Towards Robust Influence Functions with Flat Validation Minima

We appreciate the useful comments of the reviewer. We will update our current draft to avoid any confusion.

[Q1 / Other Weakness 1] How to calculate the $\tilde{\theta} _ {z_{tr}}$

We would like to clarify that it is unnecessary to compute $\tilde{\theta} _ {z_{tr}}$for each training sample. Specifically, we only need to fine-tune the pre-trained model parameters $\theta$ to obtain $\tilde{\theta}$. Once this is done, we can approximate the parameter change $\tilde{\theta} _ {z_{tr}} - \tilde{\theta}$ as outlined in Eq 18.

[Q2] How to calculate the $\tilde{g} _ {z_{tr}}$

After reviewing our initial submission, we found that the definition on line 244 indeed contains an typo, which we suspect may have contributed to this misunderstanding. Specifically, $\tilde{g} _ {z_{tr}}$ is defined as $\tilde{g} _ {z_{tr}} = \nabla _ {\tilde{\theta}} \ell(z_{tr}, \tilde{\theta})$, as demonstrated in line 879 in the appendix. We will correct this in the revised version.

In practice, we implement this using Automatic Differentiation in PyTorch.

[Theoretical Claims] Sample size $M$ in eq. 35

We can confirm there is no $M$ in eq. 35. We directly apply the variance proxy for the whole random variable $\mathcal{I}(z, S_\text{val})$ in eq. 35.

We thank you for the observation, and will improve the readbility of the proof therein.

[Supp. Material] Code for Generation Tasks

We promise we will make the code for reproducing all reported experiments publicly available upon acceptance.

[References] Comparison with EK-FAC-based Influence function

Thank you for pointing out this important baseline that we had overlooked. We have now conducted a comparison with EK-FAC [r6] on mislabel detection tasks. The results (ROC AUC/AP) are reported below, where * denotes the results computed using the best training checkpoints. As observed, our proposed method consistently outperforms the EK-FAC-based IF.

[Other Weakness 1] Diagonal approximation for inverse Hessian

Thank you for raising the concern regarding the potential oversimplification of our inverse Hessian approximation. Please refer to our detailed response to Reviewer tK1F for a full discussion on this point.

[C1] Typo

Thank you for pointing out the incorrect mathematical symbol on line 215. We will correct this in the revised version.

---

[r6] Studying large language model generalization with influence functions, arxiv, 2023.

We sincerely appreciate the reviewer's valuable suggestion. After pondering over your questions, we compose the following responses and will include all the following elaborations in the revised manuscript.

[Q1.1] Validation set size

We appreciate the reviewer for highlighting this important factor, and we will include a detailed discussion of this in the revision.

Our approach consists of two steps: (1) fine-tuning and (2) influence function (IF) computation. In the second step, both our method and other IF-based approaches are similarly affected by the size of the validation set used for computing influence scores. Therefore, compared to other methods, the validation set size primarily impacts the fine-tuning step in our approach.

To further investigate the impact of the validation set size on our approach, we conducted experiments comparing different IF approaches for mislabel detection on the CIFAR-10N Worst dataset with varying validation set sizes. The results (ROC AUC/AP) are reported below, with the performance drop relative to the size of 10.000 shown in parentheses.

As observed, the performance of all approaches tends to degrade. Nevertheless, our method maintains strong performance despite the reduced data size and still outperforms other approaches by a significant margin.

[Q1.2] Optimum assumption

In Theorem 3.1, we assume that $\mathbb{E} _ {z \sim D_+}[\mathcal{I}(z, S_{val}) > 0]$ and $\mathbb{E} _ {z \sim D_-}[\mathcal{I}(z, S_{val}) < 0]$. As noted in the remark on line 201, this requires the overall influence estimation performance on $D$ (the training data distribution in practice) to be better than random guessing. This assumption implicitly relies on the training and validation data being drawn from related distributions and on the model retaining useful information about the training data. Consequently, we assume that the flat validation minimum does not deviate significantly from the given training minimum.

[Q2] Benefits under cases without noisy labels

We would like to clarify that we have indeed conducted experiments in settings without noisy labels. Specifically, the generation tasks presented in Sections 4.3 and 4.4 are based on clean datasets, and our proposed methods, VM and FVM, consistently outperform existing baselines in identifying the most influential samples under these conditions.

[Q3] 2nd-order gradients and computational complexities

In practice, to reduce both time and space complexities, we approximate the Hessian using the diagonal elements of the empirical Fisher Information Matrix, as described in Appendix A.

Following the notation used in [r5], where $n$ and $m$ denotes the number of training samples and validation samples, $D$ the number of parameters per layer, and $L$ the number of layers, the computational complexity of LiSSA for estimating the Hessian inverse is $O(nD^2L)$, DataInf is $O(nDL)$ and our approximation is $O(mDL)$ (since it is performed w.r.t. the validation loss). Notably, in most practical scenarios, $m \ll n$.

[Q4.1] Experimental setting in generation tasks

Regarding Equation (23), we acknowledge that its current form may have led to some misunderstanding due to limitations in presentation. We would like to clarify that the experimental setup for the generation tasks totally follows that of [r5]. Later, we will refine the explanation and notation of this part in the revision.

[Q4.2] Only 10 validation samples are used for influence estimation in LLMs scenarios

We acknowledge the reviewer’s concern. Due to time constraints, we were unable to conduct more extensive experiments in the large language model (LLM) setting. However, we provide a simplified validation dataset size analysis on smaller-scale datasets—please refer to our response in [Q1.1] for details.

We will include a more thorough discussion on this limitation and its potential implications in the revised version of the manuscript.

[C1-7] Writing

We thank the reviewer for the detailed suggestions. We will revise the manuscript to improve clarity, including clearer descriptions of the experiment setups, explanation of why $\epsilon = -\frac{1}{N}$, and clarification of $R_{\text{val}}$, which refers to the risk on the validation set. The typo in Line 215 will be corrected. Additionally, we will also update the legend label in Figure 2 to "Validation ROC-AUC" and revise the caption of Figure 3 to include the experiment setups.

---

[r5] DataInf: Efficiently Estimating Data Influence in LoRA-tuned LLMs and Diffusion Models, ICLR 2024.

We sincerely appreciate your recognition of the theoretical and experimental support for our claims.

[Broader Sci. Literature.1] Absence of Related Literature section

We kindly note that, due to space constraints, the discussion of related work on influence functions was not included in the main paper but has been deferred to Appendix E.

[Broader Sci. Literature.2] Further discussion on related works of flat minima

We thank the reviewer for highlighting the importance of further discussing flat minima in the related works section.

In the initial version, we acknowledge that we did not elaborate on prior work related to flat minima. This decision was based on the observation that most existing literature focuses on flat minima in the context of model generalization. In contrast, our work considers flat validation minima as a key factor for accurate IF estimation. Given this shift in focus, we initially chose not to include a detailed discussion of the broader flat minima literature.

Nonetheless, we agree that adding this context will help clarify our perspective and position our work more clearly. We will therefore incorporate a more comprehensive discussion of relevant literature in the revised version.

[Other Weakness] Impact of "parameterization of the loss function"

First, we would like to highlight that the main theoretical contribution of our manuscript is to establish a connection between flat validation minima and the accuracy of influence function estimation. The focus of our analysis is on how flat minima matter for IF, rather than on how to obtain them.

To this end, we adopted a commonly used method—Sharpness-Aware Minimization (SAM)—to obtain flat validation minima, primarily as a means to support our theoretical insights rather than as a central contribution of the paper.

We sincerely thank the reviewer for suggesting relevant literature [1][2] on achieving flat minima from the parameterization of the model. While these directions are indeed insightful, due to time constraints and the lack of public code for those papers, we opted to experiment with two more recent and open-sourced sharpness-aware optimizers as alternatives.

Specifically, we compare three different sharpness-aware optimizer, including SAM (utilized in our initial submission), ASAM [r3] and F-SAM [r4], on CIFAR-10N Worst and CIFAR-100N Noisy dataset. The results (ROC AUC) are presented below.

As observed, different sharpness-aware optimizers do affect the final results, with F-SAM achieving the best performance. This supports our hypothesis that better flat validation minima can lead to more accurate influence function estimation.

---

[r3] ASAM: Adaptive Sharpness-Aware Minimization for Scale-Invariant Learning of Deep Neural Networks, ICML, 2021

[r4] Friendly Sharpness-Aware Minimization, CVPR, 2024

We acknowledge the reviewer’s concern regarding the use of diagonal approximation of the empirical Fisher matrix for estimating the inverse Hessian. We are happy to provide a more thorough discussion of this aspect.

1. Diagonal approximation for inverse Hessian is simply a practical choice

We would like to clarify that our core contribution lies in improving the influence function (IF) estimation by (1) seeking flat validation minima, and (2) adapting IF computation to this scenarios. Therefore, our core contributions are orthogonal to the specific choice of inverse Hessian approximation method. In fact, once flat validation minima are obtained, the specific method used to compute the inverse Hessian in Equations (20) or (21) becomes a matter of choice, depending on the trade-offs between efficiency and accuracy.

2. Further support for the use of the diagonal approximation

We mainly refer to [r1] in JMLR, where the author discusses the diagonal of the empirical Fisher matrix and emphasizes that,

• for accelerating 2nd-order optimization, the diagonal approximation is a widely accepted method to avoid the full computation of the Hessian [r2].
• furthermore, optimization methods such as Adagrad and Adam, which are based on the Fisher matrix, also estimate second-order derivatives through an approximation to the diagonal of the empirical Fisher matrix [r1].

These examples reflect a broader consensus in the community that approximating the inverse Hessian in DNNs through the diagonal of the empirical Fisher matrix strikes a practical balance between efficiency and effectiveness, especially in DNNs scenarios.

3. Additional experiments for different inverse Hessian approximation approaches

We acknowledge that with a more accurate inverse Hessian approximation approach, the improved IF estimation performance can be expected.

To quantitatively discover the impact of the approximation on the inverse Hessian, we conduct experiments on the mislabel detection task. Specifically, we replace the computation of the inverse Hessian $\\tilde{H}_{val}^{-1}$ in Equation 21 from diagonal Fisher to LiSSA and DataInf.

[Technical details in adaptation]

Note that the accelerated approximations in LiSSA and DataInf both rely on the inverse Hessian-vector product (iHVP). However, the initial product $\\tilde{H}\_{val}^{-1} \\tilde{g}\_{z\_{tr}}$ in Equation (21) depends on the specific training sample $z_{tr}$, which requires recomputation for each training sample. As a result, we cannot directly apply these methods to our proposed influence function.

To address this, we introduce a random vector $V \\in R^{|\\theta| \\times 1}$, where each element is sampled from a standard normal distribution, i.e., $V_i \\sim \\mathcal{N}(0, 1)$. With this, Equation (21) becomes \\tilde{g}\_{z\_{tr}}^\\top \\tilde{H}\_{val}^{-1} V V^\\top \\tilde{g}\_{z\_{tr}}, and we have \\mathbb{E}[\\tilde{g}\_{z_{tr}}^\\top \\tilde{H}\_{val}^{-1} V V^\\top \\tilde{g}\_{z\_{tr}}] = \\tilde{g}\_{z\_{tr}}^\\top \\tilde{H}\_{val}^{-1} \\tilde{g}\_{z\_{tr}}. By using the random vector $V$, we can directly apply the iHVP trick to $\\tilde{H}\_{val}^{-1} V$ and compute the inverse Hessian based on LiSSA or DataInf. In practice, we sample 5 different $V$ to ensure stability and reduce the variance of the approximation

The results (ROC AUC/AP) are as follows:

Theoretically, from the perspective of computational complexity and estimation fidelity, LiSSA and DataInf are expected to provide more accurate approximations of the inverse Hessian than diagonal approximation. However, in our current experiments, we observe that the performance of the diagonal approximation is competitive with, and in some cases even superior to, LiSSA and DataInf.

One possible reason is that LiSSA and DataInf involve more sensitive hyperparameters (e.g., number of iterations, damping), and tuning them appropriately for each setting is non-trivial. Despite this, the diagonal approximation—which is significantly more efficient—achieves consistently strong performance across all datasets. This suggests that our use of the diagonal approximation, while simplistic, does not lead to a substantial degradation in influence estimation accuracy in practice.

---

[r1] New Insights and Perspectives on the Natural Gradient Method, JMLR 2020.

[r2] Deep learning via Hessian-free optimization, ICML 2010.