Phantom Forgetting: How BatchNorm State Fakes Deletion in Edge Split Machine Unlearning
Abstract: Split learning is a natural fit for edge intelligence: a resource-constrained edge device runs the first layers of a network and offloads the remainder to a server, so that raw data never leave the device. When such a system must unlearn revoked or sensitive data for example to honor a right-to-erasure request, the deletion is commonly assessed through changes in forget-set accuracy. However, inference on an edge-server split also depends on non-learnable model state distributed across the two parties, and this state is especially volatile on edge devices subject to data drift, over-the-air updates, and checkpoint rollback. This paper isolates a state-integrity question with direct edge-security implications: can Batch Normalization (BN) running statistics create a target-specific forgetting signal even when every learnable weight remains fixed? We define a state-only diagnostic that separates learnable-parameter change from BN- buffer change and localizes the effect to the edge (client) side, the server side, and joint placements. We also introduce a state-induced forgetting gap (SIFG) that discounts simultaneous retain-set degradation. Over all ten CIFAR-10 forget classes, centralized BN recalibration on forget data reduces mean forget accuracy by 61.50 percentage points with zero weight change; in a split model, edge-only, server-only, and joint recalibration produce mean drops of 37.27, 41.71, and 51.90 points. The server-side state yields the largest selective gap relative to retain degradation, while joint recalibration causes the largest overall prediction change. These results establish distributed normalization buffers including those held on the edge device as security and privacy-relevant inference state, and show that forget accuracy should not be interpreted, or accepted as a deletion certificate, without an explicit edge-aware state-integrity audit.