Audit of 263 Batch-Normalized Checkpoints Finds Unlearning Numbers Move Per Checkpoint
Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpoints
This matters to developers because it reveals a potential flaw in how unlearning is verified for these models, which could impact trust in AI systems that rely on unlearning capabilities.
An audit of 263 released batch-normalized AI model checkpoints found that the numbers used to verify unlearning changed with each checkpoint. Refitting the checkpoints on retained data moved 47 of 221 past their original spread, showing the property of the checkpoint itself changed rather than the removed data surviving. The audit suggests releases should specify the fitting convention used for batch-normalized vision models.
Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpoints
An unlearning audit reads its verdict off numbers that an unlearned model and its retrained reference each publish, and both also ship batch-normalization statistics that no gradient step wrote and no release records. Refitting them on kept data at bit-identical weights moves 47 of 221 released checkpoints past the spread their own release's seeds show, several inside a method whose average does not move: what moves is the checkpoint's property, not its method's. What does the moving is not the removed data surviving in the state: exchanging kept records for removed ones inside a fixed fitting pool moves a published cell by almost nothing, while how far a checkpoint's shipped state has drifted from any refit does track it. The consequence for a published decision is real but narrow: twelve verdicts cross, four clear a measured recalibration budget, two clear it on every replicate, and a population we trained and sited near its own criterion yields none. A release should therefore name the fitting convention beside the number, on the batch-normalized vision models where this channel exists.