Batch normalization stats affect unlearning audit numbers in checkpoints

Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpoints

Artificial IntelligenceMachine Learning

Summary

When machines forget some training data, people check certain numbers to see if the forgetting really happened. The authors looked at many saved machine learning models and found that the batch normalization statistics, which are extra numbers saved in the model, can move the audit numbers even if the data meant to be forgotten is truly gone. This means that the method used to prepare these numbers during model saving matters for interpreting unlearning results. Because of this, the authors suggest that when releasing such models, creators should also share how these batch normalization statistics were computed.

What this means in practice

  • For machine learning engineers: Better verify if a model truly forgot data by checking how batch normalization stats were handled alongside audit numbers in checkpoints.
  • For ai compliance teams: Improve data removal audits by demanding checkpoint releases to document batch normalization fitting conventions to avoid misleading audit results.

Authors

Junlong Shen Xingyu Li

Abstract

An unlearning audit reads its verdict off numbers that an unlearned model and its retrained reference each publish, and both also ship batch-normalization statistics that no gradient step wrote and no release records. Refitting them on kept data at bit-identical weights moves 47 of 221 released checkpoints past the spread their own release's seeds show, several inside a method whose average does not move: what moves is the checkpoint's property, not its method's. What does the moving is not the removed data surviving in the state: exchanging kept records for removed ones inside a fixed fitting pool moves a published cell by almost nothing, while how far a checkpoint's shipped state has drifted from any refit does track it. The consequence for a published decision is real but narrow: twelve verdicts cross, four clear a measured recalibration budget, two clear it on every replicate, and a population we trained and sited near its own criterion yields none. A release should therefore name the fitting convention beside the number, on the batch-normalized vision models where this channel exists.
View PDFOpen arXiv