The BatchNorm Illusion: Diagnosing Normalization Artifacts in Machine Unlearning Evaluation
Aaryaman Kalani, Murari Mandal, Dhruv Kumar, Mohan Kankanhalli, Yash Sinha
cs.LG
Quick verdict
Claims a weight-free BN pass reverses apparent forgetting in unlearning (up to 78pp); convincing controls, but key tables single-seed, no code release.
Summary
The paper identifies an evaluation confound in approximate machine unlearning on BatchNorm architectures: recomputing BN running statistics with a single forward pass over retain data (torch update_bn) changes no weights yet reverses reported forget-class accuracy by up to 78 percentage points (BadTeacher, CIFAR-10) in six of nine evaluated methods. The authors formalize recalibration as a weight-preserving, idempotent fixed-point operator, arguing any pre/post metric gap is provably attributable to BN statistics rather than weights, and derive a decomposition of linear-probe elevation into a BN-measurement-bias term and an encoder-geometry residual; on CIFAR-100, GA/SalUn/SSD show large negative BN-residuals (-20 to -30pp) masking positive encoder residuals (+14 to +17pp). Adversarially, ten unlabeled images restore most masked accuracy (BadTeacher 88.7%, NoiseInject 91.0%, SalUn 54.4%), including with out-of-distribution recalibration data. GroupNorm and ViT-LayerNorm controls yield exactly zero gap, supporting BN-specificity. Limitations: three seeds for the main CIFAR-10 table but single seeds for the decomposition, CIFAR-100, GroupNorm and ImageNet-100 results; one hyperparameter setting per method; the GroupNorm control is partially vacuous since five of eight GN methods never entered a forgetting regime; membership-inference AUCs are essentially unchanged, bounding privacy impact; and no code release is stated.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A single weight-preserving forward pass over retain data (BN recalibration) reverses apparent forget-class accuracy by up to 78pp in six of nine methods, and the induced gap is provably attributable to BN running statistics rather than weights (Theorem 1, Corollary 1).
- Linear-probe elevation decomposes uniquely into a BN-measurement-bias term and an encoder-geometry term; on CIFAR-100, GA/SalUn/SSD have BN-residuals of -20 to -30pp masking +14 to +17pp encoder residuals (Proposition 1, Table 2).
- An attacker holding the checkpoint recovers most masked forget accuracy with ten unlabeled images (BadTeacher 88.7%, NoiseInject 91.0%, SalUn 54.4%), including with out-of-distribution recalibration data (78-95% ratio, Table 10).
- The artifact is normalization-specific and metric-specific: GroupNorm and ViT/LayerNorm controls show exactly zero gap, and membership-inference AUCs change by at most 0.012 (Appendix O), locating the failure in forget accuracy and linear probing.
Strengths
Decisive, cheap diagnostic with airtight attribution logic
The opening demo (SalUn forget accuracy 3.0% to 65.1% via update_bn with zero weight changes) and Theorem 1 + Corollary 1 make the pre/post gap provably a BN-state effect; the whole control costs one gradient-free forward pass.
Rigorous mechanistic falsification controls
GroupNorm control gives Delta-F exactly 0.00 across methods (Table 6), ViT-S/16 LayerNorm verifies the operator is the identity (Appendix M), and the effect transfers across architecture and scale: ResNet-50/Tiny-ImageNet BadTeacher +82.2pp, ImageNet-100 +92.0pp (Appendices L, T).
Unusually honest error reporting
Concrete security framing with minimal attacker budget
Actionable remediation taxonomy
Weaknesses
Single-seed fragility of the quantitative core
Proposition 1 oversells a trivial identity
Operating-point dependence of the headline
GroupNorm control partially vacuous
No code/checkpoint release; bounded privacy relevance
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper targets the evaluation of approximate machine unlearning on BatchNorm-based CNNs. Its central claim: a single weight-preserving forward pass over retain data (BN recalibration via torch.optim.swa_utils.update_bn) deterministically rewrites the model's normalization state and reverses reported forgetting by 19-78pp in six of nine methods, worst case +78.2pp for BadTeacher on CIFAR-10 (Table 1). The theory layer formalizes recalibration as an idempotent, weight-preserving fixed-point operator (Theorem 1), converts this into an attribution claim for any pre/post metric gap (Corollary 1), and splits linear-probe elevation into a BN-measurement-bias term and an encoder-geometry residual (Proposition 1, Table 2). Empirical claims span CIFAR-10/100, Tiny-ImageNet and ImageNet-100 transfers, GroupNorm and ViT-LayerNorm controls, an adversarial recovery experiment, and a null result for membership inference.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the BatchNorm illusion in machine unlearning?
It is an evaluation artifact where an unlearned model appears to have forgotten a class partly because its BatchNorm running statistics have become inconsistent with its weights. Recomputing the BN statistics with one forward pass over retain data - changing no weights at all - restores forget-class accuracy (by up to 78 percentage points in this paper), revealing that the apparent forgetting was largely a measurement artifact rather than true erasure.
How many images does an attacker need to undo class unlearning?
In this paper's threat model, an attacker who has the released model checkpoint needs only ten unlabeled natural images. Running a single BN-recalibration forward pass on them recovered 88.7% forget-class accuracy for BadTeacher and 91.0% for NoiseInject on CIFAR-10, with no labels, no gradient updates, and no access to the original training data.
Does BN recalibration mean all unlearning methods are broken?
No. In the paper's CIFAR-10 experiments, three of the nine methods (SCRUB, GA at 500 steps, and GA+FT) show near-zero gap, but for different reasons: SCRUB genuinely forgets while preserving accuracy, GA destroys retain accuracy, and GA+FT effectively recalibrates itself during fine-tuning. The paper argues evaluations should report pre- and post-recalibration metrics plus retain accuracy to distinguish these regimes, not that every method is invalid.
Does this affect privacy guarantees like GDPR erasure?
Partly. The paper shows the standard surface metric is unreliable and that class-level capability is cheaply recoverable from a released checkpoint, which challenges capability-based erasure claims. However, the membership-inference attacks tested were essentially unchanged after recalibration (AUC shifts of at most 0.012), so the demonstrated risk is class capability restoration rather than per-individual membership leakage. The authors note that defending against a checkpoint-holding attacker requires architectural changes such as GroupNorm or LayerNorm.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure 1 and Figure 2 image content is not visible in the text extraction (captions only); all quantitative claims in this review were verified against extracted tables instead.
- Table 5 (CIFAR-100 5-class) shows only the Retrain/SCRUB/GA/SalUn rows and Appendix E has no body content in the extraction; rows for the remaining methods may have been dropped by PDF parsing, so no 5-class numbers beyond those four methods are cited here.
- Mathematical notation is locally garbled by PDF extraction (e.g., Eqs. 1, 7, 10); this does not affect the review's judgments, which rely on the prose and tables.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.