PaperlayerView exact revision on arXiv

Source-linked AI summary

Forget the Data, Keep the Capability: Switchable Unlearning for Retrieval

Jingong Chen, Kyle Gao, Guangyuan Li, Chulwoo Pack, Sijia Liu, Kwanghee Won

arXiv:2610.36858v1cs.CV

TL;DR

Re-identification models must remove an individual's training influence without degrading recognition, but post-training removal is difficult when that influence is distributed through model parameters. MoME separates a Core trained without forget-set gradients from a parasitic Full-mode payload, and its Core reaches the retrained reference on membership attacks while retrieving above it. A deletion request is handled by disabling the payload, and Forgetting-Rank audits the resulting behavior.

  • Problem

    Post-training unlearning struggles to remove identity-specific influence embedded in model parameters while preserving retrieval, and deleted identities are not output categories that can serve as a direct forgetting target.

    Source: §1 · p. 1

  • Method

    MoME isolates full-data knowledge in switchable parasitic parameters and uses gradient isolation so Core receives no forget-set gradients.

    Source: §1 · p. 2, §3.2 · p. 3

  • Results

    Across Market-1501, VeRi-776, and RegDB, Core reads at the retrained reference on every attack while achieving higher retrieval performance, including on ResNet and CLIP backbones.

    Source: §5 · p. 8

  • Takeaways & Limitations

    A deletion request can be honored by disabling the Full branch rather than retraining, while the controller can retain the branch that restores full-data capability.

    Source: §1 · p. 2

    The guarantee applies to identities excluded from Core during training; a later request targeting identities already encoded in Core has no corresponding guarantee.

    Source: §3.3 · p. 5

Abstract

from arXiv · show

Privacy compliance requires re-identification models to selectively forget individuals while preserving their ability to recognize others. For this, we present MoME, a switchable framework that can adapt pre-trained backbones for privacy compliance, allowing the same model to switch between Full mode for standard inference and Core mode for unlearned inference. MoME splits one backbone into core parameters that preserve retrieval and zero-initialized parasitic parameters that carry the full-data knowledge, and training them under gradient isolation so the core never receives a forget-set gradient. Disabling the branch yields Core, which satisfies a request to delete a person's training data, and enabling it yields Full, which retains what the deleted data taught, so honoring the request is a flag flip rather than a retraining run. We prove Core independent of the forget set up to an audited set of coupling channels and introduce the rank-based Forgetting-Rank statistic to audit that independence in a trained model. On Market-1501, VeRi-776 and RegDB, Core reads at a retrained reference under three membership attacks while retrieving above it, and the retrieval advantage carries to ResNet and CLIP backbones. Code and weights are available at https://github.com/Jingong-Chen/MoME.

1. Introduction

Re-identification models must forget individuals without losing the ability to recognize others, but post-training approaches struggle to remove influence while preserving retrieval. MoME separates forget-set knowledge into a switchable branch and trains Core without forget-set gradients.

1. Introduction

  • Post-training unlearning faces a trade-off: methods preserve retrieval with strong membership signals or reduce leakage while collapsing retrieval, whereas retraining discards what the forget set taught.The retrained model is the reference for credible forgetting.Source: §1 · pp. 1–2
  • Re-identification deletion is difficult because identities are not output categories, and each identity shapes embedding geometry used to retrieve both seen and unseen people.Performance on deleted data alone does not establish that its influence was removed.Source: §1 · pp. 1–2
  • MoME uses gradient isolation to keep forget-set gradients out of Core while parasitic parameters retain full-data knowledge, making deletion a mode switch rather than retraining.The paper introduces Forgetting-Rank and evaluates Core against retrained references on Market-1501, VeRi-776, and RegDB.Source: §1 · p. 2
  • Core is independent of the forget set up to audited coupling channels, reads at the retrained reference under three membership attacks, and retrieves above it across three datasets.Full recovers full-data accuracy; the branch can also be adapted to ResNet, CLIP, and class deletion on CIFAR-10.Source: §1 · p. 2

2. Related Work

Prior unlearning work spans exact and approximate methods, but its common classification evaluation does not transfer directly to retrieval. Re-identification deletion efforts address related problems, yet do not provide MoME's combination of a never-exposed deployed model and an independence statement.

2.1. Machine Unlearning

  • Exact unlearning partitions data into shards but scales poorly, while approximate methods modify trained models through techniques including fine-tuning, gradient ascent, distillation, and weight selection.Recent approaches include LoTUS [41], MUNBa [47], and LOFT [12].Source: §2.1 · p. 2
  • Classification protocols combine forget-set accuracy, retain/test accuracy, and membership attacks, but retrieval lacks the paired forget-set signal because deleted identities are not output categories.Thus, the usual evaluation suite cannot score retrieval unlearning in the same way.Source: §2.1 · p. 2

2.2. Re-Identification and Identity Deletion

  • Re-identification privacy remains underexplored despite the field's progression from CNN metric learning to Vision Transformers [18] and cross-modal visible-infrared systems.Source: §2.2 · p. 3
  • De-ReID rejects identities at inference without removing their training influence, while TIU-ReID removes an adapter after its backbone has already seen the target identity.Only MoME's deployed weights never saw the forget set.Source: §2.2 · p. 3

3. Method

MoME separates a retrieval-preserving Core from a parasitic Full-mode payload, isolates Core updates from the forget set, and audits trained-model behavior with Forgetting-Rank. The setup targets identity deletion against a retrained reference and notes limits on later requests and state outside the gradient path.

3.1. Preliminaries

  • The deletion target is a set of identities, with all their images in U and none retained in Dr; the reference trains from scratch on Dr and membership is evaluated on U.On Market-1501, 4,972 of 12,936 retained-identity images are outside the kept prototype set and are trained on by neither Core nor the reference.Source: §3.1 · p. 3

3.2. Parasitic Parameter Mechanism

  • Zero-initialized additive parameters switch one backbone between Full and Core, while low-rank branches beside attention and FFN projections add Full-mode capacity without changing Core.The mode flag excludes parasitic terms from Core's computation graph; branch rank controls added Full capacity.Source: §3.2 · p. 3

3.3. Gradient Isolation

  • Gradient isolation updates θc from retain batches and θp from full-data batches in separate passes, preventing forget-set gradients from updating Core.Consolidation initializes the payload from θorig − θc, refines it on Df with Core frozen, and preserves separate BatchNorm statistics.Source: §3.3 · p. 4
  • For BatchNorm backbones, running statistics can absorb Df information outside the gradient path, so they must be frozen; later requests for identities already encoded in Core have no corresponding guarantee.Only Core is released after deletion; enabling the payload restores the removed capability.Source: §3.3 · pp. 4–5

3.4. Auditing the Guarantee: Forgetting-Rank

  • Forgetting-Rank compares Core's per-sample loss with same-procedure shadows that also excluded the sample; under exchangeability, its expected normalized mid-rank is 1/2.It complements reference-based attacks, which can confound forgetting with generalization differences between co-training and vanilla retraining.Source: §3.4 · p. 5
  • Under a 2% controlled violation, mean ranks placed all fourteen retained identities among the top fifteen of 676, while aggregate Forgetting-Rank and calibrated attacks required a 5% violation to detect leakage.These controls used a 90% deletion split and characterize audit sensitivity, not the deployed operating point.Source: §3.4 · p. 5

4. Experiments

Experiments compare MoME with retraining and unlearning baselines under identity-level deletion, then test component ablations and transfer to other backbones. Core matches the retrained privacy reference across attacks while exceeding it on retrieval, with transfer and ablation results delimiting where the switch works.

4.1. Experimental Setup

  • The evaluation deletes half the identities in Market-1501, VeRi-776, and RegDB, keeps k=4 images per retained identity, and scores test-set retrieval, deleted-identity retrieval, and three membership attacks.The reference is retraining from scratch on the retain set; Table 1 covers Market-1501 and VeRi-776, while Table 2 covers RegDB across modalities.Source: §4.1 · p. 5, §4.2 · p. 6, Table 1 · p. 6

4.2. Comparison to Unlearning Baselines

  • Baseline behavior varies by benchmark: on Market-1501 every baseline retains deleted-identity retrieval, while on RegDB none falls below Retrain; on VeRi-776, SCRUB reaches 1.1 mAP versus Retrain’s 32.8.On Market-1501, even the lowest baseline, LoTUS, reaches 98.3 mAP on deleted identities against 77.3 for Retrain.Source: §4.2 · p. 6
  • Core’s attack-score difference from Retrain averages +0.006 and never exceeds 0.032 across three benchmarks, five deletion splits, and three attacks; Core also has higher retrieval on all three datasets.Full reaches 99.8 mAP on deleted identities against Original’s 99.9 on Market-1501; the largest retrieval margin over Retrain is on RegDB, where the thin retain set lowers standalone Retrain performance by 19.3 mAP.Source: §4.2 · pp. 6–7

4.3. Ablation Study

  • Removing gradient isolation leaves Core at 85.1 mAP and attack score 0.995, while Full still reaches 88.3; without isolation, the core trains on the forget set.Removing Step 2 leaves Core within 1.0 retrieval and 0.011 attack score of the full method, but Full equals Core at 74.3 rather than reaching 81.5 with co-training; a frozen backbone reduces Core to 2.4 mAP.Source: §4.3 · pp. 7–8, Table 5 · p. 8
  • A single scale or shift shadow yields 75.4 mAP for Core, while co-training both raises Full to 81.5 for 1.0 mAP of Core; all three remain at the null on attacks.The results indicate that the parasitic budget sets capacity, while safety depends on whether the core sees the forget set.Source: §4.3 · p. 8

4.4. Generality across foundation model backbones

  • On ResNet-50, CLIP-ReID, and a scratch-trained CIFAR-10 ResNet-18, Core matches or beats retrained utility, but privacy is unresolved on the two non-ViT backbones and Full restoration fails outside the pre-trained ViT.The BatchNorm backbone also requires its running statistics to be frozen in Step 2, which these runs did not do.Source: §4.4 · p. 8, Table 4 · p. 8

5. Conclusion

MoME separates retrieval-preserving Core parameters from parasitic full-data knowledge, with Core independent of the forget set up to audited coupling channels. Across three datasets and two backbone families, Core matches the retrained reference on membership attacks while achieving higher retrieval performance.

5. Conclusion

  • Across Market-1501, VeRi-776, and RegDB, Core reads at the retrained reference on every attack while achieving higher retrieval performance on ResNet and CLIP backbones.The paper also introduces Forgetting-Rank as a rank-based audit of forgetting behavior in trained models.Source: §5 · p. 8
  • MoME separates retrieval-preserving core parameters from parasitic parameters that isolate forget-set knowledge.Under gradient isolation, Core is provably independent of the forget set up to paths outside the gradient.Source: §5 · p. 8
  • Forgetting-Rank provides a rank-based audit of forgetting behavior on the trained model.Source: §5 · p. 8

Supplementary Material

The supplementary proof makes exact Core independence conditional on explicit assumptions. It identifies two non-gradient paths through which forget-set information could otherwise reach Core.

Supplementary Material

  • The proof identifies Batch Normalization buffers in classification heads and the decision to apply an update as two paths by which data can reach parameters outside the gradient.The update-decision path required a code change before Assumption 5 held.Source: A. Gradient Isolation Yields Exact… · p. 11
  • Withholding forget-set gradients from Core alone does not establish independence, because data can reach parameters through paths outside the gradient.Source: A. Gradient Isolation Yields Exact… · p. 11
  • The two-step schedule makes deployed Core parameters provably independent of forgotten data only up to a small, enumerable set of audited coupling channels.Source: A. Gradient Isolation Yields Exact… · p. 11

A.1. Setup and notation

The supplementary material states the conditions for Core’s exact data independence, calibrates Forgetting-Rank against matched shadow models, and specifies how attack and utility results should be interpreted. The guarantee is conditional, while empirical agreement with a particular retrained baseline remains a measured result.

A.1. Setup and notation

  • Core is an exact unlearning procedure when its parameters are a deterministic function only of the initialization, retain set, and retain-side randomness, conditional on the initialization and retain set.The definition treats replacing the forget set with another of the same size as leaving the model distribution unchanged.Source: §A.1 · pp. 11–12
  • Core’s trajectory is equivalent to the same procedure with Step 2 removed, but neither that equivalence nor independence from the forget set implies agreement with a particular retrained baseline.The guarantee leaves utility unconstrained; the comparison with the reported baseline is empirical.Source: §A.1 · pp. 11–12
  • The independence proof requires explicit controls for coupling channels beyond gradients, including normalization state and separate update decisions for core and parasitic parameters.The result is conditional on Assumption 1; it gives no differential privacy with respect to the retain set and makes no claim about Full.Source: §A.1 · pp. 11–12

A.2. A calibrated test for residual memorization

  • Exact calibration gives E[ρU] = 1/2 under exchangeability, but correlated sample losses mean the average statistic must be read against the reference family’s spread.For each forgotten sample, the target and shadows excluding that sample have exchangeable losses; the per-sample calibration requires no distributional assumption.Source: §A.2 · p. 12
  • On Market-1501, Full moves ρU from 0.500 to 0.100, while the measured reference-family spread is 0.085 and the test resolves changes of about 0.17.The family spread is 5.8 times the spread predicted by exchangeability with identity as the unit.Source: §A.2 · pp. 12–13

B. Additional Experiments and Analyses

  • The appendix reads a single-model ρU by its distance from 1/2, with values below indicating residual memory and values above indicating over-forgetting.For family averages, the spread—not distance from 1/2—carries information; privacy must be read together with preserved utility.Source: B. Additional Experiments and Analyses · p. 13
  • Attack scores are interpreted against genuine retrained references, and low attack scores count as forgetting only when retrieval utility is preserved.The appendix also excludes distilled-from checkpoints from the calibrated reference family and uses a separate retrained-reference recipe on RegDB.Source: B. Additional Experiments and Analyses · p. 13

B.1. Training configuration

The learning-rate sweep shows that the tested baselines do not reach the retrained reference on attacks while preserving retrieval. Training configuration and controls show that Core-only consolidation can retain nearly all of the Full payload, with results varying by dataset.

B.1. Training configuration

  • The Market-1501 Core holds 74.2 mAP across five seeds versus 70.5 for the retrained reference, and consolidation from Core-only reaches 88.73 mAP versus 88.7 for the deployed payload.The consolidated payload leaves its source Core unchanged at 74.21 mAP.Source: §B.1 · p. 13
  • On RegDB, Core-only consolidation reaches 65.7 mAP versus 66.6 for the deployed payload while leaving its Core unchanged at 55.2 mAP.Thus, the near-equality of payloads is reported on Market-1501; on both datasets, nearly all of the payload survives construction from a core that never co-trained.Source: §B.1 · p. 13
  • The main runs use an ImageNet-pretrained ViT-B/16, SGD at 8 × 10^-3, and 120 epochs on Market-1501 and RegDB versus 40 on VeRi-776.Step-1 distillation uses retain-only teachers, with dataset-specific teacher counts and weights; consolidation adds 30 epochs at 4 × 10^-3.Source: §B.1 · p. 13
  • On RegDB, the retrained reference and teacher ensemble use AdamW because the shared SGD schedule fails to train on the 824 retained images.The Core uses the SGD schedule, and the baselines are given their own rates under the same rule.Source: §B.1 · p. 14
  • Baselines use the same checkpoint, retain set, deletion request, and TransReID pipeline, with their reported hyperparameters; selected methods receive rate sweeps where the shared schedule destroys the model.The LoRA row is an in-house MLP-adapter implementation, while LOFT projects the embedding without changing weights.Source: §B.1 · p. 14
  • 28.2 mAP against the reference’s 70.5 is the retrieval cost when NegGrad+ reaches the retrained reference on attacks; SCRUB does not reach it at any tested rate.Both methods preserve retrieval only where their attack scores rise to the level of a model that never unlearned.Source: Table 6 · p. 14, §B.1 · p. 14

B.2. Definitions of the reported privacy columns

The section defines privacy scores relative to retrained references and evaluates whether calibrated attacks distinguish Core from retraining. Its results also specify the threat model and the limits of the reported evidence.

B.2. Definitions of the reported privacy columns

  • The reported RMIA and U-LiRA attacks use label-free loss because non-member queries have no identity-head column, and their adaptations retain power against models trained on the forget set.The adapted attacks separate a model trained on U from a retrained reference at up to 0.38 true positives for 1% false positives, versus the reference’s 0.012.Source: §B.2 · pp. 14–15
  • Identity-level bootstrap intervals limit resolution: differences below roughly 0.04 on Market-1501, 0.05 on VeRi-776, and 0.09 on RegDB are unresolved by these pools.The table caption cautions that an interval containing zero does not establish a zero difference.Source: §B.2 · p. 16, Table 7 · p. 16
  • Against five independent retrains, Core lies within the retrain band on Market-1501 and RegDB, though its mean is 0.73 and 1.43 standard deviations above the band centre, respectively.The retrain-family comparison shows why separation from one reference can reflect that reference’s own variation.Source: §B.2 · p. 16
  • Rescoring against retrains disjoint from the distillation teachers changed none of 132 evaluated cells by more than 0.03, and no paper conclusion depends on those shifts.For Core on RegDB, RMIA moves from 0.50 to 0.53 alongside the retrained reference, preserving their gap.Source: §B.2 · p. 17, Table 8 · p. 17
  • 10 of 12 cells place Core within 1.5 standard deviations of the retrain band; VeRi-776’s low-false-positive cell is the exception at .0156 versus .0096±.0019.The authors do not claim indistinguishability at that operating point; the difference corresponds to about 285 versus 176 recovered members.Source: §B.2 · p. 17
  • The representation-level probe is omitted because identity-grouped folds reduce its Market-1501 scores and its positive control fails on two benchmarks.The authors attribute the problem to disjoint identity pools of different sizes and difficulty, which can dominate membership separability.Source: §B.2 · p. 18

B.3. The threat model

  • The guarantee concerns the released Core artifact and requests named before core training; it excludes information already encoded in public pretraining and makes no claim about retained data.The evaluated attacks receive a larger object than deployment does, including a classification head that is not released.Source: §B.3 · p. 18

B.4. The coupling channels, audited

The audit finds small, identifiable coupling channels around gradient isolation, while the parasitic affine family is complete for per-channel gates. In the trained model, the gate occupies a compact, structured subspace.

B.4. The coupling channels, audited

  • 201 of 211 core tensors are bitwise identical between γ-only and β-only variants; the ten differences are BNNeck running-statistic buffers that do not change the deployed retrieval feature.The variants also match at 0.4873 on the attack and differ in Full-mode mAP, 78.1 versus 77.8.Source: §B.4 · pp. 18–19
  • The measured shared-random-stream channel changes Core’s parameter norm by 1.26%, about a tenth of the 12.9% distance to a same-split retrain, without materially changing attack readings.The entropy scores are 0.492 and 0.491, and the calibrated scores agree to 0.002.Source: §B.4 · p. 19
  • The audit identifies gradient isolation’s remaining paths, including per-group update decisions and clipping, and reports that none of the exceptional paths ran in the reported runs.The deployed runs predate the drop counter, so that path is closed by the per-group decision rather than a log.Source: §B.4 · pp. 19–20

B.5. Completeness of the normalization affine parametrization

  • The parasitic affine parameters can realize any per-channel affine map at an augmented normalization site, making Full’s hypothesis class strictly larger than Core’s.This completeness is limited to per-channel transformations; it does not permit channel mixing.Source: §B.5 · p. 20

B.6. Low-rank structure of the parasitic gate

  • 95% of the stacked parasitic-scale spectral energy lies in 22 of 36 components, and the learned gate concentrates within middle-block pre-MLP normalizations.The gate’s compact structure is learned rather than imposed; the parameter difference to the original model is effectively full rank.Source: §B.6 · p. 20
  • The two JPM-branch final LayerNorms each hold 7.4–7.9% of gate energy, while no backbone site exceeds 5.5%; diagonal normalization gates therefore pair with low-rank linear-map branches.The branch descriptors are normalized before retrieval at those two largest sites.Source: §B.6 · p. 20

B.7. Generality across backbones, pretraining and tasks

Across the evaluated backbones and task, Core matches or exceeds its retrained reference on utility. The Forgetting-Rank reading varies in how much it resolves, while the parasitic payload’s behavior differs across backbones.

B.7. Generality across backbones, pretraining and tasks

  • Core matches or beats its retrained reference on utility across ViT, ResNet-50, CLIP, and CIFAR-10, with margins of 3.7, 14.2, 10.1 mAP and a CIFAR-10 dead heat.On ResNet-50, the five-seed reference and Core ranges are 32.4–34.5 and 46.6–48.7 mAP, respectively.Source: §B.7 · p. 20
  • For the Market-1501 ViT model, 95% of parasitic-scale energy lies in the top 22 components; the two JPM-branch final LayerNorms are the largest sites at 7.7% and 7.9%.The backbone’s largest site is 5.5%, and block 11, the final norm, and bottleneck sites carry zero.Source: Figure 5 · p. 21
  • Forgetting-Rank has limited resolving power on ResNet-50 and CLIP, where retrain readings span 0.22–0.82 and Core at 0.500 lies inside that range.The reference-family spreads are .241 on ResNet-50 and .232 on CLIP, compared with .085 on ViT and .050 on ResNet-18.Source: §B.7 · p. 21
  • The payload reads 0.100 on ViT and 0.152 on CIFAR-10 in the memorizing direction, but 0.880 on ResNet-50 and 0.896 on CLIP in the opposite direction.On ResNet-50, payload retrieval varies substantially across seeds: 52.0 ± 18.8 mAP versus Core’s 47.5 ± 0.9.Source: §B.7 · p. 21

B.8. Class deletion on image-classification benchmarks

On class-deletion benchmarks, method rankings depend on the metric and scale, so retained accuracy and attack scores must be read together. The reported comparison uses a shared ResNet-18 setup and a specified deletion protocol.

B.8. Class deletion on image-classification benchmarks

  • The comparison removes one tenth of classes on ResNet-18 and reports retained-class accuracy, deleted-class accuracy, and entropy-MIA against the test split at three scales.Every method shares the model, split, schedule, and evaluation; each entry is one seed-42 run.Source: §B.8 · p. 21
  • No single column separates methods: GA and NegGrad+ reach the attack null with retained accuracy of 11.1% and 12.7%, while MoME and SCRUB trade closeness across attack and utility.On CIFAR-10, SCRUB is closer on attack score, 0.24 versus the reference’s 0.26, while MoME’s retained accuracy is 94.1% versus SCRUB’s 93.8% and reference’s 94.3%. On CIFAR-100 and TinyImageNet, MoME’s attack scores match the reference within 0.004 and 0.002.Source: §B.8 · p. 21
  • Among the three deletion skews, only identity skew removes whole identities and approaches the exchangeable attack value; camera and imbalanced skews leave every identity in the retain set.Each skew is scored against four retrains on its own retain set.Source: Table 10 · p. 22

B.9. Deletion requests with a different unit

Across deletion units and request sizes, Core’s retrieval remains at least as high as under the uniform protocol, while calibrated audits distinguish image-level signals from identity membership and lose resolution for small requests. The Forgetting-Rank retains more resolution than calibrated attacks as the request shrinks.

B.9. Deletion requests with a different unit

  • With every retained-identity image kept, the reference-free attack reads 0.4989 on Core and 0.4957 on the retrain.No reference family was trained for this one-seed, unthinned protocol, so calibrated attacks cannot be assessed there.Source: §B.9 · p. 22
  • Core utility is 76.2 mAP under camera skew, 81.3 under imbalance, and 87.5 under identity skew, never below the uniform protocol.The identity-skew retain set grows to 12,025 images, so that result is not a like-for-like comparison at fixed retain-set size.Source: §B.9 · p. 22
  • For identity skew, which deletes 50 identities rather than the main protocol’s 376, calibrated attacks read 0.517 and 0.518, against 0.51 and 0.51 in the main protocol.This is the only variant here whose deletion unit matches the main protocol; it uses the base configuration without the distillation ensemble or low-rank pairs.Source: §B.9 · p. 22
  • For camera skew and imbalance, all identities remain in the retain set, so entropy attack scores of 0.872 and 0.917 reflect identity membership rather than whether particular images were forgotten.Against retrained references with the same identities, RMIA falls to 0.559 and 0.548; U-LiRA still reaches 0.711 on the imbalanced draw, exposing image-level signal.Source: §B.9 · p. 22

B.10. Resolution against request size

  • At five identities, the calibrated-attack interval half-width reaches 0.153 on Market-1501, so the audit cannot resolve differences below about 0.3; roughly a hundred identities are needed for resolution comparable to the full-request audit.Core and the retrained reference remain together at every tested size; the request size changes resolution, not that result.Source: §B.10 · pp. 22–23, Table 11 · p. 23
  • At five identities, the Forgetting-Rank band widens only to 0.1260 on Market-1501, while the planted payload remains at 0.100 and 3.2 band standard deviations from the null.The band grows by a factor of 1.5, compared with a factor of 7 for the attack interval; VeRi-776’s band grows by a factor of 1.1, though its wider absolute band gives lower resolution.Source: §B.10 · p. 23

B.11. Toward post-hoc unlearning

Retrofitting gradient isolation onto a checkpoint already trained on the full data does not unlearn it. The result matches the paper’s condition that Core’s independence guarantee starts from an initialization that never saw the forget set.

B.11. Toward post-hoc unlearning

  • After 30 epochs of post-hoc adaptation, all four variants retain 87.8–88.5 mAP against 88.0 for the original, while remaining identifiable on entropy attack and RMIA.Their attack ranges, 0.967–0.999 and 0.967–0.991, remain far above the retrained reference’s 0.493 and 0.511.Source: §B.11 · p. 23, Table 12 · p. 23
  • Gradient isolation withholds new forget-set gradients but cannot remove information already carried by the checkpoint’s weights.The independence argument begins with an initialization that never saw the forget set; retrofitting can reproduce the mechanism, but not that guarantee.Source: §B.11 · p. 23
  • PH1 freezes the backbone and reproduces the original model’s three attack scores exactly: 0.9986, 0.9907, and 0.9786.PH2 and PH3 move the backbone under isolation but land within a point of their starting performance; Naive is not distinguishable from the isolated variants.Source: §B.11 · p. 23
  • The post-hoc result is a single Market-1501 seed and is not repeated across seeds or the other benchmarks.Earlier purported repetitions are withdrawn because they used ImageNet initialization rather than the deployed checkpoint.Source: §B.11 · pp. 23–24

B.12. A rejection region for the rank statistic

The section develops an identity-level rejection region for Forgetting-Rank because the analytic null fails when images within an identity are dependent. Against genuine retrains, clean Core readings resemble the reference family, while a consolidated payload separates strongly.

B.12. A rejection region for the rank statistic

  • A Core-versus-retrain-family ranking cannot separate them: Core’s loss on deleted identities is below all five references, yielding 0.083 on every seed.The leave-one-out reading can miss a failure of isolation shared by every member, so the statistic’s power is demonstrated using planted violations.Source: §B.12 · p. 24
  • On retained Market-1501 images, Core’s mean loss is 0.313 versus 0.172 for references, consistent with retrains fitting their thin retain set harder.Core is the better model on identities neither procedure saw, distinguishing generalization from memory of the deleted set.Source: §B.12 · p. 24
  • The unit is one model paired with one identity, with identity-level scores formed from the mean rank across that identity’s scored images.Under exact exchangeability, the standardized score has unit variance; for Market-1501, K=5 and 376 deleted identities yield 1880 cells per family.Source: §B.12 · p. 24
  • The clean retrained family has a standard deviation of 2.68 across identity cells, despite the analytic null’s predicted 1; 137 of 1880 cells exceed the nominal family-wise threshold of 3.8.The resulting permutation test rejects for the retrained family at p ≤0.005, so it is not used as the audit’s null.Source: §B.12 · p. 24, Table 13 · p. 24
  • MoME-Core reads 3.15 and 220 cells beyond threshold, the same order as genuine retrains at 2.68 and 137, while the payload reads 5.59 and 1520 cells.The gap between clean Core and retrained families is small relative to either family’s gap from the payload.Source: §B.12 · p. 24
  • Across all three benchmarks, each deployed Core reading falls within its retrained family’s range, while retrained families spread two to four times as widely as Core families.Every family averages 0.5000 by a counting identity, so the informative quantity is its spread, which reflects retraining instability on a thin retain set.Source: §B.12 · pp. 24–25, Table 14 · p. 25

B.13. Membership inference diagnostics

The diagnostics distinguish deletion-specific membership from generalization and test both retrieval and attack behavior. They also identify limits: attack interpretation depends on the member pool and reference, and Batch Normalization buffers can carry an unaudited channel.

B.13. Membership inference diagnostics

  • On deleted identities U, Core’s membership AUC matches the reference at 0.493, while both score 1.000 on retained training images and near 0.94 on unseen images of retained identities.The whole-training-set AUC is 0.725 for Core and 0.722 for the reference, so a pool mixing these populations cannot certify forgetting.Source: §B.13 · p. 25, Table 16 · p. 26
  • Core exceeds the retrained reference on deleted identities U by 2.8 mAP on Market-1501 and 5.3 on VeRi-776, with similar advantages on held-out images of retained identities.Those paired gaps indicate generalization rather than memorization; the reference is especially unstable on VeRi-776, spanning 27.6–39.5 test mAP across seeds.Source: §B.13 · p. 25, Table 15 · p. 25
  • Freezing Batch Normalization running statistics changes the U membership attack by 0.006, but ResNet-50’s shared buffers were not closed during the generality runs.Those buffers can receive forget-set statistics during Step 2 and be reused by Core; no privacy claim is made for that backbone for this separate reason.Source: §B.13 · pp. 25–26, Table 17 · p. 26
  • The Forgetting-Rank’s within-family flatness is a counting-identity null, not evidence of forgetting; across families, Full mode ranks at the floor for 99.98% of forgotten samples.At identity level, all 1880 readings fall below the null and 1877 sit at the floor, motivating its use as a diagnostic with a positive control.Source: §B.13 · p. 26, Figure 6 · p. 26
  • Core-versus-reference-family distributions are needed because one pair of numbers cannot support indistinguishability.The comparison uses each family’s five leave-one-out readings; retrieval-preserving baselines have true-positive-rate gaps two orders of magnitude larger.Source: §B.13 · p. 27
  • At 1% false positives, Core’s RMIA true-positive rates are 0.010, 0.017, and 0.020 across the three benchmarks, versus 0.012, 0.004, and 0.011 for the reference.The consolidated Full payload is detected at 0.382, 0.205, and 0.184; chance is 0.010.Source: Table 19 · p. 27, §B.13 · p. 27
  • Against planted violations, aggregate Forgetting-Rank separates from the null at 5% and above but misses 2%; identity-level ROC-AUC exceeds 0.99 at every tested fraction.At 2%, it localizes 13 of 14 kept identities; the membership attacks also fail to resolve that fraction.Source: §B.13 · p. 28, Table 20 · p. 28
  • The planted-violation controls use a 90% deletion split and MoME-Core shadows, whose 0.0079 spread is far narrower than the deployed retrain family’s 0.085.Their σ values describe test power, not the uncertainty band for a deployed audit.Source: §B.13 · p. 28

Related papers

Loading 2610.36858v1…