BatchNorm state causes false forgetting signals in edge split learning
Phantom Forgetting: How BatchNorm State Fakes Deletion in Edge Split Machine Unlearning
Cryptography and Security
Summary
When a small device and a server share parts of an AI model, sometimes the shared settings called Batch Normalization can make it look like the model has forgotten certain data even when no actual learning changes have happened. The authors show that these running statistics on both the device and server sides can fake forgetting, which means just checking model accuracy isn’t enough to prove data deletion. This matters for privacy and security when trying to erase sensitive information from AI systems at the edge.
What this means in practice
- •For edge device engineers: Detect and verify true forgetting in split learning models by auditing BatchNorm state on devices to ensure secure data deletion.
- •For security and privacy teams: Design unlearning verification processes that account for distributed normalization buffers preventing false deletion claims in edge split learning.
Authors
Anand Agrawal, Anil Kumar Chillara, Naresh Mandan
Abstract
Split learning is a natural fit for edge intelligence: a resource-constrained edge device runs the first layers of a network and offloads the remainder to a server, so that raw data never leave the device. When such a system must unlearn revoked or sensitive data for example to honor a right-to-erasure request, the deletion is commonly assessed through changes in forget-set accuracy. However, inference on an edge-server split also depends on non-learnable model state distributed across the two parties, and this state is especially volatile on edge devices subject to data drift, over-the-air updates, and checkpoint rollback. This paper isolates a state-integrity question with direct edge-security implications: can Batch Normalization (BN) running statistics create a target-specific forgetting signal even when every learnable weight remains fixed? We define a state-only diagnostic that separates learnable-parameter change from BN- buffer change and localizes the effect to the edge (client) side, the server side, and joint placements. We also introduce a state-induced forgetting gap (SIFG) that discounts simultaneous retain-set degradation. Over all ten CIFAR-10 forget classes, centralized BN recalibration on forget data reduces mean forget accuracy by 61.50 percentage points with zero weight change; in a split model, edge-only, server-only, and joint recalibration produce mean drops of 37.27, 41.71, and 51.90 points. The server-side state yields the largest selective gap relative to retain degradation, while joint recalibration causes the largest overall prediction change. These results establish distributed normalization buffers including those held on the edge device as security and privacy-relevant inference state, and show that forget accuracy should not be interpreted, or accepted as a deletion certificate, without an explicit edge-aware state-integrity audit.