On the Fragility of Data Attribution When Learning Is Distributed

Data attribution has become an important component of pricing, auditing, and governance in machine learning pipelines, yet most attribution methods implicitly assume that attribution values faithfully reflect participants' contributions. We show that this assumption can fail: a single participant in a standard distributed training workflow can substantially inflate its measured attribution value while preserving global utility. Our attribution-first attack uses latent optimization to inject small synthetic batches that preserve utility while exploiting non-IID label coverage and evaluator sensitivities. Across datasets, models, and multiple marginal-utility evaluators, the attack consistently increases the adversary’s attribution value and reshapes the relative attribution structure among benign clients without degrading accuracy or triggering geometry-based defenses. These results show that attribution itself forms a new attack surface and motivate the development of attribution-robust and incentive-compatible scoring mechanisms.

Machine learning systems increasingly use data attribution methods to estimate how much different participants contribute to a model. These scores can influence rewards, reputation, and participation in collaborative AI systems. But can attribution scores be manipulated without affecting the model itself? In this work, we show that they can. We study distributed training systems in which multiple participants jointly train a shared model while keeping their data private. We find that a single participant can substantially increase its measured contribution while leaving overall model accuracy nearly unchanged. Our method uses latent optimization to generate small amounts of synthetic training data that subtly affect how attribution systems evaluate a participant. The attack remains effective across different datasets, models, and attribution methods, while staying difficult to detect with standard defenses. These results show that data attribution itself can become a security weakness in collaborative machine learning. More broadly, our work suggests that future attribution systems should be designed not only to measure usefulness, but also to resist strategic manipulation.