# Efficient Shapley Values for Attributing Global Properties of Diffusion
Models to Data Groups

Chris Lin, Mingyu Lu11footnotemark: 1, Chanwoo Kim Su-In Lee
Paul G. Allen School of Computer Science & Engineering
University of Washington
<EMAIL_ADDRESS>Equal contribution.

###### Abstract

As diffusion models are deployed in real-world settings, data attribution is
needed to ensure fair acknowledgment for contributors of high-quality training
data and to identify sources of harmful content. Previous work focuses on
identifying individual training samples important for the generation of a
given image. However, instead of focusing on a given generated image, some use
cases require understanding global properties of the distribution learned by a
diffusion model (e.g., demographic diversity). Furthermore, training data for
diffusion models are often contributed in groups rather than separately (e.g.,
multiple artworks from the same artist). Hence, here we tackle the problem of
attributing global properties of diffusion models to groups of training data.
Specifically, we develop a method to efficiently estimate Shapley values by
leveraging model pruning and fine-tuning. We empirically demonstrate the
utility of our method with three use cases: (i) global image quality for a
DDPM trained on a CIFAR dataset, (ii) demographic diversity for an LDM trained
on CelebA-HQ, and (iii) overall aesthetic quality for a Stable Diffusion model
LoRA-finetuned on Post-Impressionist artworks.

##  1 Introduction

Diffusion models have demonstrated impressive performance on image generation
[22, 54], with models such as Dall$\cdot$E 2 [45] and Stable Diffusion [47]
showing versatile utilities and enabling downstream applications via
customization [24, 48]. The training data for diffusion models are often
scraped from the internet [51], raising concerns such as copyright
attribution, harmful content generation [3], and bias propagation [40]. Data
attribution, which aims to trace machine learning model behaviors back to
training data, has the potential to address these issues. Indeed, in the
context of supervised learning, data attribution methods have already been
used to valuate data [14], identify adversarial samples [33], and discover
similar data points [26].

Some recent work has developed data attribution methods for diffusion models
[7, 13, 60, 63]. These methods focus on local properties related to the
generation of a given image and aim to identify important individual training
data. For example, Zheng et al. [63] showcase their method D-TRAK to study the
changes in pixel values of particular generated images and find influential
training samples. However, some use cases require understanding data’s
influence on global model properties, which are related to the overall
generative distribution of a diffusion model. For example, the demographic
diversity of generated images can be considered a global property [40], and
attributing this property to training data can help us identify pontential
sources of social biases in diffusion models. Furthermore, data for training
diffusion models are often contributed in groups instead of separately, with
each group corresponding to an entity of ownership (e.g., artworks by an
artist; or images portraying a public figure). Therefore, here we address the
problem of attributing global properties of diffusion models to groups of
training data.

While diffusion models are increasingly monetized and groups of data can often
correspond to copyright ownerships [50], attribution methods based on
cooperative game theory are desirable because of their axiomatic
justification. Particularly, the Shapley value provides a principled approach
to fairly distribute monetary gains among contributors, since it is the unique
notion that satisfies the four axioms for equitable valuation: linearity,
dummy player, symmetry, and efficiency (see Section 3.1 for details) [14, 52].
Briefly, the Shapley value assesses each contributor based on the average gain
incurred by adding the contributor to different contributor combinations. To
estimate the Shapley values for data groups in our setting, we need to (i)
retrain diffusion models on different subsets of groups; and (ii) measure
global properties of the retrained models by running inference. However,
training a diffusion model can take hundreds of GPU days, and inference can
also be expensive (e.g., approximately 5 GPU days to generate 50,000 images
for image quality metrics) [9]. Therefore, estimating Shapley values with
vanilla retraining and inference is computationally impractical. Here, we
propose to approximate retraining and retrained inference through model
pruning and fine-tuning, thus enabling efficient Shapley value estimation
(Figure 1).

Figure 1: Schematic overview of our proposed method, where $\theta^{*}$
denotes a trained diffusion model that we aim to understand, and
$\tilde{\theta}^{*}$ denotes the pruned model that approximates $\theta^{*}$.
After fine-tuning the pruned model on varying subsets of data groups, global
model properties ($\mathcal{F}$) are measured on the fine-tuned models to
estimate the Shapley value for each group of data.

Related work. The distinction between local and global model properties for
supervised learning has been discussed in Covert et al. [6]. Here, this
distinction is extended to generative models, where local properties
correspond to a particular generated image, and global properties relate to
the overall distribution learned by a generative model. The practical
implications of group attribution have been discussed in the context of
supervised learning [34].

Data attribution methods for diffusion models have been developed by recent
work. Some methods require the models that we aim to understand be trained
with specialized paradigms. For example, to assess the importance for a
training sample, Dai and Gifford [7] first train an ensemble of diffusion
models on data splits, followed by ablating models trained on splits
containing the specific sample. Wang et al. [60] evaluate data attribution for
text-to-image models by customizing a pretrained model toward an exemplar
style. In contrast, other methods can be applied to already trained models.
For example, the TRAK framework has been adapted to find important training
data for intermediate latents along a generative process [13], while Zheng et
al. [63] introduce empirical approaches that improve the performance of TRAK
for diffusion models. All these methods attribute local model properties to
individual data points, whereas our work focuses on attributing global model
properties to data groups.

Contributions. (1) To our knowledge, we are the first to investigate how
groups of training data influence global properties of diffusion models. (2)
We propose a method that efficiently estimates group-level Shapley values for
attributing global model properties, leveraging model pruning and fine-tuning.
(3) We empirically demonstrate that our method outperforms existing
attribution methods across three datasets, model architectures, and global
properties.

##  2 Preliminaries

This section provides an overview for diffusion models, global model property,
group attribution, and existing attribution methods for diffusion models.

###  2.1 Diffusion Models

Our research primarily focuses on discrete-time diffusion models, specifically
denoising diffusion probabilistic models (DDPMs) [22] and latent diffusion
models (LDMs) [47]. Generally, diffusion models are trained to approximate a
data distribution $q({\mathbf{x}}_{0})$. To perform learning, a training
sample ${\mathbf{x}}_{0}\sim q({\mathbf{x}}_{0})$ is sequentially corrupted by
additive noise [22]. This procedure is called the forward process and is
defined by
$q({\mathbf{x}}_{t}|{\mathbf{x}}_{t-1}):=\mathcal{N}({\mathbf{x}}_{t};\sqrt{1-\beta_{t}}{\mathbf{x}}_{t-1},\beta_{t}{\bm{I}})$,
for $t=1,...,T$, where $\\{\beta_{t}\\}_{t=1}^{T}$ corresponds to a variance
schedule. Notably, the forward process allows sampling of ${\mathbf{x}}_{t}$
at any time step $t$ from ${\mathbf{x}}_{0}$, with the closed form
$q({\mathbf{x}}_{t}|{\mathbf{x}}_{0})=\mathcal{N}({\mathbf{x}}_{t};\sqrt{\bar{\alpha}_{t}}{\mathbf{x}}_{0},(1-\bar{\alpha}_{t}){\bm{I}})$,
where $\alpha_{t}:=1-\beta_{t}$ and
$\bar{\alpha}_{t}:=\prod_{s=1}^{t}\alpha_{s}$. Then, a diffusion model learns
to denoise ${\mathbf{x}}_{1:T}$, following the reverse process defined by
$p_{\theta}({\mathbf{x}}_{t-1}|{\mathbf{x}}_{t}):=\mathcal{N}({\mathbf{x}}_{t-1};\mu_{\theta}({\mathbf{x}}_{t},t),\sigma_{t}^{2}{\bm{I}})$,
where $\theta\in\mathbb{R}^{d}$ is the model parameters, and $\sigma_{t}$
corresponds to some sampling schedule [32]. Instead of modeling the
conditional means $\mu_{\theta}$, it is standard to predict the added noises
with a neural network $\epsilon_{\theta}$ using the reparameterization trick.
The training objective corresponds to a variational bound and is formulated as

$\mathcal{L}_{\text{Simple}}=\mathbb{E}_{t,\epsilon}\left[\|\epsilon-\epsilon_{\theta}(\sqrt{\bar{\alpha}_{t}}x+\sqrt{(1-\bar{\alpha}_{t})}\epsilon,t)\|^{2}_{2}\right]$
(1)

Once a diffusion model has been trained, a new image can be generated by
sampling an initial noise
${\mathbf{x}}_{T}\sim\mathcal{N}(\mathbf{0},{\bm{I}})$ and iteratively
applying $\epsilon_{\theta}$ at each step $t=T,...,1$ for denoising. In
practice, the denoising process has various design choices, such as the number
of inference time steps and output scaling [53, 54, 32]. Building upon
diffusion models, LDMs [47] perform the stochastic process in the latent space
of a pretrained encoder network. Additionally, it has been shown that one can
condition diffusion models on additional information, such as a text prompt,
allowing for explicit control over the semantics of the generated images
through textual guidance [47].

###  2.2 Global Model Behavior

To gain a comprehensive understanding of machine learning models, it is often
beneficial to study global model properties [6], which assess the model’s
performance across samples, rather than focusing on individual outputs. For
example, in the setting of supervised learning, global model property can be
test accuracy. In the context of generative models, it can be a quality metric
for generated samples. For example, in image generation, the global model
property of interest can the Inception Score [16] or FID [21]. More formally,
a global model property for generative models is defined by any user-specified
function $\mathcal{F}:\Theta\rightarrow\mathbb{R}$, which maps a generative
model to a scalar value, thereby quantifying the overall distribution learned
by the model.

Building on this, we introduce the problem of group attribution for global
model properties. Similar to individual data attribution for local model
properties [43, 63, 14], the goal of group attribution is to identify
important groups of training data for a model’s global properties. Formally,
we have the following definition.

###### Definition 1

Consider $n$ groups of training samples
$\mathcal{D}=\cup\\{\mathcal{D}_{i}\\}_{i=1}^{n}$ and a global model output
function $\mathcal{F}$. A group attribution method is a function
$\tau(\theta,\mathcal{F},\\{\mathcal{D}_{i}\\}_{i=1}^{n})$ that, given a model
$\theta$, assigns a score to each training group $\mathcal{D}_{i}$ to indicate
its importance to the global model output $\mathcal{F}$.

###  2.3 Attribution Methods for Diffusion Models

In the context of diffusion models, recent works have largely focused on local
data attribution using TRAK [43], such as D-TRAK [63] and Journey-TRAK [13].
Generally, given a loss function $\mathcal{L}$ and models
$\\{\theta^{*}_{s}\\}_{s=1}^{S}$ trained on $S$ data subsets, TRAK is defined
as below:

$\frac{1}{S}\sum_{s=1}^{S}\phi^{s}(x)^{\mathsf{T}}\cdot\left({\Phi_{\text{TRAK}}^{s}}^{\mathsf{T}}\cdot\Phi_{\text{TRAK}}^{s}+\lambda
I\right)^{-1}{\Phi_{\text{TRAK}}^{s}}^{\mathsf{T}}$ (2)
$\displaystyle{\Phi_{\text{TRAK}}^{s}}=\left[\phi^{s}(x^{1}),\ldots,\phi^{s}(x^{n})\right]^{\mathsf{T}}\text{
, where
}\phi^{s}(x)=\mathcal{P}^{\mathsf{T}}_{s}\nabla_{\theta}\mathcal{L}(x,\theta_{s}^{*})$
(3)

where $\mathcal{P}_{s}$ is a random projection matrix. Building on this
framework, Journey-TRAK [13] attributes training data not only for the final
sample $x$ but also for the noisy samples along the denoising process.
Intriguingly, Zheng et al. [63] discover that replacing the loss function
$\mathcal{L}_{\text{Simple}}$ with alternative functions results in superior
performance.

While TRAK-based approaches for diffusion models are considered
computationally efficient, they have several limitations. One key drawback is
that their model property is confined to variants of the diffusion loss [63,
13], which can restrict their broader application. For example, some global
model properties such as the distribution of cluster assignments [40] are not
differentiable, making the gradient computations in TRAK infeasible. This
highlights the need for developing another approach that can handle
attribution for global model properties.

##  3 Group Attribution in Diffusion Models with the Shapley Value

In this section, we review the Shapley value and propose an efficient method
to estimate Shapley values for diffusion models through model pruning and
fine-tuning.

###  3.1 Shapley Attribution

The Shapley value was developed in cooperative game theory to fairly attribute
credits in coalition games [52]. More formally in the context of group
attribution, for training data with $n$ groups, the Shapley value for a data
group $\mathcal{D}_{i}$ is defined as:

$\beta_{i}:=\frac{1}{n}\sum_{S\subseteq
D\setminus\\{\mathcal{D}_{i}\\}}{\binom{n-1}{|S|}}^{-1}(\mathcal{F}(\theta_{S\cup\\{\mathcal{D}_{i}\\}})-\mathcal{F}(\theta_{S}))$
(4)

where $S$ is a subset of training data groups
$\\{\mathcal{D}_{1},\cdots,\mathcal{D}_{n}\\}$ and $\mathcal{F}(\theta_{S})$
is the model property of a diffusion model trained on $S$. Shapley value
assesses each group’s contribution based on the weighted marginal
contribution,
$\mathcal{F}(\theta_{S\cup\\{\mathcal{D}_{i}\\}})-\mathcal{F}(\theta_{S})$. It
satisfies axioms desirable for equitable attribution, including linearity,
dummy player, symmetry, and efficiency [14]. There are arguments that the
efficiency axiom,
$\sum_{i=1}^{n}{\beta_{i}}=\mathcal{F}(\theta^{*})-\mathcal{F}(\theta_{\emptyset})$,
where $\theta^{*}$ denotes the model trained on the entire dataset, may not
always be essential in use cases where the primary goal is to remove
detrimental data points [59]. In this setting, ranking is more important than
exact importance values for removing such data points. However, in the context
of generative models, particularly in applications involving monetary or
credit allocation of some meaningful global model behavior measures, ensuring
that the aggregate attribution of the data matches the total utility is
crucial.

Despite its advantages, evaluating the Shapley value is challenging as it
involves training $2^{n}$ (all possible subsets) models and computing their
corresponding model behavior. Fortunately, many sampling-based estimators for
Shapley values have been developed [41, 14, 56]. In particular, we can adopt
KernelSHAP in the feature attribution literature for data attribution as an
alternative by solving a weighted least squares problem with sampling [41, 5]:

$\hat{\beta}=\min_{\beta_{0},\ldots,\beta_{n}}\frac{1}{M}\sum_{i=1}^{M}\left(\mathcal{F}(\theta_{0})+\mathbf{1}_{S_{i}}^{\mathsf{T}}\beta-\mathcal{F}(\theta_{S_{i}})\right)^{2}\quad\text{s.t.}\quad\mathbf{1}^{\mathsf{T}}\beta=\mathcal{F}(\theta^{*})-\mathcal{F}(\theta_{0})$
(5)

where $S_{i}$ is sampled following the distribution
$\mu_{Sh}(S)\propto\frac{n-1}{\binom{n}{|S|}|S|(n-|S|)}$ for
$1<\mathbf{1}_{S_{i}}^{\mathsf{T}}\beta<n$; $\mathbf{1}_{S_{i}}$ is an
indicator vector representing the presence of data group in $S_{i}$; and
$\theta_{\emptyset}$ is a randomly initialized model without training. By
solving the least squares problem with the constraint via KKT conditions, a
closed-form solution can be derived [5]. The obtained parameters $\hat{\beta}$
are the attribution scores.

###  3.2 Speed Retraining and Inference with Sparsified Fine-Tuning

While Equation (5) effectively reduces the number of diffusion models needed
for Shapley value estimation, obtaining an adequate number of retrained models
$\theta_{S_{i}}$ remains a challenge. The retraining time for models scales
linearly with the number of sampled subsets, $S_{i}$, and the training
duration for each diffusion model can be as large as hundred of GPU days [9].
To further decrease the computational burden needed to obtain
$\theta_{S_{i}}$, we propose a novel yet simple technique: removal through
sparsified fine-tuning (Figure 1).

Specifically, our approach aims to approximate a model retrained with a subset
$S_{i}$ by fine-tuning the model $\theta^{*}$ on the subset $S_{i}$ but with
only a update steps. We also combine fine-tuning with model pruning using the
prune first, then unlearn paradigm [29], leveraging model sparsity to make a
more efficient approximation to retraining. We first perform pruning on
$\theta^{*}$ and initially fine-tune it with $\mathcal{D}$ to obtain a
performant pruned model, $\tilde{\theta}^{*}$. Second, to obtain
$\tilde{\theta}_{S_{i}}$, we apply fine-tuning [15, 57] on the subset $S_{i}$
with the original diffusion loss, $\mathcal{L_{\text{Simple}}}$ [22].

$\tilde{\theta}_{S_{i}}=\text{argmin}_{\theta}\mathcal{L}(\tilde{\theta}^{*},S_{i})\quad
s.t.\quad\mathcal{F}(\tilde{\theta}_{S_{i}})\textit{ (fine-
tuning)}\approx\mathcal{F}(\theta_{S_{i}})\textit{ (retraining from scratch)}$
(6)

By replacing $\theta_{S_{i}}$ with $\tilde{\theta}_{S_{i}}$ through the
combined process of pruning and fine-tuning, we can drastically reduce the
computational cost for obtaining $\tilde{\theta}_{S_{i}}$ and
$\mathcal{F}(\tilde{\theta}_{S_{i}})$, expediting the removal-based
attribution process of the Shapley value. In other words, under the same
computational budget, compared to retaining, our proposed approach
significantly increases the number of sampled $S_{i}$ for estimating Eq. 5,
thereby making the Shapley value feasible and practical for diffusion models.

##  4 Experiments

In this section, we compare our approach with existing attribution methods
across various settings. We employ two primary metrics for evaluation: LDS and
counterfactual analysis. Our findings demonstrate that our method
significantly outperforms existing techniques in terms of efficacy.

###  4.1 Datasets

Datasets used for our experiments include CIFAR-20 (a subset of CIFAR-100),
with 20 classes considered as groups for attribution; CelebA-HQ, with 50
celebrity identities considered as groups for attribution; and ArtBench (Post-
Impressionism), with 258 artists considered as groups for attribution. More
details about datasets can be found in Appendix A.

###  4.2 Setup for diffusion models

Model training. For CIFAR, we follow the original implementation of the
unconditional DDPMs [22] where the model has 35.7M parameters (i.e.,
$d=35.7\times 10^{6}\text{ for }\theta\in\mathbf{R}^{d})$. For CelebA-HQ, we
follow the implementation of LDM [47] with 274M parameters and a pre-trained
VQ-VAE[46]. For both datasets, the maximum timestep is set to $T=1000$ during
training, with a linear variance schedule for the forward diffusion process
ranging from $\beta_{1}=10^{-4}$ to $\beta_{T}=0.02$. We use the Adam
optimizer [39] and apply random horizontal flipping for data augmentation.
Both the DDPM and LDM are trained for 20,000 steps with a batch size of 64 and
a learning rate of $10^{-4}$. During inference, images are generated using the
100-step DDIM solver [53]. For ArtBench (Post-Impressionism), the Stable
Diffusion model [47] is fine-tuned using LoRA [24] with rank $=$ 256,
corresponding to 5.1M LoRA parameters. The prompt is set to “a Post-
Impressionist painting"" for each image. The model is trained using the AdamW
optimizer [39] with a weight decay of $10^{-6}$, for 200 epochs and a batch
size of 64. Cosine learning rate annealing is used, with 500 warm-up steps and
an initial learning rate of $3\times 10^{-4}$. At inference time, images are
generated using the PNDM scheduler with 100 steps [32].

Setup for pruning and fine-tuning. Magnitude-based pruning [19] is used remove
model weights according to their magnitudes, resulting in sparse diffusion
models with reduced parameters: from 35.7M to 19.8M for CIFAR-20 at a pruning
ratio of 0.3, from 274M to 70.9M for CelebA-HQ at a ratio of 0.5, and from
5.1M to 2.6M for ArtBench (Post-Impressionism). To estimate Shapley values,
the sparsified models are fine-tuned on subsets of data groups with 1,000
steps for CIFAR-20, 500 steps for CelebA-HQ, and 200 steps for ArtBench (Post-
Impressionism).

Global model properties. For CIFAR-20, we aim to study which image classes
contribute to overall image quality. Therefore, 10,240 samples are generated
to compute the Inception Score (IS)111https://github.com/sbarratt/inception-
score-pytorch[49], defined as:

$\text{IS}=\exp\left(\mathbb{E}_{x}[\text{KL}(p(y|x)\|p(y))]\right)$ (7)

where $p(y)$ represents the marginal class distribution over the generated
data and $p(y|x)$ represents the conditional class distribution given a
generated image $x$.

For CelebA-HQ, our goal is to investigate which celebrities contribute to
demographic diversity. First, we generate 1,024 samples from the model trained
using the full dataset. Following [40], we apply BLIP-
VQA222https://huggingface.co/Salesforce/blip-vqa-base[36] to extract image
embeddings, which are then clustered into 20 distinct groups using the Ward
linkage criterion [28], representing groups with demographic characteristics.
Subsequently, for models trained on different subsets of celebrities, we also
generate 1,024 samples, cluster them into those 20 clusters, and compute the
entropy as a diversity measure:

$\mathcal{H}=-\sum_{i=1}^{n}p_{i}\log(p_{i})$ (8)

where $p_{i}$ is the proportion of samples in the $i$-th cluster.

For ArtBench (Post-Impressionism), we consider the use case where images are
generated and the most aesthetically pleasing ones are kept. We simulate this
use case by computing aesthetic scores333https://github.com/LAION-
AI/aesthetic-predictor for 50 generated images and considering the 90th
percentile as the global model property.

###  4.3 Evaluating Group Attribution

Linear datamodeling score (LDS). From definition 1, for a given subset
$S\subset\mathcal{D}$, we can define an additive model of global properties
based on group attribution as follow:

$g(S,\tau):=\sum_{i:\mathcal{D}_{i}\in S}\tau_{i}$ (9)

Therefore, the evaluation for an attribution method $\tau$ can be constructed
as follows:

###### Definition 2

(Linear Datamodeling Score) Group attribution performance is measured using
the linear datamodeling score (LDS) [26], which evaluates an attribution
method by comparing linearly predicted model behaviors against actual
retrained model behaviors. Let $S_{1},\ldots,S_{K}$ be $K$ randomly sampled
subsets of the training set, each of size $\alpha\cdot n$ for some
$\alpha\in(0,1)$. The LDS for a group attribution score
$\tau\in{\mathbb{R}}^{n}$ is defined as

$LDS:=\rho\left(\\{\mathcal{F}(\theta_{S_{j}})\\}_{j=1}^{K},\\{g_{\tau}(S_{j},\tau)\\}_{j=1}^{K}\right),\text{
where }S_{j}\sim\text{Uniform}\\{S\subset\mathcal{D}:|S|=\alpha\cdot n\\}.$
(10)

where $\rho$ is the Spearman rank correlation [55], and $\theta_{S_{j}}$
denotes a model retrained from scratch with the group subset $S_{j}$.

We evaluate the LDS using 100 held-out subsets $S_{j}$, each sampled from the
datamodel distribution with $\alpha=0.25,0.5,0.75$ for each dataset, and
calculate the corresponding global model behavior. We report the mean and the
95% confidence interval of the LDS scores across these experiments. We
compared methods whtin three categories including similarity-based
(baselines), TRAK-based (TRAKs), and our Shapley-based approach. More details
about baseline methods444TracIn is not considered because intermediate model
checkpoints may not always be available in practice. can be found in Appendix
C.1.

For TRAK-based methods and gradient similarity, we compute gradients and
kernel2 using the final model checkpoint, meaning that $S=1$ in Eq (2). In
TRAK-based approaches, we select 100 timesteps evenly spaced within the
interval $[1,T]$. For instance, for 100 timesteps, the selected timesteps are
$\\{1,11,21,\ldots,991\\}$. At each timestep, we introduce one standard
Gaussian noise. The projection dimensions are set at $k=4096$ for CIFAR-20 and
$k=32768$ for CelebA and ArtBench. For D-TRAK, we adopt the best-performing
model output function $\nabla_{\theta}\mathcal{L}_{\text{Square}}$ and choose
$\lambda=5e^{-1}$ as in [63].

Counterfactual Evaluation. Following [63], we also apply the counterfactual
evaluation [23]. We assess the change in model behavior,
$\Delta\mathcal{F}=\frac{\mathcal{F}(\theta^{*}_{k})-\mathcal{F}(\theta^{*})}{\mathcal{F}(\theta^{*})}$,
by comparing the models trained before and after excluding the highest-ranked
positive influential groups identified by different attribution methods. For
this evaluation, we only choose the best-performing methods within baselines
and TRAKs and perform top 40% removal. For CIFAR-20 and CelebA-HQ, models are
retrained without the top influential groups with 10 random initializations.
For ArtBench (Post-Impression), 5 models are retrained with different
initializations.

###  4.4 Experiment Results

#### Shapley Attribution Outperforms TRAKs in Global Model Behavior

In Table 1, we present the LDS scores for baselines, TRAKs, and our method.
Interestingly, similarity-based methods such as raw pixel, CLIP score, and
gradient (without kernel) occasionally outperform TRAKs. We observe that TRAKs
sometimes yield poor or even negative correlations when the model behavior
$\mathcal{F}$ is not directly linked to $\nabla_{\theta}\mathcal{L}$. Among
TRAK-based approaches, attributing training samples using noisy latent
(Journey-TRAK) during generation can result in an reverse attribution score in
model behavior such as inception score and aesthetic score. Our findings
suggest that when model behavior is not easily differentiable, using diffusion
loss and its alternative functions, e.g. $\mathcal{L}_{\text{Square}}$, can
lead to poor correlations and even result in reverse attribution.

On the other hand, our approach calculates group attributions using Shapley
value with Equation 4 for each training sample, achieving the highest LDS
scores of 61.48%, 26.34% , and 61.44% for CIFAR-20, CelebA-HQ, and ArtBench,
respectively. This shows that attributing training samples based on their
marginal contribution with respect to $\mathcal{F}$ provides the most accurate
importance score. For, CelebA-HQ, the overall lower LDS scores are expected
due to the relatively small differences in the diversity score (entropy),
suggesting that more instances may be needed to accurately compute Shapley
values.

We compare the performance of attribution methods across varying subset sizes
($\alpha=0.25,0.5,0.75$) in Appendix D. Although our approach consistently
outperforms others, its performance decreases when the number of samples in
$S$ is small ($\alpha=0.25$). This suggests that when training with very few
data points (groups), the model may demonstrate different model behavior [30],
or there could be non-linear interactions affecting attribution scores.

Table 1: LDS (%) results with $\alpha=0.5$. Means and 95% confidence intervals
across three random initializations are reported.
Method | CIFAR-20 | CelebA-HQ |  ArtBench (Post-Impressionism)
---|---|---|---
Pixel similarity (average) | -11.81 $\pm$ 4.56 | -8.91 $\pm$ 0.93 | 11.24 $\pm$ 0.63
Pixel similarity (max) | -31.80 $\pm$ 2.90 | 21.70 $\pm$ 2.05 | 14.61 $\pm$ 2.72
Embedding dist. (average) | - | 13.83 $\pm$ 1.12 | -
Embedding dist. (max) | - | 7.32 $\pm$ 3.16 | -
CLIP similarity (average) | 5.79 $\pm$ 3.67 | -32.23 $\pm$ 0.87 | -6.96 $\pm$ 4.08
CLIP similarity (max) | 11.31 $\pm$ 0.37 | -0.93 $\pm$ 3.83 | -1.75 $\pm$ 4.07
Gradient similarity (average) | 5.79 $\pm$ 3.67 | 25.93 $\pm$ 2.94 | 0.25 $\pm$ 1.18
Gradient similarity (max) | -0.89 $\pm$ 3.17 | 15.88 $\pm$ 5.98 | 10.48 $\pm$ 3.11
Aesthetic score (average) | - | - | 24.85 $\pm$ 2.30
Aesthetic score (max) | - | - | 21.36 $\pm$ 3.70
Relative IF | 5.23 $\pm$ 5.50 | 12.65 $\pm$ 3.43 | -5.02 $\pm$ 1.77
Renormalized IF | 11.39 $\pm$ 6.79 | 9.22 $\pm$ 3.59 | -11.41 $\pm$ 0.93
TRAK | 7.94 $\pm$ 5.67 | 9.85 $\pm$ 3.62 | -8.18 $\pm$ 1.30
Journey-TRAK | -42.92 $\pm$ 2.15 | 0.80 $\pm$ 4.98 | -11.41 $\pm$ 4.22
D-TRAK | 10.90$\pm$ 1.21 | -18.83 $\pm$ 2.12 | 11.30 $\pm$ 3.47
Sparsified-FT Shapley (Ours) | 61.48 $\pm$ 2.27 | 26.34 $\pm$ 3.42 | 61.44 $\pm$ 2.04

#### Enhancing Fine-Tuning Efficiency Through Sparsification

Our sparsified fine-tuning approach significantly reduces the time required to
compute $\theta_{S_{i}}$ compared to retraining, it is $5.3$ and $10.4$ times
faster for CIFAR-20 and CelebA-HQ, respectively (Table 2). By enabling faster
computation and obtaining more subset models, $\tilde{\theta}_{S_{i}}$,
sparsified fine-tuning further enhances LDS. As shown in Figure 2, under the
same computational budgets, sparsified fine-tuning yields the best LDS.

(a) CIFAR-20

(b) CelebA-HQ

(c) ArtBench
(Post-Impressionism)

Figure 2: Comparison of LDS (%) with $\alpha=0.5$ among Shapley values
estimated with sparsified fine-tuning (FT), fine-tuning (FT), and retraining
under the same computational budgets (1 unit $=$ runtime to retrain and run
inference on a full model). Figure 3: Relative percentage changes in global
model properties, comparing the original fully trained models and models
trained with the top 40% most important groups removed based on different
attribution methods.

#### Counterfactaul Evaluation

To further evaluate the attribution methods, we analyzed model behavior
changes after removing the top influencers identified by each method. In the
CIFAR-20 dataset, our approach showed changes of -23.44%, compared to -15.12%
for CLIP similarity and -8.62% for D-TRAK, as shown in Figure 4 (Top). For
CelebA-HQ, the changes were -7.92% for our method, -7.29% for gradient
similarity, and +2.55% for relative IF. Additionally, we compared generated
samples across retrained models for each method (Figure 4 and Figure 5). As
shown in Figure 4, we visually note that for TRAK and CLIP score, automobiles
are retrained, whereas our approach removes automobiles, suggesting that
automobiles may have a significant impact on the Inception Score.

(a) Sparsified-FT Shapley

(b) D-TRAK

(c) CLIP Similarity (Max)

Figure 4: Images generated with the same initial noises for DDPMs trained
without the top 40% most important CIFAR-20 classes based on sparsified-FT
Shapley, D-TRAK, and CLIP similarity (max). Figure 5: Two generated images
above and two generated images below the 90th percentile of aesthetic scores,
for Stable Diffusion models LoRA-finetuned without the top 40% most important
artists based on D-TRAK, pixel similarity (max), training image aesthetic
score (average), and sparsified-FT Shapley.

##  5 Discussion

In this work, we introduce the problem of attributing global model properties
to groups of training data in the context of diffusion models. We develop an
efficient method to estimate group-level Shapley values, leveraging model
pruning and fine-tuning to speed up retraining and inference runtime compared
to naive retraining. Empirical results across multiple datasets and global
model properties demonstrate that our method outperforms existing attribution
methods for diffusion models. There are several directions for future work.
First, beyond fine-tuning, the field of machine unlearning offers other
methods such as gradient ascent and influence unlearning to approximate exact
retraining [17, 27, 57]. There are also recent unlearning methods tailored for
diffusion models [12, 20]. Exploring the design space of combining these
methods with various pruning strategies [10, 11, 38] can be fruitful. Second,
it can be useful to allocate group-level importance to individual data points
within each group, providing two-level attributions. The Owen value, which
modifies the Shapley value, is well suited for this scenario [42]. Finally,
our method and existing attribution methods for diffusion models assume access
to training data and model parameters, which are not necessarily available for
deployed models. For vision-to-image models, membership inference and in-
context learning may be useful in addressing this issue [25, 61].

## References

  * Barshan et al. [2020] Elnaz Barshan, Marc-Etienne Brunet, and Gintare Karolina Dziugaite.  Relatif: Identifying explanatory training samples via relative influence.  In _International Conference on Artificial Intelligence and Statistics_ , pages 1899–1909. PMLR, 2020.
  * Basu et al. [2020] Samyadeep Basu, Philip Pope, and Soheil Feizi.  Influence functions in deep learning are fragile.  _arXiv preprint arXiv:2006.14651_ , 2020.
  * Birhane et al. [2021] Abeba Birhane, Vinay Uday Prabhu, and Emmanuel Kahembwe.  Multimodal datasets: misogyny, pornography, and malignant stereotypes.  _arXiv preprint arXiv:2110.01963_ , 2021.
  * Charpiat et al. [2019] Guillaume Charpiat, Nicolas Girard, Loris Felardos, and Yuliya Tarabalka.  Input similarity from the neural network perspective.  _Advances in Neural Information Processing Systems_ , 32, 2019.
  * Covert and Lee [2021] Ian Covert and Su-In Lee.  Improving KernelSHAP: Practical Shapley value estimation using linear regression.  In _International Conference on Artificial Intelligence and Statistics_ , pages 3457–3465. PMLR, 2021.
  * Covert et al. [2020] Ian Covert, Scott Lundberg, and Su-In Lee.  Feature removal is a unifying principle for model explanation methods.  _arXiv preprint arXiv:2011.03623_ , 2020.
  * Dai and Gifford [2023] Zheng Dai and David K Gifford.  Training data attribution for diffusion models.  _arXiv preprint arXiv:2306.02174_ , 2023.
  * Dettmers et al. [2022] Tim Dettmers, Mike Lewis, Sam Shleifer, and Luke Zettlemoyer.  8-bit optimizers via block-wise quantization.  In _The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022_. OpenReview.net, 2022.  URL https://openreview.net/forum?id=shpkpVXzo3h.
  * Dhariwal and Nichol [2021] Prafulla Dhariwal and Alexander Nichol.  Diffusion models beat gans on image synthesis.  _Advances in neural information processing systems_ , 34:8780–8794, 2021.
  * Ding et al. [2019] Xiaohan Ding, Guiguang Ding, Yuchen Guo, and Jungong Han.  Centripetal sgd for pruning very deep convolutional networks with complicated structure.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 4943–4953, 2019.
  * Fang et al. [2024] Gongfan Fang, Xinyin Ma, and Xinchao Wang.  Structural pruning for diffusion models.  _Advances in neural information processing systems_ , 36, 2024.
  * Gandikota et al. [2023] Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau.  Erasing concepts from diffusion models.  _arXiv preprint arXiv:2303.07345_ , 2023.
  * Georgiev et al. [2023] Kristian Georgiev, Joshua Vendrow, Hadi Salman, Sung Min Park, and Aleksander Madry.  The journey, not the destination: How data guides diffusion models.  _arXiv preprint arXiv:2312.06205_ , 2023.
  * Ghorbani and Zou [2019] Amirata Ghorbani and James Zou.  Data shapley: Equitable valuation of data for machine learning.  In _International conference on machine learning_ , pages 2242–2251. PMLR, 2019.
  * Golatkar et al. [2020] Aditya Golatkar, Alessandro Achille, and Stefano Soatto.  Eternal sunshine of the spotless net: Selective forgetting in deep networks.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 9304–9312, 2020.
  * Goodfellow et al. [2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ , 2014.
  * Graves et al. [2021] Laura Graves, Vineel Nagisetty, and Vijay Ganesh.  Amnesiac machine learning.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 35, pages 11516–11524, 2021.
  * Hammoudeh and Lowd [2022] Zayd Hammoudeh and Daniel Lowd.  Identifying a training-set attack’s target using renormalized influence estimation.  In _Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security_ , pages 1367–1381, 2022.
  * Han et al. [2015] Song Han, Jeff Pool, John Tran, and William Dally.  Learning both weights and connections for efficient neural network.  _Advances in neural information processing systems_ , 28, 2015.
  * Heng and Soh [2023] Alvin Heng and Harold Soh.  Selective amnesia: A continual learning approach to forgetting in deep generative models.  _arXiv preprint arXiv:2305.10120_ , 2023.
  * Heusel et al. [2017] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter.  Gans trained by a two time-scale update rule converge to a local nash equilibrium.  _Advances in neural information processing systems_ , 30, 2017.
  * Ho et al. [2020] Jonathan Ho, Ajay Jain, and Pieter Abbeel.  Denoising diffusion probabilistic models.  _Advances in neural information processing systems_ , 33:6840–6851, 2020.
  * Hooker et al. [2019] Sara Hooker, Dumitru Erhan, Pieter-Jan Kindermans, and Been Kim.  A benchmark for interpretability methods in deep neural networks.  _Advances in neural information processing systems_ , 32, 2019.
  * Hu et al. [2021] Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen.  Lora: Low-rank adaptation of large language models.  _arXiv preprint arXiv:2106.09685_ , 2021.
  * Hu and Pang [2023] Hailong Hu and Jun Pang.  Membership inference of diffusion models.  _arXiv preprint arXiv:2301.09956_ , 2023.
  * Ilyas et al. [2022] Andrew Ilyas, Sung Min Park, Logan Engstrom, Guillaume Leclerc, and Aleksander Madry.  Datamodels: Predicting predictions from training data.  _arXiv preprint arXiv:2202.00622_ , 2022.
  * Izzo et al. [2021] Zachary Izzo, Mary Anne Smart, Kamalika Chaudhuri, and James Zou.  Approximate data deletion from machine learning models.  In _International Conference on Artificial Intelligence and Statistics_ , pages 2008–2016. PMLR, 2021.
  * Jh Jr [1963] Ward Jh Jr.  Hierarchical grouping to optimize an objective function.  _J. Amsr. Statis. Assoc._ , 58:236–244, 1963.
  * Jia et al. [2023] Jinghan Jia, Jiancheng Liu, Parikshit Ram, Yuguang Yao, Gaowen Liu, Yang Liu, Pranay Sharma, and Sijia Liu.  Model sparsity can simplify machine unlearning.  In _Annual Conference on Neural Information Processing Systems_ , 2023.
  * Kadkhodaie et al. [2023] Zahra Kadkhodaie, Florentin Guth, Eero P Simoncelli, and Stéphane Mallat.  Generalization in diffusion models arises from geometry-adaptive harmonic representation.  _arXiv preprint arXiv:2310.02557_ , 2023.
  * Karras et al. [2018] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen.  Progressive growing of gans for improved quality, stability, and variation.  In _6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings_. OpenReview.net, 2018.  URL https://openreview.net/forum?id=Hk99zCeAb.
  * Karras et al. [2022] Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine.  Elucidating the design space of diffusion-based generative models.  _Advances in Neural Information Processing Systems_ , 35:26565–26577, 2022.
  * Koh and Liang [2017] Pang Wei Koh and Percy Liang.  Understanding black-box predictions via influence functions.  In _International conference on machine learning_ , pages 1885–1894. PMLR, 2017.
  * Koh et al. [2019] Pang Wei W Koh, Kai-Siang Ang, Hubert Teo, and Percy S Liang.  On the accuracy of influence functions for measuring group effects.  _Advances in neural information processing systems_ , 32, 2019.
  * Krizhevsky et al. [2009] Alex Krizhevsky, Geoffrey Hinton, et al.  Learning multiple layers of features from tiny images.  2009\.
  * Li et al. [2022] Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi.  Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation.  In _International conference on machine learning_ , pages 12888–12900. PMLR, 2022.
  * Liao et al. [2022] Peiyuan Liao, Xiuyu Li, Xihui Liu, and Kurt Keutzer.  The artbench dataset: Benchmarking generative models with artworks.  _arXiv preprint arXiv:2206.11404_ , 2022.
  * Liu et al. [2021] Liyang Liu, Shilong Zhang, Zhanghui Kuang, Aojun Zhou, Jing-Hao Xue, Xinjiang Wang, Yimin Chen, Wenming Yang, Qingmin Liao, and Wayne Zhang.  Group fisher pruning for practical network compression.  In _International Conference on Machine Learning_ , pages 7021–7032. PMLR, 2021.
  * Loshchilov and Hutter [2017] Ilya Loshchilov and Frank Hutter.  Decoupled weight decay regularization.  _arXiv preprint arXiv:1711.05101_ , 2017.
  * Luccioni et al. [2023] Alexandra Sasha Luccioni, Christopher Akiki, Margaret Mitchell, and Yacine Jernite.  Stable bias: Analyzing societal representations in diffusion models.  _arXiv preprint arXiv:2303.11408_ , 2023.
  * Lundberg and Lee [2017] Scott M Lundberg and Su-In Lee.  A unified approach to interpreting model predictions.  In _Advances in Neural Information Processing Systems_ , pages 4765–4774, 2017.
  * Owen [1977] Guilliermo Owen.  Values of games with a priori unions.  In _Mathematical economics and game theory: Essays in honor of Oskar Morgenstern_ , pages 76–88. Springer, 1977.
  * Park et al. [2023] Sung Min Park, Kristian Georgiev, Andrew Ilyas, Guillaume Leclerc, and Aleksander Madry.  Trak: Attributing model behavior at scale.  _arXiv preprint arXiv:2303.14186_ , 2023.
  * Radford et al. [2021] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al.  Learning transferable visual models from natural language supervision.  In _International conference on machine learning_ , pages 8748–8763. PMLR, 2021.
  * Ramesh et al. [2022] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen.  Hierarchical text-conditional image generation with clip latents.  _arXiv preprint arXiv:2204.06125_ , 1(2):3, 2022.
  * Razavi et al. [2019] Ali Razavi, Aaron Van den Oord, and Oriol Vinyals.  Generating diverse high-fidelity images with vq-vae-2.  _Advances in neural information processing systems_ , 32, 2019.
  * Rombach et al. [2022] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.  High-resolution image synthesis with latent diffusion models.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 10684–10695, 2022.
  * Ruiz et al. [2023] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman.  Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 22500–22510, 2023.
  * Salimans et al. [2016] Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen.  Improved techniques for training gans.  _Advances in neural information processing systems_ , 29, 2016.
  * Samuelson [2023] Pamela Samuelson.  Generative ai meets copyright.  _Science_ , 381(6654):158–161, 2023.
  * Schuhmann et al. [2022] Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et al.  Laion-5b: An open large-scale dataset for training next generation image-text models.  _Advances in Neural Information Processing Systems_ , 35:25278–25294, 2022.
  * Shapley [1953] Lloyd S Shapley.  A value for n-person games.  _Contributions to the Theory of Games_ , 2(28):307–317, 1953.
  * Song et al. [2020a] Jiaming Song, Chenlin Meng, and Stefano Ermon.  Denoising diffusion implicit models.  _arXiv preprint arXiv:2010.02502_ , 2020a.
  * Song et al. [2020b] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole.  Score-based generative modeling through stochastic differential equations.  _arXiv preprint arXiv:2011.13456_ , 2020b.
  * Spearman [1961] Charles Spearman.  The proof and measurement of association between two things.  1961\.
  * Štrumbelj and Kononenko [2010] Erik Štrumbelj and Igor Kononenko.  An efficient explanation of individual classifications using game theory.  _Journal of Machine Learning Research_ , 11:1–18, 2010.
  * Thudi et al. [2022] Anvith Thudi, Gabriel Deza, Varun Chandrasekaran, and Nicolas Papernot.  Unrolling sgd: Understanding factors influencing machine unlearning.  In _2022 IEEE 7th European Symposium on Security and Privacy (EuroS &P)_, pages 303–319. IEEE, 2022.
  * van den Oord et al. [2017] Aäron van den Oord, Oriol Vinyals, and Koray Kavukcuoglu.  Neural discrete representation learning.  In Isabelle Guyon, Ulrike von Luxburg, Samy Bengio, Hanna M. Wallach, Rob Fergus, S. V. N. Vishwanathan, and Roman Garnett, editors, _Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA_ , pages 6306–6315, 2017.  URL https://proceedings.neurips.cc/paper/2017/hash/7a98af17e63a0ac09ce2e96d03992fbc-Abstract.html.
  * Wang and Jia [2023] Jiachen T Wang and Ruoxi Jia.  Data banzhaf: A robust data valuation framework for machine learning.  In _International Conference on Artificial Intelligence and Statistics_ , pages 6388–6421. PMLR, 2023.
  * Wang et al. [2023a] Sheng-Yu Wang, Alexei A Efros, Jun-Yan Zhu, and Richard Zhang.  Evaluating data attribution for text-to-image models.  _arXiv preprint arXiv:2306.09345_ , 2023a.
  * Wang et al. [2023b] Zhendong Wang, Yifan Jiang, Yadong Lu, Pengcheng He, Weizhu Chen, Zhangyang Wang, Mingyuan Zhou, et al.  In-context learning unlocked for diffusion models.  _Advances in Neural Information Processing Systems_ , 36:8542–8562, 2023b.
  * Yeh et al. [2018] Chih-Kuan Yeh, Joon Kim, Ian En-Hsu Yen, and Pradeep K Ravikumar.  Representer point selection for explaining deep neural networks.  _Advances in neural information processing systems_ , 31, 2018.
  * Zheng et al. [2023] Xiaosen Zheng, Tianyu Pang, Chao Du, Jing Jiang, and Min Lin.  Intriguing properties of data attribution on diffusion models.  _arXiv preprint arXiv:2311.00500_ , 2023.

## Appendix

##  Appendix A Datasets

CIFAR ($\bf{32\times 32}$). The CIFAR-100
dataset555https://www.cs.toronto.edu/~kriz/cifar.html[35] contains 50,000
training samples. To reduce computation, we also construct a CIFAR-20 dataset
as a subset of CIFAR-100, which consists of 10,000 training samples randomly
sampled from CIFAR-100’s training samples corresponding to the "large
carnivores", "large omnivores and herbivores", "medium mammals", and "vehicles
1" classes.

CelebA-HQ ($\bf{256\times 256}$). The original CelebA-HQ dataset [31]
comprises 30,000 face images with 6,217 unique identities. We downloaded a
preprocessed dataset with from https://github.com/ndb796/LatentHSJA, which
contain 5,478 images from 307 identities, each with 15 or more images. For our
experiment, we randomly sample 50 identities, totaling 895 images. Also, to
match the input dimension required by the latent diffusion model
implementation, we resize the original images from a resolution of $1024\times
1024$ to $256\times 256$.

ArtBench Post-Impressionism ($\bf{256\times 256}$). ArtBench-10 is a dataset
for benchmarking artwork generation with 10 art styles, consisting of 5,000
training images per style [37]. For our experiments, we consider the 5,000
training images corresponding to the art style “post-impressionism" from 258
artists.

##  Appendix B Additional Training Setup

For training diffusion models, we utilize NVIDIA GPUs: RTX 6000, A40, and
A100, each equipped with 40GB, 40GB, and 24GB of memory respectively. This
study employs the Diffusers library version 0.24.0
666https://pypi.org/project/diffusers/ to train various models across
different datasets. Per-sample gradients are computed using the techniques
outlined in the PyTorch library tutorial (version 2.2.1)
777https://pytorch.org/. Furthermore, we apply the TRAK
library888https://trak.csail.mit.edu/quickstart to project gradients with a
random projection matrix, enhancing the efficiency of our computational
methods. All experiments are conducted on systems equipped with 64 CPU cores
and the specified NVIDIA GPUs.

For CelebA-HQ, we implement two techniques to reduce GPU memory usage during
the training. First, we pre-compute the embedding of VQ-VAE module [58] for
all training samples beforehand, since the VQ-VAE module is kept frozen during
the training. This approach allows us to avoid loading the VQ-VAE module into
GPU memory during training. Second, we use the 8-bit Adam optimizer
implemented in bitsandbytes python package [8].

##  Appendix C Local Data Attribution

To compute local data attribution, several approaches have been proposed [1,
33, 14, 59, 26]. These methods can be broadly categorized into two types: 1)
retraining-based approaches, which involve the removal and retraining of data
points, and 2) influence function-based approaches, which calculate the impact
of individual data points on the model’s predictions.

Influence function (IF).[33]. Influence function calculates the effect of
infinitesimally up-weighting of a training sample $x^{n}\sim\mathcal{D}$ on
the model output function $\mathcal{F}(x;\theta^{*})$, measured on a sample of
interest $x$ by leveraging second-order approximation [33, 34, 2]. For a given
model output $\mathcal{F}$, the data attribution score can be computed as

$\tau_{IF}(x,\mathcal{D})_{n}=\nabla_{\theta}\mathcal{F}(x;\theta^{*})^{T}\cdot\mathcal{H}_{\theta^{*}}^{-1}\cdot\nabla_{\theta}\mathcal{L}(x_{n};\theta^{*})\quad\text{for}\quad
n\in[N],$ (11)

where $\mathcal{H}_{\theta^{*}}=\nabla_{\theta}^{2}\mathcal{L}(D;\theta^{*})$
is the Hessian matrix at the optimal parameters $\theta^{*}$. Since influence-
based approaches only require only the loss gradients computed at the sample
to be explained and at the training samples [33, 62], it is sometimes more
computationally efficient.

Removal by retraining. On the other hand, retraining-based approaches estimate
the influence of a training sample $x$ by removing $x$ during the training
procedure and assessing its marginal contribution [14, 59, 26]. The data
attribution score is defined as

$\tau_{R}(x,\mathcal{D})_{n}=\sum_{S\subseteq
D\setminus\\{i\\}}\mu(S)\left(\mathcal{F}(x;\theta_{S\cup\\{i\\}})-\mathcal{F}(x;\theta_{S})\right)\quad\text{for}\quad
n\in[N],$ (12)

where $S$ is a training data subset sampled from a distribution $\mathcal{D}$
with training sample $x_{i}$ removed and $\mu(S)$ are the corresponding
distribution, such as Shapley or datamodel distribution[26, 14]. While
retraining approaches have demonstrated superior performance, acquiring
retraining models for subsets $S$ is computationally expensive.

###  C.1 Data Attribution Methods for Diffusion Models

Here we provide definition and implementation details of the baselines used in
Section 4. For TRAK-based approaches, we follow the implementation in
999https://github.com/sail-sg/D-TRAK/.

Raw Pixel Similarity. This is a simple baseline that uses the raw image as the
representation and then computes the cosine similarity between the sample of
interest and each training sample as the attribution score. in particular, for
both CelebA-HQ and ArtBench, we use the embeddings encoded by a pretrained
model 101010https://github.com/CompVis/latent-
diffusion/tree/main111111https://huggingface.co/lambdalabs/miniSD-diffusers of
the raw images.

Embeddings Distance. This method computes the $l_{2}$ distances between
training sample embeddings, generated using BLIP-
VQA121212https://huggingface.co/Salesforce/blip-vqa-base [36], and the average
embedding of training samples to determine similarity.

CLIP Similarity. This method utilizes CLIP131313https://github.com/openai/CLIP
[44] to encode each sample into an embedding and compute the cosine similarity
with each training sample as its attribution score.

Gradient. This is a gradient-based influence estimator[4] which computes the
cosine similarity using the gradient representations of the sample and each
training sample, as the attribution score

$\displaystyle\tau(x,D)_{n}=\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x;\theta^{*})^{\mathsf{T}}\cdot\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x;\theta^{*})$
(13)
$\displaystyle\tau(x,D)_{n}=\frac{\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x;\theta^{*})^{\mathsf{T}}\cdot\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x;\theta^{*})}{\|\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x;\theta^{*})^{\mathsf{T}}\|\|\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x;\theta^{*})\|}$

TRAK. As discussed in Section 3, is defined as the following

$\displaystyle{\Phi_{\text{TRAK}}^{s}}=\left[\phi^{s}(x^{1}),\ldots,\phi^{s}(x^{n})\right]^{\mathsf{T}}\text{,
where
}\phi^{s}(x)=\mathcal{P}^{\mathsf{T}}_{s}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x,\theta_{s}^{*})$
(14)
$\displaystyle\tau_{\text{TRAK}}(x,\mathcal{D})_{n}=\mathcal{P}^{\mathsf{T}}_{s}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x,\theta_{s}^{*})\cdot\left({\Phi_{\text{TRAK}}^{s}}^{\mathsf{T}}\cdot\Phi_{\text{TRAK}^{s}}+\lambda
I\right)^{-1}\mathcal{P}^{\mathsf{T}}_{s}\cdot\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x^{n},\theta_{s}^{*})$

Relative Influence. Proposed by [1], the $\theta$-relative influence functions
estimator normalizes the [33] influence functions estimator by HVP magnitude.
Following [63] we integrate this estimator with the TRAK methodology. The
formulation is as follows:

$\tau_{\text{TRAK}}(x,\mathcal{D})_{n}=\frac{\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x,\theta^{*})\cdot\left({\Phi_{\text{TRAK}}}^{\mathsf{T}}\cdot\Phi_{\text{TRAK}}+\lambda
I\right)^{-1}\cdot\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x^{n},\theta^{*})}{\left\|\left({\Phi_{\text{TRAK}}}^{\mathsf{T}}\cdot\Phi_{\text{TRAK}}+\lambda
I\right)^{-1}\cdot\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x^{n};\theta^{*})\right\|}$
(15)

Renormalized Influence. Introduced by [18], this method renormalizes the
influence function by the magnitude of the training sample’s gradients.
Similar to relative influence, we made an adoption following [63]. The method
is calculated as follows:

$\tau_{\text{TRAK}}(x,\mathcal{D})_{n}=\frac{\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x,\theta^{*})\cdot\left({\Phi_{\text{TRAK}}}^{\mathsf{T}}\cdot\Phi_{\text{TRAK}}+\lambda
I\right)^{-1}\cdot\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x^{n},\theta^{*})}{\|\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x^{n};\theta^{*})\|}$
(16)

Journey-TRAK. [13] focuses on attributing noisy images $x_{t}$. We follow [63]
by averaging the attributions over the generation timesteps as follows

$\displaystyle\tau_{\text{TRAK}}(x,\mathcal{D})_{n}=\frac{1}{T^{\prime}}\sum_{t=1}^{T^{\prime}}\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x_{t},\theta^{*})\cdot\left({\Phi_{\text{TRAK}}}^{\mathsf{T}}\cdot\Phi_{\text{TRAK}}+\lambda
I\right)^{-1}\cdot\mathcal{P}^{\mathsf{T}}\nabla_{\theta}\mathcal{L}_{\text{Simple}}(x^{n},\theta^{*})$
(17)

TracIn [7, 60], which attributes the training sample’s influence to first-
order approximation with saved checkpoints during the training process.
However, this is also a major limitation because sometimes it’s impossible to
obtain checkpoints for models such as Stable Diffusion [47].

##  Appendix D Additional Experiment Results

In this section, we provide additional experiment results.

Table 2: Average runtime in minutes (training $+$ inference) for Shapley
values estimated with retraining, fine-tuning (FT), and sparsified FT.
Method | CIFAR-20 | CelebA-HQ | ArtBench (Post-Impressionism)
---|---|---|---
Retrain | 77.4 + 20.8 | 213.4 + 26.5 | 190.6 + 6.4
FT | 6.06 + 18.9 | 17.5 + 27.0 | 4.4 + 6.4
Sparsified FT | 4.37 + 14.0 | 11.0 + 11.9 | 4.5 + 6.1

###  D.1 CIFAR-20

Table 3: LDS ($\%$) results with $\alpha=0.25,0.5,0.75$ on CIFAR-20, with the
Inception Score of 10,240 generated images as the global model property. Means
and 95% confidence intervals across three random initializations are reported.
Method | $\alpha=0.25$ | $\alpha=0.5$ | $\alpha=0.75$
---|---|---|---
Pixel similarity (average) | -10.88 $\pm$ 9.61 | -11.81 $\pm$ 4.56 | -20.82 $\pm$ 5.57
Pixel similarity (max) | -17.42 $\pm$ 0.83 | -31.80 $\pm$ 2.90 | -23.88 $\pm$ 1.28
CLIP similarity (average) | -0.34 $\pm$ 4.65 | -21.27 $\pm$ 1.37 | -13.13 $\pm$ 1.96
CLIP similarity (max) | -1.19 $\pm$ 15.19 | 11.31 $\pm$ 0.37 | 16.05 $\pm$ 7.30
Gradient similarity (average) | 6.48 $\pm$ 10.98 | 5.79 $\pm$ 3.67 | -10.75 $\pm$ 7.06
Gradient similarity (max) | 7.22 $\pm$ 3.88 | -0.89 $\pm$ 3.17 | -4.82 $\pm$ 4.71
Relative IF | 1.14 $\pm$ 13.51 | 5.23 $\pm$ 5.50 | 5.21 $\pm$ 3.78
Renormalized IF | 9.09 $\pm$ 13.40 | 11.39 $\pm$ 6.79 | 7.99 $\pm$ 4.02
TRAK | 3.62 $\pm$ 14.02 | 7.94 $\pm$ 5.67 | 6.59 $\pm$ 3.88
Journey-TRAK | -30.09 $\pm$ 3.85 | -42.92 $\pm$ 2.15 | -40.43 $\pm$ 3.46
D-TRAK | 21.02 $\pm$ 6.76 | 10.90 $\pm$ 1.21 | 21.90 $\pm$ 5.02
Sparsified-FT Shapley (Ours) | 51.24 $\pm$ 3.39 | 61.48 $\pm$ 2.27 | 59.15 $\pm$ 4.24
Table 4: LDS (%) results on Removal-Based Methods with different number of subset $S$. $\alpha$ | Method | $S=100$ | $S=200$ | $S=300$ | $S=400$ | $S=500$
---|---|---|---|---|---|---
$0.25$ | Retraining | 43.88 (3.97) | 49.95 (3.20) | 57.56 (2.52) | 62.68 (1.85) | 65.90 (1.52)
Sparsified-FT | 8.46 (13.41) | 23.92 (6.27) | 33.88 (8.33) | 54.88 (7.44) | 51.24 (3.39)
FT | 13.57 (7.09) | 40.01 (8.30) | 28.94 (8.59) | 24.58 (6.07) | 20.57 (3.02)
$0.5$ | Retraining | 48.84 (2.00) | 39.55 (3.17) | 57.24 (2.69) | 66.81 (2.99) | 70.58 (2.05)
Sparsified-FT | -5.41 (4.78) | 38.00 (3.06) | 47.74 (1.49) | 63.62 (2.30) | 61.48 (2.27)
FT | 13.57 (7.09) | 40.01 (8.30) | 28.94 (8.59) | 24.58 (6.07) | 20.57 (3.02)
$0.75$ | Retraining | 51.39 (3.21) | 45.85 (3.99) | 61.91 (4.62) | 70.59 (3.13) | 72.07 (4.83)
Sparsified-FT | -11.44 (2.26) | 33.98 (0.98) | 48.16 (5.18) | 59.65 (5.34) | 59.15 (4.24)
FT | 33.90 (5.88) | 26.09 (8.55) | 45.49 (6.83) | 46.92 (5.96) | 38.51 (4.62)
Figure 6: LDS (%) results on CIFAR-20 for Shapley values estimated with
sparsified fine-tuning (FT), finet-tuning (FT), and retraining under the same
computational budgets (1 unit = runtime to retrain and run inference on a full
model).

(a) Sparsified-FT Shapley (b) IS = 6.134

(c) D-TRAK (d) IS = 6.160

(e) CLIP Similarity (Max) (f) IS = 6.258

(g) IS = 5.604

(h) IS = 6.143

(i) IS = 6.552

(j) IS = 5.352

(k) IS = 5.872

(l) IS = 6.365

Figure 7: Inception scores and example images generated with the same initial
noises for DDPMs trained without the 10%, 20%, and 40% (top to bottom) most
important CIFAR-20 classes based on sparsified-FT Shapley, D-TRAK, and CLIP
similarity (max).

###  D.2 CelebA-HQ

Table 5: LDS ($\%$) results with $\alpha=0.25,0.5,0.75$ on CelebA-HQ, with the
cluster entropy of 1,024 generated images as the global model property. Means
and 95% confidence intervals across three random initializations are reported.
Method | $\alpha=0.25$ | $\alpha=0.5$ | $\alpha=0.75$
---|---|---|---
Pixel similarity (average) | $-1.52\pm 3.14$ | $-8.91\pm 0.93$ | $-4.19\pm 2.25$
Pixel similarity (max) | $9.53\pm 6.35$ | $21.70\pm 2.05$ | $24.76\pm 0.96$
Embedding dist. (average) | $3.59\pm 6.47$ | $13.83\pm 1.12$ | $10.89\pm 2.04$
Embedding dist. (max) | $9.17\pm 2.12$ | $7.32\pm 3.16$ | $22.25\pm 1.87$
CLIP similarity (average) | $-8.29\pm 4.38$ | $-32.23\pm 0.87$ | $-22.29\pm 2.56$
CLIP similarity (max) | $-23.62\pm 3.51$ | $-0.93\pm 3.83$ | $-8.86\pm 2.16$
Gradient similarity (average) | 28.04 $\pm$3.57 | 25.93 $\pm$ 2.94 | 29.23 $\pm$ 0.96
Gradient similarity (max) | $9.61\pm 1.17$ | $11.15\pm 5.90$ | $18.70\pm 1.66$
Relative IF | 19.07 $\pm$ 4.08 | 12.62 $\pm$ 3.43 | 13.72 $\pm$1.90
Renormalized IF | $13.33\pm 3.33$ | $9.22\pm 3.59$ | $9.57\pm 1.92$
TRAK | $16.73\pm 3.73$ | $9.85\pm 3.62$ | $10.50\pm 1.79$
Journey-TRAK | $7.34\pm 0.27$ | $-8.00\pm 4.98$ | $-7.80\pm 1.53$
D-TRAK | $-6.89\pm 6.01$ | $-18.83\pm 2.12$ | $-18.54\pm 0.78$
Sparsified-FT Shapley (Ours) | 10.05 $\pm$ 5.33 | 26.34 $\pm$ 3.34 | 24.08 $\pm$ 1.52
Table 6: LDS (%) results on Removal-Based Methods with different number of subsets $S$ $\alpha$ | Method | $S=100$ | $S=200$ | $S=300$ | $S=400$ | $S=500$
---|---|---|---|---|---|---
0.25 | Retraining | 3.54 (0.59) | 8.91 (2.61) | 16.77 (4.75) | 15.58 (6.23) | 31.52 (5.56)
Sparsified - FT | 9.95 (5.77) | 15.93 (6.29) | 9.90 (8.17) | 16.12 (6.40) | 10.05 (5.33)
FT (500 steps) | -10.52 (4.26) | 2.77 (5.79) | 12.29 (4.50) | 9.86 (4.84) | 13.91 (3.91)
0.5 | Retraining | 19.01 (1.60) | 28.43 (2.71) | 35.06 (3.48) | 23.48 (2.95) | 28.58 (3.91)
Sparsified - FT | 20.73 (2.89) | 26.83 (3.96) | 12.71 (2.06) | 27.23 (2.94) | 26.34 (3.42)
FT (500 steps) | 1.82 (3.36) | 9.25 (2.59) | 12.17 (2.83) | 8.63 (0.52) | 13.77 (1.42)
0.75 | Retraining | 21.14 (0.93) | 26.29 (1.37) | 31.87 (2.85) | 31.60 (2.23) | 32.26 (2.08)
Sparsified - FT | 16.05 (0.31) | 29.35 (1.43) | 9.49 (2.03) | 17.70 (1.30) | 24.08 (1.52)
FT (500 steps) | -11.02 (1.51) | -12.07 (4.30) | 1.93 (4.82) | 0.96 (4.16) | 7.37 (3.79)
Figure 8: LDS (%) results on CelebA-HQ for Shapley values estimated with
sparsified fine-tuning (FT), fine-tuning (FT), and retraining under the same
computational budgets (1 unit = runtime to retrain and run inference on a full
model).

###  D.3 ArtBench (Post-Impressionism)

Table 7: LDS ($\%$) results with $\alpha=0.25,0.5,0.75$ on ArtBench (Post-
Impressionism), with the 90th percentil of aesthetic scores for 50 generated
images as the global model property. Means and 95% confidence intervals across
three random initializations are reported.
Method | $\alpha=0.25$ | $\alpha=0.5$ | $\alpha=0.75$
---|---|---|---
Pixel similarity (average) | 16.57 (3.16) | 11.24 (0.63) | -1.19 (5.71)
Pixel similarity (max) | 16.62 (2.95) | 14.61 (2.72) | 3.43 (10.57)
CLIP similarity (average) | -6.03 (1.61) | -6.96 (4.08) | -9.27 (2.74)
CLIP similarity (max) | 8.94 (0.43) | -1.75 (4.07) | -1.70 (9.89)
Grad similarity (average) | 4.14 (5.14) | 0.25 (1.18) | -7.81 (0.89)
Grad similarity (max) | 22.10 (9.02) | 10.48 (3.11) | 1.32 (4.19)
Aesthetic score (average) | 24.81 (3.00) | 24.85 (2.30) | 13.21 (7.82)
Aesthetic score (max) | 31.73 (3.04) | 21.36 (3.70) | 7.45 (11.66)
Relative IF | 3.30 (4.98) | -5.02 (1.77) | -3.77 (12.05)
Renormalized IF | -1.71 (4.37) | -11.41 (0.93) | -8.96 (12.86)
TRAK | -0.85 (4.74) | -8.18 (1.30) | -6.78 (13.37)
Journey-TRAK | -14.10 (5.09) | -11.41 (4.22) | -6.83 (2.80)
D-TRAK | 19.37 (3.29) | 11.30 (3.47) | 17.72 (6.87)
Sparsified-FT Shapley (Ours) | 52.83 (3.58) | 61.44 (2.04) | 32.24 (10.93)
Figure 9: LDS (%) results with $\alpha=0.25,0.5,0.75$ on ArtBench (Post-Impressionism) for Shapley values estimated with sparsified fine-tuning (FT), fine-tuning (FT), and retraining under the same computational budgets (1 unit = runtime to retrain and run inference on a full model). Table 8: Aesthetic Score (90th percentile of 50 generated images) as the global model behavior. 100 datamodel subsets with alpha = 0.25, 0.5, 0.75 are used for evaluation. Means and 95% confidence intervals across three random initializations are reported. All Shapley values are estimated with 1,000 subsets. $\alpha$ | Retrain | Sparsified - FT | FT
---|---|---|---
0.25 | 53.25 (6.75) | 51.15 (7.54) | 52.83 (3.58)
0.50 | 52.30 (2.32) | 51.61 (3.21) | 61.44 (2.04)
0.75 | 23.78 (14.07) | 33.77 (6.65) | 32.24 (10.93)
Figure 10: Two generated images above and two generated images below the 90th
percentile of aesthetic scores, for Stable Diffusion models LoRA-finetuned
without the top 40% most important artists based on D-TRAK, pixel similarity
(max), training image aesthetic score (average), and sparsified-FT Shapley.
Figure 11: Two generated images above and two generated images below the 90th
percentile of aesthetic scores, for Stable Diffusion models LoRA-finetuned
without the top 40% most important artists based on D-TRAK, pixel similarity
(max), training image aesthetic score (average), and sparsified-FT Shapley.

##  Appendix E Broader Impact

In our work, we introduce the problem of attributing global model properties
to groups of training data in the context of diffusion models. As the broader
application of generative models, it’s crucial to correctly attribute training
data. To address this, we develop a novel methodology that not only enhances
understanding of how data influences model behavior but also improves the
transparency of generative models. By systematically analyzing the impact of
different data subsets, our approach facilitates more informed modifications
to the training process, ultimately leading to more robust and reliable
generative models. This capability is essential for deploying these models in
real-world scenarios where accuracy and accountability are paramount.