Training Data Influence

• Training Data Influence is the study of how individual training examples impact a model’s behavior through counterfactual analysis, gradient tracing, and trajectory-based methods.
• Recent methodologies quantify influence by simulating removal and upweighting of examples, using metrics like leave-one-out loss changes and checkpointed gradient inner products.
• Emerging work shifts from scalar influence scores to distributed, trajectory-sensitive, and concept-conditioned attributions, addressing issues like duplication, noise, and scalability.

Training data influence denotes the dependence of model behavior on particular training examples, trajectories, subsets, or semantically defined groups of data. In the recent literature, this object is no longer treated as a single scalar attached to an example in isolation. Instead, it appears as leave-one-out or upweighting sensitivity, checkpoint-aggregated gradient alignment, zeroth-order trajectory-loss variation, full counterfactual influence distributions, concept-conditioned attribution in activation space, and downstream influence on quantities such as memorization, generalization, or LQR cost (Meeus et al., 25 Jun 2025, Kokhlikyan et al., 13 Oct 2025, Kowal et al., 16 Feb 2026).

1. Core definitions and formal objects

A common starting point is supervised learning with training data $S=\{x_1,\dots,x_n\}$, loss $\ell$, and empirical risk minimization

$$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$

One paper defines the “true influence” of a training point $x_s$ on a target point $x_t$ as

$$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$

thereby making explicit that influence is a counterfactual quantity tied to adding or removing data and retraining the model (Kokhlikyan et al., 13 Oct 2025). In that formulation, train-test influence concerns $x_s\neq x_t$, while self-influence is the special case $x_s=x_t$, a quantity used for outlier detection, mislabeled-data detection, and memorization analysis (Kokhlikyan et al., 13 Oct 2025).

A second formal line defines influence through explicit randomized dataset interventions. For a training point $x_i$ and target record $x_t$,

$\ell$0

Here $\ell$1 is a model trained on dataset $\ell$2, and positive influence means that including $\ell$3 helps predict $\ell$4, i.e. reduces loss. Self-influence is the diagonal case $\ell$5, while the full collection $\ell$6 forms an influence distribution for the target $\ell$7, and all pairwise quantities form an influence matrix $\ell$8 (Meeus et al., 25 Jun 2025).

A third family adopts the classical influence-function template. If a training point $\ell$9 is infinitesimally upweighted, then under smoothness and local invertibility assumptions the parameter perturbation is approximately

$$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$0

and downstream influence is obtained by composing this perturbation with the gradient of a target functional (Kokhlikyan et al., 13 Oct 2025). In the concept-conditioned setting, that target need not be a test loss. A behavior functional $$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$1 or a concept score $$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$2 can replace the usual test-loss objective, thereby turning training data attribution into sensitivity of semantic directions in activation space rather than sensitivity of a single labeled test example (Kowal et al., 16 Feb 2026).

2. Estimation paradigms

The oldest scalable family in this corpus is gradient-tracing. TracIn defines the idealized influence of training example $$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$3 on test example $$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$4 as the total reduction in test loss at the steps where $$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$5 was used,

$$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$6

and, after a first-order Taylor expansion of the SGD update, approximates it by checkpointwise gradient inner products. In minibatch form,

$$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$7

Its practical checkpoint version is

$$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$8

which needs gradients, checkpoints, and a loss function, but not Hessian inversion (Pruthi et al., 2020). In NLP classification, layer choice itself becomes an attribution issue: TracIn-WE moves the method from the last layer to the word embedding layer in order to mitigate a reported “cancellation effect” in last-layer influence, and the paper reports that TracIn-WE significantly outperforms other data influence methods applied on the last layer on deletion evaluation (Yeh et al., 2022).

A second family replaces gradients with losses along the training trajectory. Z0-Inf defines a zeroth-order directional gradient between checkpoints $$\theta(S)=\arg\min_\theta \sum_{i=1}^n \ell(\theta,x_i).$$9 and $x_s$0 by fitting observed loss differences,

$x_s$1

and then forms train-test influence by summing checkpointwise inner products,

$x_s$2

For self-influence, it further proposes the proxy

$x_s$3

so that only losses across checkpoints are required (Kokhlikyan et al., 13 Oct 2025). The paper reports order-of-magnitude savings in both runtime and memory footprint, and states that zeroth-order methods provide about $x_s$4 higher correlation with SSRT than first-order approximation in the reported large-model setup (Kokhlikyan et al., 13 Oct 2025).

A third family treats attribution as simulation rather than static scoring. Simfluence models the loss trajectory of a fixed test example $x_s$5 under curriculum $x_s$6 by

$x_s$7

with $x_s$8 and $x_s$9. This explicitly captures order dependence, redundancy, and diminishing returns, and the paper shows that TracIn-Ideal, TracIn-CP, and influence functions arise as additive special cases under appropriate approximations (Guu et al., 2023). GPTfluence extends this simulator view to GPT-style models by predicting metric trajectories such as loss, BLEU, and ROUGE-L with an $x_t$0-th order Markov simulator

$x_t$1

where $x_t$2 and $x_t$3 are generated from frozen semantic features of training and test examples. On instruction tuning with Pythia up to 2.8B, it reports lower MSE and higher final-step Spearman than TracIn and Simfluence on the tested tasks (Chai et al., 2024).

3. From scalar scores to distributions, trajectories, and uncertainty

A major conceptual shift in recent work is that scalar self-influence is often insufficient. In the counterfactual-distributional view, memorization is shaped by the entire training set, especially by duplicates and near-duplicates. A target sample $x_t$4 is a near-duplicate of $x_t$5 if

$x_t$6

When such neighbors occur in both worlds where $x_t$7 is present and absent, the marginal contribution of the exact target can shrink even though the content remains highly extractable (Meeus et al., 25 Jun 2025). The language-model experiment in that paper makes the point quantitatively: unique records have self-influence $x_t$8, BLEU $x_t$9, and Top-1 Influence Margin $$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$0, whereas records with near-duplicates have self-influence $$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$1, BLEU $$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$2, and Top-1 Influence Margin $$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$3 (Meeus et al., 25 Jun 2025). Low self-influence therefore does not imply low memorization risk; the paper states that self-influence can “severely underestimate tangible risks associated with memorization” (Meeus et al., 25 Jun 2025).

Trajectory-sensitive work makes a related but distinct correction. Classical leave-one-out treats the training set as permutation-invariant, whereas trajectory-specific leave-one-out fixes the realized optimization path and removes a point from the exact iteration where it appeared. If $$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$4 appears in batch $$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$5, the counterfactual run replays the same future batches after deleting $$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$6 from $$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$7, and defines

$$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$8

Its scalable approximation introduces a data value embedding

$$\inf(\ell, D, x_s, x_t) = E_{S\sim D^n}\big[\ell(\theta(S\cup\{x_s\}),x_t)-\ell(\theta(S),x_t)\big],$$9

so that

$x_s\neq x_t$0

This formulation captures the dependence of value on when a point was encountered, and the paper reports distinct phases of influence in language-model pretraining: high-impact warmup, a low-impact basin, and a gradual ascent late in training (Wang et al., 2024).

Another correction concerns stochasticity itself. A Bayesian view of training data attribution treats the learned model as a posterior sample and the leave-one-out effect

$x_s\neq x_t$1

as a random variable. The empirical finding emphasized there is that for many train-test pairs

$x_s\neq x_t$2

so the noise from initialization and SGD batch composition can dominate the mean attribution magnitude (Nguyen et al., 2023). The paper therefore recommends trusting TDA estimates only for low-noise pairs, and further observes that “the greater source of variations for the TDA estimates is the model initialisation” (Nguyen et al., 2023). This directly challenges the common practice of treating a single influence score as a deterministic ground truth.

4. What is being attributed: predictions, concepts, and balanced capabilities

Traditional training data attribution usually explains a prediction or loss on one test example. Concept Influence generalizes the target of attribution from a single test loss to a semantic direction in activation space. For concept vector $x_s\neq x_t$3 at layer $x_s\neq x_t$4, it defines

$x_s\neq x_t$5

where $x_s\neq x_t$6. Under successive approximations, this yields cheap probe-style scores such as Projection Difference and Vector Filter, and the paper reports the following runtimes on 1,000 examples: Vector Filter $x_s\neq x_t$7 s with $x_s\neq x_t$8 speedup over influence functions, Projection Difference $x_s\neq x_t$9 s with $x_s=x_t$0 speedup, Concept Influence $x_s=x_t$1 s, and Influence Function $x_s=x_t$2 s baseline (Kowal et al., 16 Feb 2026). The semantic shift is the central point: attribution is directed at behaviors such as “evilness” or sycophancy rather than at a single prompt-response loss (Kowal et al., 16 Feb 2026).

A related problem appears in multi-task instruction tuning, where raw influence is not directly comparable across tasks or even across validation instances. BIDS formalizes pairwise training-to-validation scores as an attribution matrix $x_s=x_t$3, then normalizes each validation column by

$x_s=x_t$4

and greedily selects examples that improve the most underrepresented parts of the current subset’s influence profile (Dai et al., 21 Jan 2025). The paper argues that certain tasks intrinsically have greater influence than others, so naïve top-$x_s=x_t$5 influence ranking biases data selection; its 15% subset selected by BIDS can outperform full-dataset training with a more balanced macro average, with BIDS (15%, 4 epochs) reaching $x_s=x_t$6 versus full-data training $x_s=x_t$7 at 1 epoch and $x_s=x_t$8 at 4 epochs (Dai et al., 21 Jan 2025). This suggests that influence is often capability-relative rather than globally commensurate.

5. Domains, extensions, and interventions

Several papers adapt training data influence to settings where the supervised, single-example, end-point view is inadequate. Dataset Pruning treats subset influence rather than pointwise ranking as the primitive object. With parameter influence vectors $x_s=x_t$9, it solves

$x_i$0

and proves that if the summed parameter influence of the removed subset is bounded by $x_i$1, then the generalization-gap change satisfies

$x_i$2

Empirically, the paper reports pruning 40% of CIFAR-10, nearly halving convergence time, with only about 1.3% test accuracy drop (Yang et al., 2022).

Diffusion models introduce timestep-conditioned losses and extreme gradient dimensionality. DMin defines diffusion influence as summed gradient similarity across timesteps at the final model and then compresses per-sample gradients by permutation, random sign projection, and group addition. On SD3 Medium (Full) with 5 timesteps and 9,288 training samples, the paper reports reducing total storage from 339.39 TB to 726 MB with $x_i$3, and retrieving top-$x_i$4 influential training samples in under 1 second (Lin et al., 2024). An earlier diffusion attribution approach uses encoded ensembles instead: different diffusion models are trained on overlapping coded splits, and influence is defined by “temporary unlearning,” namely removing all ensemble members that saw a point, regenerating from the same exogenous noise, and measuring how much the output changes (Dai et al., 2023).

In bilevel meta-learning, standard influence functions miss the indirect path through task-specific inner-loop adaptation. A meta-learning framework therefore defines task-IF and instance-IF using total derivatives through the inner optimum $x_i$5, with

$x_i$6

and propagates training-instance effects to the outer objective through a two-stage construction (Ren et al., 27 Jan 2025). In control, influence is pushed one stage further: after learning linear dynamics $x_i$7, IF2 differentiates the downstream LQR cost through the DARE by solving Lyapunov equations for $x_i$8, then forms

$x_i$9

The paper reports Pearson correlations of $x_t$0 and $x_t$1 for IF1 on predictive loss, and $x_t$2 and $x_t$3 for IF2 on LQR cost, in two simulated linear systems (Li et al., 12 Jun 2025).

Training data influence can also be inverted. Infusion uses influence-function approximations to compute small perturbations to training documents that induce desired behavior after retraining. On CIFAR-10, it reports that editing 100 of 45,000 training examples, i.e. 0.2% of the dataset, increases target-class probability in 100% of 2,000 experiments, with mean target-class probability change $x_t$4, and raises the top-1 target prediction rate from 10.0% to 37.35% (Rosser et al., 10 Feb 2026). In multi-agent self-training, DITS similarly replaces Q-value-only selection with validation-metric influence estimates for synthetic preference data, and reports stronger performance than Q-value-only baselines across eight multi-agent datasets (Shi et al., 2 Feb 2025).

6. Reliability, limitations, and open directions

Despite the breadth of formulations, papers converge on a cautionary message: training data influence is often fragile, target-dependent, and approximation-sensitive. Retraining-based counterfactual estimators can be faithful but are computationally prohibitive; gradient and Hessian approximations can scale, but may mismatch remove-and-retrain effects in large nonconvex models; zeroth-order methods require saved checkpoints; simulator methods require many observed runs; and concept-conditioned methods inherit the quality limits of the chosen probes, persona vectors, SAEs, or crosscoders (Kokhlikyan et al., 13 Oct 2025, Guu et al., 2023, Kowal et al., 16 Feb 2026).

Several recurrent misconceptions are explicitly rejected. Low self-influence is not a reliable certificate of low memorization risk when duplicates or near-duplicates are present (Meeus et al., 25 Jun 2025). Stable-looking attribution scores are not necessarily faithful, because a method can be overconfident relative to a noisy ground-truth leave-one-out distribution (Nguyen et al., 2023). High Q-value or raw influence is not identical to training utility in multi-capability instruction tuning, since task-dependent scale bias and redundancy can make top-$x_t$5 influence selection self-defeating (Dai et al., 21 Jan 2025). This suggests that influence should be read as a model- and target-specific local sensitivity object rather than as a universally comparable causal score.

The open problems named across these papers are correspondingly structural. One is group influence: several works note that redundancy and interactions among related examples are not captured well by pointwise scoring, and Z0-Inf explicitly points to group influence as future work (Kokhlikyan et al., 13 Oct 2025). Another is scaling: full pairwise counterfactual influence distributions remain feasible only in small or carefully controlled settings, while diffusion and LLM methods still depend on approximations, projections, or checkpoint availability (Meeus et al., 25 Jun 2025, Lin et al., 2024). A third is optimizer and trajectory realism: trajectory-aware embeddings are derived for SGD and treated as approximations for AdamW-like training, leaving a gap between theoretical target and modern practice (Wang et al., 2024). Finally, semantic attribution still depends on concept quality, and nonlinear concepts or circuits remain deferred to future work (Kowal et al., 16 Feb 2026).

Taken together, this literature replaces the older picture of influence as a single leave-one-out number with a more plural account. Training data influence may be a scalar score, a distribution over neighboring examples, a trajectory-conditional embedding, a semantic-direction sensitivity, a subset-level generalization perturbation, or a downstream systems quantity such as controller cost. The unifying question is constant—how training data shape model behavior—but the modern answer is that the relevant object depends on duplication, optimization path, target behavior, computational budget, and the intervention one wishes to approximate (Meeus et al., 25 Jun 2025, Wang et al., 2024, Kokhlikyan et al., 13 Oct 2025).