Data attribution has become an important component of pricing, auditing, and governance in machine learning pipelines, yet most attribution methods implicitly assume that attribution values faithfully reflect participants' contributions. We show that this assumption can fail: a single participant in a standard distributed training workflow can substantially inflate its measured attribution value while preserving global utility. Our attribution-first attack uses latent optimization to inject small synthetic batches that preserve utility while exploiting non-IID label coverage and evaluator sensitivities. Across datasets, models, and multiple marginal-utility evaluators, the attack consistently increases the adversary's attribution value and reshapes the relative attribution structure among benign clients without degrading accuracy or triggering geometry-based defenses. These results show that attribution itself forms a new attack surface and motivate the development of attribution-robust and incentive-compatible scoring mechanisms.

翻译：数据归因已成为机器学习流水线中定价、审计与治理的重要组成部分，但多数归因方法隐含假设归因值能忠实反映参与者的贡献。我们证明该假设可能失效：标准分布式训练工作流中的单一参与者可在保持全局效用的同时，显著放大其测量所得的归因值。我们的归因优先攻击采用潜在优化注入小型合成批次，这些批次在利用非独立同分布标签覆盖度与评估器敏感性的同时保持效用。跨数据集、模型及多种边际效用评估器的实验表明，该攻击始终能提升对手的归因值，并在不降低精度或触发基于几何特征的防御机制的前提下，重构良性客户端间的相对归因结构。这些结果揭示归因本身构成新的攻击面，并推动对归因鲁棒且激励相容的评分机制的研究。