A CIFAR-10 classifier, a model that sorts images into ten categories, once called a photograph of a plane at sunset a ship. Rank the training data by influence on that mistake and the answer jumps out: boats backlit by sunsets (Ilyas et al. 2022).
Every method in this series ended the same way: one score per training example, sixty of them, predicting what retraining would do. Parts 1 through 6 argued about how to get those numbers cheaply and honestly. One notation note before they go to work: this post writes the general estimator as \(\hat{f}\), the field’s symbol for “any function that predicts the model’s output from a choice of training data.” The simplest prediction is the change in the model’s output when one training point is left out, and every method from parts 2 through 6 is a way of building such an estimator. Every figure below reuses this series’ toy setup: sixty synthetic “student” data points and one gold-star test question, run through a small classifier we can retrain in milliseconds. This post is about the part nobody argued about because it seemed too obvious to say: once you can predict what retraining would do, you never have to wonder what training data to use. You can optimize it.
That one sentence is the field’s entire applications playbook, and the people who assembled the modern toolkit state it as a two-step recipe (Ilyas et al. 2024). Step one: rewrite your problem so it is a question about model outputs under different training data. Step two: wherever the true output appears, an expensive retraining, substitute the attribution estimate \(\hat{f}\), and solve the now-cheap problem. Debugging, dataset selection, poisoning, and unlearning are that recipe with four different things in the blank.
FIG. 1 · ONE TEMPLATE, FOUR APPLICATIONS
The whole playbook. The template never changes; the tabs change what fills it. Selection minimizes the substituted objective over which data to keep, poisoning maximizes it over what an adversary adds, unlearning evaluates it at the training set minus a forget set, and debugging just reads the coefficients. Every \(\hat{f}\) in these tabs can be any method from parts 2 through 6.
Debugging: read the coefficients
The gateway application asks for no optimization at all. A model misbehaves on some input; rank the training data by attribution and read.
Our classroom can stage the same detective story with an answer key. Before rendering this page, the build script flipped the label of exactly one student and retrained. Can the influence ranking find the saboteur?
FIG. 2 · FIND THE MISLABELED STUDENT FROM THE RANKING ALONE
One of these sixty labels is a lie. The ranked strip shows every student’s influence on the star (the one test question this whole series tracks); click through the top of the ranking, form your suspicion, then press “Reveal.” Both the exact leave-one-out ranking and the cheap influence-function ranking surface the planted mislabel near the top: the point pushing hardest against the boundary is the one wearing the wrong label.
This is attribution’s most deployed mode today, and its logic is worth stating: mislabeled, corrupted, and out-of-place examples are load-bearing in the wrong direction, so they concentrate at the extremes of any decent attribution ranking.
That is also why the same ranking machinery keeps appearing inside data-cleaning pipelines (Hara, Nitanda, and Maehara 2019) and memorization studies (Feldman and Zhang 2020). Any ranking from parts 2 through 6 slots in: at LLM scale, debugging sweeps of exactly this kind have been run with TracIn-style checkpoint sums (tracking influence across saved training checkpoints) (Pruthi et al. 2020) and with EK-FAC influence (compressing the model’s curvature so influence is practical to compute) (Grosse et al. 2023), the parts 4 and 5 machinery doing the work at that scale.
Selection: keep the data that helps
Now let the template optimize. Training data is scraped, and scraped data is dreadful: alongside encyclopedias and textbooks come spam farms, garbled OCR, and content mills. If \(\hat{f}\) can predict the test loss a training subset would produce, then choosing training data stops being folklore and becomes step two of the recipe: minimize the substituted objective over subsets (Engstrom, Feldmann, and Madry 2024). That is DsDm’s move (Engstrom et al.’s dataset-selection system) with datamodels, learned functions that predict model behavior from the chosen training subset, as \(\hat{f}\). It is also LESS’s move (Xia et al.’s instruction-tuning selector) for instruction tuning, which fine-tunes a model to follow instructions, using gradient-based influence, an \(\hat{f}\) built from the direction each example pushes the model’s weights (Xia et al. 2024). The ecosystem’s big curation efforts increasingly frame themselves the same way.
The classroom version: keep only \(m\) of the sixty students. Choose them at random, or let attribution choose.
FIG. 3 · THE SELECTION RACE, SIXTY STUDENTS, ONE BUDGET
Keep \(m\) students, retrain, measure the star’s loss: every point on these curves is a real retraining. The band is random selection (twenty draws per budget). The guided curves pick by attribution two ways: rank once and keep the top \(m\), or greedily add one student at a time. They choose almost the same students, with 98% overlap on average across budgets, which is why the curves nearly coincide. The gap is the entire economic argument for this field: at every budget, the model trained on attribution-chosen data beats the average random draw.
Poisoning: the same lever, pulled by an adversary
Read Fig. 1’s selection tab again and notice what it never specified: who is doing the optimizing, and in which direction. Flip the min to a max, hand the choice to someone who can add or alter training data, and the recipe becomes an attack: choose \(S_{adv}\) to maximize the victim’s substituted loss (Biggio, Nelson, and Laskov 2012). It is part 1’s dials one more time, turned by someone else’s hand.
This is not hypothetical: Koh and Liang’s original influence-functions paper closed with exactly this demonstration, visually unremarkable perturbed images, crafted with the part 2 formula, that flip a model’s predictions on chosen targets (Koh and Liang 2017). Part 3’s opening exhibit, an adversarial attack that hid poisoned images inside a CIFAR-10-style classifier, came from the defense literature studying such attacks (Hammoudeh and Lowd 2022).
Defenders fight back with sanitization, filtering or down-weighting the suspicious training points a poisoning search would pick, and the arms race between the two is well documented (Koh, Steinhardt, and Liang 2022).
The classroom shows the asymmetry that makes this matter, at published-concept toy scale:
FIG. 4 · WHY GUIDED ATTACKS ARE THE ONES TO PLAN FOR
Flip \(k\) labels and retrain, all real. Random flips (band: twenty draws) do modest, noisy damage. The same budget aimed by attribution does more at every \(k\), and the gap widens with budget: roughly even at one flip, roughly two and a half times the damage by three, because attribution knows exactly which students the star leans on. The defensive moral: the tools that rank your most valuable data also rank your most attackable data, and defenders should assume attackers can run them too.
Unlearning: subtraction, and where it strains
The last tab is the gentlest-sounding and the hardest. Someone’s data must come out: a deletion request, a discovered corruption, a court order. Retraining from scratch without the forget set \(F\) is the gold standard and costs a full run; the template’s version costs an evaluation: predict what the retrained model would actually do, written \(f(\theta(S \setminus F))\), where \(\theta(S \setminus F)\) means the parameters obtained by really retraining on the data minus the forget set, with the cheap estimate \(\hat{f}(S \setminus F)\) (Guo et al. 2020). For the linear-in-data methods this series built, that prediction is a sum: the forget set’s effect is the sum of its members’ individual effects, a property the field calls additivity.
Part 2 taught when first-order estimates, linear approximations around the trained model, are trustworthy: under small changes near that model. A growing forget set is exactly that trust being spent. The classroom can measure the strain as \(F\) grows:
FIG. 5 · ADDITIVITY EARNS ITS KEEP, THEN STRAINS
Predicted effect of removing a forget set (the sum of its members’ individual leave-one-out effects) against the actual retrained effect, for forget sets of growing size, ten random draws each, all retrained for real. Single removals sit on the line by construction. As the set grows, members interact, with part 1’s overdetermination (several points backing up the same prediction) working in reverse, and the additive prediction drifts. The drift, not the tightness, is the honest headline for unlearning-by-attribution.
Real unlearning research lives in that drift: certified-removal methods bound it with a provable guarantee on how far the edited model can sit from a clean retrain (Guo et al. 2020), benchmark suites measure whether the forgotten data is actually forgotten, and recent work uses attribution itself to decide which retained data protects the capabilities you want to keep (Niu et al. 2025). It is the application where attribution’s promises meet their most demanding auditor, regulation, and where the gap between “estimated” and “certified” matters most.
The adjacent territories
Two applications sit just off the template’s map, and both are moving fast.
Valuation and pricing: if attribution says what each example contributes, someone will eventually attach a price to it. The Shapley branch of part 6 was born for this (Ghorbani and Zou 2019; Wang et al. 2025), and LLM-scale valuation is now a working research program (Choe et al. 2024).
Provenance and copyright: attribution’s corroborative cousin, finding training passages a model’s output echoes, is deployed at real scale. OLMoTrace matches model outputs against trillions of training tokens, live (Liu et al. 2025), and the problem has acquired sharp legal stakes, with careful studies now extracting memorized copyrighted text from open-weight models (Cooper et al. 2025) and from production ones (Ahmed et al. 2026).
The counterfactual methods of this series answer a different, complementary question there: not “does the model contain the book?” but “did the book matter?” That distinction, part 6’s taxonomy applied to a courtroom, may end up being data attribution’s most consequential public appearance.
Are we there? A closing honesty
Part 6 closed on the field’s own sobering survey: practitioners barely know these tools exist (Nguyen et al. 2023). The open bet is whether attribution becomes prescriptive, an optimization tool inside data pipelines, instead of remaining a descriptive report generated after the fact (Ilyas et al. 2024). The applications above are the case for that bet. Fig. 3’s gap is money, Fig. 4’s is risk, and Fig. 5’s drift is compliance. None of them requires believing attribution explains anything metaphysical about learning. They only require the thing this series verified sixty retrainings at a time: the numbers predict. The tooling is young, but the papers below ship code.
Seven posts, one lever
Seven posts ago, this series started with a model that made a strange prediction and a question that sounded almost naive: which training example taught it that? Here is where the question went:
The question was never naive. It was a lever waiting for a place to stand.
Further reading
The applications, canonically
- Engstrom, Feldmann, and Madry, “DsDm: Model-Aware Dataset Selection with Datamodels” (Engstrom, Feldmann, and Madry 2024), and Xia et al., “LESS: Selecting Influential Data for Targeted Instruction Tuning” (Xia et al. 2024). Selection, at scale, both flavors of \(\hat{f}\).
- Koh and Liang (Koh and Liang 2017) for the original guided-poisoning demonstration; Biggio, Nelson, and Laskov (Biggio, Nelson, and Laskov 2012) for the attack’s ancestry; Koh, Steinhardt, and Liang (Koh, Steinhardt, and Liang 2022) for the defense arms race.
- Guo, Goldstein, Hannun, and van der Maaten, “Certified Data Removal from Machine Learning Models” (Guo et al. 2020). Unlearning with guarantees, the standard the estimates chase.
- Choe et al., “What is Your Data Worth to GPT?” (Choe et al. 2024), and Wang et al., “Data Shapley in One Training Run” (Wang et al. 2025). Valuation, both branches.
The reality check
- Nguyen, Kortukov, Song, and Oh, “Exploring Practitioner Perspectives on Training Data Attribution Explanations” (Nguyen et al. 2023). The adoption gap, measured.
- The ICML 2024 tutorial “Data Attribution at Scale” (Ilyas et al. 2024), whose two-step template and four-application framing this post follows, and whose closing bet this series passes along.
References
Reproducibility. Every figure is a real experiment on the series’ classroom, generated by a seeded script in the site repository (scripts/influence-data/): the planted mislabel is verified to surface in the top of both rankings before the page ships; every point on the selection, poisoning, and unlearning figures is an actual retraining, with random baselines averaged over twenty draws for selection and poisoning and ten draws per forget-set size for unlearning. Scale claims are cited, not simulated.
Acknowledgements. This post’s framing of applications as one substitution template follows the ICML 2024 tutorial cited throughout; the series-wide counterfactual framing follows Louis Jaburi’s lecture notes “Data (Attribution) for Alignment” (Iliad Intensive, April 2026).