Research map / Large language models / Language, safety and interpretability
DATE-LM: Benchmarking Data Attribution Evaluation for Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces DATE-LM, a unified application-driven benchmark and leaderboard for evaluating LLM data attribution methods on training data selection, toxicity/bias filtering, and factual attribution.
Problem
Existing evaluation of data attribution methods for LLMs is hard to reproduce, computationally expensive (retraining-based LOO evaluation), and lacks comprehensive application-driven evaluation, with factual attribution benchmarks biased toward lexical overlap.
Approach
A modular pipeline (attribution scoring, subset selection, task evaluation) with released model checkpoints and a leaderboard, across three LLM applications; for factual attribution it introduces a counterfactual setup that corrupts entities to break lexical overlap, and for toxicity filtering a heterogeneous setting that adds safety-aligned refusal data as distractors.
Key results
- On 1B pre-training data selection at 30k steps, EDU (a non-attribution classifier) achieved the best average accuracy (50.63) vs. Grad Sim 50.26 and random 49.83, showing simple baselines matching or beating attribution methods.
- In the heterogeneous toxicity filtering setting, Wildguard kept AUPRC 0.817 while data attribution methods dropped substantially (e.g., Grad Dot 0.234-0.326, LESS 0.515 at best for Pythia-1B).
- In factual attribution under the counterfactual setup, Grad Sim achieved Recall@50 of 0.626 on Llama3.1-8B versus BM25 0.313, showing attribution outperforms lexical baselines once lexical overlap is removed.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use EDU rather than random selection for Fineweb pre-training data | Pythia-1B pre-training · Fineweb pre-training, 30k steps | Avg accuracy: 49.83 -> 50.63 | Helped |
| Use non-attribution selection methods rather than random selection | Pythia-1B pre-training · Fineweb pre-training, 10k and 30k steps | Avg accuracy: 46.73 -> 47.73; 49.83 -> 50.63 | Helped |
| Use RDS+ rather than random selection | Llama3 8B, LoRA instruction fine-tuning · MMLU | accuracy: 60.2 -> 62.4 | Helped |
| Use BM25 rather than random selection | Llama3 8B, LoRA instruction fine-tuning · GSM8K | accuracy: 59.6 -> 60.2 | Helped |
| Use RDS+ rather than random selection | Llama3 8B, LoRA instruction fine-tuning · BBH | accuracy: 65.6 -> 66.9 | Helped |
| Add safety-aligned examples to benign data (heterogeneous filtering) | Data attribution methods · Toxicity/bias filtering | AUPRC | Hurt |
| Use cosine similarity rather than gradient dot product | Data attribution methods · Toxicity/bias filtering | AUPRC | Helped |
| Break lexical overlap by consistently corrupting factual labels | Factual attribution evaluation · Factual attribution | Recall@50 | Helped |
| Use data attribution rather than retrieval baselines for factual tracing | Factual attribution methods · Factual attribution | Recall@50 | Helped |
| Remove top-ranked influential examples and retrain | Grad Sim attribution · Factual attribution, Llama3.1-8B | Counterfactual rate: 0.273 -> 0.010 | Helped |
| Tune Gumbel temperature across values | Pre-training data selection methods · Fineweb pre-training | Avg accuracy | Mixed |
Surprising findings
- Non-attribution baselines such as EDU and Rep-Sim outperform expensive gradient-based attribution methods like Grad-Sim on pre-training and fine-tuning data selection.
- Data attribution methods drop sharply in the heterogeneous toxicity setting, where they flag safety-aligned refusal data stylistically similar to unsafe data, while LLM guard classifiers are largely unaffected.
Limitations
- Toxicity filtering uses only a small number of unsafe examples (<100 per dataset), so results may not generalize to larger or more diverse unsafe corpora.
- DataInf and EKFAC are excluded from 8B model evaluation due to memory and compute limits.
- Pre-training selection uses a single model (Pythia-1B) with a short 200-step decay stage rather than full pre-training.
Experimental setup
Datasets: FineWeb LAMBADA FLAN Tulu 3 MMLU GSM8K BBH UltraChat ToxicChat XSTest-response JailbreakBench ROME
Benchmarks: SciQ ARC-E ARC-C OBQA BoolQ HellaSwag PIQA MMLU GSM8K BBH ToxicChat XSTest-response
Metrics: accuracy AUPRC GPT score GPT ASR Recall@50 MRR counterfactual rate FLOPS
Baselines: Rep-Sim BM25 Grad-Dot Grad-Sim LESS MATES DataInf EKFAC EDU GradSafe Llama-Guard-3-8B Wildguard
Builds on: LESS MATES RDS+ Grad-Sim LAMBADA
Closest papers by meaning
- Fixing It in Post: A Comparative Study of LLM Post-Training Data Quality and Model Performance (NeurIPS 2025 · similarity 0.89)
- Scalable Influence and Fact Tracing for Large Language Model Pretraining (ICLR 2025 · similarity 0.89)
- AttriBoT: A Bag of Tricks for Efficiently Approximating Leave-One-Out Context Attribution (ICLR 2025 · similarity 0.88)
- Towards Effective Evaluations and Comparisons for LLM Unlearning Methods (ICLR 2025 · similarity 0.88)
- How Benchmark Prediction from Fewer Data Misses the Mark (NeurIPS 2025 · similarity 0.88)
- WAGLE: Strategic Weight Attribution for Effective and Modular Unlearning in Large Language Models (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.