Phantom Forgetting: How BatchNorm State Fakes Deletion in Edge Split Machine Unlearning

arXiv:2610.34800v1 [cs.CR] 26 Oct 2026

Phantom Forgetting: How BatchNorm State Fakes Deletion in Edge Split Machine Unlearning Anand Agrawal

Chillara Anil Kumar

Mandan Naresh

SUTD, Singapore Singapore agrawal anand@sutd.edu.sg

SRM University-AP, Andhra Pradesh India anilkumar.c@srmap.edu.in

Manipal Institute of Technology, Manipal, India mandan.naresh@manipal.edu

Abstract—Split learning is a natural fit for edge intelligence: a resource-constrained edge device runs the first layers of a network and offloads the remainder to a server, so that raw data never leave the device. When such a system must unlearn revoked or sensitive data for example to honor a right-to-erasure request, the deletion is commonly assessed through changes in forgetset accuracy. However, inference on an edge–server split also depends on non-learnable model state distributed across the two parties, and this state is especially volatile on edge devices subject to data drift, over-the-air updates, and checkpoint rollback. This paper isolates a state-integrity question with direct edgesecurity implications: can Batch Normalization (BN) running statistics create a target-specific forgetting signal even when every learnable weight remains fixed? We define a state-only diagnostic that separates learnable-parameter change from BNbuffer change and localizes the effect to the edge (client) side, the server side, and joint placements. We also introduce a stateinduced forgetting gap (SIFG) that discounts simultaneous retainset degradation. Over all ten CIFAR-10 forget classes, centralized BN recalibration on forget data reduces mean forget accuracy by 61.50 percentage points with zero weight change; in a split model, edge-only, server-only, and joint recalibration produce mean drops of 37.27, 41.71, and 51.90 points. The server-side state yields the largest selective gap relative to retain degradation, while joint recalibration causes the largest overall prediction change. These results establish distributed normalization buffers including those held on the edge device as security and privacyrelevant inference state, and show that forget accuracy should not be interpreted, or accepted as a deletion certificate, without an explicit edge-aware state-integrity audit. Index Terms—Edge computing, edge security, split learning, machine unlearning, Batch Normalization, model-state integrity, verification, apparent forgetting, privacy.

I. I NTRODUCTION Edge intelligence pushes model inference and, increasingly, model updates onto resource-constrained devices such as phones, wearables, cameras, and IoT sensors [18], [19], [24]. Because these devices cannot host large models and must keep sensitive data local, a common design partitions the network so that the device computes an early representation and a server completes the remaining forward and backward computation. This partitioning underlies both DNN offloading systems such as Neurosurgeon [20] and split learning [7], [8], [21], where the client sends a smashed activation instead of raw input. The deployed prediction therefore depends on state held on both sides of the edge–server communication boundary.

Edge deployments must also support deletion. Privacy regulation grants individuals a right to erasure [25], and machine unlearning aims to remove the influence of revoked or unauthorized training data without rebuilding a model from scratch [1]–[3]. In distributed and edge settings the problem is not only how to modify the model but also how to verify that an observed behavioral change represents removal rather than an unrelated alteration of the deployed system [4]–[6]. This is acute in split learning, where recent work shows the systems cost of coordinating model-state updates across the boundary [9] and where the edge client is often the least trusted and least controlled component of the pipeline [23]. A widely used verification signal is the reduction in accuracy on the forget distribution: a large reduction is read as evidence that the target information has been removed. This interpretation is incomplete for models that contain Batch Normalization (BN). At inference time, BN uses running means and variances that are updated from data but are not learnable parameters [10]; re-estimating these buffers can alter downstream representations and predictions without changing any trained weight. Test-time adaptation and post-training recalibration confirm that normalization state can strongly influence behavior under distribution shift [11]–[14], precisely the regime edge devices operate in. On an edge–server split the concern is amplified because normalization buffers may reside on the edge client, on the server, or on both. A verifier that checks only final outputs, or only weight tensors, may miss a behaviorally significant change in the operational model. The risk needs no attacker: legitimate recalibration, over-the-air (OTA) checkpoint updates applied non-atomically to a device fleet, on-device data drift, or inconsistent client/server state can all alter BN statistics. If the target-class accuracy then collapses, the change may be misattributed to unlearning, an edge device may appear to have “forgotten” a user’s data while the learned weights, and the information they encode, are untouched. This paper studies a deliberately narrow verification problem with concrete edge-security consequences: whether distributed BN state can generate target-specific apparent forgetting under zero learnable-weight change. The scope is diagnostic rather than algorithmic. We do not propose a new unlearning optimizer, compare complete unlearning mechanisms, or claim privacy-level removal. Instead, we treat BN

buffers as security and privacy-relevant inference state and test whether a verifier that observes only forget accuracy can be misled by state updates. The contributions are fourfold: • We formulate an edge-aware state-integrity threat model for split machine unlearning in which learnable parameters remain fixed but edge-side or server-side BN buffers drift. • We define a state-only diagnostic that reports parameter change and BN-buffer change separately, together with forget, retain, test, and prediction-disagreement metrics. • We introduce the state-induced forgetting gap (SIFG), which measures target-specific apparent forgetting after discounting retain-set degradation. • We localize the effect experimentally across centralized, edge-only, server-only, and joint edge–server BN recalibration over all ten CIFAR-10 forget classes, and translate the findings into edge-deployment failure scenarios and minimum verification requirements. II. R ELATED W ORK A. Edge Intelligence and Split Learning Edge computing moves computation close to data sources to reduce latency and protect privacy [18], [19]. For deep models this motivates partitioning the network between an edge device and a server: Neurosurgeon selects a split point to balance device compute and communication [20], split computing surveys catalog such device–server pipelines [21], and split learning transmits a smashed activation so that raw data stay on the device [7], [8]. SplitFed combines split and federated learning for multi-device edge fleets [22]. Security studies of the edge highlight that the on-device component and the device–server channel form a distinct attack surface [23]. These works establish the edge–server boundary as a firstclass systems and security concern; we add that non-learnable inference state on this boundary is itself a verification hazard. B. Machine-Unlearning Verification Early unlearning work focused on efficiently removing data influence or approximating retraining without the deleted samples [1]–[3]. Verification-oriented research later emphasized that a behavioral change alone is not a sufficient definition of removal. Athena evaluates probabilistic evidence of unlearning, and VeriFi studies verifiable federated unlearning with observable evidence beyond a single utility metric [4], [6]; auditable definitions require the evaluator to state what property is tested and which components may change [5]. Split unlearning extends deletion to the partitioned setting and quantifies the cost of coordinated cross-boundary updates [9]. Our work follows this verification perspective but focuses on a specific state confound, localized to the edge and server sides, rather than proposing a general certification mechanism. C. Split-Learning Security and Normalization-State Sensitivity Security studies of split learning examine leakage and malicious behavior at the device–server boundary, including

TABLE I M ODEL - STATE CASES RELEVANT TO EDGE – SERVER VERIFICATION . ∆θ

∆B

Output

Interpretation

0 >0 0 >0

0 0 >0 >0

None Possible Possible Possible

Unchanged under fixed execution. Weight update with fixed BN. State-only apparent forgetting. Mixed update; separate effects first.

pseudo-client functionality, data stealing, and backdoor attacks against vertical split learning [15], [16]. Our concern is complementary: even without protocol compromise, nonlearnable inference state can create a misleading verification outcome. Separately, BN uses batch statistics during training and running statistics during inference [10]; these buffers are stored in the model state but are not optimized by gradient descent. Post-training BN recalibration can alter or recover performance, and test-time normalization methods manage statistics under distribution shift [11]–[14], conditions endemic to edge fleets. We connect this behavioral sensitivity to splitunlearning verification and localize it across the distributed edge–server boundary. III. M ODEL S TATE AND T HREAT M ODEL A. Edge–Server Split Model Let the edge (client) model fc map an input x to a smashed activation z, and let the server model fs produce the outputscore vector s: z = fc (x; θc , Bc ),

s = fs (z; θs , Bs ),

(1)

where θc , θs are learnable parameters and Bc , Bs are stateful normalization buffers held on the edge device and the server, respectively. The complete model is F (x; θ, B) = fs (fc (x; θc , Bc ); θs , Bs ) ,

(2)

with θ = (θc , θs ) and B = (Bc , Bs ). Here F (x; θ, B) ∈ RK is the score vector for K classes and ŷF (x) = arg maxk [F (x; θ, B)]k is the predicted class. Let Df be the forget set and Dr the retain set. An unlearning-related operation may modify learnable parameters, BN buffers, or both. A behavioral verifier commonly observes overall test accuracy, retain accuracy, forget accuracy, and prediction disagreement; these outputs do not identify whether a change originates from θ, Bc , Bs , or broad model degradation. B. BN Buffers as Inference State For an activation a, inference-time BN applies a−µ + β, BN(a; µ, σ 2 , γ, β) = γ √ σ2 + ϵ

(3)

where µ and v = σ 2 are channel-wise running-statistic buffers, γ, β are learnable affine parameters, and ϵ > 0 is a stability constant. Let (θ′ , B ′ ) denote the state after recalibration or another model-state operation. We audit learnable state using
1/2 ∆θ = ∥θc′ − θc ∥22 + ∥θs′ − θs ∥22 , (4)

z

Edge client fc (x; θc , Bc )

Server fs (z; θs , Bs )

IV. S TATE -I NTEGRITY D IAGNOSTIC

Prediction and metrics

A. Behavioral Reductions and the SIFG For a model state G, let ŷG (x) = arg maxk [G(x)]k and define

state-only recalibration: ∆θ ≤ εθ , ∆BL > εB

Can BN state alone explain the forget drop? audit Rstate (L, q): behavior, ∆θ , location-specific BN drift

A(G; S) =

Fig. 1. Edge-aware state-integrity diagnostic. Selected edge-client and/or server BN buffers are recalibrated while all learnable parameters remain frozen, and the audit asks whether distributed BN state alone can account for an observed forget-accuracy drop.

where θ includes BN affine parameters and empty components are omitted for a centralized model. For j ∈ {c, s}, let LjBN be the BN layers at location j and define ∆µ,j =

X ∥µ′ℓ − µℓ ∥2 ,

∆v,j =

ℓ∈LjBN

X ∥vℓ′ − vℓ ∥2 ,

(5)

ℓ∈LjBN

with ∆Bj = ∆µ,j +∆v,j and ∆B = ∆Bc +∆Bs . The locationspecific BN-state change used in the audit is  ∆Ball ,    ∆ , Bc ∆B L =  ∆ Bs ,    ∆Bc + ∆Bs ,

L = all, L = c (edge), L = s (server), L = c+s.

1 X I[ŷG (x) = y], |S|

Dpred (F, G) =

1

X

I[ŷF (x) ̸= ŷG (x)].

|Dtest | (x,y)∈D test

For a centralized model ∆B = ∆Ball . The state-only diagnostic enforces ∆θ = 0 and ∆B > 0. With data, preprocessing, non-BN state, and execution settings fixed, any measured prediction change is attributable to the modified BN runningstate buffers.

(8)

We use Af (G) = A(G; Dftest ), Ar (G) = A(G; Drtest ), and Atest (G) = A(G; Dtest ). Let F0 be the corresponding BN unrecalibrated reference model and let FL,q denote the state obtained by recalibrating location L ∈ {all, c, s, c+s} using Dqcal , q ∈ {f, r}. For u ∈ {f, r}, BN δuBN (L, q) = Au (F0 ) − Au (FL,q ).

(9)

A large δfBN (L, q) under zero parameter change demonstrates that a behavioral forgetting signal can be generated without modifying learned weights. To discount retain degradation we define the state-induced forgetting gap SIFG(L, q) = δfBN (L, q) − δrBN (L, q).

(6)

(7)

(x,y)∈S

(10)

A positive SIFG means the forget distribution degrades more strongly than the retain distribution. For a pre-specified threshold τf > 0 and tolerances εθ , εB ≥ 0, an observation is stateconfounded when δfBN (L, q) ≥ τf , ∆θ ≤ εθ ,

SIFG(L, q) > 0,

∆BL > εB .

(11)

In the controlled experiments parameter equality is exact, so εθ = 0. This label is diagnostic rather than a privacy or removal certificate.

C. Edge-Aware Verification Threat B. Localization States The verifier may be a system operator, internal auditor, compliance authority, or external evaluator. We assume no poisoning, model extraction, test manipulation, or protocol compromise. The threat arises when a legitimate state transition of the kind routinely produced by edge operation is interpreted incorrectly. Table I distinguishes four cases. A weak verifier accepts a large forget-accuracy reduction as successful removal. A state-aware verifier instead asks whether the same behavior occurs in the third row of Table I: if it does, forget accuracy is confounded by normalization state and cannot independently identify parameter-level unlearning. Because the edge client is frequently updated out of band and rarely re-audited weight-by-weight, its BN buffers are a particularly plausible and particularly consequential source of this confound. Fig. 1 summarizes the diagnostic.

We evaluate centralized (L = all), edge-only (L = c), server-only (L = s), and joint edge–server (L = c+s) recalibration. Non-selected BN layers preserve their original buffers, and a retain-data control is included centrally to distinguish calibration-distribution effects from repeated evaluation. The location-specific report is BN Rstate (L, q) = Af , Ar , Atest , Dpred (F0 , FL,q ),
∆θ , ∆Bc , ∆Bs , SIFG ,

(12)

BN evaluated at FL,q ; for L = all the pair (∆Bc , ∆Bs ) collapses to the single quantity ∆Ball . This optimizer-independent report tests whether deployed state provides an alternative explanation for the observed behavior.

Algorithm 1 Location-Aware BN State Audit Require: F0 , Dqcal (q ∈ {f, r}), L ∈ {all, c, s, c+s} BN 1: Copy F0 to FL,q ; freeze all learnable tensors. 2: Set the model to evaluation mode; set only BN modules at L to training mode. 3: Traverse Dqcal under no-gradient execution to update selected running statistics. 4: Restore evaluation mode and compute Rstate (L, q). Ensure: ∆θ ≤ εθ and every non-selected buffer is unchanged.

V. E XPERIMENTAL M ETHOD A. Dataset and Forget Distributions We use CIFAR-10 [17]. For each class cf ∈ {0, . . . , 9}, training samples with label cf form the forget distribution and the remaining classes form the retain distribution. Let Dqcal ⊆ Dqtrain , q ∈ {f, r}, be the calibration samples used to update BN running statistics; held-out test samples are used only for evaluation and never for recalibration. Forget and retain accuracies are measured on their corresponding held-out test partitions. Reported values are mean ± standard deviation across the ten choices of cf ; the variation therefore represents class-wise sensitivity rather than random-seed variation. B. Models and Recalibration We reuse fixed 50-epoch checkpoints and a common data pipeline; no checkpoint is retrained or tuned for this study. The centralized diagnostic uses a compact BN convolutional network. In the split network the edge client contains 32- and 64-channel BN feature blocks and transmits the 64-channel smashed activation, while the server contains a 128-channel BN block followed by classification. This placement permits independent edge-only, server-only, and joint recalibration and mirrors an edge deployment in which shallow layers run ondevice. For every state-only experiment, all learnable tensors, including BN affine parameters, are frozen. The complete model is first placed in evaluation mode, after which only the selected BN modules are placed in training mode. A single gradientfree traversal of the designated training partition updates the selected running means and variances: |Dfcal | = 5000 for the current forget class and |Drcal | = 45000 for the centralized retain control. Each derived state starts from its corresponding unchanged checkpoint F0 . Full model-state dictionaries are retained for integrity checking; the reported ∆B includes the inference-active running-mean and running-variance buffers, while framework bookkeeping buffers are checked separately and excluded from the drift score. C. Audit Procedure Algorithm 1 derives every recalibrated state from its corresponding F0 and verifies parameter equality rather than assuming that disabling the optimizer is sufficient. With evaluation data, preprocessing, non-BN state, and execution settings fixed, ∆θ = 0 and unchanged non-selected buffers attribute

the measured difference to the selected BN location. We report test, retain, and forget accuracy because a target-class collapse may coexist with broad utility loss, and we additionally report prediction disagreement because accuracy can hide substantial label changes that cancel in aggregate. The SIFG derived from forget and retain reductions captures selectivity but is not used to suppress the underlying metrics. The exact scripts, configuration, and per-class result summaries are maintained in a version-controlled reproducibility package for release with the final paper. VI. R ESULTS Table II summarizes the centralized and split-location experiments. A. Centralized State-Only Apparent Forgetting The original centralized model attains mean forget accuracy 0.7357. Recalibrating only BN running statistics on forget data reduces it to 0.1207, a 61.50-point drop, while ∆θ = 0. Retain accuracy decreases by only 8.60 points, giving a SIFG of 0.5290, and the post-recalibration model changes its prediction on 33.61% of test samples. The retain-data control behaves differently: recalibration on retain samples leaves test and retain accuracy close to the original values and increases mean forget accuracy to 0.8096. Its negative SIFG shows that the calibration distribution, not repeated evaluation alone, determines the effect. For any τf ≤ 0.6150 and εB below the measured BN change, the centralized forget-data result satisfies (11) with exact parameter equality (εθ = 0). B. Edge and Server Localization In the split model both sides independently produce substantial forget-class collapse. Edge-only recalibration reduces forget accuracy from 0.7411 to 0.3684, and server-only recalibration reduces it to 0.3240; the corresponding forget drops are 0.3727 and 0.4171. The server-side state produces the largest selective effect: retain accuracy decreases by only 0.0209, giving a SIFG of 0.3962. Thus server BN buffers can create a strong target-specific behavioral signal even though they are downstream of the smashed-activation boundary. The edgeonly setting produces more prediction disagreement but also more retain degradation, yielding a smaller SIFG of 0.2624. Joint recalibration produces the largest overall forget drop, 0.5190, and the largest prediction disagreement, 0.4195; its SIFG, 0.3710, is lower than the server-only value because retain accuracy also falls by 0.1480. The placement causing the largest accuracy collapse is therefore not necessarily the placement causing the most selective state-only effect—an important distinction when an edge fleet and a server can drift independently. C. Class-Wise Stability and Disagreement Paired class-wise forget-drop standard deviations, computed directly from the ten per-class reductions, are 0.1299 (serveronly), 0.2633 (edge-only), and 0.2077 (joint). Server-side apparent forgetting is therefore not only selective on average

TABLE II S TATE - ONLY BN RECALIBRATION OVER TEN CIFAR-10 FORGET CLASSES . ACCURACIES AND DISAGREEMENT ARE MEAN ± STANDARD DEVIATION ; REDUCTIONS AND SIFG ARE DIFFERENCES OF THE REPORTED MEANS . S PLIT ROWS USE FORGET- DATA RECALIBRATION , AND ALL RECALIBRATED STATES SATISFY ∆θ = 0. Test

Retain

Forget

δfBN

δrBN

SIFG

Dpred

Original Forget recal. Retain recal.

0.7425±0.0152 0.6036±0.0346 0.7445±0.0109

0.7433±0.0193 0.6573±0.0384 0.7373±0.0150

0.7357±0.1016 0.1207±0.0289 0.8096±0.0755

– 0.6150 −0.0739

– 0.0860 0.0060

– 0.5290 −0.0799

0.0000±0.0000 0.3361±0.0438 0.1791±0.0211

Original Edge BN (c) Server BN (s) Joint BN (c+s)

0.7427±0.0114 0.6061±0.0392 0.6821±0.0446 0.5575±0.0713

0.7428±0.0186 0.6325±0.0434 0.7219±0.0481 0.5948±0.0717

0.7411±0.1170 0.3684±0.2225 0.3240±0.0880 0.2221±0.1538

– 0.3727 0.4171 0.5190

– 0.1103 0.0209 0.1480

– 0.2624 0.3962 0.3710

0.0000±0.0000 0.3468±0.0507 0.2505±0.0634 0.4195±0.0948

Setting

State

Centralized

Split (edge/server)

TABLE III C ENTRALIZED BN- STATE DRIFT AND BEHAVIOR ( TEN - CLASS MEANS ). ∆B = ∆ µ + ∆ v . Calibration Forget Retain

∆µ

∆v

∆B

δfBN

Dpred

1.5388 1.2092

3.7875 3.6197

5.3263 4.8289

0.6150 −0.0739

0.3361 0.1791

but also more stable across classes in this model, whereas edge-side sensitivity varies substantially with the selected class. The disagreement statistics reinforce this: server-only recalibration changes fewer test predictions than edge-only (0.2505 vs. 0.3468) while producing a larger forget drop, consistent with the SIFG reading that the server update is more concentrated on the target behavior. Joint recalibration changes the largest fraction of predictions, indicating that simultaneous state movement across the edge–server boundary has the broadest effect. D. State-Change Magnitude Does Not Predict Behavior Table III reports the centralized running-mean and runningvariance drift. Forget-data recalibration has magnitude 5.3263, only about 10.3% above the retain-data value 4.8289, yet their forget-accuracy effects are opposite: 0.6150 versus −0.0739. The drift score ∆B confirms that state changed but does not reveal which activation distribution shaped the statistics or which decisions will be affected. Similar magnitudes can point in different directions in state space and produce different class behavior, so state-change thresholds must be accompanied by calibration provenance and behavioral measurements—an edge integrity check that hashes buffer sizes or norms alone is insufficient. E. Verification Consequences The results establish four points. Forget accuracy is stateconfounded: drops above 50 points occur with unchanged learnable parameters. The confound is distributed: either edge or server buffers can independently change predictions. Calibration provenance matters: forget-data and retain-data recalibration have opposite target effects. Finally, collapse magnitude and selectivity differ: joint recalibration maximizes

the forget drop, whereas server-only recalibration maximizes SIFG. These findings motivate a minimum state-integrity report for split machine unlearning. A large forget drop accompanied by ∆θ = 0 should be labeled state-induced apparent forgetting, not certified removal, and the report is compatible with any unlearning optimizer because it evaluates the deployed model state rather than prescribing how the model must be updated. VII. E DGE O PERATIONAL FAILURE S CENARIOS The state-only mechanism can appear in several edge deployment scenarios even when the intended unlearning algorithm does not modify BN buffers. Evaluation-mode leakage on-device. An edge client or server component may remain in training mode during postupdate validation. Forwarding forget-distribution batches then changes running statistics even though gradients and optimizer steps are disabled. The evaluator may believe the model is frozen because θ is unchanged, while Bc or Bs continues to evolve. Algorithm 1 treats this as an explicit counterfactual; a production pipeline should prevent it unless recalibration is deliberately requested. Non-atomic OTA deployment across a device fleet. Split models are shipped as multiple artifacts, and OTA updates to a heterogeneous edge fleet rarely land atomically. An edge checkpoint may be rolled back while the server retains newer BN statistics, or the server may restore weights without restoring its buffers. The resulting pair does not correspond to any coherently trained model state. Because edge-only and serveronly recalibration independently change forget behavior, a non-atomic deployment can create or suppress an apparent unlearning effect; a common version identifier must bind both sides and all state components. Incomplete on-device integrity measurement. A deviceattestation or model-integrity mechanism may hash serialized parameter tensors but exclude registered buffers, reporting the same identity for states that share θ but differ in B. Our experiments show that such states can disagree on more than 40% of test predictions under joint recalibration. Integrity metadata for an unlearning audit must therefore cover running means, running variances, and other persistent inference buffers, not

TABLE IV M INIMUM STATE - AWARE VERIFICATION REQUIREMENTS FOR EDGE – SERVER SPLIT UNLEARNING . Requirement

Evidence

Prevented failure

State identity

Version θ, Bc , Bs together

Location control Provenance

Edge, server, and joint diagnostics Record source, count, order, and layers Report Eq. (12), not Af alone

Mixed or stale edge/server checkpoint accepted as coherent Change attributed to the wrong partition Hidden or accidental buffer update State-induced collapse certified as removal

Joint decision

only trainable tensors and must do so on the edge device, where measurement is often weakest. Deliberate threshold manipulation. Although our primary threat model requires no adversary, the same mechanism can be exploited. An operator seeking to satisfy a forget-accuracy threshold could recalibrate BN on target-distribution samples while preserving all learned weights; a verifier that checks only Af would observe a strong forgetting signal. Verifying ∆θ , buffer provenance, retain behavior, and location-specific counterfactuals prevents this state-only change from being presented as parameter-level removal. VIII. S TATE -AWARE V ERIFICATION R EQUIREMENTS The measurements above convert into four concrete requirements for a split- and edge-unlearning verifier, summarized in Table IV. A model identifier should bind θ, Bc , and Bs and confirm that edge and server snapshots belong to one coherent version. Location-aware counterfactuals should restore or recalibrate BN state one side at a time, because either component can independently generate apparent forgetting. Audit records should also identify the calibration source, updated layers, sample count, and batch ordering. The acceptance decision must combine these state records with retain utility and prediction disagreement. When (11) holds, the supported conclusion is BN-confounded behavior; actual removal requires additional method-specific evidence. IX. S ECURITY D ISCUSSION AND L IMITATIONS A. Edge State Integrity as a Trust Boundary Split-learning security work commonly emphasizes rawdata confidentiality, smashed-activation leakage, and malicious protocols [15], [16], [23]. Our results identify persistent inference state held partly on the edge device as a complementary trust boundary. Authenticating only parameter tensors misses deployments that share θ but differ in BN buffers and behavior. The issue needs no adversary: on-device recalibration, distribution shift, recovery, or inconsistent checkpoint restoration across a fleet can produce false attribution. A practical edge verifier should preserve a pre-update snapshot of θ, Bc , and Bs , compare them separately, join edge/server reports by one version identifier, and execute Algorithm 1 when possible.

Where the edge device supports a trusted execution environment, binding the BN-buffer digest into device attestation would close the gap that parameter-only integrity checks leave open. B. Scope and Limitations The study isolates mechanism and location; it does not compare retraining or gradient-based unlearning, evaluate nonIID edge clients, or perform membership-inference audits. It uses CIFAR-10, compact convolutional models, and classwise rather than multi-seed aggregation. Additional datasets, architectures, normalization layers, seeds, heterogeneous edge fleets, and device-level integrity and attestation tests are needed to establish generality. SIFG is a behavioral diagnostic, not a privacy certificate, and must be combined with algorithmspecific and privacy evidence for data-removal claims. X. C ONCLUSION BatchNorm running statistics are distributed, security- and privacy-relevant state in split machine unlearning, and part of that state lives on the edge device. With learnable parameters frozen, forget-data recalibration caused a 61.50-point centralized drop and edge-only, server-only, and joint drops of 37.27, 41.71, and 51.90 points; server-side BN state had the highest SIFG. Forget accuracy alone cannot distinguish learned-weight removal from state drift, so edge–server splitunlearning evaluation must audit both the edge-client and the server BN buffers, bind them under a single version identity, and treat a forget-accuracy collapse under ∆θ = 0 as stateinduced apparent forgetting rather than certified deletion. R EFERENCES [1] Y. Cao and J. Yang, “Towards making systems forget with machine unlearning,” in Proc. IEEE Symp. Security and Privacy, 2015. [2] L. Bourtoule et al., “Machine unlearning,” in Proc. IEEE Symp. Security and Privacy, 2021. [3] C. Guo, T. Goldstein, A. Hannun, and L. van der Maaten, “Certified data removal from machine learning models,” in Proc. ICML, 2020. [4] D. M. Sommer, L. Song, S. Wagh, and P. Mittal, “Athena: Probabilistic verification of machine unlearning,” PoPETs, vol. 2022. [5] A. Thudi, H. Jia, I. Shumailov, and N. Papernot, “On the necessity of auditable algorithmic definitions for machine unlearning,” in USENIX Security, 2022. [6] X. Gao et al., “VeriFi: Towards verifiable federated unlearning,” IEEE Trans. Dependable Secure Comput., vol. 21, no. 6, 2024. [7] P. Vepakomma, O. Gupta, T. Swedish, and R. Raskar, “Split learning for health: Distributed deep learning without sharing raw patient data,” arXiv:1812.00564, 2018. [8] O. Gupta and R. Raskar, “Distributed learning of deep neural network over multiple agents,” J. Netw. Comput. Appl., vol. 116, 2018. [9] Y. Jiang et al., “Split unlearning,” in Proc. ACM CCS, 2025. [10] S. Ioffe and C. Szegedy, “Batch normalization: Accelerating deep network training by reducing internal covariate shift,” in Proc. ICML, 2015. [11] H. Lim, B. Kim, J. Choo, and S. Choi, “TTN: A domain-shift aware batch normalization in test-time adaptation,” in Proc. ICLR, 2023. [12] D. Tomar, G. Vray, J.-P. Thiran, and B. Bozorgtabar, “Un-mixing testtime normalization statistics,” in Proc. ICLR, 2024. [13] Z. Su et al., “Unraveling batch normalization for realistic test-time adaptation,” in Proc. AAAI, 2024. [14] G. Shomron and U. Weiser, “Post-training batchnorm recalibration,” arXiv:2006.12807, 2020. [15] X. Gao and L. Zhang, “PCAT: Functionality and data stealing from split learning by pseudo-client attack,” in USENIX Security, 2023.

[16] Y. Bai et al., “VILLAIN: Backdoor attacks against vertical split learning,” in USENIX Security, 2023. [17] A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” Univ. Toronto, Tech. Rep., 2009. [18] W. Shi, J. Cao, Q. Zhang, Y. Li, and L. Xu, “Edge computing: Vision and challenges,” IEEE Internet of Things J., vol. 3, no. 5, 2016. [19] Z. Zhou, X. Chen, E. Li, L. Zeng, K. Luo, and J. Zhang, “Edge intelligence: Paving the last mile of artificial intelligence with edge computing,” Proc. IEEE, vol. 107, no. 8, 2019. [20] Y. Kang et al., “Neurosurgeon: Collaborative intelligence between the cloud and mobile edge,” in Proc. ASPLOS, 2017, pp. 615–629. [21] Y. Matsubara, M. Levorato, and F. Restuccia, “Split computing and early exiting for deep learning applications: Survey and research challenges,” ACM Comput. Surv., vol. 55, no. 5, 2022. [22] C. Thapa, M. A. P. Chamikara, S. Camtepe, and L. Sun, “SplitFed: When federated learning meets split learning,” in Proc. AAAI, 2022. [23] Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu, and W. Lv, “Edge computing security: State of the art and challenges,” Proc. IEEE, vol. 107, no. 8, 2019. [24] Javier Mendez, Kay Bierzynski, M. P. Cuéllar, and Diego P. Morales. 2022. Edge Intelligence: Concepts, Architectures, Applications, and Future Directions. ACM Trans. Embed. Comput. Syst. 21, 5, Article 48 (September 2022), 41 pages. https://doi.org/10.1145/3486674 [25] European Parliament and Council, “Regulation (EU) 2016/679 (General Data Protection Regulation), Art. 17: Right to erasure,” Official Journal of the European Union, 2016.

Related documents

• Phantom Forgetting: How BatchNorm State Fakes Deletion in Edge Split Machine Unlearning#1457954
• Memory-Coupled Unlearning for Data-Absent Identity Forgetting#1324749
• Machine unlearning using forgetting neural networks#405948
• When Unlearning Fails: Reliable Data Deletion under Post-Training in Agent Networks#1343656
• Robust Synchronisation for Federated Learning in The Face of Correlated Device Failure#31240