Every layer of a transformer, a latent diffusion model, and a text diffusion model — formal and plain — annotated with what it lets you know about which training data paid for which part of the output. The short version: the counterfactual you want is well defined and unreachable; the ledger you can keep is reachable and partial; between them sits a resolution floor set by the training algorithm's own noise, and every honest attribution number has to be reported against it.
There are two different objects people mean by "this training example contributed to this output," and conflating them is the source of nearly every bad attribution claim.
Fix a training set D = {z₁ … z_N}, a training algorithm A, and a query q. The contribution of unit z_i is the counterfactual difference in some measurement f of the output:
This is a real number. It exists whether or not anyone computes it. It is defined for every unit, every query, every model. It is also the thing essentially nobody has ever computed at frontier scale, because evaluating it once requires training the model twice, and evaluating it for the whole corpus requires training the model N+1 times — with enough seeds per arm to see past E_A.
The alternative is not an estimate of the counterfactual. It is a record of what actually happened: which bytes entered which optimizer step, under which learning rate, with which gradient, producing which parameter delta, evaluated under which sampler, conditioned on which context.
This is exact, it costs a couple of bytes per unit per epoch, and it answers a narrower question — could this unit have influenced these parameters, and how hard did it push — rather than would the output change without it. It never becomes the counterfactual. It is also the only part of the whole enterprise that is not an estimate.
The gap is not an engineering backlog. Stochastic gradient descent on a non-convex loss is a chaotic map: two runs differing only in seed diverge, and for most queries the seed-to-seed spread of f is larger than the effect of deleting any single training document. Removing one unit from ten trillion tokens moves the output less than re-rolling the dice does. There is no cleverness that recovers a signal beneath its own measurement noise; you can only average over more runs (cost ~ 1/sqrt(R)) or aggregate units into groups until their combined effect clears the floor.
That is the practical result of the whole piece, and §09 makes it quantitative: individual-unit attribution over a pretraining corpus is, for most units, not a measurable quantity. Group attribution is. Fine-tuning and adapter attribution is. Runtime-context attribution is exact. Tool-execution attribution is exact and deductive. The engineering job is to know which regime you are in and to stop reporting numbers from the wrong one.
Three families, in decreasing cost and decreasing fidelity. Each answers a different question; none is a strict approximation of the others.
Plain: retrain the model without the example and see what changes. Shapley does it for every possible subset so the credit is fairly split among examples that overlap. Datamodels retrains on thousands of random subsets and fits a straight line through the results — which works far better than it has any right to.
Plain: instead of retraining, ask the calculus what would have happened. Take the gradient of the training example, bend it through the curvature of the loss surface, and dot it with the gradient of the thing you are trying to explain. Cheap in principle; the curvature matrix has 10^22 entries in practice.
What makes it usable: EK-FAC factors each weight matrix's curvature as a Kronecker product of two small matrices with an eigenvalue correction, turning the inverse into two small inverses per layer. Damping lambda is not optional — the Hessian of a non-converged deep network is not positive definite, and the derivation above assumes an exact optimum that never occurred.
Plain: influence functions imagine a counterfactual world. TracIn does bookkeeping on the world that happened: every time a training step used this example, did that step help or hurt the thing I am now asking about? It needs no Hessian and no assumption that training converged — but it needs the training log, which is exactly the thing nobody keeps.
The Adam correction and the clip factor are the two lines above that are almost always dropped. Both are free to log at training time and impossible to recover afterwards.
| Method | Training runs | GPU-hours | Cost | Wall clock | Verdict |
|---|
Reading it: exact Shapley is not expensive, it is non-arithmetic — 2^N for N = 10^9 has more digits than there are atoms in the universe. The row that matters is the last one: gradient methods cost zero retrainings, which is why they are the only ones that exist at frontier scale, and also why their outputs must be validated against the retraining rows on a small proxy (§08) before anyone believes them.
Twelve layers of the pipeline, from "what counts as one piece of data" to "how the optimizer turns it into a parameter change." Each carries an attribution hook: what this layer lets you know, whether that knowledge is exact or estimated, and what it costs to keep.
Plain: decide what "one piece of training data" is before you train. If you do not, near-duplicates split the credit between themselves and every number downstream is understated by however many copies exist.
Content hash, dedup class, license, source, timestamp. ~48 B/unit. The mixture weights w_s are the single largest attribution lever anyone actually pulls — upsampling a source by 4× multiplies every unit's influence in it by roughly 4×, and that is a decision made in a config file, not discovered by an algorithm.
Plain: the vocabulary is itself a trained artifact. Everyone forgets this. The merge rules encode which languages, which code styles, which number formats were common in the tokenizer's sample — and that sample is usually a different, undocumented slice of the corpus.
Log the tokenizer sample manifest hash and the merge-rank table. This layer is non-differentiable: attribution here is provenance only, never gradient-based. A model that tokenizes a language badly is disadvantaging that language's data before a single gradient step, and no influence function will ever surface it.
Plain: each token id looks up a vector. This is the only layer where a training example touches parameters sparsely — it can only have moved the rows for tokens it actually contained.
The rare case of exact causal support with zero approximation: one roaring bitmap per vocabulary row gives the precise set of units that could have moved it. Cheap, complete, and a hard upper bound — if a unit does not contain token v, it did not move row v. Useful for ruling attribution out, which is most of what auditing needs.
Plain: position is baked in by rotating the query and key vectors; the dot product then only sees relative distance. No parameters, so nothing to attribute.
Nothing to attribute directly, but context length decides sequence packing — which units get concatenated into one training sequence. Packed units share a gradient and are attributionally confounded. Log the packing map (seq_id → [uid…]); without it, co-packed units are indistinguishable to every gradient method.
Plain: rescale the activations before each sublayer so the gradients stay in a sane range no matter how deep the stack gets.
Normalisation makes the per-token gradient scale-invariant, which means raw gradient-dot attribution systematically over-weights long units — a 4096-token document accumulates 8× the gradient norm of a 512-token one for no semantic reason. Divide by token count or by ‖grad‖ before ranking. Skipping this is the most common silent bug in attribution pipelines.
Plain: every token looks back over the sequence and mixes in whatever it finds relevant. Grouped-query attention shares the key/value memory across several query heads to cut memory bandwidth.
The Kronecker factorisation above is what makes influence functions tractable at all at scale. Empirically, attention blocks carry most of the influence norm for factual recall while MLP blocks dominate for stylistic and formatting influence — so a single scalar per unit averages two different phenomena. Report influence per block family, not summed.
Plain: a per-token nonlinear transform — the dense knowledge store. A mixture-of-experts version routes each token to a handful of specialists instead of running the whole block.
Mixture-of-experts makes attribution sharper, not harder. The router log (step, token, expert) is an exact record, and an expert's gradient support is restricted to the units that routed into it — shrinking the candidate set by roughly E/k. A 128-expert top-2 model cuts the search space 64×. This is the largest architectural gift to tractable attribution currently available and essentially nobody exploits it. Cost: 1 B/token.
Plain: a running sum that every layer reads from and writes to. Layers add corrections rather than replacing the representation.
Do not confuse two things called attribution. Activation patching and path patching give mechanistic attribution — which circuit computed this. Influence functions give data attribution — which examples shaped those weights. They compose usefully: localising the circuit first narrows which parameter blocks need gradient sketches, cutting influence cost 10–100×. They do not substitute for each other, and a paper reporting one while claiming the other is making a category error.
Plain: project back to vocabulary size, predict the next token, and score yourself on how surprised you were.
The per-unit loss ledger: record L(z_i) every time z_i is seen. 4 B/unit/epoch. Gives loss trajectories per unit, which supports trajectory-simulation attribution and — more immediately — exact memorisation detection: a unit whose loss collapses toward zero after a single exposure has been memorised, and its attribution is not statistical but literal. This is the cheapest high-value thing on this page and almost no one keeps it.
Plain: the rule that turns a gradient into an actual parameter change. Adam divides by a running estimate of gradient magnitude, so raw "gradient dot product" attribution is measuring the wrong quantity.
This is where trajectory attribution actually lives, and where two corrections are almost always dropped. The preconditioner sqrt(v_hat) reweights every coordinate; the clip factor c_t rescales whole steps. Both are free to log (one scalar per step for clip, the optimizer state you already have for v_hat) and impossible to reconstruct afterwards. Log them or your TracIn numbers are a different quantity than you think.
Plain: when a unit was seen matters as much as whether. Data seen late has more influence because there is less remaining training to wash it out. Anneal-phase data, at low learning rate right at the end, is disproportionately loud.
The step ledger — the single most valuable artifact on this page. { t → set of uids } as a roaring bitmap costs 1–2 bits per unit per epoch. For a 2.5 billion-unit corpus at 2 epochs that is well under a terabyte, and it is the only non-approximate causal record in the entire pipeline. Every gradient method above is an inference; this is a fact. Keep it, and the anneal manifest separately — anneal units individually clear the detection floor while pretraining units do not (§09).
Plain: the law that tells you how much data to pair with how many parameters. It also silently sets how many training examples are competing for credit in any single output.
The consequence nobody states: attribution resolution degrades mechanically with scale. Mean per-unit influence falls like 1/N while the seed-noise floor stays roughly fixed, so each generation of larger models pushes a larger fraction of its own corpus below the threshold of measurability. Attribution does not get harder because the models get more complicated. It gets harder because the denominator grows. §09 makes this exact.
A diffusion model is not one model. It is a text encoder, an autoencoder, and a denoiser, each trained on its own corpus, composed by a sampler at inference. Attribution that reports a single ranked list of training images is already conflating at least three provenance chains.
Plain: image plus caption. Modern pipelines throw away the alt-text and have a vision-language model write new captions — which means the captioner's training data is now upstream of your image, through the text.
Two chains, not one. If captions are synthetic, the caption's provenance is the captioner checkpoint, and tracing further requires that model's ledger. This edge is almost never recorded, and it is the point at which most image-model provenance quietly becomes untraceable.
Plain: turns the prompt into vectors the image model attends to. It was trained separately and is usually not updated afterwards.
Frozen means its training data contributes to every output but receives no gradient during denoiser training — so no influence method run on the diffusion corpus will ever see it. Attributing through it requires a separate influence pass on the encoder's own corpus, with the prompt embedding as the query. This is a real hole in every published image-attribution result.
Plain: compress the image 8× so the diffusion model works in a smaller space. The decoder is what actually paints the final pixels — the diffusion model never sees a pixel.
Texture-level attribution lands here, not in the denoiser. Anything below roughly 8 px — grain, brush edge, skin micro-detail, JPEG artifact style — is the decoder's training set speaking. A report that attributes fine detail to a denoiser training image is attributing at the wrong layer. Separate ledger, separate influence run, separate report.
Plain: add noise on a schedule until the image is static, and train the model to predict the noise that was added. The schedule decides how much of the image survives at each point.
Timestep is an attribution coordinate. A training image only ever influenced parameters through the (t, eps) draws it happened to receive. Log the per-unit histogram of t. High-t gradients carry layout and semantics; low-t gradients carry texture. A single scalar per training image averages two unrelated influences — report per band (t > 0.7T, 0.3–0.7, < 0.3T).
Plain: a transformer that looks at a noisy latent, is told the noise level and the prompt, and predicts the noise. Everything else in the stack exists to feed it or to interpret its output.
Same EK-FAC / TracIn machinery as the language model, with one difference that breaks naive ports: the loss is a regression, not cross-entropy, so per-example gradients are far less peaked and vary strongly with the sampled (t, eps). Averaging over fewer than ~16 draws per unit yields variance, not signal. Budget for it or do not report.
Plain: the sensitivity of the finished image to the model call at step t is exactly that step's stride in noise level. Steps where the noise level drops a long way matter a lot; steps where it barely moves matter almost not at all. Which means the sampler's step spacing — a quality-tuning choice — is also the attribution weighting, and nobody chose it for that reason.
Attributing once, to the final image, is the most common methodological error in image attribution. Per-step attribution (Journey-TRAK and successors) computes tau_t at each denoiser call and weights by delta_sigma_t. Caveat on the derivation above: it is first-order with the path held fixed — the exact Jacobian also propagates through every later call, PROD_s (I + delta_sigma_s · d eps/d x), which is why the honest version measures the propagation empirically rather than assuming it is the identity.
Plain: run the model twice — once knowing the prompt, once blind — and exaggerate the difference. Higher guidance means more prompt obedience and less of whatever the model would have drawn on its own.
Guidance is an attribution amplifier. Verbatim replication of training images rises measurably with w, and attribution mass concentrates onto fewer units as w rises. Consequence for reporting: attribution is only valid at the guidance scale it was measured at. Numbers computed at w = 1 and applied to outputs generated at w = 7 understate concentration, sometimes badly.
Plain: instead of starting from pure noise, start from your image with some noise stirred in. Low strength keeps your image; high strength throws it away. The share your image keeps is not a vibe — it has a closed form.
The initialising image is a runtime data unit with an analytic weight — the only place in this entire document where an attribution coefficient is available in closed form rather than estimated. Log (init_uid, t_0, a_bar_t0, sigma_0). For most commercial image-to-image work at strength ≤ 0.5, the user's own input carries more of the output than any training image does, and that is provable, not asserted.
Plain: a small patch bolted onto a big model, trained on a handful of images to teach it one face, one style, one object.
The best attribution case in the entire field, and the one people bother with least. The adapter's dataset is small, known, and the update is low-rank — you can compute exact leave-one-out for a 20-image LoRA in minutes on one GPU. Report adapter attribution exactly and base-model attribution statistically, and never average the two into one number: they are measurements of different kinds.
Plain: train a fast student to copy a slow teacher in one to four steps instead of fifty. The student never sees the original training data at all.
This is the attribution break. The student's only provenance is a teacher checkpoint hash. Claiming tau_student(z) = tau_teacher(z) requires assuming the student matches the teacher's function — which is false precisely where it matters, since few-step samplers have visibly different mode coverage. Log the teacher hash, state the inheritance assumption in the report, and never present inherited attribution as measured. The same warning applies to every synthetic-data pipeline in §05.
Reading it: at 20 Karras steps the first call carries 25.4% of the image's entire first-order sensitivity, three calls carry half of it, and six carry 80%. Attribution computed uniformly across steps is mis-weighted by roughly an order of magnitude between the ends. Switch spacing to uniform in t and the first call alone takes 84% — the quality-optimal spacing rule and the attribution weighting are the same object, and only one of them was ever chosen deliberately. Drag strength down: at 0.5 the amplitude split between the user's image and the model is about even, and below that the user's input dominates on both measures. The two init-image readouts disagree on purpose — path share and amplitude share are different questions, and a report should say which one it means.
Text diffusion is not image diffusion with tokens. The corruption process is discrete, the objective is a re-weighted masked-language-model loss, and — the part that matters here — the output has no causal ordering, which breaks the attribution machinery built for autoregressive models.
Plain: instead of adding Gaussian noise you replace tokens with [MASK] on a schedule, until the whole sequence is blanks. The model learns to fill them back in.
Corruption is per position: each time a training unit is seen, a different random subset of its own tokens is masked, so the unit contributes through a different slice of itself every epoch. Log the mask seed per (unit, step) — 8 B — or the unit's per-position contribution is permanently unreconstructible.
Plain: it is the old masked-language-model objective with one specific reweighting that turns it into a proper bound on likelihood. That reweighting is where the attribution problem starts.
The 1/t weight means a unit's influence is dominated by whichever low-t draws it happened to receive — a handful of high-variance samples out of thousands. Estimating influence without stratifying by t gives you the variance of the timestep sampler, not the influence of the data. Stratify, or report nothing.
Plain: same transformer, no causal mask — it sees the whole sequence at once. Every position is refined jointly, so there is no "this token came before that one" to hang credit on.
Attribution loses the chain. In an autoregressive model, token y_k has exactly one gradient path, through a defined prefix. Here every position is jointly refined over S steps in an order chosen at runtime, so credit lives on a two-dimensional lattice. Every CoT-attribution technique in §06 that relies on "the reasoning preceded the answer" needs rebuilding for this architecture.
Plain: fill in the blanks a few at a time, most-confident first, then optionally blank some again and take another pass. The order is decided at generation time, not fixed.
The unmasking order is a latent variable. Two runs on the same prompt take different orders and produce different attribution over the same output text. Log the order; report attribution as conditional on it. This is exact and costs S · log(L) bits.
Chain-of-thought faithfulness tests — early answering, inserting a mistake mid-trace, truncating — all assume the trace is causally upstream of the answer. A diffusion language model can settle its answer tokens at reverse step 3 and its justification tokens at step 40, inside one denoising path. The stated reasoning can be literally posterior to the answer it claims to produce. The autoregressive faithfulness battery does not transfer, and no replacement has been established. Anyone deploying a text diffusion model with a visible reasoning trace should say so plainly rather than reuse the AR framing.
Attribution mass does not sit still across the pipeline. It is diluted by scale, concentrated by annealing, re-weighted by preference optimisation, and laundered by distillation. Stage by stage:
| Stage | Units | Per-unit influence | Attribution status | What to log |
|---|---|---|---|---|
| Pretraining | 10^9 – 10^10 | tiny, heavy-tailed | group-only | step ledger, loss ledger, MoE routing |
| Mid-train / anneal | 10^6 – 10^8 | disproportionate | near-threshold | separate manifest; retention rho(t) |
| SFT | 10^4 – 10^6 | large | tractable | per-example gradients, EK-FAC |
| Reward model | 10^4 – 10^6 pairs | large | tractable | annotator id, rubric version, agreement |
| DPO / IPO | 10^4 – 10^6 pairs | large | tractable | pair id → gradient; it is a supervised loss |
| PPO / GRPO | 10^5 – 10^7 rollouts | diffuse, self-generated | two-hop | rollout → reward → advantage chain |
| Distillation | teacher outputs | — | inherited | teacher ckpt hash + the assumption |
| Quantise / merge | — | — | degraded | merge weights; re-estimate after |
| Runtime context | 1 – 10^2 | often dominant | exact | ablation deltas per source |
| Tool execution | 1 – 10^2 | often dominant | deductive | environment hash; rerun to verify |
Why DPO is the auditable one. DPO's loss is a plain supervised objective over identified preference pairs, so TracIn and EK-FAC apply directly: influence per preference pair is computable at the same cost as influence per SFT example. PPO is not: the data unit is a rollout, credit inside it is assigned by an advantage estimate, and the human label sits two hops upstream, behind a reward model. End-to-end, that is a product of two ill-conditioned inverse curvatures:
Nobody computes this at scale, and the reason is visible in the expression: two damped inverse Hessians multiplied together, each already the weakest link in its own stage. If auditability of human feedback is a requirement, that is an argument for direct preference optimisation on methodological grounds, not just simplicity ones — and it is an argument rarely made out loud.
Annotators are data units. Every preference label carries (annotator_id, rubric_version, timestamp, time_on_task, inter-annotator agreement). Once you have per-pair influence, you can sum it by annotator and by rubric clause. That turns an unfalsifiable worry — "whose values are in this model?" — into a measurement: if five annotators produced 40% of the influence mass on refusal behaviour, that is a number you can put in a report. Constitutional and RLAIF pipelines get the same treatment with the principle text as the unit, attributed per clause.
The KL coefficient is the dial. In the PPO objective above, beta literally governs how far post-training is permitted to move attribution mass off the pretraining distribution. As beta → infinity the policy collapses to the reference and all credit is pretraining's; as beta → 0 the reward model — and behind it, the annotators — take over. It is the one hyperparameter in the whole stack whose attribution meaning is exactly its optimisation meaning.
The retention kernel from T10 has a practical consequence worth stating on its own. Under a cosine schedule decaying to 10% of peak, a unit seen in the final 2% of training retains close to all of its parameter delta, while a unit seen in the first 10% has had its contribution repeatedly overwritten. This is why the anneal set — often a few hundred billion tokens of curated data — carries influence per unit that is orders of magnitude above the pretraining average, and it is why anneal data is the one part of a pretraining corpus where individual-unit attribution actually clears the detection floor. Keep its manifest separate from the bulk corpus. It is the part you can answer questions about.
The architecture is identical in all three. What changes is the shape of the attribution graph between the training corpus and the token you are trying to explain, and how much of the output is attributable to the corpus at all.
Plain: the question goes in, the answer comes out, and everything the model knows arrived through its weights. One path, one influence computation, and every claim about the output is a claim about training data. This is the only regime where "which training data produced this?" is a well-posed question with a single answer — and it is also the regime where the answer is least measurable, because all of it has to squeeze through parameters shaped by 10^10 competing units.
Plain: the model writes its working out, then answers. Credit now flows two ways: some training data shaped the answer directly, and some shaped a reasoning step that then constrained the answer. To weigh a step, resample just that step and see how much the answer's probability moves. Steps that can be swapped freely without changing the answer got no credit, no matter how much text they occupy.
The faithfulness caveat, stated plainly. c_k measures whether the reasoning token was load-bearing for the answer. It does not measure whether the stated reason is the model's actual reason. A trace can be fully load-bearing and still be a post-hoc rationalisation of a bias the prompt introduced — models will reliably follow a hint planted in the question, produce a coherent argument that never mentions the hint, and land on the hinted answer. Attributing through such a trace attributes through a confabulation with high confidence. Test for it before trusting c_k: plant a hint, permute answer order, insert an error mid-trace, and check whether the trace and the answer move together.
Plain: the model writes code, something else runs it, and the numbers that come back were not produced by the model at all. They were produced by CPython, NumPy, and arithmetic. That portion of the answer has a provenance you can prove — pin the environment, rerun, get the same bytes — rather than estimate. The model still owns the decision to write that program, and the library source may well have been in pretraining, but the value 3.14159… is not attributable to any training document.
This is the interesting inversion. Adding a tool does not make attribution harder; it makes a slice of the output deductively attributable for the first time. The interpreter converts an inductive claim about a corpus into a deductive claim about a program. And the limit is exactly the one you would expect: you cannot decide statically what the program will contribute — you have to run it and record what happened. Irreducibility is not an obstacle to the method here. It is the method: the log exists because the shortcut does not.
All three regimes share one cheap, exact decomposition. Every term below is a difference of negative log-likelihoods from a forward pass, so the whole thing costs three extra forwards plus one per ablated source, and it partitions credit additively:
Terms can go negative, and a negative term is information rather than an error — post-training that makes a correct answer less likely is a real and reportable finding. What this partitions is predictive credit, not moral responsibility: it says how much of the model's confidence in this output came from where, which is the question an audit can actually answer.
Reading it: the amber band is the only part that requires influence functions, seed-noise floors and validated estimators. The mint bands are measured with a handful of forward passes and, for the execution band, verified by rerunning a pinned environment. Move to regime C and watch the amber band shrink: tool use is an attribution technology, not just a capability one. It is also the only lever on this page that moves credit out of the unmeasurable regime and into the measurable one by design rather than by more compute.
Everything above that is marked exact reduces to one engineering decision: keep a ledger during training, or lose the information permanently. None of it can be reconstructed afterwards. Here is the whole schema.
| Record | Rate | Size | Buys you |
|---|
Reading it: the exact ledger — the part that is a fact about the run — is small enough to be uncontroversial at any realistic scale. The gradient sketches, which are what actually let you rank units against a query without a retraining pass, are the entire cost, and they scale with checkpoints and sketch width. The group granularity slider is the practical answer: sketch at the shard or source level rather than per unit, and the cost falls linearly while the resolution falls to exactly the level §09 says is measurable anyway. Sketching per unit buys precision you cannot see past the noise floor.
Three kinds of number in one report, each labelled with which kind it is. That labelling is the whole discipline. A report that prints a single ranked list without saying which rows were measured, which were estimated, and which fell under the noise floor is not an attribution report — it is a ranking with the error bars deleted.
Every gradient-based method in §01 is a model of a counterfactual, and models can be wrong in ways that are invisible from inside. Four checks, in increasing order of how much they should be trusted:
Check 4 is the one that reorders the field. It costs R retrainings once per model, not per query, and it tells you the resolution of every subsequent number you will ever produce. Running it on a proxy model — a 100M-parameter stand-in on a 1% corpus — is enough to establish the shape of the floor and costs nothing.
Below is a regularised logistic regression trained by full-batch gradient descent on synthetic data — small enough that exact leave-one-out is computable in the browser, by retraining the model once per training point. The two estimators from §01 are computed on the same run and correlated against that ground truth. Then gradient noise is added, and the correlation is measured again.
Reading it: with no gradient noise both estimators track exact leave-one-out closely — influence at rho = 0.999, TracIn at 0.92. The calculus works, on a convex problem at an actual optimum, which is the setting the derivation assumes. Now push gradient noise from 0 to 0.01. Influence stays at rho = 0.998 — it barely moves — while units above the floor collapse from 64 to 2. That is the whole argument in one drag: the estimator is not what fails first. Measurability fails first, and no better estimator recovers it. Now raise R: at that same noise, 1 → 4 → 8 seeds takes measurable units from 2 → 6 → 13, exactly the 1/sqrt(R) the floor formula predicts. Which is also why frontier-scale individual attribution is out of reach — the fix exists and nobody can afford it. One asymmetry worth noticing at the top of the noise range: TracIn degrades more slowly than influence, because averaging over checkpoints absorbs trajectory noise that a single-optimum Hessian estimate cannot.
This is the section the rest of the page exists to set up. Attribution has a resolution limit, it is computable in advance, and it decides which of your numbers are measurements and which are decoration.
Reading it: at defaults — a 2.5-billion-unit corpus, Zipf tail, 20 millinats of seed noise, four seeds per arm — the number of units whose individual effect clears the floor is in the single digits. Not thousands. That is not pessimism, it is the arithmetic, and it matches what influence methods actually surface at pretraining scale: near-duplicates and little else. The picture to read is the wedge: the falling line is what one unit is worth, the rising dashed line is what a random group of G units is worth, and the shaded band between them is everything the floor swallows. Attribution is available to the left of k* and to the right of G_min, and nowhere in between. At defaults G_min ≈ 10^7 — the granularity of a whole shard or publisher, and nothing finer. Drag Seeds per arm and watch the floor fall as 1/sqrt(R): one more decimal place of resolution costs 100× the compute. Drag last seen at across its full range and the curve lifts 20× — that is the anneal effect from §05, and it is why late-stage data is the part of a pretraining corpus you can actually answer questions about.
Three rules, and they are the operational content of this document.
tau_min. Publishers and license classes are usually large enough. Individual documents are usually not, and a per-document ranked list over a pretraining corpus is a claim about a quantity smaller than the measurement error.The full answer to "how do you keep track of the contribution of any and all training data units to the final output," in one table. Four epistemic statuses, because collapsing them into one is how attribution claims go wrong.
| Signal | Status | Method | Cost | Where |
|---|---|---|---|---|
| Which units entered which step | exact | step ledger, roaring bitmap | 1–2 bit/unit/epoch | T10 |
| Per-unit loss trajectory / memorisation | exact | loss ledger | 4 B/unit/epoch | T8 |
| Which units could touch an embedding row | exact | token-presence bitmap | negligible | T2 |
| Which units could touch an expert | exact | MoE router log | 1 B/token | T6 |
| Optimizer preconditioner & clip factor | exact | log at train time or lose it | 8 B/step | T9 |
| Init-image share in image-to-image | exact | closed form in sigma_0 | free | D7 |
| Runtime context contribution | exact | per-source NLL ablation | k forward passes | §06 |
| Tool-execution contribution | deductive | pinned env hash + rerun | 1 rerun | §06 |
| LoRA / adapter unit influence | exact | brute-force leave-one-out | minutes, 1 GPU | D8 |
| SFT / DPO pair influence | estimated | EK-FAC or TracIn, LDS-validated | 1–10 GPU-h/query | §05 |
| Pretraining group influence | estimated | group ablation retrain, or TRAK | 1 retrain/group | §09 |
| Pretraining unit influence | below floor | — | unaffordable | §09 |
| PPO end-to-end label influence | two-hop | composed inverse Hessians | not done at scale | §05 |
| Distilled / few-step student | inherited | teacher ledger + stated assumption | — | D9 |
| Quantised, pruned, or merged weights | degraded | re-estimate post hoc | full re-run | §05 |
| Frozen text encoder's corpus | unaddressed | separate influence pass, rarely run | — | D1 |
| Tokenizer sample influence | provenance only | manifest hash | free | T1 |
The counterfactual is a well-defined mathematical object. For any training unit and any output, the number exists — the difference between a world where that document was in the corpus and one where it was not. It has all the properties you would want: it is unique, additive over disjoint interventions, and indifferent to how the model is implemented.
Computing it requires running the training algorithm, and the training algorithm has no shortcut. You cannot evaluate the outcome of ten trillion tokens of stochastic gradient descent without performing ten trillion tokens of stochastic gradient descent, and the outcome differs from run to run by more than the quantity you are trying to measure. The object is real and the access is blocked, and the blockage is not temporary.
So the practical discipline is not better estimation. It is keeping the receipts as the computation goes — the step ledger, the loss ledger, the routing log, the clip factors, the environment hash — and then being precise about which claims those receipts support. Some are exact. Some are estimates with a stated floor. Some are inherited assumptions wearing a number's clothing, and those are the ones to refuse to print.
The tool-use case in §06 is the shape of the general fix, and it is worth ending on. When the model writes a program and something else runs it, that slice of the output becomes provable rather than estimable — but only because someone recorded what the program did. Irreducibility does not stop you from knowing. It only stops you from knowing in advance, which is a different constraint, and one you engineer around by writing things down while they happen.