Quotient Semivalues for False-Name-Resistant Data Attribution

2026-05-08

AI Summary

This study addresses the vulnerability of data valuation in machine learning to Sybil attacks, where data providers exploit fake identities or near-duplicate samples to inflate their utility. The work formally characterizes this “Sybil attack” problem and proves an inherent trade-off: exact Shapley fairness and unrestricted Sybil resistance cannot be simultaneously achieved. To reconcile this tension, the authors propose the quotient semivalue mechanism, which computes Shapley-, Banzhaf-, or Beta-type values based on evidence clustering rather than raw identities and employs a canonical representative operator to eliminate intra-cluster redundancy. This approach achieves robustness against both exact and approximate duplication attacks. In the DataMarket-Gym simulation environment, the mechanism reduces manipulative gains under Sybil attacks from 1.74 under baseline Shapley valuation to 0.96—approaching the level of honest participation—and delineates the Pareto frontier between fairness and attack resistance.

Abstract

Data valuation methods allocate payments and audit training data's contribution to machine-learning pipelines; however, they often assume passive contributors. In reality, contributors can split datasets across pseudonymous identities, duplicate high-value examples, create near-duplicates, or launder synthetic variants to inflate their share. We formalize this as false-name manipulation in ML data attribution. Our main construction is the quotient semivalue mechanism: compute Shapley-, Banzhaf-, or Beta-style values over evidence-backed attribution clusters instead of raw identities, using a canonical-representative operator to absorb within-cluster duplication. We prove an impossibility: on a fixed monotone data-value game, exact Shapley-fair attribution over reported identities is incompatible with unrestricted false-name-proofness, even on binary-valued instances, and characterize the split-gain of a general semivalue on a unanimity counter-example. The mechanism is exactly false-name-proof under two structural conditions: false-name-neutral within-cluster allocation and quotient-stable manipulations. Under imperfect provenance, when these conditions hold approximately, manipulation gain and fairness loss are bounded by three measurable quantities: escaped-cluster mass, value-estimation error, and clustering distance. We instantiate the mechanisms in DataMarket-Gym, a benchmark for attribution under strategic provider attacks. On synthetic classification tasks, quotient semivalues with example-level evidence reduce manipulation gain on duplicate and near-duplicate Sybil attacks from $1.74$ under baseline Shapley to $0.96$, near the honest level. The cosine-threshold and (false-merge, false-split) rate sweeps trace the corresponding fairness--Sybil frontier.

Problem

• false-name manipulation
• data valuation
• Sybil attacks
• data attribution
• machine learning

Innovation

• quotient semivalue
• false-name manipulation
• data attribution
• Sybil attack
• Shapley value