研究审计263个模型检查点，发现数据去失后模型状态未真正改变
Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpoints
朋友，这个研究挺有意思的，它审计了263个模型检查点，发现模型去失数据后，发布的状态和重新训练的状态不一样，说明模型状态本身可能发生了变化。
这项研究审计了263个已发布的批归一化模型检查点，发现当模型去失数据后，其发布状态与重新训练的参考模型存在差异。通过在保留数据上重新拟合这些检查点，有47个检查点超过了其发布种子显示的分布范围，表明检查点的属性发生了变化而非方法本身。研究指出，模型发布状态的变化并非被移除的数据在模型中存活，而是模型状态本身发生了漂移。
Published Unlearning Numbers Move Per Checkpoint, and Not Because the Removed Data Survives: An Audit of 263 Released Batch-Normalized Checkpoints
An unlearning audit reads its verdict off numbers that an unlearned model and its retrained reference each publish, and both also ship batch-normalization statistics that no gradient step wrote and no release records. Refitting them on kept data at bit-identical weights moves 47 of 221 released checkpoints past the spread their own release's seeds show, several inside a method whose average does not move: what moves is the checkpoint's property, not its method's. What does the moving is not the removed data surviving in the state: exchanging kept records for removed ones inside a fixed fitting pool moves a published cell by almost nothing, while how far a checkpoint's shipped state has drifted from any refit does track it. The consequence for a published decision is real but narrow: twelve verdicts cross, four clear a measured recalibration budget, two clear it on every replicate, and a population we trained and sited near its own criterion yields none. A release should therefore name the fitting convention beside the number, on the batch-normalized vision models where this channel exists.