Training data attribution

A model trained on billions of examples from thousands of licensed and scraped sources asserts a factual pattern nobody intended to teach it, confidently and repeatedly. You have to name the training examples responsible, and the naming has consequences: the sources you name get renegotiated, corrected or dropped from the next run, and a source named wrongly is a supplier lost for nothing.

You hold the final checkpoint, a modest number of intermediate checkpoints saved during the run, the full corpus with source provenance, and per-example gradients on demand at inference cost. What you do not hold is a second run. Retraining to test a hypothesis, training on held-out subsets, and any estimator whose validation requires many models trained on different data are all off the table, because a run costs more than the harm you are chasing. You get exactly one confirmatory experiment, either one fine-tune or one small-scale run, and you must specify it in advance.

A second constraint closes the obvious escape. The effect of removing any single example is smaller than the run to run variation from seed and data order, so a single-example counterfactual is not ground truth even where you could afford one. Whatever you claim has to be pitched at a granularity where the counterfactual is measurable above that noise, and you have to say what that granularity is and why.

Hand in the estimator, its cost in gradients and storage, the granularity at which its claim is falsifiable, and the one confirmatory experiment you would spend, stated with the outcome that would refute you. Name the confound between causal influence and surface similarity to the output, and give the construction that separates them. State the case where your method returns a confident wrong source and what the person acting on it does then.

Ties break toward an attribution that commits to a predicted effect size in advance and could come back at zero, over one that returns a ranked list with no claim attached.