发表机构
University of Alberta（阿尔伯塔大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
审计发现批归一化统计量重拟合可使部分已发布遗忘检查点的判定翻转，但并非因被移除数据残留，故发布时应注明拟合约定。
AI 中文摘要
一次遗忘审计通过读取被遗忘模型及其重训练参考各自发布的数字来得出判定，而两者还发布了未经任何梯度步骤写入且未被任何发布记录记载的批归一化统计量。在比特级相同的权重下，仅基于保留数据重新拟合这些统计量，会使221个已发布检查点中的47个超出其自身发布所用随机种子所展现的分布范围，其中若干属于某个平均结果不发生变化的内部方法：发生变化的正是检查点的属性，而非其方法。导致变化的原因并非被移除数据仍残留在状态中：在固定的拟合池内，将保留记录替换为被移除记录，几乎不会改变已发布的数值，而检查点已发布状态偏离任何重新拟合结果的程度却确实与此相关。对已发布判定而言，其影响是真实但有限的：十二个判定发生翻转，四个超出已测量的重新校准预算，其中两个在每次重复实验中都超出，而我们在其自身标准附近训练并定位的一个群体则未产生任何翻转。因此，在存在此通道的批归一化视觉模型上，发布时应同时注明拟合约定与数值。
英文摘要
An unlearning audit reads its verdict off numbers that an unlearned model and its retrained reference each publish, and both also ship batch-normalization statistics that no gradient step wrote and no release records. Refitting them on kept data at bit-identical weights moves 47 of 221 released checkpoints past the spread their own release's seeds show, several inside a method whose average does not move: what moves is the checkpoint's property, not its method's. What does the moving is not the removed data surviving in the state: exchanging kept records for removed ones inside a fixed fitting pool moves a published cell by almost nothing, while how far a checkpoint's shipped state has drifted from any refit does track it. The consequence for a published decision is real but narrow: twelve verdicts cross, four clear a measured recalibration budget, two clear it on every replicate, and a population we trained and sited near its own criterion yields none. A release should therefore name the fitting convention beside the number, on the batch-normalized vision models where this channel exists.
Comments38 pages, 4 figures, 26 tables. Independent of and concurrent with arXiv:2609.08901 (posted 8 Sep 2026): the instrument and protocol here were pre-registered on 29 Aug 2026; dated provenance in Appendix S
