---
title: "Using data attribution for AI alignment"
description: "In-Run Data Shapley is cheap enough to attribute behaviour during pre-training. What I would do with that: order the curriculum so a model holds human values before situational awareness."
published: 2024-07-09
tags: ["Interpretability and model internals", "Automating alignment research"]
importance: 6
confidence: "possible"
docStatus: "finished"
audio: "https://pub-4ee2f71bc29541a7a6e8d9694f0a1b21.r2.dev/668d67980a5496060d3a1328/audio.mp3"
figures:
  - src: "https://jacquesthibodeau.com/content/images/external/d0999041-2a1b79bbb2cba327cd714268aa590e05054b4f52d8d8121e.png"
    alt: "A page of the PaLM 2 technical report on inference-time control, with the closing paragraph highlighted where it says the effect holds across strata of input toxicity and is consistent with Korbak et al."
    width: 826
    height: 508
author: "Jacques Thibodeau"
canonical: "https://jacquesthibodeau.com/using-data-attribution-for-ai-alignment/"
---
This is a post on a recent paper I thought was cool. I give some follow-up project ideas after.

**In-Run Data Shapley:** [**Data attribution method**](https://x.com/ruoxijia/status/1810444361622245614) **efficient enough for *pre-training data attribution*.**

Essentially, it can track how individual data points (or clusters) impact model performance across pre-training. You just need to develop a set of validation examples to continually check the model's performance on those examples during pre-training. Amazingly, you can do this over the course of a single training run; no need to require multiple pre-training runs like other data attribution methods have required.

Other methods, like [influence functions](https://arxiv.org/abs/2308.03296), are too computationally expensive to run during pre-training and can only be run post-training.

So, here's why this might be interesting from an alignment perspective:

-   You might be able to set up a bunch of validation examples to test specific behaviour in the models so that we are hyper-aware of which data points contribute the most to that behaviour. For example, self-awareness or self-preservation.
-   Given that this is possible to run during pre-training, you might understand model behaviour at such a granular level that you can construct data mixtures/curriculums that push the model towards internalizing 'human values' much sooner than it develops behaviours or capabilities we wouldn't want. Or, you delay self-awareness and such much further along in the training process.
-   In this [Roger Dearnaley](https://www.lesswrong.com/users/rogerdearnaley?mention=user) post, [A "Bitter Lesson" Approach to Aligning AGI and ASI](https://www.lesswrong.com/posts/oRQMonLfdLfoGcDEh/a-bitter-lesson-approach-to-aligning-agi-and-asi-1), Roger proposes training an AI on a synthetic dataset where all intelligences are motivated by the collective well-being of humanity. You are trying to bias the model to be as close to the [basin of attraction for alignment](https://www.lesswrong.com/posts/EbGkqFNz8y93Ttuwq/requirements-for-a-basin-of-attraction-to-alignment) as possible. In-Run Data Shapley could be used to construct such a dataset and guide the training process so that the training data best exemplifies the desired aligned behaviour.

* * *

<!--kg-card-begin: html-->
<div class="admonition note">
<div class="admonition-title">Data is underrated in alignment</div>
<p>I think data is underrated among the alignment community (synthetic/transformed data even more). I have been thinking about it from the perspective of pre-training and post-training. My initial look into synthetic data was related to online learning and essentially controlling model behaviour. I was interested in papers <a href="https://github.com/google/sycophancy-intervention/tree/main">like this one by Google</a>, where they significantly reduce sycophancy in an LLM via 1k synthetically generated examples. Data shapes behaviour, and I think many people do not acknowledge this enough (which sometimes leads them to make confused conclusions about model behaviour).</p>
</div>
<!--kg-card-end: html-->

In terms of specific research projects, my current ideas fall into these kinds of buckets:

## Pre-training close to the basin of attraction for alignment

1.  **How much can we improve "Pretraining Language Models with Human Preferences"?** I'd like to transform training in various ways (as mentioned in your posts). For example, I could take fineweb and pre-train a GPT-2 sized model with the original dataset and a transformed version. Unclear so far which things I'd like to measure the most at that model size, though. A downstream experiment: is one model more likely to reward hack over the other? Does shard theory help us come up with useful experiments (pre-training with human feedback is almost like reinforcing behaviour and leveraging some form of shard theory)? Note that [Google used a similar pre-training scheme for PaLM 2](https://ai.google/static/documents/palm2techreport.pdf#page=23.43):

![A page of the PaLM 2 technical report on inference-time control, with the closing paragraph highlighted where it says the effect holds across strata of input toxicity and is consistent with Korbak et al.](https://jacquesthibodeau.com/content/images/external/d0999041-2a1b79bbb2cba327cd714268aa590e05054b4f52d8d8121e.png)

2\. How can the "**basin of attraction for alignmen**t" be mathematically formalized?

3\. **Trying to the impact of systematic errors**:

Studying reward misspecification: do the reward labels have a systematic effect and bias in pushing the model? How much of the model's behaviour is determined by the data itself vs. the reward model's misspecification? My current reading of the literature on this is a bit unclear. However, there's a [paper](https://arxiv.org/abs/2306.03286) saying: "We present a novel observation about the behaviour of offline reinforcement learning (RL) algorithms: on many benchmark datasets, offline RL can produce well-performing and safe policies even when trained with "wrong" reward labels, such as those that are zero everywhere or are negatives of the true rewards."

4\. How do we **design the training curriculum** to significantly bias the model's pre-training close to the basin of attraction for alignment?

Studying some form of iterative training where we have a synthetically trained model vs a normally trained model and then measure things like model drift. For example, is the model more likely to drift (in an online setting) in ways we wouldn't want it to if it is pre-trained on normal text, but the process is more safely guided through synthetic pre-training?

5\. Part of the alignment challenge (for example, the concern of scheming AIs) is that the order in which the model learns things might matter. For example, you'd want the model to **internalize a solid world model of human values before it gains the situational awareness** required to manipulate its training process (scheme). So, **can we design a training curriculum for specific capabilities s.t. the model learns capabilities in an ideal sequence?**

## Data attribution project ideas

1.  How to make this approach **work in tandem with unlearning**?

2\. Use data attribution methods to understand how specific data shapes model behaviour and use that information to **reconstruct pre-training to shape model behaviour in the way we want**. For example, can we side-step the need for unlearning? Can these data attribution methods augment unlearning to work better?

As Roger said in his comment, we can try to manage the **dataset to prevent WMB-dangerous capabilities** and things like self-replication. It's [quite possible](https://x.com/thegautamkamath/status/1810668671809003902) that [unlearning will not be enough](https://x.com/iliaishacked/status/1808424130754064386).

Another project would be to fine-tune on a dataset with and without the dangerous capabilities we don't want and use that as a benchmark for unlearning methods (and how easy it is to fine-tune the capability back into the model).

3\. **Including other methods beyond data attribution (e.g. SAEs)** to measure model evolution through training.

4\. Is it possible to better understand and **predict emergence via data attribution**?

5\. **Studying model generalization via data attribution** (doing similar things to the influence functions paper, but through time). Though the most interesting behaviour may only come at scales I wouldn't have the compute for.

6\. Would there be value in **using an early checkpoint** in training and then training on the synthetic data from that point forward? At which point in training does this make sense to do?

* * *

If you are interested in this kind of research, let me know! I'd love to brainstorm some potential projects and then apply for funding if there is something promising there.

## Sources

Every external link in this piece that has a captured card, with what that page said
when it was captured. The quoted lines below are not the author of this piece writing:
they are the linked page describing itself, recorded by `bun run link-cards` on the date
given, and kept so that a reader still has them if the original moves or goes away.

- **Ruoxi Jia** — @ruoxijia, x.com, 2024-07-08
  <https://x.com/ruoxijia/status/1810444361622245614>
  Captured 2026-08-28.

  > 1/n Interested in scalable, principled data attribution methods? Introduce In-Run Data Shapley, a method efficient enough for pre-training data attribution! (https://jiachen-t-wang.github.io/data-shapley.github.io/) Takeaways: ✅ Provides a formal framework to rigorously assess content creators' contributions to GenAI models. ✅ Tracks data contributions in real-time during training. ✅ Identifies…

- **Studying Large Language Model Generalization with Influence Functions** — Roger Grosse and 16 others, arxiv.org, 2023-08-07
  <https://arxiv.org/abs/2308.03296>
  Captured 2026-08-28.

  > When trying to gain better visibility into a machine learning model in order to understand and mitigate the associated risks, a potentially valuable source of evidence is: which training examples most contribute to a given behavior? Influence functions aim to answer a counterfactual: how would the model's parameters…

- **A "Bitter Lesson" Approach to Aligning AGI and ASI** — RogerDearnaley, lesswrong.com, 2024-07-06
  <https://lesswrong.com/posts/oRQMonLfdLfoGcDEh/a-bitter-lesson-approach-to-aligning-agi-and-asi-1>
  Captured 2026-08-28.

  > TL;DR: I discuss the challenge of aligning AGI/ASI, and outline an extremely simple approach to aligning an LLM: train entirely on a synthetic dataset that always shows the AI acting aligned (even when the humans behave badly), and use a conditional training/inference-time technique to lock the LLM into the AI role.…

- **Requirements for a Basin of Attraction to Alignment** — RogerDearnaley, lesswrong.com, 2024-02-14
  <https://lesswrong.com/posts/EbGkqFNz8y93Ttuwq/requirements-for-a-basin-of-attraction-to-alignment>
  Captured 2026-08-28.

  > TL;DR: It has been known for over a decade that that certain agent architectures based on Value Learning by construction have the very desirable property of having a basin of attraction to full alignment, where if you start sufficiently close to alignment they will converge to it, thereby evading the problem of "you…

- **Survival Instinct in Offline Reinforcement Learning** — Anqi Li and 3 others, arxiv.org, 2023-06-05
  <https://arxiv.org/abs/2306.03286>
  Captured 2026-08-28.

  > We present a novel observation about the behavior of offline reinforcement learning (RL) algorithms: on many benchmark datasets, offline RL can produce well-performing and safe policies even when trained with "wrong" reward labels, such as those that are zero everywhere or are negatives of the true rewards. This…

- **Gautam Kamath** — @thegautamkamath, x.com, 2024-07-09
  <https://x.com/thegautamkamath/status/1810668671809003902>
  Captured 2026-08-28.

  > 🧵New paper: Machine Unlearning Fails to Remove Data Poisoning Attacks, ft @MartinPawelczyk, @jimmy_di98, @ayush_sekhari, @SethInternet. Title says it all: current approaches for machine unlearning (MUL) are not effective at removing the effect of data poisoning attacks. 1/n

- **Ilia Shumailov🦔** — @iliaishacked, x.com, 2024-07-03
  <https://x.com/iliaishacked/status/1808424130754064386>
  Captured 2026-08-28.

  > Unlearning, originally for privacy, today is often discussed as a content-regulation tool. If my model doesnt know X, it is safe. We argue that unlearning provides illusion of safety, since adversaries can inject malicious knowledge back into the models. https://arxiv.org/pdf/2407.00106

- **GitHub - google/sycophancy-intervention: Scripts for generating synthetic finetuning data for reducing sycophancy.** — github.com
  <https://github.com/google/sycophancy-intervention/tree/main>
  Captured 2026-08-28.

  > Scripts for generating synthetic finetuning data for reducing sycophancy. - google/sycophancy-intervention

## Terms used

The author's own definitions for the glossary terms this piece uses. These are his words,
not a standard reference.

- **AGI** — Artificial general intelligence: a system with human level cognitive ability across domains rather than in one narrow task.
- **ASI** — Artificial superintelligence: a system that outperforms the best humans at essentially every cognitive task.
- **LLM** — Large language model: a neural network trained on very large amounts of text to predict what comes next.
- **SAE** — Sparse autoencoder: an interpretability tool that decomposes a model's activations into a larger set of mostly inactive features.
  See also: <https://jacquesthibodeau.com/automating-ai-safety-what-we-can-do-today/>
