PaperlayerView exact revision on arXiv

Source-linked AI summary

Phantom Forgetting: How BatchNorm State Fakes Deletion in Edge Split Machine Unlearning

Anand Agrawal, Anil Kumar Chillara, Naresh Mandan

arXiv:2610.34800v1cs.CR

TL;DR

Split-unlearning verification commonly uses forget accuracy, but distributed BN running statistics may alter predictions without changing learned weights. The paper separates parameter and buffer changes, localizes recalibration across edge and server placements, and finds substantial forget-accuracy drops with weights fixed. The results identify BN buffers as security- and privacy-relevant inference state and show that SIFG is not a privacy certificate.

  • Problem

    In split machine unlearning, forget-accuracy changes alone may not distinguish data removal from behavioral changes caused by distributed BN state.

    Source: §I · p. 1

  • Method

    The paper uses a state-only diagnostic that separates learnable-parameter and BN-buffer changes, localizes recalibration to edge, server, or joint placements, and defines SIFG to discount retain degradation.

    Source: §I · p. 2

  • Results

    61.50 percentage points: centralized forget-data BN recalibration reduced mean forget accuracy by this amount with zero weight change; split edge-only, server-only, and joint drops were 37.27, 41.71, and 51.90 points.

    Source: A. Centralized State-Only Apparent… · p. 4, B. Edge and Server Localization · p. 4

  • Takeaways & Limitations

    Distributed BN buffers, including edge-held state, are security- and privacy-relevant inference state, so split-unlearning evaluation must audit both client and server buffers.

    Source: §X · p. 6

    The study uses CIFAR-10 and compact convolutional models, lacks multi-seed aggregation, and does not establish generality across datasets, architectures, or heterogeneous edge fleets.

    Source: B. Scope and Limitations · p. 6

Abstract

from arXiv · show

Split learning is a natural fit for edge intelligence: a resource-constrained edge device runs the first layers of a network and offloads the remainder to a server, so that raw data never leave the device. When such a system must unlearn revoked or sensitive data for example to honor a right-to-erasure request, the deletion is commonly assessed through changes in forget-set accuracy. However, inference on an edge-server split also depends on non-learnable model state distributed across the two parties, and this state is especially volatile on edge devices subject to data drift, over-the-air updates, and checkpoint rollback. This paper isolates a state-integrity question with direct edge-security implications: can Batch Normalization (BN) running statistics create a target-specific forgetting signal even when every learnable weight remains fixed? We define a state-only diagnostic that separates learnable-parameter change from BN- buffer change and localizes the effect to the edge (client) side, the server side, and joint placements. We also introduce a state-induced forgetting gap (SIFG) that discounts simultaneous retain-set degradation. Over all ten CIFAR-10 forget classes, centralized BN recalibration on forget data reduces mean forget accuracy by 61.50 percentage points with zero weight change; in a split model, edge-only, server-only, and joint recalibration produce mean drops of 37.27, 41.71, and 51.90 points. The server-side state yields the largest selective gap relative to retain degradation, while joint recalibration causes the largest overall prediction change. These results establish distributed normalization buffers including those held on the edge device as security and privacy-relevant inference state, and show that forget accuracy should not be interpreted, or accepted as a deletion certificate, without an explicit edge-aware state-integrity audit.

I. INTRODUCTION

In split learning, inference depends on model state held by both the edge device and server, while deletion is commonly assessed through forget-set accuracy. This paper tests whether distributed BatchNorm buffers can create apparent forgetting with learned weights fixed, and introduces diagnostics for separating and localizing that effect.

I. INTRODUCTION

  • Split inference places model state on both sides of the edge–server boundary, and unlearning verification must distinguish removal from unrelated deployed-system changes.Source: §I · p. 1
  • A forget-accuracy drop can be caused by BN running-statistic changes rather than removal of learned information, even when learnable weights remain fixed.Edge drift, over-the-air updates, or inconsistent client/server state can make this change appear to be unlearning.Source: §I · p. 1
  • The paper formulates an edge-aware threat model in which edge-side or server-side BN buffers drift while learnable parameters remain fixed.Source: §I · p. 2
  • The state-only diagnostic reports parameter and BN-buffer changes separately alongside forget, retain, test, and prediction-disagreement metrics.Source: §I · p. 2
  • The state-induced forgetting gap (SIFG) measures target-specific apparent forgetting after discounting retain-set degradation.Source: §I · p. 2
  • The experiments localize the effect across centralized, edge-only, server-only, and joint BN recalibration over all ten CIFAR-10 forget classes.The findings are translated into edge-deployment failure scenarios and minimum verification requirements.Source: §I · p. 2

II. RELATED WORK

Prior work establishes the edge–server boundary as a systems and security concern and develops verification approaches for machine unlearning. This paper connects those concerns by studying how non-learnable normalization state can confound split-unlearning verification.

A. Edge Intelligence and Split Learning

  • Edge intelligence partitions computation between device and server, with split learning sending smashed activations instead of raw inputs; this work adds boundary-held inference state as a verification hazard.Source: A. Edge Intelligence and Split Learning · p. 2

B. Machine-Unlearning Verification

  • Unlearning verification research argues that behavioral change alone is insufficient, while split-unlearning work quantifies the cost of coordinated cross-boundary updates; this paper focuses on a state confound, not general certification.Source: B. Machine-Unlearning Verification · p. 2

C. Split-Learning Security and Normalization-State Sensitivity

  • Split-learning security studies leakage and malicious behavior, while BN recalibration and test-time normalization show that inference statistics can affect behavior under distribution shift.This work links that sensitivity to split-unlearning verification and localizes it across edge and server sides.Source: C. Split-Learning Security and… · p. 2

III. MODEL STATE AND THREAT MODEL

The split model distributes learnable parameters and normalization buffers across the edge client and server. The diagnostic tracks changes to those components separately and localizes BN-buffer changes by deployment location.

A. Edge–Server Split Model

  • The edge client maps input x to a smashed activation, which the server uses to produce the output score vector.The model state comprises learnable parameters θc and θs and normalization buffers Bc and Bs held on the edge and server, respectively.Source: A. Edge–Server Split Model · p. 2
  • A behavioral verifier’s accuracy and prediction-disagreement outputs do not identify whether a change originates from learnable parameters, edge buffers, server buffers, or broad model degradation.The model state is represented as θ = (θc, θs) and B = (Bc, Bs).Source: A. Edge–Server Split Model · p. 2

B. BN Buffers as Inference State

  • The diagnostic measures BN-state change separately at all, edge-only, server-only, and joint edge–server locations.For a centralized model, the state change is ΔBall; for a split model, the edge and server changes are ΔBc and ΔBs.Source: B. BN Buffers as Inference State · p. 3
  • The state-only diagnostic fixes learnable parameters and attributes measured prediction changes to modified BN running-state buffers when data, preprocessing, non-BN state, and execution settings are fixed.Inference-time BN uses channel-wise running-statistic buffers alongside learnable affine parameters.Source: B. BN Buffers as Inference State · pp. 2–3

C. Edge-Aware Verification Threat

The threat model concerns legitimate state transitions that may be misread as successful unlearning, without poisoning or protocol compromise. It contrasts verification based on forget accuracy alone with a state-aware audit.

C. Edge-Aware Verification Threat

  • A weak verifier accepts a large forget-accuracy reduction as successful removal, whereas a state-aware verifier checks whether normalization state could produce the same behavior.If it can, forget accuracy cannot independently identify parameter-level unlearning.Source: C. Edge-Aware Verification Threat · p. 3
  • The threat arises from legitimate state transitions, with no poisoning, model extraction, test manipulation, or protocol compromise assumed.The verifier may be an operator, internal auditor, compliance authority, or external evaluator.Source: C. Edge-Aware Verification Threat · p. 3
  • Edge-client BN buffers are a particularly plausible and consequential source of confounding because edge clients are often updated out of band and rarely re-audited weight by weight.Source: C. Edge-Aware Verification Threat · p. 3

IV. STATE-INTEGRITY DIAGNOSTIC

The diagnostic compares an unrecalibrated reference with a BN-recalibrated state and measures behavioral reductions while separating them from learnable-parameter change. SIFG discounts retain-set degradation, but the diagnostic is not a removal certificate.

A. Behavioral Reductions and the SIFG

B. Localization States

The localization report compares centralized, edge-only, server-only, and joint BN recalibration while retaining unselected buffers. The audit freezes learnable tensors and verifies that non-selected buffers remain unchanged.

B. Localization States

  • The location-specific evaluation includes centralized, edge-only, server-only, and joint edge–server recalibration, with non-selected BN layers retaining their original buffers.A central retain-data control distinguishes calibration-distribution effects from repeated evaluation.Source: B. Localization States · p. 3
  • The location-specific report tests whether deployed state provides an alternative explanation for observed behavior; centralized recalibration reports one BN-state change, while split placements report edge and server changes.Source: B. Localization States · p. 3
  • The audit copies the reference model, freezes learnable tensors, recalibrates selected BN running statistics on calibration data, then evaluates the resulting state.It ensures parameter change is within tolerance and non-selected buffers are unchanged.Source: B. Localization States · p. 4

V. EXPERIMENTAL METHOD

The experiments use ten CIFAR-10 class-wise forget/retain splits and held-out test partitions. They compare fixed checkpoints under centralized and split-model BN recalibration, with learnable tensors frozen and selected running statistics updated.

A. Dataset and Forget Distributions

  • For each of ten CIFAR-10 classes, that class's training samples define the forget distribution and the remaining classes define the retain distribution.Held-out test partitions measure forget and retain accuracy; reported variation across classes is class-wise sensitivity, not random-seed variation.Source: A. Dataset and Forget Distributions · p. 4

B. Models and Recalibration

  • The split model places 32- and 64-channel BN feature blocks on the edge and a 128-channel BN block plus classifier on the server.The edge transmits a 64-channel smashed activation, allowing edge-only, server-only, and joint recalibration.Source: B. Models and Recalibration · p. 4
  • All experiments reuse fixed 50-epoch checkpoints, freeze every learnable tensor, and update only selected BN running means and variances in a gradient-free traversal.Framework bookkeeping buffers are checked separately and excluded from the reported BN drift score.Source: B. Models and Recalibration · p. 4

C. Audit Procedure

The audit verifies parameter equality and attributes measured differences to selected BN state while tracking accuracy and prediction disagreement. In the centralized experiment, forget-data recalibration sharply reduces forget accuracy despite zero parameter change.

C. Audit Procedure

  • The audit derives recalibrated states from unchanged checkpoints and verifies parameter equality, isolating selected BN locations while keeping evaluation data and execution settings fixed.It reports test, retain, and forget accuracy plus prediction disagreement, since accuracy can hide label changes that cancel in aggregate.Source: C. Audit Procedure · p. 4

VI. RESULTS

  • The centralized and split-location experiments are summarized together in Table II.The table covers recalibration results across the reported locations.Source: §VI · p. 4

A. Centralized State-Only Apparent Forgetting

  • A 61.50-point forget-accuracy drop, from 0.7357 to 0.1207, occurs after centralized forget-data BN recalibration with ∆θ = 0.Retain accuracy falls 8.60 points, SIFG is 0.5290, and 33.61% of test predictions change; retain-data recalibration instead raises mean forget accuracy to 0.8096.Source: A. Centralized State-Only Apparent… · p. 4

B. Edge and Server Localization

Edge-only, server-only, and joint BN recalibration each produce forget-class accuracy collapse, but the largest collapse, most selective effect, and broadest prediction change occur at different placements. State-drift magnitude alone does not determine behavioral impact, motivating state-aware verification.

C. Class-Wise Stability and Disagreement

  • Server-only forget-drop variability is 0.1299 across classes, below joint at 0.2077 and edge-only at 0.2633; server-only also changes fewer predictions than edge-only.The corresponding prediction disagreements are 0.2505 and 0.3468, respectively.Source: C. Class-Wise Stability and Disagreement · pp. 4–5

B. Edge and Server Localization

  • A 0.5190 forget-accuracy drop and 0.4195 prediction disagreement make joint recalibration the largest overall change, while server-only recalibration has the highest SIFG at 0.3962.Edge-only and server-only recalibration reduce forget accuracy by 0.3727 and 0.4171, respectively; the edge-only SIFG is 0.2624, versus 0.3710 for joint recalibration.Source: B. Edge and Server Localization · p. 4, Table II · p. 5

D. State-Change Magnitude Does Not Predict Behavior

  • A centralized BN drift magnitude of 5.3263 versus 4.8289 accompanies opposite forget-accuracy effects of 0.6150 versus −0.0739 for forget-data and retain-data recalibration.Similar drift magnitudes can yield different class behavior, so buffer norms alone do not identify calibration provenance or affected decisions.Source: Table III · p. 5, D. State-Change Magnitude Does Not… · p. 5

E. Verification Consequences

  • A large forget drop with ∆θ = 0 should be labeled state-induced apparent forgetting, not certified removal.The report evaluates deployed model state and is compatible with any unlearning optimizer.Source: E. Verification Consequences · p. 5

VII. EDGE OPERATIONAL FAILURE SCENARIOS

Operational state changes can produce apparent forgetting without changes to learnable weights, through validation-mode leakage, non-atomic updates, incomplete integrity measurement, or deliberate threshold manipulation. The paper calls for state-aware checks that include persistent inference buffers on edge devices.

VII. EDGE OPERATIONAL FAILURE SCENARIOS

  • A client or server left in training mode during validation can update running statistics on forget-distribution batches despite disabled gradients and optimizer steps.Production pipelines should prevent this unless recalibration is deliberate.Source: §VII · p. 5
  • Non-atomic fleet updates can pair rolled-back edge state with newer server BN statistics, producing a model state that corresponds to no coherently trained model.A common version identifier should bind both sides and all state components.Source: §VII · p. 5
  • Parameter-only integrity hashes can miss persistent BN-buffer changes that alter predictions; audits should measure running means, variances, and other inference buffers on the edge device.Joint recalibration produced disagreement on more than 40% of test predictions.Source: §VII · pp. 5–6
  • Target-distribution BN recalibration can satisfy a forget-accuracy threshold while preserving learned weights, so verification should check parameter change, buffer provenance, retain behavior, and location-specific counterfactuals.The minimum state-aware verification requirements are framed for edge–server split unlearning.Source: §VII · p. 6, Table IV · p. 6

VIII. STATE-AWARE VERIFICATION REQUIREMENTS

Distributed BN buffers can produce apparent forgetting even when learnable parameters are unchanged, so verification must audit edge and server state separately. The paper proposes state-aware checks while limiting its claims to a diagnostic, not proof of data removal.

VIII. STATE-AWARE VERIFICATION REQUIREMENTS

  • A verifier should bind θ, Bc, and Bs to one coherent version, test BN state one side at a time, record calibration details, and combine state records with retain utility and prediction disagreement.When (11) holds, the supported conclusion is BN-confounded behavior; actual removal requires additional method-specific evidence.Source: §VIII · p. 6

A. Edge State Integrity as a Trust Boundary

  • Parameter-only integrity checks miss behaviorally significant differences in BN buffers; the proposed edge verifier preserves snapshots and joins edge/server reports by version.Where a trusted execution environment is available, binding the BN-buffer digest into device attestation would close this gap.Source: A. Edge State Integrity as a Trust… · p. 6

B. Scope and Limitations

  • The study does not compare unlearning methods, evaluate non-IID clients, or perform membership-inference audits, and its CIFAR-10 compact-model, class-wise results do not establish generality.SIFG is a behavioral diagnostic, not a privacy certificate; additional datasets, architectures, seeds, heterogeneous fleets, and device-level tests are needed.Source: B. Scope and Limitations · p. 6

X. CONCLUSION

  • With ∆θ = 0, forget-data recalibration caused 61.50-point centralized and 37.27-, 41.71-, and 51.90-point edge-only, server-only, and joint drops; server-side BN had the highest SIFG.Joint recalibration caused the largest overall prediction change.Source: §X · p. 6

Related papers

Loading 2610.34800v1…