An unlearning audit found 47 of 221 released checkpoints move past their own seed spread just by refitting batch-norm statistics.

arXiv 2609.11490 points out that unlearning verdicts are read off numbers published by an unlearned model and its retrained reference, and both ship batch-normalization statistics that no gradient step wrote and no release records. Refitting those stats on kept data at bit-identical weights moves 47 checkpoints past the spread their own release's seeds show, sometimes inside a method whose average doesn't move. It isn't removed data surviving in the state: swapping kept records for removed ones inside a fixed fitting pool barely moves a published cell, while drift between the shipped state and any refit does track it. Twelve published verdicts flip. If your evaluation reads any number off a released artifact, ask what in that artifact no gradient wrote.