Summary of the discussion
A post on zhichai.net analyzes the paper "Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives" (Junlong Shen, Xingyu Li et al., arXiv:2609.11490).
The core problem
Machine unlearning audits compare an unlearned checkpoint against a retrained-from-scratch reference using three accuracy numbers (forget set, retain set, test set). But both arms carry BN running mean/variance statistics \(\phi\) that were accumulated via exponential moving averages during training and are never written by any gradient step:
- The retrained reference fits \(\phi\) naturally on retained data.
- The unlearned checkpoint inherits \(\phi\) from whatever the unlearning implementation did — some preserve the base model's \(\phi\) (still containing statistical traces of deleted data), some accumulate new \(\phi\) online.
- arXiv: https://arxiv.org/abs/2609.11490
- HTML: https://arxiv.org/html/2609.11490v1
- Code and per-run artifacts ship with the paper's supplementary archive.
A literature screen found that of 52 unlearning papers, 42 passed filtering, 19 used BN-bearing convolutional backbones, and only 4 mentioned this state (3 only to cite concurrent work).
The rebuild test
The authors froze weights \(\theta\) and replaced \(\phi\) with exact statistics \(\hat{\phi}\) computed via one forward pass over retained data under the training transform, then re-read the published numbers. The ±1.2pp margin was pre-registered (29 August 2026) as the median of the headline release's own seed spread. Each checkpoint was repeated 10 times; displacement required crossing the margin on all 10 (exact sign test, \(p = (1/2)^{10} = 0.00098\)), with Benjamini–Yekutieli correction.
Results
| Question | n | Result | |---|---|---| | Published numbers reproduce as-is? | 263 | all within ±0.02 | | Forget accuracy crosses ±1.2pp? | 221 | 47 displaced | | Retain accuracy displaced? | 221 | 39 | | Test accuracy displaced? | 221 | 40 | | Published pass/fail verdicts flip? | 263 | 12 flipped | | Flips survive recalibration budget? | — | 4 | | Flips hold on all 10 repeats? | — | 2 |
Displacement is per-checkpoint, not per-method: one family "equivalent to zero" on all three metrics still contained 8 of its 45 checkpoints displaced past the margin, with individual shifts of 2.2pp, 3.8pp, even 13.3pp.
Causal localization: stale, not surviving data
Provenance experiments using fitting pools of pure-retained, mixed, or fully deleted data moved forget accuracy by at most +0.057pp — none crossed 0.5pp. What matters is staleness: the distance between shipped and refit states exceeded reference bands on all 20 checkpoints, with median 5.43x the reference. Most- and least-displaced checkpoints had identical provenance distance but very different staleness.
Frozen-twin intervention
90 twin pairs were trained where one twin updated BN buffers online and the other froze buffer updates — weights bitwise identical, only buffer hashes differing. Across 6 weight-movement levels, the exposed arm showed a +33.80pp twin gap at matched weight distance, 95% CI [21.28, 46.32] — a causal isolation, not correlation.
Scope
The channel exists only in BatchNorm-based vision models. LayerNorm/RMSNorm backbones (all modern LLMs) have no running statistics. A second deployed state (quantization activation scales, 118 checkpoints incl. 47 swin-base transformers) showed zero displacement. The authors state explicitly: "Nothing here says how far a published cell of a language model moves."
Proposed fix
Keep the shipped state; add one reporting line to each release: *"deployed state as shipped; refit on the retained split under the training transform of train.py, cell moves +2.47pp"*. Three requirements should be separated: preserve the state, record its fitting history, and report the cell under a named rebuild convention.
Forum commentary
The author frames the paper as a new instance of several recurring patterns: audit blind spots (a variable never standardized, reported, or audited), the scalar illusion (family-level averages masking per-checkpoint displacement), judgment–gate decoupling, and a "current-carrying" variable (\(\phi\), not \(\theta\)). Two new concepts are proposed: the ghost variable (differs across audit arms, is unaudited, and flips conclusions when changed) and the stale statistic (fitted during training, used at inference, not updated after weights moved). The post praises the paper's audit rigor: pre-registered margins, exact sign tests, multiple-comparison correction, and self-reporting of a first-version instrument bug that reduced the largest family shift from +5.02pp to +2.47pp.