2D-OOB: Attributing Data Contribution Through Joint Valuation Framework

Weakness-1: Section 4.3 Clarification

Re.: In line 216 on page 7, we explicitly stated that the poisoned samples are relabeled from the source class to the target class.

---

Weakness-2: Difference between 2D-OOB and image feature attribution methods

Re.: Thank you for pointing this out. As the reviewer mentioned, both feature attribution methods and the joint valuation method we studied in this paper assign a score to each cell. However, we would like to clarify that they serve distinct purposes and are conceptually different.

Feature attribution methods measure the impact of a particular data point’s features on its model prediction. In the case of image classification, these methods explain which parts of an image are most influential for its model's prediction. In contrast, the joint valuation method measures the impact of each cell in the training dataset on the model training process. Hence, it explains which parts of training images are most influential or potentially harmful to the model's performance.

---

Weakness-3: Scalability

Re.: We have included the additional experimental results on the scalability of 2D-OOB in the general response.

---

Weakness-4:Regularization term

Re.: We calculate the normalized (min-max normalization) negative L2 distance between covariates and the class-specific mean in the bootstrap dataset, as stated in L439-440. The normalization is performed across those samples within the same class. We will present a more explicit formulation in the revision.

---

Weakness-5: Super-pixel

Re.: We employ a standard super-pixel technique to transform the (32,32,3) image into a 256-dimensional vector (This is explicitly stated in line 427 page 13 of our submitted manuscript). Specifically, we partitioned the images into equally sized $2\times2$ grids and used average pooling to reduce the pixel values to a single cell value. The super-pixel technique we employed has been widely used in numerous previous explainable machine learning works [1-4] to highlight key factors in a simplified illustration.

[1] Dardouillet, Pierre, et al. "Explainability of image semantic segmentation through shap values." International Conference on Pattern Recognition. Cham: Springer Nature Switzerland, 2022.
[2] Vermeire, Tom, et al. "Explainable image classification with evidence counterfactual." Pattern Analysis and Applications 25.2 (2022): 315-335.
[3] Shah, Sumeet S., and John W. Sheppard. "Evaluating explanations of convolutional neural network image classifications." 2020 International Joint Conference on Neural Networks (IJCNN). IEEE, 2020.
[4] Jethani, Neil, et al. "Fastshap: Real-time shapley value estimation." International Conference on Learning Representations. 2021.

Weakness-1: Novelty

Re.: Thank you for your feedback. We acknowledge that 2D-OOB may initially appear to be a natural extension of existing methods, as it is built on them. However, we believe our contribution is substantial in the field of data valuation, as our proposed method addresses both practical and conceptual challenges of 2D-Shapley and Data-OOB.

Compared to 2D-Shapely, our work significantly improves computational efficiency, as demonstrated by the empirical experiments in the submitted paper and the new results in our general response. In addition, we identify new use cases of the joint valuation framework, such as attributing data contribution through cell values, correcting erroneous cells, and detecting backdoor triggers, which have not been discussed in 2D-Shapley.

In comparison with Data-OOB, which only provides data-level values, our method is designed to assess cell-level values. This finer granularity in valuation presents a richer interpretation of data values by providing attribution for data values. Also, it enables new practical applications.

---

Weakness-2: Detailed study on different attacks

Re.: BadNets and Trojan attacks are popular data poisoning techniques that maliciously contaminate the training datasets by injecting samples patched with a pre-defined trigger [1,2]. To expand our analysis, we explored the impact of varying types of triggers in additional experiments. All variations we used in the experiments are motivated by [1,2]. 2D-OOB consistently demonstrates superior detection capabilities over 2D-KNN across all trigger variations. This result suggests that 2D-OOB has a stronger detection capability against non-random outliers in applications compared to 2D-KNN, as KNN algorithms focus on local proximity and can fail to capture global patterns in feature behavior effectively.

Table: Additional experiment results on backdoor trigger detection. Five independent experiments are conducted on each dataset and the average detection AUC across all datasets is presented. The average and standard error of the detection AUC are denoted by “average ± standard error”.

[1] Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017. [2] Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and X. Zhang. 352 Trojaning attack on neural networks. In Network and Distributed System Security Symposium, 2018. URL 353 https://api.semanticscholar.org/CorpusID:31806516.

---

Weakness-3: Scalability

Re.: We have included the additional experimental results on the scalability of 2D-OOB in the overall response above. Please let us know if there are any other aspects you'd like us to discuss further.

---

Question-1: Fig. 2 statement that 2D-OOB detects a majority of outlier cells by examining a small fraction of the total cells

Re.: 2D-OOB assigns a quality score to each cell, where smaller values indicate poorer quality and a higher likelihood of being outliers. Consequently, by checking cells with low scores, we can effectively scan out most outliers, as shown in Fig 2.

For Equation 4, the underlying intuition is that if a particular feature of a data point (i.e., a cell) consistently results in a high OOB error when used in weak learners, it indicates that the cell is of poor quality and potentially a harmful outlier, thus deserving a low score.

---

Question-2: Fig. 3 results

Re.: The relatively low test accuracy observed for the Jannis dataset can be attributed to inherent variations in data separability across different datasets. The Jannis dataset may exhibit more complex patterns or higher noise levels. For example, the covariates may not be useful enough to predict their labels. The performance similarity between 2D-OOB and 2D-KNN indicates that both methods might face similar challenges with this dataset.

---

Question-3: Section 4.4 results

Re.: For different weak learners (including 2-layer MLP), we use a consistent B of 1000, which is large enough to guarantee convergence empirically.

An autoencoder has the potential to identify outliers, while our out-of-bag joint valuation framework can provide richer information (i.e., identify both low-quality and high-quality cells). Given the differences in the objective of these methods, comparing the overhead of training an out-of-bag estimator versus a single model like an autoencoder might not be directly meaningful.

We hope this addresses your concern. Please let us know if there are any other aspects you'd like us to discuss further.

---

Question-4: Stronger baselines

Re.: Thank you for the question. Given that the joint valuation problem is still emerging, with the first concept introduced in 2023 [1], there is no established baseline beyond 2D-KNN. The proposed 2D-OOB demonstrates both practical effectiveness and computational efficiency compared to 2D-KNN in many downstream tasks.

[1] Liu, Zhihong, et al. "2D-Shapley: A Framework for Fragmented Data Valuation." ICML. 2023.

Weakness-1: the OOB framework requires the training algorithm to be a bagging method with weak learners

Re.: The primary objective of the joint valuation framework is to evaluate the quality of cells rather than to optimize model performance. The model used serves as a proxy for this evaluation, and it is important to note that a high-performing machine learning method does not necessarily ensure a justified valuation framework.

Additionally, we believe the bagging framework can be useful in many domains[1-3], and 2D-OOB can be easily integrated into these applications.

[1] Smaida, Mahmoud, and Serhii Yaroshchak. "Bagging of Convolutional Neural Networks for Diagnostic of Eye Diseases." COLINS. 2020.
[2] Dong, Yan-Shi, and Ke-Song Han. "A comparison of several ensemble methods for text categorization." IEEE International Conference onServices Computing, 2004.(SCC 2004). Proceedings. 2004. IEEE, 2004.
[3] Xinqin, L. I., et al. "Application of bagging ensemble classifier based on genetic algorithm in the text classification of railway fault hazards." 2019 2nd International Conference on Artificial Intelligence and Big Data (ICAIBD). IEEE, 2019.

---

Weakness-2: Impact of number of random features and bagging size

Re.: If the number of random features is too small, each weak learner becomes nearly random, which significantly diminishes the joint valuation capacity. This issue is independent of the bagging size, as nearly random weak learners, regardless of their quantity, fail to provide meaningful signals for effective evaluation.

In practice, for low-dimensional datasets, we recommend using a higher feature subset ratio to ensure sufficient capacity of weak learners. For high-dimensional datasets, a lower or moderate feature subset ratio might be more effective in distinguishing the impact of features.

---

Question-1: Clarification of fitting a logistic model in line 187 on page 6

Re.: The cell fixation experiment is divided into two separate stages. In the first stage (attribution), we use a subset bagging model with decision trees as weak learners to fit the joint valuation framework. In the second stage (evaluation), our objective is to assess whether low-quality cells were effectively removed, rather than to optimize model performance. Logistic regression was chosen because it is a simple yet powerful machine learning model commonly used to test data separability, which is a common practice in this field [1][2].

[1] Jiang, Kevin, et al. "Opendataval: a unified benchmark for data valuation." NeurIPS. 2023. [2] Liu, Zhihong, et al. "2D-Shapley: A Framework for Fragmented Data Valuation." ICML. 2023.

---

Question-2: Difference between Trojan and BadNets trigger

Re.: BadNets attack is implemented by directly inserting a white square into the original images. In contrast, Trojan attack specifically targets a pre-trained neural network model. The Trojan trigger is generated by initializing the trigger as a white square and tuning the pixel values in the square to strongly activate some selected neurons in the neural network [1]. We believe the similar performance of the two methods on BadNets square is likely due to the trigger acting as a significant feature. In other words, the trigger pixels significantly differ from the other pixels, making it easily detectable by both methods. The result on Trojan square suggests that 2D-OOB has a stronger detection capability against non-random outliers in applications compared to 2D-KNN, as KNN algorithms focus on local proximity and can fail to effectively capture global patterns in feature behavior. We will include this discussion in the revision.

[1] Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and X. Zhang. 352 Trojaning attack on neural networks. In Network and Distributed System Security Symposium, 2018. URL 353 https://api.semanticscholar.org/CorpusID:31806516.

---

Question-3: Original prediction performance for each task

Re.: The average accuracy (across B=1000 weak learners) of various weak learners are summarized in the table below. There are certain variations across the datasets. It is important to note that the original prediction performance is not correlated with the joint valuation performance.

---

Question-4: The implication of the connection to data-OOB in Proposition 3.1.

Re.: Proposition 3.1 shows that the 2D-OOB $\psi_{ij} ^{\mathrm{2D-OOB}}$ can be interpreted as the empirical expectation of the Data-OOB, conditioned on the inclusion of the j-th feature.

To clarify further, let's consider a simple case: assume that for a given data point, each specific feature subset is selected an equal number of times when it is not selected in a bootstrap dataset, i.e., it is in an out-of-bag. Under this assumption, the point mass of $j$-th cell within the data point is $\frac{1}{\sum_{l=1}^{L}\mathbb{1}(j\in S_l)}$, which uniformly considers all feature coalitions including $j$-th feature.

It justifies why the definition in Eqn. (4) (line 120) effectively attributes a data point's value to features. It shows that for a fixed $i$ and $j \neq k$, $\psi_{ij} ^{\mathrm{2D-OOB}}>\psi_{ik} ^{\mathrm{2D-OOB}}$​ implies that the cell $x_{ij}$ is more helpful in achieving a high OOB score, serving as an indicator of model performance.

Weakness: The novelty and contribution may be relatively marginal.

Re.: Thank you for your feedback. We acknowledge that 2D-OOB may initially appear to be a natural extension of existing methods, as it is built on them. However, we believe our contribution is substantial in the field of data valuation, as our proposed method addresses both practical and conceptual challenges of 2D-Shapley and Data-OOB.

Compared to 2D-Shapely, our work significantly improves computational efficiency, as demonstrated by the empirical experiments in the submitted paper and the new results in our general response. In addition, we identify new use cases of the joint valuation framework, such as attributing data contribution through cell values, correcting erroneous cells, and detecting backdoor triggers, which have not been discussed in 2D-Shapley.

In comparison with Data-OOB, which only provides data-level values, our method is designed to assess cell-level values. This finer granularity in valuation presents a richer interpretation of data values by providing attribution for data values. Also, it enables new practical applications.

---

Question: Could you please discuss what are the unique challenges of 2D-OOB that do not arise for 2D-KNN and Data-OOB?

Re.: The main technical contribution of 2D-OOB lies in the adoption of a subset bagging model, rather than the standard bagging model used in Data-OOB. This requires more careful formulation (as detailed in Equation 4) and presents additional challenges, such as more complex hyperparameter selection (for example, the feature subset ratio, which we have thoroughly examined in the ablation study in Appendix B.4).