A cryptographic valuation protocol can let buyers measure dataset utility without seeing raw data, and simulations show encrypted scores closely track plaintext utility. The results suggest data value is heavy-tailed—few examples drive model capability—challenging flat-rate compensation in data markets.

Main Finding

The paper introduces the Trustworthy Influence Protocol (TIP): a practical, privacy-preserving framework that lets data buyers quantify the marginal utility of external data for a specific AI model without ever seeing the raw data. TIP combines gradient-based influence functions with Homomorphic Encryption (HE) and low-rank gradient projection to produce encrypted utility scores that (i) closely match plaintext influence scores across MLP, BERT and GPT-2 experiments, (ii) correlate strongly with realized utility in a healthcare retraining test (ρ = 0.96), and (iii) reveal highly skewed value distributions in real pretraining corpora — implying flat-rate data payments misprice most data.

Key Points

• Trustworthy Influence Protocol (TIP)

  • Decomposes the influence-function formula into two separable components (buyer-side and seller-side), so only an inner product is needed to evaluate marginal utility.
  • Each party prepares and encrypts its component; an untrusted broker computes the inner product homomorphically and returns encrypted scores; only the buyer can decrypt.
  • Guarantees that the buyer never sees raw seller data and the seller/broker never see the buyer’s private evaluation set or decrypted values.

• Technical approach

  • Uses influence functions (first-order Taylor approximation of parameter change) with the Inverse Hessian-Vector Product (IHVP) to estimate marginal change in evaluation loss.
  • Integrates Fully Homomorphic Encryption (FHE) to compute the inner product on ciphertexts.
  • Employs low-rank gradient projections (dimension reduction / LoGra-like techniques) to make IHVP and HE computations tractable for large models (BERT, GPT-2).

• Empirical findings

  • Encrypted scoring reproduces plaintext scores with near-perfect fidelity across tested models (MLP, BERT, GPT-2), with only a marginal computational overhead.
  • In a regulated healthcare data exchange, the encrypted influence scores correlated 0.96 with realized utility obtained from retraining — significantly outperforming simple similarity heuristics.
  • In a generative AI book-market simulation, data utility was highly skewed: a small minority of texts materially improved model performance while most data was neutral or harmful. This undermines flat-rate compensation used in some legal settlements and suggests merit-based pricing is needed.

• Practical deliverable

  • Authors provide a full implementation (linked in paper) to replicate experiments.

Data & Methods

• Valuation metric

  • Influence functions: estimate the effect of adding a candidate training point z_s using ∇θ ℓ(z; θ̂) and the IHVP H^{-1}{θ̂} via a first-order Taylor expansion of parameter change.
  • Final score is an inner product: s(z_s) ≈ (∇θ ℓ(z_eval)^T H^{-1}{θ̂}) · ∇_θ ℓ(z_s; θ̂).

• Cryptography

  • Fully Homomorphic Encryption (FHE) / HE scheme to encrypt the buyer’s preconditioned evaluation vector and the seller’s gradients independently; broker computes encrypted inner products and returns encrypted scores. Buyer holds decryption key.
  • Uses evaluation/relinearization keys to support ciphertext operations.

• Scalability techniques

  • Low-rank gradient projections / random-projection-style dimensionality reduction to compress gradient vectors before HE, preserving near-plaintext fidelity while reducing ciphertext sizes and computation.
  • Approximations to IHVP (practical second-order solvers / low-rank approximations) to avoid intractable Hessian inversion for large models.

• Models and datasets

  • Experiments across three model families: MLP (image), BERT (text classification), GPT-2 (text generation).
  • Two real-world instantiations:
    • Healthcare data market (real inpatient data) to compare encrypted score vs. retraining utility.
    • Generative AI book market to analyze value heterogeneity in pretraining corpora.
  • Evaluation metrics: correlation with retraining utility, fidelity to plaintext influence scores, and computational overhead.

• Security arguments

  • Formal proofs (in paper appendices) establish that no party learns the other’s raw inputs: seller never learns buyer eval data, buyer never learns seller raw data, and the broker only operates on ciphertexts.

• Limitations / operational constraints (noted by authors)

  • Protocol relies on accurate IHVP approximations and the low-rank projection preserving relevant gradient directions.
  • Computational cost of HE still non-negligible; scalability to extremely large (billions+ parameter) models requires careful projection and engineering.
  • Practical deployment requires addressing model accessibility: parties must be able to compute their gradient component (so either model gradients must be computable by the party holding the data or via a secure execution environment).
  • Boundary conditions (Section 5) include acquisition size limits, access constraints to buyer model or gradients, and potential trade-offs between fidelity and compression/HE cost.

Implications for AI Economics

• Resolves a core market friction (Arrow’s information paradox) for data-as-input to AI:
  • Buyers can verify ex ante the marginal utility of datasets without exposing data, reducing information asymmetry and adverse selection in data markets.
• Enables meritocratic, utility-based pricing:
  • Empirical skew in data value implies that uniform or flat-rate compensation systematically misprices contributions; TIP enables per-item or marginal-value payments.
  • Could change licensing settlements and commercial licensing structures away from flat lump-sum payments toward marginal-value contracts, royalties, or micropayments tied to decrypted influence scores.
• Affects bargaining power and market structure:
  • Sellers of rare, high-utility data gain pricing leverage if their items can be precisely valued privately.
  • Platforms and brokers can mediate without being trusted custodians of raw data, reducing onboarding friction for sensitive data providers (healthcare, proprietary corpora).
• Legal and regulatory impacts
  • Provides technical evidence for valuations in copyright and contract disputes (e.g., attribution of contribution to model capability), potentially informing damages or compensation design.
  • Could facilitate compliant data licensing in regulated domains (healthcare, finance) where raw-data transfer is restricted.
• Market design and welfare
  • More accurate marginal valuation reduces inefficient transfers and can improve aggregate welfare by directing payments to high-utility suppliers and discouraging training on noisy or harmful data.
  • However, practical adoption depends on lowering HE costs and resolving operational constraints (model access, incentive compatibility, potential for strategic behavior by sellers).

Overall, TIP furnishes a scalable cryptographic mechanism that makes model-specific, prospective data valuation feasible in practice, with strong implications for the design, pricing, and regulation of data markets in the age of generative and foundation models.