Search papers, labs, and topics across Lattice.
The authors identify and formalize a severe evaluation artifact in machine unlearning on BatchNorm architectures, where a single forward pass over retain data without parameter updates resets running statistics and reverses apparent forgetting. Using a weight-preserving fixed-point operator framework, the work mathematically separates normalization-induced measurement bias from true residual weight-encoded information and decomposes linear-probe evaluation shifts. Across nine standard unlearning methods, statistic recalibration restores up to 78 percentage points of headline forget accuracy鈥攔ecoverable with as few as 10 unlabeled images鈥攚hile adopting GroupNorm eliminates the artifact entirely.
Up to 78 percentage points of reported machine unlearning success can be reversed with just 10 unlabeled images and zero weight updates, exposing widely cited forgetting benchmarks as mere BatchNorm illusions.
Approximate machine unlearning aims to remove the influence of specific training data from a trained model without retraining from scratch. We identify a previously undocumented confound in how unlearning is evaluated on BatchNorm-based architectures: a single forward pass over retain data, an operation that modifies no weight, can deterministically rewrite the model's normalization state and reverse the apparent surface-metric forgetting. We formalize this operation as a weight-preserving fixed-point operator and prove that any pre-versus-post gap it induces is provably attributable to BN running statistics rather than to any modification the unlearning method made to the weights. This attribution claim cleanly separates measurement failure (BN artifact) from encoder failure (residual weight-encoded information, recently documented in concurrent work), and the same operator framework yields a unique decomposition of linear-probe elevation into BN-measurement-bias and encoder-geometry components. Empirically, the artifact reverses headline forget accuracy by up to 78 pp across nine evaluated methods on standard benchmarks; an attacker with as few as 10 unlabeled images recovers most of the masked accuracy; and a strict GroupNorm control reduces the artifact to zero across all methods. The tested membership-inference attacks change little under recalibration, locating the observed evaluation failure in forget accuracy and linear probing.
