Published Unlearning Numbers Move Per Checkpoint, a... | AI Research

Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpoints
This paper investigates a hidden variable in machine unlearning audits: the batch-normalization statistics. When researchers evaluate whether a model has successfully "unlearned" specific data, they compare it against a reference model retrained from scratch. However, the authors find that these models often ship with internal statistics (running means and variances) that were not updated by the unlearning process itself. By re-fitting these statistics on the retained data, the authors demonstrate that the published "pass/fail" results for many models change, revealing that these numbers are sensitive to how the internal state is managed rather than just the removal of data. The same large language models question is explored in Geospatial AI, Dataverse Metadata, and the..., which adds a research perspective.

The Hidden State Problem

Machine learning models, particularly convolutional vision models, contain batch-normalization layers that track running statistics about the data they process. These statistics are used during inference but are not typically updated by the gradient-based training steps used in unlearning. Because the unlearning process and the retrained reference model handle these statistics differently—or not at all—the audit comparison is often skewed. The authors argue that because these statistics are not recorded or standardized in model releases, auditors cannot know if a model’s performance is due to successful unlearning or simply the state of these "stale" statistics.

How the Audit Works

To test this, the authors performed a "rebuild" on 263 released checkpoints. They kept the model's trainable weights identical to the original release but re-calculated the batch-normalization statistics using only the data the model was supposed to keep. They then re-ran the standard unlearning evaluation metrics to see if the results changed. By comparing the original published numbers against these "refitted" numbers, the authors could determine if the model’s performance was stable or if it shifted significantly due to the internal state update. The same ai evaluation question is explored in Multi-Step Tool-Calling over Korean Open Public..., which adds a research perspective.

Key Findings

The study reveals that the movement of these numbers is a property of the individual checkpoint rather than the specific unlearning method used. Out of 221 checkpoints tested, 47 showed significant displacement past the researchers' margin of error. Importantly, the authors found that this shift is caused by the stale statistics drifting away from the weights, not by the "surviving" influence of the removed data. While most models remained stable, 12 published verdicts crossed the threshold from "pass" to "fail" (or vice versa) after the statistics were refitted, suggesting that current unlearning audits are sensitive to conventions that are rarely documented.

Important Considerations

The authors emphasize that this issue is specific to models with batch-normalization layers, such as certain convolutional vision models; it does not apply to architectures like LayerNorm or RMSNorm backbones often used in language models. Furthermore, the authors clarify that their refitting process is a second, defensible convention rather than a "correction" of previous work. They conclude that because these internal statistics can influence audit outcomes, future model releases should explicitly name the fitting convention used for these layers to ensure that unlearning claims can be accurately verified. The same large language models question is explored in Rethinking On-Policy Distillation of Large Language..., which adds a research perspective. as detailed in the full paper on Arxiv