is supposed to justify them. The LDS gains over TRAK, LoGra, and EKFAC are consistent across variants, and the black-box application to OpenAI GPT models is the first I know of. If the method holds up, it fills a real practical gap.\n\nWhat is good: the method is simple, needs no Hessian or gradient for the black-box variant, and the CIFAR-10 LDS numbers are convincing. The qualitative backdoor-attribution examples on GPT-4.1 and GPT-4o mini are a nice demonstration that the covariance signal survives even when fine-tuning is done through an API.\n\nThe soft spots are mostly in the theory. Theorem 1's proof in Appendix A.2 quietly replaces the empirical gradient outer product (1/n)Σ∇L_i∇L_i^T with the Hessian H. That identity does not hold for general losses; it is true in expectation for MLE families but not for finite samples of a deep-network loss. Without it, the derivation gives H^{-1} G H^{-1}, not H^{-1}, so the stated equivalence with the influence function is not established. The method may still rank examples correctly—the empirical evidence suggests it does—but the paper needs to either state the assumption, prove it under a more restrictive setting, or reframe the claim as 'whitened gradient covariance' and show why that is a good attribution score. There are two smaller slips in the same appendix: σ=2ξ−1 for ξ~U(0,1) has variance 1/3, not 1, so the constant is off by a factor of 3 (fine for ranking), and the proof omits the subsampling step that is actually in Algorithm 1. These are fixable.\n\nOn the experimental side, the IFEval removal range was chosen after seeing where the methods diverged; that is post hoc and weakens that curve, though the MATH results and the CIFAR-10 LDS are not affected. LLM curves have no error bars. And TRAK is absent at LLM scale, so 'outperforms existing TDA methods' is really 'outperforms LoGra' at that scale.\n\nBottom line: the method deserves a serious referee. The empirical contribution is solid enough to stand on its own, and the black-box demonstration is important. The theory needs a careful rewrite before it can be called a proof.","headline":"DAUNCE is a simple, empirically strong attribution method whose central theorem is unsupported as proven; worth engaging for the black-box results.","tokens_in":17223,"tokens_out":3282,"would_cite":true,"duration_ms":32393,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Per-example loss covariance across K perturbed models estimates the classical influence function, giving scalable attribution that works for large language models and black-box APIs.","keywords":["training data attribution","influence functions","uncertainty estimation","covariance","black-box access","large language models","linear datamodeling score","perturbation"],"falsifier":"On a small model where the Hessian and the gradient outer product are known to differ (for example a two-layer ReLU network), compute DAUNCE scores and compare their ranking with exact leave-one-out influence values obtained by retraining; if the Spearman correlation is comparable to random projection baselines, the stated equivalence is not supported.","tokens_in":16159,"feed_emoji":"🎯","tokens_out":4592,"duration_ms":42738,"temperature":0.7,"pith_summary":"The paper proposes DAUNCE, a training data attribution method that estimates how much each training example influences a model's behavior on a test point by fine-tuning K perturbed copies of the model and computing the covariance of per-example losses across those copies. The central claim, formalized in Theorem 1, is that this covariance is an approximately unbiased estimator of the classical influence function, without ever forming the Hessian. If true, DAUNCE provides a scalable route to influence-style attribution that needs only loss values, making it applicable to large models and even black-box APIs. The paper demonstrates improved linear datamodeling scores over TRAK, LoGra, and EKFAC on vision tasks, stronger subset-removal results on LLM fine-tuning, and the first attribution on proprietary OpenAI GPT models.","feed_headline":"Loss covariance across perturbed models recovers influence attribution","feed_subtitle":"A new method estimates per-example influence from loss covariance, beating TRAK and LoGra, and runs on OpenAI GPT models.","key_machinery":"The central object is the empirical covariance of per-example losses across K perturbed models, I(x_i,x_j) = (1/(K-1)) Σ_k (L_i(θ_k) - \\bar L_i)(L_j(θ_k) - \\bar L_j). The perturbation injects a random first-order term into the fine-tuning objective, and the algebra of this term turns the covariance into a Monte Carlo estimate of a quadratic form in the inverse Hessian, which is exactly the influence-function structure. Subsampling and LoRA are used to keep the K training runs cheap at LLM scale.","core_discovery":"On the paper's own terms, the covariance of per-example losses across K models fine-tuned on randomly subsampled, linearly perturbed objectives estimates the influence function (1/n) ∇L_i(θ0)^T H(θ0)^{-1} ∇L_j(θ0). Theorem 1 proves this in expectation under a Taylor approximation, and the practical upshot is that attribution reduces to training K cheap models and computing pairwise covariances, with no Hessian inversion and no gradient projection. This even works when only API access to loss values is available, which the paper exploits to achieve the first data attribution on proprietary LLMs.","pith_inferences":["Editorial inference: the covariance estimator is a randomized, second-order-free probe of the Hessian, so any perturbation scheme whose induced parameter shifts have covariance proportional to H^{-1} (for example, noise on the loss or dropout-like stochasticity) should yield the same attribution, generalizing the method beyond the specific uniform perturbation.","The black-box result suggests that a model owner with query-only access can test data influence, ownership, or memorization (e.g., whether a specific example caused a refusal), with auditing and legal implications the paper does not explore.","Testable extension: apply DAUNCE to detect backdoor triggers at scale with precision/recall metrics; the paper's case study shows qualitative retrieval of injected examples but does not report quantitative detection accuracy."],"forward_implications":["Attribution becomes a drop-in tool for LLM interpretability: any user with API access to a fine-tunable model can rank training examples' influence on a query's output.","Because covariance estimation avoids second-order matrices, DAUNCE scales to models where Hessian-based methods are infeasible, as demonstrated on 7B-8B LLMs.","The fitted exponential scaling law with K means a modest number of perturbed models (around 100-200) is enough for near-peak performance, making the method cheap in practice.","The method can operate in strict black-box settings by replacing fine-tuning with prompt optimization, so attribution is possible even when model weights are never exposed.","The correlation variant behaves like influence with unit-normalized gradients, which mitigates the effect of outlier training examples with large gradient magnitudes."],"supporting_citations":[{"why":"Provides the closed-form influence function that DAUNCE aims to approximate.","marker":"[2]"},{"why":"TRAK is the main white-box scalable baseline, and its margin-based second-order formulation is adapted as DAUNCE-T.","marker":"[15]"},{"why":"LoGra serves as the LLM-scale attribution baseline for subset-removal comparisons.","marker":"[8]"},{"why":"EKFAC influence function is the high-fidelity baseline, and it supplies the equivalence between Hessian and Fisher under MLE.","marker":"[1]"},{"why":"Bootstrap variance estimation for uncertainty via random subsets is the direct motivation for the covariance-based attribution score.","marker":"[11]"},{"why":"BDPL supplies the black-box prompt optimization used to train perturbed models under strict black-box access.","marker":"[41]"},{"why":"LoRA makes fine-tuning K perturbed LLMs computationally feasible.","marker":"[34]"}],"fun_headline_variants":["Loss covariance across perturbed models estimates influence","No Hessian inversion: loss covariance gives data attribution","First attribution on proprietary LLMs via loss covariance","Loss covariance across perturbed models scales to black-box LLMs","Attribution from uncertainty: loss covariance replaces Hessian inversion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The theorem assumes the average outer product of per-example gradients equals the Hessian, which is exactly true only for special statistical models and only approximately true for deep networks; if that identity fails for a given model, the covariance no longer equals the influence function.","fun_headline_variants_meta":{"raw":{"variants":["Loss covariance across perturbed models estimates influence","No Hessian inversion: loss covariance gives data attribution","First attribution on proprietary LLMs via loss covariance","Loss covariance across perturbed models scales to black-box LLMs","Attribution from uncertainty: loss covariance replaces Hessian inversion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000665,"raw_usage":{"total_tokens":2989,"prompt_tokens":852,"completion_tokens":2137,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":468,"completion_tokens_details":{"reasoning_tokens":2061}},"tokens_in":468,"tokens_out":2137,"duration_ms":14209,"temperature":1.0,"reasoning_tokens":2061,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T12:51:33.995443+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"On a small model where the Hessian and the gradient outer product are known to differ (for example a two-layer ReLU network), compute DAUNCE scores and compare their ranking with exact leave-one-out influence values obtained by retraining; if the Spearman correlation is comparable to random projection baselines, the stated equivalence is not supported.","supporting_citations":[{"cited_title":"Black-box prompt learning for pre-trained language models.Trans","cited_arxiv_id":null,"evidence_quote":"BDPL supplies the black-box prompt optimization used to train perturbed models under strict black-box access."}],"review_version":1}