How to Value Data for AI Without Revealing It?

Artificial intelligence is booming, but there’s a snag: data are valuable yet must stay secret. This “value‑privacy” paradox means a buyer wants to know if a dataset is useful, but checking it could expose sensitive information.

The Trustworthy Influence Protocol, or TIP, solves this. It leverages homomorphic encryption, which lets you compute on encrypted data as if it were plain. A seller can send encrypted data, and the buyer can assess how much it would improve their AI model without ever decrypting it.

The key lies in gradient‑based influence functions: they measure each data point’s impact on the model. TIP combines these with homomorphic encryption, producing a “blind” score for every datum. For massive models like BERT or GPT‑2, TIP uses low‑rank gradient projections, cutting computation time while keeping near‑perfect fidelity to plaintext results.

Tests show encrypted valuation scores match real‑world utility in both healthcare and generative‑AI scenarios. Moreover, data value follows a heavy‑tailed distribution: a tiny fraction of texts drive most of the performance boost, while the majority are neutral or even harmful. This challenges flat‑rate payment schemes, hinting at a future where data are rewarded based on actual contribution.

In short, TIP paves the way for a safer, merit‑based data market, letting sellers prove worth without losing privacy and buyers invest with confidence.

The TIP protocol rests on two theoretical pillars: homomorphic encryption (HE) and gradient‑based influence functions.

1. **Homomorphic encryption**: HE enables arithmetic operations (addition, multiplication) directly on ciphertexts. Practical schemes like BFV or CKKS support real‑number calculations with controlled noise. In TIP, training data are encrypted with the buyer’s public key; the seller never holds the private key, so decryption is impossible.

2. **Influence functions**: Originating from Koh & Liang (2017), these estimate the effect of removing or adding a data point on a model’s loss. Formally, the influence of a point \(z\) on parameters \(\theta\) is \(\nabla_\theta L(z) \cdot H^{-1}_\theta \nabla_\theta L_{train}\), where \(H\) is the Hessian matrix. TIP computes these terms on encrypted data, leveraging HE to preserve privacy.

3. **Low‑rank projections**: For large models, computing the full Hessian is prohibitive. TIP employs a low‑rank decomposition (e.g., SVD) of gradients, retaining only the top‑k components that capture most variance. This reduces complexity from \(O(d^2)\) to \(O(kd)\), where \(d\) is the parameter count and \(k \ll d\).

4. **Correlation with real utility**: Experiments on medical datasets (e.g., MIMIC‑III) and LLM corpora (OpenWebText) show Pearson correlation > 0.92 between TIP scores and performance metrics (AUROC, perplexity). This indicates that “blind” valuation is virtually indistinguishable from traditional assessment.

5. **Data value distribution**: Analyzing the Lorenz curve reveals that 20% of texts generate 80% of LLM capability gains, confirming a Pareto‑type distribution. This evidence supports compensation models based on token‑level contribution or marginal utility metrics.

6. **Security and limits**: TIP is resistant to inference attacks as long as the private key remains secret. However, the noise introduced by HE can degrade precision if security parameters are set too high; a balance between privacy (security bits) and score accuracy is required. Moreover, scaling to models with billions of parameters demands specialized hardware (GPU/TPU with HE support).

In summary, TIP marks a decisive step toward transparent, secure data markets, merging cryptographic and statistical advances to assess true data value without compromising confidentiality.